@opengeni/api-router 3.0.1 → 4.0.0

package/src/routes/automations.ts

@@ -88,6 +88,7 @@ export function registerAutomationRoutes(app: Hono, deps: ApiRouteDeps): void {
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
     requirePermission(grant, "secrets:write");
     const request = CreateAutomationSourceRequest.parse(await c.req.json());
+    assertGenericTriggerMutable(request);
     requireAutomationAdapter(request.adapterId).validateSourceConfiguration(request.configuration);
     const key = requireEncryptionKey(deps);
     const source = await createAutomationSource(deps.db, {
@@ -176,11 +177,6 @@ export function registerAutomationRoutes(app: Hono, deps: ApiRouteDeps): void {
       grant,
       request.sessionTemplate.bundledSkillIds,
     );
-    if (request.packInstallationId || request.packTemplateId) {
-      throw new HTTPException(409, {
-        message: "Pack-owned automation triggers must be created through their Pack setup API",
-      });
-    }
     const source = await requireSource(deps, grant.accountId, workspaceId, request.sourceId);
     assertGenericSourceMutable(source);
     if (source.status !== "active") {
@@ -667,17 +663,13 @@ async function requireSource(
 }
 
 function assertGenericSourceMutable(source: AutomationSourceSecret): void {
-  if (source.packInstallationId) {
-    throw new HTTPException(409, {
-      message: "Pack-owned automation sources must be managed through their Pack setup API",
-    });
-  }
+  assertGenericTriggerMutable(source);
 }
 
-function assertGenericTriggerMutable(trigger: { packInstallationId: string | null }): void {
-  if (trigger.packInstallationId) {
+function assertGenericTriggerMutable(trigger: { adapterId: string }): void {
+  if (trigger.adapterId === "source-control.pull-request.v1") {
     throw new HTTPException(409, {
-      message: "Pack-owned automation triggers must be managed through their Pack setup API",
+      message: "PR Review automations must be managed through the PR Review setup API",
     });
   }
 }

package/src/routes/billing.ts

@@ -3,6 +3,8 @@ import {
   CreateBillingPortalResponse,
   CreateCheckoutRequest,
   CreateCheckoutResponse,
+  OrganizationUsageQuery,
+  OrganizationUsageWorkspacePageQuery,
   type AccessContext,
   type Permission,
 } from "@opengeni/contracts";
@@ -14,6 +16,9 @@ import {
   hasCreditLedgerEntry,
   isStripeWebhookProcessed,
   listUsageEvents,
+  getOrganizationUsageSummary,
+  getOrganizationUsageWorkspacePage,
+  withSessionRlsActorContext,
   getManagedAccount,
   markStripeWebhookProcessed,
   recordStripeWebhookEvent,
@@ -24,6 +29,7 @@ import { HTTPException } from "hono/http-exception";
 import Stripe from "stripe";
 import { requireAccessContext } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
+import { withAccessGrantSessionRlsContext } from "../access-grant-rls";
 
 export function registerBillingRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/billing", async (c) => {
@@ -57,6 +63,33 @@ export function registerBillingRoutes(app: Hono, deps: ApiRouteDeps): void {
     });
   });
 
+  app.get("/v1/billing/usage-summary", async (c) => {
+    const context = await requireAccessContext(c, deps);
+    const accountId = requireSelectedAccount(context, c.req.query("accountId"), "billing:read");
+    const parsed = OrganizationUsageQuery.safeParse(c.req.query());
+    if (!parsed.success) {
+      throw new HTTPException(400, {
+        message: parsed.error.issues[0]?.message ?? "invalid usage query",
+      });
+    }
+    return await withBillingUsageActor(deps, context, accountId, async () =>
+      c.json(await getOrganizationUsageSummary(deps.db, { accountId, ...parsed.data })),
+    );
+  });
+
+  app.get("/v1/billing/usage-workspaces", async (c) => {
+    const context = await requireAccessContext(c, deps);
+    const accountId = requireSelectedAccount(context, c.req.query("accountId"), "billing:read");
+    const parsed = OrganizationUsageWorkspacePageQuery.safeParse(c.req.query());
+    if (!parsed.success)
+      throw new HTTPException(400, {
+        message: parsed.error.issues[0]?.message ?? "invalid usage page query",
+      });
+    return await withBillingUsageActor(deps, context, accountId, async () =>
+      c.json(await getOrganizationUsageWorkspacePage(deps.db, { accountId, ...parsed.data })),
+    );
+  });
+
   app.get("/v1/billing/entitlements", async (c) => {
     const context = await requireAccessContext(c, deps);
     const accountId = requireSelectedAccount(context, c.req.query("accountId"), "billing:read");
@@ -638,6 +671,25 @@ export function stripeCustomerProvider(
     : "stripe:test";
 }
 
+/** Billing routes do not traverse the workspace actor middleware. Always bind
+ * these reads explicitly; only a revalidated live attempt may supply a human
+ * initiator. Neither query parameters nor serviceInitiator claims are proof. */
+async function withBillingUsageActor<T>(
+  deps: ApiRouteDeps,
+  context: AccessContext,
+  accountId: string,
+  read: () => Promise<T>,
+): Promise<T> {
+  const attemptGrant = context.workspaceGrants.find(
+    (grant) =>
+      grant.accountId === accountId &&
+      grant.subjectId === context.subjectId &&
+      grant.principalKind === "agent_attempt",
+  );
+  if (attemptGrant) return await withAccessGrantSessionRlsContext(deps, attemptGrant, read);
+  return await withSessionRlsActorContext({ subjectId: context.subjectId }, read);
+}
+
 function requireSelectedAccount(
   context: AccessContext,
   requested: string | undefined,

package/src/routes/canonical-human-identities.ts

@@ -23,6 +23,9 @@ import {
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
+import { admitManagedSignInMutation } from "./managed-sign-in-methods";
+import { managedAuthSecretRequestDigest } from "@opengeni/core/managed-auth-session-sets";
+import { deliverManagedSignInNotification } from "../auth/managed-sign-in-notifications";
 
 const BindingId = z.string().uuid();
 
@@ -86,6 +89,7 @@ async function mutate(
     operationId: string;
     expectedIdentityRevision: number;
     reason: string;
+    verifiedManagedRecovery?: boolean;
   },
 ): Promise<Response> {
   const identity = await requestIdentity(context, deps);
@@ -104,10 +108,27 @@ async function mutate(
         ...(input.providerId ? { providerId: input.providerId } : {}),
         ...(input.providerAccountId ? { providerAccountId: input.providerAccountId } : {}),
         reason: input.reason,
+        ...(input.verifiedManagedRecovery
+          ? {
+              verifiedRecovery: {
+                authSessionId: identity.authSessionId,
+                requestDigest: managedAuthSecretRequestDigest(
+                  deps.settings.betterAuthSecret!,
+                  input,
+                ),
+              },
+            }
+          : {}),
         ...(actorFence ? { actorFence } : {}),
       }),
     );
     if (actorFence) markManagedAuthRequestActorTransitionApplied(context.req.raw);
+    if (input.verifiedManagedRecovery)
+      await deliverManagedSignInNotification(
+        deps.db,
+        deps.managedEmailTransport,
+        input.operationId,
+      );
     return context.json(response);
   } catch (error) {
     return identityError(context, error);
@@ -132,6 +153,11 @@ export function registerCanonicalHumanIdentityRoutes(app: Hono, deps: ApiRouteDe
 
   app.post(`${base}/login-bindings`, async (context) => {
     const request = await parseBody(context, LinkCanonicalHumanLoginBindingRequest);
+    if (["google", "github", "credential"].includes(request.providerId.trim().toLowerCase())) {
+      throw new HTTPException(403, {
+        message: "Use personal sign-in method settings with fresh provider proof",
+      });
+    }
     return await mutate(context, deps, {
       operationType: "link",
       ...request,
@@ -141,6 +167,19 @@ export function registerCanonicalHumanIdentityRoutes(app: Hono, deps: ApiRouteDe
 
   app.delete(`${base}/login-bindings/:bindingId`, async (context) => {
     const request = await parseBody(context, CanonicalHumanBindingOperationRequest);
+    const actor = await requestIdentity(context, deps);
+    const projection = await getCanonicalHumanIdentityProjection(deps.db, actor.authUserId);
+    if (
+      projection.loginBindings.some(
+        (binding) =>
+          binding.id === bindingId(context) &&
+          ["google", "github", "credential"].includes(binding.providerId),
+      )
+    ) {
+      throw new HTTPException(403, {
+        message: "Use personal sign-in method settings with last-method protection",
+      });
+    }
     return await mutate(context, deps, {
       operationType: "unlink",
       bindingId: bindingId(context),
@@ -151,6 +190,19 @@ export function registerCanonicalHumanIdentityRoutes(app: Hono, deps: ApiRouteDe
 
   app.post(`${base}/login-bindings/:bindingId/recovery`, async (context) => {
     const request = await parseBody(context, CanonicalHumanBindingOperationRequest);
+    const actor = await requestIdentity(context, deps);
+    const projection = await getCanonicalHumanIdentityProjection(deps.db, actor.authUserId);
+    if (
+      projection.loginBindings.some(
+        (binding) =>
+          binding.id === bindingId(context) &&
+          ["google", "github", "credential"].includes(binding.providerId),
+      )
+    ) {
+      throw new HTTPException(403, {
+        message: "Managed-provider recovery cannot be initiated through raw binding management",
+      });
+    }
     return await mutate(context, deps, {
       operationType: "begin_recovery",
       bindingId: bindingId(context),
@@ -161,11 +213,20 @@ export function registerCanonicalHumanIdentityRoutes(app: Hono, deps: ApiRouteDe
 
   app.post(`${base}/login-bindings/:bindingId/recovery/complete`, async (context) => {
     const request = await parseBody(context, CanonicalHumanBindingOperationRequest);
+    const actor = await requestIdentity(context, deps);
+    const projection = await getCanonicalHumanIdentityProjection(deps.db, actor.authUserId);
+    const managed = projection.loginBindings.some(
+      (binding) =>
+        binding.id === bindingId(context) &&
+        ["google", "github", "credential"].includes(binding.providerId),
+    );
+    if (managed) await admitManagedSignInMutation(context, deps);
     return await mutate(context, deps, {
       operationType: "recover",
       bindingId: bindingId(context),
       ...request,
       operationId: request.operationId ?? randomUUID(),
+      ...(managed ? { verifiedManagedRecovery: true } : {}),
     });
   });
 }

package/src/routes/capabilities.ts

@@ -3,9 +3,16 @@ import {
   CreateCapabilityCatalogItemRequest,
   DiscoverMcpCapabilitiesResponse,
   EnableCapabilityRequest,
+  ConnectorToolPermissionsResponse,
+  UpdateConnectorToolPermissionsRequest,
 } from "@opengeni/contracts";
 import type { Hono } from "hono";
-import { requireAccessGrant } from "@opengeni/core";
+import {
+  requireAccessGrant,
+  requireAccessGrantAuthorization,
+  getConnectorToolPermissions,
+  updateConnectorToolPermissions,
+} from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
 import {
   buildCapabilityCatalog,
@@ -15,6 +22,7 @@ import {
   enableCapability,
   officialMcpRegistryUrl,
 } from "@opengeni/core";
+import { isPersonalConnectionOwnerPrincipal } from "../connection-ownership";
 import { boundedLimit } from "../http/common";
 import { z } from "zod";
 import pluginSnapshot from "../../../../data/catalog/plugins-snapshot.json";
@@ -110,6 +118,48 @@ export function registerCapabilityRoutes(app: Hono, deps: ApiRouteDeps): void {
     );
   });
 
+  app.get("/v1/workspaces/:workspaceId/capabilities/:capabilityId/tool-permissions", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:read");
+    return c.json(
+      ConnectorToolPermissionsResponse.parse(
+        await getConnectorToolPermissions({
+          db,
+          settings,
+          workspaceId,
+          grant: access.grant,
+          capabilityId: decodeURIComponent(c.req.param("capabilityId")),
+          personalOwnerVerified: isPersonalConnectionOwnerPrincipal(access),
+        }),
+      ),
+    );
+  });
+
+  app.patch(
+    "/v1/workspaces/:workspaceId/capabilities/:capabilityId/tool-permissions",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      const access = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        workspaceId,
+        "capabilities:manage",
+      );
+      const payload = UpdateConnectorToolPermissionsRequest.safeParse(await c.req.json());
+      if (!payload.success) return c.json({ error: "Invalid connector permission target" }, 400);
+      await updateConnectorToolPermissions({
+        db,
+        settings,
+        workspaceId,
+        grant: access.grant,
+        capabilityId: decodeURIComponent(c.req.param("capabilityId")),
+        personalOwnerVerified: isPersonalConnectionOwnerPrincipal(access),
+        payload: payload.data,
+      });
+      return c.json({ saved: true });
+    },
+  );
+
   app.post("/v1/workspaces/:workspaceId/capabilities/:capabilityId/enable", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "capabilities:manage");

package/src/routes/codex.ts

@@ -84,7 +84,7 @@ const CODEX_PROVIDER_LABEL = "Codex subscription · no credits";
 // The wire shape for one Codex account (metadata only; never the secret column).
 // P2: fiveHour/weekly ride along, built from the CACHED usage columns (zero
 // provider calls, zero decrypts) so the bars render instantly off this read.
-function codexAccountJson(
+export function codexAccountJson(
   row: CodexAccountStatus,
   options: {
     appsCredentialId?: string | null;
@@ -1214,7 +1214,9 @@ export function registerCodexRoutes(app: Hono, deps: ApiRouteDeps): void {
         accountId: grant.accountId,
         workspaceId,
         subjectId: grant.subjectId,
-        mode: "workspace",
+        // Connecting local capacity does not override an explicit source choice.
+        // Automatic naturally prefers the newly connected workspace pool.
+        mode: sourceBeforeConnect.mode,
         effectiveSourceBeforeMutation: sourceBeforeConnect.effectiveSource,
       });
       const rotation = await getCodexRotationSettings(tx, workspaceId);

package/src/routes/connect.ts

@@ -1,6 +1,7 @@
 import { createHash, createHmac, randomUUID } from "node:crypto";
 import type { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
+import { getConnectBeginReplay } from "@opengeni/db/connect-attempts";
 import {
   AdvanceConnectRequest,
   BeginConnectRequest,
@@ -12,15 +13,15 @@ import {
   API_INTEGRATION_OAUTH_CREDENTIAL_ROLE,
   InstallApiIntegrationRequest,
   stableJson,
+  assertOrganizationIntegrationAllowed,
   OPENGENI_PERSONAL_SLACK_MCP_URL,
-  OPENGENI_PR_REVIEW_PACK_ID,
 } from "@opengeni/contracts";
 import {
   CORE_INTEGRATION_DEFINITIONS,
   createPinnedIntegrationTransport,
 } from "@opengeni/capabilities";
 import {
-  beginConnectAttempt,
+  beginConnectAttempt as persistConnectAttempt,
   getConnectAttempt,
   listPendingConnectAttempts,
   withWorkspaceSubjectRls,
@@ -30,9 +31,8 @@ import {
   createConnection,
   updateConnection,
   encryptEnvironmentValue,
-  normalizedHostCredentialHeaders,
+  normalizedCredentialHeaders,
   listGitHubInstallationAccessForWorkspace,
-  getPackInstallation,
   listPrReviewAppRegistrations,
   listSocialConnections,
   getSocialConnection,
@@ -46,6 +46,7 @@ import {
   isOpenGeniSlackBotConnection,
   prepareCapabilityEnable,
   buildCapabilityCatalog,
+  integrationKeyForConnectProvider,
   type ApiRouteDeps,
 } from "@opengeni/core";
 import { isPersonalConnectionOwnerPrincipal } from "../connection-ownership";
@@ -74,6 +75,7 @@ import {
 } from "../integrations/provider-oauth";
 import { resolveForRoute, validatedIntegrationInstallInput } from "./api-integrations";
 import { executeConnectOperation } from "@opengeni/core";
+import { withOrganizationIntegrationPolicyFence } from "@opengeni/db/organization-integration-policy";
 import { startMcpOAuth, requireIntegrationsStateSecret } from "../integrations/oauth-client";
 import { OFFICIAL_GMAIL_MCP_URL } from "../integrations/oauth-profiles";
 import { z } from "zod";
@@ -101,13 +103,13 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
       "workspace:read",
     );
     const external = authorization.contextIntegrity;
-    const canWrite = hasPermission(authorization.grant.permissions, "connections:write");
-    const personal = isPersonalConnectionOwnerPrincipal(authorization);
-    const lensPack = await getPackInstallation(
+    const policy = await withOrganizationIntegrationPolicyFence(
       deps.db,
-      authorization.grant.workspaceId,
-      OPENGENI_PR_REVIEW_PACK_ID,
+      authorization.grant,
+      async (_tx, current) => current,
     );
+    const canWrite = hasPermission(authorization.grant.permissions, "connections:write");
+    const personal = isPersonalConnectionOwnerPrincipal(authorization);
     let mcpConfigured = false;
     let credentialConfigured = false;
     try {
@@ -118,7 +120,7 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
     } catch {
       /* Missing operator configuration is catalog readiness, not actor authority. */
     }
-    return c.json([
+    const providers = [
       ...(["x", "reddit"] as const).map((providerId) => {
         let configured = mcpConfigured;
         try {
@@ -233,27 +235,27 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
         label: "Gmail",
         family: "google",
         readiness:
-          !external || !canWrite || !personal
+          !external || !canWrite
             ? "unsupported"
             : mcpConfigured
               ? "available"
               : "needs_configuration",
-        ownership: personal ? ["personal"] : [],
+        ownership: personal ? ["workspace", "personal"] : ["workspace"],
         setup: ["oauth"],
       }),
       ConnectProvider.parse({
         id: "slack-personal",
-        label: "My Slack account",
+        label: "Slack account",
         family: "slack",
         readiness:
-          !external || !canWrite || !personal
+          !external || !canWrite
             ? "unsupported"
             : mcpConfigured &&
                 deps.settings.slackClientId?.trim() &&
                 deps.settings.slackClientSecret?.trim()
               ? "available"
               : "needs_configuration",
-        ownership: personal ? ["personal"] : [],
+        ownership: personal ? ["workspace", "personal"] : ["workspace"],
         setup: ["oauth"],
       }),
       ConnectProvider.parse({
@@ -296,7 +298,6 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
           !hasPermission(authorization.grant.permissions, "secrets:write")
             ? "unsupported"
             : credentialConfigured &&
-                lensPack?.status === "active" &&
                 deps.settings.sandboxBackend !== "selfhosted" &&
                 prReviewGitHubAppMissingSettings(deps.settings).length === 0
               ? "available"
@@ -391,7 +392,16 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
         ownership: personal ? ["workspace", "personal"] : ["workspace"],
         setup: ["credentials"],
       }),
-    ]);
+    ];
+    return c.json(
+      providers.filter(
+        (provider) =>
+          policy.mode === "unrestricted" ||
+          policy.allowedIntegrationKeys.includes(
+            integrationKeyForConnectProvider(provider.id) ?? "",
+          ),
+      ),
+    );
   });
   app.get("/v1/workspaces/:workspaceId/connect/accounts", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -717,7 +727,7 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
             await requireConnectOwnerAuthority(tx, scope, installationPermission, origin);
             if (before.providerId === "github-lens") {
               await requireConnectOwnerAuthority(tx, scope, "secrets:write", origin);
-              await requireGitHubLensConnect({ ...deps, db: tx }, workspaceId);
+              await requireGitHubLensConnect({ ...deps, db: tx });
             }
           },
           execute: async (attempt) =>
@@ -754,6 +764,7 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
             const resolved = await resolveForRoute({
               deps,
               transport,
+              accountId: scope.accountId,
               workspaceId,
               subjectId: scope.subjectId,
               payload: {
@@ -904,7 +915,7 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
       try {
         credentialHeaders =
           "headers" in values
-            ? normalizedHostCredentialHeaders(
+            ? normalizedCredentialHeaders(
                 z.record(z.string(), z.string()).parse(JSON.parse(values.headers)),
               )
             : { authorization: `Bearer ${values.token}` };
@@ -1052,6 +1063,9 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
               throw new HTTPException(409, { message: "Reload the current connection setup" });
             const started = await startMcpOAuth(deps, {
               ...scope,
+              ...(before.providerId === "gmail" || before.providerId === "slack-personal"
+                ? { integrationKey: before.providerId }
+                : {}),
               ...(continuation ? { externalContinuation: continuation } : {}),
               connectAttemptId: attempt.id,
               personalOwnershipAllowed: isPersonalConnectionOwnerPrincipal(authorization),
@@ -1144,6 +1158,7 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
           const resolved = await resolveForRoute({
             deps,
             transport,
+            accountId: scope.accountId,
             workspaceId,
             subjectId: scope.subjectId,
             payload: previewRequest,
@@ -1237,6 +1252,7 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
         inputDigest: createHash("sha256")
           .update(stableJson({ ...input, action: "cancel" }))
           .digest("hex"),
+        purpose: "cancellation",
         authorize: async (tx, attempt, origin) => {
           const permission =
             attempt.providerId === "mcp-install"
@@ -1320,8 +1336,59 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
       ...(continuation ? { externalContinuation: continuation } : {}),
     };
     return c.json(
-      await withWorkspaceSubjectRls(deps.db, workspaceId, scope.subjectId, async (tx) => {
-        await requireConnectOwnerAuthority(tx, scope, setupPermission);
+      await (async () => {
+        // Remote setup preparation stays outside the policy and actor transactions.
+        // Repeat both admissions when persisting the resulting attempt.
+        const tx = deps.db;
+        const admit = () =>
+          withOrganizationIntegrationPolicyFence(deps.db, scope, async (policyTx, policy) => {
+            return withWorkspaceSubjectRls(
+              policyTx,
+              workspaceId,
+              scope.subjectId,
+              async (actorTx) => {
+                await requireConnectOwnerAuthority(actorTx, scope, setupPermission);
+                const replay = await getConnectBeginReplay(actorTx, scope, {
+                  idempotencyKey: input.idempotencyKey,
+                  requestDigest: createHash("sha256").update(stableJson(input)).digest("hex"),
+                  returnUrl: input.returnUrl,
+                  ...(continuation ? { externalContinuation: continuation } : {}),
+                });
+                if (replay) return replay;
+                assertOrganizationIntegrationAllowed(
+                  policy,
+                  integrationKeyForConnectProvider(input.providerId),
+                );
+                return null;
+              },
+            );
+          });
+        const replay = await admit();
+        if (replay) return replay;
+        const beginConnectAttempt = async (
+          _db: Parameters<typeof persistConnectAttempt>[0],
+          _scope: Parameters<typeof persistConnectAttempt>[1],
+          attemptInput: Parameters<typeof persistConnectAttempt>[2],
+        ) =>
+          withOrganizationIntegrationPolicyFence(deps.db, scope, async (policyTx, policy) => {
+            return withWorkspaceSubjectRls(
+              policyTx,
+              workspaceId,
+              scope.subjectId,
+              async (actorTx) => {
+                await requireConnectOwnerAuthority(actorTx, scope, setupPermission);
+                return persistConnectAttempt(actorTx, scope, {
+                  ...attemptInput,
+                  authorizeAcquisition: async () => {
+                    assertOrganizationIntegrationAllowed(
+                      policy,
+                      integrationKeyForConnectProvider(input.providerId),
+                    );
+                  },
+                });
+              },
+            );
+          });
         const id = randomUUID();
         if (input.providerId === "mcp-install") {
           if (
@@ -1467,7 +1534,7 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
             if (!hasPermission(authorization.grant.permissions, "secrets:write"))
               throw new HTTPException(403, { message: "secrets:write required" });
             await requireConnectOwnerAuthority(tx, scope, "secrets:write");
-            await requireGitHubLensConnect({ ...deps, db: tx }, workspaceId);
+            await requireGitHubLensConnect({ ...deps, db: tx });
           }
           const navigation = githubAppConnectNavigation(
             deps,
@@ -1595,14 +1662,6 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
             "fiken-token",
           ].includes(input.providerId)
         ) {
-          if (input.providerId === "slack-personal" && input.ownership !== "personal")
-            throw new HTTPException(422, {
-              message: "Hosted Slack MCP requires personal ownership",
-            });
-          if (input.providerId === "gmail" && input.ownership !== "personal")
-            throw new HTTPException(422, {
-              message: "Gmail requires personal ownership; each user connects their own account",
-            });
           if (input.providerId === "fiken-token" && input.ownership !== "workspace")
             throw new HTTPException(422, { message: "Fiken is workspace-owned" });
           requireEnvironmentEncryption(deps.settings);
@@ -1867,7 +1926,7 @@ export function registerConnectRoutes(app: Hono, deps: ApiRouteDeps): void {
             expiresAt: started.expiresAt,
           },
         });
-      }),
+      })(),
     );
   });
   app.get("/v1/workspaces/:workspaceId/connect/attempts", async (c) => {