@shipfox/api-agent 12.2.0 → 13.1.0

package/src/presentation/routes/delete-model-provider-config.ts

@@ -2,10 +2,18 @@ import {modelProviderRefSchema} from '@shipfox/api-agent-dto';
 import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
-import {deleteModelProviderConfig} from '#core/index.js';
+import {
+  assertWorkspaceProviderConfigurationEnabled,
+  deleteModelProviderConfig,
+} from '#core/index.js';
 import type {AgentSecretsClient} from '#core/secrets-client.js';
+import type {WorkspaceProviderPolicyOptions} from '#core/workspace-provider-policy.js';
+import {translateModelProviderRouteError} from './errors.js';
 
-export function createDeleteModelProviderConfigRoute(secrets: AgentSecretsClient) {
+export function createDeleteModelProviderConfigRoute(
+  secrets: AgentSecretsClient,
+  workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {workspaceProviders: 'enabled'},
+) {
   return defineRoute({
     method: 'DELETE',
     path: '/model-providers/:providerId',
@@ -19,9 +27,11 @@ export function createDeleteModelProviderConfigRoute(secrets: AgentSecretsClient
         204: z.void(),
       },
     },
+    errorHandler: translateModelProviderRouteError,
     handler: async (request, reply) => {
       const {workspaceId, providerId} = request.params;
       requireWorkspaceAccess({request, workspaceId});
+      assertWorkspaceProviderConfigurationEnabled(workspaceProviderPolicy);
 
       const deleted = await deleteModelProviderConfig({workspaceId, providerId}, {secrets});
       if (!deleted) {

package/src/presentation/routes/discover-custom-model-provider-models-by-slug.ts

@@ -7,13 +7,18 @@ import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {
+  assertWorkspaceProviderConfigurationEnabled,
   discoverCustomModelProviderModels,
   resolveCustomModelProviderDiscoveryParams,
 } from '#core/index.js';
 import type {AgentSecretsClient} from '#core/secrets-client.js';
+import type {WorkspaceProviderPolicyOptions} from '#core/workspace-provider-policy.js';
 import {translateModelProviderRouteError} from './errors.js';
 
-export function createDiscoverCustomModelProviderModelsBySlugRoute(secrets: AgentSecretsClient) {
+export function createDiscoverCustomModelProviderModelsBySlugRoute(
+  secrets: AgentSecretsClient,
+  workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {workspaceProviders: 'enabled'},
+) {
   return defineRoute({
     method: 'POST',
     path: '/custom-model-providers/:slug/discover-models',
@@ -32,6 +37,7 @@ export function createDiscoverCustomModelProviderModelsBySlugRoute(secrets: Agen
     handler: async (request) => {
       const {workspaceId, slug} = request.params;
       requireWorkspaceAccess({request, workspaceId});
+      assertWorkspaceProviderConfigurationEnabled(workspaceProviderPolicy);
 
       const discoveryParams = await resolveCustomModelProviderDiscoveryParams(
         {

package/src/presentation/routes/discover-custom-model-provider-models.ts

@@ -5,25 +5,37 @@ import {
 import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
-import {discoverCustomModelProviderModels} from '#core/index.js';
+import {
+  assertWorkspaceProviderConfigurationEnabled,
+  discoverCustomModelProviderModels,
+} from '#core/index.js';
+import type {WorkspaceProviderPolicyOptions} from '#core/workspace-provider-policy.js';
 import {translateModelProviderRouteError} from './errors.js';
 
-export const discoverCustomModelProviderModelsRoute = defineRoute({
-  method: 'POST',
-  path: '/custom-model-providers/discover-models',
-  description: 'Discover models exposed by a custom model provider endpoint',
-  schema: {
-    params: z.object({workspaceId: z.string().uuid()}),
-    body: discoverCustomModelProviderModelsBodySchema,
-    response: {
-      200: discoverCustomModelProviderModelsResponseSchema,
+export function createDiscoverCustomModelProviderModelsRoute(
+  workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {workspaceProviders: 'enabled'},
+) {
+  return defineRoute({
+    method: 'POST',
+    path: '/custom-model-providers/discover-models',
+    description: 'Discover models exposed by a custom model provider endpoint',
+    schema: {
+      params: z.object({workspaceId: z.string().uuid()}),
+      body: discoverCustomModelProviderModelsBodySchema,
+      response: {
+        200: discoverCustomModelProviderModelsResponseSchema,
+      },
+    },
+    errorHandler: translateModelProviderRouteError,
+    handler: async (request) => {
+      const {workspaceId} = request.params;
+      requireWorkspaceAccess({request, workspaceId});
+      assertWorkspaceProviderConfigurationEnabled(workspaceProviderPolicy);
+
+      return await discoverCustomModelProviderModels(request.body);
     },
-  },
-  errorHandler: translateModelProviderRouteError,
-  handler: async (request) => {
-    const {workspaceId} = request.params;
-    requireWorkspaceAccess({request, workspaceId});
+  });
+}
 
-    return await discoverCustomModelProviderModels(request.body);
-  },
-});
+export const discoverCustomModelProviderModelsRoute =
+  createDiscoverCustomModelProviderModelsRoute();

package/src/presentation/routes/errors.ts

@@ -12,6 +12,7 @@ import {
   ModelProviderConfigNotFoundError,
   ModelProviderValidationError,
   UnsupportedModelProviderError,
+  WorkspaceProvidersDisabledError,
 } from '#core/index.js';
 import {getModelProviderCredentialKeys} from '#core/model-provider-policy.js';
 
@@ -96,6 +97,16 @@ export function translateModelProviderRouteError(error: unknown): never {
     });
   }
 
+  if (error instanceof WorkspaceProvidersDisabledError) {
+    throw new ClientError(error.message, 'workspace-providers-disabled', {
+      status: 422,
+      details: {
+        managed_provider_id: error.managedProviderId,
+        message: error.message,
+      },
+    });
+  }
+
   if (error instanceof ModelProviderConfigNotFoundError) {
     throw new ClientError('Provider is not configured', 'provider-not-configured', {
       status: 422,

package/src/presentation/routes/index.ts

@@ -1,40 +1,58 @@
+import type {ManagedModelProvider, WorkspaceProvidersPolicy} from '@shipfox/api-agent-dto';
 import {AUTH_USER} from '@shipfox/api-auth-context';
 import type {RouteGroup} from '@shipfox/node-fastify';
 import type {AgentSecretsClient} from '#core/secrets-client.js';
+import type {WorkspaceProviderPolicyOptions} from '#core/workspace-provider-policy.js';
 import {createCustomModelProviderRoute} from './create-custom-model-provider.js';
 import {createDeleteModelProviderConfigRoute} from './delete-model-provider-config.js';
-import {discoverCustomModelProviderModelsRoute} from './discover-custom-model-provider-models.js';
+import {createDiscoverCustomModelProviderModelsRoute} from './discover-custom-model-provider-models.js';
 import {createDiscoverCustomModelProviderModelsBySlugRoute} from './discover-custom-model-provider-models-by-slug.js';
-import {listModelProviderCatalogRoute} from './list-model-provider-catalog.js';
+import {createListModelProviderCatalogRoute} from './list-model-provider-catalog.js';
 import {listModelProviderConfigsRoute} from './list-model-provider-configs.js';
 import {setDefaultHarnessRoute} from './set-default-harness.js';
-import {setDefaultModelProviderRoute} from './set-default-model-provider.js';
+import {createSetDefaultModelProviderRoute} from './set-default-model-provider.js';
 import {createUpdateCustomModelProviderRoute} from './update-custom-model-provider.js';
-import {updateModelProviderDefaultModelRoute} from './update-model-provider-default-model.js';
+import {createUpdateModelProviderDefaultModelRoute} from './update-model-provider-default-model.js';
 import {createUpsertModelProviderConfigRoute} from './upsert-model-provider-config.js';
 
-export function createAgentRoutes(secrets: AgentSecretsClient): RouteGroup[] {
+export function createAgentRoutes(
+  secrets: AgentSecretsClient,
+  options: {
+    managedProvider?: ManagedModelProvider | undefined;
+    workspaceProviders?: WorkspaceProvidersPolicy | undefined;
+  } = {},
+): RouteGroup[] {
+  const workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {
+    workspaceProviders: options.workspaceProviders ?? 'enabled',
+    managedProviderId: options.managedProvider?.id,
+  };
+
   return [
     {
       prefix: '/workspaces/:workspaceId/agent',
       auth: AUTH_USER,
       routes: [
         listModelProviderConfigsRoute,
-        createCustomModelProviderRoute(secrets),
-        discoverCustomModelProviderModelsRoute,
-        createDiscoverCustomModelProviderModelsBySlugRoute(secrets),
-        createUpdateCustomModelProviderRoute(secrets),
-        createUpsertModelProviderConfigRoute(secrets),
-        updateModelProviderDefaultModelRoute,
-        createDeleteModelProviderConfigRoute(secrets),
+        createCustomModelProviderRoute(secrets, workspaceProviderPolicy),
+        createDiscoverCustomModelProviderModelsRoute(workspaceProviderPolicy),
+        createDiscoverCustomModelProviderModelsBySlugRoute(secrets, workspaceProviderPolicy),
+        createUpdateCustomModelProviderRoute(secrets, workspaceProviderPolicy),
+        createUpsertModelProviderConfigRoute(secrets, workspaceProviderPolicy),
+        createUpdateModelProviderDefaultModelRoute(workspaceProviderPolicy),
+        createDeleteModelProviderConfigRoute(secrets, workspaceProviderPolicy),
         setDefaultHarnessRoute,
-        setDefaultModelProviderRoute,
+        createSetDefaultModelProviderRoute(workspaceProviderPolicy),
       ],
     },
     {
       prefix: '/agent',
       auth: AUTH_USER,
-      routes: [listModelProviderCatalogRoute],
+      routes: [
+        createListModelProviderCatalogRoute({
+          managedProvider: options.managedProvider,
+          workspaceProviders: options.workspaceProviders,
+        }),
+      ],
     },
   ];
 }

package/src/presentation/routes/list-model-provider-catalog.ts

@@ -1,15 +1,36 @@
-import {modelProviderCatalogResponseSchema} from '@shipfox/api-agent-dto';
+import {
+  type ManagedModelProvider,
+  modelProviderCatalogResponseSchema,
+  type WorkspaceProvidersPolicy,
+} from '@shipfox/api-agent-dto';
 import {defineRoute} from '@shipfox/node-fastify';
 import {buildModelProviderCatalog} from '#core/index.js';
 
-export const listModelProviderCatalogRoute = defineRoute({
-  method: 'GET',
-  path: '/model-provider-catalog',
-  description: 'List available model providers and models',
-  schema: {
-    response: {
-      200: modelProviderCatalogResponseSchema,
+export function createListModelProviderCatalogRoute(
+  options: {
+    managedProvider?: ManagedModelProvider | undefined;
+    workspaceProviders?: WorkspaceProvidersPolicy | undefined;
+  } = {},
+) {
+  const workspaceProviders = options.workspaceProviders ?? 'enabled';
+
+  return defineRoute({
+    method: 'GET',
+    path: '/model-provider-catalog',
+    description: 'List available model providers and models',
+    schema: {
+      response: {
+        200: modelProviderCatalogResponseSchema,
+      },
     },
-  },
-  handler: () => ({providers: buildModelProviderCatalog()}),
-});
+    handler: () => ({
+      providers: buildModelProviderCatalog({
+        managedProvider: options.managedProvider,
+        workspaceProviders,
+      }),
+      workspace_providers: workspaceProviders,
+    }),
+  });
+}
+
+export const listModelProviderCatalogRoute = createListModelProviderCatalogRoute();

package/src/presentation/routes/model-provider-catalog.test.ts

@@ -1,7 +1,8 @@
+import type {ManagedModelProvider} from '@shipfox/api-agent-dto';
 import {AUTH_USER, buildUserContext, setUserContext} from '@shipfox/api-auth-context';
 import type {AuthMethod, FastifyRequest} from '@shipfox/node-fastify';
 import {ClientError, closeApp, createApp} from '@shipfox/node-fastify';
-import {agentRoutes} from './index.js';
+import {agentRoutes, createAgentRoutes} from './index.js';
 
 const fakeUserAuth: AuthMethod = {
   name: AUTH_USER,
@@ -69,5 +70,52 @@ describe('model provider catalog route', () => {
         }
       }
     });
+
+    it('returns only the managed provider and the disabled policy when configured', async () => {
+      await closeApp();
+      app = await createApp({
+        auth: [fakeUserAuth],
+        routes: createAgentRoutes(undefined as never, {
+          managedProvider: managedProvider(),
+          workspaceProviders: 'disabled',
+        }),
+        swagger: false,
+      });
+      await app.ready();
+
+      const res = await app.inject({
+        method: 'GET',
+        url: '/agent/model-provider-catalog',
+        headers: {authorization: 'Bearer user'},
+      });
+
+      expect(res.statusCode, res.body).toBe(200);
+      expect(res.json()).toMatchObject({
+        workspace_providers: 'disabled',
+        providers: [
+          expect.objectContaining({
+            id: 'shipfox',
+            support_status: 'supported',
+            default_model: 'managed-claude',
+            credential_fields: [],
+            models: [{id: 'managed-claude', label: 'Managed Claude', api: 'anthropic-messages'}],
+          }),
+        ],
+      });
+    });
   });
 });
+
+function managedProvider(): ManagedModelProvider {
+  return {
+    id: 'shipfox',
+    label: 'Shipfox',
+    models: [{id: 'managed-claude', label: 'Managed Claude', api: 'anthropic-messages'}],
+    defaultModel: 'managed-claude',
+    resolveCredentials: async () => ({
+      api: 'anthropic-messages',
+      baseUrl: 'https://gateway.example.com',
+      credentials: {api_key: 'token'},
+    }),
+  };
+}

package/src/presentation/routes/model-provider-config.test.ts

@@ -20,7 +20,7 @@ import {
 } from '#db/index.js';
 import {modelProviderConfigs} from '#db/schema/model-provider-configs.js';
 import {getSecretsByNamespace, setSecrets} from '#test/fixtures/secrets-client.js';
-import {agentRoutes} from './index.js';
+import {agentRoutes, createAgentRoutes} from './index.js';
 
 vi.mock('@earendil-works/pi-ai/compat', async (importOriginal) => {
   const actual = await importOriginal<typeof import('@earendil-works/pi-ai/compat')>();
@@ -391,6 +391,53 @@ describe('model provider config routes', () => {
 
       expect(res.statusCode).toBe(400);
     });
+
+    it('rejects catalog and custom provider writes when workspace providers are disabled', async () => {
+      await closeApp();
+      app = await createApp({
+        auth: [fakeUserAuth],
+        routes: createAgentRoutes(undefined as never, {
+          managedProvider: managedProvider(),
+          workspaceProviders: 'disabled',
+        }),
+        swagger: false,
+      });
+      await app.ready();
+
+      const catalogWrite = await app.inject({
+        method: 'PUT',
+        url: `/workspaces/${workspaceId}/agent/model-providers/anthropic`,
+        headers: {authorization: 'Bearer user'},
+        payload: {credentials: {api_key: 'sk-secret'}},
+      });
+      const customWrite = await app.inject({
+        method: 'POST',
+        url: `/workspaces/${workspaceId}/agent/custom-model-providers`,
+        headers: {authorization: 'Bearer user'},
+        payload: {
+          slug: 'local-vllm',
+          display_name: 'Local vLLM',
+          api: 'openai-responses',
+          base_url: 'http://127.0.0.1:11434/v1',
+          models: [{id: 'llama-3.1', label: 'Llama 3.1'}],
+        },
+      });
+
+      expect(catalogWrite.statusCode).toBe(422);
+      expect(customWrite.statusCode).toBe(422);
+      expect(catalogWrite.json()).toMatchObject({
+        code: 'workspace-providers-disabled',
+        details: {
+          message: 'This instance only supports provider `shipfox`.',
+        },
+      });
+      expect(customWrite.json()).toMatchObject({
+        code: 'workspace-providers-disabled',
+        details: {
+          message: 'This instance only supports provider `shipfox`.',
+        },
+      });
+    });
   });
 
   describe('DELETE /workspaces/:workspaceId/agent/model-providers/:providerId', () => {
@@ -804,4 +851,18 @@ describe('model provider config routes', () => {
     });
     expect(rows).toHaveLength(1);
   }
+
+  function managedProvider() {
+    return {
+      id: 'shipfox',
+      label: 'Shipfox',
+      models: [{id: 'managed-claude', label: 'Managed Claude', api: 'anthropic-messages' as const}],
+      defaultModel: 'managed-claude',
+      resolveCredentials: async () => ({
+        api: 'anthropic-messages' as const,
+        baseUrl: 'https://gateway.example.com',
+        credentials: {api_key: 'token'},
+      }),
+    };
+  }
 });

package/src/presentation/routes/set-default-model-provider.ts

@@ -5,43 +5,54 @@ import {
 import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
-import {UnsupportedModelProviderError} from '#core/index.js';
+import {
+  assertWorkspaceProviderConfigurationEnabled,
+  UnsupportedModelProviderError,
+} from '#core/index.js';
 import {getModelProviderEntry} from '#core/model-provider-policy.js';
+import type {WorkspaceProviderPolicyOptions} from '#core/workspace-provider-policy.js';
 import {getModelProviderConfig, setDefaultModelProvider} from '#db/index.js';
 import {translateModelProviderRouteError} from './errors.js';
 
-export const setDefaultModelProviderRoute = defineRoute({
-  method: 'PUT',
-  path: '/default-model-provider',
-  description: 'Set the default model provider for a workspace',
-  schema: {
-    params: z.object({workspaceId: z.string().uuid()}),
-    body: setDefaultModelProviderBodySchema,
-    response: {
-      200: setDefaultModelProviderResponseSchema,
+export function createSetDefaultModelProviderRoute(
+  workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {workspaceProviders: 'enabled'},
+) {
+  return defineRoute({
+    method: 'PUT',
+    path: '/default-model-provider',
+    description: 'Set the default model provider for a workspace',
+    schema: {
+      params: z.object({workspaceId: z.string().uuid()}),
+      body: setDefaultModelProviderBodySchema,
+      response: {
+        200: setDefaultModelProviderResponseSchema,
+      },
     },
-  },
-  errorHandler: translateModelProviderRouteError,
-  handler: async (request) => {
-    const {workspaceId} = request.params;
-    requireWorkspaceAccess({request, workspaceId});
+    errorHandler: translateModelProviderRouteError,
+    handler: async (request) => {
+      const {workspaceId} = request.params;
+      requireWorkspaceAccess({request, workspaceId});
+      assertWorkspaceProviderConfigurationEnabled(workspaceProviderPolicy);
 
-    const existingConfig = await getModelProviderConfig({
-      workspaceId,
-      providerId: request.body.provider_id,
-    });
-    if (existingConfig?.kind !== 'custom') {
-      const entry = getModelProviderEntry(request.body.provider_id);
-      if (entry === undefined || entry.support_status !== 'supported') {
-        throw new UnsupportedModelProviderError(request.body.provider_id);
+      const existingConfig = await getModelProviderConfig({
+        workspaceId,
+        providerId: request.body.provider_id,
+      });
+      if (existingConfig?.kind !== 'custom') {
+        const entry = getModelProviderEntry(request.body.provider_id);
+        if (entry === undefined || entry.support_status !== 'supported') {
+          throw new UnsupportedModelProviderError(request.body.provider_id);
+        }
       }
-    }
 
-    const settings = await setDefaultModelProvider({
-      workspaceId,
-      providerId: request.body.provider_id,
-    });
+      const settings = await setDefaultModelProvider({
+        workspaceId,
+        providerId: request.body.provider_id,
+      });
+
+      return {default_provider_id: settings.defaultProviderId};
+    },
+  });
+}
 
-    return {default_provider_id: settings.defaultProviderId};
-  },
-});
+export const setDefaultModelProviderRoute = createSetDefaultModelProviderRoute();

package/src/presentation/routes/update-custom-model-provider.ts

@@ -6,12 +6,19 @@ import {
 import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
-import {updateCustomModelProviderConfig} from '#core/index.js';
+import {
+  assertWorkspaceProviderConfigurationEnabled,
+  updateCustomModelProviderConfig,
+} from '#core/index.js';
 import type {AgentSecretsClient} from '#core/secrets-client.js';
+import type {WorkspaceProviderPolicyOptions} from '#core/workspace-provider-policy.js';
 import {toCustomModelProviderConfigDto} from '#presentation/dto/index.js';
 import {translateModelProviderRouteError} from './errors.js';
 
-export function createUpdateCustomModelProviderRoute(secrets: AgentSecretsClient) {
+export function createUpdateCustomModelProviderRoute(
+  secrets: AgentSecretsClient,
+  workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {workspaceProviders: 'enabled'},
+) {
   return defineRoute({
     method: 'PUT',
     path: '/custom-model-providers/:slug',
@@ -39,6 +46,7 @@ export function createUpdateCustomModelProviderRoute(secrets: AgentSecretsClient
       });
 
       requireWorkspaceAccess({request, workspaceId});
+      assertWorkspaceProviderConfigurationEnabled(workspaceProviderPolicy);
 
       const config = await updateCustomModelProviderConfig(
         {

package/src/presentation/routes/update-model-provider-default-model.ts

@@ -6,35 +6,46 @@ import {
 import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
-import {updateModelProviderConfigDefaultModel} from '#core/index.js';
+import {
+  assertWorkspaceProviderConfigurationEnabled,
+  updateModelProviderConfigDefaultModel,
+} from '#core/index.js';
+import type {WorkspaceProviderPolicyOptions} from '#core/workspace-provider-policy.js';
 import {toModelProviderConfigResponseDto} from '#presentation/dto/index.js';
 import {translateModelProviderRouteError} from './errors.js';
 
-export const updateModelProviderDefaultModelRoute = defineRoute({
-  method: 'PUT',
-  path: '/model-providers/:providerId/default-model',
-  description: 'Update the default model for an existing model provider configuration',
-  schema: {
-    params: z.object({
-      workspaceId: z.string().uuid(),
-      providerId: modelProviderRefSchema,
-    }),
-    body: updateModelProviderDefaultModelBodySchema,
-    response: {
-      200: modelProviderConfigResponseSchema,
+export function createUpdateModelProviderDefaultModelRoute(
+  workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {workspaceProviders: 'enabled'},
+) {
+  return defineRoute({
+    method: 'PUT',
+    path: '/model-providers/:providerId/default-model',
+    description: 'Update the default model for an existing model provider configuration',
+    schema: {
+      params: z.object({
+        workspaceId: z.string().uuid(),
+        providerId: modelProviderRefSchema,
+      }),
+      body: updateModelProviderDefaultModelBodySchema,
+      response: {
+        200: modelProviderConfigResponseSchema,
+      },
     },
-  },
-  errorHandler: translateModelProviderRouteError,
-  handler: async (request) => {
-    const {workspaceId, providerId} = request.params;
-    requireWorkspaceAccess({request, workspaceId});
+    errorHandler: translateModelProviderRouteError,
+    handler: async (request) => {
+      const {workspaceId, providerId} = request.params;
+      requireWorkspaceAccess({request, workspaceId});
+      assertWorkspaceProviderConfigurationEnabled(workspaceProviderPolicy);
+
+      const config = await updateModelProviderConfigDefaultModel({
+        workspaceId,
+        providerId,
+        defaultModel: request.body.default_model,
+      });
 
-    const config = await updateModelProviderConfigDefaultModel({
-      workspaceId,
-      providerId,
-      defaultModel: request.body.default_model,
-    });
+      return toModelProviderConfigResponseDto(config);
+    },
+  });
+}
 
-    return toModelProviderConfigResponseDto(config);
-  },
-});
+export const updateModelProviderDefaultModelRoute = createUpdateModelProviderDefaultModelRoute();

package/src/presentation/routes/upsert-model-provider-config.ts

@@ -6,12 +6,19 @@ import {
 import {requireWorkspaceAccess} from '@shipfox/api-auth-context';
 import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
-import {testAndSaveModelProviderConfig} from '#core/index.js';
+import {
+  assertWorkspaceProviderConfigurationEnabled,
+  testAndSaveModelProviderConfig,
+} from '#core/index.js';
 import type {AgentSecretsClient} from '#core/secrets-client.js';
+import type {WorkspaceProviderPolicyOptions} from '#core/workspace-provider-policy.js';
 import {toModelProviderConfigDto} from '#presentation/dto/index.js';
 import {translateModelProviderRouteError} from './errors.js';
 
-export function createUpsertModelProviderConfigRoute(secrets: AgentSecretsClient) {
+export function createUpsertModelProviderConfigRoute(
+  secrets: AgentSecretsClient,
+  workspaceProviderPolicy: WorkspaceProviderPolicyOptions = {workspaceProviders: 'enabled'},
+) {
   return defineRoute({
     method: 'PUT',
     path: '/model-providers/:providerId',
@@ -39,6 +46,7 @@ export function createUpsertModelProviderConfigRoute(secrets: AgentSecretsClient
       });
 
       const membership = requireWorkspaceAccess({request, workspaceId});
+      assertWorkspaceProviderConfigurationEnabled(workspaceProviderPolicy);
 
       const config = await testAndSaveModelProviderConfig(
         {