@opengeni/core 2.7.5-canary.2 → 2.7.5-canary.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "2.7.5-canary.2",
+  "version": "2.7.5-canary.4",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -54,17 +54,17 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/capabilities": "^0.3.2-canary.2",
-    "@opengeni/codex": "^0.2.21-canary.2",
-    "@opengeni/config": "^1.0.0-canary.2",
-    "@opengeni/contracts": "^2.13.0-canary.2",
-    "@opengeni/db": "^4.0.0-canary.2",
-    "@opengeni/documents": "^0.8.19-canary.2",
-    "@opengeni/events": "^0.4.17-canary.2",
-    "@opengeni/network": "^0.3.0-canary.2",
-    "@opengeni/observability": "^0.8.19-canary.2",
-    "@opengeni/runtime": "^2.3.0-canary.2",
-    "@opengeni/storage": "^0.2.120-canary.2",
+    "@opengeni/capabilities": "^0.3.2-canary.4",
+    "@opengeni/codex": "^0.2.21-canary.4",
+    "@opengeni/config": "^1.0.0-canary.4",
+    "@opengeni/contracts": "^2.13.0-canary.4",
+    "@opengeni/db": "^4.0.0-canary.4",
+    "@opengeni/documents": "^0.8.19-canary.4",
+    "@opengeni/events": "^0.4.17-canary.4",
+    "@opengeni/network": "^0.3.0-canary.4",
+    "@opengeni/observability": "^0.8.19-canary.4",
+    "@opengeni/runtime": "^2.3.0-canary.4",
+    "@opengeni/storage": "^0.2.120-canary.4",
     "hono": "^4.12.18",
     "zod": "^4.2.1"
   },

package/src/access/index.ts

@@ -12,6 +12,7 @@ import {
   findActiveApiKeyByHash,
   getWorkspaceGrant,
   requireWorkspace,
+  resolveNamedManagedPersonalWorkspaceGrant,
   type Database,
 } from "@opengeni/db";
 import type { Context } from "hono";
@@ -309,6 +310,35 @@ export async function requireAccessGrantAuthorization(
   return await accessGrantAuthorization(context, deps, workspaceId, permission);
 }
 
+/**
+ * Settings administration is narrower than workspace administration. The
+ * canonical managed-cookie owner may configure their Personal workspace, but
+ * never acquires the admin wildcard (and its membership/delegation powers).
+ * Only use this boundary for workspace configuration, not access management.
+ */
+export async function requireWorkspaceSettingsGrant(
+  c: Context,
+  deps: AccessDeps,
+  workspaceId: string,
+): Promise<AccessGrant> {
+  const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+  const grant = requireResolvedAccessGrantAuthorization(authorization, workspaceId);
+  if (hasPermission(grant.permissions, "workspace:admin")) return grant;
+  if (
+    authorization.canonicalManagedHumanSession &&
+    (await resolveNamedManagedPersonalWorkspaceGrant(deps.db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: authorization.authenticatedSubjectId,
+    }))
+  ) {
+    return grant;
+  }
+  throw new HTTPException(403, {
+    message: "workspace settings require a workspace administrator or Personal workspace owner",
+  });
+}
+
 async function accessGrantAuthorization(
   context: AccessContext,
   deps: AccessDeps,

package/src/application/session-commands.ts

@@ -28,6 +28,7 @@ import {
   moveQueuedTurnInTransaction,
   mutateSessionControlInTransaction,
   mutateWorkspaceControlInTransaction,
+  setWorkspacePauseTimerInTransaction,
   projectEffectiveControlForRelatedAccess,
   runIdempotentPersistenceTransaction,
   saveComposerDraftInTransaction,
@@ -1065,3 +1066,34 @@ export async function saveHumanComposerDraft(
   );
   return composerDraft(row)!;
 }
+
+export async function controlHumanWorkspaceTimer(
+  deps: Parameters<typeof controlHumanWorkspace>[0],
+  context: Parameters<typeof controlHumanWorkspace>[1],
+  input: import("@opengeni/contracts").WorkspacePauseTimerRequest,
+): Promise<void> {
+  const result = await withWorkspaceRls(deps.db, context.workspaceId, (scoped) =>
+    scoped.transaction((tx) =>
+      setWorkspacePauseTimerInTransaction(tx as unknown as Database, {
+        ...input,
+        ...context,
+      }),
+    ),
+  );
+  scheduleSessionCommandPostCommit(deps, "human_workspace_timer", [
+    ...(result.workspaceControlEventId
+      ? [
+          {
+            kind: "workspace_control_fanout" as const,
+            run: async () =>
+              await publishWorkspaceControlEvent(
+                deps,
+                context.workspaceId,
+                result.workspaceControlEventId!,
+              ),
+          },
+        ]
+      : []),
+    { kind: "workflow_wake" as const, run: async () => await requestControlWakeDispatch(deps, 1) },
+  ]);
+}