@opengeni/api-router 3.0.1 → 3.1.2

package/src/routes/connection-authorities.ts

@@ -1,139 +0,0 @@
-import {
-  ConnectionUseGrantMutationResponse,
-  ConnectionUseGrantRevocationResponse,
-  IssueConnectionUseGrantRequest,
-  ListConnectionAuthoritiesQuery,
-  RevokeConnectionUseGrantQuery,
-} from "@opengeni/contracts/connection-authority";
-import {
-  issueManagedHumanUserResourceGrant,
-  listManagedHumanUserResourceAuthorities,
-  requireAccessGrantAuthorization,
-  revokeManagedHumanUserResourceGrant,
-  SessionAuthorizationDeniedError,
-  SessionAuthorizationUnavailableError,
-  SessionTenancyManagedHumanRequiredError,
-  type ApiRouteDeps,
-} from "@opengeni/core";
-import { nestedPostgresSqlState, SessionTenancyNotActivatedError } from "@opengeni/db";
-import type { Context, Hono } from "hono";
-import { HTTPException } from "hono/http-exception";
-import { z } from "zod";
-import {
-  connectionUseGrantLifecycleInput,
-  projectSelfConnectionAuthorities,
-} from "../connection-authority-owner";
-
-async function body<S extends z.ZodType>(context: Context, schema: S): Promise<z.infer<S>> {
-  const parsed = schema.safeParse(await context.req.json().catch(() => null));
-  if (!parsed.success) throw new HTTPException(422, { message: "invalid connection authority" });
-  return parsed.data;
-}
-
-function lifecycleError(error: unknown): never {
-  if (
-    error instanceof SessionAuthorizationDeniedError ||
-    error instanceof SessionTenancyManagedHumanRequiredError ||
-    error instanceof SessionTenancyNotActivatedError
-  ) {
-    throw new HTTPException(403, { message: "connection authority denied" });
-  }
-  if (error instanceof SessionAuthorizationUnavailableError) {
-    throw new HTTPException(503, { message: "session authorization unavailable" });
-  }
-  if (nestedPostgresSqlState(error) === "42501") {
-    throw new HTTPException(403, { message: "connection authority denied" });
-  }
-  if (nestedPostgresSqlState(error) === "22023") {
-    throw new HTTPException(422, { message: "invalid connection authority" });
-  }
-  throw error;
-}
-
-export function registerConnectionAuthorityRoutes(app: Hono, deps: ApiRouteDeps): void {
-  const base = "/v1/workspaces/:workspaceId/connection-authorities";
-
-  app.get(base, async (context) => {
-    const query = ListConnectionAuthoritiesQuery.safeParse({
-      scope: context.req.query("scope"),
-      cursor: context.req.query("cursor"),
-      limit: context.req.query("limit"),
-    });
-    if (!query.success) throw new HTTPException(422, { message: "explicit scope=user required" });
-    const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization(
-      context,
-      deps,
-      workspaceId,
-      "connections:read",
-    );
-    try {
-      return context.json(
-        projectSelfConnectionAuthorities(
-          await listManagedHumanUserResourceAuthorities(deps, access, workspaceId, {
-            resourceKind: "connection",
-            cursor: query.data.cursor,
-            limit: query.data.limit,
-          }),
-        ),
-      );
-    } catch (error) {
-      return lifecycleError(error);
-    }
-  });
-
-  app.post(`${base}/:authorityId/grants`, async (context) => {
-    const workspaceId = context.req.param("workspaceId");
-    const authorityId = z.string().uuid().safeParse(context.req.param("authorityId"));
-    if (!authorityId.success) throw new HTTPException(422, { message: "invalid authority id" });
-    const request = await body(context, IssueConnectionUseGrantRequest);
-    const access = await requireAccessGrantAuthorization(
-      context,
-      deps,
-      workspaceId,
-      "connections:read",
-    );
-    try {
-      const normalized = connectionUseGrantLifecycleInput(request);
-      return context.json(
-        ConnectionUseGrantMutationResponse.parse({
-          scope: "user",
-          grant: await issueManagedHumanUserResourceGrant(
-            deps,
-            access,
-            workspaceId,
-            authorityId.data,
-            { scope: "user", resourceKind: "connection", ...normalized },
-            "http",
-          ),
-        }),
-      );
-    } catch (error) {
-      return lifecycleError(error);
-    }
-  });
-
-  app.delete(`${base}/grants/:grantId`, async (context) => {
-    const query = RevokeConnectionUseGrantQuery.safeParse({ scope: context.req.query("scope") });
-    if (!query.success) throw new HTTPException(422, { message: "explicit scope=user required" });
-    const grantId = z.string().uuid().safeParse(context.req.param("grantId"));
-    if (!grantId.success) throw new HTTPException(422, { message: "invalid grant id" });
-    const workspaceId = context.req.param("workspaceId");
-    const access = await requireAccessGrantAuthorization(
-      context,
-      deps,
-      workspaceId,
-      "workspace:read",
-    );
-    try {
-      return context.json(
-        ConnectionUseGrantRevocationResponse.parse({
-          scope: "user",
-          grant: await revokeManagedHumanUserResourceGrant(deps, access, workspaceId, grantId.data),
-        }),
-      );
-    } catch (error) {
-      return lifecycleError(error);
-    }
-  });
-}

package/src/routes/environments.ts

@@ -1,388 +0,0 @@
-import {
-  CreateVariableSetRequest,
-  ResolveVariableSetAttachmentsRequest,
-  ResolveVariableSetAttachmentsResponse,
-  SetVariableSetVariableRequest,
-  UpdateVariableSetRequest,
-  VariableSetVariableName,
-} from "@opengeni/contracts";
-import {
-  countVariableSets,
-  createVariableSet,
-  decryptVariableSetValue,
-  deleteVariableSet,
-  deleteVariableSetVariable,
-  encryptVariableSetValue,
-  getVariableSetByName,
-  listVariableSets,
-  readVariableSetSecretAtomically,
-  resolveVariableSetAttachments,
-  setVariableSetVariable,
-  updateVariableSet,
-  VariableSetAttachedError,
-} from "@opengeni/db";
-import type { Hono } from "hono";
-import { HTTPException } from "hono/http-exception";
-import {
-  requireAccessGrant,
-  requireAccessGrantAuthorization,
-  requireLiteralPermission,
-  requirePermission,
-} from "@opengeni/core";
-import type { ApiRouteDeps } from "@opengeni/core";
-import {
-  assertAllowedVariableSetVariableName,
-  MAX_ENVIRONMENTS_PER_WORKSPACE,
-  MAX_VARIABLES_PER_ENVIRONMENT,
-  recordVariableSetAuditEvent,
-  requireVariableSetEncryption,
-  requireVariableSetForApi,
-} from "@opengeni/core";
-
-export function registerVariableSetRoutes(app: Hono, deps: ApiRouteDeps): void {
-  const { settings, db } = deps;
-  const prefixes = [
-    "/v1/workspaces/:workspaceId/variable-sets",
-    "/v1/workspaces/:workspaceId/environments",
-  ];
-
-  for (const prefix of prefixes) {
-    app.get(`${prefix}`, async (c) => {
-      const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId);
-      requirePermission(grant, "variable-sets:list");
-      requirePermission(grant, "secrets:list");
-      return c.json(
-        await listVariableSets(db, {
-          accountId: grant.accountId,
-          workspaceId,
-          subjectId: grant.subjectId,
-        }),
-      );
-    });
-
-    app.post(`${prefix}`, async (c) => {
-      const workspaceId = c.req.param("workspaceId")!;
-      const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
-      const grant = authorization.grant;
-      requirePermission(grant, "variable-sets:write");
-      const key = requireVariableSetEncryption(settings);
-      const payload = CreateVariableSetRequest.parse(await c.req.json());
-      if (prefix.endsWith("/environments") && payload.scope !== "workspace") {
-        throw new HTTPException(422, {
-          message: "the legacy environments route only creates workspace-scoped variable sets",
-        });
-      }
-      if (
-        payload.scope === "organization" &&
-        authorization.accountGrant?.permissions.includes("account:admin") !== true
-      ) {
-        throw new HTTPException(403, {
-          message: "missing permission: account:admin",
-        });
-      }
-      if (payload.variables.length > 0) {
-        requirePermission(grant, "secrets:write");
-      }
-      const name = trimmedVariableSetName(payload.name);
-      if (payload.variables.length > MAX_VARIABLES_PER_ENVIRONMENT) {
-        throw new HTTPException(422, {
-          message: `a variable set supports at most ${MAX_VARIABLES_PER_ENVIRONMENT} variables`,
-        });
-      }
-      const variableNames = new Set<string>();
-      for (const variable of payload.variables) {
-        assertAllowedVariableSetVariableName(variable.name);
-        if (variableNames.has(variable.name)) {
-          throw new HTTPException(422, {
-            message: `duplicate variable set variable name: ${variable.name}`,
-          });
-        }
-        variableNames.add(variable.name);
-      }
-      const access = {
-        accountId: grant.accountId,
-        workspaceId,
-        subjectId: grant.subjectId,
-      };
-      if ((await countVariableSets(db, access, payload.scope)) >= MAX_ENVIRONMENTS_PER_WORKSPACE) {
-        throw new HTTPException(422, {
-          message: `a workspace supports at most ${MAX_ENVIRONMENTS_PER_WORKSPACE} variable sets`,
-        });
-      }
-      if (await getVariableSetByName(db, access, name, payload.scope)) {
-        throw new HTTPException(409, {
-          message: `variable set name is already in use: ${name}`,
-        });
-      }
-      // Values are encrypted up front and the variableSet plus all initial
-      // variables are written in one transaction: a failure leaves nothing.
-      const created = await createVariableSet(db, {
-        accountId: grant.accountId,
-        workspaceId,
-        scope: payload.scope,
-        subjectId: grant.subjectId,
-        allowOrganization: payload.scope === "organization",
-        name,
-        description: payload.description ?? null,
-        variables: payload.variables.map((variable) => ({
-          name: variable.name,
-          valueEncrypted: encryptVariableSetValue(key, variable.value),
-        })),
-      });
-      await recordVariableSetAuditEvent(db, {
-        grant,
-        action: "variable_set.created",
-        variableSetId: created.id,
-      });
-      return c.json(created, 201);
-    });
-
-    if (prefix.endsWith("/variable-sets")) {
-      app.post(`${prefix}/resolve-attachments`, async (c) => {
-        const workspaceId = c.req.param("workspaceId")!;
-        const grant = await requireAccessGrant(c, deps, workspaceId);
-        requirePermission(grant, "variable-sets:attach");
-        requirePermission(grant, "variable-sets:use");
-        const payload = ResolveVariableSetAttachmentsRequest.parse(await c.req.json());
-        const variableSets = await resolveVariableSetAttachments(
-          db,
-          {
-            accountId: grant.accountId,
-            workspaceId,
-            subjectId: grant.subjectId,
-          },
-          payload.variableSetIds,
-        );
-        return c.json(ResolveVariableSetAttachmentsResponse.parse({ variableSets }));
-      });
-    }
-
-    app.get(`${prefix}/:variableSetId`, async (c) => {
-      const workspaceId = c.req.param("workspaceId")!;
-      const grant = await requireAccessGrant(c, deps, workspaceId);
-      requirePermission(grant, "variable-sets:read");
-      requirePermission(grant, "secrets:list");
-      return c.json(await requireVariableSetForApi(db, grant, c.req.param("variableSetId")!));
-    });
-
-    if (prefix.endsWith("/variable-sets")) {
-      app.get(`${prefix}/:variableSetId/variables/:name`, async (c) => {
-        const workspaceId = c.req.param("workspaceId")!;
-        const grant = await requireAccessGrant(c, deps, workspaceId);
-        requirePermission(grant, "variable-sets:read");
-        requireLiteralPermission(grant, "secrets:read");
-        const key = requireVariableSetEncryption(settings);
-        const name = parseVariableName(c.req.param("name")!);
-        const secret = await readVariableSetSecretAtomically(db, {
-          accountId: grant.accountId,
-          workspaceId,
-          subjectId: grant.subjectId,
-          variableSetId: c.req.param("variableSetId")!,
-          name,
-          actor: { kind: "subject" },
-          decrypt: (valueEncrypted) => decryptVariableSetValue(key, valueEncrypted),
-        });
-        if (!secret) {
-          throw new HTTPException(404, {
-            message: "variable set variable not found",
-          });
-        }
-        return c.json(secret);
-      });
-    }
-
-    app.patch(`${prefix}/:variableSetId`, async (c) => {
-      const workspaceId = c.req.param("workspaceId")!;
-      const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
-      const grant = authorization.grant;
-      requirePermission(grant, "variable-sets:write");
-      const variableSet = await requireVariableSetForApi(db, grant, c.req.param("variableSetId")!);
-      const allowOrganization =
-        variableSet.scope === "organization" &&
-        authorization.accountGrant?.permissions.includes("account:admin") === true;
-      if (variableSet.scope === "organization" && !allowOrganization) {
-        throw new HTTPException(403, {
-          message: "missing permission: account:admin",
-        });
-      }
-      const payload = UpdateVariableSetRequest.parse(await c.req.json());
-      const name = payload.name !== undefined ? trimmedVariableSetName(payload.name) : undefined;
-      if (name !== undefined && name !== variableSet.name) {
-        const existing = await getVariableSetByName(
-          db,
-          {
-            accountId: grant.accountId,
-            workspaceId,
-            subjectId: grant.subjectId,
-          },
-          name,
-          variableSet.scope,
-        );
-        if (existing && existing.id !== variableSet.id) {
-          throw new HTTPException(409, {
-            message: `variable set name is already in use: ${name}`,
-          });
-        }
-      }
-      const updated = await updateVariableSet(
-        db,
-        { accountId: grant.accountId, workspaceId, subjectId: grant.subjectId },
-        variableSet.id,
-        {
-          ...(name !== undefined ? { name } : {}),
-          ...(payload.description !== undefined ? { description: payload.description } : {}),
-          allowOrganization,
-        },
-      );
-      await recordVariableSetAuditEvent(db, {
-        grant,
-        action: "variable_set.updated",
-        variableSetId: variableSet.id,
-      });
-      return c.json(updated);
-    });
-
-    app.delete(`${prefix}/:variableSetId`, async (c) => {
-      const workspaceId = c.req.param("workspaceId")!;
-      const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
-      const grant = authorization.grant;
-      requirePermission(grant, "variable-sets:write");
-      requirePermission(grant, "secrets:write");
-      const variableSet = await requireVariableSetForApi(db, grant, c.req.param("variableSetId")!);
-      const allowOrganization =
-        variableSet.scope === "organization" &&
-        authorization.accountGrant?.permissions.includes("account:admin") === true;
-      if (variableSet.scope === "organization" && !allowOrganization) {
-        throw new HTTPException(403, {
-          message: "missing permission: account:admin",
-        });
-      }
-      try {
-        await deleteVariableSet(
-          db,
-          {
-            accountId: grant.accountId,
-            workspaceId,
-            subjectId: grant.subjectId,
-          },
-          variableSet.id,
-          { allowOrganization },
-        );
-      } catch (error) {
-        if (error instanceof VariableSetAttachedError) {
-          throw new HTTPException(409, { message: error.message });
-        }
-        throw error;
-      }
-      await recordVariableSetAuditEvent(db, {
-        grant,
-        action: "variable_set.deleted",
-        variableSetId: variableSet.id,
-      });
-      return c.json({ ok: true });
-    });
-
-    app.put(`${prefix}/:variableSetId/variables/:name`, async (c) => {
-      const workspaceId = c.req.param("workspaceId")!;
-      const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
-      const grant = authorization.grant;
-      requirePermission(grant, "variable-sets:write");
-      requirePermission(grant, "secrets:write");
-      const key = requireVariableSetEncryption(settings);
-      const name = parseVariableName(c.req.param("name")!);
-      const variableSet = await requireVariableSetForApi(db, grant, c.req.param("variableSetId")!);
-      const allowOrganization =
-        variableSet.scope === "organization" &&
-        authorization.accountGrant?.permissions.includes("account:admin") === true;
-      if (variableSet.scope === "organization" && !allowOrganization) {
-        throw new HTTPException(403, {
-          message: "missing permission: account:admin",
-        });
-      }
-      const payload = SetVariableSetVariableRequest.parse(await c.req.json());
-      const exists = variableSet.variables.some((variable) => variable.name === name);
-      if (!exists && variableSet.variables.length >= MAX_VARIABLES_PER_ENVIRONMENT) {
-        throw new HTTPException(422, {
-          message: `a variable set supports at most ${MAX_VARIABLES_PER_ENVIRONMENT} variables`,
-        });
-      }
-      const metadata = await setVariableSetVariable(db, {
-        accountId: grant.accountId,
-        workspaceId,
-        subjectId: grant.subjectId,
-        variableSetId: variableSet.id,
-        name,
-        valueEncrypted: encryptVariableSetValue(key, payload.value),
-        allowOrganization,
-      });
-      await recordVariableSetAuditEvent(db, {
-        grant,
-        action: "variable_set.variable.set",
-        variableSetId: variableSet.id,
-        variableName: name,
-      });
-      return c.json(metadata);
-    });
-
-    app.delete(`${prefix}/:variableSetId/variables/:name`, async (c) => {
-      const workspaceId = c.req.param("workspaceId")!;
-      const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
-      const grant = authorization.grant;
-      requirePermission(grant, "variable-sets:write");
-      requirePermission(grant, "secrets:write");
-      const name = parseVariableName(c.req.param("name")!);
-      const variableSet = await requireVariableSetForApi(db, grant, c.req.param("variableSetId")!);
-      const allowOrganization =
-        variableSet.scope === "organization" &&
-        authorization.accountGrant?.permissions.includes("account:admin") === true;
-      if (variableSet.scope === "organization" && !allowOrganization) {
-        throw new HTTPException(403, {
-          message: "missing permission: account:admin",
-        });
-      }
-      const deleted = await deleteVariableSetVariable(db, {
-        accountId: grant.accountId,
-        workspaceId,
-        subjectId: grant.subjectId,
-        variableSetId: variableSet.id,
-        name,
-        allowOrganization,
-      });
-      if (!deleted) {
-        throw new HTTPException(404, {
-          message: "variable set variable not found",
-        });
-      }
-      await recordVariableSetAuditEvent(db, {
-        grant,
-        action: "variable_set.variable.deleted",
-        variableSetId: variableSet.id,
-        variableName: name,
-      });
-      return c.json({ ok: true });
-    });
-  }
-}
-
-/** @deprecated use registerVariableSetRoutes */
-export const registerEnvironmentRoutes = registerVariableSetRoutes;
-
-function parseVariableName(raw: string): string {
-  const parsed = VariableSetVariableName.safeParse(raw);
-  if (!parsed.success) {
-    throw new HTTPException(422, {
-      message: "variable set variable names must match ^[A-Z][A-Z0-9_]*$",
-    });
-  }
-  assertAllowedVariableSetVariableName(parsed.data);
-  return parsed.data;
-}
-
-function trimmedVariableSetName(name: string): string {
-  const trimmed = name.trim();
-  if (!trimmed) {
-    throw new HTTPException(422, { message: "variable set name is required" });
-  }
-  return trimmed;
-}

package/src/routes/host-mcp-bindings.ts

@@ -1,122 +0,0 @@
-import type { Hono } from "hono";
-import { HTTPException } from "hono/http-exception";
-import { z } from "zod";
-import {
-  CreateHostMcpBindingRequest,
-  IssueHostMcpDelegationRequest,
-} from "@opengeni/contracts/host-mcp-bindings";
-import {
-  createHostMcpBinding,
-  getHostMcpBinding,
-  revokeHostMcpBinding,
-  issueHostMcpDelegation,
-  getHostMcpDelegation,
-  revokeHostMcpDelegation,
-  HostMcpDelegationAuthorityError,
-  HostMcpBindingConflictError,
-  withWorkspaceSubjectRls,
-} from "@opengeni/db";
-import {
-  requireAccessGrantAuthorization,
-  prepareHostMcpOwnerAuthorization,
-  type ApiRouteDeps,
-} from "@opengeni/core";
-
-/** Registration is not an execution grant. The durable runtime must separately
- * validate the exact binding generation and accepted execution context. */
-export function registerHostMcpBindingRoutes(app: Hono, deps: ApiRouteDeps): void {
-  for (const entity of ["bindings", "delegations"] as const) {
-    app.on(
-      ["GET", "POST"],
-      [
-        `/v1/workspaces/:workspaceId/host-mcp-${entity}`,
-        `/v1/workspaces/:workspaceId/host-mcp-${entity}/:bindingId`,
-        `/v1/workspaces/:workspaceId/host-mcp-${entity}/:bindingId/revoke`,
-      ],
-      async (c) => {
-        const workspaceId = c.req.param("workspaceId")!;
-        const bindingId = c.req.param("bindingId");
-        const method = c.req.method;
-        const revoke = c.req.path.endsWith("/revoke");
-        if (
-          !(
-            (method === "POST" && !bindingId) ||
-            (method === "GET" && bindingId && !revoke) ||
-            (method === "POST" && bindingId && revoke)
-          )
-        )
-          throw new HTTPException(404, { message: "not found" });
-        const permission = method === "GET" ? "connections:read" : "connections:write";
-        const authorization = await requireAccessGrantAuthorization(
-          c,
-          deps,
-          workspaceId,
-          permission,
-        );
-        const authorizeCommit = prepareHostMcpOwnerAuthorization(
-          authorization,
-          workspaceId,
-          permission,
-        );
-        if (bindingId) z.string().uuid().parse(bindingId);
-        const createInput =
-          method === "POST" && !bindingId
-            ? (entity === "bindings"
-                ? CreateHostMcpBindingRequest
-                : IssueHostMcpDelegationRequest
-              ).parse(await c.req.json())
-            : null;
-        const revokeInput = revoke
-          ? z
-              .object({ expectedGeneration: z.number().int().positive().safe() })
-              .strict()
-              .parse(await c.req.json())
-          : null;
-        const owner = {
-          accountId: authorization.grant.accountId,
-          workspaceId,
-          subjectId: authorization.grant.subjectId,
-        };
-        try {
-          const result = await withWorkspaceSubjectRls(
-            deps.db,
-            workspaceId,
-            owner.subjectId,
-            async (tx) => {
-              const effectiveOwner = await authorizeCommit(tx);
-              if (createInput)
-                return entity === "bindings"
-                  ? createHostMcpBinding(tx, effectiveOwner, createInput)
-                  : issueHostMcpDelegation(tx, effectiveOwner, createInput);
-              const existing = await (
-                entity === "bindings" ? getHostMcpBinding : getHostMcpDelegation
-              )(tx, effectiveOwner, bindingId!);
-              if (!existing)
-                throw new HTTPException(404, {
-                  message:
-                    entity === "bindings" ? "Host binding not found" : "Host delegation not found",
-                });
-              return revokeInput
-                ? (entity === "bindings" ? revokeHostMcpBinding : revokeHostMcpDelegation)(
-                    tx,
-                    effectiveOwner,
-                    bindingId!,
-                    revokeInput.expectedGeneration,
-                  )
-                : existing;
-            },
-          );
-          return c.json(result, createInput ? 201 : 200);
-        } catch (error) {
-          if (error instanceof HostMcpDelegationAuthorityError)
-            throw new HTTPException(403, { message: "Host delegation authority unavailable" });
-          if (error instanceof HostMcpBindingConflictError)
-            throw new HTTPException(409, {
-              message: "Host binding changed; reload before retrying",
-            });
-          throw error;
-        }
-      },
-    );
-  }
-}

package/src/routes/host-mcp-resolvers.ts

@@ -1,41 +0,0 @@
-import type { Hono } from "hono";
-import { hostMcpResolverForRequest, type ApiRouteDeps } from "@opengeni/core";
-
-export function registerHostMcpResolverRoutes(app: Hono, deps: ApiRouteDeps): void {
-  const path = "/v1/organizations/:organizationId/mcp-credential-resolvers/:externalSource";
-  app.get(path, async (context) =>
-    context.json(
-      await hostMcpResolverForRequest(
-        context,
-        deps,
-        context.req.param("organizationId"),
-        context.req.param("externalSource"),
-        "get",
-      ),
-    ),
-  );
-  app.put(path, async (context) =>
-    context.json(
-      await hostMcpResolverForRequest(
-        context,
-        deps,
-        context.req.param("organizationId"),
-        context.req.param("externalSource"),
-        "put",
-        await context.req.json().catch(() => null),
-      ),
-    ),
-  );
-  app.post(`${path}/revoke`, async (context) =>
-    context.json(
-      await hostMcpResolverForRequest(
-        context,
-        deps,
-        context.req.param("organizationId"),
-        context.req.param("externalSource"),
-        "revoke",
-        await context.req.json().catch(() => null),
-      ),
-    ),
-  );
-}