@opengeni/api-router 3.0.1 → 3.0.2-canary.38894290271001

package/src/integrations/provider-oauth.ts

@@ -1,3 +1,5 @@
+import { withOrganizationIntegrationAcquisition } from "@opengeni/db/organization-integration-policy";
+import { claimOAuthAcquisition, finishOAuthAcquisition } from "./oauth-client";
 import { Buffer } from "node:buffer";
 import { createHash, randomBytes } from "node:crypto";
 
@@ -18,7 +20,11 @@ import {
   type ApiIntegrationOAuthStartRequest,
   type ConnectionOwnership,
 } from "@opengeni/contracts";
-import { requireEnvironmentEncryption, type ApiRouteDeps } from "@opengeni/core";
+import {
+  integrationKeyForConnectProvider,
+  requireEnvironmentEncryption,
+  type ApiRouteDeps,
+} from "@opengeni/core";
 import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
 import {
   consumeIntegrationOAuthStateNonce,
@@ -28,7 +34,6 @@ import {
   loadConnectionCredentialForBroker,
   persistProviderOAuthConnection,
   getConnectAttempt,
-  claimConnectOperation,
   finishConnectOperation,
 } from "@opengeni/db";
 import { createSignedState, readSignedState } from "@opengeni/github";
@@ -49,15 +54,11 @@ import {
 } from "../connection-ownership";
 import {
   integrationBaseUrl,
+  oauthStateFailureReturn,
   oauthStateTtlMs,
   requireIntegrationsStateSecret,
+  workspaceIntegrationsPath,
 } from "./oauth-client";
-import {
-  assertOwnershipAllowed,
-  builtInOAuthProfileFor,
-  DEFAULT_OAUTH_PROFILE,
-  type OAuthProviderProfile,
-} from "./oauth-profiles";
 
 const PROVIDER_OAUTH_CALLBACK_PATH = "/v1/integrations/provider-oauth/callback";
 const PROVIDER_OAUTH_TIMEOUT_MS = 15_000;
@@ -110,6 +111,7 @@ type ProviderIdentity = {
 
 type ProviderOAuthFailureReason =
   | "state_invalid"
+  | "state_expired"
   | "state_replayed"
   | "provider_denied"
   | "missing_code"
@@ -149,6 +151,7 @@ export async function startApiIntegrationProviderOAuth(
   },
 ): Promise<OAuthStartResponse> {
   const definition = requiredDefinition(input.payload.definitionId);
+  await withOrganizationIntegrationAcquisition(deps.db, input, [definition.id], async () => {});
   const providerDomain = integrationDefinitionProviderDomain(definition);
   const existing = input.payload.connectionId
     ? await getConnectionMetadata(
@@ -182,18 +185,8 @@ export async function startApiIntegrationProviderOAuth(
       message: "The selected Connection ownership does not match this OAuth request",
     });
   }
-  // This flow used to resolve an omitted ownership to `personal`, inverting the
-  // documented workspace-owned default. Resolving it to `workspace` instead
-  // would have been the opposite defect: an executed probe on
-  // `microsoft-outlook-mail` confirmed it flips a newly connected mailbox from
-  // subject-scoped to workspace-shared for API/SDK callers, which is a real
-  // narrow -> broad widening. So an ambiguous omission is refused outright and
-  // the caller must choose. A profile that allows exactly one ownership is not
-  // ambiguous (Gmail and hosted Slack MCP are personal-only), and a reconnect
-  // takes the existing row's ownership.
-  const profile = providerOAuthProfile(definition, providerDomain);
-  const ownership =
-    existingOwnership ?? input.payload.ownership ?? soleAllowedOwnership(profile) ?? null;
+  // API callers choose ownership explicitly; reconnects preserve the saved choice.
+  const ownership = existingOwnership ?? input.payload.ownership ?? null;
   if (ownership === null) {
     throw new HTTPException(422, {
       message:
@@ -201,13 +194,6 @@ export async function startApiIntegrationProviderOAuth(
         'or "personal" to connect only for yourself',
     });
   }
-  // Inert by construction today, and deliberately kept: no curated Definition
-  // resolves to a personal-only profile (all five are Google Workspace and
-  // Microsoft Graph APIs, so `providerOAuthProfile` returns the default), which
-  // is why disabling this line reddens nothing. It is the fence that keeps a
-  // future Definition targeting slack.com or Gmail from minting an ownership
-  // its profile forbids - read it as pre-wiring, not as an untested gap.
-  assertOwnershipAllowed(profile, ownership);
   assertConnectionOwnershipAllowedForPrincipal(ownership, input.personalOwnershipAllowed);
   const authorizeScopes = uniqueStrings([
     ...(existing?.grantedScopes ?? []),
@@ -219,7 +205,7 @@ export async function startApiIntegrationProviderOAuth(
   const baseUrl = integrationBaseUrl(deps.settings.publicBaseUrl, input.requestUrl);
   const redirectUri = `${baseUrl}${providerOAuthCallbackPath(definition)}`;
   const returnPath = safeReturnPath(
-    input.payload.returnPath ?? `/workspaces/${input.workspaceId}/capabilities`,
+    input.payload.returnPath ?? workspaceIntegrationsPath(input.workspaceId),
   );
   const state = createSignedState(requireIntegrationsStateSecret(deps.settings), {
     accountId: input.accountId,
@@ -307,12 +293,18 @@ export async function completeApiIntegrationProviderOAuth(
         operationId: `oauth:${state.nonce}`,
         inputDigest: createHash("sha256").update(input.state!).digest("hex"),
       };
-      const claim = await claimConnectOperation(deps.db, state, {
-        ...connectOperation,
-        expectedRevision: stored.attempt.revision,
-        authorize: (tx, _attempt, origin) =>
-          requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
-      });
+      const claim = await claimOAuthAcquisition(
+        deps.db,
+        state,
+        {
+          ...connectOperation,
+          expectedRevision: stored.attempt.revision,
+          authorize: (tx, _attempt, origin) =>
+            requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
+        },
+        integrationKeyForConnectProvider(state.definitionId),
+        Boolean(input.code && !input.error),
+      );
       if (claim.status === "replayed") return { redirectTo: exactReturnUrl, exactReturn: true };
     }
     requireProviderOAuthOwner(state);
@@ -350,6 +342,7 @@ export async function completeApiIntegrationProviderOAuth(
 
     const definition = integrationDefinitionById(state.definitionId);
     if (!definition) throw new ProviderOAuthCallbackError("state_invalid");
+    await withOrganizationIntegrationAcquisition(deps.db, state, [definition.id], async () => {});
     if (
       state.definitionFingerprint !== providerDefinitionFingerprint(definition) ||
       state.providerDomain !== integrationDefinitionProviderDomain(definition) ||
@@ -480,32 +473,42 @@ export async function completeApiIntegrationProviderOAuth(
     const persist = (database: import("@opengeni/db").Database) =>
       persistProviderOAuthConnection(database, persistenceInput);
     if (connectOperation) {
-      await finishConnectOperation(deps.db, state, {
-        ...connectOperation,
-        authorize: (tx, _attempt, origin) =>
-          requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
-        commit: async (tx, current) => {
-          const connection = await persist(tx);
-          if (!connection) throw new ProviderOAuthCallbackError("connection_conflict");
-          return {
-            ...current,
-            revision: current.revision + 1,
-            state: "connected_but_incomplete",
-            credentialsCommitted: true,
-            nextAction: { type: "none" },
-            account: {
-              id: connection.id,
-              providerId: current.providerId,
-              label: identity.displayName ?? identity.email ?? identity.principalId,
-              ownership: current.ownership,
-              status: "connected",
-            },
-          };
+      await finishOAuthAcquisition(
+        deps.db,
+        state,
+        {
+          ...connectOperation,
+          authorize: (tx, _attempt, origin) =>
+            requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
+          commit: async (tx, current) => {
+            const connection = await persist(tx);
+            if (!connection) throw new ProviderOAuthCallbackError("connection_conflict");
+            return {
+              ...current,
+              revision: current.revision + 1,
+              state: "connected_but_incomplete",
+              credentialsCommitted: true,
+              nextAction: { type: "none" },
+              account: {
+                id: connection.id,
+                providerId: current.providerId,
+                label: identity.displayName ?? identity.email ?? identity.principalId,
+                ownership: current.ownership,
+                status: "connected",
+              },
+            };
+          },
         },
-      });
+        definition.id,
+      );
       return { redirectTo: exactReturnUrl!, exactReturn: true };
     }
-    const connection = await persist(deps.db);
+    const connection = await withOrganizationIntegrationAcquisition(
+      deps.db,
+      state,
+      [definition.id],
+      persist,
+    );
     if (!connection) throw new ProviderOAuthCallbackError("connection_conflict");
     return {
       redirectTo: providerOAuthReturnUrl(returnBaseUrl, state.returnPath, "success", {
@@ -517,42 +520,24 @@ export async function completeApiIntegrationProviderOAuth(
     };
   } catch (error) {
     if (exactReturnUrl !== undefined) return { redirectTo: exactReturnUrl, exactReturn: true };
+    const reason = providerOAuthFailureReason(error);
+    // An unreadable state carries no return path; an authentic but aged one
+    // still names its workspace and is reported as expired.
+    const failure = state ? null : oauthStateFailureReturn(deps.settings, input.state);
     return {
       redirectTo: providerOAuthReturnUrl(
         returnBaseUrl,
-        state?.returnPath ?? "/integrations",
+        state?.returnPath ?? failure!.returnPath,
         "error",
         {
           ...(state?.definitionId ? { definitionId: state.definitionId } : {}),
-          reason: providerOAuthFailureReason(error),
+          reason: failure && reason === "state_invalid" ? failure.reason : reason,
         },
       ),
     };
   }
 }
 
-/**
- * The ownership fences that apply to a curated Definition, read from the same
- * profile table the MCP OAuth start uses. No curated Definition targets a
- * personal-only provider today (they are Google Workspace and Microsoft Graph
- * APIs), so this resolves to the default profile and its workspace default;
- * matching by provider domain keeps the Slack/Gmail fences in force if one ever
- * does, instead of letting this flow mint an ownership their profile forbids.
- */
-/** The profile's ownership when it allows exactly one, else null (ambiguous). */
-function soleAllowedOwnership(profile: OAuthProviderProfile): ConnectionOwnership | null {
-  return profile.allowedOwnership.length === 1 ? profile.allowedOwnership[0]! : null;
-}
-
-function providerOAuthProfile(
-  definition: IntegrationDefinition,
-  providerDomain: string,
-): OAuthProviderProfile {
-  return (
-    builtInOAuthProfileFor({ mcpUrl: definition.baseUrl, providerDomain }) ?? DEFAULT_OAUTH_PROFILE
-  );
-}
-
 function requiredDefinition(id: string): IntegrationDefinition {
   const definition = integrationDefinitionById(id);
   if (!definition) throw new HTTPException(404, { message: "Unknown Integration definition" });
@@ -564,10 +549,7 @@ export function curatedOAuthReadiness(
   settings: Settings,
   definition: IntegrationDefinition,
 ): { configured: boolean; ownership: ConnectionOwnership[] } {
-  const ownership = [
-    ...providerOAuthProfile(definition, integrationDefinitionProviderDomain(definition))
-      .allowedOwnership,
-  ];
+  const ownership: ConnectionOwnership[] = ["workspace", "personal"];
   try {
     if (!settings.integrationsEnabled) return { configured: false, ownership };
     requireEnvironmentEncryption(settings);

package/src/integrations/slack-app-home.ts

@@ -76,7 +76,7 @@ export function buildSlackAppHomeBlocks(input: {
     {
       type: "header",
       block_id: "opengeni_home_header",
-      text: { type: "plain_text", text: "Your OpenGeni tasks", emoji: true },
+      text: { type: "plain_text", text: "Your Opengeni tasks", emoji: true },
     },
     {
       type: "context",
@@ -84,7 +84,7 @@ export function buildSlackAppHomeBlocks(input: {
       elements: [
         {
           type: "mrkdwn",
-          text: "Private to you · refreshed from your current OpenGeni access",
+          text: "Private to you · refreshed from your current Opengeni access",
         },
       ],
     },
@@ -115,7 +115,7 @@ export function buildSlackAppHomeBlocks(input: {
         {
           type: "button",
           action_id: "opengeni.home.open_all",
-          text: { type: "plain_text", text: "Open OpenGeni", emoji: true },
+          text: { type: "plain_text", text: "Open Opengeni", emoji: true },
           url: input.workspaceUrl,
           style: "primary",
         },
@@ -135,7 +135,7 @@ export function buildSlackAppHomeAccessBlocks(input: {
     {
       type: "header",
       block_id: "opengeni_home_header",
-      text: { type: "plain_text", text: "OpenGeni", emoji: true },
+      text: { type: "plain_text", text: "Opengeni", emoji: true },
     },
     {
       type: "section",
@@ -156,7 +156,7 @@ export function buildSlackAppHomeAccessBlocks(input: {
           action_id: "opengeni.home.connect",
           text: {
             type: "plain_text",
-            text: input.actionLabel?.slice(0, 75) || "Open OpenGeni",
+            text: input.actionLabel?.slice(0, 75) || "Open Opengeni",
             emoji: true,
           },
           url: input.actionUrl,