@opengeni/core 0.4.6 → 0.4.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -8,6 +8,10 @@
     "url": "git+https://github.com/Cloudgeni-ai/opengeni.git",
     "directory": "packages/core"
   },
+  "files": [
+    "dist",
+    "src"
+  ],
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -19,33 +23,29 @@
       "import": "./dist/index.js"
     }
   },
-  "files": [
-    "dist",
-    "src"
-  ],
-  "engines": {
-    "node": ">=18"
-  },
   "publishConfig": {
     "access": "public",
     "provenance": true
   },
   "scripts": {
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsgo --noEmit",
     "build": "tsup",
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/codex": "^0.2.1",
-    "@opengeni/config": "^0.4.0",
-    "@opengeni/contracts": "^0.9.0",
-    "@opengeni/db": "^0.6.1",
-    "@opengeni/documents": "^0.2.8",
-    "@opengeni/events": "^0.2.8",
+    "@opengeni/codex": "^0.2.2",
+    "@opengeni/config": "^0.5.0",
+    "@opengeni/contracts": "^0.10.0",
+    "@opengeni/db": "^0.7.1",
+    "@opengeni/documents": "^0.2.10",
+    "@opengeni/events": "^0.3.1",
     "@opengeni/observability": "^0.3.0",
-    "@opengeni/runtime": "^0.6.1",
-    "@opengeni/storage": "^0.2.8",
+    "@opengeni/runtime": "^0.7.0",
+    "@opengeni/storage": "^0.2.9",
     "hono": "^4.12.18"
+  },
+  "engines": {
+    "node": ">=18"
   }
 }

package/src/access/index.ts

@@ -1,5 +1,10 @@
 import type { Settings } from "@opengeni/config";
-import { verifyDelegatedAccessToken, type AccessContext, type AccessGrant, type Permission } from "@opengeni/contracts";
+import {
+  verifyDelegatedAccessToken,
+  type AccessContext,
+  type AccessGrant,
+  type Permission,
+} from "@opengeni/contracts";
 import {
   bootstrapWorkspace,
   ensureManagedAccessForUser,
@@ -28,10 +33,16 @@ export async function requireAccessContext(c: Context, deps: AccessDeps): Promis
   return context;
 }
 
-export async function requireAccessGrant(c: Context, deps: AccessDeps, workspaceId: string, permission?: Permission): Promise<AccessGrant> {
+export async function requireAccessGrant(
+  c: Context,
+  deps: AccessDeps,
+  workspaceId: string,
+  permission?: Permission,
+): Promise<AccessGrant> {
   const context = await requireAccessContext(c, deps);
-  const grant = context.workspaceGrants.find((candidate) => candidate.workspaceId === workspaceId)
-    ?? await getWorkspaceGrant(deps.db, context.subjectId, workspaceId);
+  const grant =
+    context.workspaceGrants.find((candidate) => candidate.workspaceId === workspaceId) ??
+    (await getWorkspaceGrant(deps.db, context.subjectId, workspaceId));
   if (!grant) {
     const workspace = await requireWorkspace(deps.db, workspaceId).catch(() => null);
     if (!workspace) {
@@ -47,12 +58,30 @@ export async function requireAccessGrant(c: Context, deps: AccessDeps, workspace
 
 export function requirePermission(grant: AccessGrant, permission: Permission): void {
   if (!hasPermission(grant.permissions, permission)) {
+    if (permission === "variable-sets:use") {
+      throw new HTTPException(403, {
+        message: "missing permission: variable-sets:use (deprecated alias: environments:use)",
+      });
+    }
+    if (permission === "variable-sets:manage") {
+      throw new HTTPException(403, {
+        message: "missing permission: variable-sets:manage (deprecated alias: environments:manage)",
+      });
+    }
     throw new HTTPException(403, { message: `missing permission: ${permission}` });
   }
 }
 
 export function hasPermission(permissions: Permission[], permission: Permission): boolean {
-  return permissions.includes(permission) || permissions.includes("workspace:admin");
+  const aliases: Partial<Record<Permission, Permission[]>> = {
+    "variable-sets:use": ["environments:use" as Permission],
+    "variable-sets:manage": ["environments:manage" as Permission],
+  };
+  return (
+    permissions.includes(permission) ||
+    (aliases[permission]?.some((alias) => permissions.includes(alias)) ?? false) ||
+    permissions.includes("workspace:admin")
+  );
 }
 
 async function resolveAccessContext(c: Context, deps: AccessDeps): Promise<AccessContext | null> {
@@ -69,16 +98,20 @@ async function resolveAccessContext(c: Context, deps: AccessDeps): Promise<Acces
     });
   }
 
-	  if (deps.settings.productAccessMode === "configured") {
-	    const delegated = await delegatedAccessContext(c, deps, "configured");
-	    if (delegated) {
-	      return delegated;
-	    }
-	    if (deps.settings.delegationSecret) {
-	      return null;
-	    }
-	    return await bootstrapWorkspace(deps.db, {
-	      accountExternalSource: "opengeni:configured",
+  if (deps.settings.productAccessMode === "configured") {
+    const delegated = await delegatedAccessContext(c, deps, "configured");
+    if (delegated) {
+      return delegated;
+    }
+    const apiKey = await apiKeyAccessContext(c, deps, "configured");
+    if (apiKey) {
+      return apiKey;
+    }
+    if (deps.settings.delegationSecret) {
+      return null;
+    }
+    return await bootstrapWorkspace(deps.db, {
+      accountExternalSource: "opengeni:configured",
       accountExternalId: "default",
       accountName: "Configured",
       workspaceExternalSource: "opengeni:configured",
@@ -95,31 +128,9 @@ async function resolveAccessContext(c: Context, deps: AccessDeps): Promise<Acces
     if (delegated) {
       return delegated;
     }
-    const apiKey = await findActiveApiKeyByHash(deps.db, await sha256Hex(bearer));
+    const apiKey = await apiKeyAccessContext(c, deps, "managed");
     if (apiKey) {
-      const accountPermissions = apiKey.workspaceId
-        ? apiKey.permissions.filter((permission) => permission === "billing:read" || permission === "billing:manage")
-        : apiKey.permissions;
-      return {
-        mode: "managed",
-        subjectId: `api_key:${apiKey.id}`,
-        subjectLabel: apiKey.name,
-        accountGrants: [{
-          accountId: apiKey.accountId,
-          subjectId: `api_key:${apiKey.id}`,
-          subjectLabel: apiKey.name,
-          permissions: accountPermissions,
-        }],
-        workspaceGrants: apiKey.workspaceId ? [{
-          workspaceId: apiKey.workspaceId,
-          accountId: apiKey.accountId,
-          subjectId: `api_key:${apiKey.id}`,
-          subjectLabel: apiKey.name,
-          permissions: apiKey.permissions,
-        }] : [],
-        defaultAccountId: apiKey.accountId,
-        defaultWorkspaceId: apiKey.workspaceId,
-      } satisfies AccessContext;
+      return apiKey;
     }
   }
 
@@ -137,7 +148,59 @@ async function resolveAccessContext(c: Context, deps: AccessDeps): Promise<Acces
   return null;
 }
 
-async function delegatedAccessContext(c: Context, deps: AccessDeps, mode: "configured" | "managed", token = bearerToken(c)): Promise<AccessContext | null> {
+async function apiKeyAccessContext(
+  c: Context,
+  deps: AccessDeps,
+  mode: "configured" | "managed",
+): Promise<AccessContext | null> {
+  const bearer = bearerToken(c);
+  if (!bearer) {
+    return null;
+  }
+  const apiKey = await findActiveApiKeyByHash(deps.db, await sha256Hex(bearer));
+  if (!apiKey) {
+    return null;
+  }
+  const subjectId = `api_key:${apiKey.id}`;
+  const accountPermissions = apiKey.workspaceId
+    ? apiKey.permissions.filter(
+        (permission) => permission === "billing:read" || permission === "billing:manage",
+      )
+    : apiKey.permissions;
+  return {
+    mode,
+    subjectId,
+    subjectLabel: apiKey.name,
+    accountGrants: [
+      {
+        accountId: apiKey.accountId,
+        subjectId,
+        subjectLabel: apiKey.name,
+        permissions: accountPermissions,
+      },
+    ],
+    workspaceGrants: apiKey.workspaceId
+      ? [
+          {
+            workspaceId: apiKey.workspaceId,
+            accountId: apiKey.accountId,
+            subjectId,
+            subjectLabel: apiKey.name,
+            permissions: apiKey.permissions,
+          },
+        ]
+      : [],
+    defaultAccountId: apiKey.accountId,
+    defaultWorkspaceId: apiKey.workspaceId,
+  } satisfies AccessContext;
+}
+
+async function delegatedAccessContext(
+  c: Context,
+  deps: AccessDeps,
+  mode: "configured" | "managed",
+  token = bearerToken(c),
+): Promise<AccessContext | null> {
   if (!token || !deps.settings.delegationSecret) {
     return null;
   }
@@ -149,22 +212,36 @@ async function delegatedAccessContext(c: Context, deps: AccessDeps, mode: "confi
     mode,
     subjectId: payload.subjectId,
     ...(payload.subjectLabel ? { subjectLabel: payload.subjectLabel } : {}),
-    accountGrants: [{
-      accountId: payload.accountId,
-      subjectId: payload.subjectId,
-      ...(payload.subjectLabel ? { subjectLabel: payload.subjectLabel } : {}),
-      permissions: payload.permissions,
-    }],
-    workspaceGrants: [{
-      workspaceId: payload.workspaceId,
-      accountId: payload.accountId,
-      subjectId: payload.subjectId,
-      ...(payload.subjectLabel ? { subjectLabel: payload.subjectLabel } : {}),
-      permissions: payload.permissions,
-      // sessionId is worker-asserted (HMAC-signed token claim), not agent
-      // controlled; it scopes session-bound MCP tools such as goal management.
-      metadata: { delegated: true, ...(payload.sessionId ? { sessionId: payload.sessionId } : {}) },
-    }],
+    accountGrants: [
+      {
+        accountId: payload.accountId,
+        subjectId: payload.subjectId,
+        ...(payload.subjectLabel ? { subjectLabel: payload.subjectLabel } : {}),
+        permissions: payload.permissions,
+      },
+    ],
+    workspaceGrants: [
+      {
+        workspaceId: payload.workspaceId,
+        accountId: payload.accountId,
+        subjectId: payload.subjectId,
+        ...(payload.subjectLabel ? { subjectLabel: payload.subjectLabel } : {}),
+        permissions: payload.permissions,
+        // sessionId is worker-asserted (HMAC-signed token claim), not agent
+        // controlled; it scopes session-bound MCP tools such as goal management.
+        metadata: {
+          delegated: true,
+          ...(payload.sessionId ? { sessionId: payload.sessionId } : {}),
+          // Caller identity: the turn that minted this token. Tools classify the
+          // CALLER from this instead of re-reading the live active pointer.
+          ...(payload.turnId ? { turnId: payload.turnId } : {}),
+          ...(payload.attemptId ? { attemptId: payload.attemptId } : {}),
+          ...(payload.executionGeneration
+            ? { executionGeneration: payload.executionGeneration }
+            : {}),
+        },
+      },
+    ],
     defaultAccountId: payload.accountId,
     defaultWorkspaceId: payload.workspaceId,
   };
@@ -182,5 +259,7 @@ function bearerToken(c: Context): string | null {
 
 async function sha256Hex(value: string): Promise<string> {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
-  return Array.from(new Uint8Array(digest)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  return Array.from(new Uint8Array(digest))
+    .map((byte) => byte.toString(16).padStart(2, "0"))
+    .join("");
 }