@opengeni/api-router 3.0.1 → 3.1.2

package/src/routes/pr-review.ts

@@ -1,10 +1,10 @@
 import { environmentsEncryptionKeyBytes } from "@opengeni/config";
+import { withOrganizationIntegrationAcquisition } from "@opengeni/db/organization-integration-policy";
 import {
   CreatePrReviewAppRegistrationRequest,
   CreatePrReviewRepositoryBindingRequest,
   PrReviewAppRegistration,
   PrReviewRepositoryBinding,
-  OPENGENI_PR_REVIEW_PACK_ID,
   UpdatePrReviewAppRegistrationRequest,
   UpdatePrReviewRepositoryBindingRequest,
 } from "@opengeni/contracts";
@@ -12,17 +12,17 @@ import {
   assertWorkspaceModelPolicyAllows,
   canonicalConfiguredModel,
   defaultPrReviewProviderBaseUrl,
-  getCapabilityPack,
   workspaceCustomModelReference,
   lockActiveCustomModelForAdmission,
+  modelUnavailableHttpException,
   prReviewWebhookAuthKind,
   normalizePrReviewProviderBaseUrl,
-  prReviewPackConnectorId,
-  PR_REVIEW_AUTOMATION_TEMPLATE_ID,
   requireAccessGrant,
+  requireAccessGrantAuthorization,
   requirePermission,
   resolveWorkspaceCatalogSettings,
   type ApiRouteDeps,
+  PR_REVIEW_AUTOMATION_SETUP,
 } from "@opengeni/core";
 import {
   createPrReviewAppRegistration,
@@ -32,7 +32,6 @@ import {
   decryptVariableSetValue,
   encryptVariableSetValue,
   getPrReviewAppRegistrationSecret,
-  getPackInstallation,
   listPrReviewAppRegistrations,
   listPrReviewRepositoryBindings,
   nestedPostgresSqlState,
@@ -48,6 +47,8 @@ import {
   verifyPrReviewProviderRepository,
 } from "../integrations/pr-review-provider";
 import { registerPrReviewGitHubRoutes } from "./pr-review-github";
+import { integrationCommitGrant } from "../integrations/integration-commit-authority";
+import { parseRequestJson } from "../http/request-body";
 
 export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { db, settings } = deps;
@@ -56,7 +57,7 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/workspaces/:workspaceId/pr-review/registrations", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-    await requirePrReviewPackActive(db, workspaceId);
+
     return c.json({
       registrations: await listPrReviewAppRegistrations(db, grant.accountId, workspaceId),
       repositories: await listPrReviewRepositoryBindings(db, grant.accountId, workspaceId),
@@ -67,9 +68,9 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
     requirePermission(grant, "secrets:write");
-    const packInstallation = await requirePrReviewPackActive(db, workspaceId);
+
     assertPrReviewSandboxBackend(deps);
-    const payload = CreatePrReviewAppRegistrationRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, CreatePrReviewAppRegistrationRequest);
     const encryptionKey = requirePrReviewEncryptionKey(deps);
     let providerBaseUrl: string;
     try {
@@ -94,28 +95,32 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
       });
     }
     const registration = await mapPrReviewUniqueConflict(
-      createPrReviewAppRegistration(db, {
-        accountId: grant.accountId,
-        workspaceId,
-        name: payload.name,
-        provider: payload.provider,
-        providerBaseUrl,
-        appId: payload.appId ?? null,
-        credentialKind: payload.credentialKind,
-        credentialEncrypted: encryptVariableSetValue(
-          encryptionKey,
-          payload.privateKey ?? payload.accessToken!,
-        ),
-        accessTokenExpiresAt: payload.accessTokenExpiresAt
-          ? new Date(payload.accessTokenExpiresAt)
-          : null,
-        webhookAuthKind: prReviewWebhookAuthKind(payload.provider),
-        webhookSecretEncrypted: encryptVariableSetValue(encryptionKey, payload.webhookSecret),
-        webhookUsername: payload.webhookUsername ?? null,
-        createdBySubjectId: grant.subjectId,
-        packInstallationId: packInstallation.id,
-        packConnectorId: prReviewPackConnectorId(payload.provider),
-      }),
+      withOrganizationIntegrationAcquisition(
+        db,
+        grant,
+        [prReviewIntegrationKey(payload.provider)],
+        (tx) =>
+          createPrReviewAppRegistration(tx, {
+            accountId: grant.accountId,
+            workspaceId,
+            name: payload.name,
+            provider: payload.provider,
+            providerBaseUrl,
+            appId: payload.appId ?? null,
+            credentialKind: payload.credentialKind,
+            credentialEncrypted: encryptVariableSetValue(
+              encryptionKey,
+              payload.privateKey ?? payload.accessToken!,
+            ),
+            accessTokenExpiresAt: payload.accessTokenExpiresAt
+              ? new Date(payload.accessTokenExpiresAt)
+              : null,
+            webhookAuthKind: prReviewWebhookAuthKind(payload.provider),
+            webhookSecretEncrypted: encryptVariableSetValue(encryptionKey, payload.webhookSecret),
+            webhookUsername: payload.webhookUsername ?? null,
+            createdBySubjectId: grant.subjectId,
+          }),
+      ),
       "A PR Review registration with this provider and name already exists",
     );
     await recordAuditEvent(db, {
@@ -138,8 +143,8 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
     requirePermission(grant, "secrets:write");
-    await requirePrReviewPackActive(db, workspaceId);
-    const payload = UpdatePrReviewAppRegistrationRequest.parse(await c.req.json());
+
+    const payload = await parseRequestJson(c, UpdatePrReviewAppRegistrationRequest);
     const existing = await getPrReviewAppRegistrationSecret(db, {
       accountId: grant.accountId,
       workspaceId,
@@ -158,12 +163,12 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
         payload.accessTokenExpiresAt !== undefined
       ) {
         throw new HTTPException(422, {
-          message: "OpenGeni Lens credentials are managed by the deployment",
+          message: "Opengeni Lens credentials are managed by the deployment",
         });
       }
       if (payload.status === "active") {
         throw new HTTPException(409, {
-          message: "Reconnect OpenGeni Lens to reactivate and resync its repositories",
+          message: "Reconnect Opengeni Lens to reactivate and resync its repositories",
         });
       }
     }
@@ -272,9 +277,13 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/pr-review/repositories", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const packInstallation = await requirePrReviewPackActive(db, workspaceId);
-    const payload = CreatePrReviewRepositoryBindingRequest.parse(await c.req.json());
+    const grant = await integrationCommitGrant(
+      await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:admin"),
+      ["workspace:admin"],
+      { settings: deps.settings, authorizationHeader: c.req.header("authorization") },
+    );
+
+    const payload = await parseRequestJson(c, CreatePrReviewRepositoryBindingRequest);
     const registration = await getPrReviewAppRegistrationSecret(db, {
       accountId: grant.accountId,
       workspaceId,
@@ -284,6 +293,8 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
       throw new HTTPException(404, {
         message: "PR Review app registration not found",
       });
+    const integrationKey = prReviewIntegrationKey(registration.provider);
+    await withOrganizationIntegrationAcquisition(db, grant, [integrationKey], async () => {});
     const repositoryUrl = new URL(payload.repositoryUri);
     let canonicalRepositoryUri = repositoryUrl.href;
     let canonicalRepositoryFullName = payload.repositoryFullName;
@@ -406,35 +417,33 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
           modelId: model,
         })
       : undefined;
-    const template = getCapabilityPack(OPENGENI_PR_REVIEW_PACK_ID)?.automationTemplates?.find(
-      (candidate) => candidate.id === PR_REVIEW_AUTOMATION_TEMPLATE_ID,
-    );
-    if (!template) {
-      throw new HTTPException(503, { message: "PR Review automation template is unavailable" });
-    }
+    const template = PR_REVIEW_AUTOMATION_SETUP;
+
     const binding = await mapPrReviewUniqueConflict(
-      createPrReviewRepositoryBinding(db, {
-        accountId: grant.accountId,
-        workspaceId,
-        registrationId: registration.id,
-        provider: registration.provider,
-        repositoryUri: canonicalRepositoryUri,
-        repositoryFullName: canonicalRepositoryFullName,
-        providerRepositoryId: canonicalProviderRepositoryId,
-        installationId:
-          payload.installationId === undefined ? null : String(payload.installationId),
-        projectId: canonicalProjectId,
-        model,
-        additionalInstructions: payload.additionalInstructions ?? null,
-        status: payload.status,
-        createdBySubjectId: grant.subjectId,
-        packInstallationId: packInstallation.id,
-        packTemplateId: template.id,
-        adapterId: template.adapterId,
-        eventTypes: template.eventTypes,
-        configuration: template.configuration,
-        sessionTemplate: template.sessionTemplate,
-        ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
+      withOrganizationIntegrationAcquisition(db, grant, [integrationKey], async (tx) => {
+        await grant.authorizeCommit(tx);
+        return createPrReviewRepositoryBinding(tx, {
+          accountId: grant.accountId,
+          workspaceId,
+          registrationId: registration.id,
+          provider: registration.provider,
+          repositoryUri: canonicalRepositoryUri,
+          repositoryFullName: canonicalRepositoryFullName,
+          providerRepositoryId: canonicalProviderRepositoryId,
+          installationId:
+            payload.installationId === undefined ? null : String(payload.installationId),
+          projectId: canonicalProjectId,
+          model,
+          additionalInstructions: payload.additionalInstructions ?? null,
+          status: payload.status,
+          createdBySubjectId: grant.subjectId,
+
+          adapterId: template.adapterId,
+          eventTypes: template.eventTypes,
+          configuration: template.configuration,
+          sessionTemplate: template.sessionTemplate,
+          ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
+        });
       }),
       "This repository is already bound to the selected PR Review registration",
     );
@@ -457,8 +466,8 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.patch("/v1/workspaces/:workspaceId/pr-review/repositories/:bindingId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    await requirePrReviewPackActive(db, workspaceId);
-    const payload = UpdatePrReviewRepositoryBindingRequest.parse(await c.req.json());
+
+    const payload = await parseRequestJson(c, UpdatePrReviewRepositoryBindingRequest);
     const catalogSettings = (
       await resolveWorkspaceCatalogSettings(db, deps.settings, {
         accountId: grant.accountId,
@@ -547,6 +556,12 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
   });
 }
 
+/** PR Review's server-owned provider, not a repository URL or user label,
+ * establishes Lens identity. Other providers have no curated acquisition key. */
+function prReviewIntegrationKey(provider: string): "github-lens" | null {
+  return provider === "github" ? "github-lens" : null;
+}
+
 function prReviewCustomModelCommitGuard(input: {
   settings: ApiRouteDeps["settings"];
   accountId: string;
@@ -560,11 +575,12 @@ function prReviewCustomModelCommitGuard(input: {
       accountId: input.accountId,
       workspaceId: input.workspaceId,
       reference,
+      // Review runs carry no accepted Claude authority, so an organization
+      // Claude model is refused here (unchanged behaviour).
+      claudeAuthority: null,
     });
     if (!active) {
-      throw new HTTPException(422, {
-        message: `model is not available: ${input.modelId}`,
-      });
+      throw modelUnavailableHttpException(input.modelId);
     }
   };
 }
@@ -573,26 +589,16 @@ function assertPrReviewSandboxBackend(deps: ApiRouteDeps): void {
   if (deps.settings.sandboxBackend === "selfhosted") {
     throw new HTTPException(409, {
       message:
-        "OpenGeni Review Bot requires managed compute so it can materialize and verify the exact pull-request head",
-    });
-  }
-}
-
-async function requirePrReviewPackActive(db: ApiRouteDeps["db"], workspaceId: string) {
-  const installation = await getPackInstallation(db, workspaceId, OPENGENI_PR_REVIEW_PACK_ID);
-  if (installation?.status !== "active") {
-    throw new HTTPException(409, {
-      message: "Install and enable the OpenGeni Review Bot Pack first",
+        "Opengeni Review Bot requires managed compute so it can materialize and verify the exact pull-request head",
     });
   }
-  return installation;
 }
 
 function requirePrReviewEncryptionKey(deps: ApiRouteDeps): Uint8Array {
   const key = environmentsEncryptionKeyBytes(deps.settings);
   if (!key) {
     throw new HTTPException(503, {
-      message: "OpenGeni Review Bot requires configured secret encryption",
+      message: "Opengeni Review Bot requires configured secret encryption",
     });
   }
   return key;

package/src/routes/preference-registry.ts

@@ -97,6 +97,7 @@ function requiredAttemptClaims(grant: AccessGrant): PreferenceRegistryAttemptCla
 
 function requireHumanMutation(access: AccessGrantAuthorization): void {
   const { grant } = access;
+  if (isDeploymentKeyOperator(access)) return;
   if (
     !access.contextIntegrity ||
     access.authenticatedSubjectId !== grant.subjectId ||
@@ -112,6 +113,23 @@ function requireHumanMutation(access: AccessGrantAuthorization): void {
   }
 }
 
+/**
+ * A key-only (configured) deployment has no Opengeni sign-in: whoever holds the
+ * deployment key is its operator, so a request made with the key itself counts
+ * as the person. Agents never hold the key and stay refused.
+ */
+function isDeploymentKeyOperator(access: AccessGrantAuthorization): boolean {
+  const { grant } = access;
+  return (
+    access.contextIntegrity &&
+    access.authenticatedSubjectId === grant.subjectId &&
+    grant.principalKind === "configured_key" &&
+    exactAttemptClaims(grant) === null &&
+    !grant.serviceInitiator &&
+    !grant.serviceInitiatorContext
+  );
+}
+
 export function authorizePreferenceRegistryScopeMutation(
   access: AccessGrantAuthorization,
   scope: PreferenceRegistryScope,

package/src/routes/rigs.ts

@@ -1,3 +1,4 @@
+import { legacyVariableSetFields, VariableSetsRemovedError } from "../http/variable-sets-removed";
 import {
   CreateRigRequest,
   ProposeRigChangeRequest,
@@ -42,6 +43,21 @@ async function parseRigRequest<T>(c: Context, schema: ZodType<T>, label: string)
     bodyRecord?.payload && typeof bodyRecord.payload === "object"
       ? (bodyRecord.payload as Record<string, unknown>)
       : null;
+  // RM-1: rig default Variable Sets were removed with Variable Sets.
+  const legacyFields = [
+    ...legacyVariableSetFields(bodyRecord),
+    ...legacyVariableSetFields(payloadRecord).map((field) => `payload.${field}`),
+  ];
+  if (legacyFields.length > 0) {
+    throw new VariableSetsRemovedError(legacyFields);
+  }
+  // An explicit [] still clears an old version's defaults; null means "unchanged".
+  if (bodyRecord && !Array.isArray(bodyRecord.defaultVariableSetIds)) {
+    delete bodyRecord.defaultVariableSetIds;
+  }
+  if (payloadRecord && !Array.isArray(payloadRecord.defaultVariableSetIds)) {
+    delete payloadRecord.defaultVariableSetIds;
+  }
   const imageOverrideUnsupported = Boolean(
     (bodyRecord && Object.hasOwn(bodyRecord, "image")) ||
     (payloadRecord && Object.hasOwn(payloadRecord, "image")),
@@ -51,7 +67,7 @@ async function parseRigRequest<T>(c: Context, schema: ZodType<T>, label: string)
   throw new ApiHttpError(422, {
     code: "validation_failed",
     message: imageOverrideUnsupported
-      ? "Rig base-image overrides are not supported; Rigs use the deployment-managed platform sandbox."
+      ? "Sandbox Environment base-image overrides are not supported; Sandbox Environments use the deployment-managed platform sandbox."
       : `Invalid ${label}.`,
     retryable: false,
     details: {
@@ -77,7 +93,7 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
     const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId, permission);
     const rigId = c.req.param("rigId");
     if (!rigId) {
-      throw new HTTPException(400, { message: "rig id is required" });
+      throw new HTTPException(400, { message: "sandbox environment id is required" });
     }
     const rig = await requireRigForApi(db, authorization.grant, rigId);
     if (
@@ -126,7 +142,7 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
       // The verifying transition already committed. Keep its deterministic
       // attempt identity retryable instead of reporting an opaque 5xx after a
       // durable mutation or inventing a second attempt after an ambiguous start.
-      deps.observability?.warn("rig change verification start failed", {
+      deps.observability?.warn("sandbox environment change verification start failed", {
         workspaceId,
         changeId,
         attempt,
@@ -163,11 +179,14 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
       // Creation already committed. The rig remains fully usable through its
       // runtime setup fallback and can be re-verified explicitly; never turn a
       // successful create into an unretryable 5xx because Temporal was down.
-      deps.observability?.warn("initial rig provider-image verification start failed", {
-        workspaceId,
-        versionId,
-        error: error instanceof Error ? error.message : String(error),
-      });
+      deps.observability?.warn(
+        "initial sandbox environment provider-image verification start failed",
+        {
+          workspaceId,
+          versionId,
+          error: error instanceof Error ? error.message : String(error),
+        },
+      );
       return false;
     }
   }
@@ -183,7 +202,11 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
     const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
     const grant = authorization.grant;
     requirePermission(grant, "rigs:manage");
-    const payload = await parseRigRequest(c, CreateRigRequest, "Rig create request");
+    const payload = await parseRigRequest(
+      c,
+      CreateRigRequest,
+      "Sandbox Environment create request",
+    );
     const allowOrganization =
       payload.scope === "organization" &&
       authorization.accountGrant?.permissions.includes("account:admin") === true;
@@ -222,7 +245,11 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
         message: "missing permission: account:admin",
       });
     }
-    const payload = await parseRigRequest(c, UpdateRigRequest, "Rig update request");
+    const payload = await parseRigRequest(
+      c,
+      UpdateRigRequest,
+      "Sandbox Environment update request",
+    );
     return c.json(await updateRigForApi({ db }, grant, rig, payload, { allowOrganization }));
   });
 
@@ -254,7 +281,11 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/rigs/:rigId/versions", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const { grant, rig } = await requireRigMutation(c, workspaceId, "rigs:manage");
-    const payload = await parseRigRequest(c, RigDefinitionEditPayload, "Rig version request");
+    const payload = await parseRigRequest(
+      c,
+      RigDefinitionEditPayload,
+      "Sandbox Environment version request",
+    );
     const version = await createRigVersionForApi({ db }, grant, rig, payload);
     const started = await tryStartInitialVersionVerification(rig.workspaceId, version.id);
     if (!started) c.header("OpenGeni-Rig-Verification", "deferred");
@@ -289,7 +320,11 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/rigs/:rigId/changes", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const { grant, rig } = await requireRigMutation(c, workspaceId, "rigs:use");
-    const request = await parseRigRequest(c, ProposeRigChangeRequest, "Rig change request");
+    const request = await parseRigRequest(
+      c,
+      ProposeRigChangeRequest,
+      "Sandbox Environment change request",
+    );
     const change = await proposeRigChangeForApi({ db }, grant, rig, request);
     const verification = await startChangeVerification(rig.workspaceId, change.id);
     if (!verification.started) c.header("OpenGeni-Rig-Verification", "deferred");
@@ -336,7 +371,7 @@ export function registerRigRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const { rig } = await requireRigMutation(c, workspaceId, "rigs:use");
     if (!rig.activeVersion) {
-      return c.json({ error: "rig has no active version" }, 422);
+      return c.json({ error: "sandbox environment has no active version" }, 422);
     }
     await startVersionVerification(rig.workspaceId, rig.activeVersion.id);
     return c.json({ ok: true, versionId: rig.activeVersion.id }, 202);