@opengeni/core 2.8.3 → 2.9.3-canary.0

package/src/application/external-workspace-members.ts

@@ -0,0 +1,95 @@
+import type { Context } from "hono";
+import { HTTPException } from "hono/http-exception";
+import {
+  AddExternalWorkspaceMemberRequest,
+  type ExternalIdentity,
+} from "@opengeni/contracts/external-identities";
+import {
+  ensureExternalIdentity,
+  grantWorkspaceAccess,
+  listWorkspaceMembers,
+  lockExternalWorkspaceMembershipLifecycle,
+  requireWorkspace,
+  setRlsContext,
+  withWorkspaceSubjectRls,
+} from "@opengeni/db";
+import {
+  accountScopedApiKeyWorkspaceAuthority,
+  hasPermission,
+  requireAccessContext,
+  requireFreshAccessGrant,
+  type AccessDeps,
+} from "../access";
+
+/** Explicit host onboarding. Ordinary asUser reads never call this operation.
+ * Existing memberships are not overwritten, including reduced permissions. */
+export async function addExternalWorkspaceMemberForRequest(
+  c: Context,
+  deps: AccessDeps,
+  workspaceId: string,
+  input: unknown,
+): Promise<ExternalIdentity> {
+  const payload = AddExternalWorkspaceMemberRequest.parse(input);
+  const context = await requireAccessContext(c, deps);
+  const authority = accountScopedApiKeyWorkspaceAuthority(context);
+  if (!authority)
+    throw new HTTPException(403, {
+      message: "external onboarding requires an organization service key",
+    });
+  const grant = await requireFreshAccessGrant(c, deps, workspaceId, "members:manage");
+  if (
+    grant.accountId !== authority.accountId ||
+    payload.permissions.some((permission) => !hasPermission(grant.permissions, permission))
+  ) {
+    throw new HTTPException(403, { message: "membership exceeds key authority" });
+  }
+  return withWorkspaceSubjectRls(deps.db, workspaceId, grant.subjectId, async (tx) => {
+    await lockExternalWorkspaceMembershipLifecycle(tx, grant.accountId);
+    const live = await requireFreshAccessGrant(
+      c,
+      { ...deps, db: tx },
+      workspaceId,
+      "members:manage",
+    );
+    if (
+      live.accountId !== grant.accountId ||
+      live.subjectId !== grant.subjectId ||
+      payload.permissions.some((permission) => !hasPermission(live.permissions, permission))
+    ) {
+      throw new HTTPException(403, { message: "membership authority changed" });
+    }
+    const workspace = await requireWorkspace(tx, workspaceId);
+    if (workspace.kind !== "shared" || workspace.accountId !== authority.accountId)
+      throw new HTTPException(403, {
+        message: "external onboarding requires a shared organization workspace",
+      });
+    const identity = await ensureExternalIdentity(tx, {
+      accountId: authority.accountId,
+      ...payload.identity,
+    });
+    await setRlsContext(tx, { accountId: authority.accountId, workspaceId });
+    const existing = (await listWorkspaceMembers(tx, workspaceId)).find(
+      (member) => member.subjectId === identity.subjectId,
+    );
+    const permissions = [...new Set(payload.permissions)];
+    if (existing) {
+      if (
+        existing.permissions.length !== permissions.length ||
+        existing.permissions.some((permission) => !permissions.includes(permission))
+      ) {
+        throw new HTTPException(409, {
+          message: "existing membership differs; onboarding does not overwrite permissions",
+        });
+      }
+      return identity;
+    }
+    await grantWorkspaceAccess(tx, {
+      accountId: authority.accountId,
+      workspaceId,
+      subjectId: identity.subjectId,
+      role: "member",
+      permissions,
+    });
+    return identity;
+  });
+}

package/src/application/host-mcp-owner.ts

@@ -0,0 +1,41 @@
+import { HTTPException } from "hono/http-exception";
+import { resolveHostMcpBindingOwner, type Database } from "@opengeni/db";
+import {
+  externalActorContinuationForAuthorization,
+  hasPermission,
+  hasVerifiedOwningUserAuthorization,
+  requireResolvedAccessGrantAuthorization,
+  type AccessGrantAuthorization,
+} from "../access";
+import { requireConnectOwnerAuthority } from "./connect-authority";
+
+/** Direct user admission only. Agents inherit exact accepted snapshots instead.
+ * Native and externally represented users share owner semantics; service keys
+ * cannot impersonate a human owner merely by naming a subject. */
+export function prepareHostMcpOwnerAuthorization(
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+  permission: "connections:read" | "connections:write",
+) {
+  const grant = requireResolvedAccessGrantAuthorization(authorization, workspaceId);
+  if (
+    !hasVerifiedOwningUserAuthorization(authorization) ||
+    grant.metadata?.sessionId ||
+    !hasPermission(grant.permissions, permission)
+  )
+    throw new HTTPException(403, {
+      message: "Host binding requires verified owning-user authority",
+    });
+  const continuation = externalActorContinuationForAuthorization(authorization);
+  const scope = {
+    accountId: grant.accountId,
+    workspaceId,
+    subjectId: grant.subjectId,
+    personalOwnerVerified: authorization.canonicalManagedHumanSession,
+    ...(continuation ? { externalContinuation: continuation } : {}),
+  };
+  return async (tx: Database) => {
+    await requireConnectOwnerAuthority(tx, scope, permission);
+    return resolveHostMcpBindingOwner(tx, scope);
+  };
+}

package/src/application/new-session-drafts.ts

@@ -29,7 +29,11 @@ import {
   validateGitHubRepositorySelection,
   validateToolRefs,
 } from "../domain/resources";
-import { hasPermission } from "../access";
+import {
+  hasPermission,
+  externalAttributionForAuthorization,
+  type AccessGrantAuthorization,
+} from "../access";
 import { assertConfiguredModel, assertWorkspaceModelPolicyAllows } from "../domain/sessions";
 
 type NewSessionDraftDependencies = Pick<AppDependencies, "settings" | "db" | "objectStorage">;
@@ -227,6 +231,7 @@ export async function saveActorNewSessionDraft(
    * the historical bare-membership fence.
    */
   canonicalManagedHumanSession = false,
+  externalAuthorization?: AccessGrantAuthorization,
 ): Promise<NewSessionDraftValue> {
   const input = SaveNewSessionDraftRequest.parse(rawInput);
   // The pre-marker client contract required `tools` and had no
@@ -280,7 +285,9 @@ export async function saveActorNewSessionDraft(
           // all, so the human-removal fence above must fall back to the
           // organization-membership pointer for them — and only for the
           // canonical managed-cookie session that owns it.
-          personalWorkspaceOwnerException: canonicalManagedHumanSession,
+          personalWorkspaceOwnerException:
+            canonicalManagedHumanSession ||
+            externalAttributionForAuthorization(externalAuthorization, grant) !== null,
         }),
       ),
     );

package/src/application/session-tenancy.ts

@@ -26,10 +26,15 @@ import {
   type ForkSessionContentResult,
 } from "@opengeni/db";
 import { publishDurableSessionEvents, type EventBus } from "@opengeni/events";
-import { requirePermission, type AccessGrantAuthorization } from "../access";
+import {
+  requirePermission,
+  hasVerifiedOwningUserAuthorization,
+  type AccessGrantAuthorization,
+} from "../access";
 import { requireSessionAuthorization } from "../session-authorization";
 import type { AppDependencies } from "../dependencies";
 import { validateVariableSetAttachment } from "../domain/environments";
+import { externalContinuationCommitAuthorizer } from "./external-continuation";
 
 type SessionTenancyDependencies = Pick<
   AppDependencies,
@@ -64,6 +69,18 @@ export function requireCanonicalManagedHuman(
   }
 }
 
+export function requireVerifiedOwningUser(
+  authorization: AccessGrantAuthorization,
+  workspaceId: string,
+): void {
+  if (
+    !hasVerifiedOwningUserAuthorization(authorization) ||
+    authorization.grant.workspaceId !== workspaceId
+  ) {
+    throw new SessionTenancyManagedHumanRequiredError();
+  }
+}
+
 export async function getManagedHumanSessionCreateCapabilities(
   deps: Pick<SessionTenancyDependencies, "db">,
   authorization: AccessGrantAuthorization,
@@ -71,7 +88,7 @@ export async function getManagedHumanSessionCreateCapabilities(
 ): Promise<SessionTenancyCreateCapabilities> {
   requirePermission(authorization.grant, "sessions:create");
   try {
-    requireCanonicalManagedHuman(authorization, workspaceId);
+    requireVerifiedOwningUser(authorization, workspaceId);
   } catch (error) {
     if (error instanceof SessionTenancyManagedHumanRequiredError) {
       return SessionTenancyCreateCapabilities.parse({
@@ -132,7 +149,7 @@ async function requireSessionTenancyMutationGate(
   // These checks are deliberately target-free. A rejected principal must not
   // cause a session lookup or embedding-host callback that distinguishes a
   // missing, shared, or another owner's private session.
-  requireCanonicalManagedHuman(authorization, workspaceId);
+  requireVerifiedOwningUser(authorization, workspaceId);
   for (const permission of permissions) requirePermission(authorization.grant, permission);
   if (!(await sessionTenancyProductActivated(deps.db, workspaceId))) {
     throw new SessionTenancyNotActivatedError();
@@ -234,6 +251,7 @@ export async function updateManagedHumanSessionVisibility(
   request: UpdateSessionVisibilityRequest,
   authorizationSurface: SessionAuthorizationSurface = "core",
 ): Promise<UpdateSessionVisibilityResponse> {
+  const beforeCommit = externalContinuationCommitAuthorizer(authorization);
   await requireSessionTenancyMutationGate(deps, authorization, workspaceId, ["sessions:control"]);
   await requireSessionAuthorization(deps, authorization.grant, {
     sessionId,
@@ -250,6 +268,7 @@ export async function updateManagedHumanSessionVisibility(
         targetVisibility: sessionVisibilityFromPublic(request.visibility),
         expectedAuthorityEpoch: request.expectedAuthorityEpoch,
         operationKey: request.idempotencyKey,
+        ...(beforeCommit ? { beforeCommit } : {}),
       }),
   );
   const response = UpdateSessionVisibilityResponse.parse({
@@ -284,6 +303,7 @@ export async function forkManagedHumanSession(
     "sessions:read",
     "sessions:create",
   ]);
+  const beforeCommit = externalContinuationCommitAuthorizer(authorization);
   const forkInput = {
     sourceWorkspaceId: workspaceId,
     sourceSessionId,
@@ -294,6 +314,7 @@ export async function forkManagedHumanSession(
       request.visibility === "private" ? ("user_private" as const) : ("workspace_shared" as const),
     workspaceSharedAcknowledged: request.workspaceSharedAcknowledged,
     operationKey: request.idempotencyKey,
+    ...(beforeCommit ? { beforeCommit } : {}),
     ...(request.rigId !== undefined || request.variableSetIds !== undefined
       ? {
           runtimeRequest: {

package/src/application/user-resource-grants.ts

@@ -16,7 +16,7 @@ import { requirePermission, type AccessGrantAuthorization } from "../access";
 import type { AppDependencies } from "../dependencies";
 import { requireSessionAuthorization } from "../session-authorization";
 import {
-  requireCanonicalManagedHuman,
+  requireVerifiedOwningUser,
   SessionTenancyManagedHumanRequiredError,
 } from "./session-tenancy";
 
@@ -58,7 +58,7 @@ function requireOwnerAuthority(
   permissions: readonly Permission[],
 ): void {
   if (!authorization.canonicalLocalHumanSession) {
-    requireCanonicalManagedHuman(authorization, workspaceId);
+    requireVerifiedOwningUser(authorization, workspaceId);
   } else if (
     !authorization.contextIntegrity ||
     authorization.authenticatedSubjectId !== authorization.grant.subjectId ||

package/src/dependencies.ts

@@ -208,6 +208,8 @@ export type AppDependencies = {
   fikenFetch?: typeof fetch;
   /** Injectable Integration Definition OAuth/API transport for deterministic tests. */
   apiIntegrationOAuthFetch?: typeof fetch;
+  /** Injectable specification/introspection transport, still network-policy checked. */
+  apiIntegrationSourceFetch?: typeof fetch;
   atlassianFetch?: typeof fetch;
   /** Injectable MCP OAuth setup deadline for deterministic stalled-provider tests. */
   oauthStartDeadlineMs?: number;

package/src/domain/capabilities.ts

@@ -231,7 +231,7 @@ export async function createCatalogItem(input: {
   });
 }
 
-export async function enableCapability(input: {
+type EnableCapabilityInput = {
   db: Database;
   grant: AccessGrant;
   accountId: string;
@@ -240,13 +240,28 @@ export async function enableCapability(input: {
   capabilityId: string;
   payload: EnableCapabilityRequest;
   probeMcpServer?: McpCapabilityProbe;
-}): Promise<CapabilityInstallation> {
+};
+
+export async function enableCapability(
+  input: EnableCapabilityInput,
+): Promise<CapabilityInstallation> {
+  const prepared = await prepareCapabilityEnable(input);
+  return prepared.commit(input.db);
+}
+
+/** Probe outside a durable Connect commit; persist the exact prepared settings
+ * inside the caller's authorized receipt transaction. Native enable uses this too. */
+export async function prepareCapabilityEnable(input: EnableCapabilityInput) {
   const item = await requireCatalogItem(
     input.db,
     input.workspaceId,
     input.settings,
     input.capabilityId,
   );
+  if (isReservedCodexAppsCatalogItem(item))
+    throw new HTTPException(422, {
+      message: "Codex Apps use the dedicated account designation flow",
+    });
   if (item.kind === "skill") {
     throw new HTTPException(409, {
       message: "Install Skills through the Skill library or source import flow",
@@ -303,14 +318,15 @@ export async function enableCapability(input: {
       );
     }
   }
-  return await enableCapabilityInstallation(input.db, {
+  const installation = {
     accountId: input.accountId,
     workspaceId: input.workspaceId,
     capabilityId: item.id,
     kind: item.kind,
     config: installationConfig,
     metadata: installationMetadata,
-  });
+  };
+  return { commit: (db: Database) => enableCapabilityInstallation(db, installation) };
 }
 
 /**

package/src/domain/external-creation-attribution.ts

@@ -0,0 +1,22 @@
+import type { AccessGrant } from "@opengeni/contracts";
+import { HTTPException } from "hono/http-exception";
+import { externalAttributionForAuthorization, type AccessGrantAuthorization } from "../access";
+
+export const EXTERNAL_CREATION_ATTRIBUTION_KEY = "opengeniExternalCreationAttribution";
+
+/** Retained alongside session.created metadata; this is not a live permission
+ * snapshot and must never authorize a follow-up, child, or scheduled turn. */
+export function externalCreationMetadata(
+  metadata: Record<string, unknown> | undefined,
+  authorization: AccessGrantAuthorization | undefined,
+  grant: AccessGrant,
+): Record<string, unknown> | undefined {
+  if (metadata && Object.hasOwn(metadata, EXTERNAL_CREATION_ATTRIBUTION_KEY)) {
+    throw new HTTPException(422, {
+      message: `${EXTERNAL_CREATION_ATTRIBUTION_KEY} is server-owned`,
+    });
+  }
+  const attribution = externalAttributionForAuthorization(authorization, grant);
+  if (!attribution) return metadata;
+  return { ...metadata, [EXTERNAL_CREATION_ATTRIBUTION_KEY]: attribution };
+}

package/src/domain/host-mcp-task-admission.ts

@@ -0,0 +1,111 @@
+import { HTTPException } from "hono/http-exception";
+import type { Settings } from "@opengeni/config";
+import type { ToolRef, ScheduledTask, AccessGrant } from "@opengeni/contracts";
+import {
+  HostMcpBindingDefinition,
+  HostMcpCreateSelections,
+} from "@opengeni/contracts/host-mcp-bindings";
+import {
+  captureHostMcpTaskAuthorities,
+  HostMcpDelegationAuthorityError,
+  inheritHostMcpTaskAuthoritiesFromAttempt,
+  type Database,
+} from "@opengeni/db";
+import { hasPermission, type AccessGrantAuthorization } from "../access";
+import { prepareHostMcpOwnerAuthorization } from "../application/host-mcp-owner";
+import { assertHostMcpAuthoritySourceAdmissionEnabled } from "./host-mcp-authority-source-admission";
+
+/** Internal closure, not a caller-provided callback or durable key dependency. */
+export function prepareHostMcpTaskAdmission(input: {
+  settings: Settings;
+  tools: ToolRef[];
+  grant: AccessGrant;
+  authorization?: AccessGrantAuthorization;
+  selections: unknown;
+}): (tx: Database, task: ScheduledTask) => Promise<void> {
+  const selections = HostMcpCreateSelections.parse(input.selections);
+  if (
+    !input.authorization ||
+    input.authorization.grant.accountId !== input.grant.accountId ||
+    input.authorization.grant.subjectId !== input.grant.subjectId ||
+    input.authorization?.grant.workspaceId !== input.grant.workspaceId ||
+    input.grant.metadata?.["sessionId"] ||
+    !hasPermission(input.authorization?.grant.permissions ?? [], "connections:read") ||
+    !hasPermission(input.grant.permissions, "connections:read")
+  )
+    throw new HTTPException(403, {
+      message: "Host task selection requires a verified owner",
+    });
+  const reauthorize = prepareHostMcpOwnerAuthorization(
+    input.authorization,
+    input.grant.workspaceId,
+    "connections:read",
+  );
+  const prepared = selections.map((selection) => {
+    const server = input.settings.mcpServers.find(
+      (candidate) => candidate.id === selection.serverId,
+    );
+    if (
+      !server?.url ||
+      server.connectionRef?.authoritySource !== "host" ||
+      !server.connectionRef.hostBinding ||
+      !input.tools.some((tool) => tool.kind === "mcp" && tool.id === selection.serverId)
+    )
+      throw new HTTPException(422, {
+        message: "Host task selection must match a selected configured server",
+      });
+    assertHostMcpAuthoritySourceAdmissionEnabled(input.settings, server.connectionRef);
+    const { hostBinding, ...connectionRef } = server.connectionRef;
+    return {
+      delegationId: selection.delegationId,
+      generation: selection.generation,
+      bindingId: hostBinding.bindingId,
+      bindingGeneration: hostBinding.generation,
+      definition: HostMcpBindingDefinition.parse({
+        serverId: selection.serverId,
+        destinationUrl: server.url,
+        connectionRef,
+      }),
+    };
+  });
+  return async (tx, task) => {
+    const owner = await reauthorize(tx);
+    try {
+      if (prepared.length) await captureHostMcpTaskAuthorities(tx, owner, task, prepared);
+    } catch (error) {
+      if (error instanceof HostMcpDelegationAuthorityError)
+        throw new HTTPException(403, { message: error.message });
+      throw error;
+    }
+  };
+}
+
+export function prepareInheritedHostMcpTaskAdmission(
+  settings: Settings,
+  tools: ToolRef[],
+  source: { sessionId: string; turnId: string; attemptId: string; executionGeneration: number },
+): (tx: Database, task: ScheduledTask) => Promise<void> {
+  const configured = settings.mcpServers.flatMap((server) => {
+    if (
+      !tools.some((tool) => tool.kind === "mcp" && tool.id === server.id) ||
+      server.connectionRef?.authoritySource !== "host" ||
+      !server.connectionRef.hostBinding ||
+      !server.url
+    )
+      return [];
+    assertHostMcpAuthoritySourceAdmissionEnabled(settings, server.connectionRef);
+    const { hostBinding, ...connectionRef } = server.connectionRef;
+    return [
+      {
+        bindingId: hostBinding.bindingId,
+        bindingGeneration: hostBinding.generation,
+        definition: HostMcpBindingDefinition.parse({
+          serverId: server.id,
+          destinationUrl: server.url,
+          connectionRef,
+        }),
+      },
+    ];
+  });
+  return (tx, task) => inheritHostMcpTaskAuthoritiesFromAttempt(tx, task, source, configured);
+}