@opengeni/api-router 3.0.1 → 3.1.2

package/src/routes/external-identity-links.ts

@@ -28,6 +28,7 @@ import {
   type AccessGrantAuthorization,
   type ApiRouteDeps,
 } from "@opengeni/core";
+import { parseRequestBody, parseRequestJson, readRequestJson } from "../http/request-body";
 
 function nativeConfirmation(authorization: AccessGrantAuthorization) {
   if (
@@ -36,7 +37,7 @@ function nativeConfirmation(authorization: AccessGrantAuthorization) {
     authorization.authenticatedSubjectId !== authorization.grant.subjectId ||
     !authorization.grant.subjectId.startsWith("user:")
   )
-    throw new HTTPException(403, { message: "Confirm using your authenticated OpenGeni account" });
+    throw new HTTPException(403, { message: "Confirm using your authenticated Opengeni account" });
 }
 
 /** Both products address the link through a workspace they already own. The
@@ -78,7 +79,7 @@ export function registerExternalIdentityLinkRoutes(app: Hono, deps: ApiRouteDeps
     const continuation = externalActorContinuationForAuthorization(authorization);
     if (!continuation || continuation.actor.actingMode !== "external")
       throw new HTTPException(403, { message: "Start linking as the external product user" });
-    const input = BeginExternalIdentityLinkRequest.parse(await c.req.json());
+    const input = await parseRequestJson(c, BeginExternalIdentityLinkRequest);
     if (input.expiresAt !== null && Date.parse(input.expiresAt) <= Date.now())
       throw new HTTPException(422, { message: "Link expiry must be in the future" });
     const commit = externalContinuationCommitAuthorizer(authorization)!;
@@ -124,7 +125,7 @@ export function registerExternalIdentityLinkRoutes(app: Hono, deps: ApiRouteDeps
     if (operation === "preview" || operation === "confirm" || !external)
       nativeConfirmation(authorization);
     const grant = authorization.grant;
-    const input = c.req.method === "POST" ? await c.req.json() : null;
+    const input = c.req.method === "POST" ? await readRequestJson(c) : null;
     try {
       const result = await withWorkspaceSubjectRls(
         deps.db,
@@ -133,10 +134,10 @@ export function registerExternalIdentityLinkRoutes(app: Hono, deps: ApiRouteDeps
         async (tx) => {
           await externalContinuationCommitAuthorizer(authorization)?.(tx);
           if (operation === "preview") {
-            const request = z
-              .object({ challenge: ConfirmExternalIdentityLinkRequest.shape.challenge })
-              .strict()
-              .parse(input);
+            const request = parseRequestBody(
+              z.object({ challenge: ConfirmExternalIdentityLinkRequest.shape.challenge }).strict(),
+              input,
+            );
             const preview = await previewExternalIdentityLink(tx, {
               accountId: grant.accountId,
               linkId,
@@ -147,7 +148,7 @@ export function registerExternalIdentityLinkRoutes(app: Hono, deps: ApiRouteDeps
               : null;
           }
           if (operation === "confirm") {
-            const request = ConfirmExternalIdentityLinkRequest.parse(input);
+            const request = parseRequestBody(ConfirmExternalIdentityLinkRequest, input);
             await lockExternalWorkspaceMembershipLifecycle(tx, grant.accountId);
             const personalWorkspaceId = await namedSubjectPersonalWorkspaceId(tx, {
               accountId: grant.accountId,
@@ -180,10 +181,10 @@ export function registerExternalIdentityLinkRoutes(app: Hono, deps: ApiRouteDeps
           }
           const scope = { accountId: grant.accountId, linkId, subjectId: grant.subjectId };
           if (operation === "revoke") {
-            const request = z
-              .object({ expectedRevision: z.number().int().positive().safe() })
-              .strict()
-              .parse(input);
+            const request = parseRequestBody(
+              z.object({ expectedRevision: z.number().int().positive().safe() }).strict(),
+              input,
+            );
             return revokeExternalIdentityLink(tx, { ...scope, ...request });
           }
           return getExternalIdentityLink(tx, scope);

package/src/routes/files.ts

@@ -1,3 +1,4 @@
+import { readSessionAttachmentFiles } from "@opengeni/core";
 import { ZodError } from "zod";
 import {
   CompleteFileUploadResponse,
@@ -14,6 +15,7 @@ import {
   retainedGeneratedImageReferenceFromFile,
   retainedGeneratedVideoReferenceFromFile,
   retainedScreenshotReferenceFromFile,
+  retainedSessionScreenshotKindFromObjectKey,
   VideoArtifactPlaybackSource,
   resolveRetainedOutputRange,
   type RetainedArtifactMetadata,
@@ -56,12 +58,14 @@ import type { ApiRouteDeps } from "@opengeni/core";
 import { retryWhileMissing } from "@opengeni/storage";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { buildFilesMcpServer } from "../mcp/files";
+import { userContentResponseHeaders, userContentSignedGetUrlOptions } from "../http/user-content";
 import { mcpOAuthAuthenticateHeader, resolveMcpOAuthRouteAccess } from "../mcp-oauth";
 import { withAccessGrantSessionRlsContext } from "../access-grant-rls";
 import {
   buildWorkspaceToolGatewayMcpServer,
   prepareMcpOAuthWorkspaceToolGateway,
 } from "../workspace-tool-gateway";
+import { parseRequestJson } from "../http/request-body";
 
 export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { db, objectStorage } = deps;
@@ -73,6 +77,7 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
     "/v1/workspaces/:workspaceId/files",
     "/v1/workspaces/:workspaceId/files/*",
     "/v1/workspaces/:workspaceId/artifacts/*",
+    "/v1/workspaces/:workspaceId/sessions/:sessionId/artifacts/*",
   ]) {
     app.use(path, async (c, next) => {
       const permission = c.req.path.includes("/files/uploads") ? "files:upload" : "files:read";
@@ -153,7 +158,7 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
         message: "object storage is not configured",
       });
     }
-    const payload = CreateFileUploadRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, CreateFileUploadRequest);
     const privateOwner = fileRequestAuthority.get(c.req.raw)?.owner ?? null;
     const personal =
       payload.scope === "personal" ||
@@ -405,15 +410,28 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
     );
   });
 
-  app.get("/v1/workspaces/:workspaceId/files/:fileId", async (c) => {
-    const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
-    const file = await requireFileForSubject(db, {
+  const readRequestedFile = async (
+    c: Context,
+    grant: Awaited<ReturnType<typeof requireAccessGrant>>,
+  ) => {
+    const fileId = c.req.param("fileId") ?? "";
+    const sessionId = c.req.query("sessionId");
+    if (sessionId) {
+      if (!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/iu.test(sessionId)) return null;
+      return (await readSessionAttachmentFiles(deps, grant, sessionId, [fileId]))[0] ?? null;
+    }
+    return requireFileForSubject(db, {
       accountId: grant.accountId,
-      workspaceId,
+      workspaceId: grant.workspaceId,
       subjectId: grant.subjectId,
-      fileId: c.req.param("fileId"),
+      fileId,
     }).catch(() => null);
+  };
+
+  app.get("/v1/workspaces/:workspaceId/files/:fileId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
+    const file = await readRequestedFile(c, grant).catch(() => null);
     if (!file) {
       throw new HTTPException(404, { message: "file not found" });
     }
@@ -480,7 +498,10 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (!videoPresent) {
       throw new HTTPException(410, { message: "generated video bytes are unavailable" });
     }
-    const signed = await objectStorage.createGetUrl({ key: file.objectKey });
+    const signed = await objectStorage.createGetUrl({
+      key: file.objectKey,
+      ...userContentSignedGetUrlOptions(file.contentType, file.filename),
+    });
     await recordAuditEvent(db, {
       accountId: grant.accountId,
       workspaceId,
@@ -589,12 +610,7 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
         message: "object storage is not configured",
       });
     }
-    const file = await requireFileForSubject(db, {
-      accountId: grant.accountId,
-      workspaceId,
-      subjectId: grant.subjectId,
-      fileId: c.req.param("fileId"),
-    }).catch(() => null);
+    const file = await readRequestedFile(c, grant).catch(() => null);
     if (!file) {
       throw new HTTPException(404, { message: "file not found" });
     }
@@ -607,7 +623,10 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
     if (!present) {
       throw new HTTPException(410, { message: "file bytes are unavailable" });
     }
-    const signed = await objectStorage.createGetUrl({ key: file.objectKey });
+    const signed = await objectStorage.createGetUrl({
+      key: file.objectKey,
+      ...userContentSignedGetUrlOptions(file.contentType, file.filename),
+    });
     await recordAuditEvent(db, {
       accountId: grant.accountId,
       workspaceId,
@@ -675,12 +694,15 @@ async function serveRetainedArtifactContent(
     );
   }
 
+  // Stored bytes and their content type are user- or agent-chosen; this origin
+  // also serves the console, so the response is a sandboxed, non-embeddable
+  // document and active markup downloads instead of rendering.
   const headers = {
     "Accept-Ranges": range.acceptRanges,
     "Cache-Control": "private, no-store",
     "Content-Length": String(range.length),
     "Content-Type": metadata.contentType,
-    "X-Content-Type-Options": "nosniff",
+    ...userContentResponseHeaders(metadata.contentType, file.filename),
     ...(range.contentRange ? { "Content-Range": range.contentRange } : {}),
   };
   if (range.kind === "empty") {
@@ -878,12 +900,15 @@ function retainedScreenshotMetadata(
     artifact.sessionId &&
     artifact.retentionExpiresAt.getTime() > Date.now()
   ) {
+    const kind = retainedSessionScreenshotKindFromObjectKey(artifact.file.objectKey);
+    if (!kind) return retainedArtifactUnavailable(artifact.artifactId, "invalid_content");
     const reference = retainedScreenshotReferenceFromFile({
       ...artifact.file,
       sessionId: artifact.sessionId,
       width: artifact.width,
       height: artifact.height,
       expiresAt: artifact.retentionExpiresAt.toISOString(),
+      kind,
     });
     if (reference) return reference;
   }