@opengeni/db 4.4.0-canary.0 → 4.4.0-canary.2

package/src/connection-token-resolver.ts

@@ -17,6 +17,7 @@ import type {
   TurnInitiator,
   TurnInitiatorContext,
 } from "@opengeni/contracts";
+import { hostMcpCredentialUseGuard } from "@opengeni/contracts";
 import {
   ConnectionUseAuthoritySnapshot,
   type ConnectionUseAttribution,
@@ -48,6 +49,7 @@ import type {
   AcceptedConnectionUseResolution,
 } from "./connection-authority";
 import { connectionScopeKey } from "./connection-scopes";
+import { hostMcpBindingMatchesSelection } from "@opengeni/contracts/host-mcp-bindings";
 
 const MAX_CREDENTIAL_PLACEMENTS = 32;
 const MAX_CREDENTIAL_NAME_BYTES = 256;
@@ -193,6 +195,10 @@ export type HostMcpCredentialResolverContext = {
   /** Backend-owned live validator. Never populate from caller JSON or a host
    * credential response. Omission denies every explicit durable reference. */
   authorizeDurableBinding?: (request: McpCredentialsRequest) => Promise<boolean>;
+  /** Backend-only accepted-work lookup, not a host response or registry fallback. */
+  resolveAcceptedBinding?: (
+    request: McpCredentialsRequest,
+  ) => Promise<McpServerConnectionRef | null>;
 };
 
 export class HostMcpCredentialScopeError extends Error {
@@ -325,8 +331,8 @@ export function buildHostConnectionTokenResolver(
       ...(toolName ? { toolName } : {}),
       ...(input.subjectId ? { callerSubjectId: input.subjectId } : {}),
     };
-    const snapshot = structuredClone(request);
-    const requestedRef = structuredClone(input.connectionRef);
+    // Freeze configuration before any asynchronous authority lookup.
+    let requestedRef = structuredClone(request.connectionRef);
     const credentialTarget = input.credentialTarget ?? "mcp";
     const durableDenial = (
       reason: McpCredentialAuthNeededReason,
@@ -337,6 +343,32 @@ export function buildHostConnectionTokenResolver(
       authoritySource: "host",
       ...(requestedRef.connectionId ? { connectionId: requestedRef.connectionId } : {}),
     });
+    if (requestedRef.hostBinding && "selection" in requestedRef.hostBinding) {
+      if (!context.resolveAcceptedBinding || !context.authorizeDurableBinding)
+        return durableDenial("unsupported_auth");
+      try {
+        const concrete = await context.resolveAcceptedBinding(structuredClone(request));
+        if (!concrete?.hostBinding || "selection" in concrete.hostBinding)
+          return durableDenial("personal_authority_unavailable");
+        const { hostBinding, ...connectionRef } = concrete;
+        if (
+          !hostMcpBindingMatchesSelection(
+            {
+              id: hostBinding.bindingId,
+              generation: hostBinding.generation,
+              definition: { serverId: request.serverId, destinationUrl, connectionRef },
+            },
+            request,
+          )
+        )
+          return durableDenial("personal_authority_unavailable");
+        request.connectionRef = structuredClone(concrete);
+        requestedRef = structuredClone(concrete);
+      } catch {
+        return durableDenial("refresh_failed");
+      }
+    }
+    const snapshot = structuredClone(request);
     const authorized = async () => {
       try {
         if (
@@ -362,14 +394,27 @@ export function buildHostConnectionTokenResolver(
       if (denial) return durableDenial(denial);
     }
     const result = await resolve(structuredClone(snapshot));
+    const routeGuard = result.status === "ok" ? result[hostMcpCredentialUseGuard] : undefined;
+    const routeAuthorized = async () => {
+      try {
+        return routeGuard ? await routeGuard() : true;
+      } catch {
+        return false;
+      }
+    };
     if (requiresAuthorization) {
       const denial = await authorized();
       if (denial) return durableDenial(denial);
     }
+    if (routeGuard && !(await routeAuthorized())) return durableDenial("refresh_failed");
     assertHostMcpCredentialScope(result, context);
     const normalized = normalizeHostCredentialResolution(result, requestedRef, credentialTarget);
-    return normalized.status === "ok" && requiresAuthorization
-      ? { ...normalized, authorizeProviderRequest: async () => (await authorized()) === null }
+    return normalized.status === "ok" && (requiresAuthorization || routeGuard)
+      ? {
+          ...normalized,
+          authorizeProviderRequest: async () =>
+            (await authorized()) === null && (await routeAuthorized()),
+        }
       : normalized;
   };
 }
@@ -415,6 +460,14 @@ export function buildHostGatewayConnectionTokenResolver(
     await reauthorize();
     const result = await resolve(structuredClone(request));
     await reauthorize();
+    const routeGuard = result.status === "ok" ? result[hostMcpCredentialUseGuard] : undefined;
+    if (routeGuard) {
+      try {
+        if (!(await routeGuard())) return deny("refresh_failed");
+      } catch {
+        return deny("refresh_failed");
+      }
+    }
     for (const field of ["accountId", "workspaceId", "requestId"] as const) {
       if (result[field] !== request[field])
         throw new Error(`host gateway credential ${field} scope mismatch`);
@@ -430,7 +483,7 @@ export function buildHostGatewayConnectionTokenResolver(
       authorizeProviderRequest: async () => {
         try {
           await reauthorize();
-          return true;
+          return routeGuard ? await routeGuard() : true;
         } catch {
           return false;
         }
@@ -1548,6 +1601,15 @@ export async function refreshOAuthConnectionCredential(
   const expiresAt = expiresAtFromTokenResponse(payload, cred.expiresAt);
   const scopeText = stringValue(payload.scope);
   const returnedScopes = scopeText?.split(/[\s,]+/).filter(Boolean) ?? [];
+  // A successful Microsoft refresh proves offline access, although Microsoft
+  // reports only access-token permissions in the response's scope field.
+  if (
+    scopeText &&
+    ref.providerDomain.toLowerCase() === "graph.microsoft.com" &&
+    !returnedScopes.some((scope) => scope.toLowerCase() === "offline_access")
+  ) {
+    returnedScopes.push("offline_access");
+  }
   const refreshTokenExpiresIn =
     typeof payload.refresh_token_expires_in === "number"
       ? payload.refresh_token_expires_in
@@ -1574,7 +1636,14 @@ export async function refreshOAuthConnectionCredential(
       "Bearer",
     ...(expiresAt ? { expires_at: expiresAt.toISOString() } : {}),
     ...(resource ? { resource } : {}),
-    ...(scopeText ? { scope: scopeText } : {}),
+    ...(scopeText
+      ? {
+          scope:
+            ref.providerDomain.toLowerCase() === "graph.microsoft.com"
+              ? returnedScopes.join(" ")
+              : scopeText,
+        }
+      : {}),
     ...(refreshTokenExpiresAt ? { refresh_token_expires_at: refreshTokenExpiresAt } : {}),
     ...(clientSecret && !personalGitHub
       ? { client_secret: clientSecret, token_endpoint_auth_method: authMethod }

package/src/database.ts

@@ -53,6 +53,8 @@ export type RlsContext = {
 
 export type SessionRlsActorContext = {
   subjectId: string;
+  /** Host-verified personal file ownership, never a request-supplied subject. */
+  privateFileOwnerSubjectId?: string | null;
   initiatingHumanSubjectId?: string | null;
 };
 
@@ -74,6 +76,15 @@ export async function withSessionRlsActorContext<T>(
       "withSessionRlsActorContext: initiatingHumanSubjectId must be null or non-empty",
     );
   }
+  if (
+    actor.privateFileOwnerSubjectId !== undefined &&
+    actor.privateFileOwnerSubjectId !== null &&
+    !actor.privateFileOwnerSubjectId.trim()
+  ) {
+    throw new Error(
+      "withSessionRlsActorContext: privateFileOwnerSubjectId must be null or non-empty",
+    );
+  }
   return await sessionRlsActorContext.run(actor, fn);
 }
 
@@ -389,7 +400,7 @@ export async function setRlsContext(db: Database, context: RlsContext): Promise<
   if (sessionActor) {
     await setSubjectRlsContext(db, sessionActor.subjectId);
     await db.execute(
-      sql`select set_config(
+      sql`select set_config('opengeni.private_file_owner', ${sessionActor.privateFileOwnerSubjectId ?? ""}, true), set_config(
         'opengeni.initiating_human_subject_id',
         ${sessionActor.initiatingHumanSubjectId ?? ""},
         true

package/src/external-identities.ts

@@ -5,6 +5,7 @@ import {
   ExternalIdentityReference,
 } from "@opengeni/contracts/external-identities";
 import { rawRows, withAccountRls, type Database } from "./database";
+export * from "./external-membership-operations";
 
 /** Pass an open transaction to retain the key lock through the protected write. */
 export async function lockActiveExternalOrganizationKey(

package/src/external-membership-operations.ts

@@ -0,0 +1,134 @@
+import { sql } from "drizzle-orm";
+import { z } from "zod";
+import {
+  ExternalIdentity,
+  ExternalIdentityLookup,
+  CancelExternalWorkspaceMemberGrantResponse,
+  type AddExternalWorkspaceMemberRequest,
+  type CancelExternalWorkspaceMemberGrantRequest,
+  type ExternalIdentityReference,
+} from "@opengeni/contracts/external-identities";
+import {
+  rawRows,
+  withAccountRls,
+  withWorkspaceSubjectRls,
+  setSubjectRlsContext,
+  type Database,
+} from "./database";
+import { grantWorkspaceAccess, listWorkspaceMembers } from "./workspace-membership-access";
+import { removeWorkspaceMember } from "./organization-membership-lifecycle";
+
+type ServiceScope = { organizationId: string; actorSubjectId: string };
+
+export async function lookupExternalIdentity(
+  db: Database,
+  scope: ServiceScope,
+  identity: ExternalIdentityReference,
+) {
+  return withAccountRls(db, scope.organizationId, async (tx) => {
+    await setSubjectRlsContext(tx, scope.actorSubjectId);
+    const [row] = await rawRows<{ result: unknown }>(
+      tx,
+      sql`select lookup_external_identity(
+      ${scope.organizationId}::uuid, ${scope.actorSubjectId}, ${identity.source}, ${identity.externalId}
+    ) as result`,
+    );
+    return ExternalIdentityLookup.parse(row?.result);
+  });
+}
+
+async function prepare(db: Database, command: Record<string, unknown>) {
+  const [row] = await rawRows<{ result: unknown }>(
+    db,
+    sql`select prepare_external_workspace_membership_operation(${JSON.stringify(command)}::jsonb) as result`,
+  );
+  return z
+    .object({
+      replay: z.boolean(),
+      result: z.unknown().optional(),
+      identity: z.unknown().optional(),
+    })
+    .parse(row?.result);
+}
+
+async function record(db: Database, command: Record<string, unknown>, result: unknown) {
+  await db.execute(sql`select record_external_workspace_membership_operation(
+    ${JSON.stringify(command)}::jsonb, ${JSON.stringify(result)}::jsonb)`);
+}
+
+/** One keyed grant. An operation replay never restores a removed/reduced row. */
+export async function addExternalWorkspaceMemberOperation(
+  db: Database,
+  scope: ServiceScope & { workspaceId: string },
+  request: AddExternalWorkspaceMemberRequest & { operationId: string },
+) {
+  const command = {
+    ...scope,
+    action: "grant",
+    ...request,
+    permissions: [...new Set(request.permissions)].sort(),
+  };
+  return withWorkspaceSubjectRls(db, scope.workspaceId, scope.actorSubjectId, async (tx) => {
+    const prepared = await prepare(tx, command);
+    if (prepared.replay)
+      return z.object({ identity: ExternalIdentity }).parse(prepared.result).identity;
+    const identity = ExternalIdentity.parse(prepared.identity);
+    const existing = (await listWorkspaceMembers(tx, scope.workspaceId)).find(
+      (member) => member.subjectId === identity.subjectId,
+    );
+    if (
+      existing &&
+      (existing.permissions.length !== command.permissions.length ||
+        existing.permissions.some((permission) => !command.permissions.includes(permission)))
+    ) {
+      // SQLSTATE matches the native optimistic-concurrency contract.
+      await tx.execute(
+        sql`do $$ begin raise exception 'existing membership differs' using errcode = '40001'; end $$`,
+      );
+    }
+    if (!existing)
+      await grantWorkspaceAccess(tx, {
+        accountId: scope.organizationId,
+        workspaceId: scope.workspaceId,
+        subjectId: identity.subjectId,
+        role: "member",
+        permissions: command.permissions,
+      });
+    await record(tx, command, { workspaceId: scope.workspaceId, identity });
+    return identity;
+  });
+}
+
+/** The native removal owns all teardown; this wrapper adds an immutable causal
+ * fence even when an earlier grant has not reached the database yet. */
+export async function cancelExternalWorkspaceMemberGrant(
+  db: Database,
+  scope: ServiceScope & { workspaceId: string; membershipId: string },
+  request: CancelExternalWorkspaceMemberGrantRequest,
+) {
+  const command = { ...scope, action: "revoke", ...request };
+  return withWorkspaceSubjectRls(db, scope.workspaceId, scope.actorSubjectId, async (tx) => {
+    const prepared = await prepare(tx, command);
+    if (prepared.replay) {
+      const stored = z
+        .object({ removed: z.boolean(), fencedGrantOperationId: z.string().uuid() })
+        .parse(prepared.result);
+      return CancelExternalWorkspaceMemberGrantResponse.parse({ ...stored, replay: true });
+    }
+    const identity = z.object({ subjectId: z.string() }).parse(prepared.identity);
+    const removed = await removeWorkspaceMember(tx, {
+      accountId: scope.organizationId,
+      workspaceId: scope.workspaceId,
+      actorSubjectId: scope.actorSubjectId,
+      targetSubjectId: identity.subjectId,
+      operationId: request.operationId,
+    });
+    const result = {
+      removed,
+      replay: false,
+      fencedGrantOperationId: request.cancelGrantOperationId,
+    };
+    await record(tx, command, { ...result, workspaceId: scope.workspaceId });
+    return result;
+  });
+}

package/src/governed-learning-evaluator.ts

@@ -1,10 +1,6 @@
 import {
-  EvaluateGovernedLearningProposalRequest,
   GovernedLearningDecisionReceipt,
-  GovernedLearningEvaluationAttempt,
   type GovernedLearningDecisionReceipt as GovernedLearningDecisionReceiptType,
-  type GovernedLearningEvaluationAttempt as GovernedLearningEvaluationAttemptType,
-  type EvaluateGovernedLearningProposalRequest as EvaluateGovernedLearningProposalRequestType,
 } from "@opengeni/contracts";
 import { sql } from "drizzle-orm";
 import type { Database } from "./database";
@@ -15,15 +11,6 @@ export class GovernedLearningEvaluationAuthorityError extends Error {
   readonly name = "GovernedLearningEvaluationAuthorityError";
 }
 
-export class GovernedLearningEvaluationConflictError extends Error {
-  readonly name = "GovernedLearningEvaluationConflictError";
-}
-
-export type GovernedLearningEvaluationInput = Readonly<{
-  attempt: GovernedLearningEvaluationAttemptType;
-  request: EvaluateGovernedLearningProposalRequestType;
-}>;
-
 type ReceiptRow = {
   receipt_id: string;
   operation_id: string;
@@ -159,59 +146,3 @@ export async function listGovernedLearningDecisionReceipts(
     throw error;
   }
 }
-
-/**
- * Persist one inert, content-free governed-learning decision. The database
- * capability independently revalidates the accepted attempt, policy snapshot,
- * proposal lineage, current evidence authority, and deterministic verdict.
- */
-export async function evaluateGovernedLearningProposal(
-  db: Database,
-  input: GovernedLearningEvaluationInput,
-): Promise<GovernedLearningDecisionReceiptType> {
-  const attempt = GovernedLearningEvaluationAttempt.parse(input.attempt);
-  const request = EvaluateGovernedLearningProposalRequest.parse(input.request);
-  try {
-    return await withWorkspaceSubjectRls(
-      db,
-      attempt.workspaceId,
-      attempt.subjectId,
-      async (scopedDb) => {
-        const rows = await rawRows<ReceiptRow>(
-          scopedDb,
-          sql`SELECT * FROM evaluate_governed_learning_proposal(
-            current_setting('opengeni.account_id')::uuid,
-            ${attempt.workspaceId}::uuid,
-            ${attempt.sessionId}::uuid,
-            ${attempt.turnId}::uuid,
-            ${attempt.attemptId}::uuid,
-            ${attempt.executionGeneration}::integer,
-            ${request.operationId}::uuid,
-            ${request.policySnapshotId}::uuid,
-            ${request.proposalId}::uuid,
-            ${request.claimId}::uuid,
-            ${request.evidenceId}::uuid
-          )`,
-        );
-        const row = rows[0];
-        if (!row || rows.length !== 1) {
-          throw new Error("Governed-learning evaluation returned no unique receipt");
-        }
-        return receiptFromRow(row);
-      },
-    );
-  } catch (error) {
-    const state = nestedPostgresSqlState(error);
-    if (state === "42501") {
-      throw new GovernedLearningEvaluationAuthorityError(
-        "Governed-learning proposal evaluation is unavailable",
-      );
-    }
-    if (state === "23505" || state === "40001") {
-      throw new GovernedLearningEvaluationConflictError(
-        "Governed-learning proposal evaluation conflicted",
-      );
-    }
-    throw error;
-  }
-}

package/src/host-mcp-binding-match.ts

@@ -14,6 +14,7 @@ export function hostMcpBindingMatchesRequest(
   const { hostBinding, ...connectionRef } = request.connectionRef;
   if (
     !hostBinding ||
+    "selection" in hostBinding ||
     binding.status !== "active" ||
     binding.revokedAt !== null ||
     binding.id !== hostBinding.bindingId ||

package/src/host-mcp-bindings.ts

@@ -10,6 +10,7 @@ import {
   IssueHostMcpDelegationRequest,
   HostMcpAcceptedAuthority,
   HostMcpOwnerSubject,
+  hostMcpBindingMatchesSelection,
 } from "@opengeni/contracts/host-mcp-bindings";
 import { rawRows, withWorkspaceSubjectRls, type Database } from "./database";
 import { listSelfOrganizationMemberships } from "./organization-membership-lifecycle";
@@ -732,10 +733,14 @@ async function resolveDirectHostMcpUseAuthority(
       (delegation.grant.mode === "session" &&
         (delegation.grant.sessionId !== request.sessionId ||
           delegation.grant.expectedAuthorityEpoch !== a.targetSessionAuthorityEpoch)) ||
+      binding.status !== "active" ||
+      binding.revokedAt !== null ||
       binding.authorizationRevision !== a.ownerMembershipAuthorizationRevision ||
       binding.generation !== a.bindingGeneration ||
       stableJson(binding.definition) !== stableJson(a.definition) ||
-      !hostMcpBindingMatchesRequest(binding, request)
+      !(request.connectionRef.hostBinding && "selection" in request.connectionRef.hostBinding
+        ? request.credentialTarget === "mcp" && hostMcpBindingMatchesSelection(binding, request)
+        : hostMcpBindingMatchesRequest(binding, request))
     )
       return false;
     const live = await getHostMcpLiveAttempt(
@@ -752,3 +757,21 @@ async function resolveDirectHostMcpUseAuthority(
     );
   });
 }
+
+/** Resolve a configuration selector from the exact live accepted turn, never
+ * registry inventory or session creator metadata. The broker still revalidates
+ * the resulting concrete reference around resolution and every physical use. */
+export async function resolveAcceptedHostMcpBinding(
+  db: Database,
+  request: McpCredentialsRequest,
+): Promise<McpCredentialsRequest["connectionRef"] | null> {
+  if (!request.connectionRef.hostBinding || !("selection" in request.connectionRef.hostBinding))
+    return null;
+  const authority = await resolveDirectHostMcpUseAuthority(db, request);
+  return authority
+    ? {
+        ...authority.definition.connectionRef,
+        hostBinding: { bindingId: authority.bindingId, generation: authority.bindingGeneration },
+      }
+    : null;
+}