@opengeni/core 0.28.1 → 1.0.0

package/src/application/session-mcp-credential-rotation.ts

@@ -0,0 +1,217 @@
+import { createHmac } from "node:crypto";
+import { RotateSessionMcpCredentialsRequest, type AccessGrant } from "@opengeni/contracts";
+import {
+  encryptVariableSetValue,
+  getWorkspaceGrant,
+  subjectHasLiveWorkspaceAuthorityInScope,
+  type Database,
+} from "@opengeni/db";
+import {
+  rotateSessionMcpCredentialsAtomically,
+  SessionMcpCredentialRotationError,
+} from "@opengeni/db/session-mcp-credential-rotation";
+import { HTTPException } from "hono/http-exception";
+import type { Settings } from "@opengeni/config";
+import {
+  requirePermission,
+  hasVerifiedOwningUserAuthorization,
+  requireResolvedAccessGrantAuthorization,
+  type AccessGrantAuthorization,
+} from "../access";
+import {
+  grantHasAgentAttemptAuthority,
+  requireSessionAuthorization,
+  SessionAuthorizationDeniedError,
+  SessionAuthorizationUnavailableError,
+  type SessionAuthorizationDependencies,
+} from "../session-authorization";
+import { requireVariableSetEncryption } from "../domain/environments";
+import { normalizedSessionMcpCredentialHeaders } from "../domain/sessions";
+import { externalContinuationCommitAuthorizer } from "./external-continuation";
+import {
+  listOwnConnectionAccountsForGrant,
+  personalConnectionDelegationSourceForGrant,
+} from "../domain/personal-connection-delegations";
+import { nativeSessionConnectionReplacement } from "../domain/session-native-connection-replacement";
+
+/** HMAC domains separate request identity from key availability. The key tag
+ * carries no request material and neither fingerprint is returned publicly. */
+export function sessionMcpRotationFingerprint(
+  key: Uint8Array,
+  scope: { accountId: string; workspaceId: string; sessionId: string; subjectId: string },
+  request: RotateSessionMcpCredentialsRequest,
+) {
+  return {
+    digestKeyTag: createHmac("sha256", key)
+      .update("opengeni:session-mcp-rotation:key:v1")
+      .digest("hex"),
+    requestDigest: createHmac("sha256", key)
+      .update("opengeni:session-mcp-rotation:request:v1\0")
+      .update(JSON.stringify({ ...scope, request }))
+      .digest("hex"),
+  };
+}
+
+function requireRotationGrant(grant: AccessGrant) {
+  if (grantHasAgentAttemptAuthority(grant))
+    throw new HTTPException(403, { message: "host authorization required" });
+  requirePermission(grant, "sessions:control");
+  requirePermission(grant, "mcp_servers:attach");
+}
+
+/** HTTP/SDK host boundary only. The mandatory callback re-resolves request
+ * authentication with the transaction handle, not a cached route-time grant. */
+export async function rotateSessionMcpCredentialsForRequest(
+  deps: SessionAuthorizationDependencies & { settings: Settings },
+  authorization: AccessGrantAuthorization,
+  sessionId: string,
+  raw: unknown,
+  reauthorize: (tx: Database) => Promise<AccessGrant>,
+) {
+  const grant = requireResolvedAccessGrantAuthorization(
+    authorization,
+    authorization.grant.workspaceId,
+  );
+  requireRotationGrant(grant);
+  const parsed = RotateSessionMcpCredentialsRequest.safeParse(raw);
+  if (!parsed.success)
+    throw new HTTPException(422, { message: "invalid credential rotation request" });
+  const encryptionKey = requireVariableSetEncryption(deps.settings);
+  let request: RotateSessionMcpCredentialsRequest;
+  try {
+    request = {
+      operationKey: parsed.data.operationKey,
+      updates: parsed.data.updates
+        .map((update) => ({
+          id: update.id,
+          expectedCredentialVersion: update.expectedCredentialVersion,
+          expectedServerUrl: update.expectedServerUrl,
+          ...("nativeConnectionId" in update
+            ? {
+                nativeConnectionId: update.nativeConnectionId,
+                ...(update.replacementServerUrl
+                  ? { replacementServerUrl: update.replacementServerUrl }
+                  : {}),
+              }
+            : {
+                headers: Object.fromEntries(
+                  Object.entries(normalizedSessionMcpCredentialHeaders(update.headers))
+                    .map(([name, value]) => [name.toLowerCase(), value] as const)
+                    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
+                ),
+              }),
+        }))
+        .sort((left, right) => (left.id < right.id ? -1 : left.id > right.id ? 1 : 0)),
+    };
+    if (new Set(request.updates.map((update) => update.id)).size !== request.updates.length)
+      throw new Error();
+  } catch {
+    // Header names and validation paths are caller-controlled secret channels.
+    throw new HTTPException(422, { message: "invalid credential rotation headers or server IDs" });
+  }
+  const scope = {
+    accountId: grant.accountId,
+    workspaceId: grant.workspaceId,
+    sessionId,
+    subjectId: grant.subjectId,
+    actorType: grant.principalKind === "service" ? ("service" as const) : ("human" as const),
+  };
+  const externalAuthorize = externalContinuationCommitAuthorizer(authorization);
+  let authorizedGrant = grant;
+  try {
+    return await rotateSessionMcpCredentialsAtomically(deps.db, {
+      ...scope,
+      operationKey: request.operationKey,
+      ...sessionMcpRotationFingerprint(encryptionKey, scope, request),
+      updates: request.updates.map((update) =>
+        "nativeConnectionId" in update
+          ? update
+          : {
+              id: update.id,
+              expectedCredentialVersion: update.expectedCredentialVersion,
+              expectedServerUrl: update.expectedServerUrl,
+              headersEncrypted: Object.fromEntries(
+                Object.entries(update.headers).map(([name, value]) => [
+                  name,
+                  encryptVariableSetValue(encryptionKey, value),
+                ]),
+              ),
+            },
+      ),
+      resolveNativeConnection: async (tx, server, nativeConnectionId, replacementServerUrl) => {
+        const connections = await listOwnConnectionAccountsForGrant(tx, authorizedGrant);
+        const source = personalConnectionDelegationSourceForGrant(authorizedGrant);
+        try {
+          return nativeSessionConnectionReplacement({
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            subjectId: source.kind === "subject" ? source.subjectId : null,
+            serverUrl: server.url,
+            ...(replacementServerUrl ? { replacementServerUrl } : {}),
+            currentRef: server.connectionRef,
+            nativeConnectionId,
+            connections,
+          });
+        } catch {
+          throw new SessionMcpCredentialRotationError("connection_unavailable");
+        }
+      },
+      authorize: async (tx) => {
+        await externalAuthorize?.(tx);
+        const fresh = await reauthorize(tx);
+        if (
+          fresh.accountId !== grant.accountId ||
+          fresh.workspaceId !== grant.workspaceId ||
+          fresh.subjectId !== grant.subjectId ||
+          fresh.principalKind !== grant.principalKind
+        )
+          throw new HTTPException(403, { message: "credential rotation authority changed" });
+        requireRotationGrant(fresh);
+        if (fresh.principalKind === "human_session" && !externalAuthorize) {
+          // Signed host grants may narrow a named human's permissions, never
+          // outlive removal or expand that human's current workspace grant.
+          const live = await getWorkspaceGrant(tx, fresh.subjectId, fresh.workspaceId);
+          if (live) {
+            requireRotationGrant(live);
+          } else if (!hasVerifiedOwningUserAuthorization(authorization)) {
+            throw new HTTPException(403, { message: "credential rotation authority changed" });
+          }
+          if (!(await subjectHasLiveWorkspaceAuthorityInScope(tx, scope))) {
+            throw new HTTPException(403, { message: "credential rotation authority changed" });
+          }
+        }
+        await requireSessionAuthorization({ ...deps, db: tx }, fresh, {
+          sessionId,
+          operation: "session.mcp.credentials.rotate",
+          surface: "http",
+        });
+        authorizedGrant = fresh;
+      },
+    });
+  } catch (error) {
+    if (error instanceof HTTPException)
+      throw new HTTPException(error.status, { message: "credential rotation access denied" });
+    if (error instanceof SessionAuthorizationDeniedError)
+      throw new HTTPException(403, { message: "credential rotation access denied" });
+    if (error instanceof SessionAuthorizationUnavailableError)
+      throw new HTTPException(503, { message: "credential rotation authorization unavailable" });
+    if (error instanceof SessionMcpCredentialRotationError) {
+      const status =
+        error.code === "receipt_key_unavailable"
+          ? 503
+          : error.code === "authority_revoked"
+            ? 403
+            : error.code === "not_found"
+              ? 404
+              : error.code === "invalid_request" ||
+                  error.code === "brokered_server" ||
+                  error.code === "connection_unavailable"
+                ? 422
+                : 409;
+      throw new HTTPException(status, { message: `credential_rotation_${error.code}` });
+    }
+    // Drizzle failures can include query parameters. Never attach their cause,
+    // ciphertext, fingerprints, header names, or raw input to API telemetry.
+    throw new HTTPException(503, { message: "credential rotation unavailable" });
+  }
+}

package/src/application/session-tenancy.ts

@@ -0,0 +1,445 @@
+import {
+  ForkSessionResponse,
+  SessionTenancyCreateCapabilities,
+  UpdateSessionVisibilityResponse,
+  sessionVisibilityFromPublic,
+  sessionVisibilityToPublic,
+  type ForkSessionRequest,
+  type SessionAuthorizationSurface,
+  type UpdateSessionVisibilityRequest,
+  type VariableSet,
+} from "@opengeni/contracts";
+import {
+  assertSessionIsNotImported,
+  forkSessionContent,
+  getSessionForSubject,
+  getRig,
+  getPrivateSessionCreatePolicy,
+  getSessionEventForSubject,
+  isRetryableDatabaseTransportFailure,
+  nestedPostgresSqlState,
+  replayAppliedSessionFork,
+  sessionTenancyProductActivated,
+  SessionTenancyAccessError,
+  SessionTenancyInvalidRequestError,
+  SessionTenancyNotActivatedError,
+  transitionSessionVisibility,
+  type Database,
+  type ForkSessionContentResult,
+} from "@opengeni/db";
+import { publishDurableSessionEvents, type EventBus } from "@opengeni/events";
+import {
+  requirePermission,
+  hasVerifiedOwningUserAuthorization,
+  type AccessGrantAuthorization,
+} from "../access";
+import { requireSessionAuthorization } from "../session-authorization";
+import type { AppDependencies } from "../dependencies";
+import { validateVariableSetAttachment } from "../domain/environments";
+import { externalContinuationCommitAuthorizer } from "./external-continuation";
+
+type SessionTenancyDependencies = Pick<
+  AppDependencies,
+  "db" | "bus" | "sessionAuthorization" | "settings"
+>;
+
+export class SessionTenancyManagedHumanRequiredError extends Error {
+  readonly name = "SessionTenancyManagedHumanRequiredError";
+  constructor() {
+    super("Session tenancy mutations require the owning managed-human session");
+  }
+}
+
+export class SessionTenancyPersistenceOutcomeUnknownError extends Error {
+  readonly name = "SessionTenancyPersistenceOutcomeUnknownError";
+  constructor(options?: ErrorOptions) {
+    super("The session tenancy mutation outcome is unknown", options);
+  }
+}
+
+export function requireCanonicalManagedHuman(
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+): void {
+  if (
+    !authorization.canonicalManagedHumanSession ||
+    !authorization.contextIntegrity ||
+    authorization.authenticatedSubjectId !== authorization.grant.subjectId ||
+    authorization.grant.workspaceId !== workspaceId
+  ) {
+    throw new SessionTenancyManagedHumanRequiredError();
+  }
+}
+
+export function requireVerifiedOwningUser(
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+): void {
+  if (
+    !hasVerifiedOwningUserAuthorization(authorization) ||
+    authorization.grant.workspaceId !== workspaceId
+  ) {
+    throw new SessionTenancyManagedHumanRequiredError();
+  }
+}
+
+export async function getManagedHumanSessionCreateCapabilities(
+  deps: Pick<SessionTenancyDependencies, "db">,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+): Promise<SessionTenancyCreateCapabilities> {
+  requirePermission(authorization.grant, "sessions:create");
+  try {
+    requireVerifiedOwningUser(authorization, workspaceId);
+  } catch (error) {
+    if (error instanceof SessionTenancyManagedHumanRequiredError) {
+      return SessionTenancyCreateCapabilities.parse({
+        activated: false,
+        canCreatePrivate: false,
+        reason: "managed_session_required",
+      });
+    }
+    throw error;
+  }
+  // Mirror the database create fence exactly: a managed human's own Personal
+  // workspace needs only the operator readiness receipt, while a shared
+  // organization workspace additionally needs the owner/admin product setting.
+  let activated = false;
+  try {
+    const policy = await getPrivateSessionCreatePolicy(deps.db, {
+      workspaceId,
+      actorSubjectId: authorization.grant.subjectId,
+    });
+    activated = policy.personalWorkspace ? policy.platformAvailable : policy.organizationEnabled;
+  } catch (error) {
+    // A canonical managed human without an active organization membership or
+    // stated workspace authority (legacy managed access) is simply not
+    // private-ready; the definer's 42501 is a capability answer here, not a
+    // failure. Every other error still propagates.
+    if (
+      !(error instanceof SessionTenancyAccessError) &&
+      nestedPostgresSqlState(error) !== "42501"
+    ) {
+      throw error;
+    }
+  }
+  return SessionTenancyCreateCapabilities.parse({
+    activated,
+    canCreatePrivate: activated,
+    reason: activated ? "available" : "not_activated",
+  });
+}
+
+export async function requireManagedHumanPrivateSessionCreate(
+  deps: Pick<SessionTenancyDependencies, "db">,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+): Promise<void> {
+  // Target-free readiness preflight only. The owner/admin organization setting
+  // is enforced by the create transaction itself (under the organization
+  // fence, after keyed replay resolution), so a committed keyed success still
+  // replays after the setting is disabled while a fresh key fails closed.
+  await requireSessionTenancyMutationGate(deps, authorization, workspaceId, ["sessions:create"]);
+}
+
+async function requireSessionTenancyMutationGate(
+  deps: Pick<SessionTenancyDependencies, "db">,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+  permissions: ReadonlyArray<"sessions:read" | "sessions:create" | "sessions:control">,
+): Promise<void> {
+  // These checks are deliberately target-free. A rejected principal must not
+  // cause a session lookup or embedding-host callback that distinguishes a
+  // missing, shared, or another owner's private session.
+  requireVerifiedOwningUser(authorization, workspaceId);
+  for (const permission of permissions) requirePermission(authorization.grant, permission);
+  if (!(await sessionTenancyProductActivated(deps.db, workspaceId))) {
+    throw new SessionTenancyNotActivatedError();
+  }
+}
+
+async function publishExactCommittedEvent(
+  deps: { db: Database; bus: EventBus },
+  input: {
+    workspaceId: string;
+    sessionId: string;
+    subjectId: string;
+    eventId: string | null;
+    eventSequence: number | null;
+  },
+): Promise<void> {
+  if (input.eventId === null && input.eventSequence === null) return;
+  if (input.eventId === null || input.eventSequence === null) {
+    console.error("[session-tenancy] committed event receipt is incomplete", {
+      errorClass: "SessionTenancyEventInvariantError",
+      errorCode: "session_tenancy_event_receipt_incomplete",
+      origin: "core",
+      sessionId: input.sessionId,
+    });
+    return;
+  }
+  try {
+    const event = await getSessionEventForSubject(
+      deps.db,
+      input.workspaceId,
+      input.subjectId,
+      input.eventId,
+    );
+    if (!event || event.sessionId !== input.sessionId || event.sequence !== input.eventSequence) {
+      console.error("[session-tenancy] committed event receipt did not resolve exactly", {
+        errorClass: "SessionTenancyEventInvariantError",
+        errorCode: "session_tenancy_event_receipt_mismatch",
+        origin: "core",
+        sessionId: input.sessionId,
+      });
+      return;
+    }
+    await publishDurableSessionEvents(deps.bus, input.workspaceId, input.sessionId, [event]);
+  } catch {
+    // The mutation and event committed atomically before this read. Live fanout
+    // is repairable from the durable stream, so a publication-side failure must
+    // not turn a known successful mutation into an unknown client outcome.
+    console.warn("[session-tenancy] committed event live publication was deferred to replay", {
+      errorClass: "SessionTenancyEventPublishOperationError",
+      errorCode: "session_tenancy_event_publish_deferred",
+      origin: "core",
+      sessionId: input.sessionId,
+    });
+  }
+}
+
+async function runTenancyMutation<T>(operation: () => Promise<T>): Promise<T> {
+  try {
+    return await operation();
+  } catch (error) {
+    if (isRetryableDatabaseTransportFailure(error)) {
+      throw new SessionTenancyPersistenceOutcomeUnknownError({ cause: error });
+    }
+    throw error;
+  }
+}
+
+async function projectAndPublishSessionFork(
+  deps: SessionTenancyDependencies,
+  actorSubjectId: string,
+  result: ForkSessionContentResult,
+): Promise<ForkSessionResponse> {
+  const response = ForkSessionResponse.parse({
+    operationId: result.operationId,
+    eventId: result.eventId,
+    eventSequence: result.eventSequence,
+    sessionId: result.sessionId,
+    workspaceId: result.workspaceId,
+    visibility: sessionVisibilityToPublic(result.visibility),
+    authorityEpoch: result.authorityEpoch,
+    copiedHistoryItemCount: result.copiedHistoryItemCount,
+    replay: result.replay,
+  });
+  await publishExactCommittedEvent(deps, {
+    workspaceId: response.workspaceId,
+    sessionId: response.sessionId,
+    subjectId: actorSubjectId,
+    eventId: response.eventId,
+    eventSequence: response.eventSequence,
+  });
+  return response;
+}
+
+export async function updateManagedHumanSessionVisibility(
+  deps: SessionTenancyDependencies,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+  sessionId: string,
+  request: UpdateSessionVisibilityRequest,
+  authorizationSurface: SessionAuthorizationSurface = "core",
+): Promise<UpdateSessionVisibilityResponse> {
+  const beforeCommit = externalContinuationCommitAuthorizer(authorization);
+  await requireSessionTenancyMutationGate(deps, authorization, workspaceId, ["sessions:control"]);
+  await requireSessionAuthorization(deps, authorization.grant, {
+    sessionId,
+    operation: "session.visibility.write",
+    surface: authorizationSurface,
+  });
+
+  const result = await runTenancyMutation(
+    async () =>
+      await transitionSessionVisibility(deps.db, {
+        workspaceId,
+        sessionId,
+        actorSubjectId: authorization.grant.subjectId,
+        targetVisibility: sessionVisibilityFromPublic(request.visibility),
+        expectedAuthorityEpoch: request.expectedAuthorityEpoch,
+        operationKey: request.idempotencyKey,
+        ...(beforeCommit ? { beforeCommit } : {}),
+      }),
+  );
+  const response = UpdateSessionVisibilityResponse.parse({
+    operationId: result.operationId,
+    eventId: result.eventId,
+    eventSequence: result.eventSequence,
+    visibility: sessionVisibilityToPublic(result.visibility),
+    authorityEpoch: result.authorityEpoch,
+    changed: result.changed,
+    replay: result.replay,
+    revokedGrantCount: result.revokedGrantCount,
+  });
+  await publishExactCommittedEvent(deps, {
+    workspaceId,
+    sessionId,
+    subjectId: authorization.grant.subjectId,
+    eventId: response.eventId,
+    eventSequence: response.eventSequence,
+  });
+  return response;
+}
+
+export async function forkManagedHumanSession(
+  deps: SessionTenancyDependencies,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+  sourceSessionId: string,
+  request: ForkSessionRequest,
+  authorizationSurface: SessionAuthorizationSurface = "core",
+): Promise<ForkSessionResponse> {
+  await requireSessionTenancyMutationGate(deps, authorization, workspaceId, [
+    "sessions:read",
+    "sessions:create",
+  ]);
+  const beforeCommit = externalContinuationCommitAuthorizer(authorization);
+  const forkInput = {
+    sourceWorkspaceId: workspaceId,
+    sourceSessionId,
+    ...(request.sourceEventId ? { sourceEventId: request.sourceEventId } : {}),
+    actorSubjectId: authorization.grant.subjectId,
+    destinationWorkspaceId: workspaceId,
+    destinationVisibility:
+      request.visibility === "private" ? ("user_private" as const) : ("workspace_shared" as const),
+    workspaceSharedAcknowledged: request.workspaceSharedAcknowledged,
+    operationKey: request.idempotencyKey,
+    ...(beforeCommit ? { beforeCommit } : {}),
+    ...(request.rigId !== undefined || request.variableSetIds !== undefined
+      ? {
+          runtimeRequest: {
+            rigId: request.rigId ?? null,
+            variableSetIds: request.variableSetIds ?? [],
+          },
+        }
+      : {}),
+  };
+  const recoverAppliedReceipt = async () =>
+    await runTenancyMutation(async () => await replayAppliedSessionFork(deps.db, forkInput));
+  const runtimeSetupRequested = request.rigId !== undefined || request.variableSetIds !== undefined;
+  let runtimeConfigurationPromise: Promise<{
+    variableSetIds: string[];
+    rigId: string | null;
+    rigVersionId: string | null;
+  }> | null = null;
+  const resolveRuntimeConfiguration = async () => {
+    if (runtimeConfigurationPromise) return await runtimeConfigurationPromise;
+    runtimeConfigurationPromise = (async () => {
+      const variableSets: VariableSet[] = [];
+      for (const variableSetId of request.variableSetIds ?? []) {
+        variableSets.push(
+          await validateVariableSetAttachment(
+            { settings: deps.settings, db: deps.db },
+            authorization.grant,
+            workspaceId,
+            variableSetId,
+          ),
+        );
+      }
+      let rigVersionId: string | null = null;
+      if (request.rigId) {
+        requirePermission(authorization.grant, "rigs:use");
+        const rig = await getRig(deps.db, authorization.grant, request.rigId);
+        if (!rig?.activeVersion) {
+          throw new SessionTenancyInvalidRequestError();
+        }
+        for (const defaultVariableSetId of new Set(rig.activeVersion.defaultVariableSetIds)) {
+          await validateVariableSetAttachment(
+            { settings: deps.settings, db: deps.db },
+            authorization.grant,
+            workspaceId,
+            defaultVariableSetId,
+          );
+        }
+        rigVersionId = rig.activeVersion.id;
+      }
+      return {
+        variableSetIds: variableSets.map((variableSet) => variableSet.id),
+        rigId: request.rigId ?? null,
+        rigVersionId,
+      };
+    })();
+    return await runtimeConfigurationPromise;
+  };
+  const publishRuntimeConfiguration = async (result: ForkSessionContentResult) => {
+    if (!result.runtimeEventId || !result.runtimeEventSequence) return;
+    await publishExactCommittedEvent(deps, {
+      workspaceId,
+      sessionId: result.sessionId,
+      subjectId: authorization.grant.subjectId,
+      eventId: result.runtimeEventId,
+      eventSequence: result.runtimeEventSequence,
+    });
+  };
+
+  // A committed response is owned by the exact actor/key/request tuple and no
+  // longer depends on mutable source visibility. Resolve it before source/host
+  // authorization so a lost response remains recoverable after the source
+  // owner makes a formerly shared session private.
+  const applied = await recoverAppliedReceipt();
+  if (applied) {
+    const response = await projectAndPublishSessionFork(
+      deps,
+      authorization.grant.subjectId,
+      applied,
+    );
+    await publishRuntimeConfiguration(applied);
+    return response;
+  }
+
+  try {
+    await requireSessionAuthorization(deps, authorization.grant, {
+      sessionId: sourceSessionId,
+      operation: "session.fork.create",
+      surface: authorizationSurface,
+    });
+  } catch (authorizationError) {
+    // Close the race where a duplicate request checked before the first commit
+    // but mutable source/host authority changed immediately after it. Only an
+    // exact applied receipt can convert the authorization failure into replay.
+    const racedApplied = await recoverAppliedReceipt();
+    if (racedApplied) {
+      const response = await projectAndPublishSessionFork(
+        deps,
+        authorization.grant.subjectId,
+        racedApplied,
+      );
+      await publishRuntimeConfiguration(racedApplied);
+      return response;
+    }
+    throw authorizationError;
+  }
+
+  // Validate all requested runtime resources before committing the independent
+  // fork so ordinary authorization failures cannot leave an unusable copy.
+  const source = await getSessionForSubject(
+    deps.db,
+    workspaceId,
+    sourceSessionId,
+    authorization.grant.subjectId,
+  );
+  if (source) assertSessionIsNotImported(source);
+  const runtimeConfiguration = runtimeSetupRequested ? await resolveRuntimeConfiguration() : null;
+  const result = await runTenancyMutation(
+    async () =>
+      await forkSessionContent(deps.db, {
+        ...forkInput,
+        ...(runtimeConfiguration ? { runtimeConfiguration } : {}),
+      }),
+  );
+  const response = await projectAndPublishSessionFork(deps, authorization.grant.subjectId, result);
+  await publishRuntimeConfiguration(result);
+  return response;
+}