@opengeni/api-router 3.0.0-canary.0 → 3.0.1-canary.0

package/src/integrations/atlassian.ts

@@ -1,7 +1,17 @@
+import {
+  withOrganizationIntegrationAcquisition,
+  withOrganizationIntegrationPolicyFence,
+} from "@opengeni/db/organization-integration-policy";
+import {
+  claimOAuthAcquisition,
+  finishOAuthAcquisition,
+  integrationSourceSelectionRequiresAcquisition,
+} from "./oauth-client";
 import {
   scheduledTaskKnowledgeSource,
   requireScheduledTaskKnowledgeSource,
   knowledgeSourceAgentConfig,
+  assertOrganizationIntegrationAllowed,
 } from "@opengeni/contracts";
 import type { Settings } from "@opengeni/config";
 import { createHash } from "node:crypto";
@@ -44,7 +54,6 @@ import {
   ConnectionDisconnectGenerationError,
   ConnectionDisconnectIdempotencyError,
   consumeIntegrationOAuthStateNonce,
-  claimConnectOperation,
   finishConnectOperation,
   getConnectAttempt,
   decryptEnvironmentValue,
@@ -132,6 +141,7 @@ export async function startAtlassianOAuth(
     externalContinuation?: ExternalActorContinuation;
   },
 ): Promise<AtlassianOAuthStartResponse> {
+  await withOrganizationIntegrationAcquisition(deps.db, input, ["atlassian"], async () => {});
   const oauth = requireAtlassianSettings(deps.settings);
   const existing = input.payload.connectionId
     ? await getConnectionMetadata(
@@ -208,12 +218,18 @@ export async function completeAtlassianOAuthCallback(
         operationId: `oauth:${state.nonce}`,
         inputDigest: createHash("sha256").update(input.state!).digest("hex"),
       };
-      const claim = await claimConnectOperation(deps.db, state, {
-        ...operation,
-        expectedRevision: stored.attempt.revision,
-        authorize: (tx, _attempt, origin) =>
-          requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
-      });
+      const claim = await claimOAuthAcquisition(
+        deps.db,
+        state,
+        {
+          ...operation,
+          expectedRevision: stored.attempt.revision,
+          authorize: (tx, _attempt, origin) =>
+            requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
+        },
+        "atlassian",
+        Boolean(input.code && !input.error),
+      );
       if (claim.status === "replayed") return { redirectTo: exactReturnUrl, exactReturn: true };
     }
     await requireCallbackGrant(deps, state);
@@ -247,6 +263,7 @@ export async function completeAtlassianOAuthCallback(
     }
     if (input.error) throw new AtlassianCallbackError("provider_denied");
     if (!input.code) throw new AtlassianCallbackError("missing_code");
+    await withOrganizationIntegrationAcquisition(deps.db, state, ["atlassian"], async () => {});
 
     const oauth = requireAtlassianSettings(deps.settings);
     const redirectUri = `${baseUrl}/v1/integrations/atlassian/callback`;
@@ -360,36 +377,46 @@ export async function completeAtlassianOAuthCallback(
           });
     };
     if (operation) {
-      await finishConnectOperation(deps.db, acceptedState, {
-        ...operation,
-        authorize: (tx, _attempt, origin) =>
-          requireConnectOwnerAuthority(tx, acceptedState, "connections:write", origin),
-        commit: async (tx, current) => {
-          const connection = await persist(tx);
-          if (!connection) throw new AtlassianCallbackError("connection_conflict");
-          return {
-            ...current,
-            revision: current.revision + 1,
-            state: "complete",
-            credentialsCommitted: true,
-            nextAction: { type: "none" },
-            account: {
-              id: connection.id,
-              version: connection.version,
-              providerId: "atlassian",
-              label: profile.displayName ?? "Atlassian",
-              ownership: "personal",
-              status: "connected",
-            },
-          };
+      await finishOAuthAcquisition(
+        deps.db,
+        acceptedState,
+        {
+          ...operation,
+          authorize: (tx, _attempt, origin) =>
+            requireConnectOwnerAuthority(tx, acceptedState, "connections:write", origin),
+          commit: async (tx, current) => {
+            const connection = await persist(tx);
+            if (!connection) throw new AtlassianCallbackError("connection_conflict");
+            return {
+              ...current,
+              revision: current.revision + 1,
+              state: "complete",
+              credentialsCommitted: true,
+              nextAction: { type: "none" },
+              account: {
+                id: connection.id,
+                version: connection.version,
+                providerId: "atlassian",
+                label: profile.displayName ?? "Atlassian",
+                ownership: "personal",
+                status: "connected",
+              },
+            };
+          },
         },
-      });
+        "atlassian",
+      );
       return { redirectTo: exactReturnUrl!, exactReturn: true };
     }
-    const connection = await deps.db.transaction(async (tx) => {
-      await requireCallbackGrant({ ...deps, db: tx }, acceptedState);
-      return persist(tx);
-    });
+    const connection = await withOrganizationIntegrationAcquisition(
+      deps.db,
+      acceptedState,
+      ["atlassian"],
+      async (tx) => {
+        await requireCallbackGrant({ ...deps, db: tx }, acceptedState);
+        return persist(tx);
+      },
+    );
     if (!connection) throw new AtlassianCallbackError("connection_conflict");
     return {
       redirectTo: returnUrl(returnBaseUrl, state.returnPath, "connected", connection.id),
@@ -705,9 +732,28 @@ export async function saveAtlassianSources(
     initiatingSubjectId: input.subjectId,
   });
 
-  const available = (await browseAtlassianSources(deps, input)).items;
+  const requestedSelection = parsed.data.sources.map((source) => ({
+    ...source,
+    destination,
+    syncCadence: parsed.data.syncCadence,
+    syncEnabled: parsed.data.syncEnabled,
+    readPolicy: parsed.data.readPolicy,
+  }));
+  const acquiring = integrationSourceSelectionRequiresAcquisition(
+    metadata.selectedSources,
+    requestedSelection,
+  );
+  if (acquiring) {
+    await withOrganizationIntegrationAcquisition(deps.db, input, ["atlassian"], async () => {});
+  }
+
+  const available =
+    acquiring && parsed.data.sources.length
+      ? (await browseAtlassianSources(deps, input)).items
+      : [];
   const availableById = new Map(available.map((source) => [source.id, source]));
   const verified = parsed.data.sources.map((source) => {
+    if (!acquiring) return source;
     const current = availableById.get(source.id);
     if (
       !current ||
@@ -724,28 +770,39 @@ export async function saveAtlassianSources(
     return current;
   });
   const previousSources = metadata.selectedSources;
-  const updated = await transitionConnectionState(deps.db, {
-    workspaceId: input.workspaceId,
-    connectionId: existing.id,
-    visibleToSubjectId: input.subjectId,
-    expectedVersion: existing.version,
-    metadata: AtlassianConnectionMetadata.parse({
-      ...metadata,
-      documentDestination: destination,
-      selectedSources: verified.map((source) => ({
-        ...source,
-        destination,
-        syncCadence: parsed.data.syncCadence,
-        syncEnabled: parsed.data.syncEnabled,
-        configGeneration:
-          (previousSources.find((previous) => previous.id === source.id)?.configGeneration ?? 0) +
-          1,
-        readPolicy: parsed.data.readPolicy,
-        selectedAt: new Date().toISOString(),
-      })),
-    }),
-    updatedBySubjectId: input.subjectId,
-  });
+  const updated = await withOrganizationIntegrationPolicyFence(
+    deps.db,
+    input,
+    async (tx, policy) => {
+      // The exact generation checked by transitionConnectionState binds this
+      // comparison to the row being changed. Provider verification already ended.
+      if (integrationSourceSelectionRequiresAcquisition(previousSources, requestedSelection)) {
+        assertOrganizationIntegrationAllowed(policy, "atlassian");
+      }
+      return transitionConnectionState(tx, {
+        workspaceId: input.workspaceId,
+        connectionId: existing.id,
+        visibleToSubjectId: input.subjectId,
+        expectedVersion: existing.version,
+        metadata: AtlassianConnectionMetadata.parse({
+          ...metadata,
+          documentDestination: destination,
+          selectedSources: verified.map((source) => ({
+            ...source,
+            destination,
+            syncCadence: parsed.data.syncCadence,
+            syncEnabled: parsed.data.syncEnabled,
+            configGeneration:
+              (previousSources.find((previous) => previous.id === source.id)?.configGeneration ??
+                0) + 1,
+            readPolicy: parsed.data.readPolicy,
+            selectedAt: new Date().toISOString(),
+          })),
+        }),
+        updatedBySubjectId: input.subjectId,
+      });
+    },
+  );
   if (!updated) throw new HTTPException(409, { message: "Atlassian connection changed" });
   await materializeSchedules(deps, {
     ...input,
@@ -783,14 +840,27 @@ export async function transitionAtlassianLifecycle(
   if (target === "paused") {
     await deauthorizeConnectionSources(deps, connection, input.subjectId, "connection_paused");
   }
-  const updated = await transitionConnectionState(deps.db, {
-    workspaceId: input.workspaceId,
-    connectionId: input.connectionId,
-    visibleToSubjectId: input.subjectId,
-    expectedVersion: connection.version,
-    metadata: AtlassianConnectionMetadata.parse({ ...metadata, lifecycle: lifecycle(target) }),
-    updatedBySubjectId: input.subjectId,
-  });
+  const persist = (tx: Database) =>
+    transitionConnectionState(tx, {
+      workspaceId: input.workspaceId,
+      connectionId: input.connectionId,
+      visibleToSubjectId: input.subjectId,
+      expectedVersion: connection.version,
+      metadata: AtlassianConnectionMetadata.parse({ ...metadata, lifecycle: lifecycle(target) }),
+      updatedBySubjectId: input.subjectId,
+    });
+  const updated =
+    target === "active"
+      ? await withOrganizationIntegrationPolicyFence(
+          deps.db,
+          { accountId: connection.accountId, workspaceId: input.workspaceId },
+          (tx, policy) => {
+            if ((metadata.lifecycle?.state ?? "active") !== "active")
+              assertOrganizationIntegrationAllowed(policy, "atlassian");
+            return persist(tx);
+          },
+        )
+      : await persist(deps.db);
   if (!updated) throw new HTTPException(409, { message: "Atlassian connection changed" });
   await setSchedulePause(deps, input.workspaceId, input.connectionId, target === "paused");
   return updated;

package/src/integrations/fiken.ts

@@ -1,3 +1,5 @@
+import { withOrganizationIntegrationAcquisition } from "@opengeni/db/organization-integration-policy";
+import { claimOAuthAcquisition, finishOAuthAcquisition } from "./oauth-client";
 import { safeReturnPath } from "./oauth-return-path";
 import type { ApiRouteDeps } from "@opengeni/core";
 import type { Settings } from "@opengeni/config";
@@ -30,7 +32,6 @@ import {
   encryptEnvironmentValue,
   decryptEnvironmentValue,
   getConnectAttempt,
-  claimConnectOperation,
   finishConnectOperation,
   getConnectionMetadata,
   listConnectionsMetadata,
@@ -63,7 +64,9 @@ const MAX_DRAFT_LINES = 100;
 const COMPANY_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,127}$/;
 
 /** Shared native/embedded token adapter. Provider verification happens before
- * persistence; the caller reauthorizes inside its durable commit transaction. */
+ * persistence; the caller reauthorizes inside its durable commit transaction.
+ * That caller must acquire the organization policy fence for `fiken` BEFORE
+ * owner/tenancy locks and invoke the returned writer with that exact tx. */
 export async function prepareFikenTokenInstall(
   deps: ApiRouteDeps,
   grant: Pick<AccessGrant, "accountId" | "workspaceId" | "subjectId">,
@@ -71,6 +74,7 @@ export async function prepareFikenTokenInstall(
   expectedVersion?: number,
 ): Promise<(tx: Database) => Promise<ConnectionMetadata>> {
   const payload = FikenInstallRequest.parse(raw);
+  await withOrganizationIntegrationAcquisition(deps.db, grant, ["fiken"], async () => {});
   const key = requireEnvironmentEncryption(deps.settings);
   const existing = payload.connectionId
     ? await getConnectionMetadata(deps.db, grant.workspaceId, payload.connectionId, null)
@@ -1102,6 +1106,7 @@ export async function startFikenOAuth(
     connectAttemptId?: string;
   },
 ): Promise<FikenOAuthStartResponse> {
+  await withOrganizationIntegrationAcquisition(deps.db, input, ["fiken"], async () => {});
   const fiken = requireFikenOAuthSettings(deps.settings);
   const existing = input.payload.connectionId
     ? await getConnectionMetadata(deps.db, input.workspaceId, input.payload.connectionId, null)
@@ -1168,12 +1173,18 @@ export async function completeFikenOAuthCallback(
         operationId: `oauth:${state.nonce}`,
         inputDigest: createHash("sha256").update(input.state!).digest("hex"),
       };
-      const claim = await claimConnectOperation(deps.db, state, {
-        ...operation,
-        expectedRevision: stored.attempt.revision,
-        authorize: (tx, _attempt, origin) =>
-          requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
-      });
+      const claim = await claimOAuthAcquisition(
+        deps.db,
+        state,
+        {
+          ...operation,
+          expectedRevision: stored.attempt.revision,
+          authorize: (tx, _attempt, origin) =>
+            requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
+        },
+        "fiken",
+        Boolean(input.code && !input.error),
+      );
       if (claim.status === "replayed") return { redirectTo: exactReturnUrl, exactReturn: true };
     }
     await requireFikenCallbackGrant(deps.db, state);
@@ -1217,6 +1228,7 @@ export async function completeFikenOAuthCallback(
     if (!input.code) {
       throw new FikenOAuthCallbackError("missing_code");
     }
+    await withOrganizationIntegrationAcquisition(deps.db, state, ["fiken"], async () => {});
     const fiken = requireFikenOAuthSettings(deps.settings);
     const key = requireEnvironmentEncryption(deps.settings);
     const fetchImpl = deps.fikenFetch ?? fetch;
@@ -1303,36 +1315,46 @@ export async function completeFikenOAuthCallback(
             createdBySubjectId: state!.subjectId,
           });
     if (operation) {
-      await finishConnectOperation(deps.db, state, {
-        ...operation,
-        authorize: (tx, _attempt, origin) =>
-          requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
-        commit: async (tx, current) => {
-          const connection = await persist(tx);
-          if (!connection) throw new FikenOAuthCallbackError("connection_conflict");
-          return {
-            ...current,
-            revision: current.revision + 1,
-            state: "complete",
-            credentialsCommitted: true,
-            nextAction: { type: "none" },
-            account: {
-              id: connection.id,
-              version: connection.version,
-              providerId: "fiken-oauth",
-              label: "Fiken",
-              ownership: "workspace",
-              status: "connected",
-            },
-          };
+      await finishOAuthAcquisition(
+        deps.db,
+        state,
+        {
+          ...operation,
+          authorize: (tx, _attempt, origin) =>
+            requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
+          commit: async (tx, current) => {
+            const connection = await persist(tx);
+            if (!connection) throw new FikenOAuthCallbackError("connection_conflict");
+            return {
+              ...current,
+              revision: current.revision + 1,
+              state: "complete",
+              credentialsCommitted: true,
+              nextAction: { type: "none" },
+              account: {
+                id: connection.id,
+                version: connection.version,
+                providerId: "fiken-oauth",
+                label: "Fiken",
+                ownership: "workspace",
+                status: "connected",
+              },
+            };
+          },
         },
-      });
+        "fiken",
+      );
       return { redirectTo: exactReturnUrl!, exactReturn: true };
     }
-    const connection = await deps.db.transaction(async (tx) => {
-      await requireFikenCallbackGrant(tx, state!);
-      return persist(tx);
-    });
+    const connection = await withOrganizationIntegrationAcquisition(
+      deps.db,
+      state,
+      ["fiken"],
+      async (tx) => {
+        await requireFikenCallbackGrant(tx, state!);
+        return persist(tx);
+      },
+    );
     if (!connection) {
       throw new FikenOAuthCallbackError("connection_conflict");
     }

package/src/integrations/github-app-connect.ts

@@ -4,7 +4,6 @@ import { HTTPException } from "hono/http-exception";
 import type { ConnectAdvance, ConnectAttempt } from "@opengeni/contracts/connect";
 import {
   bindAuthorizedGitHubInstallationRepositories,
-  claimConnectOperation,
   finishConnectOperation,
   getConnectAttempt,
   type ConnectActorScope,
@@ -23,7 +22,7 @@ import {
 import { commitGitHubLensConnect, requireGitHubLensConnect } from "./github-lens-connect";
 import type { ApiRouteDeps, PreparedConnectOperation } from "@opengeni/core";
 import { requireConnectOwnerAuthority } from "./connect-authority";
-import { integrationBaseUrl } from "./oauth-client";
+import { claimOAuthAcquisition, finishOAuthAcquisition, integrationBaseUrl } from "./oauth-client";
 import {
   isConsistentGitHubBindingCandidates,
   isConsistentGitHubBindingProof,
@@ -177,27 +176,40 @@ export async function completeGitHubAppConnect(
     const stored = await getConnectAttempt(deps.db, state, state.connectAttemptId);
     if (stored.attempt.providerId !== state.providerId || stored.attempt.ownership !== "workspace")
       throw new Error("GitHub attempt mismatch");
-    destination = stored.returnUrl;
     // Reject obsolete browser stages before committing an operation claim.
     // Otherwise a valid older callback could strand the current stage in-flight.
     // Completed callbacks still navigate home without repeating provider work.
-    if (
-      stored.attempt.nextAction.type !== "authorize" ||
-      new URL(stored.attempt.nextAction.url).searchParams.get("state") !== input.state
-    )
-      throw new Error("Stale GitHub setup stage");
-    if (state.providerId === "github-lens") await requireGitHubLensConnect(deps, state.workspaceId);
-    const authorize = callbackAuthority(state);
+    const authorize: ConnectOperationAuthorization = async (tx, attempt, origin) => {
+      await callbackAuthority(state)(tx, attempt, origin);
+      destination = stored.returnUrl;
+    };
+    const acquiring =
+      !input.error && (state.phase === "install" ? input.setupAction !== "request" : !!input.code);
     const operation = {
       attemptId: state.connectAttemptId,
       operationId: `github:${state.nonce}`,
       inputDigest: createHash("sha256").update(input.state!).digest("hex"),
       authorize,
     };
-    const claim = await claimConnectOperation(deps.db, state, {
-      ...operation,
-      expectedRevision: stored.attempt.revision,
-    });
+    const claim = await claimOAuthAcquisition(
+      deps.db,
+      state,
+      {
+        ...operation,
+        expectedRevision: stored.attempt.revision,
+        authorizeAcquisition: async (tx, current) => {
+          if (
+            current.nextAction.type !== "authorize" ||
+            new URL(current.nextAction.url).searchParams.get("state") !== input.state
+          )
+            throw new Error("Stale GitHub setup stage");
+          if (acquiring && state.providerId === "github-lens")
+            await requireGitHubLensConnect({ ...deps, db: tx }, state.workspaceId);
+        },
+      },
+      state.providerId,
+      acquiring,
+    );
     if (claim.status !== "replayed") {
       const provider =
         state.providerId === "github-lens" ? deps.prReviewGithubAppApi : deps.githubAppApi;
@@ -378,7 +390,14 @@ export async function completeGitHubAppConnect(
           },
         };
       }
-      await finishConnectOperation(deps.db, state, { ...operation, commit: prepared.commit });
+      if (acquiring)
+        await finishOAuthAcquisition(
+          deps.db,
+          state,
+          { ...operation, commit: prepared.commit },
+          state.providerId,
+        );
+      else await finishConnectOperation(deps.db, state, { ...operation, commit: prepared.commit });
     }
   } catch {
     // Preserve unknown outcomes; never replay provider authorization to recover.