@opengeni/core 2.7.5-canary.2 → 2.7.5-canary.4

package/dist/access/index.d.ts

@@ -91,6 +91,13 @@ export declare function requireCanonicalLocalAccountAdministrator(c: Context, de
     authorization: AccessGrantAuthorization;
 }>;
 export declare function requireAccessGrantAuthorization(c: Context, deps: AccessDeps, workspaceId: string, permission?: Permission): Promise<AccessGrantAuthorization>;
+/**
+ * Settings administration is narrower than workspace administration. The
+ * canonical managed-cookie owner may configure their Personal workspace, but
+ * never acquires the admin wildcard (and its membership/delegation powers).
+ * Only use this boundary for workspace configuration, not access management.
+ */
+export declare function requireWorkspaceSettingsGrant(c: Context, deps: AccessDeps, workspaceId: string): Promise<AccessGrant>;
 export declare function requirePermission(grant: AccessGrant, permission: Permission): void;
 /**
  * Require a permission to be present literally on the grant. This deliberately

package/dist/application/session-commands.d.ts

@@ -124,4 +124,5 @@ export declare function controlHumanWorkspace(deps: {
 } & SessionCommandPostCommitDeps, context: Omit<HumanSessionCommandContext, "sessionId">, input: WorkspaceInferenceControlRequest): Promise<WorkspaceInferenceControlResponse>;
 export declare function getHumanComposerDraft(deps: SessionAuthorizationCommandDeps, context: HumanSessionCommandContext): Promise<ComposerDraft>;
 export declare function saveHumanComposerDraft(deps: SessionAuthorizationCommandDeps, context: HumanSessionCommandContext, input: SaveComposerDraftRequest): Promise<ComposerDraft>;
+export declare function controlHumanWorkspaceTimer(deps: Parameters<typeof controlHumanWorkspace>[0], context: Parameters<typeof controlHumanWorkspace>[1], input: import("@opengeni/contracts").WorkspacePauseTimerRequest): Promise<void>;
 export {};

package/dist/index.js

@@ -1988,7 +1988,8 @@ import {
   ensureManagedAccessForUser,
   findActiveApiKeyByHash,
   getWorkspaceGrant,
-  requireWorkspace
+  requireWorkspace,
+  resolveNamedManagedPersonalWorkspaceGrant
 } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
 var bearerPrefix = "Bearer ";
@@ -2110,6 +2111,21 @@ async function requireAccessGrantAuthorization(c, deps, workspaceId, permission)
   const context = await requireAccessContext(c, deps);
   return await accessGrantAuthorization(context, deps, workspaceId, permission);
 }
+async function requireWorkspaceSettingsGrant(c, deps, workspaceId) {
+  const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+  const grant = requireResolvedAccessGrantAuthorization(authorization, workspaceId);
+  if (hasPermission(grant.permissions, "workspace:admin")) return grant;
+  if (authorization.canonicalManagedHumanSession && await resolveNamedManagedPersonalWorkspaceGrant(deps.db, {
+    accountId: grant.accountId,
+    workspaceId,
+    subjectId: authorization.authenticatedSubjectId
+  })) {
+    return grant;
+  }
+  throw new HTTPException(403, {
+    message: "workspace settings require a workspace administrator or Personal workspace owner"
+  });
+}
 async function accessGrantAuthorization(context, deps, workspaceId, permission) {
   const principalKind = hostedHumanSessionPrincipalKind(context);
   let grant = context.workspaceGrants.find((candidate) => candidate.workspaceId === workspaceId) ?? await getWorkspaceGrant(
@@ -15285,6 +15301,7 @@ import {
   moveQueuedTurnInTransaction,
   mutateSessionControlInTransaction,
   mutateWorkspaceControlInTransaction,
+  setWorkspacePauseTimerInTransaction,
   projectEffectiveControlForRelatedAccess,
   runIdempotentPersistenceTransaction as runIdempotentPersistenceTransaction2,
   saveComposerDraftInTransaction,
@@ -16015,6 +16032,31 @@ async function saveHumanComposerDraft(deps, context, input) {
   );
   return composerDraft(row);
 }
+async function controlHumanWorkspaceTimer(deps, context, input) {
+  const result = await withWorkspaceRls2(
+    deps.db,
+    context.workspaceId,
+    (scoped) => scoped.transaction(
+      (tx) => setWorkspacePauseTimerInTransaction(tx, {
+        ...input,
+        ...context
+      })
+    )
+  );
+  scheduleSessionCommandPostCommit(deps, "human_workspace_timer", [
+    ...result.workspaceControlEventId ? [
+      {
+        kind: "workspace_control_fanout",
+        run: async () => await publishWorkspaceControlEvent(
+          deps,
+          context.workspaceId,
+          result.workspaceControlEventId
+        )
+      }
+    ] : [],
+    { kind: "workflow_wake", run: async () => await requestControlWakeDispatch(deps, 1) }
+  ]);
+}
 
 // src/application/user-resource-grants.ts
 import {
@@ -16442,6 +16484,7 @@ export {
   controlHumanSessionWorkstream,
   controlHumanSessionWorkstreamWithOutcome,
   controlHumanWorkspace,
+  controlHumanWorkspaceTimer,
   conversationDeliveryNextAction,
   correctWorkspaceMemoryWithSlackPublication,
   createAndStartSession,
@@ -16661,6 +16704,7 @@ export {
   requireSessionAuthorizationListScope,
   requireVariableSetEncryption,
   requireVariableSetForApi,
+  requireWorkspaceSettingsGrant,
   resolveCapabilityPack,
   resolveCatalogSettings,
   resolveChildGoalFromAcceptedSnapshot,