@opengeni/core 0.14.4 → 0.15.1

package/dist/access/index.d.ts

@@ -1,4 +1,4 @@
-import type { Settings } from "@opengeni/config";
+import { type Settings } from "@opengeni/config";
 import { type AccountGrant, type AccessContext, type AccessGrant, type Permission } from "@opengeni/contracts";
 import { type Database } from "@opengeni/db";
 import type { Context } from "hono";

package/dist/index.js

@@ -757,6 +757,7 @@ async function provisionSandbox(services, ctx, input) {
 }
 
 // src/access/index.ts
+import { resolveFirstPartyDelegationSecret } from "@opengeni/config";
 import {
   verifyDelegatedAccessToken
 } from "@opengeni/contracts";
@@ -837,7 +838,9 @@ function requirePermission(grant, permission) {
         message: "missing permission: variable-sets:manage (deprecated alias: environments:manage)"
       });
     }
-    throw new HTTPException2(403, { message: `missing permission: ${permission}` });
+    throw new HTTPException2(403, {
+      message: `missing permission: ${permission}`
+    });
   }
 }
 function hasPermission(permissions, permission) {
@@ -899,7 +902,9 @@ async function resolveAccessContext(c, deps) {
     }
   }
   if (deps.managedAuth) {
-    const session = await deps.managedAuth.api.getSession({ headers: c.req.raw.headers });
+    const session = await deps.managedAuth.api.getSession({
+      headers: c.req.raw.headers
+    });
     if (session?.user) {
       return await ensureManagedAccessForUser(deps.db, {
         userId: session.user.id,
@@ -950,10 +955,11 @@ async function apiKeyAccessContext(c, deps, mode) {
   };
 }
 async function delegatedAccessContext(c, deps, mode, token = bearerToken(c)) {
-  if (!token || !deps.settings.delegationSecret) {
+  const delegationSecret = resolveFirstPartyDelegationSecret(deps.settings);
+  if (!token || !delegationSecret) {
     return null;
   }
-  const payload = await verifyDelegatedAccessToken(deps.settings.delegationSecret, token);
+  const payload = await verifyDelegatedAccessToken(delegationSecret, token);
   if (!payload) {
     return null;
   }
@@ -1019,7 +1025,8 @@ import {
 import {
   getSession,
   getSessionRootId,
-  getSessionTurnForAttempt
+  getSessionTurnForAttempt,
+  getSlackInteractionSessionAccessForSession
 } from "@opengeni/db";
 var SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS = 15e3;
 var SessionAuthorizationDeniedError = class extends Error {
@@ -1039,11 +1046,19 @@ var SessionAuthorizationUnavailableError = class extends Error {
 };
 async function requireSessionAuthorization(deps, grant, input) {
   const port = deps.sessionAuthorization;
+  const slackAccess = await getSlackInteractionSessionAccessForSession(deps.db, {
+    accountId: grant.accountId,
+    workspaceId: grant.workspaceId,
+    sessionId: input.sessionId
+  });
+  if (!port && slackAccess?.visibility !== "private") return null;
+  const actor = await resolveSessionAuthorizationActor(deps.db, grant);
+  const target = slackAccess ? { sessionId: input.sessionId, rootSessionId: slackAccess.rootSessionId } : await resolveSessionAuthorizationTarget(deps.db, grant, input.sessionId);
+  if (slackAccess?.visibility === "private") {
+    const allowed = actor.kind === "subject" ? actor.subjectId === slackAccess.owningSubjectId : actor.callerRootSessionId === target.rootSessionId;
+    if (!allowed) throw new SessionAuthorizationDeniedError("forbidden");
+  }
   if (!port) return null;
-  const [actor, target] = await Promise.all([
-    resolveSessionAuthorizationActor(deps.db, grant),
-    resolveSessionAuthorizationTarget(deps.db, grant, input.sessionId)
-  ]);
   let rawDecision;
   try {
     rawDecision = await port.authorizeSession({