@opengeni/api-router 3.0.1 → 3.0.2-canary.38894290271001

package/src/routes/workspace-artifacts.ts

@@ -4,6 +4,8 @@ import {
   PublishWorkspaceArtifactVersionRequest,
   RollbackWorkspaceArtifactRequest,
   SetWorkspaceArtifactStatusRequest,
+  UpdateWorkspaceArtifactVisibilityRequest,
+  UpdateWorkspaceArtifactVisibilityResponse,
   WorkspaceArtifactContentResponse,
   WorkspaceArtifactDetailResponse,
   WorkspaceArtifactListQuery,
@@ -16,8 +18,11 @@ import {
   requireAccessGrant,
   requireAccessGrantAuthorization,
   requireSessionAuthorization,
+  resolveNewSiteAudience,
+  resolveSiteAudienceChange,
   SessionAuthorizationDeniedError,
   SessionAuthorizationUnavailableError,
+  siteViewerForGrant,
   type ApiRouteDeps,
 } from "@opengeni/core";
 import {
@@ -29,14 +34,22 @@ import {
   publishWorkspaceArtifactVersion,
   rollbackWorkspaceArtifact,
   setWorkspaceArtifactStatus,
+  updateWorkspaceArtifactVisibility,
   WorkspaceArtifactConflictError,
   WorkspaceArtifactNotFoundError,
   WorkspaceArtifactOperationError,
+  WorkspaceArtifactOwnerRequiredError,
 } from "@opengeni/db";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
 import { readWorkspaceArtifactContent } from "../workspace-artifact-content";
+import { userContentDispositionHeaders } from "../http/user-content";
+import {
+  afterSiteArtifactMutation,
+  notifySitePublicationChanged,
+  requireSiteVersionPublishOpen,
+} from "../site-publishing/service";
 import {
   projectWorkspaceArtifactDetailProvenance,
   projectWorkspaceArtifactMutationProvenance,
@@ -85,6 +98,9 @@ export function workspaceArtifactErrorResponse(context: Context, error: unknown)
       409,
     );
   }
+  if (error instanceof WorkspaceArtifactOwnerRequiredError) {
+    return context.json({ code: "WORKSPACE_ARTIFACT_OWNER_REQUIRED", message: error.message }, 403);
+  }
   if (error instanceof WorkspaceArtifactOperationError) {
     return context.json(
       { code: "INVALID_WORKSPACE_ARTIFACT_OPERATION", message: error.message },
@@ -166,6 +182,15 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
   // `published-artifacts` deliberately avoids the existing `/artifacts/:id`
   // retained-output API. The product route remains simply `/artifacts`.
   const base = "/v1/workspaces/:workspaceId/published-artifacts";
+  // A published Site follows its Site: a new version, rollback, archive or
+  // restore advances its host map (after commit, never blocking the change),
+  // through the same hook the agent artifact tools run. Recorded before the
+  // response so the next host lookup sees the change; publish and rollback
+  // scan the version that became current.
+  const publishedSiteChanged = async <T extends WorkspaceArtifactMutationResponse>(
+    result: T,
+    scan = false,
+  ): Promise<T> => await afterSiteArtifactMutation(deps, result, { scan });
 
   app.post(`${base}/uploads`, async (context) => {
     const grant = await requireAccessGrant(
@@ -179,18 +204,23 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
 
   app.get(`${base}/:artifactId/downloads`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
+    const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
     if (!deps.objectStorage)
       throw new HTTPException(503, {
         message: "Object storage is not configured",
       });
-    const ref = await getWorkspaceArtifactContentRef(
-      deps.db,
-      workspaceId,
-      artifactId(context),
-      parseVersionId(context.req.query("versionId")),
-    );
-    return context.json(await workspaceArtifactDownloads(deps.objectStorage, ref, "public"));
+    try {
+      const ref = await getWorkspaceArtifactContentRef(
+        deps.db,
+        workspaceId,
+        await siteViewerForGrant(deps.db, grant),
+        artifactId(context),
+        parseVersionId(context.req.query("versionId")),
+      );
+      return context.json(await workspaceArtifactDownloads(deps.objectStorage, ref, "public"));
+    } catch (error) {
+      return workspaceArtifactErrorResponse(context, error);
+    }
   });
 
   app.get(base, async (context) => {
@@ -213,14 +243,19 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
       return context.json(
         WorkspaceArtifactListResponse.parse(
           redactWorkspaceArtifactListProvenance(
-            await listWorkspaceArtifacts(deps.db, workspaceId, {
-              limit: query.data.limit,
-              ...(query.data.cursor ? { cursor: query.data.cursor } : {}),
-              ...(query.data.status ? { status: query.data.status } : {}),
-              ...(query.data.sourceSessionId
-                ? { sourceSessionId: query.data.sourceSessionId }
-                : {}),
-            }),
+            await listWorkspaceArtifacts(
+              deps.db,
+              workspaceId,
+              await siteViewerForGrant(deps.db, grant),
+              {
+                limit: query.data.limit,
+                ...(query.data.cursor ? { cursor: query.data.cursor } : {}),
+                ...(query.data.status ? { status: query.data.status } : {}),
+                ...(query.data.sourceSessionId
+                  ? { sourceSessionId: query.data.sourceSessionId }
+                  : {}),
+              },
+            ),
           ),
         ),
       );
@@ -243,6 +278,14 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
     const slugBase = request.slug ?? (normalizeWorkspaceArtifactSlug(request.title) || "artifact");
     const slug = request.slug ?? `${slugBase.slice(0, 87)}-${id.slice(0, 8)}`;
     try {
+      const audience = await resolveNewSiteAudience({
+        db: deps.db,
+        settings: deps.settings,
+        grant,
+        viewer: await siteViewerForGrant(deps.db, grant),
+        requested: request.visibility,
+        sourceSessionId: null,
+      });
       const content = await prepareContent(deps, grant, {
         ...(request.html !== undefined ? { html: request.html } : {}),
         ...(request.uploadId ? { uploadId: request.uploadId } : {}),
@@ -254,6 +297,7 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
           deps,
           grant,
           await createWorkspaceArtifact(deps.db, {
+            ...audience,
             accountId: grant.accountId,
             workspaceId,
             artifactId: id,
@@ -276,7 +320,12 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
     const workspaceId = context.req.param("workspaceId");
     const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
     try {
-      const detail = await getWorkspaceArtifact(deps.db, workspaceId, artifactId(context));
+      const detail = await getWorkspaceArtifact(
+        deps.db,
+        workspaceId,
+        await siteViewerForGrant(deps.db, grant),
+        artifactId(context),
+      );
       return context.json(
         WorkspaceArtifactDetailResponse.parse(
           await projectWorkspaceArtifactDetailProvenance(detail, (sessionId) =>
@@ -291,17 +340,23 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
 
   app.get(`${base}/:artifactId/html`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
+    const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
     if (!deps.objectStorage)
       throw new HTTPException(503, {
         message: "Object storage is not configured",
       });
-    const ref = await getWorkspaceArtifactContentRef(
-      deps.db,
-      workspaceId,
-      artifactId(context),
-      parseVersionId(context.req.query("versionId")),
-    );
+    let ref: Awaited<ReturnType<typeof getWorkspaceArtifactContentRef>>;
+    try {
+      ref = await getWorkspaceArtifactContentRef(
+        deps.db,
+        workspaceId,
+        await siteViewerForGrant(deps.db, grant),
+        artifactId(context),
+        parseVersionId(context.req.query("versionId")),
+      );
+    } catch (error) {
+      return workspaceArtifactErrorResponse(context, error);
+    }
     const iterator = readArtifactObject(deps.objectStorage, ref.contentKey);
     return new Response(
       new ReadableStream({
@@ -322,7 +377,15 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
         headers: {
           "Content-Type": "text/html; charset=utf-8",
           "Cache-Control": "private, no-store",
+          // A Site runs its own scripts, but only inside an opaque origin: no
+          // same-origin access to the console, and no cross-site embedding.
           "Content-Security-Policy": "sandbox allow-scripts",
+          "Cross-Origin-Resource-Policy": "same-origin",
+          "X-Content-Type-Options": "nosniff",
+          // Clients read this HTML with fetch and render it in their own frame
+          // (the console uses srcdoc). Opening the raw URL downloads it rather
+          // than running a publisher-authored page at an app-origin URL.
+          ...userContentDispositionHeaders("text/html", "site.html"),
         },
       },
     );
@@ -330,7 +393,7 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
 
   app.get(`${base}/:artifactId/content`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
+    const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
     if (!deps.objectStorage)
       throw new HTTPException(503, {
         message: "Object storage is not configured",
@@ -340,6 +403,7 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
       const ref = await getWorkspaceArtifactContentRef(
         deps.db,
         workspaceId,
+        await siteViewerForGrant(deps.db, grant),
         artifactId(context),
         parsedVersion,
       );
@@ -377,6 +441,8 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
     const grant = authorization.grant;
     const request = await body(context, PublishWorkspaceArtifactVersionRequest);
     const id = artifactId(context);
+    // A published Site gets no new versions while the platform brake is engaged.
+    await requireSiteVersionPublishOpen(deps, { accountId: grant.accountId, workspaceId }, id);
     try {
       const content = await prepareContent(deps, grant, {
         ...(request.html !== undefined ? { html: request.html } : {}),
@@ -388,16 +454,20 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
         await mutationResponse(
           deps,
           grant,
-          await publishWorkspaceArtifactVersion(deps.db, {
-            accountId: grant.accountId,
-            workspaceId,
-            artifactId: id,
-            expectedCurrentVersionId: request.expectedCurrentVersionId,
-            ...(request.title !== undefined ? { title: request.title } : {}),
-            ...(request.description !== undefined ? { description: request.description } : {}),
-            ...content,
-            ...provenance(grant.subjectId, request.idempotencyKey),
-          }),
+          await publishedSiteChanged(
+            await publishWorkspaceArtifactVersion(deps.db, {
+              accountId: grant.accountId,
+              workspaceId,
+              artifactId: id,
+              viewer: await siteViewerForGrant(deps.db, grant),
+              expectedCurrentVersionId: request.expectedCurrentVersionId,
+              ...(request.title !== undefined ? { title: request.title } : {}),
+              ...(request.description !== undefined ? { description: request.description } : {}),
+              ...content,
+              ...provenance(grant.subjectId, request.idempotencyKey),
+            }),
+            true,
+          ),
         ),
       );
     } catch (error) {
@@ -421,15 +491,19 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
         await mutationResponse(
           deps,
           grant,
-          await rollbackWorkspaceArtifact(deps.db, {
-            accountId: grant.accountId,
-            workspaceId,
-            artifactId: id,
-            versionId: request.versionId,
-            expectedCurrentVersionId: request.expectedCurrentVersionId,
-            reason: request.reason,
-            ...provenance(grant.subjectId, request.idempotencyKey),
-          }),
+          await publishedSiteChanged(
+            await rollbackWorkspaceArtifact(deps.db, {
+              accountId: grant.accountId,
+              workspaceId,
+              artifactId: id,
+              viewer: await siteViewerForGrant(deps.db, grant),
+              versionId: request.versionId,
+              expectedCurrentVersionId: request.expectedCurrentVersionId,
+              reason: request.reason,
+              ...provenance(grant.subjectId, request.idempotencyKey),
+            }),
+            true,
+          ),
         ),
       );
     } catch (error) {
@@ -453,19 +527,57 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
         await mutationResponse(
           deps,
           grant,
-          await setWorkspaceArtifactStatus(deps.db, {
-            accountId: grant.accountId,
-            workspaceId,
-            artifactId: id,
-            status: request.status,
-            expectedCurrentVersionId: request.expectedCurrentVersionId,
-            reason: request.reason,
-            ...provenance(grant.subjectId, request.idempotencyKey),
-          }),
+          await publishedSiteChanged(
+            await setWorkspaceArtifactStatus(deps.db, {
+              accountId: grant.accountId,
+              workspaceId,
+              artifactId: id,
+              viewer: await siteViewerForGrant(deps.db, grant),
+              status: request.status,
+              expectedCurrentVersionId: request.expectedCurrentVersionId,
+              reason: request.reason,
+              ...provenance(grant.subjectId, request.idempotencyKey),
+            }),
+          ),
         ),
       );
     } catch (error) {
       return workspaceArtifactErrorResponse(context, error);
     }
   });
+
+  // Who can see the Site: the whole workspace, or only its owner. Only the
+  // owner changes it, like a chat's or a schedule's audience.
+  app.put(`${base}/:artifactId/visibility`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const grant = await requireAccessGrant(context, deps, workspaceId, "artifacts:publish");
+    const request = await body(context, UpdateWorkspaceArtifactVisibilityRequest);
+    const id = artifactId(context);
+    try {
+      const viewer = await siteViewerForGrant(deps.db, grant);
+      const visibility = await resolveSiteAudienceChange({
+        db: deps.db,
+        settings: deps.settings,
+        grant,
+        viewer,
+        requested: request.visibility,
+      });
+      const artifact = await updateWorkspaceArtifactVisibility(deps.db, {
+        workspaceId,
+        artifactId: id,
+        viewer,
+        visibility,
+      });
+      await notifySitePublicationChanged(deps, { accountId: grant.accountId, workspaceId }, id);
+      const projected = await projectWorkspaceArtifactDetailProvenance(
+        { artifact, versions: [], events: [], versionsTruncated: false, eventsTruncated: false },
+        (sessionId) => canReadProvenanceSession(deps, grant, sessionId),
+      );
+      return context.json(
+        UpdateWorkspaceArtifactVisibilityResponse.parse({ artifact: projected.artifact }),
+      );
+    } catch (error) {
+      return workspaceArtifactErrorResponse(context, error);
+    }
+  });
 }