@opengeni/core 0.14.4 → 0.16.1

package/dist/access/index.d.ts

@@ -1,4 +1,4 @@
-import type { Settings } from "@opengeni/config";
+import { type Settings } from "@opengeni/config";
 import { type AccountGrant, type AccessContext, type AccessGrant, type Permission } from "@opengeni/contracts";
 import { type Database } from "@opengeni/db";
 import type { Context } from "hono";

package/dist/index.js

@@ -757,6 +757,7 @@ async function provisionSandbox(services, ctx, input) {
 }
 
 // src/access/index.ts
+import { resolveFirstPartyDelegationSecret } from "@opengeni/config";
 import {
   verifyDelegatedAccessToken
 } from "@opengeni/contracts";
@@ -837,7 +838,9 @@ function requirePermission(grant, permission) {
         message: "missing permission: variable-sets:manage (deprecated alias: environments:manage)"
       });
     }
-    throw new HTTPException2(403, { message: `missing permission: ${permission}` });
+    throw new HTTPException2(403, {
+      message: `missing permission: ${permission}`
+    });
   }
 }
 function hasPermission(permissions, permission) {
@@ -899,7 +902,9 @@ async function resolveAccessContext(c, deps) {
     }
   }
   if (deps.managedAuth) {
-    const session = await deps.managedAuth.api.getSession({ headers: c.req.raw.headers });
+    const session = await deps.managedAuth.api.getSession({
+      headers: c.req.raw.headers
+    });
     if (session?.user) {
       return await ensureManagedAccessForUser(deps.db, {
         userId: session.user.id,
@@ -950,10 +955,11 @@ async function apiKeyAccessContext(c, deps, mode) {
   };
 }
 async function delegatedAccessContext(c, deps, mode, token = bearerToken(c)) {
-  if (!token || !deps.settings.delegationSecret) {
+  const delegationSecret = resolveFirstPartyDelegationSecret(deps.settings);
+  if (!token || !delegationSecret) {
     return null;
   }
-  const payload = await verifyDelegatedAccessToken(deps.settings.delegationSecret, token);
+  const payload = await verifyDelegatedAccessToken(delegationSecret, token);
   if (!payload) {
     return null;
   }
@@ -1019,7 +1025,8 @@ import {
 import {
   getSession,
   getSessionRootId,
-  getSessionTurnForAttempt
+  getSessionTurnForAttempt,
+  getSlackInteractionSessionAccessForSession
 } from "@opengeni/db";
 var SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS = 15e3;
 var SessionAuthorizationDeniedError = class extends Error {
@@ -1039,11 +1046,19 @@ var SessionAuthorizationUnavailableError = class extends Error {
 };
 async function requireSessionAuthorization(deps, grant, input) {
   const port = deps.sessionAuthorization;
+  const slackAccess = await getSlackInteractionSessionAccessForSession(deps.db, {
+    accountId: grant.accountId,
+    workspaceId: grant.workspaceId,
+    sessionId: input.sessionId
+  });
+  if (!port && slackAccess?.visibility !== "private") return null;
+  const actor = await resolveSessionAuthorizationActor(deps.db, grant);
+  const target = slackAccess ? { sessionId: input.sessionId, rootSessionId: slackAccess.rootSessionId } : await resolveSessionAuthorizationTarget(deps.db, grant, input.sessionId);
+  if (slackAccess?.visibility === "private") {
+    const allowed = actor.kind === "subject" ? actor.subjectId === slackAccess.owningSubjectId : actor.callerRootSessionId === target.rootSessionId;
+    if (!allowed) throw new SessionAuthorizationDeniedError("forbidden");
+  }
   if (!port) return null;
-  const [actor, target] = await Promise.all([
-    resolveSessionAuthorizationActor(deps.db, grant),
-    resolveSessionAuthorizationTarget(deps.db, grant, input.sessionId)
-  ]);
   let rawDecision;
   try {
     rawDecision = await port.authorizeSession({
@@ -1497,10 +1512,26 @@ var marketingSocialPack = {
       category: "social-media",
       authModel: "oauth2_authorization_code_pkce",
       providers: ["x"],
-      scopes: ["tweet.read", "users.read", "offline.access"],
+      scopes: ["tweet.read", "tweet.write", "users.read", "offline.access"],
+      required: false,
+      metadata: {
+        docs: "https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code",
+        firstParty: true,
+        oauthStartPath: "/social/oauth/start"
+      }
+    },
+    {
+      id: "reddit",
+      name: "Reddit",
+      category: "social-media",
+      authModel: "oauth2_authorization_code",
+      providers: ["reddit"],
+      scopes: ["identity", "read", "submit", "privatemessages", "history"],
       required: false,
       metadata: {
-        docs: "https://docs.x.com/fundamentals/authentication/oauth-2-0/authorization-code"
+        docs: "https://github.com/reddit-archive/reddit/wiki/OAuth2",
+        firstParty: true,
+        oauthStartPath: "/social/oauth/start"
       }
     },
     {
@@ -1589,7 +1620,12 @@ var marketingSocialPack = {
     firstPartyMcpTools: [
       "social_connections_list",
       "social_posts_recent",
-      "social_daily_analysis_context"
+      "social_daily_analysis_context",
+      "social_search_live",
+      "social_mentions_live",
+      "social_thread_fetch",
+      "social_posts_sync",
+      "social_post_reply"
     ]
   }
 };