@opengeni/api-router 3.0.1 → 4.0.0

package/src/integrations/oauth-client.ts

@@ -1,4 +1,9 @@
 import { safeReturnPath } from "./oauth-return-path";
+import { assertOrganizationIntegrationAllowed, stableJson } from "@opengeni/contracts";
+import {
+  withOrganizationIntegrationAcquisition,
+  withOrganizationIntegrationPolicyFence,
+} from "@opengeni/db/organization-integration-policy";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
@@ -9,7 +14,7 @@ import {
   type ConnectionOwnership,
   type OAuthStartRequest,
 } from "@opengeni/contracts";
-import { requireEnvironmentEncryption } from "@opengeni/core";
+import { requireEnvironmentEncryption, integrationKeyForConnectProvider } from "@opengeni/core";
 import { ExternalActorContinuation } from "@opengeni/contracts/external-identities";
 import type { Observability } from "@opengeni/observability";
 import {
@@ -63,11 +68,11 @@ import { ApiHttpError } from "../http/api-error";
 import { requireConnectOwnerAuthority } from "./connect-authority";
 import {
   DEFAULT_OAUTH_PROFILE,
+  OFFICIAL_GMAIL_MCP_URL,
   DEPLOYMENT_MANAGED_CLIENTS,
   builtInOAuthProfileByKey,
   assertAuthorizationServerNotReserved,
   assertAuthorizationServerPins,
-  assertOwnershipAllowed,
   builtInOAuthProfileFor,
   catalogMcpUrlKey,
   defaultOwnershipFor,
@@ -95,6 +100,8 @@ type OAuthClientDeps = {
 };
 
 export type OAuthStartContext = {
+  /** Server-selected dedicated adapter identity; never copied from request metadata. */
+  integrationKey?: "gmail" | "slack-personal";
   connectAttemptId?: string;
   externalContinuation?: ExternalActorContinuation;
   accountId: string;
@@ -129,6 +136,7 @@ type OAuthClientRegistration = {
 };
 
 type OAuthStatePayload = {
+  integrationKey?: "gmail" | "slack-personal";
   connectAttemptId?: string;
   externalContinuation?: ExternalActorContinuation;
   returnUrl?: string;
@@ -312,10 +320,90 @@ class OAuthCallbackDeadline {
   }
 }
 
+/** Policy is the outermost lock. Receipt replay still runs normal authorization,
+ * but the DB calls authorizeAcquisition only for uncommitted progress. Provider
+ * requests must happen after this transaction, never inside either wrapper. */
+export async function claimOAuthAcquisition(
+  db: Database,
+  scope: Parameters<typeof claimConnectOperation>[1],
+  input: Parameters<typeof claimConnectOperation>[2],
+  integrationKey: string | null,
+  acquiring = true,
+) {
+  if (!acquiring) return claimConnectOperation(db, scope, input);
+  return withOrganizationIntegrationPolicyFence(db, scope, (tx, policy) =>
+    claimConnectOperation(tx, scope, {
+      ...input,
+      authorizeAcquisition: async (locked, attempt) => {
+        assertOrganizationIntegrationAllowed(policy, integrationKey);
+        await input.authorizeAcquisition?.(locked, attempt);
+      },
+    }),
+  );
+}
+
+type IntegrationSourceSelection = Record<string, unknown> & {
+  id: string;
+  syncEnabled: boolean;
+  readPolicy: "allow" | "ask" | "block";
+};
+
+/** Compare server-bound selections, not provider classification. Removing a
+ * source, disabling sync, or narrowing its read permission acquires no authority.
+ * Generation/timestamp bookkeeping does not turn an unchanged save into setup. */
+export function integrationSourceSelectionRequiresAcquisition(
+  previous: readonly IntegrationSourceSelection[],
+  requested: readonly IntegrationSourceSelection[],
+): boolean {
+  const rank = { block: 0, ask: 1, allow: 2 };
+  const config = (source: IntegrationSourceSelection) => {
+    const {
+      selectedAt: _selectedAt,
+      configGeneration: _generation,
+      syncEnabled: _enabled,
+      readPolicy: _readPolicy,
+      ...binding
+    } = source;
+    return stableJson(binding);
+  };
+  return requested.some((source) => {
+    const existing = previous.find((candidate) => candidate.id === source.id);
+    return (
+      !existing ||
+      (!existing.syncEnabled && source.syncEnabled) ||
+      rank[source.readPolicy] > rank[existing.readPolicy] ||
+      config(existing) !== config(source)
+    );
+  });
+}
+
+export async function finishOAuthAcquisition(
+  db: Database,
+  scope: Parameters<typeof finishConnectOperation>[1],
+  input: Parameters<typeof finishConnectOperation>[2],
+  integrationKey: string | null,
+) {
+  return withOrganizationIntegrationPolicyFence(db, scope, (tx, policy) =>
+    finishConnectOperation(tx, scope, {
+      ...input,
+      authorizeAcquisition: async (locked, attempt) => {
+        assertOrganizationIntegrationAllowed(policy, integrationKey);
+        await input.authorizeAcquisition?.(locked, attempt);
+      },
+    }),
+  );
+}
+
 export async function startMcpOAuth(
   deps: OAuthClientDeps,
   context: OAuthStartContext,
 ): Promise<OAuthStartResponse> {
+  await withOrganizationIntegrationAcquisition(
+    deps.db,
+    context,
+    [context.integrationKey ?? "custom:mcp"],
+    async () => {},
+  );
   const deadline = new OAuthStartDeadline(deps.oauthStartDeadlineMs ?? OAUTH_START_DEADLINE_MS);
   try {
     return await startMcpOAuthWithinDeadline(deps, context, deadline);
@@ -375,12 +463,9 @@ async function startMcpOAuthWithinDeadline(
     })) ??
     DEFAULT_OAUTH_PROFILE;
   assertOAuthStartProfile(settings, context.payload, mcpUrl, profile);
-  // Personal-only resources default an omitted ownership to personal, matching
-  // the fence that existed before #1240; an explicit non-personal value is the
-  // only thing rejected. Everything else defaults to workspace as before.
+  // Catalog defaults are setup preferences; an explicit ownership always wins.
   const requestedOwnership: ConnectionOwnership =
     context.payload.ownership ?? defaultOwnershipFor(profile);
-  assertOwnershipAllowed(profile, requestedOwnership);
   const returnPath = safeReturnPath(context.payload.returnPath ?? "/integrations");
   const baseUrl = integrationBaseUrl(settings.publicBaseUrl, context.requestUrl);
   const redirectUri = `${baseUrl}/v1/integrations/oauth/callback`;
@@ -404,15 +489,11 @@ async function startMcpOAuthWithinDeadline(
   const ownership = existing
     ? ownershipForConnection(existing.subjectId, context.subjectId)
     : requestedOwnership;
-  // A reconnect of a legacy row must not renew an ownership the profile no
-  // longer allows (e.g. shared authority over one human's hosted-Slack grant).
-  assertOwnershipAllowed(profile, ownership);
   // Only a managed human can own a personal Connection: personal-authority
   // execution resolves through a delegation snapshot frozen on a human's causal
   // turn, and migration 0256 can mint the `user` authority scope only for a
-  // subject that holds an active organization membership. For a personal-only
-  // profile (Gmail, hosted Slack MCP) this refuses the whole flow rather than
-  // silently downgrading to the workspace ownership those profiles forbid.
+  // subject that holds an active organization membership. An explicit personal
+  // choice is never silently downgraded to workspace ownership.
   assertConnectionOwnershipAllowedForPrincipal(ownership, context.personalOwnershipAllowed);
 
   const discovery = await discoverMcpOAuth(mcpUrl, settings, deadline);
@@ -439,10 +520,12 @@ async function startMcpOAuthWithinDeadline(
       context.payload.oauthClient,
       profile,
       signal,
+      context,
     ),
   );
   const key = requireEnvironmentEncryption(settings);
   const state = createSignedState(requireIntegrationsStateSecret(settings), {
+    ...(context.integrationKey ? { integrationKey: context.integrationKey } : {}),
     ...(context.connectAttemptId ? { connectAttemptId: context.connectAttemptId } : {}),
     accountId: context.accountId,
     workspaceId: context.workspaceId,
@@ -510,32 +593,6 @@ async function startMcpOAuthWithinDeadline(
   });
 }
 
-/** Ownership fence for the official Gmail profile, keyed by exact MCP URL. */
-export function assertOfficialGmailPersonalOwnership(
-  mcpUrl: string,
-  ownership: ConnectionOwnership,
-): void {
-  const profile = builtInOAuthProfileFor({ mcpUrl });
-  if (profile?.key === "official-gmail") {
-    assertOwnershipAllowed(profile, ownership);
-  }
-}
-
-/**
- * Slack's hosted MCP issues user tokens only. Sharing one human's grant as
- * workspace authority made every shared agent act as a named employee; the
- * OpenGeni workspace bot owns shared Slack access instead (bot-token search
- * covers public channels, files, and users).
- */
-export function assertHostedSlackMcpPersonalOwnership(
-  hostedSlackMcp: boolean,
-  ownership: ConnectionOwnership,
-): void {
-  if (hostedSlackMcp) {
-    assertOwnershipAllowed(builtInOAuthProfileByKey("hosted-slack-mcp"), ownership);
-  }
-}
-
 export function isHostedSlackMcpTarget(providerDomain: string, mcpUrl: string): boolean {
   return builtInOAuthProfileFor({ mcpUrl, providerDomain })?.key === "hosted-slack-mcp";
 }
@@ -627,6 +684,7 @@ async function completeMcpOAuthCallbackWithinDeadline(
 ): Promise<OAuthCallbackResult> {
   const { db, settings, observability } = deps;
   let state: OAuthStatePayload | null = null;
+  let integrationKey: string | null = "custom:mcp";
   let connectOperation: { attemptId: string; operationId: string; inputDigest: string } | undefined;
   if (!input.state) {
     const error = new OAuthCallbackStageError(
@@ -644,10 +702,21 @@ async function completeMcpOAuthCallbackWithinDeadline(
   }
   try {
     state = readOAuthState(input.state, settings);
+    integrationKey = state.integrationKey ?? "custom:mcp";
     if (state.connectAttemptId) {
       const stored = await getConnectAttempt(db, state, state.connectAttemptId);
+      // Native Gmail setup uses its own provider id, but shares this callback.
+      // Bind that id to the exact reviewed Gmail destination before
+      // claiming an operation (including receipt replay), not to arbitrary MCP.
+      const gmailAttemptMatches =
+        stored.attempt.providerId === "gmail" &&
+        state.mcpUrl === OFFICIAL_GMAIL_MCP_URL &&
+        state.providerDomain === "gmailmcp.googleapis.com" &&
+        builtInOAuthProfileFor(state)?.key === "official-gmail" &&
+        personalOwnerStateAccepted(state);
       if (
-        !["mcp-oauth", "slack-personal"].includes(stored.attempt.providerId) ||
+        (!["mcp-oauth", "slack-personal"].includes(stored.attempt.providerId) &&
+          !gmailAttemptMatches) ||
         stored.attempt.ownership !== state.ownership ||
         stored.returnUrl !== state.returnUrl
       )
@@ -657,29 +726,23 @@ async function completeMcpOAuthCallbackWithinDeadline(
         operationId: `oauth:${state.nonce}`,
         inputDigest: createHash("sha256").update(input.state).digest("hex"),
       };
-      const claim = await claimConnectOperation(db, state, {
-        ...connectOperation,
-        expectedRevision: stored.attempt.revision,
-        authorize: (tx, _attempt, origin) =>
-          requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
-      });
+      integrationKey = integrationKeyForConnectProvider(stored.attempt.providerId);
+      const claim = await claimOAuthAcquisition(
+        db,
+        state,
+        {
+          ...connectOperation,
+          expectedRevision: stored.attempt.revision,
+          authorize: (tx, _attempt, origin) =>
+            requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
+        },
+        integrationKey,
+        Boolean(input.code),
+      );
       if (claim.status === "replayed") return { redirectTo: stored.returnUrl, exactReturn: true };
     }
-    // Fence state minted by an older deployment too: a rolling update must not
-    // let a still-valid callback persist an ownership the target's profile no
-    // longer allows (workspace-owned Gmail or hosted Slack, for example).
-    const builtInCallbackProfile = builtInOAuthProfileFor({
-      mcpUrl: state.mcpUrl,
-      providerDomain: state.providerDomain,
-    });
-    if (builtInCallbackProfile) {
-      assertOwnershipAllowed(builtInCallbackProfile, state.ownership);
-    }
-    // Only a managed human may own a personal Connection. This callback has no
-    // live principal, so it enforces the signed start-time decision; a state
-    // minted before that fence existed carries no claim and is refused, which
-    // closes the in-flight window across a rolling deploy. The legacy
-    // `?? "personal"` decode above therefore cannot land a machine-owned row.
+    // The callback enforces the signed start-time principal decision.
+    // Workspace ownership requires no personal-owner claim.
     if (!personalOwnerStateAccepted(state)) {
       throw new OAuthCallbackStageError(
         "state_verify",
@@ -711,24 +774,13 @@ async function completeMcpOAuthCallbackWithinDeadline(
         reason: "missing_code",
       });
     }
+    await withOrganizationIntegrationAcquisition(db, state, [integrationKey], async () => {});
     const consumed = await runCallbackDatabaseStage(
       deadline,
       "state_verify",
       db,
       async (scopedDb) => {
         await requireOAuthCallbackGrant(scopedDb, state!);
-        if (!builtInCallbackProfile) {
-          // Catalog-declared ownership fences get the same rolling-update
-          // treatment as the built-in ones.
-          const raw = await getGlobalCatalogOAuthProfile(
-            scopedDb,
-            state!.workspaceId,
-            catalogMcpUrlKey(state!.mcpUrl),
-          );
-          if (raw !== null) {
-            assertOwnershipAllowed(oauthProfileFromCatalog(state!.mcpUrl, raw), state!.ownership);
-          }
-        }
         return await consumeIntegrationOAuthStateNonce(scopedDb, {
           accountId: state!.accountId,
           workspaceId: state!.workspaceId,
@@ -843,38 +895,45 @@ async function completeMcpOAuthCallbackWithinDeadline(
     };
     if (connectOperation) {
       await runCallbackDatabaseStage(deadline, "persist", db, (scopedDb) =>
-        finishConnectOperation(scopedDb, state!, {
-          ...connectOperation!,
-          authorize: (tx, _attempt, origin) =>
-            requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
-          commit: async (tx, current) => {
-            const connection = await persist(tx);
-            if (!connection)
-              throw new HTTPException(409, {
-                message: "connection changed during OAuth reconnect",
-              });
-            return {
-              ...current,
-              revision: current.revision + 1,
-              state: "complete",
-              completionRequirement: "connection",
-              credentialsCommitted: true,
-              nextAction: { type: "none" },
-              account: {
-                id: connection.id,
-                version: connection.version,
-                providerId: current.providerId,
-                label: state!.providerDomain,
-                ownership: current.ownership,
-                status: "connected",
-              },
-            };
+        finishOAuthAcquisition(
+          scopedDb,
+          state!,
+          {
+            ...connectOperation!,
+            authorize: (tx, _attempt, origin) =>
+              requireConnectOwnerAuthority(tx, state!, "connections:write", origin),
+            commit: async (tx, current) => {
+              const connection = await persist(tx);
+              if (!connection)
+                throw new HTTPException(409, {
+                  message: "connection changed during OAuth reconnect",
+                });
+              return {
+                ...current,
+                revision: current.revision + 1,
+                state: "complete",
+                completionRequirement: "connection",
+                credentialsCommitted: true,
+                nextAction: { type: "none" },
+                account: {
+                  id: connection.id,
+                  version: connection.version,
+                  providerId: current.providerId,
+                  label: state!.providerDomain,
+                  ownership: current.ownership,
+                  status: "connected",
+                },
+              };
+            },
           },
-        }),
+          integrationKey,
+        ),
       );
       return { redirectTo: state.returnUrl!, exactReturn: true };
     }
-    const connection = await runCallbackDatabaseStage(deadline, "persist", db, persist);
+    const connection = await runCallbackDatabaseStage(deadline, "persist", db, (scopedDb) =>
+      withOrganizationIntegrationAcquisition(scopedDb, state!, [integrationKey], persist),
+    );
     if (!connection) {
       throw new HTTPException(409, {
         message: "connection changed during OAuth reconnect; start again",
@@ -1206,6 +1265,7 @@ async function registerOAuthClient(
   manual: OAuthStartRequest["oauthClient"],
   profile: OAuthProviderProfile,
   signal: AbortSignal,
+  acquisition: Pick<OAuthStartContext, "accountId" | "workspaceId" | "integrationKey">,
 ): Promise<OAuthClientRegistration> {
   const operator = operatorClientForAs(settings, as);
   if (operator) {
@@ -1220,6 +1280,7 @@ async function registerOAuthClient(
       redirectUri,
       scopes,
       signal,
+      acquisition,
     );
   }
   if (selfRegistration === "cimd") {
@@ -1244,7 +1305,15 @@ async function registerOAuthClient(
       ),
     };
   }
-  return await getOrCreateDynamicClientRegistration(db, settings, as, redirectUri, scopes, signal);
+  return await getOrCreateDynamicClientRegistration(
+    db,
+    settings,
+    as,
+    redirectUri,
+    scopes,
+    signal,
+    acquisition,
+  );
 }
 
 export function preferredOAuthSelfRegistration(
@@ -1272,6 +1341,7 @@ async function getOrCreateDynamicClientRegistration(
   redirectUri: string,
   scopes: string[],
   signal: AbortSignal,
+  acquisition: Pick<OAuthStartContext, "accountId" | "workspaceId" | "integrationKey">,
 ): Promise<OAuthClientRegistration> {
   const storedClient = await loadIntegrationOAuthClient(db, settings, as.issuer);
   if (storedClient && storedDcrClientSatisfiesPolicy(storedClient, as, redirectUri, scopes)) {
@@ -1292,6 +1362,12 @@ async function getOrCreateDynamicClientRegistration(
       message: "manual OAuth client credentials are required for this authorization server",
     });
   }
+  await withOrganizationIntegrationAcquisition(
+    db,
+    acquisition,
+    [acquisition.integrationKey ?? "custom:mcp"],
+    async () => {},
+  );
   const dcr = await dynamicClientRegistration(settings, as, redirectUri, scopes, signal);
   const key = dcr.clientSecret ? requireEnvironmentEncryption(settings) : null;
   const storeInput = {
@@ -1303,34 +1379,43 @@ async function getOrCreateDynamicClientRegistration(
     tokenEndpointAuthMethod: dcr.tokenEndpointAuthMethod,
     metadata: registrationMetadata(as, redirectUri, scopes),
   };
-  if (storedClient) {
-    const replaced = await replaceIntegrationOAuthClientIfCurrent(db, {
-      ...storeInput,
-      expectedClientId: storedClient.clientId,
-    });
-    if (replaced?.clientId === dcr.clientId) {
-      return dcr;
-    }
-    return await loadCompatibleDcrWinner(db, settings, as, redirectUri, scopes);
-  }
-  const storedWinner = await storeIntegrationOAuthClient(db, storeInput);
-  if (storedWinner.clientId === dcr.clientId) {
-    return dcr;
-  }
-  const winner = await loadIntegrationOAuthClient(db, settings, as.issuer);
-  if (winner && storedDcrClientSatisfiesPolicy(winner, as, redirectUri, scopes)) {
-    return dcrRegistrationFromStored(winner);
-  }
-  if (winner) {
-    const replaced = await replaceIntegrationOAuthClientIfCurrent(db, {
-      ...storeInput,
-      expectedClientId: winner.clientId,
-    });
-    if (replaced?.clientId === dcr.clientId) {
-      return dcr;
-    }
-  }
-  return await loadCompatibleDcrWinner(db, settings, as, redirectUri, scopes);
+  // Registration has already happened outside this transaction. Fence only the
+  // durable client credential; a restriction racing DCR must not persist it.
+  return withOrganizationIntegrationAcquisition(
+    db,
+    acquisition,
+    [acquisition.integrationKey ?? "custom:mcp"],
+    async (tx) => {
+      if (storedClient) {
+        const replaced = await replaceIntegrationOAuthClientIfCurrent(tx, {
+          ...storeInput,
+          expectedClientId: storedClient.clientId,
+        });
+        if (replaced?.clientId === dcr.clientId) {
+          return dcr;
+        }
+        return await loadCompatibleDcrWinner(tx, settings, as, redirectUri, scopes);
+      }
+      const storedWinner = await storeIntegrationOAuthClient(tx, storeInput);
+      if (storedWinner.clientId === dcr.clientId) {
+        return dcr;
+      }
+      const winner = await loadIntegrationOAuthClient(tx, settings, as.issuer);
+      if (winner && storedDcrClientSatisfiesPolicy(winner, as, redirectUri, scopes)) {
+        return dcrRegistrationFromStored(winner);
+      }
+      if (winner) {
+        const replaced = await replaceIntegrationOAuthClientIfCurrent(tx, {
+          ...storeInput,
+          expectedClientId: winner.clientId,
+        });
+        if (replaced?.clientId === dcr.clientId) {
+          return dcr;
+        }
+      }
+      return await loadCompatibleDcrWinner(tx, settings, as, redirectUri, scopes);
+    },
+  );
 }
 
 function storedDcrClientSatisfiesPolicy(
@@ -1641,6 +1726,13 @@ function readOAuthState(state: string, settings: Settings): OAuthStatePayload {
   if (!payload) {
     throw new HTTPException(400, { message: "invalid or expired OAuth state" });
   }
+  if (
+    payload.integrationKey !== undefined &&
+    payload.integrationKey !== "gmail" &&
+    payload.integrationKey !== "slack-personal"
+  ) {
+    throw new HTTPException(400, { message: "invalid OAuth integration identity" });
+  }
   const nowSeconds = Math.floor(Date.now() / 1000);
   const iat = numberValue(payload.iat);
   if (iat === undefined || nowSeconds - iat > oauthStateTtlMs / 1000 || nowSeconds < iat) {
@@ -1670,6 +1762,12 @@ function readOAuthState(state: string, settings: Settings): OAuthStatePayload {
   if (discoveryMode === "legacy_2025_03_26_metadata" && resourceParameterSupported) {
     throw new HTTPException(400, { message: "invalid legacy OAuth resource parameter state" });
   }
+  const ownership = connectionOwnership(payload.ownership);
+  if (!ownership) {
+    throw new HTTPException(400, {
+      message: "missing or invalid OAuth ownership; restart connection setup",
+    });
+  }
   const parsed = {
     accountId: requiredString(payload.accountId, "state.accountId"),
     workspaceId: requiredString(payload.workspaceId, "state.workspaceId"),
@@ -1692,11 +1790,12 @@ function readOAuthState(state: string, settings: Settings): OAuthStatePayload {
     ...(stringValue(payload.connectAttemptId)
       ? { connectAttemptId: requiredString(payload.connectAttemptId, "state.connectAttemptId") }
       : {}),
-    // OAuth states minted before ownership was explicit were always personal.
-    // Preserve that meaning for in-flight reconnects during a rolling deploy.
-    ownership: connectionOwnership(payload.ownership) ?? "personal",
+    ownership,
     // Absent on a legacy state, which therefore cannot land a personal owner.
     personalOwnerVerified: personalOwnerVerifiedInState(payload),
+    ...(payload.integrationKey
+      ? { integrationKey: payload.integrationKey as "gmail" | "slack-personal" }
+      : {}),
     providerDomain: requiredString(payload.providerDomain, "state.providerDomain"),
     mcpUrl: stringValue(payload.mcpUrl) ?? resource,
     resource,

package/src/integrations/oauth-profiles.ts

@@ -16,10 +16,9 @@ import { canonicalProviderDomain } from "./provider-domain";
  *
  * Profiles come from two layers:
  *
- * 1. Built-in profiles below, for the providers whose fences are security
- *    invariants (hosted Slack MCP and official Gmail are personal-only, their
- *    authorization servers are origin-pinned). These live in code as data so
- *    the fences never depend on catalog import state.
+ * 1. Built-in profiles pin known authorization servers and protocol quirks.
+ *    Ownership defaults guide setup; users may choose personal or workspace.
+ *    Authorization-server pins never depend on catalog import state.
  * 2. A validated `oauthProfile` object on a global catalog row (curated
  *    overlay -> importer -> `capability_catalog_items.metadata`). A catalog
  *    profile applies only when no built-in matches, and it can only narrow the
@@ -81,10 +80,8 @@ export type OAuthProviderProfile = {
   requireExactMcpUrl?: { url: string; message: string };
   /** Deployment-managed client credentials must be configured (503 otherwise). */
   requireDeploymentClient?: { key: DeploymentManagedClientKey; message: string };
-  /** Ownerships a connection may take; a singleton also sets the default. */
-  allowedOwnership: readonly ConnectionOwnership[];
-  /** Exact 422 message when an explicit disallowed ownership is requested. */
-  ownershipMessage?: string;
+  /** Suggested ownership; an explicit user choice always wins. */
+  defaultOwnership?: ConnectionOwnership;
   /** Bind reconnect/dedupe to the exact mcpUrl, not just the provider domain. */
   exactMcpBinding: boolean;
   /** How an existing connection is chosen for reconnect coalescing. */
@@ -113,7 +110,6 @@ export type OAuthProviderProfile = {
 export const DEFAULT_OAUTH_PROFILE: OAuthProviderProfile = {
   key: "default",
   match: {},
-  allowedOwnership: ["workspace", "personal"],
   exactMcpBinding: false,
   connectionSelection: "first_active",
   sendResourceParameter: true,
@@ -138,9 +134,6 @@ const HOSTED_SLACK_PROFILE: OAuthProviderProfile = {
     key: "slack",
     message: "Slack MCP OAuth requires OPENGENI_SLACK_CLIENT_ID and OPENGENI_SLACK_CLIENT_SECRET",
   },
-  allowedOwnership: ["personal"],
-  ownershipMessage:
-    "Slack's hosted MCP connection is personal only; install the OpenGeni Slack bot for workspace access",
   exactMcpBinding: true,
   connectionSelection: "canonical_personal",
   authorizationServer: {
@@ -156,9 +149,7 @@ const HOSTED_SLACK_PROFILE: OAuthProviderProfile = {
 const OFFICIAL_GMAIL_PROFILE: OAuthProviderProfile = {
   key: "official-gmail",
   match: { mcpUrls: [OFFICIAL_GMAIL_MCP_URL] },
-  allowedOwnership: ["personal"],
-  ownershipMessage:
-    "Gmail connections are personal only; each workspace member must connect their own mailbox",
+  defaultOwnership: "personal",
   exactMcpBinding: true,
   connectionSelection: "first_active",
   authorizationServer: {
@@ -285,24 +276,7 @@ export function builtInOAuthProfileFor(input: {
 
 /** Ownership an omitted request defaults to under a profile. */
 export function defaultOwnershipFor(profile: OAuthProviderProfile): ConnectionOwnership {
-  return profile.allowedOwnership.length === 1 && profile.allowedOwnership[0] === "personal"
-    ? "personal"
-    : "workspace";
-}
-
-/** Rejects an ownership outside the profile's allowed set with its exact message. */
-export function assertOwnershipAllowed(
-  profile: OAuthProviderProfile,
-  ownership: ConnectionOwnership,
-): void {
-  if (profile.allowedOwnership.includes(ownership)) {
-    return;
-  }
-  throw new HTTPException(422, {
-    message:
-      profile.ownershipMessage ??
-      `this integration allows only ${profile.allowedOwnership.join(" or ")} connections`,
-  });
+  return profile.defaultOwnership ?? "workspace";
 }
 
 /** Enforces a profile's authorization-server origin pins with its exact message. */
@@ -375,10 +349,7 @@ export const catalogOAuthProfileSchema = z
     pinnedIssuerOrigins: z.array(z.string().url()).min(1).optional(),
     pinnedEndpointOrigins: z.array(z.string().url()).min(1).optional(),
     sendResourceParameter: z.boolean().optional(),
-    allowedOwnership: z
-      .array(z.enum(["personal", "workspace"]))
-      .min(1)
-      .optional(),
+    defaultOwnership: z.enum(["personal", "workspace"]).optional(),
     requestedScopes: z.array(z.string().min(1)).min(1).optional(),
     extraAuthorizeParams: z
       .record(z.string(), z.string())
@@ -425,7 +396,7 @@ export function catalogMcpUrlKey(value: string): string {
  *
  * A present-but-invalid profile fails closed with a 422: the row's operator
  * declared constraints, and silently degrading to the default profile would
- * drop an ownership fence or origin pin on a JSON typo.
+ * drop an origin pin on a JSON typo.
  */
 export function oauthProfileFromCatalog(mcpUrl: string, raw: unknown): OAuthProviderProfile {
   const parsed = catalogOAuthProfileSchema.safeParse(raw);
@@ -451,13 +422,7 @@ export function oauthProfileFromCatalog(mcpUrl: string, raw: unknown): OAuthProv
   return {
     key: `catalog:${mcpUrl}`,
     match: { mcpUrls: [mcpUrl] },
-    allowedOwnership: data.allowedOwnership ?? DEFAULT_OAUTH_PROFILE.allowedOwnership,
-    ...(data.allowedOwnership && !data.allowedOwnership.includes("workspace")
-      ? {
-          ownershipMessage:
-            "this integration allows only personal connections; each workspace member must connect their own account",
-        }
-      : {}),
+    ...(data.defaultOwnership ? { defaultOwnership: data.defaultOwnership } : {}),
     exactMcpBinding: Boolean(data.exactMcpUrl),
     ...(data.exactMcpUrl
       ? {