@amalgm/automations 0.2.6 → 0.3.1

package/supabase/migrations/20260904010000_typed_workflow_admission.sql

@@ -0,0 +1,272 @@
+-- Every delivery path admits the same declared workflow versions. The SDK owns
+-- shape validation; this transaction-bound predicate prevents incomplete or
+-- unsupported definitions from entering the durable execution ledger.
+
+CREATE OR REPLACE FUNCTION public.amalgm_workflow_is_executable(p_compiled jsonb)
+RETURNS boolean
+LANGUAGE sql
+IMMUTABLE
+SET search_path = public
+AS $$
+  SELECT jsonb_typeof(p_compiled) = 'object'
+    AND p_compiled->>'version' IN ('1', '2')
+    AND jsonb_typeof(p_compiled->'steps') = 'array'
+    AND jsonb_array_length(
+      CASE WHEN jsonb_typeof(p_compiled->'steps') = 'array'
+        THEN p_compiled->'steps' ELSE '[]'::jsonb END
+    ) BETWEEN 1 AND 100;
+$$;
+
+CREATE OR REPLACE FUNCTION public.list_amalgm_event_triggers(p_user_id uuid, p_target_id text)
+RETURNS TABLE (
+  user_id uuid,
+  automation_id text,
+  trigger_id text,
+  target_id text,
+  source text,
+  event text,
+  secret text
+)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT t.user_id, t.automation_id, t.id, a.target_id, t.source, t.event, t.secret
+  FROM public.amalgm_automation_triggers t
+  JOIN public.amalgm_automations a
+    ON a.user_id = t.user_id AND a.id = t.automation_id
+  JOIN public.amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE t.kind = 'webhook' AND t.user_id = p_user_id
+    AND a.target_id = p_target_id AND t.enabled AND a.enabled
+    AND public.amalgm_workflow_is_executable(w.compiled);
+$$;
+
+CREATE OR REPLACE FUNCTION public.list_due_amalgm_crons(p_now timestamptz)
+RETURNS TABLE (
+  user_id uuid,
+  automation_id text,
+  trigger_id text,
+  target_id text,
+  cron text,
+  timezone text,
+  next_run_at timestamptz,
+  remaining_occurrences integer
+)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT t.user_id, t.automation_id, t.id, a.target_id,
+    t.cron, t.timezone, t.next_run_at, t.remaining_occurrences
+  FROM public.amalgm_automation_triggers t
+  JOIN public.amalgm_automations a
+    ON a.user_id = t.user_id AND a.id = t.automation_id
+  JOIN public.amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE t.kind = 'schedule' AND t.next_run_at <= p_now
+    AND (t.remaining_occurrences IS NULL OR t.remaining_occurrences > 0)
+    AND t.enabled AND a.enabled
+    AND public.amalgm_workflow_is_executable(w.compiled)
+  ORDER BY t.next_run_at, t.user_id, t.automation_id, t.id;
+$$;
+
+CREATE OR REPLACE FUNCTION public.resolve_amalgm_webhook(p_endpoint_id text)
+RETURNS TABLE (
+  user_id uuid,
+  automation_id text,
+  trigger_id text,
+  target_id text,
+  endpoint_id text,
+  source text,
+  event text,
+  secret text
+)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT t.user_id, t.automation_id, t.id, a.target_id,
+    t.endpoint_id, t.source, t.event, t.secret
+  FROM public.amalgm_automation_triggers t
+  JOIN public.amalgm_automations a
+    ON a.user_id = t.user_id AND a.id = t.automation_id
+  JOIN public.amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE t.kind = 'webhook' AND t.endpoint_id = p_endpoint_id
+    AND t.enabled AND a.enabled
+    AND public.amalgm_workflow_is_executable(w.compiled);
+$$;
+
+CREATE OR REPLACE FUNCTION public.enqueue_amalgm_run(
+  p_kind text,
+  p_user_id uuid,
+  p_automation_id text,
+  p_trigger_id text,
+  p_target_id text,
+  p_endpoint_id text,
+  p_delivery_key text,
+  p_expected_next_run_at timestamptz,
+  p_next_run_at timestamptz,
+  p_input jsonb,
+  p_now timestamptz
+) RETURNS SETOF public.amalgm_automation_runs
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_inserted integer := 0;
+BEGIN
+  IF p_kind = 'cron' THEN
+    IF p_endpoint_id IS NOT NULL OR p_delivery_key IS NOT NULL THEN
+      RAISE EXCEPTION 'Schedule admission cannot carry webhook identity';
+    END IF;
+    PERFORM 1
+    FROM public.amalgm_automation_triggers t
+    JOIN public.amalgm_automations a
+      ON a.user_id = t.user_id AND a.id = t.automation_id
+    WHERE t.user_id = p_user_id AND t.automation_id = p_automation_id
+      AND t.id = p_trigger_id AND a.target_id = p_target_id
+      AND t.kind = 'schedule' AND t.next_run_at = p_expected_next_run_at
+      AND (t.remaining_occurrences IS NULL OR t.remaining_occurrences > 0)
+      AND t.enabled AND a.enabled
+    FOR UPDATE OF t;
+  ELSIF p_kind = 'event' THEN
+    IF p_endpoint_id IS NULL THEN RAISE EXCEPTION 'Webhook endpoint is required'; END IF;
+    PERFORM 1
+    FROM public.amalgm_automation_triggers t
+    JOIN public.amalgm_automations a
+      ON a.user_id = t.user_id AND a.id = t.automation_id
+    WHERE t.user_id = p_user_id AND t.automation_id = p_automation_id
+      AND t.id = p_trigger_id AND a.target_id = p_target_id
+      AND t.kind = 'webhook' AND t.endpoint_id = p_endpoint_id
+      AND t.enabled AND a.enabled;
+  ELSE
+    RAISE EXCEPTION 'Invalid automation trigger kind';
+  END IF;
+  IF NOT FOUND THEN RETURN; END IF;
+
+  RETURN QUERY
+  INSERT INTO public.amalgm_automation_runs (
+    user_id, target_id, automation_id, trigger_id, workflow_id,
+    automation_payload, input, status, delivery_key, created_at
+  )
+  SELECT a.user_id, a.target_id, a.id, t.id, w.id,
+    jsonb_strip_nulls(jsonb_build_object(
+      'id', a.id, 'targetId', a.target_id, 'name', a.name,
+      'description', a.description, 'enabled', a.enabled,
+      'trigger', jsonb_strip_nulls(jsonb_build_object(
+        'id', t.id,
+        'kind', CASE WHEN t.kind = 'schedule' THEN 'cron' ELSE 'event' END,
+        'enabled', t.enabled, 'cron', t.cron, 'timezone', t.timezone,
+        'source', t.source, 'event', t.event
+      )),
+      'workflow', jsonb_strip_nulls(jsonb_build_object(
+        'id', w.id, 'name', w.name, 'script', w.script,
+        'compiled', w.compiled, 'allowlist', w.allowlist, 'limits', w.limits
+      ))
+    )),
+    p_input, 'pending', p_delivery_key, p_now
+  FROM public.amalgm_automations a
+  JOIN public.amalgm_automation_triggers t
+    ON t.user_id = a.user_id AND t.automation_id = a.id
+  JOIN public.amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE a.user_id = p_user_id AND a.id = p_automation_id AND t.id = p_trigger_id
+    AND a.target_id = p_target_id AND t.enabled AND a.enabled
+    AND (p_kind = 'cron' OR (t.kind = 'webhook' AND t.endpoint_id = p_endpoint_id))
+    AND public.amalgm_workflow_is_executable(w.compiled)
+  ON CONFLICT (user_id, automation_id, trigger_id, delivery_key)
+    WHERE delivery_key IS NOT NULL
+  DO UPDATE SET delivery_key = EXCLUDED.delivery_key
+  RETURNING *;
+  GET DIAGNOSTICS v_inserted = ROW_COUNT;
+
+  IF p_kind = 'cron' AND v_inserted = 1 THEN
+    UPDATE public.amalgm_automation_triggers SET
+      next_run_at = p_next_run_at,
+      remaining_occurrences = CASE WHEN remaining_occurrences IS NULL
+        THEN NULL ELSE remaining_occurrences - 1 END,
+      enabled = CASE WHEN remaining_occurrences = 1 THEN false ELSE enabled END,
+      updated_at = p_now
+    WHERE user_id = p_user_id AND automation_id = p_automation_id
+      AND id = p_trigger_id AND kind = 'schedule'
+      AND next_run_at = p_expected_next_run_at;
+  END IF;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION public.enqueue_amalgm_manual_run(
+  p_user_id uuid,
+  p_automation_id text,
+  p_input jsonb,
+  p_idempotency_key text,
+  p_now timestamptz
+) RETURNS SETOF public.amalgm_automation_runs
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  IF p_idempotency_key IS NOT NULL THEN
+    RETURN QUERY
+    SELECT r.*
+    FROM public.amalgm_automation_runs r
+    WHERE r.user_id = p_user_id
+      AND r.automation_id = p_automation_id
+      AND r.trigger_id = '@manual'
+      AND r.delivery_key = p_idempotency_key;
+    IF FOUND THEN RETURN; END IF;
+  END IF;
+
+  RETURN QUERY
+  INSERT INTO public.amalgm_automation_runs (
+    user_id, target_id, automation_id, trigger_id, workflow_id,
+    automation_payload, input, status, delivery_key, created_at
+  )
+  SELECT a.user_id, a.target_id, a.id, '@manual', w.id,
+    jsonb_strip_nulls(jsonb_build_object(
+      'id', a.id, 'targetId', a.target_id, 'name', a.name,
+      'description', a.description, 'enabled', a.enabled,
+      'trigger', jsonb_build_object(
+        'id', '@manual', 'kind', 'manual', 'enabled', true
+      ),
+      'workflow', jsonb_strip_nulls(jsonb_build_object(
+        'id', w.id, 'name', w.name, 'script', w.script,
+        'compiled', w.compiled, 'allowlist', w.allowlist, 'limits', w.limits
+      ))
+    )),
+    p_input, 'pending', p_idempotency_key, p_now
+  FROM public.amalgm_automations a
+  JOIN public.amalgm_automation_workflows w
+    ON w.user_id = a.user_id AND w.automation_id = a.id
+  WHERE a.user_id = p_user_id AND a.id = p_automation_id AND a.enabled
+    AND public.amalgm_workflow_is_executable(w.compiled)
+  ON CONFLICT (user_id, automation_id, trigger_id, delivery_key)
+    WHERE delivery_key IS NOT NULL
+  DO UPDATE SET delivery_key = EXCLUDED.delivery_key
+  RETURNING *;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.amalgm_workflow_is_executable(jsonb) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.list_amalgm_event_triggers(uuid, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.list_due_amalgm_crons(timestamptz) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.resolve_amalgm_webhook(text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.enqueue_amalgm_run(
+  text, uuid, text, text, text, text, text, timestamptz, timestamptz, jsonb, timestamptz
+) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.enqueue_amalgm_manual_run(
+  uuid, text, jsonb, text, timestamptz
+) FROM PUBLIC;
+
+GRANT EXECUTE ON FUNCTION public.list_amalgm_event_triggers(uuid, text) TO service_role;
+GRANT EXECUTE ON FUNCTION public.list_due_amalgm_crons(timestamptz) TO service_role;
+GRANT EXECUTE ON FUNCTION public.resolve_amalgm_webhook(text) TO service_role;
+GRANT EXECUTE ON FUNCTION public.enqueue_amalgm_run(
+  text, uuid, text, text, text, text, text, timestamptz, timestamptz, jsonb, timestamptz
+) TO service_role;
+GRANT EXECUTE ON FUNCTION public.enqueue_amalgm_manual_run(
+  uuid, text, jsonb, text, timestamptz
+) TO service_role;