@opengeni/api-router 3.0.1 → 3.1.2

package/src/routes/site-sql.ts

@@ -0,0 +1,263 @@
+import { SITE_FRAME_HEADER } from "@opengeni/contracts/site-session-http";
+import {
+  SITE_SQL_ERROR_STATUS,
+  SITE_SQL_EXPORT_NEXT_CURSOR_HEADER,
+  SiteSqlExportFormat,
+  SiteSqlImportRequest,
+  SiteSqlMigrationRequest,
+  SiteSqlResetRequest,
+  SiteSqlStatementRequest,
+  SiteSqlQueryDefinitionRequest,
+  SiteSqlRunRequest,
+  SiteSqlSettingsRequest,
+  type ErrorCode,
+  type SiteSqlErrorCode,
+} from "@opengeni/contracts";
+import { requireAccessGrant, type ApiRouteDeps } from "@opengeni/core";
+import type { Context, Hono } from "hono";
+import { z } from "zod";
+import { ApiHttpError } from "../http/api-error";
+import { USER_CONTENT_SECURITY_HEADERS } from "../http/user-content";
+import type { SiteDataSurface } from "../site-data/service";
+import {
+  defineSiteSqlQuery,
+  describeSiteSql,
+  exportSiteSql,
+  importSiteSql,
+  inspectSiteSql,
+  migrateSiteSql,
+  resetSiteSql,
+  runSiteSqlQuery,
+  runSiteSqlStatement,
+  setSiteSqlSettings,
+  SiteSqlError,
+} from "../site-sql/service";
+
+const SiteId = z.string().uuid();
+
+const PUBLIC_CODE: Record<SiteSqlErrorCode, ErrorCode> = {
+  validation: "validation_failed",
+  sql_error: "validation_failed",
+  conflict: "conflict",
+  disabled: "conflict",
+  not_found: "not_found",
+  forbidden: "forbidden",
+  quota_exceeded: "limit_exceeded",
+  rate_limited: "limit_exceeded",
+  unavailable: "upstream_unavailable",
+};
+
+/** Typed Site SQL errors in the public envelope; `details.code` is the Site SQL code. */
+export function siteSqlHttpError(error: SiteSqlError): ApiHttpError {
+  return new ApiHttpError(SITE_SQL_ERROR_STATUS[error.code], {
+    code: PUBLIC_CODE[error.code],
+    message: error.message,
+    retryable: error.code === "rate_limited" || error.details.retryable === true,
+    outcomeUnknown: error.details.outcomeUnknown === true,
+    details: { ...error.details, code: error.code },
+  });
+}
+
+export async function runSiteSqlRoute<T>(fn: () => Promise<T>): Promise<T> {
+  try {
+    return await fn();
+  } catch (error) {
+    if (error instanceof SiteSqlError) throw siteSqlHttpError(error);
+    throw error;
+  }
+}
+
+export async function siteSqlBody<S extends z.ZodType>(
+  context: Context,
+  schema: S,
+): Promise<z.infer<S>> {
+  const parsed = schema.safeParse(await context.req.json().catch(() => null));
+  if (!parsed.success)
+    throw siteSqlHttpError(
+      new SiteSqlError(
+        "validation",
+        parsed.error.issues
+          .slice(0, 3)
+          .map((issue) => `${issue.path.join(".") || "request"}: ${issue.message}`)
+          .join("; "),
+      ),
+    );
+  return parsed.data;
+}
+
+function siteId(context: Context): string {
+  const parsed = SiteId.safeParse(context.req.param("artifactId"));
+  if (!parsed.success) throw siteSqlHttpError(new SiteSqlError("not_found", "Site not found"));
+  return parsed.data;
+}
+
+/** Like Site Data: the frame marker or pinned Site id makes a request framed. */
+function surface(context: Context): SiteDataSurface {
+  const frame = context.req.header("x-opengeni-site-id");
+  const marked = context.req.header(SITE_FRAME_HEADER) !== undefined;
+  if (!frame && !marked) return {};
+  return { frameSiteId: frame ?? "" };
+}
+
+function refuseFramed(context: Context, what: string): void {
+  if (surface(context).frameSiteId !== undefined)
+    throw siteSqlHttpError(new SiteSqlError("forbidden", `A Site cannot ${what}`));
+}
+
+/**
+ * Site SQL routes. Running a named query needs Site access (`artifacts:read`
+ * and the viewer's audience); the query's audience decides the rest. Everything
+ * else is management: a manager of the Site outside any Site frame, with
+ * `artifacts:read` to look and `artifacts:publish` to change.
+ */
+export function registerSiteSqlRoutes(app: Hono, deps: ApiRouteDeps): void {
+  const base = "/v1/workspaces/:workspaceId/published-artifacts/:artifactId/sql";
+  const grantFor = (context: Context, permission: "artifacts:read" | "artifacts:publish") =>
+    requireAccessGrant(context, deps, context.req.param("workspaceId")!, permission);
+
+  app.get(base, async (context) => {
+    const grant = await grantFor(context, "artifacts:read");
+    refuseFramed(context, "manage its database");
+    return context.json(await runSiteSqlRoute(() => describeSiteSql(deps, grant, siteId(context))));
+  });
+
+  app.put(`${base}/settings`, async (context) => {
+    const grant = await grantFor(context, "artifacts:publish");
+    const request = await siteSqlBody(context, SiteSqlSettingsRequest);
+    refuseFramed(context, "manage its database");
+    return context.json(
+      await runSiteSqlRoute(() => setSiteSqlSettings(deps, grant, siteId(context), request)),
+    );
+  });
+
+  app.post(`${base}/queries/:name`, async (context) => {
+    const grant = await grantFor(context, "artifacts:read");
+    const request = await siteSqlBody(context, SiteSqlRunRequest);
+    return context.json(
+      await runSiteSqlRoute(() =>
+        runSiteSqlQuery(
+          deps,
+          grant,
+          siteId(context),
+          context.req.param("name")!,
+          request.params ?? {},
+          surface(context),
+        ),
+      ),
+    );
+  });
+
+  app.put(`${base}/queries/:name`, async (context) => {
+    const grant = await grantFor(context, "artifacts:publish");
+    const request = await siteSqlBody(context, SiteSqlQueryDefinitionRequest);
+    refuseFramed(context, "define queries");
+    const result = await runSiteSqlRoute(() =>
+      defineSiteSqlQuery(deps, grant, siteId(context), context.req.param("name")!, request),
+    );
+    return context.json(result.query, result.created ? 201 : 200);
+  });
+
+  app.delete(`${base}/queries/:name`, async (context) => {
+    const grant = await grantFor(context, "artifacts:publish");
+    refuseFramed(context, "delete queries");
+    await runSiteSqlRoute(() =>
+      defineSiteSqlQuery(deps, grant, siteId(context), context.req.param("name")!, null),
+    );
+    return context.json({ deleted: true });
+  });
+
+  app.post(`${base}/migrations`, async (context) => {
+    const grant = await grantFor(context, "artifacts:publish");
+    const request = await siteSqlBody(context, SiteSqlMigrationRequest);
+    refuseFramed(context, "change its database schema");
+    return context.json(
+      await runSiteSqlRoute(() => migrateSiteSql(deps, grant, siteId(context), request)),
+      201,
+    );
+  });
+
+  app.post(`${base}/query`, async (context) => {
+    const grant = await grantFor(context, "artifacts:read");
+    const request = await siteSqlBody(context, SiteSqlStatementRequest);
+    refuseFramed(context, "run ad hoc SQL");
+    return context.json(
+      await runSiteSqlRoute(() =>
+        runSiteSqlStatement(deps, grant, siteId(context), request, "read"),
+      ),
+    );
+  });
+
+  app.post(`${base}/execute`, async (context) => {
+    const grant = await grantFor(context, "artifacts:publish");
+    const request = await siteSqlBody(context, SiteSqlStatementRequest);
+    refuseFramed(context, "run ad hoc SQL");
+    return context.json(
+      await runSiteSqlRoute(() =>
+        runSiteSqlStatement(deps, grant, siteId(context), request, "write"),
+      ),
+    );
+  });
+
+  app.get(`${base}/inspect`, async (context) => {
+    const grant = await grantFor(context, "artifacts:read");
+    refuseFramed(context, "inspect its database");
+    return context.json(await runSiteSqlRoute(() => inspectSiteSql(deps, grant, siteId(context))));
+  });
+
+  app.get(`${base}/export`, async (context) => {
+    const grant = await grantFor(context, "artifacts:read");
+    refuseFramed(context, "export its database");
+    const format = SiteSqlExportFormat.safeParse(context.req.query("format") ?? "sql");
+    if (!format.success)
+      throw siteSqlHttpError(new SiteSqlError("validation", "format is sql, csv or json"));
+    const table = context.req.query("table");
+    const cursor = context.req.query("cursor");
+    if (cursor !== undefined && (cursor.length === 0 || cursor.length > 4096))
+      throw siteSqlHttpError(
+        new SiteSqlError("validation", "cursor is a nextCursor from an export"),
+      );
+    const maxBytesText = context.req.query("maxBytes");
+    const maxBytes = maxBytesText === undefined ? undefined : Number(maxBytesText);
+    if (maxBytes !== undefined && (!Number.isSafeInteger(maxBytes) || maxBytes < 1024))
+      throw siteSqlHttpError(
+        new SiteSqlError("validation", "maxBytes is a whole number of bytes, at least 1024"),
+      );
+    const exported = await runSiteSqlRoute(() =>
+      exportSiteSql(deps, grant, siteId(context), {
+        format: format.data,
+        ...(table ? { table } : {}),
+        ...(cursor ? { cursor } : {}),
+        ...(maxBytes !== undefined ? { maxBytes } : {}),
+      }),
+    );
+    return new Response(exported.content, {
+      headers: {
+        "Content-Type": exported.contentType,
+        "Content-Disposition": `attachment; filename="${exported.filename}"`,
+        ...USER_CONTENT_SECURITY_HEADERS,
+        "X-OpenGeni-Export-Truncated": exported.truncated ? "true" : "false",
+        ...(exported.nextCursor
+          ? { [SITE_SQL_EXPORT_NEXT_CURSOR_HEADER]: exported.nextCursor }
+          : {}),
+      },
+    });
+  });
+
+  app.post(`${base}/import`, async (context) => {
+    const grant = await grantFor(context, "artifacts:publish");
+    const request = await siteSqlBody(context, SiteSqlImportRequest);
+    refuseFramed(context, "import data");
+    return context.json(
+      await runSiteSqlRoute(() => importSiteSql(deps, grant, siteId(context), request)),
+    );
+  });
+
+  app.post(`${base}/reset`, async (context) => {
+    const grant = await grantFor(context, "artifacts:publish");
+    const request = await siteSqlBody(context, SiteSqlResetRequest);
+    refuseFramed(context, "reset its database");
+    return context.json(
+      await runSiteSqlRoute(() => resetSiteSql(deps, grant, siteId(context), request)),
+    );
+  });
+}

package/src/routes/skill-content.ts

@@ -1,10 +1,12 @@
 import { z } from "zod";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
-import { SkillFile, type SkillWriteReceipt } from "@opengeni/contracts";
+import { SkillFile, SKILL_MAX_FILES, type SkillWriteReceipt } from "@opengeni/contracts";
+import { getSessionForSubject, readSkillRemovalScope } from "@opengeni/db";
 import {
   approveSkill,
   rejectSkill,
+  removeSkill,
   listSkills,
   readSkill,
   requireAccessGrant,
@@ -26,13 +28,14 @@ const saveRequest = z
     expectedScopeVersion: z.number().int().nonnegative(),
     scope: scopeSchema.default("workspace"),
     stableKey: z.string().min(1).max(96),
-    files: z.array(SkillFile).max(128),
-    deletions: z.array(z.string().min(1).max(512)).max(128).default([]),
+    files: z.array(SkillFile).max(SKILL_MAX_FILES),
+    deletions: z.array(z.string().min(1).max(512)).max(SKILL_MAX_FILES).default([]),
     reason: z.string().min(1).max(2000),
   })
   .strict();
 const revisionRequest = z
   .object({
+    removalOperationId: z.uuid().optional(),
     operationId: z.uuid(),
     revisionId: z.uuid(),
     expectedRevisionId: z.uuid().nullable(),
@@ -41,6 +44,8 @@ const revisionRequest = z
   })
   .strict();
 
+const removeRequest = revisionRequest.omit({ revisionId: true, removalOperationId: true });
+
 async function parseSkillRequest<S extends z.ZodType>(c: Context, schema: S): Promise<z.infer<S>> {
   const parsed = schema.safeParse(await c.req.json().catch(() => null));
   if (!parsed.success) throw new HTTPException(422, { message: "Invalid Skill request" });
@@ -64,9 +69,20 @@ export function registerSkillContentRoutes(app: Hono, deps: ApiRouteDeps): void
       .object({
         limit: z.coerce.number().int().min(1).max(250).default(100),
         cursor: z.string().max(2048).optional(),
+        sessionId: z.uuid().optional(),
       })
       .safeParse(c.req.query());
     if (!query.success) throw new HTTPException(422, { message: "Invalid Skill list query" });
+    if (query.data.sessionId) {
+      await requireAccessGrant(c, deps, workspaceId, "sessions:read");
+      const session = await getSessionForSubject(
+        deps.db,
+        workspaceId,
+        query.data.sessionId,
+        grant.subjectId,
+      );
+      if (!session) throw new HTTPException(404, { message: "Session not found" });
+    }
     let after: { stableKey: string; id: string } | undefined;
     if (query.data.cursor !== undefined) {
       try {
@@ -81,7 +97,12 @@ export function registerSkillContentRoutes(app: Hono, deps: ApiRouteDeps): void
     const rows = await listSkills(
       deps.db,
       { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
-      { limit: query.data.limit + 1, metadataOnly: true, ...(after ? { after } : {}) },
+      {
+        limit: query.data.limit + 1,
+        metadataOnly: true,
+        ...(after ? { after } : {}),
+        ...(query.data.sessionId ? { sessionId: query.data.sessionId } : {}),
+      },
     );
     const page = rows.slice(0, query.data.limit);
     const last = page.at(-1);
@@ -169,6 +190,36 @@ export function registerSkillContentRoutes(app: Hono, deps: ApiRouteDeps): void
     );
     return c.json(receipt);
   });
+  app.post(`${base}/:skillId/remove`, async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:read");
+    const skillId = skillIdentifier(c.req.param("skillId"));
+    const request = await parseSkillRequest(c, removeRequest);
+    const context = {
+      accountId: access.grant.accountId,
+      workspaceId,
+      subjectId: access.grant.subjectId,
+    };
+    const current = await readSkill(deps.db, context, skillId);
+    const scope =
+      current?.scope ??
+      (await readSkillRemovalScope(deps.db, context, skillId, request.operationId));
+    if (!scope) throw new HTTPException(404, { message: "Skill not found" });
+    authorizePreferenceRegistryScopeMutation(access, scope);
+    if (scope === "organization")
+      throw new HTTPException(403, { message: "Organization skills cannot be removed here." });
+    return c.json(
+      await skillMutation(() =>
+        removeSkill(deps.db, {
+          ...request,
+          skillId,
+          accountId: context.accountId,
+          workspaceId,
+          actor: { kind: "human", principalKind: "human_session", subjectId: context.subjectId },
+        }),
+      ),
+    );
+  });
   for (const operation of ["approve", "reject", "restore"] as const) {
     app.post(`${base}/:skillId/${operation}`, async (c) => {
       const workspaceId = c.req.param("workspaceId");
@@ -180,8 +231,22 @@ export function registerSkillContentRoutes(app: Hono, deps: ApiRouteDeps): void
         { accountId: access.grant.accountId, workspaceId, subjectId: access.grant.subjectId },
         skillId,
       );
-      if (!current) throw new HTTPException(404, { message: "Skill not found" });
-      authorizePreferenceRegistryScopeMutation(access, current.scope);
+      const scope =
+        current?.scope ??
+        (operation === "approve" && request.removalOperationId
+          ? await readSkillRemovalScope(
+              deps.db,
+              {
+                accountId: access.grant.accountId,
+                workspaceId,
+                subjectId: access.grant.subjectId,
+              },
+              skillId,
+              request.operationId,
+            )
+          : null);
+      if (!scope) throw new HTTPException(404, { message: "Skill not found" });
+      authorizePreferenceRegistryScopeMutation(access, scope);
       const apply =
         operation === "approve"
           ? approveSkill
@@ -214,7 +279,7 @@ async function skillMutation(run: () => Promise<SkillWriteReceipt>): Promise<Ski
     let current: unknown = error;
     for (let depth = 0; depth < 4 && current && typeof current === "object"; depth++) {
       const candidate = current as { code?: unknown; cause?: unknown };
-      if (candidate.code === "23505" || candidate.code === "40001")
+      if (candidate.code === "23505" || candidate.code === "40001" || candidate.code === "55P03")
         throw new HTTPException(409, {
           message:
             "Skill changed or this operation key was reused. Reload and reconcile the change.",

package/src/routes/skills.ts

@@ -38,6 +38,7 @@ import type { Hono } from "hono";
 import { createGitHubSkillSourceClient } from "../integrations/github-skill-source";
 import { registerSkillContentRoutes } from "./skill-content";
 import { skillInstallerActor, skillRemovalActor } from "./skill-install-authority";
+import { parseRequestJson } from "../http/request-body";
 
 export type SkillRouteOverrides = Readonly<{
   github?: GitHubSkillSourceClient;
@@ -88,7 +89,7 @@ export function registerSkillRoutes(
     const { grant } = access;
     const skillActor = skillInstallerActor(access);
     const libraryId = decodeURIComponent(c.req.param("libraryId"));
-    const payload = InstallLibrarySkillRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, InstallLibrarySkillRequest);
     let loaded: ReturnType<typeof loadSkillLibrarySkill>;
     try {
       loaded = loadSkillLibrarySkill(libraryId, payload.expectedVersion);
@@ -150,7 +151,7 @@ export function registerSkillRoutes(
   app.post("/v1/workspaces/:workspaceId/skills/preview", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-    const payload = PreviewSkillImportRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, PreviewSkillImportRequest);
     const resolved = await resolveForRoute(payload.url, github);
     const installed = await getPortableSkillUninstallPreview(
       deps.db,
@@ -176,7 +177,7 @@ export function registerSkillRoutes(
     );
     const { grant } = access;
     const skillActor = skillInstallerActor(access);
-    const payload = InstallSkillRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, InstallSkillRequest);
     const resolved = await resolveForRoute(payload.url, github);
     if (
       resolved.preview.sourceCommit !== payload.expectedSourceCommit ||
@@ -252,7 +253,7 @@ export function registerSkillRoutes(
     const { grant } = access;
     const skillActor = skillRemovalActor(access);
     const capabilityId = decodeURIComponent(c.req.param("capabilityId"));
-    const payload = UninstallSkillRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, UninstallSkillRequest);
     try {
       return c.json(
         UninstallSkillResult.parse(

package/src/routes/slack-bot-access.ts

@@ -0,0 +1,108 @@
+import {
+  AvailableOpenGeniSlackBots,
+  OpenGeniSlackBotOrganizationAccess,
+  UpdateOpenGeniSlackBotOrganizationAccess,
+} from "@opengeni/contracts";
+import {
+  isOpenGeniSlackBotConnection,
+  requireAccessGrant,
+  type ApiRouteDeps,
+} from "@opengeni/core";
+import {
+  availableSlackBotConnectionMetadata,
+  nestedPostgresSqlState,
+  readOrganizationSlackBotAccess,
+  setOrganizationSlackBotAccess,
+  sharedOrganizationSlackBots,
+} from "@opengeni/db";
+import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+import { authorizeOrganizationIntegrationAdministration } from "./organization-integration-policy";
+
+export function registerSlackBotAccessRoutes(app: Hono, deps: ApiRouteDeps): void {
+  const base = "/v1/workspaces/:workspaceId/connections";
+  app.get(`${base}/:connectionId/slack-bot/organization-access`, async (context) => {
+    const grant = await requireAccessGrant(
+      context,
+      deps,
+      context.req.param("workspaceId"),
+      "connections:read",
+    );
+    const connectionId = z.string().uuid().safeParse(context.req.param("connectionId"));
+    if (!connectionId.success) throw new HTTPException(422, { message: "Invalid bot connection" });
+    context.header("cache-control", "private, no-store");
+    try {
+      return context.json(
+        OpenGeniSlackBotOrganizationAccess.parse(
+          await readOrganizationSlackBotAccess(deps.db, {
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            connectionId: connectionId.data,
+          }),
+        ),
+      );
+    } catch (error) {
+      if (nestedPostgresSqlState(error) === "42501")
+        throw new HTTPException(404, { message: "Local bot installation unavailable" });
+      throw error;
+    }
+  });
+  app.get(`${base}/slack-bot/available`, async (context) => {
+    const grant = await requireAccessGrant(
+      context,
+      deps,
+      context.req.param("workspaceId"),
+      "connections:read",
+    );
+    context.header("cache-control", "private, no-store");
+    const [connections, shares] = await Promise.all([
+      availableSlackBotConnectionMetadata(deps.db, grant),
+      sharedOrganizationSlackBots(deps.db, grant),
+    ]);
+    return context.json(
+      AvailableOpenGeniSlackBots.parse({
+        connections: connections.filter(
+          (connection) =>
+            connection.status === "active" && isOpenGeniSlackBotConnection(connection),
+        ),
+        organizationSharedConnectionIds: shares.map((share) => share.connectionId),
+      }),
+    );
+  });
+  app.put(`${base}/:connectionId/slack-bot/organization-access`, async (context) => {
+    const grant = await requireAccessGrant(
+      context,
+      deps,
+      context.req.param("workspaceId"),
+      "connections:write",
+    );
+    const connectionId = z.string().uuid().safeParse(context.req.param("connectionId"));
+    const request = UpdateOpenGeniSlackBotOrganizationAccess.safeParse(
+      await context.req.json().catch(() => null),
+    );
+    if (!connectionId.success || !request.success)
+      throw new HTTPException(422, { message: "Invalid bot access setting" });
+    context.header("cache-control", "private, no-store");
+    try {
+      const result = await setOrganizationSlackBotAccess(
+        deps.db,
+        {
+          accountId: grant.accountId,
+          workspaceId: grant.workspaceId,
+          connectionId: connectionId.data,
+          enabled: request.data.enabled,
+        },
+        () => authorizeOrganizationIntegrationAdministration(context, deps, grant.accountId, true),
+      );
+      return context.json(OpenGeniSlackBotOrganizationAccess.parse(result));
+    } catch (error) {
+      if (error instanceof HTTPException) throw error;
+      if (nestedPostgresSqlState(error) === "42501")
+        throw new HTTPException(403, {
+          message: "Organization administrator and a verified local bot installation required",
+        });
+      throw error;
+    }
+  });
+}

package/src/routes/social.ts

@@ -2,8 +2,10 @@ import {
   CreateSocialConnectionRequest,
   CreateSocialPostRequest,
   OAuthStartResponse,
+  OrganizationIntegrationDeniedError,
   SocialOAuthStartRequest,
 } from "@opengeni/contracts";
+import { withOrganizationIntegrationAcquisition } from "@opengeni/db/organization-integration-policy";
 import {
   createSocialConnection,
   createSocialPost,
@@ -24,6 +26,7 @@ import {
 import type { ApiRouteDeps } from "@opengeni/core";
 import { boundedLimit } from "../http/common";
 import { completeSocialOAuthCallback, startSocialOAuth } from "../integrations/social-oauth";
+import { parseRequestJson } from "../http/request-body";
 
 export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { db, settings, observability } = deps;
@@ -44,22 +47,28 @@ export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/social/connections", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const payload = CreateSocialConnectionRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, CreateSocialConnectionRequest);
     try {
       return c.json(
-        await createSocialConnection(db, {
-          accountId: grant.accountId,
-          workspaceId,
-          provider: payload.provider,
-          accountHandle: payload.accountHandle,
-          accountName: payload.accountName ?? null,
-          externalAccountId: payload.externalAccountId ?? null,
-          status: payload.status,
-          scopes: payload.scopes,
-          credentialRef: payload.credentialRef ?? null,
-          tokenMetadata: payload.tokenMetadata,
-          metadata: payload.metadata,
-        }),
+        await withOrganizationIntegrationAcquisition(
+          db,
+          { accountId: grant.accountId, workspaceId },
+          [payload.provider === "x" || payload.provider === "reddit" ? payload.provider : null],
+          (tx) =>
+            createSocialConnection(tx, {
+              accountId: grant.accountId,
+              workspaceId,
+              provider: payload.provider,
+              accountHandle: payload.accountHandle,
+              accountName: payload.accountName ?? null,
+              externalAccountId: payload.externalAccountId ?? null,
+              status: payload.status,
+              scopes: payload.scopes,
+              credentialRef: payload.credentialRef ?? null,
+              tokenMetadata: payload.tokenMetadata,
+              metadata: payload.metadata,
+            }),
+        ),
         201,
       );
     } catch (error) {
@@ -168,7 +177,7 @@ export function registerSocialRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.post("/v1/workspaces/:workspaceId/social/posts", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const payload = CreateSocialPostRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, CreateSocialPostRequest);
     try {
       return c.json(
         await createSocialPost(db, {
@@ -222,6 +231,9 @@ function parseConnectionIds(raw: string | undefined): string[] | undefined {
 }
 
 function socialHttpException(error: unknown): HTTPException {
+  if (error instanceof OrganizationIntegrationDeniedError) {
+    return new HTTPException(403, { message: error.message });
+  }
   const message = error instanceof Error ? error.message : String(error);
   if (message.includes("not found")) {
     return new HTTPException(404, { message });