@agent-native/dispatch 0.14.1 → 0.14.3

package/src/server/lib/dispatch-store.ts

@@ -1,6 +1,6 @@
 import crypto from "node:crypto";
 
-import { and, desc, eq, isNull, or } from "@agent-native/core/db/schema";
+import { and, desc, eq, isNull, or, sql } from "@agent-native/core/db/schema";
 import {
   getRequestUserEmail,
   getRequestOrgId,
@@ -11,6 +11,7 @@ import { getDb, schema } from "../../db/index.js";
 
 export const SHARED_DISPATCH_OWNER = "dispatch@shared";
 const APPROVAL_POLICY_KEY = "dispatch-approval-policy";
+const APPROVAL_APPLY_LEASE_MS = 5 * 60 * 1000;
 
 // ─── /link rate limiting ──────────────────────────────────────────────────
 //
@@ -188,8 +189,8 @@ export async function getApprovalPolicy(): Promise<DispatchApprovalPolicy> {
 async function applyApprovalPolicy(
   input: DispatchApprovalPolicy,
   actor = currentOwnerEmail(),
+  orgId = currentOrgId(),
 ) {
-  const orgId = currentOrgId();
   if (!orgId) {
     throw new Error(
       "Dispatch approval settings require an active organization",
@@ -209,7 +210,10 @@ async function applyApprovalPolicy(
     metadata: input,
     actor,
   });
-  return getApprovalPolicy();
+  return {
+    enabled: input.enabled,
+    approverEmails: input.approverEmails,
+  };
 }
 
 export async function setApprovalPolicy(input: DispatchApprovalPolicy) {
@@ -564,6 +568,7 @@ async function applyApprovedRequest(request: DispatchApprovalRequest) {
     return applyApprovalPolicy(
       payload,
       request.reviewedBy || currentOwnerEmail(),
+      requestCtx.orgId,
     );
   }
   if (request.changeType === "dream-proposal.apply") {
@@ -610,22 +615,77 @@ export async function approveRequest(requestId: string) {
   const ctx = requireDispatchCtx();
   const request = await getApprovalRequest(requestId, ctx);
   if (!request) throw new Error("Approval request not found");
-  if (request.status !== "pending") {
-    throw new Error("Only pending approvals can be approved");
-  }
+
   const timestamp = now();
-  await db
+  const staleApplyingBefore = timestamp - APPROVAL_APPLY_LEASE_MS;
+  // Fence the transition on the current status so a concurrent approve can't
+  // both win. A crashed worker can leave its lease in "applying", so reclaim
+  // only a lease that has been idle for the full lease interval.
+  const claimed = await db
+    .update(schema.dispatchApprovalRequests)
+    .set({
+      status: "applying",
+      updatedAt: timestamp,
+    })
+    .where(
+      and(
+        eq(schema.dispatchApprovalRequests.id, requestId),
+        ctxScope(schema.dispatchApprovalRequests, ctx),
+        or(
+          eq(schema.dispatchApprovalRequests.status, "pending"),
+          and(
+            eq(schema.dispatchApprovalRequests.status, "applying"),
+            sql`${schema.dispatchApprovalRequests.updatedAt} < ${staleApplyingBefore}`,
+          ),
+        ),
+      ),
+    )
+    .returning();
+
+  if (claimed.length === 0) {
+    const current = (await getApprovalRequest(requestId, ctx)) ?? request;
+    if (current.status === "applying") {
+      throw new Error("Approval is already being applied");
+    }
+    return current;
+  }
+
+  const applying = claimed[0];
+  try {
+    await applyApprovedRequest(applying);
+  } catch (error) {
+    // Applying a request can have succeeded partially before throwing. Do not
+    // return it to pending: that would allow an immediate retry to duplicate a
+    // non-idempotent effect. Keep the lease until it becomes stale, which
+    // serializes any recovery attempt behind the same fencing rule.
+    await db
+      .update(schema.dispatchApprovalRequests)
+      .set({ updatedAt: now() })
+      .where(
+        and(
+          eq(schema.dispatchApprovalRequests.id, requestId),
+          ctxScope(schema.dispatchApprovalRequests, ctx),
+          eq(schema.dispatchApprovalRequests.status, "applying"),
+        ),
+      );
+    throw error;
+  }
+  const [updated] = await db
     .update(schema.dispatchApprovalRequests)
     .set({
       status: "approved",
       reviewedBy: currentOwnerEmail(),
       reviewedAt: timestamp,
-      updatedAt: timestamp,
+      updatedAt: now(),
     })
-    .where(eq(schema.dispatchApprovalRequests.id, requestId));
-  const updated = await getApprovalRequest(requestId, ctx);
+    .where(
+      and(
+        eq(schema.dispatchApprovalRequests.id, requestId),
+        eq(schema.dispatchApprovalRequests.status, "applying"),
+      ),
+    )
+    .returning();
   if (!updated) throw new Error("Approval request disappeared");
-  await applyApprovedRequest(updated);
   await recordAudit({
     action: "approval.approved",
     targetType: updated.targetType,
@@ -638,13 +698,12 @@ export async function approveRequest(requestId: string) {
 
 export async function rejectRequest(requestId: string, reason?: string | null) {
   const db = getDb();
-  const request = await getApprovalRequest(requestId);
+  const ctx = requireDispatchCtx();
+  const request = await getApprovalRequest(requestId, ctx);
   if (!request) throw new Error("Approval request not found");
-  if (request.status !== "pending") {
-    throw new Error("Only pending approvals can be rejected");
-  }
+
   const timestamp = now();
-  await db
+  const claimed = await db
     .update(schema.dispatchApprovalRequests)
     .set({
       status: "rejected",
@@ -652,15 +711,27 @@ export async function rejectRequest(requestId: string, reason?: string | null) {
       reviewedAt: timestamp,
       updatedAt: timestamp,
     })
-    .where(eq(schema.dispatchApprovalRequests.id, requestId));
+    .where(
+      and(
+        eq(schema.dispatchApprovalRequests.id, requestId),
+        eq(schema.dispatchApprovalRequests.status, "pending"),
+      ),
+    )
+    .returning();
+
+  if (claimed.length === 0) {
+    return (await getApprovalRequest(requestId, ctx)) ?? request;
+  }
+
+  const updated = claimed[0];
   await recordAudit({
     action: "approval.rejected",
-    targetType: request.targetType,
+    targetType: updated.targetType,
     targetId: requestId,
-    summary: `Rejected ${request.summary}`,
-    metadata: { request, reason: reason || null },
+    summary: `Rejected ${updated.summary}`,
+    metadata: { request: updated, reason: reason || null },
   });
-  return getApprovalRequest(requestId);
+  return updated;
 }
 
 export async function createLinkToken(platform: string) {

package/src/server/lib/env-config.ts

@@ -3,7 +3,7 @@ import type { EnvKeyConfig } from "@agent-native/core/server";
 export const envKeys: EnvKeyConfig[] = [
   {
     key: "SLACK_BOT_TOKEN",
-    label: "Slack bot token",
+    label: "Slack bot token (legacy)",
     required: false,
   },
   {

package/src/server/lib/vault-store.ts

@@ -1,6 +1,6 @@
 import crypto from "node:crypto";
 
-import { and, desc, eq, isNull, or } from "@agent-native/core/db/schema";
+import { and, desc, eq, isNull, or, sql } from "@agent-native/core/db/schema";
 import { ssrfSafeFetch } from "@agent-native/core/extensions/url-safety";
 import {
   deleteAppSecret,
@@ -567,8 +567,59 @@ export async function createGrant(
   if (!secret) throw new Error("Secret not found");
 
   const timestamp = now();
-  const grantId = id();
   const actor = ctx.ownerEmail;
+  const [existing] = await db
+    .select()
+    .from(schema.vaultGrants)
+    .where(
+      and(
+        eq(schema.vaultGrants.secretId, secretId),
+        eq(schema.vaultGrants.appId, appId),
+        ctxScope(schema.vaultGrants, ctx),
+      ),
+    )
+    .orderBy(desc(schema.vaultGrants.updatedAt))
+    .limit(1);
+
+  if (existing?.status === "active") {
+    return existing;
+  }
+
+  if (existing) {
+    await db
+      .update(schema.vaultGrants)
+      .set({
+        grantedBy: actor,
+        status: "active",
+        syncedAt: null,
+        updatedAt: timestamp,
+      })
+      .where(
+        and(
+          eq(schema.vaultGrants.id, existing.id),
+          ctxScope(schema.vaultGrants, ctx),
+        ),
+      );
+
+    await recordVaultAudit({
+      action: "grant.reinstated",
+      secretId,
+      appId,
+      summary: `Reinstated "${secret.name}" (${secret.credentialKey}) for ${appId}`,
+      metadata: { grantId: existing.id },
+    });
+
+    await recordAudit({
+      action: "vault.grant.reinstated",
+      targetType: "vault-grant",
+      targetId: existing.id,
+      summary: `Reinstated vault secret "${secret.name}" for ${appId}`,
+    });
+
+    return getGrant(existing.id, ctx);
+  }
+
+  const grantId = id();
 
   await db.insert(schema.vaultGrants).values({
     id: grantId,
@@ -956,65 +1007,115 @@ export async function approveRequest(
   const db = getDb();
   const request = await getRequest(requestId, ctx);
   if (!request) throw new Error("Request not found");
-  if (request.status !== "pending") {
-    throw new Error("Only pending requests can be approved");
-  }
 
   const timestamp = now();
   const reviewer = ctx.ownerEmail;
-
-  // Update request status — scoped to caller's tenant.
-  await db
+  const staleApplyingBefore = timestamp - 5 * 60 * 1000;
+
+  // Fence the transition on the current status — scoped to caller's tenant —
+  // so a concurrent approve can't both win: only the caller that flips
+  // pending -> applying proceeds to create the secret/grant. A crashed worker
+  // leaves an applying row behind, so a later reviewer may reclaim a lease
+  // that has been idle for five minutes. See
+  // claimAgentTeamRun in packages/core/src/server/agent-teams-run-queue.ts
+  // for the same pattern.
+  const claimed = await db
     .update(schema.vaultRequests)
     .set({
-      status: "approved",
-      reviewedBy: reviewer,
-      reviewedAt: timestamp,
+      status: "applying",
       updatedAt: timestamp,
     })
     .where(
       and(
         eq(schema.vaultRequests.id, requestId),
         ctxScope(schema.vaultRequests, ctx),
+        or(
+          eq(schema.vaultRequests.status, "pending"),
+          and(
+            eq(schema.vaultRequests.status, "applying"),
+            sql`${schema.vaultRequests.updatedAt} < ${staleApplyingBefore}`,
+          ),
+        ),
       ),
-    );
+    )
+    .returning();
+
+  if (claimed.length === 0) {
+    const current = await getRequest(requestId, ctx);
+    if (current?.status === "applying") {
+      throw new Error("Vault request is already being applied");
+    }
+    return current;
+  }
+
+  const claimedRequest = claimed[0];
 
   // Secret + grant must land in the REQUEST's tenant, not the approver's
   // (the approver may be acting on behalf of another user in the same org).
-  const requestCtx = ctxForRow(request);
+  const requestCtx = ctxForRow(claimedRequest);
 
-  // Check if secret already exists in the request's tenant for this key.
-  const existingSecrets = await db
-    .select()
-    .from(schema.vaultSecrets)
+  try {
+    // Check if secret already exists in the request's tenant for this key.
+    const existingSecrets = await db
+      .select()
+      .from(schema.vaultSecrets)
+      .where(
+        and(
+          eq(schema.vaultSecrets.credentialKey, claimedRequest.credentialKey),
+          ctxScope(schema.vaultSecrets, requestCtx),
+        ),
+      );
+    let secret = existingSecrets[0] ?? null;
+
+    if (!secret) {
+      secret = await createSecret(
+        {
+          credentialKey: claimedRequest.credentialKey,
+          value: secretValue,
+          name: secretName || claimedRequest.credentialKey,
+        },
+        requestCtx,
+      );
+    }
+
+    if (secret) {
+      // Create the grant in the request's tenant as well.
+      await createGrant(secret.id, claimedRequest.appId, requestCtx);
+    }
+  } catch (error) {
+    await db
+      .update(schema.vaultRequests)
+      .set({ status: "pending", updatedAt: now() })
+      .where(
+        and(
+          eq(schema.vaultRequests.id, requestId),
+          ctxScope(schema.vaultRequests, ctx),
+          eq(schema.vaultRequests.status, "applying"),
+        ),
+      );
+    throw error;
+  }
+
+  await db
+    .update(schema.vaultRequests)
+    .set({
+      status: "approved",
+      reviewedBy: reviewer,
+      reviewedAt: timestamp,
+      updatedAt: now(),
+    })
     .where(
       and(
-        eq(schema.vaultSecrets.credentialKey, request.credentialKey),
-        ctxScope(schema.vaultSecrets, requestCtx),
+        eq(schema.vaultRequests.id, requestId),
+        ctxScope(schema.vaultRequests, ctx),
+        eq(schema.vaultRequests.status, "applying"),
       ),
     );
-  let secret = existingSecrets[0] ?? null;
-
-  if (!secret) {
-    secret = await createSecret(
-      {
-        credentialKey: request.credentialKey,
-        value: secretValue,
-        name: secretName || request.credentialKey,
-      },
-      requestCtx,
-    );
-  }
-
-  if (secret) {
-    // Create the grant in the request's tenant as well.
-    await createGrant(secret.id, request.appId, requestCtx);
-  }
 
   await recordVaultAudit({
     action: "request.approved",
-    appId: request.appId,
-    summary: `Approved ${request.credentialKey} for ${request.appId} (requested by ${request.requestedBy})`,
+    appId: claimedRequest.appId,
+    summary: `Approved ${claimedRequest.credentialKey} for ${claimedRequest.appId} (requested by ${claimedRequest.requestedBy})`,
     metadata: { requestId, reviewer },
   });
 
@@ -1029,14 +1130,11 @@ export async function denyRequest(
   const db = getDb();
   const request = await getRequest(requestId, ctx);
   if (!request) throw new Error("Request not found");
-  if (request.status !== "pending") {
-    throw new Error("Only pending requests can be denied");
-  }
 
   const timestamp = now();
   const reviewer = ctx.ownerEmail;
 
-  await db
+  const claimed = await db
     .update(schema.vaultRequests)
     .set({
       status: "denied",
@@ -1048,13 +1146,21 @@ export async function denyRequest(
       and(
         eq(schema.vaultRequests.id, requestId),
         ctxScope(schema.vaultRequests, ctx),
+        eq(schema.vaultRequests.status, "pending"),
       ),
-    );
+    )
+    .returning();
+
+  if (claimed.length === 0) {
+    return getRequest(requestId, ctx);
+  }
+
+  const claimedRequest = claimed[0];
 
   await recordVaultAudit({
     action: "request.denied",
-    appId: request.appId,
-    summary: `Denied ${request.credentialKey} for ${request.appId} (requested by ${request.requestedBy})`,
+    appId: claimedRequest.appId,
+    summary: `Denied ${claimedRequest.credentialKey} for ${claimedRequest.appId} (requested by ${claimedRequest.requestedBy})`,
     metadata: { requestId, reviewer, reason },
   });