@opengeni/core 0.28.1 → 2.1.0-canary.0

package/src/domain/resources.ts

@@ -14,10 +14,16 @@ import {
   ResourceRefConflictError,
   ResourceMountPathError,
   stableJson,
+  type RepositoryResourceRef,
   type ResourceRef,
   type ToolRef,
+  type WorkspaceSessionToolDefaults,
 } from "@opengeni/contracts";
-import { areGitHubRepositoriesAllowedForWorkspace, requireFile, type Database } from "@opengeni/db";
+import {
+  areGitHubRepositoriesAllowedForWorkspace,
+  requireFileForSubject,
+  type Database,
+} from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
 
 export function validateToolRefs(tools: ToolRef[], settings: McpSettings): ToolRef[] {
@@ -38,15 +44,19 @@ export function validateToolRefs(tools: ToolRef[], settings: McpSettings): ToolR
     }
     // Tool refs are tri-state for pack portability across deployments:
     //  - bare / optional:false is STRICT: the id must be configured here and
-    //    runtime connection failure fails the turn.
+    //    runtime connection failure fails closed when preparation is demanded.
+    //    Only an independent eager:true marker makes that a startup barrier.
     //  - optional:true + known id is preserved: runtime treats it like an
     //    auto-attached capability MCP and skips connect/list failures.
     //  - optional:true + unknown id is skipped above: the client explicitly
     //    opted into graceful degradation for MCPs (for example docs servers
     //    like context7) that only some deployments configure.
-    out.push(
-      optional ? { kind: "mcp", id: tool.id, optional: true } : { kind: "mcp", id: tool.id },
-    );
+    out.push({
+      kind: "mcp",
+      id: tool.id,
+      ...(optional ? { optional: true } : {}),
+      ...(tool.eager === true ? { eager: true } : {}),
+    });
   }
   return mergeToolRefs([], out);
 }
@@ -77,6 +87,31 @@ export function withDefaultEnabledCapabilityMcpTools(
   return mergeToolRefs(tools, enabledCapabilityMcpToolRefs(settings, runtimeSettings));
 }
 
+/**
+ * Apply the workspace's exact new-session MCP defaults when configured.
+ * Stale or currently unavailable ids are optional and disappear from the
+ * executable selection without making every new session fail during a rolling
+ * connector change. An absent workspace override preserves the legacy
+ * deployment + enabled-capability default.
+ */
+export function withWorkspaceDefaultMcpTools(
+  tools: ToolRef[],
+  settings: McpSettings,
+  runtimeSettings: McpSettings,
+  defaults: WorkspaceSessionToolDefaults | null,
+): ToolRef[] {
+  if (!defaults) {
+    return withDefaultEnabledCapabilityMcpTools(tools, settings, runtimeSettings);
+  }
+  return mergeToolRefs(
+    tools,
+    validateToolRefs(
+      defaults.mcpServerIds.map((id) => ({ kind: "mcp" as const, id, optional: true as const })),
+      runtimeSettings,
+    ),
+  );
+}
+
 /** Drop stored refs that are no longer present in the current runtime registry. */
 export function availableToolRefs(tools: ToolRef[], settings: McpSettings): ToolRef[] {
   const available = new Set(settings.mcpServers.map((server) => server.id));
@@ -161,6 +196,7 @@ export function normalizeResources(resources: ResourceRef[]): ResourceRef[] {
         mountPath,
         ...(resource.subpath ? { subpath: normalizeRepositorySubpath(resource.subpath) } : {}),
         ...(resource.provider ? { provider: resource.provider } : {}),
+        ...(resource.connectionType ? { connectionType: resource.connectionType } : {}),
         ...(resource.credentialBindingId
           ? { credentialBindingId: resource.credentialBindingId }
           : {}),
@@ -228,6 +264,97 @@ export function validateGitHubRepositorySelectionShapes(resources: ResourceRef[]
   return [...new Set(selected.map((item) => item.installationId))];
 }
 
+export type PersonalGitHubRepositoryResource = RepositoryResourceRef & {
+  provider: "github";
+  connectionType: "github_personal";
+  credentialBindingId: string;
+  access: "read" | "write";
+  repositoryId: string;
+};
+
+const PERSONAL_GITHUB_BINDING_ID_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
+
+function isPersonalGitHubRepositoryCandidate(
+  resource: ResourceRef,
+): resource is RepositoryResourceRef & { provider: "github"; credentialBindingId: string } {
+  if (resource.kind !== "repository" || resource.connectionType !== "github_personal") {
+    return false;
+  }
+  return resource.provider === "github" && resource.credentialBindingId !== undefined;
+}
+
+/**
+ * Validate and return the dedicated personal-GitHub repository resource lane.
+ * A host-opaque binding is only a selector for the server-side authority
+ * snapshot; it never authorizes a repository on its own.
+ */
+export function personalGitHubRepositoryResources(
+  resources: ResourceRef[],
+): PersonalGitHubRepositoryResource[] {
+  const selected: PersonalGitHubRepositoryResource[] = [];
+  for (const resource of resources) {
+    if (!isPersonalGitHubRepositoryCandidate(resource)) {
+      if (resource.kind === "repository" && resource.connectionType === "github_personal") {
+        throw new HTTPException(422, {
+          message: "personal GitHub repository resources require the dedicated GitHub provider",
+        });
+      }
+      continue;
+    }
+    if (
+      !PERSONAL_GITHUB_BINDING_ID_PATTERN.test(resource.credentialBindingId) ||
+      typeof resource.repositoryId !== "string" ||
+      !/^[1-9]\d*$/u.test(resource.repositoryId) ||
+      (resource.access !== "read" && resource.access !== "write") ||
+      resource.installationId !== undefined ||
+      resource.githubInstallationId !== undefined ||
+      resource.githubRepositoryId !== undefined ||
+      resource.connectionId !== undefined ||
+      resource.projectId !== undefined
+    ) {
+      throw new HTTPException(422, {
+        message:
+          "personal GitHub repository resources require one opaque binding, provider repository id, and explicit read or write access",
+      });
+    }
+    let uri: URL;
+    try {
+      uri = new URL(resource.uri);
+    } catch {
+      throw new HTTPException(422, { message: "personal GitHub repository URI is invalid" });
+    }
+    if (
+      uri.protocol !== "https:" ||
+      uri.hostname !== "github.com" ||
+      uri.port !== "" ||
+      uri.username !== "" ||
+      uri.password !== "" ||
+      uri.search !== "" ||
+      uri.hash !== "" ||
+      uri.pathname.endsWith(".git") ||
+      uri.pathname.split("/").filter(Boolean).length !== 2 ||
+      resource.uri !== `${uri.origin}${uri.pathname.replace(/\/$/u, "")}`
+    ) {
+      throw new HTTPException(422, {
+        message: "personal GitHub repository resources require a canonical GitHub HTTPS URI",
+      });
+    }
+    selected.push(resource as PersonalGitHubRepositoryResource);
+  }
+  const identities = new Set<string>();
+  for (const resource of selected) {
+    const key = `${resource.credentialBindingId}\0${resource.repositoryId}`;
+    if (identities.has(key)) {
+      throw new HTTPException(422, {
+        message: "personal GitHub repository resources must not contain duplicates",
+      });
+    }
+    identities.add(key);
+  }
+  return selected;
+}
+
 /** @deprecated Use validateGitHubRepositorySelectionShapes for multi-installation sessions. */
 export function validateGitHubRepositorySelectionShape(resources: ResourceRef[]): number | null {
   const installationIds = validateGitHubRepositorySelectionShapes(resources);
@@ -246,6 +373,9 @@ function gitHubRepositorySelections(
     if (resource.kind !== "repository") {
       return [];
     }
+    if (isPersonalGitHubRepositoryCandidate(resource)) {
+      return [];
+    }
     const installationRaw =
       resource.githubInstallationId ??
       (resource.provider === "github" ? resource.installationId : undefined);
@@ -275,6 +405,7 @@ export async function validateGitHubRepositorySelection(
   workspaceId: string,
   resources: ResourceRef[],
 ): Promise<void> {
+  personalGitHubRepositoryResources(resources);
   const installationIds = validateGitHubRepositorySelectionShapes(resources);
   if (installationIds.length === 0) {
     return;
@@ -311,7 +442,9 @@ export function isAuthoritativeGitHubRepositorySelectionError(error: unknown): b
 
 export async function validateFileResources(
   db: Database,
+  accountId: string,
   workspaceId: string,
+  subjectId: string,
   resources: ResourceRef[],
 ): Promise<void> {
   const fileIds = new Set<string>();
@@ -323,7 +456,12 @@ export async function validateFileResources(
       throw new HTTPException(422, { message: `duplicate file resource: ${resource.fileId}` });
     }
     fileIds.add(resource.fileId);
-    const file = await requireFile(db, workspaceId, resource.fileId).catch(() => null);
+    const file = await requireFileForSubject(db, {
+      accountId,
+      workspaceId,
+      subjectId,
+      fileId: resource.fileId,
+    }).catch(() => null);
     if (!file) {
       throw new HTTPException(422, { message: `unknown file resource: ${resource.fileId}` });
     }