@opengeni/api-router 3.0.0-canary.0 → 3.0.1-canary.0

package/src/routes/billing.ts

@@ -3,6 +3,8 @@ import {
   CreateBillingPortalResponse,
   CreateCheckoutRequest,
   CreateCheckoutResponse,
+  OrganizationUsageQuery,
+  OrganizationUsageWorkspacePageQuery,
   type AccessContext,
   type Permission,
 } from "@opengeni/contracts";
@@ -14,6 +16,9 @@ import {
   hasCreditLedgerEntry,
   isStripeWebhookProcessed,
   listUsageEvents,
+  getOrganizationUsageSummary,
+  getOrganizationUsageWorkspacePage,
+  withSessionRlsActorContext,
   getManagedAccount,
   markStripeWebhookProcessed,
   recordStripeWebhookEvent,
@@ -24,6 +29,7 @@ import { HTTPException } from "hono/http-exception";
 import Stripe from "stripe";
 import { requireAccessContext } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
+import { withAccessGrantSessionRlsContext } from "../access-grant-rls";
 
 export function registerBillingRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/billing", async (c) => {
@@ -57,6 +63,33 @@ export function registerBillingRoutes(app: Hono, deps: ApiRouteDeps): void {
     });
   });
 
+  app.get("/v1/billing/usage-summary", async (c) => {
+    const context = await requireAccessContext(c, deps);
+    const accountId = requireSelectedAccount(context, c.req.query("accountId"), "billing:read");
+    const parsed = OrganizationUsageQuery.safeParse(c.req.query());
+    if (!parsed.success) {
+      throw new HTTPException(400, {
+        message: parsed.error.issues[0]?.message ?? "invalid usage query",
+      });
+    }
+    return await withBillingUsageActor(deps, context, accountId, async () =>
+      c.json(await getOrganizationUsageSummary(deps.db, { accountId, ...parsed.data })),
+    );
+  });
+
+  app.get("/v1/billing/usage-workspaces", async (c) => {
+    const context = await requireAccessContext(c, deps);
+    const accountId = requireSelectedAccount(context, c.req.query("accountId"), "billing:read");
+    const parsed = OrganizationUsageWorkspacePageQuery.safeParse(c.req.query());
+    if (!parsed.success)
+      throw new HTTPException(400, {
+        message: parsed.error.issues[0]?.message ?? "invalid usage page query",
+      });
+    return await withBillingUsageActor(deps, context, accountId, async () =>
+      c.json(await getOrganizationUsageWorkspacePage(deps.db, { accountId, ...parsed.data })),
+    );
+  });
+
   app.get("/v1/billing/entitlements", async (c) => {
     const context = await requireAccessContext(c, deps);
     const accountId = requireSelectedAccount(context, c.req.query("accountId"), "billing:read");
@@ -638,6 +671,25 @@ export function stripeCustomerProvider(
     : "stripe:test";
 }
 
+/** Billing routes do not traverse the workspace actor middleware. Always bind
+ * these reads explicitly; only a revalidated live attempt may supply a human
+ * initiator. Neither query parameters nor serviceInitiator claims are proof. */
+async function withBillingUsageActor<T>(
+  deps: ApiRouteDeps,
+  context: AccessContext,
+  accountId: string,
+  read: () => Promise<T>,
+): Promise<T> {
+  const attemptGrant = context.workspaceGrants.find(
+    (grant) =>
+      grant.accountId === accountId &&
+      grant.subjectId === context.subjectId &&
+      grant.principalKind === "agent_attempt",
+  );
+  if (attemptGrant) return await withAccessGrantSessionRlsContext(deps, attemptGrant, read);
+  return await withSessionRlsActorContext({ subjectId: context.subjectId }, read);
+}
+
 function requireSelectedAccount(
   context: AccessContext,
   requested: string | undefined,

package/src/routes/capabilities.ts

@@ -3,9 +3,16 @@ import {
   CreateCapabilityCatalogItemRequest,
   DiscoverMcpCapabilitiesResponse,
   EnableCapabilityRequest,
+  ConnectorToolPermissionsResponse,
+  UpdateConnectorToolPermissionsRequest,
 } from "@opengeni/contracts";
 import type { Hono } from "hono";
-import { requireAccessGrant } from "@opengeni/core";
+import {
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  getConnectorToolPermissions,
+  updateConnectorToolPermissions,
+} from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
   buildCapabilityCatalog,
@@ -15,6 +22,7 @@ import {
   enableCapability,
   officialMcpRegistryUrl,
 } from "@opengeni/core";
+import { isPersonalConnectionOwnerPrincipal } from "../connection-ownership";
 import { boundedLimit } from "../http/common";
 import { z } from "zod";
 import pluginSnapshot from "../../../../data/catalog/plugins-snapshot.json";
@@ -110,6 +118,48 @@ export function registerCapabilityRoutes(app: Hono, deps: ApiRouteDeps): void {
     );
   });
 
+  app.get("/v1/workspaces/:workspaceId/capabilities/:capabilityId/tool-permissions", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:read");
+    return c.json(
+      ConnectorToolPermissionsResponse.parse(
+        await getConnectorToolPermissions({
+          db,
+          settings,
+          workspaceId,
+          grant: access.grant,
+          capabilityId: decodeURIComponent(c.req.param("capabilityId")),
+          personalOwnerVerified: isPersonalConnectionOwnerPrincipal(access),
+        }),
+      ),
+    );
+  });
+
+  app.patch(
+    "/v1/workspaces/:workspaceId/capabilities/:capabilityId/tool-permissions",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const access = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        workspaceId,
+        "capabilities:manage",
+      );
+      const payload = UpdateConnectorToolPermissionsRequest.safeParse(await c.req.json());
+      if (!payload.success) return c.json({ error: "Invalid connector permission target" }, 400);
+      await updateConnectorToolPermissions({
+        db,
+        settings,
+        workspaceId,
+        grant: access.grant,
+        capabilityId: decodeURIComponent(c.req.param("capabilityId")),
+        personalOwnerVerified: isPersonalConnectionOwnerPrincipal(access),
+        payload: payload.data,
+      });
+      return c.json({ saved: true });
+    },
+  );
+
   app.post("/v1/workspaces/:workspaceId/capabilities/:capabilityId/enable", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");

package/src/routes/connect.ts

@@ -1,6 +1,7 @@
 import { createHash, createHmac, randomUUID } from "node:crypto";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
+import { getConnectBeginReplay } from "@opengeni/db/connect-attempts";
 import {
   AdvanceConnectRequest,
   BeginConnectRequest,
@@ -12,6 +13,7 @@ import {
   API_INTEGRATION_OAUTH_CREDENTIAL_ROLE,
   InstallApiIntegrationRequest,
   stableJson,
+  assertOrganizationIntegrationAllowed,
   OPENGENI_PERSONAL_SLACK_MCP_URL,
   OPENGENI_PR_REVIEW_PACK_ID,
 } from "@opengeni/contracts";
@@ -20,7 +22,7 @@ import {
   createPinnedIntegrationTransport,
 } from "@opengeni/capabilities";
 import {
-  beginConnectAttempt,
+  beginConnectAttempt as persistConnectAttempt,
   getConnectAttempt,
   listPendingConnectAttempts,
   withWorkspaceSubjectRls,
@@ -46,6 +48,7 @@ import {
   isOpenGeniSlackBotConnection,
   prepareCapabilityEnable,
   buildCapabilityCatalog,
+  integrationKeyForConnectProvider,
   type ApiRouteDeps,
 } from "@opengeni/core";
 import { isPersonalConnectionOwnerPrincipal } from "../connection-ownership";
@@ -74,7 +77,9 @@ import {
 } from "../integrations/provider-oauth";
 import { resolveForRoute, validatedIntegrationInstallInput } from "./api-integrations";
 import { executeConnectOperation } from "@opengeni/core";
+import { withOrganizationIntegrationPolicyFence } from "@opengeni/db/organization-integration-policy";
 import { startMcpOAuth, requireIntegrationsStateSecret } from "../integrations/oauth-client";
+import { OFFICIAL_GMAIL_MCP_URL } from "../integrations/oauth-profiles";
 import { z } from "zod";
 import {
   WORKSPACE_OPENROUTER_CONNECTION_DOMAIN,
@@ -100,6 +105,11 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
       "workspace:read",
     );
     const external = authorization.contextIntegrity;
+    const policy = await withOrganizationIntegrationPolicyFence(
+      deps.db,
+      authorization.grant,
+      async (_tx, current) => current,
+    );
     const canWrite = hasPermission(authorization.grant.permissions, "connections:write");
     const personal = isPersonalConnectionOwnerPrincipal(authorization);
     const lensPack = await getPackInstallation(
@@ -117,7 +127,7 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
     } catch {
       /* Missing operator configuration is catalog readiness, not actor authority. */
     }
-    return c.json([
+    const providers = [
       ...(["x", "reddit"] as const).map((providerId) => {
         let configured = mcpConfigured;
         try {
@@ -227,6 +237,19 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
         ownership: ["workspace"],
         setup: ["oauth"],
       }),
+      ConnectProvider.parse({
+        id: "gmail",
+        label: "Gmail",
+        family: "google",
+        readiness:
+          !external || !canWrite || !personal
+            ? "unsupported"
+            : mcpConfigured
+              ? "available"
+              : "needs_configuration",
+        ownership: personal ? ["personal"] : [],
+        setup: ["oauth"],
+      }),
       ConnectProvider.parse({
         id: "slack-personal",
         label: "My Slack account",
@@ -377,7 +400,16 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
         ownership: personal ? ["workspace", "personal"] : ["workspace"],
         setup: ["credentials"],
       }),
-    ]);
+    ];
+    return c.json(
+      providers.filter(
+        (provider) =>
+          policy.mode === "unrestricted" ||
+          policy.allowedIntegrationKeys.includes(
+            integrationKeyForConnectProvider(provider.id) ?? "",
+          ),
+      ),
+    );
   });
   app.get("/v1/workspaces/:workspaceId/connect/accounts", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -557,7 +589,9 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
               providerId:
                 connection.metadata.mcpUrl === OPENGENI_PERSONAL_SLACK_MCP_URL
                   ? "slack-personal"
-                  : "mcp-oauth",
+                  : connection.metadata.mcpUrl === OFFICIAL_GMAIL_MCP_URL
+                    ? "gmail"
+                    : "mcp-oauth",
               label: connection.providerDomain,
               ownership: connection.subjectId === null ? "workspace" : "personal",
               status:
@@ -738,6 +772,7 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
             const resolved = await resolveForRoute({
               deps,
               transport,
+              accountId: scope.accountId,
               workspaceId,
               subjectId: scope.subjectId,
               payload: {
@@ -1007,16 +1042,18 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
         }),
       );
     }
-    if (["mcp-oauth", "slack-personal"].includes(before.providerId)) {
+    if (["mcp-oauth", "slack-personal", "gmail"].includes(before.providerId)) {
       if (action.type !== "credentials")
         throw new HTTPException(422, { message: "MCP OAuth requires a server URL" });
       const values =
         before.providerId === "slack-personal"
           ? { mcpUrl: OPENGENI_PERSONAL_SLACK_MCP_URL }
-          : z
-              .object({ mcpUrl: z.string().url().max(4096) })
-              .strict()
-              .parse(action.values);
+          : before.providerId === "gmail"
+            ? { mcpUrl: OFFICIAL_GMAIL_MCP_URL }
+            : z
+                .object({ mcpUrl: z.string().url().max(4096) })
+                .strict()
+                .parse(action.values);
       return c.json(
         await executeConnectOperation({
           db: deps.db,
@@ -1034,6 +1071,9 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
               throw new HTTPException(409, { message: "Reload the current connection setup" });
             const started = await startMcpOAuth(deps, {
               ...scope,
+              ...(before.providerId === "gmail" || before.providerId === "slack-personal"
+                ? { integrationKey: before.providerId }
+                : {}),
               ...(continuation ? { externalContinuation: continuation } : {}),
               connectAttemptId: attempt.id,
               personalOwnershipAllowed: isPersonalConnectionOwnerPrincipal(authorization),
@@ -1126,6 +1166,7 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
           const resolved = await resolveForRoute({
             deps,
             transport,
+            accountId: scope.accountId,
             workspaceId,
             subjectId: scope.subjectId,
             payload: previewRequest,
@@ -1219,6 +1260,7 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
         inputDigest: createHash("sha256")
           .update(stableJson({ ...input, action: "cancel" }))
           .digest("hex"),
+        purpose: "cancellation",
         authorize: async (tx, attempt, origin) => {
           const permission =
             attempt.providerId === "mcp-install"
@@ -1302,8 +1344,59 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
       ...(continuation ? { externalContinuation: continuation } : {}),
     };
     return c.json(
-      await withWorkspaceSubjectRls(deps.db, workspaceId, scope.subjectId, async (tx) => {
-        await requireConnectOwnerAuthority(tx, scope, setupPermission);
+      await (async () => {
+        // Remote setup preparation stays outside the policy and actor transactions.
+        // Repeat both admissions when persisting the resulting attempt.
+        const tx = deps.db;
+        const admit = () =>
+          withOrganizationIntegrationPolicyFence(deps.db, scope, async (policyTx, policy) => {
+            return withWorkspaceSubjectRls(
+              policyTx,
+              workspaceId,
+              scope.subjectId,
+              async (actorTx) => {
+                await requireConnectOwnerAuthority(actorTx, scope, setupPermission);
+                const replay = await getConnectBeginReplay(actorTx, scope, {
+                  idempotencyKey: input.idempotencyKey,
+                  requestDigest: createHash("sha256").update(stableJson(input)).digest("hex"),
+                  returnUrl: input.returnUrl,
+                  ...(continuation ? { externalContinuation: continuation } : {}),
+                });
+                if (replay) return replay;
+                assertOrganizationIntegrationAllowed(
+                  policy,
+                  integrationKeyForConnectProvider(input.providerId),
+                );
+                return null;
+              },
+            );
+          });
+        const replay = await admit();
+        if (replay) return replay;
+        const beginConnectAttempt = async (
+          _db: Parameters<typeof persistConnectAttempt>[0],
+          _scope: Parameters<typeof persistConnectAttempt>[1],
+          attemptInput: Parameters<typeof persistConnectAttempt>[2],
+        ) =>
+          withOrganizationIntegrationPolicyFence(deps.db, scope, async (policyTx, policy) => {
+            return withWorkspaceSubjectRls(
+              policyTx,
+              workspaceId,
+              scope.subjectId,
+              async (actorTx) => {
+                await requireConnectOwnerAuthority(actorTx, scope, setupPermission);
+                return persistConnectAttempt(actorTx, scope, {
+                  ...attemptInput,
+                  authorizeAcquisition: async () => {
+                    assertOrganizationIntegrationAllowed(
+                      policy,
+                      integrationKeyForConnectProvider(input.providerId),
+                    );
+                  },
+                });
+              },
+            );
+          });
         const id = randomUUID();
         if (input.providerId === "mcp-install") {
           if (
@@ -1552,6 +1645,7 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
           [
             "mcp-oauth",
             "slack-personal",
+            "gmail",
             "mcp-bearer",
             "mcp-headers",
             "fiken-token",
@@ -1567,18 +1661,27 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
             message: "MCP credential setup does not install an API integration instance",
           });
         if (
-          ["mcp-oauth", "slack-personal", "mcp-bearer", "mcp-headers", "fiken-token"].includes(
-            input.providerId,
-          )
+          [
+            "mcp-oauth",
+            "slack-personal",
+            "gmail",
+            "mcp-bearer",
+            "mcp-headers",
+            "fiken-token",
+          ].includes(input.providerId)
         ) {
           if (input.providerId === "slack-personal" && input.ownership !== "personal")
             throw new HTTPException(422, {
               message: "Hosted Slack MCP requires personal ownership",
             });
+          if (input.providerId === "gmail" && input.ownership !== "personal")
+            throw new HTTPException(422, {
+              message: "Gmail requires personal ownership; each user connects their own account",
+            });
           if (input.providerId === "fiken-token" && input.ownership !== "workspace")
             throw new HTTPException(422, { message: "Fiken is workspace-owned" });
           requireEnvironmentEncryption(deps.settings);
-          if (["mcp-oauth", "slack-personal"].includes(input.providerId))
+          if (["mcp-oauth", "slack-personal", "gmail"].includes(input.providerId))
             requireIntegrationsStateSecret(deps.settings);
           const existing = input.reconnectAccountId
             ? await getConnectionMetadata(
@@ -1593,11 +1696,13 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
             (!existing ||
               (input.providerId === "fiken-token"
                 ? !isFikenConnection(existing)
-                : ["mcp-oauth", "slack-personal"].includes(input.providerId)
+                : ["mcp-oauth", "slack-personal", "gmail"].includes(input.providerId)
                   ? existing.kind !== "oauth2" ||
                     !existing.metadata.oauthDiscovery ||
                     (input.providerId === "slack-personal" &&
-                      existing.metadata.mcpUrl !== OPENGENI_PERSONAL_SLACK_MCP_URL)
+                      existing.metadata.mcpUrl !== OPENGENI_PERSONAL_SLACK_MCP_URL) ||
+                    (input.providerId === "gmail" &&
+                      existing.metadata.mcpUrl !== OFFICIAL_GMAIL_MCP_URL)
                   : existing.kind !== "api_key" ||
                     existing.metadata.connectAdapter !== input.providerId) ||
               (existing.subjectId === null ? "workspace" : "personal") !== input.ownership)
@@ -1634,51 +1739,50 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
                 : {}),
               nextAction: {
                 type: "credentials",
-                fields:
-                  input.providerId === "slack-personal"
-                    ? []
-                    : input.providerId === "fiken-token"
-                      ? [
-                          {
-                            name: "apiToken",
-                            label: "Fiken API token",
-                            required: true,
-                            secret: true,
-                          },
-                          {
-                            name: "defaultCompanySlug",
-                            label: "Default company slug (optional)",
-                            required: false,
-                            secret: false,
-                          },
-                        ]
-                      : [
-                          {
-                            name: "mcpUrl",
-                            label: "MCP server URL",
-                            required: true,
-                            secret: false,
-                          },
-                          ...(input.providerId === "mcp-bearer"
+                fields: ["slack-personal", "gmail"].includes(input.providerId)
+                  ? []
+                  : input.providerId === "fiken-token"
+                    ? [
+                        {
+                          name: "apiToken",
+                          label: "Fiken API token",
+                          required: true,
+                          secret: true,
+                        },
+                        {
+                          name: "defaultCompanySlug",
+                          label: "Default company slug (optional)",
+                          required: false,
+                          secret: false,
+                        },
+                      ]
+                    : [
+                        {
+                          name: "mcpUrl",
+                          label: "MCP server URL",
+                          required: true,
+                          secret: false,
+                        },
+                        ...(input.providerId === "mcp-bearer"
+                          ? [
+                              {
+                                name: "token",
+                                label: "Bearer credential",
+                                required: true,
+                                secret: true,
+                              },
+                            ]
+                          : input.providerId === "mcp-headers"
                             ? [
                                 {
-                                  name: "token",
-                                  label: "Bearer credential",
+                                  name: "headers",
+                                  label: "Credential headers (JSON)",
                                   required: true,
                                   secret: true,
                                 },
                               ]
-                            : input.providerId === "mcp-headers"
-                              ? [
-                                  {
-                                    name: "headers",
-                                    label: "Credential headers (JSON)",
-                                    required: true,
-                                    secret: true,
-                                  },
-                                ]
-                              : []),
-                        ],
+                            : []),
+                      ],
               },
               expiresAt: new Date(Date.now() + 15 * 60_000).toISOString(),
             },
@@ -1838,7 +1942,7 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
             expiresAt: started.expiresAt,
           },
         });
-      }),
+      })(),
     );
   });
   app.get("/v1/workspaces/:workspaceId/connect/attempts", async (c) => {