@opengeni/core 0.28.0 → 1.0.0

package/src/domain/resources.ts

@@ -14,10 +14,18 @@ import {
   ResourceRefConflictError,
   ResourceMountPathError,
   stableJson,
+  type RepositoryResourceRef,
   type ResourceRef,
   type ToolRef,
+  type WorkspaceSessionToolDefaults,
 } from "@opengeni/contracts";
-import { areGitHubRepositoriesAllowedForWorkspace, requireFile, type Database } from "@opengeni/db";
+import {
+  areGitHubRepositoriesAllowedForWorkspace,
+  requireFileForSubject,
+  withSessionRlsActorContext,
+  type SessionRlsActorContext,
+  type Database,
+} from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
 
 export function validateToolRefs(tools: ToolRef[], settings: McpSettings): ToolRef[] {
@@ -36,17 +44,21 @@ export function validateToolRefs(tools: ToolRef[], settings: McpSettings): ToolR
       }
       throw new HTTPException(422, { message: `unknown MCP server id: ${tool.id}` });
     }
-    // Tool refs are tri-state for pack portability across deployments:
+
     //  - bare / optional:false is STRICT: the id must be configured here and
-    //    runtime connection failure fails the turn.
+    //    runtime connection failure fails closed when preparation is demanded.
+    //    Only an independent eager:true marker makes that a startup barrier.
     //  - optional:true + known id is preserved: runtime treats it like an
     //    auto-attached capability MCP and skips connect/list failures.
     //  - optional:true + unknown id is skipped above: the client explicitly
     //    opted into graceful degradation for MCPs (for example docs servers
     //    like context7) that only some deployments configure.
-    out.push(
-      optional ? { kind: "mcp", id: tool.id, optional: true } : { kind: "mcp", id: tool.id },
-    );
+    out.push({
+      kind: "mcp",
+      id: tool.id,
+      ...(optional ? { optional: true } : {}),
+      ...(tool.eager === true ? { eager: true } : {}),
+    });
   }
   return mergeToolRefs([], out);
 }
@@ -77,6 +89,38 @@ export function withDefaultEnabledCapabilityMcpTools(
   return mergeToolRefs(tools, enabledCapabilityMcpToolRefs(settings, runtimeSettings));
 }
 
+/**
+ * Apply the workspace's exact new-session MCP defaults when configured.
+ * Stale or currently unavailable ids are optional and disappear from the
+ * executable selection without making every new session fail during a rolling
+ * connector change. An absent workspace override preserves the legacy
+ * deployment + enabled-capability default.
+ */
+export function withWorkspaceDefaultMcpTools(
+  tools: ToolRef[],
+  settings: McpSettings,
+  runtimeSettings: McpSettings,
+  defaults: WorkspaceSessionToolDefaults | null,
+): ToolRef[] {
+  if (!defaults?.mcpServerIds) {
+    return withDefaultEnabledCapabilityMcpTools(tools, settings, runtimeSettings);
+  }
+  return mergeToolRefs(
+    tools,
+    validateToolRefs(
+      [
+        ...defaults.mcpServerIds,
+        ...(defaults.inheritConnectedMcpServers
+          ? runtimeSettings.mcpServers
+              .filter((server) => !["opengeni", "files", "docs"].includes(server.id))
+              .map((server) => server.id)
+          : []),
+      ].map((id) => ({ kind: "mcp" as const, id, optional: true as const })),
+      runtimeSettings,
+    ),
+  );
+}
+
 /** Drop stored refs that are no longer present in the current runtime registry. */
 export function availableToolRefs(tools: ToolRef[], settings: McpSettings): ToolRef[] {
   const available = new Set(settings.mcpServers.map((server) => server.id));
@@ -161,6 +205,7 @@ export function normalizeResources(resources: ResourceRef[]): ResourceRef[] {
         mountPath,
         ...(resource.subpath ? { subpath: normalizeRepositorySubpath(resource.subpath) } : {}),
         ...(resource.provider ? { provider: resource.provider } : {}),
+        ...(resource.connectionType ? { connectionType: resource.connectionType } : {}),
         ...(resource.credentialBindingId
           ? { credentialBindingId: resource.credentialBindingId }
           : {}),
@@ -175,6 +220,7 @@ export function normalizeResources(resources: ResourceRef[]): ResourceRef[] {
           ? { githubInstallationId: resource.githubInstallationId }
           : {}),
         ...(resource.githubRepositoryId ? { githubRepositoryId: resource.githubRepositoryId } : {}),
+        ...(resource.optional === true ? { optional: true } : {}),
       };
     }
     const key = stableJson(normalized);
@@ -228,6 +274,97 @@ export function validateGitHubRepositorySelectionShapes(resources: ResourceRef[]
   return [...new Set(selected.map((item) => item.installationId))];
 }
 
+export type PersonalGitHubRepositoryResource = RepositoryResourceRef & {
+  provider: "github";
+  connectionType: "github_personal";
+  credentialBindingId: string;
+  access: "read" | "write";
+  repositoryId: string;
+};
+
+const PERSONAL_GITHUB_BINDING_ID_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
+
+function isPersonalGitHubRepositoryCandidate(
+  resource: ResourceRef,
+): resource is RepositoryResourceRef & { provider: "github"; credentialBindingId: string } {
+  if (resource.kind !== "repository" || resource.connectionType !== "github_personal") {
+    return false;
+  }
+  return resource.provider === "github" && resource.credentialBindingId !== undefined;
+}
+
+/**
+ * Validate and return the dedicated personal-GitHub repository resource lane.
+ * A host-opaque binding is only a selector for the server-side authority
+ * snapshot; it never authorizes a repository on its own.
+ */
+export function personalGitHubRepositoryResources(
+  resources: ResourceRef[],
+): PersonalGitHubRepositoryResource[] {
+  const selected: PersonalGitHubRepositoryResource[] = [];
+  for (const resource of resources) {
+    if (!isPersonalGitHubRepositoryCandidate(resource)) {
+      if (resource.kind === "repository" && resource.connectionType === "github_personal") {
+        throw new HTTPException(422, {
+          message: "personal GitHub repository resources require the dedicated GitHub provider",
+        });
+      }
+      continue;
+    }
+    if (
+      !PERSONAL_GITHUB_BINDING_ID_PATTERN.test(resource.credentialBindingId) ||
+      typeof resource.repositoryId !== "string" ||
+      !/^[1-9]\d*$/u.test(resource.repositoryId) ||
+      (resource.access !== "read" && resource.access !== "write") ||
+      resource.installationId !== undefined ||
+      resource.githubInstallationId !== undefined ||
+      resource.githubRepositoryId !== undefined ||
+      resource.connectionId !== undefined ||
+      resource.projectId !== undefined
+    ) {
+      throw new HTTPException(422, {
+        message:
+          "personal GitHub repository resources require one opaque binding, provider repository id, and explicit read or write access",
+      });
+    }
+    let uri: URL;
+    try {
+      uri = new URL(resource.uri);
+    } catch {
+      throw new HTTPException(422, { message: "personal GitHub repository URI is invalid" });
+    }
+    if (
+      uri.protocol !== "https:" ||
+      uri.hostname !== "github.com" ||
+      uri.port !== "" ||
+      uri.username !== "" ||
+      uri.password !== "" ||
+      uri.search !== "" ||
+      uri.hash !== "" ||
+      uri.pathname.endsWith(".git") ||
+      uri.pathname.split("/").filter(Boolean).length !== 2 ||
+      resource.uri !== `${uri.origin}${uri.pathname.replace(/\/$/u, "")}`
+    ) {
+      throw new HTTPException(422, {
+        message: "personal GitHub repository resources require a canonical GitHub HTTPS URI",
+      });
+    }
+    selected.push(resource as PersonalGitHubRepositoryResource);
+  }
+  const identities = new Set<string>();
+  for (const resource of selected) {
+    const key = `${resource.credentialBindingId}\0${resource.repositoryId}`;
+    if (identities.has(key)) {
+      throw new HTTPException(422, {
+        message: "personal GitHub repository resources must not contain duplicates",
+      });
+    }
+    identities.add(key);
+  }
+  return selected;
+}
+
 /** @deprecated Use validateGitHubRepositorySelectionShapes for multi-installation sessions. */
 export function validateGitHubRepositorySelectionShape(resources: ResourceRef[]): number | null {
   const installationIds = validateGitHubRepositorySelectionShapes(resources);
@@ -246,6 +383,9 @@ function gitHubRepositorySelections(
     if (resource.kind !== "repository") {
       return [];
     }
+    if (isPersonalGitHubRepositoryCandidate(resource)) {
+      return [];
+    }
     const installationRaw =
       resource.githubInstallationId ??
       (resource.provider === "github" ? resource.installationId : undefined);
@@ -275,6 +415,7 @@ export async function validateGitHubRepositorySelection(
   workspaceId: string,
   resources: ResourceRef[],
 ): Promise<void> {
+  personalGitHubRepositoryResources(resources);
   const installationIds = validateGitHubRepositorySelectionShapes(resources);
   if (installationIds.length === 0) {
     return;
@@ -311,28 +452,44 @@ export function isAuthoritativeGitHubRepositorySelectionError(error: unknown): b
 
 export async function validateFileResources(
   db: Database,
+  accountId: string,
   workspaceId: string,
+  subjectId: string | null,
   resources: ResourceRef[],
+  privateFileContext?: SessionRlsActorContext,
 ): Promise<void> {
-  const fileIds = new Set<string>();
-  for (const resource of resources) {
-    if (resource.kind !== "file") {
-      continue;
-    }
-    if (fileIds.has(resource.fileId)) {
-      throw new HTTPException(422, { message: `duplicate file resource: ${resource.fileId}` });
-    }
-    fileIds.add(resource.fileId);
-    const file = await requireFile(db, workspaceId, resource.fileId).catch(() => null);
-    if (!file) {
-      throw new HTTPException(422, { message: `unknown file resource: ${resource.fileId}` });
-    }
-    if (file.status !== "ready") {
-      throw new HTTPException(422, {
-        message: `file resource ${resource.fileId} is ${file.status}`,
-      });
-    }
-  }
+  return withSessionRlsActorContext(
+    privateFileContext ?? {
+      subjectId: subjectId ?? "service:file-resource-validation",
+      privateFileOwnerSubjectId: null,
+    },
+    async () => {
+      const fileIds = new Set<string>();
+      for (const resource of resources) {
+        if (resource.kind !== "file") {
+          continue;
+        }
+        if (fileIds.has(resource.fileId)) {
+          throw new HTTPException(422, { message: `duplicate file resource: ${resource.fileId}` });
+        }
+        fileIds.add(resource.fileId);
+        const file = await requireFileForSubject(db, {
+          accountId,
+          workspaceId,
+          subjectId: privateFileContext?.initiatingHumanSubjectId ?? subjectId,
+          fileId: resource.fileId,
+        }).catch(() => null);
+        if (!file) {
+          throw new HTTPException(422, { message: `unknown file resource: ${resource.fileId}` });
+        }
+        if (file.status !== "ready") {
+          throw new HTTPException(422, {
+            message: `file resource ${resource.fileId} is ${file.status}`,
+          });
+        }
+      }
+    },
+  );
 }
 
 function normalizeMountPath(path: string): string {