@opengeni/api-router 3.0.1 → 4.0.0

package/src/routes/plugins.ts

@@ -1,7 +1,12 @@
 import pluginSnapshot from "../../../../data/catalog/plugins-snapshot.json";
 import { marketplacePlugin } from "../integrations/marketplace-plugin";
 import { mcpEndpointIdentity } from "@opengeni/contracts";
-import { buildCapabilityCatalog, createCatalogItem } from "@opengeni/core";
+import {
+  buildCapabilityCatalog,
+  createCatalogItem,
+  integrationSourceForOrganizationPolicy,
+} from "@opengeni/core";
+import { withOrganizationIntegrationPolicyFence } from "@opengeni/db/organization-integration-policy";
 import { createHash } from "node:crypto";
 
 import {
@@ -43,6 +48,7 @@ import {
   getConnectionMetadata,
   getInstalledPluginPackage,
   getPluginPackageUninstallPreview,
+  PluginUninstallPreviewChangedError,
   integrationBindingKey,
   installApiIntegration,
   installPluginMcpReference,
@@ -344,9 +350,14 @@ export function registerPluginRoutes(
 
   app.get("/v1/workspaces/:workspaceId/plugins/:pluginKey/uninstall-preview", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "workspace:read");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
     const pluginKey = decodeURIComponent(c.req.param("pluginKey"));
-    const preview = await getPluginPackageUninstallPreview(deps.db, workspaceId, pluginKey);
+    const preview = await getPluginPackageUninstallPreview(
+      deps.db,
+      workspaceId,
+      pluginKey,
+      grant.subjectId,
+    );
     return c.json(PluginUninstallPreview.parse({ pluginKey, ...preview }));
   });
 
@@ -373,11 +384,33 @@ export function registerPluginRoutes(
             subjectId: grant.subjectId,
             pluginKey,
             expectedInstallationVersion: payload.expectedInstallationVersion,
+            ...(payload.expectedPreviewToken
+              ? { expectedPreviewToken: payload.expectedPreviewToken }
+              : {}),
             idempotencyKey: payload.idempotencyKey,
           })),
         }),
       );
     } catch (error) {
+      if (error instanceof PluginUninstallPreviewChangedError) {
+        const preview = error.preview ?? {
+          pluginKey,
+          ...(await getPluginPackageUninstallPreview(
+            deps.db,
+            workspaceId,
+            pluginKey,
+            grant.subjectId,
+          )),
+        };
+        return c.json(
+          {
+            code: error.code,
+            message: error.message,
+            preview: PluginUninstallPreview.parse(preview),
+          },
+          409,
+        );
+      }
       throw pluginMutationHttpError(error);
     }
   });
@@ -499,6 +532,11 @@ async function resolvePluginPackage(input: {
       continue;
     }
     if (component.kind === "integration") {
+      const source = await withOrganizationIntegrationPolicyFence(
+        input.deps.db,
+        input,
+        async (_tx, policy) => integrationSourceForOrganizationPolicy(policy, component.source),
+      );
       const requestedBinding = input.bindings[component.key];
       const connection = await optionalConnection(
         input.deps,
@@ -507,7 +545,7 @@ async function resolvePluginPackage(input: {
         requestedBinding?.connectionId,
       );
       const resolved = await resolveApiIntegrationPreview({
-        source: component.source,
+        source,
         connection: connectionDescriptor(connection),
         transport: input.transport,
         authority: {

package/src/routes/pr-review-github.ts

@@ -1,7 +1,7 @@
 import { environmentsEncryptionKeyBytes } from "@opengeni/config";
+import { withOrganizationIntegrationAcquisition } from "@opengeni/db/organization-integration-policy";
 import {
   AUTOMATION_WEBHOOK_MAX_BYTES,
-  OPENGENI_PR_REVIEW_PACK_ID,
   PrReviewManagedGitHubSetup,
   type AccessGrant,
   type GitHubInstallationBindingCandidate,
@@ -9,22 +9,19 @@ import {
 } from "@opengeni/contracts";
 import {
   automationRequestDigest,
-  getCapabilityPack,
   hasPermission,
-  PR_REVIEW_AUTOMATION_TEMPLATE_ID,
-  prReviewPackConnectorId,
   requireAutomationAdapter,
   requireAccessGrantAuthorization,
   externalActorContinuationForAuthorization,
   requirePermission,
   verifyPrReviewWebhook,
   type ApiRouteDeps,
+  PR_REVIEW_AUTOMATION_SETUP,
 } from "@opengeni/core";
 import {
   AutomationDeliveryConflictError,
   encryptVariableSetValue,
   getAutomationSourceSecret,
-  getPackInstallation,
   listPrReviewAppRegistrations,
   listPrReviewRepositoryBindings,
   nestedPostgresSqlState,
@@ -49,6 +46,10 @@ import {
 } from "@opengeni/github";
 import type { Context, Hono } from "hono";
 import { requireLegacyOAuthActor } from "../connection-ownership";
+import {
+  integrationCommitGrant,
+  type IntegrationCommitGrant,
+} from "../integrations/integration-commit-authority";
 import { deleteCookie, setCookie } from "hono/cookie";
 import { HTTPException } from "hono/http-exception";
 import { githubBrowserBaseUrl } from "../github-browser-flow";
@@ -131,7 +132,7 @@ export function registerPrReviewGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
     const workspaceId = c.req.param("workspaceId");
     const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:read");
     const grant = access.grant;
-    await requireActivePack(deps, workspaceId);
+
     const missing = prReviewGitHubAppMissingSettings(deps.settings);
     const configured = missing.length === 0;
     const registrations = (
@@ -203,7 +204,7 @@ export function registerPrReviewGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
     const state = requireStateQuery(c, "missing OpenGeni Lens installation state");
     const payload = requireFreshState(state, deps, "pr_review_github_authority", workspaceId);
     await requirePrReviewManageGrant(c, deps, workspaceId, payload);
-    await requireActivePack(deps, workspaceId);
+
     assertManagedCompute(deps);
     requireConfiguredApp(deps);
     const discoveryState = createSignedState(deps.githubStateSecret, {
@@ -233,7 +234,7 @@ export function registerPrReviewGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
         throw new HTTPException(400, { message: "invalid OpenGeni Lens installation" });
       }
       await requirePrReviewManageGrant(c, deps, workspaceId, payload);
-      await requireActivePack(deps, workspaceId);
+
       assertManagedCompute(deps);
       const registrations = await listPrReviewAppRegistrations(
         deps.db,
@@ -279,7 +280,7 @@ export function registerPrReviewGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
     const payload = requireFreshState(state, deps, "pr_review_github_install");
     requireStateCookie(c, state);
     await requirePrReviewManageGrant(c, deps, payload.workspaceId!, payload);
-    await requireActivePack(deps, payload.workspaceId!);
+
     assertManagedCompute(deps);
     const setupAction = c.req.query("setup_action");
     if (setupAction === "request") return c.html(setupPendingHtml());
@@ -336,10 +337,11 @@ export function registerPrReviewGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
     const payload = requireFreshState(state, deps);
     requireStateCookie(c, state);
     const grant = await requirePrReviewManageGrant(c, deps, payload.workspaceId!, payload);
-    const packInstallation = await requireActivePack(deps, grant.workspaceId);
+
     assertManagedCompute(deps);
     requireConfiguredApp(deps);
 
+    await withOrganizationIntegrationAcquisition(deps.db, grant, ["github-lens"], async () => {});
     if (payload.intent === "pr_review_github_discovery") {
       let candidates: GitHubInstallationBindingCandidate[] | null;
       try {
@@ -410,12 +412,8 @@ export function registerPrReviewGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
     if (repositoryIds.size !== proof.repositories.length) {
       throw new HTTPException(409, { message: "GitHub returned duplicate repository identities" });
     }
-    const template = getCapabilityPack(OPENGENI_PR_REVIEW_PACK_ID)?.automationTemplates?.find(
-      (candidate) => candidate.id === PR_REVIEW_AUTOMATION_TEMPLATE_ID,
-    );
-    if (!template) {
-      throw new HTTPException(503, { message: "PR Review automation template is unavailable" });
-    }
+    const template = PR_REVIEW_AUTOMATION_SETUP;
+
     const encryptionKey = environmentsEncryptionKeyBytes(deps.settings);
     if (!encryptionKey) {
       throw new HTTPException(503, {
@@ -424,32 +422,38 @@ export function registerPrReviewGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
     }
     let synchronized;
     try {
-      synchronized = await syncManagedGitHubPrReviewInstallation(deps.db, {
-        accountId: grant.accountId,
-        workspaceId: grant.workspaceId,
-        installationId,
-        providerAccountLogin: proof.installation.accountLogin,
-        providerAccountType: proof.installation.accountType as "User" | "Organization",
-        githubActorId: proof.actorId,
-        authorityKind: proof.authorityKind,
-        authorityCheckedAt: new Date(),
-        authorityExpiresAt: new Date((payload.iat + bindingStateMaxAgeSeconds) * 1_000),
-        authorityNonce: payload.nonce,
-        appId: deps.settings.prReviewGithubAppId!,
-        webhookSecretEncrypted: encryptVariableSetValue(
-          encryptionKey,
-          deps.settings.prReviewGithubWebhookSecret!,
-        ),
-        repositories: proof.repositories,
-        createdBySubjectId: grant.subjectId,
-        packInstallationId: packInstallation.id,
-        packConnectorId: prReviewPackConnectorId("github"),
-        packTemplateId: template.id,
-        adapterId: template.adapterId,
-        eventTypes: template.eventTypes,
-        configuration: template.configuration,
-        sessionTemplate: template.sessionTemplate,
-      });
+      synchronized = await withOrganizationIntegrationAcquisition(
+        deps.db,
+        grant,
+        ["github-lens"],
+        async (tx) => {
+          await grant.authorizeCommit(tx);
+          return syncManagedGitHubPrReviewInstallation(tx, {
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            installationId,
+            providerAccountLogin: proof.installation.accountLogin,
+            providerAccountType: proof.installation.accountType as "User" | "Organization",
+            githubActorId: proof.actorId,
+            authorityKind: proof.authorityKind,
+            authorityCheckedAt: new Date(),
+            authorityExpiresAt: new Date((payload.iat + bindingStateMaxAgeSeconds) * 1_000),
+            authorityNonce: payload.nonce,
+            appId: deps.settings.prReviewGithubAppId!,
+            webhookSecretEncrypted: encryptVariableSetValue(
+              encryptionKey,
+              deps.settings.prReviewGithubWebhookSecret!,
+            ),
+            repositories: proof.repositories,
+            createdBySubjectId: grant.subjectId,
+
+            adapterId: template.adapterId,
+            eventTypes: template.eventTypes,
+            configuration: template.configuration,
+            sessionTemplate: template.sessionTemplate,
+          });
+        },
+      );
     } catch (error) {
       if (error instanceof PrReviewDispatchAuthorityError) {
         throw new HTTPException(409, { message: error.message });
@@ -492,7 +496,7 @@ export function registerPrReviewGitHubRoutes(app: Hono, deps: ApiRouteDeps): voi
     const payload = requireFreshState(state, deps, "pr_review_github_selection", workspaceId);
     requireStateCookie(c, state);
     await requirePrReviewManageGrant(c, deps, workspaceId, payload);
-    await requireActivePack(deps, workspaceId);
+
     const selected = c.req.query("installation_id");
     if (selected === "new") return redirectToInstallation(c, deps, state);
     const installationId = positiveInteger(selected);
@@ -518,16 +522,6 @@ function requireConfiguredApp(deps: ApiRouteDeps): void {
   }
 }
 
-async function requireActivePack(deps: ApiRouteDeps, workspaceId: string) {
-  const installation = await getPackInstallation(deps.db, workspaceId, OPENGENI_PR_REVIEW_PACK_ID);
-  if (installation?.status !== "active") {
-    throw new HTTPException(409, {
-      message: "Install and enable the OpenGeni Review Bot Pack first",
-    });
-  }
-  return installation;
-}
-
 function assertManagedCompute(deps: ApiRouteDeps): void {
   if (deps.settings.sandboxBackend === "selfhosted") {
     throw new HTTPException(409, { message: "OpenGeni Lens requires managed compute" });
@@ -539,17 +533,33 @@ async function requirePrReviewManageGrant(
   deps: ApiRouteDeps,
   workspaceId: string,
   state: GitHubSignedStatePayload,
-): Promise<AccessGrant> {
-  let grant: AccessGrant;
+): Promise<IntegrationCommitGrant> {
+  let grant: IntegrationCommitGrant;
   try {
     const access = await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:admin");
     requireLegacyOAuthActor(access);
-    grant = access.grant;
+    grant = await integrationCommitGrant(access, ["workspace:admin", "secrets:write"], {
+      settings: deps.settings,
+      authorizationHeader: c.req.header("authorization"),
+    });
   } catch (error) {
     if (!(error instanceof HTTPException) || error.status !== 401) throw error;
     const handedOff = prReviewBrowserGrantFromState(deps, state, workspaceId);
     if (!handedOff) throw error;
-    grant = handedOff;
+    grant = {
+      ...handedOff,
+      authorizeCommit: async () => {
+        const current = prReviewBrowserGrantFromState(deps, state, workspaceId);
+        if (
+          !current ||
+          current.accountId !== handedOff.accountId ||
+          current.subjectId !== handedOff.subjectId
+        )
+          throw new HTTPException(403, {
+            message: "OpenGeni Lens browser handoff expired or changed",
+          });
+      },
+    };
   }
   requirePermission(grant, "secrets:write");
   if (grant.accountId !== state.accountId) {

package/src/routes/pr-review.ts

@@ -1,10 +1,10 @@
 import { environmentsEncryptionKeyBytes } from "@opengeni/config";
+import { withOrganizationIntegrationAcquisition } from "@opengeni/db/organization-integration-policy";
 import {
   CreatePrReviewAppRegistrationRequest,
   CreatePrReviewRepositoryBindingRequest,
   PrReviewAppRegistration,
   PrReviewRepositoryBinding,
-  OPENGENI_PR_REVIEW_PACK_ID,
   UpdatePrReviewAppRegistrationRequest,
   UpdatePrReviewRepositoryBindingRequest,
 } from "@opengeni/contracts";
@@ -12,17 +12,16 @@ import {
   assertWorkspaceModelPolicyAllows,
   canonicalConfiguredModel,
   defaultPrReviewProviderBaseUrl,
-  getCapabilityPack,
   workspaceCustomModelReference,
   lockActiveCustomModelForAdmission,
   prReviewWebhookAuthKind,
   normalizePrReviewProviderBaseUrl,
-  prReviewPackConnectorId,
-  PR_REVIEW_AUTOMATION_TEMPLATE_ID,
   requireAccessGrant,
+  requireAccessGrantAuthorization,
   requirePermission,
   resolveWorkspaceCatalogSettings,
   type ApiRouteDeps,
+  PR_REVIEW_AUTOMATION_SETUP,
 } from "@opengeni/core";
 import {
   createPrReviewAppRegistration,
@@ -32,7 +31,6 @@ import {
   decryptVariableSetValue,
   encryptVariableSetValue,
   getPrReviewAppRegistrationSecret,
-  getPackInstallation,
   listPrReviewAppRegistrations,
   listPrReviewRepositoryBindings,
   nestedPostgresSqlState,
@@ -48,6 +46,7 @@ import {
   verifyPrReviewProviderRepository,
 } from "../integrations/pr-review-provider";
 import { registerPrReviewGitHubRoutes } from "./pr-review-github";
+import { integrationCommitGrant } from "../integrations/integration-commit-authority";
 
 export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { db, settings } = deps;
@@ -56,7 +55,7 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.get("/v1/workspaces/:workspaceId/pr-review/registrations", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:read");
-    await requirePrReviewPackActive(db, workspaceId);
+
     return c.json({
       registrations: await listPrReviewAppRegistrations(db, grant.accountId, workspaceId),
       repositories: await listPrReviewRepositoryBindings(db, grant.accountId, workspaceId),
@@ -67,7 +66,7 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
     requirePermission(grant, "secrets:write");
-    const packInstallation = await requirePrReviewPackActive(db, workspaceId);
+
     assertPrReviewSandboxBackend(deps);
     const payload = CreatePrReviewAppRegistrationRequest.parse(await c.req.json());
     const encryptionKey = requirePrReviewEncryptionKey(deps);
@@ -94,28 +93,32 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
       });
     }
     const registration = await mapPrReviewUniqueConflict(
-      createPrReviewAppRegistration(db, {
-        accountId: grant.accountId,
-        workspaceId,
-        name: payload.name,
-        provider: payload.provider,
-        providerBaseUrl,
-        appId: payload.appId ?? null,
-        credentialKind: payload.credentialKind,
-        credentialEncrypted: encryptVariableSetValue(
-          encryptionKey,
-          payload.privateKey ?? payload.accessToken!,
-        ),
-        accessTokenExpiresAt: payload.accessTokenExpiresAt
-          ? new Date(payload.accessTokenExpiresAt)
-          : null,
-        webhookAuthKind: prReviewWebhookAuthKind(payload.provider),
-        webhookSecretEncrypted: encryptVariableSetValue(encryptionKey, payload.webhookSecret),
-        webhookUsername: payload.webhookUsername ?? null,
-        createdBySubjectId: grant.subjectId,
-        packInstallationId: packInstallation.id,
-        packConnectorId: prReviewPackConnectorId(payload.provider),
-      }),
+      withOrganizationIntegrationAcquisition(
+        db,
+        grant,
+        [prReviewIntegrationKey(payload.provider)],
+        (tx) =>
+          createPrReviewAppRegistration(tx, {
+            accountId: grant.accountId,
+            workspaceId,
+            name: payload.name,
+            provider: payload.provider,
+            providerBaseUrl,
+            appId: payload.appId ?? null,
+            credentialKind: payload.credentialKind,
+            credentialEncrypted: encryptVariableSetValue(
+              encryptionKey,
+              payload.privateKey ?? payload.accessToken!,
+            ),
+            accessTokenExpiresAt: payload.accessTokenExpiresAt
+              ? new Date(payload.accessTokenExpiresAt)
+              : null,
+            webhookAuthKind: prReviewWebhookAuthKind(payload.provider),
+            webhookSecretEncrypted: encryptVariableSetValue(encryptionKey, payload.webhookSecret),
+            webhookUsername: payload.webhookUsername ?? null,
+            createdBySubjectId: grant.subjectId,
+          }),
+      ),
       "A PR Review registration with this provider and name already exists",
     );
     await recordAuditEvent(db, {
@@ -138,7 +141,7 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
     requirePermission(grant, "secrets:write");
-    await requirePrReviewPackActive(db, workspaceId);
+
     const payload = UpdatePrReviewAppRegistrationRequest.parse(await c.req.json());
     const existing = await getPrReviewAppRegistrationSecret(db, {
       accountId: grant.accountId,
@@ -272,8 +275,12 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/pr-review/repositories", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    const packInstallation = await requirePrReviewPackActive(db, workspaceId);
+    const grant = await integrationCommitGrant(
+      await requireAccessGrantAuthorization(c, deps, workspaceId, "workspace:admin"),
+      ["workspace:admin"],
+      { settings: deps.settings, authorizationHeader: c.req.header("authorization") },
+    );
+
     const payload = CreatePrReviewRepositoryBindingRequest.parse(await c.req.json());
     const registration = await getPrReviewAppRegistrationSecret(db, {
       accountId: grant.accountId,
@@ -284,6 +291,8 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
       throw new HTTPException(404, {
         message: "PR Review app registration not found",
       });
+    const integrationKey = prReviewIntegrationKey(registration.provider);
+    await withOrganizationIntegrationAcquisition(db, grant, [integrationKey], async () => {});
     const repositoryUrl = new URL(payload.repositoryUri);
     let canonicalRepositoryUri = repositoryUrl.href;
     let canonicalRepositoryFullName = payload.repositoryFullName;
@@ -406,35 +415,33 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
           modelId: model,
         })
       : undefined;
-    const template = getCapabilityPack(OPENGENI_PR_REVIEW_PACK_ID)?.automationTemplates?.find(
-      (candidate) => candidate.id === PR_REVIEW_AUTOMATION_TEMPLATE_ID,
-    );
-    if (!template) {
-      throw new HTTPException(503, { message: "PR Review automation template is unavailable" });
-    }
+    const template = PR_REVIEW_AUTOMATION_SETUP;
+
     const binding = await mapPrReviewUniqueConflict(
-      createPrReviewRepositoryBinding(db, {
-        accountId: grant.accountId,
-        workspaceId,
-        registrationId: registration.id,
-        provider: registration.provider,
-        repositoryUri: canonicalRepositoryUri,
-        repositoryFullName: canonicalRepositoryFullName,
-        providerRepositoryId: canonicalProviderRepositoryId,
-        installationId:
-          payload.installationId === undefined ? null : String(payload.installationId),
-        projectId: canonicalProjectId,
-        model,
-        additionalInstructions: payload.additionalInstructions ?? null,
-        status: payload.status,
-        createdBySubjectId: grant.subjectId,
-        packInstallationId: packInstallation.id,
-        packTemplateId: template.id,
-        adapterId: template.adapterId,
-        eventTypes: template.eventTypes,
-        configuration: template.configuration,
-        sessionTemplate: template.sessionTemplate,
-        ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
+      withOrganizationIntegrationAcquisition(db, grant, [integrationKey], async (tx) => {
+        await grant.authorizeCommit(tx);
+        return createPrReviewRepositoryBinding(tx, {
+          accountId: grant.accountId,
+          workspaceId,
+          registrationId: registration.id,
+          provider: registration.provider,
+          repositoryUri: canonicalRepositoryUri,
+          repositoryFullName: canonicalRepositoryFullName,
+          providerRepositoryId: canonicalProviderRepositoryId,
+          installationId:
+            payload.installationId === undefined ? null : String(payload.installationId),
+          projectId: canonicalProjectId,
+          model,
+          additionalInstructions: payload.additionalInstructions ?? null,
+          status: payload.status,
+          createdBySubjectId: grant.subjectId,
+
+          adapterId: template.adapterId,
+          eventTypes: template.eventTypes,
+          configuration: template.configuration,
+          sessionTemplate: template.sessionTemplate,
+          ...(beforeCreateCommit ? { beforeCreateCommit } : {}),
+        });
       }),
       "This repository is already bound to the selected PR Review registration",
     );
@@ -457,7 +464,7 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
   app.patch("/v1/workspaces/:workspaceId/pr-review/repositories/:bindingId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "workspace:admin");
-    await requirePrReviewPackActive(db, workspaceId);
+
     const payload = UpdatePrReviewRepositoryBindingRequest.parse(await c.req.json());
     const catalogSettings = (
       await resolveWorkspaceCatalogSettings(db, deps.settings, {
@@ -547,6 +554,12 @@ export function registerPrReviewRoutes(app: Hono, deps: ApiRouteDeps): void {
   });
 }
 
+/** PR Review's server-owned provider, not a repository URL or user label,
+ * establishes Lens identity. Other providers have no curated acquisition key. */
+function prReviewIntegrationKey(provider: string): "github-lens" | null {
+  return provider === "github" ? "github-lens" : null;
+}
+
 function prReviewCustomModelCommitGuard(input: {
   settings: ApiRouteDeps["settings"];
   accountId: string;
@@ -578,16 +591,6 @@ function assertPrReviewSandboxBackend(deps: ApiRouteDeps): void {
   }
 }
 
-async function requirePrReviewPackActive(db: ApiRouteDeps["db"], workspaceId: string) {
-  const installation = await getPackInstallation(db, workspaceId, OPENGENI_PR_REVIEW_PACK_ID);
-  if (installation?.status !== "active") {
-    throw new HTTPException(409, {
-      message: "Install and enable the OpenGeni Review Bot Pack first",
-    });
-  }
-  return installation;
-}
-
 function requirePrReviewEncryptionKey(deps: ApiRouteDeps): Uint8Array {
   const key = environmentsEncryptionKeyBytes(deps.settings);
   if (!key) {