@opengeni/core 1.0.1 → 2.2.0-canary.0

package/src/application/session-tenancy.ts

@@ -0,0 +1,321 @@
+import {
+  ForkSessionResponse,
+  SessionTenancyCreateCapabilities,
+  UpdateSessionVisibilityResponse,
+  sessionVisibilityFromPublic,
+  sessionVisibilityToPublic,
+  type ForkSessionRequest,
+  type SessionAuthorizationSurface,
+  type UpdateSessionVisibilityRequest,
+} from "@opengeni/contracts";
+import {
+  forkSessionContent,
+  getPrivateSessionCreatePolicy,
+  getSessionEventForSubject,
+  isRetryableDatabaseTransportFailure,
+  nestedPostgresSqlState,
+  replayAppliedSessionFork,
+  sessionTenancyProductActivated,
+  SessionTenancyAccessError,
+  SessionTenancyNotActivatedError,
+  transitionSessionVisibility,
+  type Database,
+  type ForkSessionContentResult,
+} from "@opengeni/db";
+import { publishDurableSessionEvents, type EventBus } from "@opengeni/events";
+import { requirePermission, type AccessGrantAuthorization } from "../access";
+import { requireSessionAuthorization } from "../session-authorization";
+import type { AppDependencies } from "../dependencies";
+
+type SessionTenancyDependencies = Pick<AppDependencies, "db" | "bus" | "sessionAuthorization">;
+
+export class SessionTenancyManagedHumanRequiredError extends Error {
+  readonly name = "SessionTenancyManagedHumanRequiredError";
+  constructor() {
+    super("Session tenancy mutations require the owning managed-human session");
+  }
+}
+
+export class SessionTenancyPersistenceOutcomeUnknownError extends Error {
+  readonly name = "SessionTenancyPersistenceOutcomeUnknownError";
+  constructor(options?: ErrorOptions) {
+    super("The session tenancy mutation outcome is unknown", options);
+  }
+}
+
+export function requireCanonicalManagedHuman(
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+): void {
+  if (
+    !authorization.canonicalManagedHumanSession ||
+    !authorization.contextIntegrity ||
+    authorization.authenticatedSubjectId !== authorization.grant.subjectId ||
+    authorization.grant.workspaceId !== workspaceId
+  ) {
+    throw new SessionTenancyManagedHumanRequiredError();
+  }
+}
+
+export async function getManagedHumanSessionCreateCapabilities(
+  deps: Pick<SessionTenancyDependencies, "db">,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+): Promise<SessionTenancyCreateCapabilities> {
+  requirePermission(authorization.grant, "sessions:create");
+  try {
+    requireCanonicalManagedHuman(authorization, workspaceId);
+  } catch (error) {
+    if (error instanceof SessionTenancyManagedHumanRequiredError) {
+      return SessionTenancyCreateCapabilities.parse({
+        activated: false,
+        canCreatePrivate: false,
+        reason: "managed_session_required",
+      });
+    }
+    throw error;
+  }
+  // Mirror the database create fence exactly: a managed human's own Personal
+  // workspace needs only the operator readiness receipt, while a shared
+  // organization workspace additionally needs the owner/admin product setting.
+  let activated = false;
+  try {
+    const policy = await getPrivateSessionCreatePolicy(deps.db, {
+      workspaceId,
+      actorSubjectId: authorization.grant.subjectId,
+    });
+    activated = policy.personalWorkspace ? policy.platformAvailable : policy.organizationEnabled;
+  } catch (error) {
+    // A canonical managed human without an active organization membership or
+    // stated workspace authority (legacy managed access) is simply not
+    // private-ready; the definer's 42501 is a capability answer here, not a
+    // failure. Every other error still propagates.
+    if (
+      !(error instanceof SessionTenancyAccessError) &&
+      nestedPostgresSqlState(error) !== "42501"
+    ) {
+      throw error;
+    }
+  }
+  return SessionTenancyCreateCapabilities.parse({
+    activated,
+    canCreatePrivate: activated,
+    reason: activated ? "available" : "not_activated",
+  });
+}
+
+export async function requireManagedHumanPrivateSessionCreate(
+  deps: Pick<SessionTenancyDependencies, "db">,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+): Promise<void> {
+  // Target-free readiness preflight only. The owner/admin organization setting
+  // is enforced by the create transaction itself (under the organization
+  // fence, after keyed replay resolution), so a committed keyed success still
+  // replays after the setting is disabled while a fresh key fails closed.
+  await requireSessionTenancyMutationGate(deps, authorization, workspaceId, ["sessions:create"]);
+}
+
+async function requireSessionTenancyMutationGate(
+  deps: Pick<SessionTenancyDependencies, "db">,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+  permissions: ReadonlyArray<"sessions:read" | "sessions:create" | "sessions:control">,
+): Promise<void> {
+  // These checks are deliberately target-free. A rejected principal must not
+  // cause a session lookup or embedding-host callback that distinguishes a
+  // missing, shared, or another owner's private session.
+  requireCanonicalManagedHuman(authorization, workspaceId);
+  for (const permission of permissions) requirePermission(authorization.grant, permission);
+  if (!(await sessionTenancyProductActivated(deps.db, workspaceId))) {
+    throw new SessionTenancyNotActivatedError();
+  }
+}
+
+async function publishExactCommittedEvent(
+  deps: { db: Database; bus: EventBus },
+  input: {
+    workspaceId: string;
+    sessionId: string;
+    subjectId: string;
+    eventId: string | null;
+    eventSequence: number | null;
+  },
+): Promise<void> {
+  if (input.eventId === null && input.eventSequence === null) return;
+  if (input.eventId === null || input.eventSequence === null) {
+    console.error("[session-tenancy] committed event receipt is incomplete", {
+      errorClass: "SessionTenancyEventInvariantError",
+      errorCode: "session_tenancy_event_receipt_incomplete",
+      origin: "core",
+      sessionId: input.sessionId,
+    });
+    return;
+  }
+  try {
+    const event = await getSessionEventForSubject(
+      deps.db,
+      input.workspaceId,
+      input.subjectId,
+      input.eventId,
+    );
+    if (!event || event.sessionId !== input.sessionId || event.sequence !== input.eventSequence) {
+      console.error("[session-tenancy] committed event receipt did not resolve exactly", {
+        errorClass: "SessionTenancyEventInvariantError",
+        errorCode: "session_tenancy_event_receipt_mismatch",
+        origin: "core",
+        sessionId: input.sessionId,
+      });
+      return;
+    }
+    await publishDurableSessionEvents(deps.bus, input.workspaceId, input.sessionId, [event]);
+  } catch {
+    // The mutation and event committed atomically before this read. Live fanout
+    // is repairable from the durable stream, so a publication-side failure must
+    // not turn a known successful mutation into an unknown client outcome.
+    console.warn("[session-tenancy] committed event live publication was deferred to replay", {
+      errorClass: "SessionTenancyEventPublishOperationError",
+      errorCode: "session_tenancy_event_publish_deferred",
+      origin: "core",
+      sessionId: input.sessionId,
+    });
+  }
+}
+
+async function runTenancyMutation<T>(operation: () => Promise<T>): Promise<T> {
+  try {
+    return await operation();
+  } catch (error) {
+    if (isRetryableDatabaseTransportFailure(error)) {
+      throw new SessionTenancyPersistenceOutcomeUnknownError({ cause: error });
+    }
+    throw error;
+  }
+}
+
+async function projectAndPublishSessionFork(
+  deps: SessionTenancyDependencies,
+  actorSubjectId: string,
+  result: ForkSessionContentResult,
+): Promise<ForkSessionResponse> {
+  const response = ForkSessionResponse.parse({
+    operationId: result.operationId,
+    eventId: result.eventId,
+    eventSequence: result.eventSequence,
+    sessionId: result.sessionId,
+    workspaceId: result.workspaceId,
+    visibility: sessionVisibilityToPublic(result.visibility),
+    authorityEpoch: result.authorityEpoch,
+    copiedHistoryItemCount: result.copiedHistoryItemCount,
+    replay: result.replay,
+  });
+  await publishExactCommittedEvent(deps, {
+    workspaceId: response.workspaceId,
+    sessionId: response.sessionId,
+    subjectId: actorSubjectId,
+    eventId: response.eventId,
+    eventSequence: response.eventSequence,
+  });
+  return response;
+}
+
+export async function updateManagedHumanSessionVisibility(
+  deps: SessionTenancyDependencies,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+  sessionId: string,
+  request: UpdateSessionVisibilityRequest,
+  authorizationSurface: SessionAuthorizationSurface = "core",
+): Promise<UpdateSessionVisibilityResponse> {
+  await requireSessionTenancyMutationGate(deps, authorization, workspaceId, ["sessions:control"]);
+  await requireSessionAuthorization(deps, authorization.grant, {
+    sessionId,
+    operation: "session.visibility.write",
+    surface: authorizationSurface,
+  });
+
+  const result = await runTenancyMutation(
+    async () =>
+      await transitionSessionVisibility(deps.db, {
+        workspaceId,
+        sessionId,
+        actorSubjectId: authorization.grant.subjectId,
+        targetVisibility: sessionVisibilityFromPublic(request.visibility),
+        expectedAuthorityEpoch: request.expectedAuthorityEpoch,
+        operationKey: request.idempotencyKey,
+      }),
+  );
+  const response = UpdateSessionVisibilityResponse.parse({
+    operationId: result.operationId,
+    eventId: result.eventId,
+    eventSequence: result.eventSequence,
+    visibility: sessionVisibilityToPublic(result.visibility),
+    authorityEpoch: result.authorityEpoch,
+    changed: result.changed,
+    replay: result.replay,
+    revokedGrantCount: result.revokedGrantCount,
+  });
+  await publishExactCommittedEvent(deps, {
+    workspaceId,
+    sessionId,
+    subjectId: authorization.grant.subjectId,
+    eventId: response.eventId,
+    eventSequence: response.eventSequence,
+  });
+  return response;
+}
+
+export async function forkManagedHumanSession(
+  deps: SessionTenancyDependencies,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+  sourceSessionId: string,
+  request: ForkSessionRequest,
+  authorizationSurface: SessionAuthorizationSurface = "core",
+): Promise<ForkSessionResponse> {
+  await requireSessionTenancyMutationGate(deps, authorization, workspaceId, [
+    "sessions:read",
+    "sessions:create",
+  ]);
+  const forkInput = {
+    sourceWorkspaceId: workspaceId,
+    sourceSessionId,
+    actorSubjectId: authorization.grant.subjectId,
+    destinationWorkspaceId: workspaceId,
+    destinationVisibility:
+      request.visibility === "private" ? ("user_private" as const) : ("workspace_shared" as const),
+    workspaceSharedAcknowledged: request.workspaceSharedAcknowledged,
+    operationKey: request.idempotencyKey,
+  };
+  const recoverAppliedReceipt = async () =>
+    await runTenancyMutation(async () => await replayAppliedSessionFork(deps.db, forkInput));
+
+  // A committed response is owned by the exact actor/key/request tuple and no
+  // longer depends on mutable source visibility. Resolve it before source/host
+  // authorization so a lost response remains recoverable after the source
+  // owner makes a formerly shared session private.
+  const applied = await recoverAppliedReceipt();
+  if (applied) {
+    return await projectAndPublishSessionFork(deps, authorization.grant.subjectId, applied);
+  }
+
+  try {
+    await requireSessionAuthorization(deps, authorization.grant, {
+      sessionId: sourceSessionId,
+      operation: "session.fork.create",
+      surface: authorizationSurface,
+    });
+  } catch (authorizationError) {
+    // Close the race where a duplicate request checked before the first commit
+    // but mutable source/host authority changed immediately after it. Only an
+    // exact applied receipt can convert the authorization failure into replay.
+    const racedApplied = await recoverAppliedReceipt();
+    if (racedApplied) {
+      return await projectAndPublishSessionFork(deps, authorization.grant.subjectId, racedApplied);
+    }
+    throw authorizationError;
+  }
+
+  const result = await runTenancyMutation(async () => await forkSessionContent(deps.db, forkInput));
+  return await projectAndPublishSessionFork(deps, authorization.grant.subjectId, result);
+}

package/src/application/user-resource-grants.ts

@@ -0,0 +1,140 @@
+import type {
+  IssueUserResourceGrantRequest,
+  Permission,
+  SessionAuthorizationSurface,
+  UserResourceKind,
+} from "@opengeni/contracts";
+import {
+  issueSelfUserResourceGrant,
+  listSelfUserResourceAuthorities,
+  revokeSelfUserResourceGrant,
+  sessionTenancyProductActivated,
+  SessionTenancyNotActivatedError,
+} from "@opengeni/db";
+import { requirePermission, type AccessGrantAuthorization } from "../access";
+import type { AppDependencies } from "../dependencies";
+import { requireSessionAuthorization } from "../session-authorization";
+import { requireCanonicalManagedHuman } from "./session-tenancy";
+
+type UserResourceGrantDependencies = Pick<AppDependencies, "db" | "sessionAuthorization">;
+
+const LIST_PERMISSIONS = {
+  connection: ["connections:read"],
+  document: ["documents:search"],
+  variable_set: ["variable-sets:list"],
+  rig: ["rigs:use"],
+  connected_machine: ["enrollments:read"],
+} as const satisfies Record<UserResourceKind, readonly Permission[]>;
+
+const ISSUE_PERMISSIONS = {
+  connection: ["connections:read"],
+  document: ["documents:search"],
+  variable_set: ["variable-sets:list", "variable-sets:attach", "variable-sets:use"],
+  rig: ["rigs:use"],
+  connected_machine: ["enrollments:read"],
+} as const satisfies Record<UserResourceKind, readonly Permission[]>;
+
+async function requireOwnerProductGate(
+  deps: Pick<UserResourceGrantDependencies, "db">,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+  permissions: readonly Permission[],
+): Promise<void> {
+  // Target-free gates must run before an optional target-session lookup or host
+  // callback so rejected principals cannot use grant management as an oracle.
+  requireOwnerAuthority(authorization, workspaceId, permissions);
+  if (!(await sessionTenancyProductActivated(deps.db, workspaceId))) {
+    throw new SessionTenancyNotActivatedError();
+  }
+}
+
+function requireOwnerAuthority(
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+  permissions: readonly Permission[],
+): void {
+  requireCanonicalManagedHuman(authorization, workspaceId);
+  for (const permission of permissions) requirePermission(authorization.grant, permission);
+}
+
+export async function listManagedHumanUserResourceAuthorities(
+  deps: Pick<UserResourceGrantDependencies, "db">,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+  input: { resourceKind: UserResourceKind; cursor?: string | undefined; limit: number },
+) {
+  requireOwnerAuthority(authorization, workspaceId, LIST_PERMISSIONS[input.resourceKind]);
+  // Before activation there cannot be usable personal-resource authority in
+  // this organization. Discovery therefore has an exact empty answer; only
+  // issue/revoke and runtime use remain behind the forward-only product gate.
+  // This keeps ordinary workspace-owned Rig/Variable Set selection independent
+  // from an optional personal-resource product that is not enabled.
+  if (!(await sessionTenancyProductActivated(deps.db, workspaceId))) {
+    return { authorities: [], nextCursor: null };
+  }
+  return await listSelfUserResourceAuthorities(deps.db, {
+    accountId: authorization.grant.accountId,
+    workspaceId,
+    subjectId: authorization.grant.subjectId,
+    ...input,
+  });
+}
+
+export async function issueManagedHumanUserResourceGrant(
+  deps: UserResourceGrantDependencies,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+  authorityId: string,
+  request: IssueUserResourceGrantRequest,
+  authorizationSurface: SessionAuthorizationSurface = "core",
+) {
+  const modePermissions: Permission[] =
+    request.mode === "session" ? ["sessions:control"] : ["sessions:create"];
+  await requireOwnerProductGate(deps, authorization, workspaceId, [
+    ...ISSUE_PERMISSIONS[request.resourceKind],
+    ...modePermissions,
+  ]);
+
+  if (request.mode === "session") {
+    // Contract refinement guarantees both fields. Keep the defensive check so
+    // direct core callers cannot accidentally weaken the target fence.
+    if (!request.sessionId || !request.expectedAuthorityEpoch) {
+      throw new TypeError("session grant requires its exact authority epoch");
+    }
+    await requireSessionAuthorization(deps, authorization.grant, {
+      sessionId: request.sessionId,
+      operation: "session.personal_resource.grant",
+      surface: authorizationSurface,
+    });
+  }
+
+  return await issueSelfUserResourceGrant(deps.db, {
+    accountId: authorization.grant.accountId,
+    workspaceId,
+    subjectId: authorization.grant.subjectId,
+    authorityId,
+    resourceKind: request.resourceKind,
+    mode: request.mode,
+    context: request.context,
+    sessionId: request.sessionId ?? null,
+    expectedAuthorityEpoch: request.expectedAuthorityEpoch ?? null,
+    workspaceSharedAcknowledged: request.workspaceSharedAcknowledged,
+  });
+}
+
+export async function revokeManagedHumanUserResourceGrant(
+  deps: Pick<UserResourceGrantDependencies, "db">,
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+  grantId: string,
+) {
+  // Revocation narrows authority. It intentionally does not require the
+  // resource-specific permission that may have been removed since issuance.
+  await requireOwnerProductGate(deps, authorization, workspaceId, []);
+  return await revokeSelfUserResourceGrant(deps.db, {
+    accountId: authorization.grant.accountId,
+    workspaceId,
+    subjectId: authorization.grant.subjectId,
+    grantId,
+  });
+}

package/src/billing/limits.ts

@@ -1,4 +1,4 @@
-import { configuredStaticUsageLimits } from "@opengeni/config";
+import { configuredStaticUsageLimits, resolveModelProvider } from "@opengeni/config";
 import type {
   LimitAction,
   LimitDecision,
@@ -25,12 +25,11 @@ export type LimitCheckInput = {
   workspaceId?: string;
   action: LimitAction;
   quantity?: number;
-  // The turn's model id, when the action represents an agent turn. When this is a
-  // Codex-billed turn (codex/<slug> + feature enabled + active workspace
-  // credential) the turn is paid by the user's ChatGPT/Codex plan and consumes
-  // ZERO OpenGeni credits, so the credit-balance + model-cost + token gates are
-  // skipped. Non-model infra actions (workspace/api_key/schedule create) leave
-  // this undefined and are unaffected.
+  // The turn's model id, when the action represents an agent turn. Externally
+  // billed models consume ZERO OpenGeni credits, so the credit-balance +
+  // model-cost + token gates are skipped. Connected subscriptions still require
+  // live workspace readiness; an explicitly anonymous deployment route is
+  // statically ready by definition. Non-model infra actions leave this undefined.
   model?: string | null;
 };
 
@@ -59,23 +58,34 @@ export async function checkLimit(
         model: input.model,
       })
     : false;
-  const creditDecision = await checkCreditBalance(deps, input, codexBilled);
+  const credentialFreeExternal = input.model
+    ? (() => {
+        const resolved = resolveModelProvider(deps.settings, input.model);
+        return (
+          resolved?.model.billing.metering === "external" &&
+          resolved.model.credentialSource.kind === "deployment" &&
+          resolved.model.credentialSource.mechanism === "none"
+        );
+      })()
+    : false;
+  const externallyBilled = codexBilled || credentialFreeExternal;
+  const creditDecision = await checkCreditBalance(deps, input, externallyBilled);
   if (!creditDecision.allowed) {
     return creditDecision;
   }
   if (deps.settings.usageLimitsMode !== "static" && deps.settings.usageLimitsMode !== "managed") {
     return { allowed: true };
   }
-  return await checkStaticCaps(deps, input, codexBilled);
+  return await checkStaticCaps(deps, input, externallyBilled);
 }
 
 async function checkCreditBalance(
   deps: LimitDependencies,
   input: LimitCheckInput,
-  codexBilled: boolean,
+  externallyBilled: boolean,
 ): Promise<LimitDecision> {
-  if (codexBilled) {
-    return { allowed: true }; // paid by the user's ChatGPT/Codex plan — zero OpenGeni credits
+  if (externallyBilled) {
+    return { allowed: true }; // paid outside OpenGeni — zero OpenGeni credits
   }
   if (!usesCreditLimits(deps) || !isCostlyAction(input.action)) {
     return { allowed: true };
@@ -90,10 +100,10 @@ async function checkCreditBalance(
 async function checkStaticCaps(
   deps: LimitDependencies,
   input: LimitCheckInput,
-  codexBilled: boolean,
+  externallyBilled: boolean,
 ): Promise<LimitDecision> {
   const limits = configuredStaticUsageLimits(deps.settings);
-  if (limits.maxMonthlyCostMicrosPerAccount && isCostlyAction(input.action) && !codexBilled) {
+  if (limits.maxMonthlyCostMicrosPerAccount && isCostlyAction(input.action) && !externallyBilled) {
     const used = await sumUsageQuantity(deps.db, {
       accountId: input.accountId,
       eventType: "model.cost",
@@ -172,7 +182,7 @@ async function checkStaticCaps(
           );
     }
     case "tokens:consume": {
-      if (codexBilled || !limits.maxMonthlyTokensPerWorkspace || !input.workspaceId) {
+      if (externallyBilled || !limits.maxMonthlyTokensPerWorkspace || !input.workspaceId) {
         return { allowed: true };
       }
       const used = await sumUsageQuantity(deps.db, {

package/src/dependencies.ts

@@ -25,6 +25,11 @@ import type {
 } from "./editable-artifacts";
 
 export type SessionWorkflowClient = {
+  triggerAutomationRun?: (input: {
+    accountId: string;
+    workspaceId: string;
+    runId: string;
+  }) => Promise<void>;
   signalUserMessage: (input: {
     sessionId: string;
     eventId: string;
@@ -108,7 +113,11 @@ export type AppDependencies = {
   editableArtifactOfficeImports?: EditableArtifactOfficeImportPort;
   bus: EventBus;
   workflowClient: SessionWorkflowClient;
-  /** Injectable structural seam for replayable prompt fanout and wake work. */
+  /**
+   * Injectable structural seam for replayable post-commit fanout and wake work.
+   * The historical name is retained for host compatibility; every interactive
+   * session command now uses this boundary, not only prompt submission.
+   */
   schedulePromptPostCommit?: (task: () => Promise<void>) => void;
   /** Optional provider override for deterministic API/object-storage tests. */
   objectStorage?: ObjectStorageDependency;
@@ -138,6 +147,8 @@ export type AppDependencies = {
   managedAuth?: ManagedAuth | null;
   /** Injectable Codex HTTP transport for deterministic API/provider tests. */
   codexFetch?: typeof fetch;
+  /** Injectable GitHub transport for deterministic personal-OAuth tests. */
+  githubPersonalFetch?: typeof fetch;
   /** Injectable xAI OAuth/subscription transport for deterministic API/provider tests. */
   xaiFetch?: typeof fetch;
   /** Injectable Slack Web API transport for deterministic bot-connection tests. */