@opengeni/core 2.5.3 → 2.6.4-canary.0

package/src/domain/workspace-members.ts

@@ -44,7 +44,9 @@ export function assertWorkspaceMemberRemovable(input: {
 }): void {
   const { members, subjectId, callerSubjectId } = input;
   if (subjectId === callerSubjectId) {
-    throw new HTTPException(409, { message: "you cannot remove your own membership" });
+    throw new HTTPException(409, {
+      message: "you cannot remove your own membership",
+    });
   }
   const target = members.find((member) => member.subjectId === subjectId);
   if (!target) {
@@ -62,6 +64,34 @@ export function assertWorkspaceMemberRemovable(input: {
   }
 }
 
+/** Keep scoped member edits from orphaning the workspace or changing the caller's own grant. */
+export function assertWorkspaceMemberUpdateAllowed(input: {
+  members: WorkspaceMember[];
+  subjectId: string;
+  callerSubjectId: string;
+  nextPermissions: Permission[];
+}): void {
+  const { members, subjectId, callerSubjectId, nextPermissions } = input;
+  if (subjectId === callerSubjectId) {
+    throw new HTTPException(409, {
+      message: "you cannot change your own workspace access",
+    });
+  }
+  const target = members.find((member) => member.subjectId === subjectId);
+  if (!target) {
+    throw new HTTPException(404, { message: "member not found" });
+  }
+  if (
+    memberCanAdminister(target) &&
+    !memberCanAdminister({ permissions: nextPermissions }) &&
+    !members.some((member) => member.subjectId !== subjectId && memberCanAdminister(member))
+  ) {
+    throw new HTTPException(409, {
+      message: "the workspace must keep at least one administrator",
+    });
+  }
+}
+
 /**
  * Guard the workspace-delete path before any external/DB mutation. Refuses
  * (409) to delete the account's last workspace, and refuses while any session
@@ -74,7 +104,9 @@ export function assertWorkspaceDeletable(input: {
   activeSessionCount: number;
 }): void {
   if (input.workspaceCountForAccount <= 1) {
-    throw new HTTPException(409, { message: "cannot delete the account's only workspace" });
+    throw new HTTPException(409, {
+      message: "cannot delete the account's only workspace",
+    });
   }
   if (input.activeSessionCount > 0) {
     throw new HTTPException(409, {

package/src/index.ts

@@ -49,6 +49,7 @@ export {
   type ManagedAuthActorMutationLeaseStamp,
 } from "./managed-session";
 export * from "./transcription";
+export * from "./model-catalog";
 
 // Sandbox fleet/routing service — the closure of `domain/sessions.ts`
 // (`swapActiveSandbox` + `FleetContext`). apps/api re-imports these for its MCP

package/src/managed-auth-session-sets.ts

@@ -278,25 +278,48 @@ export async function authenticateAndAdoptManagedAuthSession(input: {
     credentials: { email: input.email, password: input.password },
     headers: input.isolatedHeaders,
   });
+  return await adoptManagedAuthSession({
+    ...input,
+    authorityHash: managedAuthSha256(input.authority),
+    transactionSecretHash: managedAuthSha256(input.transactionSecret),
+    authSessionId: created.authSessionId,
+  });
+}
+
+export async function adoptManagedAuthSession(input: {
+  db: Database;
+  adapter: ManagedAuthSessionAdapter;
+  authority: string;
+  authorityHash: string;
+  csrfHash: string;
+  operationId: string;
+  requestDigest: string;
+  expectedGeneration: string;
+  expectedActorEpoch: string;
+  transactionId: string;
+  transactionSecretHash: string;
+  authSessionId: string;
+  mode: ManagedAuthSessionSetMode;
+}): Promise<{ projection: ManagedAuthDatabaseProjection; returnIntent: string | null }> {
   let completed: { projection: ManagedAuthDatabaseProjection; returnIntent: string | null };
   try {
     completed = await completeManagedAuthLoginTransaction(input.db, {
-      authorityHash: managedAuthSha256(input.authority),
+      authorityHash: input.authorityHash,
       csrfHash: input.csrfHash,
       operationId: input.operationId,
       requestDigest: input.requestDigest,
       expectedGeneration: input.expectedGeneration,
       expectedActorEpoch: input.expectedActorEpoch,
       transactionId: input.transactionId,
-      transactionSecretHash: managedAuthSha256(input.transactionSecret),
-      authSessionId: created.authSessionId,
+      transactionSecretHash: input.transactionSecretHash,
+      authSessionId: input.authSessionId,
       mode: input.mode,
     });
   } catch (error) {
     let receipt: Awaited<ReturnType<typeof getManagedAuthSessionSetOperationReceipt>>;
     try {
       receipt = await getManagedAuthSessionSetOperationReceipt(input.db, {
-        authorityHash: managedAuthSha256(input.authority),
+        authorityHash: input.authorityHash,
         operationId: input.operationId,
         requestDigest: input.requestDigest,
       });
@@ -304,14 +327,16 @@ export async function authenticateAndAdoptManagedAuthSession(input: {
       throw new ManagedAuthCompletionOutcomeUnknownError({ cause: receiptError });
     }
     if (receipt) {
-      await reconcileCreatedManagedAuthSession(input, created.authSessionId);
+      await reconcileCreatedManagedAuthSession(input, input.authSessionId);
       return receipt;
     }
-    await input.adapter.revokeSession(created).catch(() => undefined);
+    await input.adapter
+      .revokeSession({ authSessionId: input.authSessionId })
+      .catch(() => undefined);
     throw error;
   }
   try {
-    await reconcileCreatedManagedAuthSession(input, created.authSessionId);
+    await reconcileCreatedManagedAuthSession(input, input.authSessionId);
   } catch (error) {
     throw new ManagedAuthCompletionOutcomeUnknownError({ cause: error });
   }
@@ -319,10 +344,12 @@ export async function authenticateAndAdoptManagedAuthSession(input: {
 }
 
 async function reconcileCreatedManagedAuthSession(
-  input: Pick<
-    Parameters<typeof authenticateAndAdoptManagedAuthSession>[0],
-    "db" | "adapter" | "authority" | "mode"
-  >,
+  input: {
+    db: Database;
+    adapter: ManagedAuthSessionAdapter;
+    authority: string;
+    mode: ManagedAuthSessionSetMode;
+  },
   authSessionId: string,
 ): Promise<void> {
   const snapshot = await getManagedAuthSessionSetSnapshot(input.db, {