@opengeni/api-router 3.0.1 → 3.1.2

package/src/routes/managed-sign-in-methods.ts

@@ -0,0 +1,433 @@
+import {
+  ManagedSignInMethods,
+  ManagedSignInPasswordMutation,
+  ManagedSignInProviderMutation,
+  ManagedSignInMutationResponse,
+} from "@opengeni/contracts/managed-sign-in-methods";
+import type { ApiRouteDeps } from "@opengeni/core";
+import {
+  requireCanonicalHumanRequestIdentity,
+  getManagedAuthRequestActorLeaseStamp,
+  markManagedAuthRequestActorTransitionApplied,
+} from "@opengeni/core/canonical-human-identities";
+import {
+  MANAGED_AUTH_SESSION_SET_COOKIE,
+  managedAuthSha256,
+  managedAuthSecretRequestDigest,
+  requireManagedAuthMutationAdmission,
+} from "@opengeni/core/managed-auth-session-sets";
+import { getManagedAuthSessionSetSnapshot } from "@opengeni/db/managed-auth-session-sets";
+import { getCanonicalHumanIdentityProjection } from "@opengeni/db/canonical-human-identities";
+import { sql } from "drizzle-orm";
+import type { Context, Hono } from "hono";
+import { getCookie } from "hono/cookie";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+import {
+  isolatedManagedAuthOAuthCallbackRequest,
+  hashManagedAuthPassword,
+  verifyManagedAuthPassword,
+} from "../auth/managed-auth";
+import { runManagedSignInConnect } from "../auth/managed-auth-attempt-context";
+import { deliverManagedSignInNotification } from "../auth/managed-sign-in-notifications";
+import { managedAuthSelectedProofHeaders } from "../auth/managed-auth-session-adapter";
+import { scrubManagedAuthProviderResponse } from "./managed-auth-session-sets";
+
+const ConnectState = z.object({
+  opengeniSignInMethod: z.object({
+    intentId: z.string().uuid(),
+    provider: z.enum(["google", "github"]),
+  }),
+  link: z.object({ userId: z.string().min(1), email: z.string().email() }),
+  callbackURL: z.string().url(),
+  errorURL: z.string().url(),
+});
+const ConnectIntent = z.object({
+  authUserId: z.string().min(1),
+  authSessionId: z.string().min(1),
+  expectedIdentityId: z.string().uuid(),
+  actorFence: z
+    .object({
+      authorityHash: z.string().regex(/^[0-9a-f]{64}$/),
+      actorEpoch: z.string().regex(/^[1-9][0-9]*$/),
+      requestId: z.string().uuid(),
+    })
+    .optional(),
+});
+
+async function rows<T>(deps: ApiRouteDeps, query: ReturnType<typeof sql>): Promise<T[]> {
+  const result = await deps.db.execute(query);
+  return (Array.isArray(result) ? result : (result as { rows: T[] }).rows) as T[];
+}
+
+async function identity(context: Context, deps: ApiRouteDeps) {
+  return requireCanonicalHumanRequestIdentity(context, {
+    db: deps.db,
+    managedAuth: deps.managedAuth,
+    managedAuthSessionAdapter: deps.managedAuthSessionAdapter,
+    managedAuthSessionSetMode: deps.settings.managedAuthSessionSetMode,
+  });
+}
+
+export async function admitManagedSignInMutation(context: Context, deps: ApiRouteDeps) {
+  const origin = deps.settings.publicBaseUrl ? new URL(deps.settings.publicBaseUrl).origin : null;
+  if (
+    !origin ||
+    context.req.header("origin") !== origin ||
+    context.req.header("sec-fetch-site") !== "same-origin" ||
+    context.req.header("content-type")?.split(";", 1)[0] !== "application/json"
+  ) {
+    throw new HTTPException(403, { message: "Same-origin browser mutation required" });
+  }
+  const authority = getCookie(context, MANAGED_AUTH_SESSION_SET_COOKIE);
+  if (deps.settings.managedAuthSessionSetMode !== "legacy" && authority) {
+    const snapshot = await getManagedAuthSessionSetSnapshot(deps.db, {
+      authorityHash: managedAuthSha256(authority),
+      mode: deps.settings.managedAuthSessionSetMode,
+      readOnly: true,
+    });
+    if (!snapshot) throw new HTTPException(401);
+    try {
+      requireManagedAuthMutationAdmission({
+        request: context.req.raw,
+        allowedOrigins: [origin],
+        authority,
+        signingSecret: deps.settings.betterAuthSecret!,
+        expectedGeneration: snapshot.projection.generation,
+      });
+    } catch {
+      throw new HTTPException(403, { message: "Browser session-set CSRF validation failed" });
+    }
+  }
+}
+
+function configured(deps: ApiRouteDeps, provider: "credential" | "google" | "github") {
+  return (
+    provider === "credential" ||
+    (provider === "google"
+      ? Boolean(
+          deps.settings.managedAuthGoogleClientId && deps.settings.managedAuthGoogleClientSecret,
+        )
+      : Boolean(
+          deps.settings.managedAuthGithubClientId && deps.settings.managedAuthGithubClientSecret,
+        ))
+  );
+}
+
+function mutationError(context: Context, error: unknown): Response {
+  let candidate: unknown = error;
+  for (
+    let depth = 0;
+    depth < 5 && candidate instanceof Error;
+    depth++, candidate = candidate.cause
+  ) {
+    const code = candidate.message.match(/SIGN_IN_METHOD_[A-Z_]+/)?.[0];
+    if (code)
+      return context.json(
+        { code, message: code.toLowerCase().replaceAll("_", " ") },
+        code.includes("CONFLICT") ||
+          code.includes("REUSED") ||
+          code.includes("CHANGED") ||
+          code.includes("COLLISION") ||
+          code.includes("ALREADY")
+          ? 409
+          : 403,
+      );
+  }
+  throw error;
+}
+
+export function registerManagedSignInMethodRoutes(app: Hono, deps: ApiRouteDeps): void {
+  const base = "/v1/auth/sign-in-methods";
+  app.use(`${base}*`, async (context, next) => {
+    context.header("cache-control", "no-store");
+    await next();
+  });
+  app.get(base, async (context) => {
+    const actor = await identity(context, deps);
+    const projection = await getCanonicalHumanIdentityProjection(deps.db, actor.authUserId);
+    const [user] = await rows<{ email: string; emailVerified: boolean; fresh: boolean }>(
+      deps,
+      sql`
+      select u.email, u.email_verified as "emailVerified", s.created_at > clock_timestamp()-interval '5 minutes' as fresh
+      from auth_users u join auth_sessions s on s.user_id=u.id where u.id=${actor.authUserId} and s.id=${actor.authSessionId}`,
+    );
+    if (!user) throw new HTTPException(401);
+    const accounts = await rows<{ provider: string; usable: boolean }>(
+      deps,
+      sql`
+      select provider_id as provider, (provider_id <> 'credential' or length(password)>0) as usable from auth_identities where user_id=${actor.authUserId}`,
+    );
+    const connected = (provider: string) =>
+      accounts.some((a) => a.provider === provider && a.usable) &&
+      projection.loginBindings.some((b) => b.providerId === provider && b.status === "active");
+    const count = (["credential", "google", "github"] as const).filter(
+      (p) => connected(p) && configured(deps, p),
+    ).length;
+    return context.json(
+      ManagedSignInMethods.parse({
+        ...user,
+        identityId: projection.activeIdentity.id,
+        identityRevision: projection.activeIdentity.identityRevision,
+        freshAuthenticationRequired: !user.fresh,
+        methods: (["credential", "google", "github"] as const).map((provider) => ({
+          provider,
+          connected: connected(provider),
+          available: configured(deps, provider),
+          canDisconnect:
+            provider !== "credential" &&
+            connected(provider) &&
+            count - (configured(deps, provider) ? 1 : 0) > 0,
+          implicitRelinkingSuppressed:
+            !connected(provider) &&
+            projection.loginBindings.some(
+              (b) => b.providerId === provider && b.status !== "active",
+            ),
+        })),
+      }),
+    );
+  });
+  for (const kind of ["connect", "disconnect", "password"] as const) {
+    app.post(`${base}/${kind}`, async (context) => {
+      await admitManagedSignInMutation(context, deps);
+      const actor = await identity(context, deps);
+      const actorFence = getManagedAuthRequestActorLeaseStamp(context.req.raw);
+      if (deps.settings.managedAuthSessionSetMode !== "legacy" && !actorFence)
+        throw new HTTPException(409, { message: "Managed actor fence required" });
+      const schema =
+        kind === "password" ? ManagedSignInPasswordMutation : ManagedSignInProviderMutation;
+      const parsed = schema.safeParse(await context.req.json().catch(() => null));
+      if (!parsed.success)
+        throw new HTTPException(422, { message: "Invalid sign-in method request" });
+      const body = parsed.data;
+      const currentIdentity = await getCanonicalHumanIdentityProjection(deps.db, actor.authUserId);
+      if (currentIdentity.activeIdentity.id !== body.expectedIdentityId)
+        return context.json(
+          {
+            code: "SIGN_IN_METHOD_IDENTITY_CHANGED",
+            message: "The signed-in account changed; reload security settings",
+          },
+          409,
+        );
+      const [user] = await rows<{ email: string; token: string }>(
+        deps,
+        sql`select u.email,s.token from auth_users u join auth_sessions s on s.user_id=u.id where u.id=${actor.authUserId} and s.id=${actor.authSessionId}`,
+      );
+      if (!user) throw new HTTPException(401);
+      const request: Record<string, unknown> = {
+        kind,
+        operationId: body.operationId,
+        requestDigest: managedAuthSecretRequestDigest(deps.settings.betterAuthSecret!, {
+          kind,
+          ...body,
+        }),
+        expectedIdentityRevision: body.expectedIdentityRevision,
+        expectedIdentityId: body.expectedIdentityId,
+        usableProviders: (["credential", "google", "github"] as const).filter((p) =>
+          configured(deps, p),
+        ),
+        ...(actorFence ? { actorFence } : {}),
+      };
+      try {
+        const [prior] = await rows<{ result: unknown }>(
+          deps,
+          sql`select replay_managed_sign_in_method(${actor.authUserId},${actor.authSessionId},${JSON.stringify(request)}::jsonb) result`,
+        );
+        if (prior?.result)
+          return context.json(
+            kind === "connect"
+              ? {
+                  url: new URL(
+                    "/settings/security?signInMethod=connected",
+                    deps.settings.publicBaseUrl!,
+                  ).toString(),
+                }
+              : ManagedSignInMutationResponse.parse(prior.result),
+          );
+      } catch (error) {
+        return mutationError(context, error);
+      }
+      // Per-human, cross-replica admission before password hashing or creating
+      // OAuth state. Successful committed-result replay does not spend a slot.
+      const [limit] = await rows<{ count: number }>(
+        deps,
+        sql`
+        insert into auth_rate_limits(id,key,count,last_request)
+        values(${`sign-in-methods:${actor.authUserId}`},${`sign-in-methods:${actor.authUserId}`},1,(extract(epoch from clock_timestamp())*1000)::bigint)
+        on conflict(key) do update set
+          count=case when auth_rate_limits.last_request < (extract(epoch from clock_timestamp())*1000)::bigint-60000 then 1 else least(auth_rate_limits.count+1,11) end,
+          last_request=case when auth_rate_limits.last_request < (extract(epoch from clock_timestamp())*1000)::bigint-60000 then (extract(epoch from clock_timestamp())*1000)::bigint else auth_rate_limits.last_request end
+        returning count`,
+      );
+      if (!limit || limit.count > 10)
+        return context.json(
+          {
+            code: "SIGN_IN_METHOD_RATE_LIMITED",
+            message: "Too many sign-in method attempts; try again in one minute",
+          },
+          429,
+        );
+      if ("provider" in body) {
+        request.provider = body.provider;
+        if (kind === "connect" && !configured(deps, body.provider))
+          throw new HTTPException(409, { message: "Sign-in provider is not configured" });
+      } else {
+        const [credential] = await rows<{ password: string | null }>(
+          deps,
+          sql`select password from auth_identities where user_id=${actor.authUserId} and provider_id='credential'`,
+        );
+        if (
+          credential?.password &&
+          (!body.currentPassword ||
+            !(await verifyManagedAuthPassword(body.currentPassword, credential.password)))
+        ) {
+          return context.json(
+            {
+              code: "SIGN_IN_METHOD_CURRENT_PASSWORD_REQUIRED",
+              message: "Enter your current password",
+            },
+            403,
+          );
+        }
+        request.expectedPasswordHash = credential?.password ?? null;
+        request.passwordHash = await hashManagedAuthPassword(body.newPassword);
+      }
+      try {
+        await rows(
+          deps,
+          sql`select mutate_managed_sign_in_method(${actor.authUserId},${actor.authSessionId},${JSON.stringify(request)}::jsonb)`,
+        );
+        if (kind === "connect" && "provider" in body) {
+          const headers = await managedAuthSelectedProofHeaders(deps.managedAuth!, user.token);
+          headers.set("origin", new URL(deps.settings.publicBaseUrl!).origin);
+          const callbackURL = new URL(
+            "/settings/security?signInMethod=connected",
+            deps.settings.publicBaseUrl!,
+          ).toString();
+          const errorCallbackURL = new URL(
+            "/settings/security?signInMethod=error",
+            deps.settings.publicBaseUrl!,
+          ).toString();
+          const result = await deps.managedAuth!.api.linkSocialAccount({
+            headers,
+            returnHeaders: true,
+            body: {
+              provider: body.provider,
+              callbackURL,
+              errorCallbackURL,
+              disableRedirect: true,
+              additionalData: {
+                opengeniSignInMethod: { intentId: body.operationId, provider: body.provider },
+              },
+            },
+          });
+          for (const cookie of result.headers.getSetCookie())
+            context.header("set-cookie", cookie, { append: true });
+          return context.json({ url: result.response.url });
+        }
+        if (actorFence) markManagedAuthRequestActorTransitionApplied(context.req.raw);
+        return context.json({
+          reauthenticationRequired: true,
+          notification: await deliverManagedSignInNotification(
+            deps.db,
+            deps.managedEmailTransport,
+            body.operationId,
+          ),
+        });
+      } catch (error) {
+        return mutationError(context, error);
+      }
+    });
+  }
+}
+
+/** Intercept only database-backed, product-issued explicit connect states. */
+export async function handleManagedSignInConnectCallback(
+  context: Context,
+  deps: ApiRouteDeps,
+  provider: "google" | "github",
+): Promise<Response | null> {
+  const state = context.req.query("state");
+  if (!state || !deps.managedAuth) return null;
+  const verification = await (
+    await deps.managedAuth.$context
+  ).internalAdapter.findVerificationValue(state);
+  if (!verification?.value) return null;
+  let rawState: unknown;
+  try {
+    rawState = JSON.parse(verification.value);
+  } catch {
+    return null;
+  }
+  if (!rawState || typeof rawState !== "object" || !("opengeniSignInMethod" in rawState))
+    return null;
+  const parsed = ConnectState.safeParse(rawState);
+  if (!parsed.success)
+    throw new HTTPException(403, { message: "Invalid sign-in method OAuth proof" });
+  const value = parsed.data,
+    proof = value.opengeniSignInMethod;
+  if (
+    proof.provider !== provider ||
+    value.callbackURL !==
+      new URL(
+        "/settings/security?signInMethod=connected",
+        deps.settings.publicBaseUrl!,
+      ).toString() ||
+    value.errorURL !==
+      new URL("/settings/security?signInMethod=error", deps.settings.publicBaseUrl!).toString()
+  )
+    throw new HTTPException(403);
+  const [intent] = await rows<{ value: string }>(
+    deps,
+    sql`select value from auth_verifications where identifier=${`managed-sign-in:${proof.intentId}`} and expires_at>clock_timestamp()`,
+  );
+  if (!intent) throw new HTTPException(403, { message: "Sign-in method connection expired" });
+  const request = ConnectIntent.parse(JSON.parse(intent.value));
+  const authority = getCookie(context, MANAGED_AUTH_SESSION_SET_COOKIE);
+  if (!request.actorFence) {
+    const ambient = await deps.managedAuthSessionAdapter?.resolveAmbientSession(
+      context.req.raw.headers,
+    );
+    if (
+      !ambient ||
+      ambient.session.id !== request.authSessionId ||
+      ambient.user.id !== request.authUserId
+    ) {
+      return context.redirect(
+        new URL(
+          "/settings/security?signInMethod=error&error=SIGN_IN_METHOD_IDENTITY_CHANGED",
+          deps.settings.publicBaseUrl!,
+        ).toString(),
+      );
+    }
+  }
+  if (
+    request.actorFence &&
+    (!authority || managedAuthSha256(authority) !== request.actorFence.authorityHash)
+  )
+    throw new HTTPException(403);
+  if (value.link?.userId !== request.authUserId || value.link?.email === undefined)
+    throw new HTTPException(403);
+  const isolated = await isolatedManagedAuthOAuthCallbackRequest(deps.managedAuth, context.req.raw);
+  const response = await runManagedSignInConnect(proof.intentId, () =>
+    deps.managedAuth!.handler(isolated.request),
+  );
+  const [linked] = await rows<{ email: string }>(
+    deps,
+    sql`select u.email from auth_identities a join auth_users u on u.id=a.user_id where a.managed_link_intent_id=${proof.intentId}`,
+  );
+  if (linked)
+    await deliverManagedSignInNotification(deps.db, deps.managedEmailTransport, proof.intentId);
+  if (response.status >= 400 || !linked) {
+    return context.redirect(
+      new URL(
+        "/settings/security?signInMethod=error&error=SIGN_IN_METHOD_CONNECT_FAILED",
+        deps.settings.publicBaseUrl!,
+      ).toString(),
+    );
+  }
+  return scrubManagedAuthProviderResponse(response, {
+    replacementCookies: [],
+    preserveCookieNames: [isolated.stateCookieName],
+  });
+}

package/src/routes/memory-slack-publications.ts

@@ -25,6 +25,7 @@ import {
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { createOpenGeniSlackBotInteractionClient } from "../integrations/slack-bot";
+import { parseRequestJson } from "../http/request-body";
 
 export function registerMemorySlackPublicationRoutes(app: Hono, deps: ApiRouteDeps): void {
   const base = "/v1/workspaces/:workspaceId/memory-slack-publications";
@@ -45,7 +46,7 @@ export function registerMemorySlackPublicationRoutes(app: Hono, deps: ApiRouteDe
   app.put(`${base}/configuration`, async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const payload = UpdateMemorySlackPublicationConfigurationRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, UpdateMemorySlackPublicationConfigurationRequest);
     let slackTeamId: string | null = null;
     let channelName = payload.slackChannelName;
     if (payload.connectionId || payload.slackChannelId) {
@@ -179,7 +180,7 @@ export function registerMemorySlackPublicationRoutes(app: Hono, deps: ApiRouteDe
   app.post(`${base}/:publicationId/action`, async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const payload = MemorySlackPublicationActionRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, MemorySlackPublicationActionRequest);
     const publication = await actOnMemorySlackPublication(deps.db, {
       workspaceId,
       publicationId: c.req.param("publicationId"),

package/src/routes/model-account-choice.ts

@@ -0,0 +1,194 @@
+import {
+  ModelAccountPreferences,
+  SessionModelAccountChoiceResponse,
+  SetSessionModelAccountChoiceRequest,
+  SetSessionModelAccountChoiceResponse,
+  UpdateModelAccountPreferencesRequest,
+} from "@opengeni/contracts";
+import { requireAccessContext, requireAccessGrant, type ApiRouteDeps } from "@opengeni/core";
+import {
+  chooseSubscriptionCoreSessionAccount,
+  deliverSubscriptionCoreProviderWakes,
+  readSubscriptionCoreSessionAccountChoice,
+  readSubscriptionPersonPreferences,
+  writeSubscriptionPersonPreferences,
+} from "@opengeni/db";
+import { publishDurableSessionEvents } from "@opengeni/events";
+import type { Context, Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+
+import { ApiHttpError } from "../http/api-error";
+import { isAgentActingAsPerson, requireFullAccessIfAgent } from "../http/acting-person";
+import { requireSameOriginBrowserMutation } from "./codex";
+
+const Uuid = z.string().uuid();
+
+function parseId(value: string | undefined, what: string): string {
+  const parsed = Uuid.safeParse(value);
+  if (!parsed.success) throw new HTTPException(404, { message: `${what} not found` });
+  return parsed.data;
+}
+
+async function jsonBody(c: Context): Promise<unknown> {
+  return await c.req.json().catch(() => null);
+}
+
+/** The calling person in this organization (a human, or an agent acting as one). */
+async function requireOrganizationPerson(
+  c: Context,
+  deps: ApiRouteDeps,
+  mutation: boolean,
+): Promise<{ organizationId: string; subjectId: string }> {
+  const organizationId = parseId(c.req.param("organizationId"), "organization");
+  if (mutation) {
+    requireSameOriginBrowserMutation(c, deps);
+    if (isAgentActingAsPerson(c)) requireFullAccessIfAgent(c, "Changing model account preferences");
+  }
+  const context = await requireAccessContext(c, deps);
+  const grant = context.accountGrants.find((each) => each.accountId === organizationId);
+  if (!grant || !context.subjectId.startsWith("user:")) {
+    throw new HTTPException(404, { message: "organization not found" });
+  }
+  return { organizationId, subjectId: context.subjectId };
+}
+
+/**
+ * Explicit model-account choice for a session and a person's own
+ * preferences, for every provider on the shared subscription core
+ * (SUB-SEL-02, SUB-SEL-04, SUB-ELIG-05, SUB-OWN-05, D-24, D-27, D-28).
+ *
+ * The session routes sit behind the session authorization middleware
+ * (`session.read` to read, the account-choice operation to write), so a
+ * private session is reachable only by its owner. The database enforces
+ * which account a session may use; these routes translate its outcome.
+ */
+export function registerModelAccountChoiceRoutes(app: Hono, deps: ApiRouteDeps): void {
+  const sessionPath = "/v1/workspaces/:workspaceId/sessions/:sessionId/model-account";
+
+  app.get(sessionPath, async (c) => {
+    c.header("cache-control", "private, no-store");
+    const workspaceId = parseId(c.req.param("workspaceId"), "workspace");
+    const sessionId = parseId(c.req.param("sessionId"), "session");
+    await requireAccessGrant(c, deps, workspaceId, "sessions:read");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const choice = await readSubscriptionCoreSessionAccountChoice(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+      sessionId,
+      subjectId: grant.subjectId,
+    });
+    if (!choice) throw new HTTPException(404, { message: "session not found" });
+    return c.json(
+      SessionModelAccountChoiceResponse.parse({
+        binding: choice.binding,
+        bindings: choice.bindings,
+        serving: choice.serving,
+        accounts: choice.connections,
+        personal: choice.personal,
+      }),
+    );
+  });
+
+  app.put(sessionPath, async (c) => {
+    const workspaceId = parseId(c.req.param("workspaceId"), "workspace");
+    const sessionId = parseId(c.req.param("sessionId"), "session");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "sessions:control");
+    const parsed = SetSessionModelAccountChoiceRequest.safeParse(await jsonBody(c));
+    if (!parsed.success) {
+      throw new HTTPException(422, {
+        message: "connectionId must be an account id or null, with an optional provider",
+      });
+    }
+    const result = await chooseSubscriptionCoreSessionAccount(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+      sessionId,
+      connectionId: parsed.data.connectionId,
+      provider: parsed.data.provider ?? null,
+      subjectId: grant.subjectId,
+    });
+    switch (result.outcome) {
+      case "not_found":
+        throw new HTTPException(404, { message: "session or account not found" });
+      case "refused":
+        throw new ApiHttpError(409, {
+          code: "conflict",
+          message: "this account cannot be used for this session",
+          retryable: false,
+          outcomeUnknown: false,
+          details: { reason: "account_not_eligible" },
+        });
+      case "conflict":
+        // The choice kept losing a deadlock to a concurrent placement after
+        // its bounded replay; nothing changed.
+        throw new ApiHttpError(409, {
+          code: "conflict",
+          message: "the session's account changed at the same time; try again",
+          retryable: true,
+          outcomeUnknown: false,
+          details: { reason: "binding_busy" },
+        });
+      case "changed":
+        // Waiters recheck on their own bounded timer; a lost wake only delays.
+        await deliverSubscriptionCoreProviderWakes(deps.db, result.wakes);
+        await publishDurableSessionEvents(deps.bus, workspaceId, sessionId, result.events);
+        break;
+      case "unchanged":
+        break;
+    }
+    return c.json(
+      SetSessionModelAccountChoiceResponse.parse({
+        changed: result.outcome === "changed",
+        appliedTo: result.appliedTo,
+        provider: result.provider,
+        connectionId: result.connectionId,
+        choice: parsed.data.connectionId === null ? "automatic" : "explicit",
+      }),
+    );
+  });
+
+  const preferencesPath = "/v1/organizations/:organizationId/me/model-account-preferences";
+
+  app.get(preferencesPath, async (c) => {
+    c.header("cache-control", "private, no-store");
+    const person = await requireOrganizationPerson(c, deps, false);
+    const preferences = await readSubscriptionPersonPreferences(deps.db, {
+      accountId: person.organizationId,
+      subjectId: person.subjectId,
+    });
+    if (!preferences) throw new HTTPException(404, { message: "organization not found" });
+    return c.json(ModelAccountPreferences.parse(preferences));
+  });
+
+  app.patch(preferencesPath, async (c) => {
+    const person = await requireOrganizationPerson(c, deps, true);
+    const parsed = UpdateModelAccountPreferencesRequest.safeParse(await jsonBody(c));
+    if (!parsed.success) {
+      throw new HTTPException(422, { message: "invalid model account preferences" });
+    }
+    const result = await writeSubscriptionPersonPreferences(deps.db, {
+      accountId: person.organizationId,
+      subjectId: person.subjectId,
+      personalFallbackOptIn: parsed.data.personalFallbackOptIn,
+      ...(parsed.data.expectedVersion === undefined
+        ? {}
+        : { expectedVersion: parsed.data.expectedVersion }),
+    });
+    if (result.outcome === "not_member") {
+      throw new HTTPException(404, { message: "organization not found" });
+    }
+    if (result.outcome === "conflict") {
+      throw new ApiHttpError(409, {
+        code: "conflict",
+        message: "your preferences changed in the meantime; reload and try again",
+        retryable: false,
+        outcomeUnknown: false,
+        details: { reason: "version_conflict", currentVersion: result.preferences.version },
+      });
+    }
+    // Waiters recheck on their own bounded timer; a lost wake only delays.
+    await deliverSubscriptionCoreProviderWakes(deps.db, result.wakes);
+    return c.json(ModelAccountPreferences.parse(result.preferences));
+  });
+}