@opengeni/api-router 3.0.1 → 3.1.2

package/src/routes/organization-memberships.ts

@@ -1,8 +1,15 @@
+import { signupCreditModelIds } from "@opengeni/config";
 import {
   lookupExternalIdentityForRequest,
   cancelExternalWorkspaceMemberGrantForRequest,
+  updateExternalWorkspaceMemberForRequest,
+  getOrganizationPrivacySettings,
+  OrganizationPrivacyLockedError,
+  privacyDeploymentLimits,
+  updateOrganizationPrivacySettings,
 } from "@opengeni/core";
 import {
+  type Permission,
   AcceptOrganizationInvitationRequest,
   CreateAdditionalOrganizationRequest,
   CreateAdditionalOrganizationResponse,
@@ -18,6 +25,7 @@ import {
   OrganizationInvitation,
   OrganizationUserSetupDelivery,
   OrganizationMember,
+  OrganizationPrivacySettings,
   OrganizationPrivateSessionSettings,
   OrganizationRetentionPolicy,
   OrganizationSummary,
@@ -30,6 +38,7 @@ import {
   RevokeOrganizationWorkspaceMemberResponse,
   UpdateOrganizationMemberRequest,
   UpdateOrganizationNameRequest,
+  UpdateOrganizationPrivacySettingsRequest,
   UpdateOrganizationPrivateSessionSettingsRequest,
   UpdateOrganizationRetentionPolicyRequest,
   UpdateOrganizationWorkspaceRequest,
@@ -38,6 +47,10 @@ import {
 } from "@opengeni/contracts";
 import {
   getManagedSession,
+  accountScopedApiKeyWorkspaceAuthority,
+  organizationWorkspaceInScope,
+  hasPermission,
+  requireAccessContext,
   organizationMembershipHttpStatus,
   requireCanonicalLocalAccountAdministrator,
   updateExternalIdentityMembershipForRequest,
@@ -57,6 +70,7 @@ import {
   getOrganizationPrivateSessionSettings,
   getSelfOrganizationInvitation,
   getOrganizationRetentionPolicy,
+  requireWorkspace,
   listOrganizationAdministrationMembers,
   listOrganizationInvitations,
   listSelfOrganizationInvitations,
@@ -77,17 +91,82 @@ import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
 import { deleteWorkspaceForRequest } from "../workspace-deletion";
+import { agentActingAsPerson, organizationSettingsPermission } from "../http/acting-person";
 
 import {
   assertOrganizationUserSetupDeliveryConfigured,
   resolveOrganizationUserSetupDeliveryEmail,
 } from "../auth/organization-user-setup";
+import { readRequestJson } from "../http/request-body";
 
 const OrganizationId = z.string().uuid();
 const WorkspaceId = z.string().uuid();
 const MembershipId = z.string().uuid();
 const InvitationId = z.string().uuid();
 
+// Organization keys administer settings, not another person's session contents.
+// The database independently fences current key authority, including on replay.
+async function requirePrivateSessionAdministrator(
+  context: Context,
+  deps: ApiRouteDeps,
+  organizationId: string,
+): Promise<{ subjectId: string }> {
+  const agent = agentActingAsPerson(
+    context,
+    organizationId,
+    organizationSettingsPermission(context),
+  );
+  if (agent) return agent;
+  if (!context.req.header("authorization")) return requireManagedHuman(context, deps);
+  const access = await requireAccessContext(context, deps);
+  const key = accountScopedApiKeyWorkspaceAuthority(access);
+  if (!key || key.accountId !== organizationId || !key.permissions.includes("workspace:admin")) {
+    throw new HTTPException(403, {
+      message: "organization administration required",
+    });
+  }
+  if (
+    key.permissionMode === "explicit" &&
+    !access.accountGrants.some(
+      (grant) => grant.accountId === organizationId && grant.permissions.includes("account:admin"),
+    )
+  ) {
+    throw new HTTPException(403, { message: "organization administration requires account:admin" });
+  }
+  return { subjectId: access.subjectId };
+}
+
+async function requireOrganizationKeyWorkspaceDeletion(
+  context: Context,
+  deps: ApiRouteDeps,
+  organizationId: string,
+  workspaceId: string,
+): Promise<void> {
+  const access = await requireAccessContext(context, deps);
+  const key = accountScopedApiKeyWorkspaceAuthority(access);
+  if (
+    !key ||
+    key.accountId !== organizationId ||
+    !hasPermission(key.permissions, "workspace:admin")
+  ) {
+    throw new HTTPException(403, {
+      message:
+        "deleting an organization workspace requires an organization owner session or an organization API key with workspace:admin",
+    });
+  }
+  const workspace = await requireWorkspace(deps.db, workspaceId).catch(() => null);
+  if (!workspace || workspace.accountId !== organizationId) {
+    throw new HTTPException(404, { message: "workspace not found" });
+  }
+  if (workspace.kind !== "shared") {
+    throw new HTTPException(403, {
+      message: "organization API keys cannot delete a Personal workspace",
+    });
+  }
+  if (!organizationWorkspaceInScope(key.workspaceScope, workspaceId))
+    throw new HTTPException(403, { message: "workspace is outside organization key scope" });
+}
+
 async function requireManagedHuman(context: Context, deps: ApiRouteDeps) {
   if (
     deps.settings.productAccessMode !== "managed" ||
@@ -108,11 +187,32 @@ async function requireManagedHuman(context: Context, deps: ApiRouteDeps) {
   return { session, subjectId: `user:${session.user.id}` };
 }
 
+/**
+ * A person acting in this organization: in their browser, or through an agent
+ * acting as them whose access setting includes `permission`. The database
+ * still checks the person's own role on every call.
+ */
+async function requireOrganizationPerson(
+  context: Context,
+  deps: ApiRouteDeps,
+  permission: Permission,
+): Promise<{ subjectId: string }> {
+  const agent = agentActingAsPerson(context, context.req.param("organizationId") ?? "", permission);
+  if (agent) return agent;
+  return await requireManagedHuman(context, deps);
+}
+
 async function requireOrganizationAdministrator(
   context: Context,
   deps: ApiRouteDeps,
   organizationId: string,
 ): Promise<{ subjectId: string }> {
+  const agent = agentActingAsPerson(
+    context,
+    organizationId,
+    organizationSettingsPermission(context),
+  );
+  if (agent) return agent;
   if (deps.settings.productAccessMode === "managed") {
     return await requireManagedHuman(context, deps);
   }
@@ -217,6 +317,10 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
             subjectId,
             subjectLabel: session.user.email || session.user.name,
             ...payload,
+            trialCreditModelIds: signupCreditModelIds(deps.settings),
+            trialCreditsEnabled:
+              deps.settings.productAccessMode === "managed" &&
+              deps.settings.verifiedSignupTrialCreditsEnabled,
           }),
         ),
         201,
@@ -406,6 +510,18 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
       context.req.param("organizationId"),
       "organization id",
     );
+    if (context.req.header("authorization")) {
+      // An integrating backend deletes the organization workspaces it
+      // provisions (tenant offboarding, test cleanup) with its organization
+      // key. This is exactly the authority `DELETE /v1/workspaces/:id` already
+      // grants that key - an organization workspace (never a Personal one) in
+      // the key's own organization, with `workspace:admin` - under the same
+      // quiescence rules. It confers no organization-administrator identity.
+      const workspaceId = parseId(WorkspaceId, context.req.param("workspaceId"), "workspace id");
+      await requireOrganizationKeyWorkspaceDeletion(context, deps, organizationId, workspaceId);
+      await deleteWorkspaceForRequest(deps, { accountId: organizationId, workspaceId });
+      return context.body(null, 204);
+    }
     const { subjectId } = await requireOrganizationAdministrator(context, deps, organizationId);
     const workspaceId = parseId(WorkspaceId, context.req.param("workspaceId"), "workspace id");
     await deleteWorkspaceForRequest(deps, {
@@ -447,7 +563,7 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
   app.put(
     "/v1/organizations/:organizationId/workspaces/:workspaceId/members/:membershipId",
     async (context) => {
-      const { subjectId } = await requireManagedHuman(context, deps);
+      const { subjectId } = await requireOrganizationPerson(context, deps, "members:manage");
       const organizationId = parseId(
         OrganizationId,
         context.req.param("organizationId"),
@@ -478,6 +594,23 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
     },
   );
 
+  // Organization service key: replace an existing external member's
+  // permissions in one shared workspace (keyed, idempotent, non-destructive).
+  app.patch(
+    "/v1/organizations/:organizationId/workspaces/:workspaceId/external-members/:membershipId",
+    async (context) =>
+      context.json(
+        await updateExternalWorkspaceMemberForRequest(
+          context,
+          deps,
+          parseId(OrganizationId, context.req.param("organizationId"), "organization id"),
+          parseId(WorkspaceId, context.req.param("workspaceId"), "workspace id"),
+          parseId(MembershipId, context.req.param("membershipId"), "membership id"),
+          await readRequestJson(context),
+        ),
+      ),
+  );
+
   app.post(
     "/v1/organizations/:organizationId/workspaces/:workspaceId/members/:membershipId/revoke",
     async (context) => {
@@ -494,7 +627,7 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
           ),
         );
       }
-      const { subjectId } = await requireManagedHuman(context, deps);
+      const { subjectId } = await requireOrganizationPerson(context, deps, "members:manage");
       const organizationId = parseId(
         OrganizationId,
         context.req.param("organizationId"),
@@ -527,20 +660,23 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
   );
 
   app.get("/v1/organizations/:organizationId/private-session-settings", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
     const organizationId = parseId(
       OrganizationId,
       context.req.param("organizationId"),
       "organization id",
     );
+    const { subjectId } = await requirePrivateSessionAdministrator(context, deps, organizationId);
     try {
+      const value = await getOrganizationPrivateSessionSettings(deps.db, {
+        organizationId,
+        actorSubjectId: subjectId,
+      });
+      // A deployment that turns Only me off makes it unavailable everywhere.
       return context.json(
-        OrganizationPrivateSessionSettings.parse(
-          await getOrganizationPrivateSessionSettings(deps.db, {
-            organizationId,
-            actorSubjectId: subjectId,
-          }),
-        ),
+        OrganizationPrivateSessionSettings.parse({
+          ...value,
+          available: value.available && privacyDeploymentLimits(deps.settings).onlyMeAllowed,
+        }),
       );
     } catch (error) {
       rethrowMembershipError(error);
@@ -548,13 +684,16 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
   });
 
   app.patch("/v1/organizations/:organizationId/private-session-settings", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
     const organizationId = parseId(
       OrganizationId,
       context.req.param("organizationId"),
       "organization id",
     );
+    const { subjectId } = await requirePrivateSessionAdministrator(context, deps, organizationId);
     const payload = await parseBody(context, UpdateOrganizationPrivateSessionSettingsRequest);
+    if (payload.enabled && !privacyDeploymentLimits(deps.settings).onlyMeAllowed) {
+      throw new HTTPException(409, { message: "Only me is turned off for this app." });
+    }
     try {
       return context.json(
         OrganizationPrivateSessionSettings.parse(
@@ -566,17 +705,64 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
         ),
       );
     } catch (error) {
-      if (nestedPostgresSqlState(error) === "55000") {
-        throw new HTTPException(409, {
-          message: "private-session readiness is not activated for this organization",
-        });
+      rethrowMembershipError(error);
+    }
+  });
+
+  // The organization's privacy choices: the default audience for new chats and
+  // schedules, and whether admins see that other people's Only me schedules
+  // exist. `limits` reports what this deployment fixes.
+  app.get("/v1/organizations/:organizationId/privacy-settings", async (context) => {
+    const organizationId = parseId(
+      OrganizationId,
+      context.req.param("organizationId"),
+      "organization id",
+    );
+    const { subjectId } = await requirePrivateSessionAdministrator(context, deps, organizationId);
+    try {
+      // The same owner/admin check the private session settings read makes.
+      await getOrganizationPrivateSessionSettings(deps.db, {
+        organizationId,
+        actorSubjectId: subjectId,
+      });
+      return context.json(
+        OrganizationPrivacySettings.parse(
+          await getOrganizationPrivacySettings(deps, organizationId),
+        ),
+      );
+    } catch (error) {
+      rethrowMembershipError(error);
+    }
+  });
+
+  app.patch("/v1/organizations/:organizationId/privacy-settings", async (context) => {
+    const organizationId = parseId(
+      OrganizationId,
+      context.req.param("organizationId"),
+      "organization id",
+    );
+    const { subjectId } = await requirePrivateSessionAdministrator(context, deps, organizationId);
+    const request = await parseBody(context, UpdateOrganizationPrivacySettingsRequest);
+    try {
+      return context.json(
+        OrganizationPrivacySettings.parse(
+          await updateOrganizationPrivacySettings(deps, {
+            organizationId,
+            actorSubjectId: subjectId,
+            request,
+          }),
+        ),
+      );
+    } catch (error) {
+      if (error instanceof OrganizationPrivacyLockedError) {
+        throw new HTTPException(409, { message: error.message });
       }
       rethrowMembershipError(error);
     }
   });
 
   app.post("/v1/organizations/:organizationId/invitations", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
+    const { subjectId } = await requireOrganizationPerson(context, deps, "members:manage");
     const organizationId = parseId(
       OrganizationId,
       context.req.param("organizationId"),
@@ -630,7 +816,7 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
   });
 
   app.get("/v1/organizations/:organizationId/invitations", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
+    const { subjectId } = await requireOrganizationPerson(context, deps, "account:read");
     const organizationId = parseId(
       OrganizationId,
       context.req.param("organizationId"),
@@ -661,7 +847,7 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
   app.post(
     "/v1/organizations/:organizationId/invitations/:invitationId/delivery/retry",
     async (context) => {
-      const { subjectId } = await requireManagedHuman(context, deps);
+      const { subjectId } = await requireOrganizationPerson(context, deps, "members:manage");
       const organizationId = parseId(
         OrganizationId,
         context.req.param("organizationId"),
@@ -732,7 +918,7 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
   app.post(
     "/v1/organizations/:organizationId/invitations/:invitationId/revoke",
     async (context) => {
-      const { subjectId } = await requireManagedHuman(context, deps);
+      const { subjectId } = await requireOrganizationPerson(context, deps, "members:manage");
       const organizationId = parseId(
         OrganizationId,
         context.req.param("organizationId"),
@@ -784,7 +970,7 @@ export function registerOrganizationMembershipRoutes(app: Hono, deps: ApiRouteDe
   });
 
   app.patch("/v1/organizations/:organizationId/members/:membershipId", async (context) => {
-    const { subjectId } = await requireManagedHuman(context, deps);
+    const { subjectId } = await requireOrganizationPerson(context, deps, "members:manage");
     const organizationId = parseId(
       OrganizationId,
       context.req.param("organizationId"),

package/src/routes/organization-model-defaults.ts

@@ -0,0 +1,110 @@
+import { canonicalizeConfiguredModelId } from "@opengeni/config";
+import {
+  OrganizationModelDefaults,
+  UpdateOrganizationModelDefaultsRequest,
+} from "@opengeni/contracts";
+import type { ApiRouteDeps } from "@opengeni/core";
+import {
+  getOrganizationModelDefaultsForAdministrator,
+  nestedPostgresSqlState,
+  updateOrganizationModelDefaults,
+} from "@opengeni/db";
+import type { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+
+import { requireOrganizationCodexHuman, requireSameOriginBrowserMutation } from "./codex";
+
+const OrganizationId = z.string().uuid();
+
+function parseOrganizationId(value: string | undefined): string {
+  const parsed = OrganizationId.safeParse(value);
+  if (!parsed.success) throw new HTTPException(404, { message: "organization not found" });
+  return parsed.data;
+}
+
+function refused(error: unknown): never {
+  if (nestedPostgresSqlState(error) === "42501") {
+    throw new HTTPException(403, {
+      message: "Only organization owners and admins can change model defaults",
+    });
+  }
+  if (error instanceof RangeError) throw new HTTPException(422, { message: error.message });
+  throw error;
+}
+
+/**
+ * Organization model defaults: what every workspace follows until it saves
+ * its own default model, allowed models or compaction trigger. Owners and
+ * admins read and change them; workspaces read them through their own model
+ * routes, which report where each value comes from.
+ */
+export function registerOrganizationModelDefaultsRoutes(app: Hono, deps: ApiRouteDeps): void {
+  const path = "/v1/organizations/:organizationId/model-defaults";
+  app.get(path, async (c) => {
+    c.header("cache-control", "private, no-store");
+    const organizationId = parseOrganizationId(c.req.param("organizationId"));
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    try {
+      return c.json(
+        OrganizationModelDefaults.parse(
+          await getOrganizationModelDefaultsForAdministrator(deps.db, {
+            organizationId,
+            actorSubjectId: human.subjectId,
+          }),
+        ),
+      );
+    } catch (error) {
+      refused(error);
+    }
+  });
+
+  app.patch(path, async (c) => {
+    requireSameOriginBrowserMutation(c, deps);
+    const organizationId = parseOrganizationId(c.req.param("organizationId"));
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    const parsed = UpdateOrganizationModelDefaultsRequest.safeParse(
+      await c.req.json().catch(() => null),
+    );
+    if (!parsed.success) {
+      throw new HTTPException(422, { message: "invalid organization model defaults" });
+    }
+    const { settings } = await deps.resolveCatalogSettings();
+    const canonical = (id: string) => canonicalizeConfiguredModelId(settings, id);
+    const patch = parsed.data;
+    try {
+      return c.json(
+        OrganizationModelDefaults.parse(
+          await updateOrganizationModelDefaults(deps.db, {
+            organizationId,
+            actorSubjectId: human.subjectId,
+            patch: {
+              ...(patch.sessionDefaults === undefined
+                ? {}
+                : {
+                    sessionDefaults: patch.sessionDefaults
+                      ? { ...patch.sessionDefaults, model: canonical(patch.sessionDefaults.model) }
+                      : null,
+                  }),
+              ...(patch.modelPolicy === undefined
+                ? {}
+                : {
+                    modelPolicy: {
+                      allowedProviders: patch.modelPolicy?.allowedProviders ?? null,
+                      allowedModels: patch.modelPolicy?.allowedModels
+                        ? [...new Set(patch.modelPolicy.allowedModels.map(canonical))]
+                        : null,
+                    },
+                  }),
+              ...(patch.modelCompactionThresholds === undefined
+                ? {}
+                : { modelCompactionThresholds: patch.modelCompactionThresholds }),
+            },
+          }),
+        ),
+      );
+    } catch (error) {
+      refused(error);
+    }
+  });
+}

package/src/routes/organization-model-providers.ts

@@ -1,3 +1,4 @@
+import { claudeProviderId, opperCredentialProblem } from "@opengeni/config";
 import {
   CreateOrganizationProviderCustomModelRequest,
   DeleteOrganizationProviderCustomModelRequest,
@@ -25,6 +26,7 @@ import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
 
+import { offerClaudeDefaultModels } from "../claude-default-models";
 import { requireOrganizationCodexHuman, requireSameOriginBrowserMutation } from "./codex";
 
 const OrganizationId = z.string().uuid();
@@ -48,7 +50,7 @@ function providerKind(value: string) {
 }
 
 function connectionJson(connection: {
-  providerKind: "vercel_gateway" | "openrouter";
+  providerKind: "vercel_gateway" | "openrouter" | "anthropic" | "claude_subscription" | "opper";
   status: "active" | "revoked";
   version: number;
   createdAt: Date;
@@ -87,10 +89,28 @@ function conflict(error: unknown): never {
 }
 
 export function registerOrganizationModelProviderRoutes(app: Hono, deps: ApiRouteDeps): void {
+  app.use("/v1/organizations/:organizationId/model-providers/:providerKind", async (c, next) => {
+    if (
+      c.req.param("providerKind") === "claude_subscription" &&
+      !deps.settings.claudeSubscriptionEnabled
+    )
+      throw new HTTPException(404, { message: "Claude subscriptions are not enabled" });
+    await next();
+  });
+  app.use("/v1/organizations/:organizationId/model-providers/:providerKind/*", async (c, next) => {
+    if (
+      c.req.param("providerKind") === "claude_subscription" &&
+      !deps.settings.claudeSubscriptionEnabled
+    )
+      throw new HTTPException(404, { message: "Claude subscriptions are not enabled" });
+    await next();
+  });
   app.get("/v1/organizations/:organizationId/model-providers/:providerKind", async (c) => {
     c.header("cache-control", "private, no-store");
     const organizationId = parseOrganizationId(c.req.param("organizationId"));
     const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    if (c.req.param("providerKind") === "claude_subscription")
+      throw new HTTPException(410, { message: "Claude subscriptions use individual accounts." });
     const connection = await getOrganizationModelProviderConnection(deps.db, {
       organizationId,
       actorSubjectId: human.subjectId,
@@ -98,6 +118,29 @@ export function registerOrganizationModelProviderRoutes(app: Hono, deps: ApiRout
     });
     return connection ? c.json(connectionJson(connection)) : c.json(null);
   });
+  const usagePath = "/v1/organizations/:organizationId/model-providers/:providerKind/usage";
+  async function usageScope(c: Context) {
+    c.header("cache-control", "private, no-store");
+    if (providerKind(c.req.param("providerKind")!) !== "claude_subscription")
+      throw new HTTPException(404, { message: "Usage not available for this provider" });
+    const organizationId = parseOrganizationId(c.req.param("organizationId")!);
+    const human = await requireOrganizationCodexHuman(c, deps, organizationId);
+    return {
+      accountId: organizationId,
+      workspaceId: null,
+      scope: "organization" as const,
+      actorSubjectId: human.subjectId,
+    };
+  }
+  app.get(usagePath, async (c) => {
+    await usageScope(c);
+    throw new HTTPException(410, { message: "Check usage on the individual Claude account." });
+  });
+  app.post(`${usagePath}/refresh`, async (c) => {
+    requireSameOriginBrowserMutation(c, deps);
+    await usageScope(c);
+    throw new HTTPException(410, { message: "Check usage on the individual Claude account." });
+  });
 
   app.put("/v1/organizations/:organizationId/model-providers/:providerKind", async (c) => {
     c.header("cache-control", "private, no-store");
@@ -109,6 +152,20 @@ export function registerOrganizationModelProviderRoutes(app: Hono, deps: ApiRout
       UpsertOrganizationModelProviderConnectionRequest,
       "invalid organization model provider connection",
     );
+    const kind = providerKind(c.req.param("providerKind"));
+    if (kind === "claude_subscription")
+      throw new HTTPException(410, { message: "Claude subscriptions use individual accounts." });
+    if (kind === "anthropic" && !/^sk-ant-api[0-9]+-\S+$/.test(payload.apiKey))
+      throw new HTTPException(422, {
+        message: "Enter an Anthropic API key. Use Claude subscription for setup tokens.",
+      });
+    const opperProblem = kind === "opper" ? opperCredentialProblem(payload.apiKey) : null;
+    if (opperProblem) throw new HTTPException(422, { message: opperProblem });
+    if (payload.claudeIdentity)
+      throw new HTTPException(422, {
+        message: "Claude identity is only valid for subscription connections.",
+      });
+    const credential = payload.apiKey;
     try {
       const connection = await upsertOrganizationModelProviderConnection(deps.db, {
         organizationId,
@@ -116,14 +173,20 @@ export function registerOrganizationModelProviderRoutes(app: Hono, deps: ApiRout
         providerKind: providerKind(c.req.param("providerKind")),
         credentialEncrypted: encryptEnvironmentValue(
           requireEnvironmentEncryption(deps.settings),
-          payload.apiKey,
+          credential,
         ),
-        credentialDigest: organizationModelProviderCredentialDigest(payload.apiKey),
+        credentialDigest: organizationModelProviderCredentialDigest(credential),
         operationId: payload.operationId,
         ...(payload.expectedVersion === undefined
           ? {}
           : { expectedVersion: payload.expectedVersion }),
       });
+      if (kind === "anthropic")
+        await offerClaudeDefaultModels(deps, {
+          organizationId,
+          actorSubjectId: human.subjectId,
+          providerKind: kind,
+        });
       return c.json(connectionJson(connection));
     } catch (error) {
       conflict(error);
@@ -141,6 +204,8 @@ export function registerOrganizationModelProviderRoutes(app: Hono, deps: ApiRout
       "invalid organization model provider disconnect",
     );
     try {
+      if (c.req.param("providerKind") === "claude_subscription")
+        throw new HTTPException(410, { message: "Claude subscriptions use individual accounts." });
       const connection = await revokeOrganizationModelProviderConnection(deps.db, {
         organizationId,
         actorSubjectId: human.subjectId,
@@ -182,6 +247,12 @@ export function registerOrganizationModelProviderRoutes(app: Hono, deps: ApiRout
         CreateOrganizationProviderCustomModelRequest,
         "invalid organization custom model",
       );
+      const kind = providerKind(c.req.param("providerKind"));
+      if (
+        (kind === "anthropic" || kind === "claude_subscription") &&
+        `${claudeProviderId(kind)}/${payload.upstreamModelId}`.length > 256
+      )
+        throw new HTTPException(422, { message: "Claude model ID is too long" });
       try {
         const model = await createOrganizationModelProviderCustomModel(deps.db, {
           organizationId,