@opengeni/contracts 4.1.0 → 5.0.0

package/src/connection-authority.ts

@@ -1,150 +1,7 @@
 import { z } from "zod";
-import {
-  ConnectionKind,
-  ManagedUserResourceGrantMode,
-  SessionTenancyVisibility,
-  UserResourceAuthorityGrant,
-  UserResourceDelegation,
-} from "./index";
+import { ConnectionKind, SessionTenancyVisibility } from "./index";
 
-/** The only generic grant action that authorizes use of a connection. */
-export const ConnectionUseAction = z.literal("connection.use");
-export type ConnectionUseAction = z.infer<typeof ConnectionUseAction>;
-
-/**
- * Connection authority is either workspace-owned or user-owned. Omission is
- * intentionally compatible with the historical workspace connection path.
- */
-export const ConnectionAuthorityEnvelope = z
-  .object({
-    scope: z.enum(["workspace", "user"]).default("workspace"),
-    userDelegation: UserResourceDelegation.optional(),
-  })
-  .strict()
-  .superRefine((value, context) => {
-    if (value.scope === "workspace" && value.userDelegation !== undefined) {
-      context.addIssue({
-        code: "custom",
-        path: ["userDelegation"],
-        message: "workspace connections cannot carry user delegation",
-      });
-      return;
-    }
-    if (value.scope === "user" && value.userDelegation === undefined) {
-      context.addIssue({
-        code: "custom",
-        path: ["userDelegation"],
-        message: "user connections require an immutable delegation",
-      });
-      return;
-    }
-    if (value.userDelegation && value.userDelegation.action !== ConnectionUseAction.value) {
-      context.addIssue({
-        code: "custom",
-        path: ["userDelegation", "action"],
-        message: "connection delegation must use connection.use",
-      });
-    }
-  });
-export type ConnectionAuthorityEnvelope = z.infer<typeof ConnectionAuthorityEnvelope>;
-
-export const ConnectionAuthorityGrant = UserResourceAuthorityGrant.extend({
-  action: ConnectionUseAction,
-}).strict();
-export type ConnectionAuthorityGrant = z.infer<typeof ConnectionAuthorityGrant>;
-
-/** Owner-only opaque projection; connection identity and owner metadata stay server-side. */
-export const ConnectionAuthoritySummary = z
-  .object({
-    authorityId: z.string().uuid(),
-    resourceId: z.string().uuid(),
-    originWorkspaceId: z.string().uuid().nullable(),
-    generation: z.number().int().positive(),
-    status: z.enum(["active", "retained", "revoked"]),
-    grants: z.array(ConnectionAuthorityGrant),
-  })
-  .strict();
-export type ConnectionAuthoritySummary = z.infer<typeof ConnectionAuthoritySummary>;
-
-export const ListConnectionAuthoritiesQuery = z
-  .object({
-    scope: z.literal("user"),
-    cursor: z.string().uuid().optional(),
-    limit: z.coerce.number().int().min(1).max(100).default(50),
-  })
-  .strict();
-export const ListConnectionAuthoritiesResponse = z
-  .object({
-    scope: z.literal("user"),
-    authorities: z.array(ConnectionAuthoritySummary),
-    nextCursor: z.string().uuid().nullable(),
-  })
-  .strict();
-
-export const IssueConnectionUseGrantRequest = z
-  .object({
-    scope: z.literal("user"),
-    mode: ManagedUserResourceGrantMode,
-    context: SessionTenancyVisibility,
-    sessionId: z.string().uuid().nullable().optional(),
-    expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),
-    workspaceSharedAcknowledged: z.boolean().default(false),
-  })
-  .strict()
-  .superRefine((value, context) => {
-    if (value.context === "workspace_shared" && !value.workspaceSharedAcknowledged) {
-      context.addIssue({
-        code: "custom",
-        path: ["workspaceSharedAcknowledged"],
-        message: "workspace_shared requires durable shared-output acknowledgement",
-      });
-    }
-    if (value.mode === "always" && (value.sessionId || value.expectedAuthorityEpoch)) {
-      context.addIssue({ code: "custom", path: ["sessionId"], message: "always is unbound" });
-    }
-    if (value.mode === "session" && (!value.sessionId || !value.expectedAuthorityEpoch)) {
-      context.addIssue({
-        code: "custom",
-        path: ["sessionId"],
-        message: "session requires a target session and expectedAuthorityEpoch",
-      });
-    }
-  });
-export type IssueConnectionUseGrantRequest = z.infer<typeof IssueConnectionUseGrantRequest>;
-
-export const RevokeConnectionUseGrantQuery = z.object({ scope: z.literal("user") }).strict();
-
-export const ConnectionUseGrantMutationResponse = z
-  .object({
-    scope: z.literal("user"),
-    grant: ConnectionAuthorityGrant,
-  })
-  .strict();
-export type ConnectionUseGrantMutationResponse = z.infer<typeof ConnectionUseGrantMutationResponse>;
-
-export const ConnectionUseGrantRevocationResponse = z
-  .object({
-    scope: z.literal("user"),
-    grant: z
-      .object({
-        grantId: z.string().uuid(),
-        generation: z.number().int().positive(),
-        status: z.literal("revoked"),
-        revokedAt: z.string().datetime(),
-      })
-      .strict(),
-  })
-  .strict();
-export type ConnectionUseGrantRevocationResponse = z.infer<
-  typeof ConnectionUseGrantRevocationResponse
->;
-
-export const ConnectionAuthoritySelectionSource = z.enum([
-  "explicit_workspace",
-  "legacy_workspace_omission",
-  "legacy_user_compatibility",
-  "user_delegation",
-]);
+export const ConnectionAuthoritySelectionSource = z.enum(["explicit_workspace", "sender"]);
 export type ConnectionAuthoritySelectionSource = z.infer<typeof ConnectionAuthoritySelectionSource>;
 
 export const ConnectionUseSelectionSource = z
@@ -190,13 +47,13 @@ export const ConnectionUseAuthoritySnapshot = z
     connectionStatus: z.literal("active"),
     providerDomain: z.string().min(1).max(2048),
     connectionKind: ConnectionKind,
-    scope: z.enum(["workspace", "user", "legacy_user"]),
+    scope: z.enum(["workspace", "user"]),
     ownerSubjectId: z.string().min(1).max(512).nullable(),
     ownerOrganizationMembershipId: z.string().uuid().nullable(),
     ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),
     authoritySource: ConnectionAuthoritySelectionSource,
     selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),
-    userDelegation: UserResourceDelegation.nullable(),
+    userDelegation: z.null(),
   })
   .strict()
   .superRefine((value, context) => {
@@ -223,39 +80,18 @@ export const ConnectionUseAuthoritySnapshot = z
         message: "only user connections retain an owner membership revision",
       });
     }
-    if (delegated !== (value.userDelegation !== null)) {
-      context.addIssue({
-        code: "custom",
-        path: ["userDelegation"],
-        message: "only user connections retain a delegation",
-      });
-    }
-    if (delegated && value.authoritySource !== "user_delegation") {
+    if (delegated && value.authoritySource !== "sender") {
       context.addIssue({
         code: "custom",
         path: ["authoritySource"],
-        message: "user connections require user_delegation provenance",
+        message: "user connections require authenticated sender provenance",
       });
     }
-    if (!delegated && value.authoritySource === "user_delegation") {
+    if (!delegated && value.authoritySource === "sender") {
       context.addIssue({
         code: "custom",
         path: ["authoritySource"],
-        message: "non-delegated connections cannot claim user delegation provenance",
-      });
-    }
-    if (value.scope === "legacy_user" && value.authoritySource !== "legacy_user_compatibility") {
-      context.addIssue({
-        code: "custom",
-        path: ["authoritySource"],
-        message: "legacy user connections require explicit compatibility provenance",
-      });
-    }
-    if (value.scope === "workspace" && value.authoritySource === "legacy_user_compatibility") {
-      context.addIssue({
-        code: "custom",
-        path: ["authoritySource"],
-        message: "workspace connections cannot claim legacy user provenance",
+        message: "workspace connections cannot claim sender provenance",
       });
     }
     if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {
@@ -265,50 +101,6 @@ export const ConnectionUseAuthoritySnapshot = z
         message: "workspace connections must be owned by the target workspace",
       });
     }
-    const delegation = value.userDelegation;
-    if (!delegation) return;
-    const exactFacts: Array<[boolean, (string | number)[], string]> = [
-      [
-        delegation.organizationId === value.organizationId,
-        ["userDelegation", "organizationId"],
-        "delegation organization mismatch",
-      ],
-      [
-        delegation.workspaceId === value.targetWorkspaceId,
-        ["userDelegation", "workspaceId"],
-        "delegation target workspace mismatch",
-      ],
-      [
-        delegation.action === ConnectionUseAction.value,
-        ["userDelegation", "action"],
-        "delegation action mismatch",
-      ],
-      [
-        delegation.context === value.targetSessionVisibility,
-        ["userDelegation", "context"],
-        "delegation visibility mismatch",
-      ],
-    ];
-    for (const [matches, path, message] of exactFacts) {
-      if (!matches) context.addIssue({ code: "custom", path, message });
-    }
-    if (delegation.sessionId !== null && delegation.sessionId !== value.targetSessionId) {
-      context.addIssue({
-        code: "custom",
-        path: ["userDelegation", "sessionId"],
-        message: "delegation session mismatch",
-      });
-    }
-    if (
-      delegation.authorityEpoch !== null &&
-      delegation.authorityEpoch !== value.targetSessionAuthorityEpoch
-    ) {
-      context.addIssue({
-        code: "custom",
-        path: ["userDelegation", "authorityEpoch"],
-        message: "delegation authority epoch mismatch",
-      });
-    }
   });
 export type ConnectionUseAuthoritySnapshot = z.infer<typeof ConnectionUseAuthoritySnapshot>;
 
@@ -370,24 +162,32 @@ function refineConnectionUseAttribution(
       });
     }
   }
-  const delegated = value.scope === "user";
-  for (const field of ["authorityId", "grantId"] as const) {
-    if (delegated !== (value[field] !== null)) {
+  const owned = value.scope === "user";
+  for (const field of ["authorityId"] as const) {
+    if (owned !== (value[field] !== null)) {
       context.addIssue({
         code: "custom",
         path: [field],
-        message: delegated
-          ? `delegated personal attribution requires ${field}`
-          : `non-delegated attribution cannot carry ${field}`,
+        message: owned
+          ? `personal attribution requires ${field}`
+          : `non-personal attribution cannot carry ${field}`,
       });
     }
   }
+  if (!owned && value.grantId !== null) {
+    context.addIssue({
+      code: "custom",
+      path: ["grantId"],
+      message: "only historical personal attribution can carry a grant",
+    });
+  }
 }
 
 /** Metadata-only attribution emitted after pre-use authorization. */
-export const ConnectionUseAttribution = ConnectionUseAttributionFields.superRefine(
-  refineConnectionUseAttribution,
-);
+export const ConnectionUseAttribution = ConnectionUseAttributionFields.extend({
+  scope: z.enum(["workspace", "user"]),
+  grantId: z.null(),
+}).superRefine(refineConnectionUseAttribution);
 export type ConnectionUseAttribution = z.infer<typeof ConnectionUseAttribution>;
 
 export const ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({

package/src/connector-tool-permissions.ts

@@ -0,0 +1,59 @@
+import { z } from "zod";
+
+export const ConnectorToolPermission = z.enum(["allow", "ask", "block"]);
+export type ConnectorToolPermission = z.infer<typeof ConnectorToolPermission>;
+
+export const ConnectorToolPermissionEntry = z.object({
+  name: z.string().min(1).max(512),
+  title: z.string().optional(),
+  description: z.string().optional(),
+  group: z.enum(["read", "write", "other"]),
+  permission: ConnectorToolPermission,
+  inherited: z.boolean(),
+  approvalRequired: z.boolean(),
+});
+export type ConnectorToolPermissionEntry = z.infer<typeof ConnectorToolPermissionEntry>;
+
+export const ConnectorToolPermissionsResponse = z.object({
+  connectionId: z.string(),
+  serverId: z.string(),
+  defaultPermission: ConnectorToolPermission.nullable(),
+  tools: z.array(ConnectorToolPermissionEntry),
+  discoveryError: z.string().nullable(),
+  canManage: z.boolean(),
+});
+export type ConnectorToolPermissionsResponse = z.infer<typeof ConnectorToolPermissionsResponse>;
+
+// Group changes name the currently displayed tools explicitly. MCP annotations
+// organize the UI only; they never grant future tools permission automatically.
+export const UpdateConnectorToolPermissionsRequest = z.discriminatedUnion("target", [
+  z
+    .object({
+      connectionId: z.string().min(1).max(512),
+      target: z.literal("default"),
+      permission: ConnectorToolPermission,
+    })
+    .strict(),
+  z
+    .object({
+      connectionId: z.string().min(1).max(512),
+      target: z.literal("tools"),
+      toolNames: z
+        .array(
+          z
+            .string()
+            .min(1)
+            .max(512)
+            .refine((name) => name !== "*" && name === name.trim(), {
+              message: "Tool names must be exact and cannot use the connector-default wildcard.",
+            }),
+        )
+        .min(1)
+        .max(2048),
+      permission: ConnectorToolPermission,
+    })
+    .strict(),
+]);
+export type UpdateConnectorToolPermissionsRequest = z.infer<
+  typeof UpdateConnectorToolPermissionsRequest
+>;

package/src/host-mcp-bindings.ts

@@ -1,10 +1,12 @@
 import { z } from "zod";
 export { HostMcpCreateSelections, type HostMcpCreateSelection } from "./index";
-import { McpServerConnectionRef, SessionTenancyVisibility, stableJson } from "./index";
 import {
-  ConnectionUseAuthoritySnapshot,
-  IssueConnectionUseGrantRequest,
-} from "./connection-authority";
+  McpServerConnectionRef,
+  SessionTenancyVisibility,
+  ManagedUserResourceGrantMode,
+  stableJson,
+} from "./index";
+import { ConnectionUseAuthoritySnapshot } from "./connection-authority";
 import { ExternalIdentity } from "./external-identities";
 export const HostMcpOwnerSubject = z.union([
   ExternalIdentity.shape.subjectId,
@@ -112,8 +114,38 @@ export const CreateHostMcpBindingRequest = z
   .strict();
 export type CreateHostMcpBindingRequest = z.infer<typeof CreateHostMcpBindingRequest>;
 
+const HostMcpGrantRequest = z
+  .object({
+    scope: z.literal("user"),
+    mode: ManagedUserResourceGrantMode,
+    context: SessionTenancyVisibility,
+    sessionId: z.string().uuid().nullable().optional(),
+    expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),
+    workspaceSharedAcknowledged: z.boolean().default(false),
+  })
+  .strict()
+  .superRefine((value, context) => {
+    if (value.context === "workspace_shared" && !value.workspaceSharedAcknowledged) {
+      context.addIssue({
+        code: "custom",
+        path: ["workspaceSharedAcknowledged"],
+        message: "workspace_shared requires durable shared-output acknowledgement",
+      });
+    }
+    if (value.mode === "always" && (value.sessionId || value.expectedAuthorityEpoch)) {
+      context.addIssue({ code: "custom", path: ["sessionId"], message: "always is unbound" });
+    }
+    if (value.mode === "session" && (!value.sessionId || !value.expectedAuthorityEpoch)) {
+      context.addIssue({
+        code: "custom",
+        path: ["sessionId"],
+        message: "session requires a target session and expectedAuthorityEpoch",
+      });
+    }
+  });
+
 /** Internal owner-authorized issuance; never itself proves caller identity. */
-const HostMcpDelegationGrant = IssueConnectionUseGrantRequest.superRefine((value, context) => {
+const HostMcpDelegationGrant = HostMcpGrantRequest.superRefine((value, context) => {
   if (
     Boolean(value.sessionId) !== (value.expectedAuthorityEpoch != null) ||
     (value.expectedAuthorityEpoch != null && !Number.isSafeInteger(value.expectedAuthorityEpoch))