@opengeni/api-router 3.2.2 → 3.4.0

package/src/site-frame-guard.ts

@@ -11,7 +11,7 @@ import {
   withSiteSessionOrigin,
   type ApiRouteDeps,
 } from "@opengeni/core";
-import { getSession } from "@opengeni/db";
+import { getSession, getSessionAuthorityProjection } from "@opengeni/db";
 import type { Context, Next } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { ApiHttpError } from "./http/api-error";
@@ -78,10 +78,19 @@ export function siteFrameGuard(deps: ApiRouteDeps) {
         throw new HTTPException(404, { message: "Unsupported Site session API path" });
     }
     if (match.sessionId !== null) {
+      const authority = await getSessionAuthorityProjection(
+        deps.db,
+        grant.workspaceId,
+        match.sessionId,
+      );
       const session = await getSession(deps.db, grant.workspaceId, match.sessionId).catch(
         () => null,
       );
-      if (!session || !siteOriginsMatch(origin, siteSessionOriginFromMetadata(session.metadata)))
+      if (
+        !authority?.siteAccessRootId ||
+        !session ||
+        !siteOriginsMatch(origin, siteSessionOriginFromMetadata(session.metadata))
+      )
         throw new HTTPException(404, { message: "session not found" });
     }
     if (c.req.method !== "GET" && match.operation.id !== "sessions.create") {

package/src/site-publishing/agent-data-tools.ts

@@ -1,10 +1,12 @@
 import {
   siteHostname,
+  permissionsRequiredByFirstPartyTools,
   type FirstPartyMcpToolName,
+  type Permission,
   type SiteLimitProfileKind,
 } from "@opengeni/contracts";
 import { resolveFirstPartyMcpToolPolicy } from "@opengeni/config";
-import type { ApiRouteDeps } from "@opengeni/core";
+import { hasPermission, type ApiRouteDeps } from "@opengeni/core";
 import {
   consumeSiteRuntimeRate,
   findSiteRuntimeAgentConversation,
@@ -47,12 +49,6 @@ export const SITE_AGENT_MEMBER_SQL_TOOLS = Object.freeze([
   "site_sql_query",
 ] as const satisfies readonly FirstPartyMcpToolName[]);
 
-/** The first-party permissions those tools need (Site Data writes need publish). */
-export const SITE_AGENT_DATA_TOOL_PERMISSIONS = Object.freeze([
-  "artifacts:read",
-  "artifacts:publish",
-] as const);
-
 export const SITE_AGENT_OTHER_SITE_MESSAGE = "This Site's assistant can only use this Site's data";
 export const SITE_AGENT_MANAGEMENT_MESSAGE =
   "This Site's assistant can use the Site's data, not manage the Site";
@@ -64,13 +60,23 @@ export function siteAgentDataToolNames(input: {
   siteSql: boolean;
   /** The deployment's first-party tool allowlist. */
   allowed: readonly string[];
+  /** Live member ceiling; omitted only where the native caller filters tools itself. */
+  memberPermissions?: readonly Permission[];
 }): FirstPartyMcpToolName[] {
   const names: FirstPartyMcpToolName[] = [
     ...SITE_AGENT_DATA_TOOLS,
     ...(input.siteSql ? SITE_AGENT_SQL_TOOLS : []),
     ...(input.siteSql && input.viewerKind === "member" ? SITE_AGENT_MEMBER_SQL_TOOLS : []),
   ];
-  return names.filter((name) => input.allowed.includes(name));
+  return names.filter(
+    (name) =>
+      input.allowed.includes(name) &&
+      (input.viewerKind !== "member" ||
+        input.memberPermissions === undefined ||
+        permissionsRequiredByFirstPartyTools([name]).every((permission) =>
+          hasPermission(input.memberPermissions!, permission),
+        )),
+  );
 }
 
 /** Whether Site SQL is offered on this deployment and turned on for the Site. */
@@ -90,11 +96,13 @@ export async function siteAgentDataToolsForStart(
   scope: { accountId: string; workspaceId: string },
   siteId: string,
   viewerKind: SiteRuntimeConversationViewerKind,
+  memberPermissions?: readonly Permission[],
 ): Promise<FirstPartyMcpToolName[]> {
   return siteAgentDataToolNames({
     viewerKind,
     siteSql: await siteAgentSiteSqlOn(deps, scope, siteId),
     allowed: resolveFirstPartyMcpToolPolicy(deps.settings).allowed,
+    ...(memberPermissions === undefined ? {} : { memberPermissions }),
   });
 }
 

package/src/site-publishing/agent-session.ts

@@ -1,11 +1,16 @@
-import { resolveAgentConfig, type SessionToolPolicy, type ToolRef } from "@opengeni/contracts";
+import {
+  permissionsRequiredByFirstPartyTools,
+  resolveAgentConfig,
+  type Permission,
+  type SessionToolPolicy,
+  type ToolRef,
+} from "@opengeni/contracts";
 import { agentConfigDeploymentPolicy, resolveFirstPartyMcpToolPolicy } from "@opengeni/config";
 import { siteSessionOriginFromMetadata, type ApiRouteDeps } from "@opengeni/core";
 import { appendSessionEventsWithLockedSessionUpdate, getSiteSqlDatabase } from "@opengeni/db";
 import { publishDurableSessionEvents } from "@opengeni/events";
 import {
   resolveSiteAgentDataContext,
-  SITE_AGENT_DATA_TOOL_PERMISSIONS,
   siteAgentDataToolNames,
   siteAgentInstructions,
 } from "./agent-data-tools";
@@ -14,7 +19,7 @@ import type { SiteRuntimeViewer } from "./viewer";
 import { sitePublishingError } from "./service";
 import { siteSqlOffered } from "../site-sql/gateway";
 
-export const SITE_AGENT_DEFAULTS_VERSION = 1;
+export const SITE_AGENT_DEFAULTS_VERSION = 2;
 
 /**
  * Before admitting more work, converge pre-redesign published-host sessions to
@@ -33,6 +38,7 @@ export async function normalizeSiteAgentSession(
   viewer: SiteRuntimeViewer,
   sessionId: string,
   retainedToolIds: readonly string[],
+  memberPermissions?: readonly Permission[],
 ): Promise<void> {
   const data = await resolveSiteAgentDataContext(deps, host.scope, sessionId);
   if (
@@ -55,7 +61,9 @@ export async function normalizeSiteAgentSession(
     viewerKind: viewer.kind,
     siteSql: sqlEnabled,
     allowed: resolveFirstPartyMcpToolPolicy(deps.settings).allowed,
+    ...(memberPermissions === undefined ? {} : { memberPermissions }),
   });
+  const dataToolPermissions = permissionsRequiredByFirstPartyTools(dataTools);
   const config = resolveAgentConfig({
     creator: "api",
     request: {
@@ -83,7 +91,12 @@ export async function normalizeSiteAgentSession(
     (session) => {
       if (
         session.parentSessionId ||
-        session.createdBy.subjectId !== `site:${host.site.id}` ||
+        (session.createdBy.subjectId !== `site:${host.site.id}` &&
+          !(
+            viewer.kind === "member" &&
+            session.createdBy.kind === "subject" &&
+            session.createdBy.subjectId === viewer.subjectId
+          )) ||
         siteSessionOriginFromMetadata(session.metadata)?.siteId !== host.site.id
       )
         throw sitePublishingError(
@@ -97,7 +110,12 @@ export async function normalizeSiteAgentSession(
         raw && typeof raw === "object" && !Array.isArray(raw)
           ? (raw as Record<string, unknown>)
           : {};
-      if (stamp.agentDefaultsVersion === SITE_AGENT_DEFAULTS_VERSION) return { events: [] };
+      if (
+        stamp.agentDefaultsVersion === SITE_AGENT_DEFAULTS_VERSION &&
+        session.firstPartyMcpTools.join(",") === dataTools.join(",") &&
+        session.firstPartyMcpPermissions?.join(",") === dataToolPermissions.join(",")
+      )
+        return { events: [] };
       // Never restore workspace defaults or add a newly declared connector to
       // an old conversation. Preserve only its still-authorized exact refs.
       const allowed = new Set(["opengeni", ...retainedToolIds]);
@@ -126,7 +144,7 @@ export async function normalizeSiteAgentSession(
         ],
         update: {
           firstPartyMcpTools: dataTools,
-          firstPartyMcpPermissions: [...SITE_AGENT_DATA_TOOL_PERMISSIONS],
+          firstPartyMcpPermissions: dataToolPermissions,
           agentConfig: config,
           instructions,
           tools,

package/src/site-publishing/runtime.ts

@@ -9,7 +9,11 @@ import {
   type SiteLimits,
   type SiteViewerCapabilities,
 } from "@opengeni/contracts";
-import { sessionUsageLimitsProducerEnabled, type ApiRouteDeps } from "@opengeni/core";
+import {
+  sessionUsageLimitsProducerEnabled,
+  stampSiteViewerSessionAuthorization,
+  type ApiRouteDeps,
+} from "@opengeni/core";
 import {
   consumeSiteRuntimeRate,
   findSiteHostname,
@@ -40,6 +44,7 @@ import {
   type SiteRuntimeReservation,
 } from "@opengeni/db";
 import type { SiteGatewayFields } from "./gateway-signature";
+import { bindSiteSessionRequestAuthority } from "./session-request-authority";
 import { effectiveSiteLimits, siteViewerLimits, sourceSiteLimitProfile } from "./limits";
 import {
   siteLimitInputs,
@@ -59,8 +64,8 @@ import {
 /**
  * Site-runtime: the narrow API a Site gateway calls for one published Site
  * host, after the gateway signature passed. Everything here works for exactly
- * one Site: the host names it, the viewer is resolved for it, and the agent
- * principal is `site:<siteId>`.
+ * one Site: the host names it and the viewer is resolved for it. Members retain
+ * their human identity; outsiders use the viewer-bound `site:<siteId>` principal.
  */
 
 export type SiteRuntimeDeps = Pick<ApiRouteDeps, "db" | "settings" | "objectStorage">;
@@ -219,6 +224,7 @@ export async function resolveSiteRuntimeViewer(
 /** What a viewer cannot do on a Site: 403 with `details.code` `not_available_for_viewer`. */
 export type SiteViewerFeature =
   | "agent"
+  | "private_conversations"
   | "agent_model"
   | "workspace_tools"
   | "site_data"
@@ -796,9 +802,9 @@ export async function meterSiteRuntime(
 // --- in-process dispatch ------------------------------------------------------------
 
 /**
- * Run an ordinary session route in this process as the Site's service
- * principal (`site:<siteId>`), with a 60-second delegated token carrying only
- * session permissions and the viewer as its display label. The Site and the
+ * Run an ordinary session route in this process as the verified member, or
+ * the Site service principal for an outsider. The latter uses a 60-second
+ * delegated token plus the separate trusted viewer audience. The Site and the
  * served version ride along as the request's Site origin, so new sessions and
  * turns record where they came from. The route authorizes as usual.
  */
@@ -812,14 +818,30 @@ export async function siteRuntimeSessionRequest(
     path: string;
     body?: unknown;
     extraPermissions?: readonly Permission[];
+    reauthorize: () => Promise<void>;
   },
 ): Promise<Request> {
-  return await siteServiceSessionRequest(
+  const request = await siteServiceSessionRequest(
     deps,
     host.scope,
     { id: host.site.id, versionId: host.versionId },
     { ...input, label: `${siteRuntimeViewerLabel(viewer)} on ${host.hostname}` },
   );
+  bindSiteSessionRequestAuthority(request, input.reauthorize);
+  if (viewer.kind === "member" && viewer.subjectId && viewer.sessionId) {
+    // The gateway already verified the host and opaque Site cookie. Native
+    // resolution reloads this person's live membership, roles and models.
+    // This is delegated ownership, never fabricated managed-cookie proof.
+    stampSiteViewerSessionAuthorization(request, {
+      organizationId: host.scope.accountId,
+      subjectId: viewer.subjectId,
+      permissions: [
+        ...new Set([...SITE_RUNTIME_AGENT_PERMISSIONS, ...(input.extraPermissions ?? [])]),
+      ],
+      workspaceId: host.scope.workspaceId,
+    });
+  }
+  return request;
 }
 
 /** A forwarded response without cookies (site-runtime never sets any). */

package/src/site-publishing/service.ts

@@ -1,4 +1,5 @@
 import { randomBytes } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
 import {
   normalizeSitesDomain,
   OPENGENI_API_CONTRACT_HEADER,
@@ -23,6 +24,7 @@ import {
   siteAgentClamp,
   siteViewerForGrant,
   type ApiRouteDeps,
+  type cancelPublishedSiteSession,
 } from "@opengeni/core";
 import {
   bumpSitePublicationGeneration,
@@ -38,7 +40,7 @@ import {
   readSiteRuntimeUsage,
   recordSitePublicationScan,
   getPublishedSite,
-  listActiveSiteRuntimeConversations,
+  listSiteRuntimeCancellationCandidates,
   revokeSiteViewerSessions,
   SitePublishingError,
   SITE_RUNTIME_SITE_PRINCIPAL,
@@ -174,24 +176,20 @@ export const SITE_EFFECT_CONCURRENCY = 4;
 const SITE_EFFECT_QUEUE_LIMIT = 2_000;
 
 const effectsBySettings = new WeakMap<object, SitePublishingEffects>();
-const dispatchBySettings = new WeakMap<object, (request: Request) => Promise<Response>>();
+type SiteCancellation = (
+  input: Parameters<typeof cancelPublishedSiteSession>[1],
+) => Promise<unknown>;
+const cancellationBySettings = new WeakMap<object, SiteCancellation>();
 
 /**
- * The app's in-process dispatch, registered with the site-runtime routes, so
- * publication changes can cancel a Site's conversations through the ordinary
- * session routes. Without it (the operator script) cancellation is skipped.
+ * Internal host lifecycle adapter. This never grants the Site service bearer
+ * ordinary session access and never impersonates a conversation's viewer.
  */
-export function setSitePublishingDispatch(
+export function setSitePublishingCancellation(
   settings: ApiRouteDeps["settings"],
-  dispatch: (request: Request) => Promise<Response>,
+  cancel: SiteCancellation,
 ): void {
-  dispatchBySettings.set(settings, dispatch);
-}
-
-export function sitePublishingDispatch(
-  settings: ApiRouteDeps["settings"],
-): ((request: Request) => Promise<Response>) | null {
-  return dispatchBySettings.get(settings) ?? null;
+  cancellationBySettings.set(settings, cancel);
 }
 
 type SitePublishingEffectsOptions = {
@@ -643,26 +641,29 @@ export async function siteServiceSessionRequest(
     "x-opengeni-site-id": site.id,
   });
   if (site.versionId) headers.set("x-opengeni-site-version", site.versionId);
-  if (input.body !== undefined) headers.set("content-type", "application/json");
+  const body = input.body === undefined ? undefined : JSON.stringify(input.body);
+  if (body !== undefined) {
+    headers.set("content-type", "application/json");
+    // Preserve the exact Request carrying verified-human dispatch proof.
+    headers.set("content-length", String(Buffer.byteLength(body)));
+  }
   return new Request(new URL(input.path, input.origin), {
     method: input.method,
     headers,
-    ...(input.body === undefined ? {} : { body: JSON.stringify(input.body) }),
+    ...(body === undefined ? {} : { body }),
   });
 }
 
-/** Conversations cancelled per stop (newest activity first); the rest end on their own caps. */
-const STOP_CONVERSATIONS_LIMIT = 200;
+/** Bound each database page, not the complete cancellation operation. */
+const STOP_CONVERSATIONS_PAGE_SIZE = 200;
 
 /**
  * Stop a Site's viewers after a takedown, unpublish or narrower access:
  * revoke every site-session now, and after commit cancel the Site's agent
  * conversations that may still be working (in-flight turns and queued
- * messages), as the Site itself through the ordinary control route. The
- * gateway refuses new work at once regardless: every site-runtime call
- * re-checks the publication. Without an in-process dispatch (the operator
- * script) the cancellation is skipped and logged; per-conversation caps
- * still bound what running turns can spend.
+ * messages), through the native cancel-only lifecycle adapter. The original
+ * actor survives queued background execution. No transcript access is granted.
+ * Every page is drained, including old conversations; there is no age cutoff.
  */
 export async function stopSiteViewers(
   deps: SitePublishingDeps,
@@ -688,68 +689,55 @@ export async function stopSiteViewers(
     }
   }
   if (options.cancelConversations === false) return { revokedSessions };
-  const dispatch = sitePublishingDispatch(deps.settings);
-  if (!dispatch) {
-    console.warn("[site-publishing] conversation cancel skipped: no in-process dispatch", {
+  const cancel = cancellationBySettings.get(deps.settings);
+  if (!cancel) {
+    console.warn("[site-publishing] conversation cancel unavailable: no lifecycle adapter", {
       siteId,
     });
     return { revokedSessions };
   }
   const effects = sitePublishingEffects(deps.settings);
-  const origin = deps.settings.publicBaseUrl ?? "http://localhost";
-  effects.schedule("cancel conversations", async () => {
-    const sessionIds = await listActiveSiteRuntimeConversations(deps.db, scope, {
-      siteId,
-      limit: STOP_CONVERSATIONS_LIMIT,
-      ...(options.toolsNarrowedTo ? { toolsNarrowedTo: options.toolsNarrowedTo } : {}),
-    });
-    if (sessionIds.length === 0) return;
-    // The Site acts with its own origin (a Site and one of its versions).
-    const versionId = (await getPublishedSite(deps.db, scope, siteId))?.currentVersionId ?? null;
-    if (!versionId) {
-      console.warn("[site-publishing] conversation cancel skipped: the Site has no version", {
-        siteId,
-      });
-      return;
-    }
-    const operation = crypto.randomUUID();
-    for (const sessionId of sessionIds) {
-      try {
-        const response = await dispatch(
-          await siteServiceSessionRequest(
-            deps,
-            scope,
-            { id: siteId, versionId },
-            {
-              origin,
-              method: "POST",
-              path: `/v1/workspaces/${scope.workspaceId}/sessions/${sessionId}/control`,
-              body: {
-                action: "cancel",
-                clientEventId: `site-stop:${operation}:${sessionId}`.slice(0, 200),
-                reason: options.reason.slice(0, 500),
-              },
-              label: "Published Site",
-            },
-          ),
-        );
-        if (!response.ok)
-          console.warn("[site-publishing] could not cancel a Site conversation", {
-            siteId,
-            sessionId,
-            status: response.status,
-            body: (await response.text().catch(() => "")).slice(0, 300),
-          });
-        else await response.body?.cancel().catch(() => undefined);
-      } catch (error) {
-        console.warn("[site-publishing] could not cancel a Site conversation", {
+  const runInContext = AsyncLocalStorage.snapshot();
+  const operation = crypto.randomUUID();
+  const startedBefore = new Date();
+  const run = () =>
+    runInContext(async () => {
+      let after: string | undefined;
+      let failed = 0;
+      for (;;) {
+        const sessionIds = await listSiteRuntimeCancellationCandidates(deps.db, scope, {
           siteId,
-          sessionId,
-          error: error instanceof Error ? error.message : String(error),
+          limit: STOP_CONVERSATIONS_PAGE_SIZE,
+          startedBefore,
+          ...(after ? { after } : {}),
+          ...(options.toolsNarrowedTo ? { toolsNarrowedTo: options.toolsNarrowedTo } : {}),
         });
+        if (sessionIds.length === 0) break;
+        for (const sessionId of sessionIds) {
+          try {
+            await cancel({
+              ...scope,
+              siteId,
+              sessionId,
+              operationKey: `site-stop:${operation}:${sessionId}`,
+              reason: options.reason.slice(0, 500),
+            });
+          } catch (error) {
+            failed += 1;
+            console.warn("[site-publishing] could not cancel a Site conversation", {
+              siteId,
+              sessionId,
+              error: error instanceof Error ? error.message : String(error),
+            });
+          }
+        }
+        after = sessionIds.at(-1)!;
       }
-    }
-  });
+      if (failed > 0)
+        throw new Error(`Site lifecycle cancellation failed for ${failed} conversations`);
+    });
+  // A saturated best-effort effects queue must not silently drop cancellation.
+  if (!effects.schedule("cancel conversations", run)) await run();
   return { revokedSessions };
 }
 

package/src/site-publishing/session-request-authority.ts

@@ -0,0 +1,14 @@
+/** Exact in-process request proof, installed only by the verified Site gateway. */
+const authorities = new WeakMap<Request, () => Promise<void>>();
+
+export function bindSiteSessionRequestAuthority(
+  request: Request,
+  reauthorize: () => Promise<void>,
+): void {
+  authorities.set(request, reauthorize);
+}
+
+/** Periodic SSE reauthorization must check the Site cookie, not only its delegate. */
+export async function reauthorizeSiteSessionRequest(request: Request): Promise<void> {
+  await authorities.get(request)?.();
+}