@opengeni/api-router 3.0.1 → 3.1.2

package/src/integrations/github-app-connect.ts

@@ -4,7 +4,6 @@ import { HTTPException } from "hono/http-exception";
 import type { ConnectAdvance, ConnectAttempt } from "@opengeni/contracts/connect";
 import {
   bindAuthorizedGitHubInstallationRepositories,
-  claimConnectOperation,
   finishConnectOperation,
   getConnectAttempt,
   type ConnectActorScope,
@@ -23,11 +22,12 @@ import {
 import { commitGitHubLensConnect, requireGitHubLensConnect } from "./github-lens-connect";
 import type { ApiRouteDeps, PreparedConnectOperation } from "@opengeni/core";
 import { requireConnectOwnerAuthority } from "./connect-authority";
-import { integrationBaseUrl } from "./oauth-client";
+import { claimOAuthAcquisition, finishOAuthAcquisition, integrationBaseUrl } from "./oauth-client";
 import {
   isConsistentGitHubBindingCandidates,
   isConsistentGitHubBindingProof,
 } from "./github-installation-proof";
+import { githubConnectFailureHtml } from "../routes/github-browser-pages";
 
 const stateSchema = z.object({
   kind: z.literal("github_app_connect"),
@@ -177,27 +177,52 @@ export async function completeGitHubAppConnect(
     const stored = await getConnectAttempt(deps.db, state, state.connectAttemptId);
     if (stored.attempt.providerId !== state.providerId || stored.attempt.ownership !== "workspace")
       throw new Error("GitHub attempt mismatch");
-    destination = stored.returnUrl;
     // Reject obsolete browser stages before committing an operation claim.
     // Otherwise a valid older callback could strand the current stage in-flight.
     // Completed callbacks still navigate home without repeating provider work.
-    if (
-      stored.attempt.nextAction.type !== "authorize" ||
-      new URL(stored.attempt.nextAction.url).searchParams.get("state") !== input.state
-    )
-      throw new Error("Stale GitHub setup stage");
-    if (state.providerId === "github-lens") await requireGitHubLensConnect(deps, state.workspaceId);
-    const authorize = callbackAuthority(state);
+    const authorize: ConnectOperationAuthorization = async (tx, attempt, origin) => {
+      await callbackAuthority(state)(tx, attempt, origin);
+      destination = stored.returnUrl;
+    };
+    const acquiring =
+      !input.error && (state.phase === "install" ? input.setupAction !== "request" : !!input.code);
     const operation = {
       attemptId: state.connectAttemptId,
       operationId: `github:${state.nonce}`,
       inputDigest: createHash("sha256").update(input.state!).digest("hex"),
       authorize,
     };
-    const claim = await claimConnectOperation(deps.db, state, {
-      ...operation,
-      expectedRevision: stored.attempt.revision,
-    });
+    const claim = await claimOAuthAcquisition(
+      deps.db,
+      state,
+      {
+        ...operation,
+        expectedRevision: stored.attempt.revision,
+        authorizeAcquisition: async (tx, current) => {
+          if (
+            current.nextAction.type !== "authorize" ||
+            new URL(current.nextAction.url).searchParams.get("state") !== input.state
+          )
+            throw new Error("Stale GitHub setup stage");
+          if (acquiring && state.providerId === "github-lens")
+            await requireGitHubLensConnect({ ...deps, db: tx });
+        },
+      },
+      state.providerId,
+      acquiring,
+    );
+    // Recover a repeated install callback only while its next stage is still
+    // current. A completed/superseded attempt returns home without reopening OAuth.
+    if (
+      claim.status === "replayed" &&
+      state.phase === "install" &&
+      claim.attempt.revision === stored.attempt.revision &&
+      claim.attempt.nextAction.type === "authorize"
+    )
+      return new Response(null, {
+        status: 302,
+        headers: { Location: claim.attempt.nextAction.url },
+      });
     if (claim.status !== "replayed") {
       const provider =
         state.providerId === "github-lens" ? deps.prReviewGithubAppApi : deps.githubAppApi;
@@ -231,7 +256,7 @@ export async function completeGitHubAppConnect(
               error: {
                 code: "owner_approval_pending",
                 message:
-                  "A GitHub organization owner must approve installation. Retry discovery after approval.",
+                  "Request sent. GitHub asked your organization owners to approve Opengeni. After an owner approves, an owner of the organization connects it here.",
                 retryable: true,
               },
             }),
@@ -378,12 +403,33 @@ export async function completeGitHubAppConnect(
           },
         };
       }
-      await finishConnectOperation(deps.db, state, { ...operation, commit: prepared.commit });
+      const completed = acquiring
+        ? await finishOAuthAcquisition(
+            deps.db,
+            state,
+            { ...operation, commit: prepared.commit },
+            state.providerId,
+          )
+        : await finishConnectOperation(deps.db, state, { ...operation, commit: prepared.commit });
+      // Installation is only the first half of consent. Keep this browser on
+      // the exact authorization stage committed above; polling still waits for
+      // the final owner proof before reporting connection completion.
+      if (state.phase === "install" && completed.nextAction.type === "authorize")
+        return new Response(null, { status: 302, headers: { Location: completed.nextAction.url } });
     }
   } catch {
     // Preserve unknown outcomes; never replay provider authorization to recover.
-    if (!destination)
-      return Response.json({ error: "Connection callback is invalid or expired" }, { status: 400 });
+    // This is browser navigation (usually the Connect popup), so explain the
+    // stale or reused link on a page instead of returning a JSON body.
+    if (!destination) {
+      const home =
+        deps.settings.webBaseUrl ??
+        integrationBaseUrl(deps.settings.publicBaseUrl, input.requestUrl);
+      return new Response(githubConnectFailureHtml("expired", `${home.replace(/\/+$/u, "")}/`), {
+        status: 400,
+        headers: { "content-type": "text/html; charset=UTF-8" },
+      });
+    }
   }
   return new Response(null, { status: 302, headers: { Location: destination! } });
 }

package/src/integrations/github-lens-connect.ts

@@ -1,35 +1,20 @@
 import { environmentsEncryptionKeyBytes } from "@opengeni/config";
-import {
-  OPENGENI_PR_REVIEW_PACK_ID,
-  type GitHubInstallationBindingProof,
-} from "@opengeni/contracts";
-import {
-  getCapabilityPack,
-  PR_REVIEW_AUTOMATION_TEMPLATE_ID,
-  prReviewPackConnectorId,
-  type ApiRouteDeps,
-} from "@opengeni/core";
+import { type GitHubInstallationBindingProof } from "@opengeni/contracts";
+import { PR_REVIEW_AUTOMATION_SETUP, type ApiRouteDeps } from "@opengeni/core";
 import {
   encryptVariableSetValue,
-  getPackInstallation,
   recordAuditEvent,
   syncManagedGitHubPrReviewInstallation,
   type Database,
 } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
 
-export async function requireGitHubLensConnect(deps: ApiRouteDeps, workspaceId: string) {
+export async function requireGitHubLensConnect(deps: ApiRouteDeps) {
   if (deps.settings.sandboxBackend === "selfhosted")
-    throw new HTTPException(409, { message: "OpenGeni Lens requires managed compute" });
-  const installation = await getPackInstallation(deps.db, workspaceId, OPENGENI_PR_REVIEW_PACK_ID);
-  if (installation?.status !== "active")
-    throw new HTTPException(409, { message: "Install and enable the Review Bot Pack first" });
-  const template = getCapabilityPack(OPENGENI_PR_REVIEW_PACK_ID)?.automationTemplates?.find(
-    (value) => value.id === PR_REVIEW_AUTOMATION_TEMPLATE_ID,
-  );
-  if (!template || !environmentsEncryptionKeyBytes(deps.settings))
-    throw new HTTPException(503, { message: "Lens template or secret encryption is unavailable" });
-  return { installation, template };
+    throw new HTTPException(409, { message: "Opengeni Lens requires managed compute" });
+  if (!environmentsEncryptionKeyBytes(deps.settings))
+    throw new HTTPException(503, { message: "Lens secret encryption is unavailable" });
+  return { template: PR_REVIEW_AUTOMATION_SETUP };
 }
 
 /** Separate Lens registration/source/automation domain, not a repository-access
@@ -48,10 +33,7 @@ export async function commitGitHubLensConnect(
     nonce: string;
   },
 ) {
-  const { installation, template } = await requireGitHubLensConnect(
-    { ...deps, db: tx },
-    input.workspaceId,
-  );
+  const { template } = await requireGitHubLensConnect({ ...deps, db: tx });
   const synchronized = await syncManagedGitHubPrReviewInstallation(tx, {
     accountId: input.accountId,
     workspaceId: input.workspaceId,
@@ -70,9 +52,6 @@ export async function commitGitHubLensConnect(
     ),
     repositories: input.proof.repositories,
     createdBySubjectId: input.subjectId,
-    packInstallationId: installation.id,
-    packConnectorId: prReviewPackConnectorId("github"),
-    packTemplateId: template.id,
     adapterId: template.adapterId,
     eventTypes: template.eventTypes,
     configuration: template.configuration,