@opengeni/api-router 3.0.1 → 3.1.2

package/src/browser-state-authority.ts

@@ -1,236 +1 @@
-import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "node:crypto";
-import { BROWSER_PROFILE_ARTIFACT_FORMAT } from "@opengeni/contracts";
-
-const ROOT_KEY_BYTES = 32;
-const DATA_KEY_BYTES = 32;
-const IV_BYTES = 12;
-const TAG_BYTES = 16;
-const WRAPPED_PREFIX = "ogbk1";
-const SHA256_PATTERN = /^[0-9a-f]{64}$/u;
-const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
-
-export type BrowserStateOperationScope = {
-  accountId: string;
-  workspaceId: string;
-  browserSessionId: string;
-  operationId: string;
-  objectKey: string;
-};
-
-export type BrowserStateArtifactScope = {
-  accountId: string;
-  workspaceId: string;
-  objectKey: string;
-  artifactDigest: string;
-  contentDigest: string;
-};
-
-/** Deterministic only within one idempotent publication operation. This lets a
- * control-plane retry present browserd with exactly the same secret authority
- * without storing a plaintext key or placing it in an operation row. */
-export function deriveBrowserStateDataKey(
-  rootKey: Uint8Array,
-  scopeInput: BrowserStateOperationScope,
-): Buffer {
-  const scope = operationScope(scopeInput);
-  return createHmac("sha256", root(rootKey))
-    .update("opengeni.browser-state.data-key.v1\0", "utf8")
-    .update(canonicalJson(scope), "utf8")
-    .digest();
-}
-
-/** Associated data for the encrypted profile object. It is reproducible from
- * durable non-secret artifact authority during restore. */
-export function browserStateArtifactAad(
-  scopeInput: Pick<BrowserStateArtifactScope, "accountId" | "workspaceId" | "objectKey">,
-): Buffer {
-  const scope = baseArtifactScope(scopeInput);
-  return Buffer.from(`opengeni.browser-state.artifact-aad.v1\0${canonicalJson(scope)}`, "utf8");
-}
-
-/** Wrap a 32-byte artifact data key under the operator-held root key. The
- * ciphertext is bound to workspace, object, and both integrity digests. */
-export function wrapBrowserStateDataKey(
-  rootKey: Uint8Array,
-  dataKeyInput: Uint8Array,
-  scopeInput: BrowserStateArtifactScope,
-): string {
-  const dataKey = exactKey(dataKeyInput, "browser state data key");
-  const scope = artifactScope(scopeInput);
-  const iv = randomBytes(IV_BYTES);
-  const wrappingKey = browserStateWrappingKey(rootKey, scope);
-  try {
-    const cipher = createCipheriv("aes-256-gcm", wrappingKey, iv);
-    cipher.setAAD(wrapAad(scope));
-    const ciphertext = Buffer.concat([cipher.update(dataKey), cipher.final()]);
-    const payload = Buffer.concat([ciphertext, cipher.getAuthTag()]);
-    return `${WRAPPED_PREFIX}:${iv.toString("base64")}:${payload.toString("base64")}`;
-  } finally {
-    wrappingKey.fill(0);
-  }
-}
-
-export function unwrapBrowserStateDataKey(
-  rootKey: Uint8Array,
-  wrapped: string,
-  scopeInput: BrowserStateArtifactScope,
-): Buffer {
-  const scope = artifactScope(scopeInput);
-  const parts = wrapped.split(":");
-  if (parts.length !== 3 || parts[0] !== WRAPPED_PREFIX) {
-    throw new Error("browser state data-key envelope is unsupported");
-  }
-  const iv = canonicalBase64(parts[1]!, IV_BYTES, "browser state data-key envelope");
-  const payload = canonicalBase64(
-    parts[2]!,
-    DATA_KEY_BYTES + TAG_BYTES,
-    "browser state data-key envelope",
-  );
-  const ciphertext = payload.subarray(0, DATA_KEY_BYTES);
-  const tag = payload.subarray(DATA_KEY_BYTES);
-  const wrappingKey = browserStateWrappingKey(rootKey, scope);
-  try {
-    const decipher = createDecipheriv("aes-256-gcm", wrappingKey, iv);
-    decipher.setAAD(wrapAad(scope));
-    decipher.setAuthTag(tag);
-    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-  } catch {
-    throw new Error("browser state data-key decryption failed");
-  } finally {
-    wrappingKey.fill(0);
-  }
-}
-
-export function browserStateObjectKey(workspaceIdInput: string, operationIdInput: string): string {
-  const workspaceId = uuid(workspaceIdInput, "workspace id");
-  const operationId = uuid(operationIdInput, "browser state operation id");
-  return `workspaces/${workspaceId}/browser-state/revisions/${operationId}/chromium-profile.ogbs`;
-}
-
-export function browserStateManifestDigest(manifest: unknown): string {
-  return createHash("sha256").update(canonicalJson(manifest), "utf8").digest("hex");
-}
-
-function operationScope(input: BrowserStateOperationScope) {
-  const base = baseArtifactScope(input);
-  return {
-    ...base,
-    browserSessionId: uuid(input.browserSessionId, "browser session id"),
-    operationId: uuid(input.operationId, "browser state operation id"),
-  };
-}
-
-function artifactScope(input: BrowserStateArtifactScope) {
-  return {
-    ...baseArtifactScope(input),
-    artifactDigest: sha256(input.artifactDigest, "browser state artifact digest"),
-    contentDigest: sha256(input.contentDigest, "browser state content digest"),
-  };
-}
-
-function baseArtifactScope(
-  input: Pick<BrowserStateArtifactScope, "accountId" | "workspaceId" | "objectKey">,
-) {
-  const workspaceId = uuid(input.workspaceId, "workspace id");
-  const objectKey = browserStateObjectKeyValue(input.objectKey, workspaceId);
-  return {
-    version: 1,
-    accountId: uuid(input.accountId, "account id"),
-    workspaceId,
-    objectKey,
-    format: BROWSER_PROFILE_ARTIFACT_FORMAT,
-  };
-}
-
-function wrapAad(scope: ReturnType<typeof artifactScope>): Buffer {
-  return Buffer.from(`opengeni.browser-state.data-key-wrap.v1\0${canonicalJson(scope)}`, "utf8");
-}
-
-function browserStateWrappingKey(
-  rootKey: Uint8Array,
-  scope: ReturnType<typeof artifactScope>,
-): Buffer {
-  return createHmac("sha256", root(rootKey))
-    .update("opengeni.browser-state.wrapping-key.v1\0", "utf8")
-    .update(canonicalJson(scope), "utf8")
-    .digest();
-}
-
-function browserStateObjectKeyValue(value: string, workspaceId: string): string {
-  if (
-    typeof value !== "string" ||
-    Buffer.byteLength(value) > 2_048 ||
-    !new RegExp(
-      `^workspaces/${workspaceId}/browser-state/[A-Za-z0-9._=-]+(?:/[A-Za-z0-9._=-]+)*$`,
-      "u",
-    ).test(value)
-  ) {
-    throw new Error("browser state object key is invalid");
-  }
-  return value;
-}
-
-function root(value: Uint8Array): Buffer {
-  return exactKey(value, "browser state root key");
-}
-
-function exactKey(value: Uint8Array, label: string): Buffer {
-  if (!(value instanceof Uint8Array) || value.byteLength !== ROOT_KEY_BYTES) {
-    throw new Error(`${label} must be exactly ${ROOT_KEY_BYTES} bytes`);
-  }
-  return Buffer.from(value.buffer, value.byteOffset, value.byteLength);
-}
-
-function uuid(value: string, label: string): string {
-  if (typeof value !== "string" || !UUID_PATTERN.test(value)) {
-    throw new Error(`${label} must be a UUID`);
-  }
-  return value.toLowerCase();
-}
-
-function sha256(value: string, label: string): string {
-  if (typeof value !== "string" || !SHA256_PATTERN.test(value)) {
-    throw new Error(`${label} is invalid`);
-  }
-  return value;
-}
-
-function canonicalBase64(value: string, length: number, label: string): Buffer {
-  if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(value)) {
-    throw new Error(`${label} is unsupported`);
-  }
-  const decoded = Buffer.from(value, "base64");
-  if (decoded.byteLength !== length || decoded.toString("base64") !== value) {
-    decoded.fill(0);
-    throw new Error(`${label} is unsupported`);
-  }
-  return decoded;
-}
-
-function canonicalJson(value: unknown): string {
-  return JSON.stringify(canonicalValue(value));
-}
-
-function canonicalValue(value: unknown): unknown {
-  if (
-    value === null ||
-    typeof value === "string" ||
-    typeof value === "boolean" ||
-    (typeof value === "number" && Number.isFinite(value))
-  ) {
-    return value;
-  }
-  if (Array.isArray(value)) return value.map(canonicalValue);
-  if (typeof value === "object") {
-    const input = value as Record<string, unknown>;
-    const output: Record<string, unknown> = {};
-    for (const key of Object.keys(input).sort()) {
-      if (input[key] === undefined) {
-        throw new Error("canonical JSON cannot contain undefined");
-      }
-      output[key] = canonicalValue(input[key]);
-    }
-    return output;
-  }
-  throw new Error("value cannot be represented as canonical JSON");
-}
+export * from "@opengeni/interaction/browser-state-authority";

package/src/claude-default-models.ts

@@ -0,0 +1,37 @@
+import type { ApiRouteDeps } from "@opengeni/core";
+import {
+  seedOrganizationClaudeDefaultModels,
+  seedWorkspaceClaudeDefaultModels,
+} from "@opengeni/db";
+
+type ClaudeConnectionScope =
+  | { organizationId: string; workspaceId?: undefined }
+  | { accountId: string; workspaceId: string };
+
+/**
+ * After a Claude account connects, offer the default models where this scope
+ * never configured any. The connection has already succeeded, so a failure
+ * here is reported and leaves the model list as it was; people can still add
+ * models themselves.
+ */
+export async function offerClaudeDefaultModels(
+  deps: Pick<ApiRouteDeps, "db">,
+  scope: ClaudeConnectionScope & {
+    actorSubjectId: string;
+    providerKind: "anthropic" | "claude_subscription";
+  },
+): Promise<void> {
+  try {
+    if (scope.workspaceId === undefined) {
+      await seedOrganizationClaudeDefaultModels(deps.db, scope);
+    } else {
+      await seedWorkspaceClaudeDefaultModels(deps.db, scope);
+    }
+  } catch (error) {
+    console.warn("[api] could not add the default Claude models", {
+      providerKind: scope.providerKind,
+      scope: scope.workspaceId === undefined ? "organization" : "workspace",
+      error: error instanceof Error ? error.message : String(error),
+    });
+  }
+}

package/src/claude-subscription-core.ts

@@ -0,0 +1,154 @@
+// Claude's account routes on the shared subscription core (design
+// docs/design/subscription-core-2026-10-07.md, 5.3 "Claude track", C2b).
+// Every caller requires the organization's Claude cutover receipt. Missing
+// or disabled receipts fail closed; legacy tables are never a runtime fallback.
+import { HTTPException } from "hono/http-exception";
+import type { ApiRouteDeps } from "@opengeni/core";
+import {
+  connectSubscriptionCoreClaudeConnection,
+  getSubscriptionCoreClaudeOrganizationProjection,
+  getSubscriptionCoreClaudeWorkspaceProjection,
+  namedSubjectPersonalWorkspaceId,
+  SUBSCRIPTION_CORE_CLAUDE,
+  type Database,
+  type SubscriptionCoreClaudeAccount,
+  type SubscriptionCoreClaudeConnectResult,
+} from "@opengeni/db";
+import {
+  canonicalConnectionId,
+  coreConnectRefused,
+  deliverPoolCoreWake,
+  requireSubscriptionCoreRoute,
+  type SubscriptionPoolCore,
+} from "./routes/subscription-pool-core";
+
+/** The runtime serving Claude for the organization (one receipt read; maintenance is a typed 503). */
+export const claudeCoreRoute = (deps: ApiRouteDeps, accountId: () => Promise<string>) =>
+  requireSubscriptionCoreRoute(deps, "claude", "Claude", accountId);
+
+/** Deliver a core Claude wake after commit (best effort, as every pool wake). */
+export const deliverClaudeCoreWake = (
+  deps: ApiRouteDeps,
+  wake: Parameters<typeof deliverPoolCoreWake>[2],
+) => deliverPoolCoreWake(deps, { binding: SUBSCRIPTION_CORE_CLAUDE }, wake);
+
+/**
+ * Claude on the shared core for the neutral pool routes. The listings add
+ * the legacy usage reading beside the account (`listedAccountJson`); every
+ * other route answers the plain legacy `accountJson`.
+ */
+export function claudePoolCore(
+  accountJson: (account: SubscriptionCoreClaudeAccount, activeId: string | null) => object,
+): SubscriptionPoolCore {
+  return {
+    binding: SUBSCRIPTION_CORE_CLAUDE,
+    workspaceProjection: getSubscriptionCoreClaudeWorkspaceProjection,
+    organizationProjection: getSubscriptionCoreClaudeOrganizationProjection,
+    listedAccountJson: (account, activeId) => {
+      const claude = account as SubscriptionCoreClaudeAccount;
+      // The legacy listing's usage fields, from the core quota reading.
+      return {
+        ...accountJson(claude, activeId),
+        usage: claude.usage,
+        ...(claude.usage.refreshStatus === "reconnect"
+          ? { status: "needs_relogin", lastError: "Sign in to Claude again." }
+          : {}),
+      };
+    },
+  };
+}
+
+type ClaudeCoreScope = { accountId: string; workspaceId: string | null; subjectId: string };
+
+/**
+ * The account a reconnect names, as this caller's listing shows it: a legacy
+ * id resolves through the cutover aliases as the caller may see them
+ * (`canonicalConnectionId`, which resolves a personal account's legacy id
+ * only for its owner in their Personal workspace). Null when the caller's
+ * listing does not show it.
+ */
+export async function claudeCoreAccount(
+  deps: ApiRouteDeps,
+  scope: ClaudeCoreScope,
+  routeId: string,
+): Promise<SubscriptionCoreClaudeAccount | null> {
+  const id = await canonicalConnectionId(deps, SUBSCRIPTION_CORE_CLAUDE, { ...scope, routeId });
+  const projection = scope.workspaceId
+    ? await getSubscriptionCoreClaudeWorkspaceProjection(deps.db, {
+        accountId: scope.accountId,
+        workspaceId: scope.workspaceId,
+        viewerSubjectId: scope.subjectId,
+      })
+    : await getSubscriptionCoreClaudeOrganizationProjection(deps.db, {
+        organizationId: scope.accountId,
+        subjectId: scope.subjectId,
+      });
+  return projection.accounts.find((account) => account.id === id) ?? null;
+}
+
+/**
+ * A private (`user`) Claude account is connected on the core only in the
+ * person's own Personal workspace (strictest reading of the personal rule);
+ * elsewhere, including any shared workspace, it is refused before a sign-in
+ * starts. The connect writer checks the same rule with the exact owner
+ * membership and authority generation in its transaction.
+ */
+export async function requireClaudeCorePersonalWorkspace(
+  deps: ApiRouteDeps,
+  scope: { accountId: string; workspaceId: string | null; subjectId: string },
+): Promise<void> {
+  const own = scope.subjectId.startsWith("user:")
+    ? await namedSubjectPersonalWorkspaceId(deps.db, scope)
+    : null;
+  if (own === null || own !== scope.workspaceId)
+    throw new HTTPException(403, {
+      message: "Connect a private Claude account from your own Personal workspace.",
+    });
+}
+
+/** What a person who cannot reconnect this way is told to do instead. */
+const RECONNECT_REFUSED: Record<
+  "different_account" | "setup_token_over_sign_in" | "sign_in_over_unverified",
+  string
+> = {
+  different_account:
+    "Sign in to the same Claude account to reconnect. Use Add account for a different subscription.",
+  setup_token_over_sign_in:
+    "A setup token can't replace a signed-in Claude account. Add it as a new account.",
+  sign_in_over_unverified:
+    "This account was added without a verified sign-in. Add it again with Sign in, then remove the old one.",
+};
+
+/** The legacy response for a refused core Claude connect. */
+export function claudeCoreConnectRefused(
+  result: Extract<SubscriptionCoreClaudeConnectResult, { kind: "refused" }>,
+  personal: boolean,
+  changedMessage: string,
+): HTTPException | ReturnType<typeof coreConnectRefused> {
+  if (
+    result.reason === "different_account" ||
+    result.reason === "setup_token_over_sign_in" ||
+    result.reason === "sign_in_over_unverified"
+  )
+    return new HTTPException(409, { message: RECONNECT_REFUSED[result.reason] });
+  if (result.reason === "changed") return new HTTPException(409, { message: changedMessage });
+  if (result.reason === "forbidden" && personal)
+    return new HTTPException(403, {
+      message: "Connect a private Claude account from your own Personal workspace.",
+    });
+  return coreConnectRefused(result.reason, "Claude", personal);
+}
+
+/** Connect through the neutral writer; throws the legacy refusal, returns the connection. */
+export async function connectClaudeCore(
+  db: Database,
+  input: Parameters<typeof connectSubscriptionCoreClaudeConnection>[1],
+  changedMessage: string,
+) {
+  const result = await connectSubscriptionCoreClaudeConnection(db, input);
+  if (result.kind === "refused")
+    throw claudeCoreConnectRefused(result, input.personal === true, changedMessage);
+  // The Claude writer always asks for the version (the legacy credential version).
+  if (result.version === undefined) throw new Error("core Claude connect reported no version");
+  return { id: result.id, version: result.version, wake: result.wake };
+}