@automagik/omni 2.260923.5 → 2.260923.6

package/db/drizzle/0079_instances_slack_identity_unique.sql

@@ -0,0 +1,58 @@
+-- Slack OAuth identity uniqueness (#1235, follow-up to #1233).
+--
+-- The OAuth callback upserts one instance per Slack identity, but nothing in
+-- the database enforced it: two callbacks for the same identity landing
+-- together could both insert. These partial unique indexes make the identity
+-- a constraint and give the upsert an ON CONFLICT target:
+--
+--   instances_slack_oauth_user_uq  (slack_team_id, slack_user_id) for
+--                                  user-mode OAuth rows
+--   instances_slack_oauth_bot_uq   (slack_team_id) for bot-mode OAuth rows
+--                                  (NULL slack_user_id) — two bot installs
+--                                  for one workspace are one identity
+--
+-- Only slack_connection_method = 'oauth' rows are covered: the
+-- instance.connected listener also fills the identity columns of manual
+-- pasted-token instances, which may legitimately repeat.
+--
+-- Duplicate-row policy: detect and refuse. A database that already holds two
+-- OAuth rows for one identity cannot build the index, so the DO block below
+-- fails the migration with the duplicate instance ids instead. Resolve by
+-- deleting the extra instance(s), then restart; nothing is deduped
+-- automatically because each row carries its own live tokens.
+--
+-- Hand-written following the 0043/0044/0052 precedent (additive, idempotent).
+-- No explicit BEGIN/COMMIT — the boot migrator executes this file on a pooled
+-- postgres-js connection, which rejects raw transaction control.
+
+DO $$
+DECLARE
+  duplicates text;
+BEGIN
+  SELECT string_agg(
+           format('team %s %s: instances %s',
+                  slack_team_id,
+                  COALESCE('user ' || slack_user_id, '(bot)'),
+                  ids),
+           '; ')
+    INTO duplicates
+    FROM (
+      SELECT slack_team_id, slack_user_id, string_agg(id::text, ', ' ORDER BY created_at) AS ids
+        FROM "instances"
+       WHERE slack_connection_method = 'oauth' AND slack_team_id IS NOT NULL
+       GROUP BY slack_team_id, slack_user_id
+      HAVING count(*) > 1
+    ) d;
+
+  IF duplicates IS NOT NULL THEN
+    RAISE EXCEPTION 'Duplicate Slack OAuth instances for one identity (#1235): %. Delete the extra instance(s) and restart.', duplicates;
+  END IF;
+END $$;
+
+CREATE UNIQUE INDEX IF NOT EXISTS "instances_slack_oauth_user_uq"
+  ON "instances" ("slack_team_id", "slack_user_id")
+  WHERE "slack_connection_method" = 'oauth' AND "slack_user_id" IS NOT NULL;
+
+CREATE UNIQUE INDEX IF NOT EXISTS "instances_slack_oauth_bot_uq"
+  ON "instances" ("slack_team_id")
+  WHERE "slack_connection_method" = 'oauth' AND "slack_user_id" IS NULL;

package/db/drizzle/meta/_journal.json

@@ -554,6 +554,13 @@
       "when": 1787800000000,
       "tag": "0078_instances_slack_oauth_identity",
       "breakpoints": true
+    },
+    {
+      "idx": 79,
+      "version": "7",
+      "when": 1787900000000,
+      "tag": "0079_instances_slack_identity_unique",
+      "breakpoints": true
     }
   ]
 }

package/dist/index.js

@@ -82460,6 +82460,8 @@ var init_schema2 = __esm(() => {
     agentIdIdx: index("instances_agent_id_idx").on(table3.agentId),
     metaPhoneNumberIdx: index("instances_meta_phone_number_idx").on(table3.metaPhoneNumberId),
     slackIdentityIdx: index("instances_slack_identity_idx").on(table3.slackTeamId, table3.slackUserId),
+    slackOAuthUserUq: uniqueIndex("instances_slack_oauth_user_uq").on(table3.slackTeamId, table3.slackUserId).where(sql`${table3.slackConnectionMethod} = 'oauth' AND ${table3.slackUserId} IS NOT NULL`),
+    slackOAuthBotUq: uniqueIndex("instances_slack_oauth_bot_uq").on(table3.slackTeamId).where(sql`${table3.slackConnectionMethod} = 'oauth' AND ${table3.slackUserId} IS NULL`),
     chainModeCheck: check("instances_chain_mode_check", sql`${table3.chainMode} IN ('off', 'forward', 'bidirectional')`)
   }));
   whatsappTemplates = pgTable("whatsapp_templates", {
@@ -115984,7 +115986,7 @@ var require_client2 = __commonJS((exports) => {
 
 // ../../node_modules/.bun/@sentry+node-core@10.52.0+2c50d7e904f6cfd7/node_modules/@sentry/node-core/build/cjs/sdk/esmLoader.js
 var require_esmLoader = __commonJS((exports) => {
-  var __filename = "/home/runner/work/omni/omni/.stable-source/node_modules/.bun/@sentry+node-core@10.52.0+2c50d7e904f6cfd7/node_modules/@sentry/node-core/build/cjs/sdk/esmLoader.js";
+  var __filename = "/home/runner/work/omni/omni/node_modules/.bun/@sentry+node-core@10.52.0+2c50d7e904f6cfd7/node_modules/@sentry/node-core/build/cjs/sdk/esmLoader.js";
   Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
   var core = require_cjs();
   var importInTheMiddle = require_import_in_the_middle();
@@ -137460,7 +137462,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260923.5",
+  version: "2.260923.6",
   repository: {
     type: "git",
     url: "git+https://github.com/automagik-dev/omni.git",

package/dist/server/index.js

@@ -77157,7 +77157,7 @@ var require_ClientVoiceManager = __commonJS((exports, module) => {
 
 // ../../node_modules/.bun/@discordjs+ws@1.2.3/node_modules/@discordjs/ws/dist/index.js
 var require_dist9 = __commonJS((exports, module) => {
-  var __dirname = "/home/runner/work/omni/omni/.stable-source/node_modules/.bun/@discordjs+ws@1.2.3/node_modules/@discordjs/ws/dist";
+  var __dirname = "/home/runner/work/omni/omni/node_modules/.bun/@discordjs+ws@1.2.3/node_modules/@discordjs/ws/dist";
   var __create2 = Object.create;
   var __defProp2 = Object.defineProperty;
   var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;
@@ -176984,7 +176984,7 @@ var require_indexes = __commonJS((exports, module) => {
 
 // ../../node_modules/.bun/thread-stream@3.1.0/node_modules/thread-stream/index.js
 var require_thread_stream = __commonJS((exports, module) => {
-  var __dirname = "/home/runner/work/omni/omni/.stable-source/node_modules/.bun/thread-stream@3.1.0/node_modules/thread-stream";
+  var __dirname = "/home/runner/work/omni/omni/node_modules/.bun/thread-stream@3.1.0/node_modules/thread-stream";
   var { version } = require_package5();
   var { EventEmitter: EventEmitter3 } = __require("events");
   var { Worker } = __require("worker_threads");
@@ -177405,7 +177405,7 @@ var require_thread_stream = __commonJS((exports, module) => {
 
 // ../../node_modules/.bun/pino@9.14.0/node_modules/pino/lib/transport.js
 var require_transport2 = __commonJS((exports, module) => {
-  var __dirname = "/home/runner/work/omni/omni/.stable-source/node_modules/.bun/pino@9.14.0/node_modules/pino/lib";
+  var __dirname = "/home/runner/work/omni/omni/node_modules/.bun/pino@9.14.0/node_modules/pino/lib";
   var { createRequire: createRequire2 } = __require("module");
   var getCallers = require_caller();
   var { join: join8, isAbsolute, sep: sep2 } = __require("path");
@@ -188261,6 +188261,8 @@ var init_schema2 = __esm(() => {
     agentIdIdx: index("instances_agent_id_idx").on(table3.agentId),
     metaPhoneNumberIdx: index("instances_meta_phone_number_idx").on(table3.metaPhoneNumberId),
     slackIdentityIdx: index("instances_slack_identity_idx").on(table3.slackTeamId, table3.slackUserId),
+    slackOAuthUserUq: uniqueIndex("instances_slack_oauth_user_uq").on(table3.slackTeamId, table3.slackUserId).where(sql`${table3.slackConnectionMethod} = 'oauth' AND ${table3.slackUserId} IS NOT NULL`),
+    slackOAuthBotUq: uniqueIndex("instances_slack_oauth_bot_uq").on(table3.slackTeamId).where(sql`${table3.slackConnectionMethod} = 'oauth' AND ${table3.slackUserId} IS NULL`),
     chainModeCheck: check("instances_chain_mode_check", sql`${table3.chainMode} IN ('off', 'forward', 'bidirectional')`)
   }));
   whatsappTemplates = pgTable("whatsapp_templates", {
@@ -259216,7 +259218,7 @@ var require_client3 = __commonJS((exports) => {
 
 // ../../node_modules/.bun/@sentry+node-core@10.52.0+2c50d7e904f6cfd7/node_modules/@sentry/node-core/build/cjs/sdk/esmLoader.js
 var require_esmLoader = __commonJS((exports) => {
-  var __filename = "/home/runner/work/omni/omni/.stable-source/node_modules/.bun/@sentry+node-core@10.52.0+2c50d7e904f6cfd7/node_modules/@sentry/node-core/build/cjs/sdk/esmLoader.js";
+  var __filename = "/home/runner/work/omni/omni/node_modules/.bun/@sentry+node-core@10.52.0+2c50d7e904f6cfd7/node_modules/@sentry/node-core/build/cjs/sdk/esmLoader.js";
   Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
   var core3 = require_cjs6();
   var importInTheMiddle = require_import_in_the_middle();
@@ -266442,7 +266444,7 @@ var init_sentry_scrub = __esm(() => {
 var require_package7 = __commonJS((exports, module) => {
   module.exports = {
     name: "@omni/api",
-    version: "2.260923.5",
+    version: "2.260923.6",
     private: true,
     type: "module",
     exports: {
@@ -293545,7 +293547,7 @@ var require_src45 = __commonJS((exports) => {
 
 // ../../node_modules/.bun/@grpc+grpc-js@1.14.3/node_modules/@grpc/grpc-js/build/src/channelz.js
 var require_channelz = __commonJS((exports) => {
-  var __dirname = "/home/runner/work/omni/omni/.stable-source/node_modules/.bun/@grpc+grpc-js@1.14.3/node_modules/@grpc/grpc-js/build/src";
+  var __dirname = "/home/runner/work/omni/omni/node_modules/.bun/@grpc+grpc-js@1.14.3/node_modules/@grpc/grpc-js/build/src";
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.registerChannelzSocket = exports.registerChannelzServer = exports.registerChannelzSubchannel = exports.registerChannelzChannel = exports.ChannelzCallTrackerStub = exports.ChannelzCallTracker = exports.ChannelzChildrenTrackerStub = exports.ChannelzChildrenTracker = exports.ChannelzTrace = exports.ChannelzTraceStub = undefined;
   exports.unregisterChannelzRef = unregisterChannelzRef;
@@ -298948,7 +298950,7 @@ var require_duration = __commonJS((exports) => {
 
 // ../../node_modules/.bun/@grpc+grpc-js@1.14.3/node_modules/@grpc/grpc-js/build/src/orca.js
 var require_orca = __commonJS((exports) => {
-  var __dirname = "/home/runner/work/omni/omni/.stable-source/node_modules/.bun/@grpc+grpc-js@1.14.3/node_modules/@grpc/grpc-js/build/src";
+  var __dirname = "/home/runner/work/omni/omni/node_modules/.bun/@grpc+grpc-js@1.14.3/node_modules/@grpc/grpc-js/build/src";
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.OrcaOobMetricsSubchannelWrapper = exports.GRPC_METRICS_HEADER = exports.ServerMetricRecorder = exports.PerRequestMetricRecorder = undefined;
   exports.createOrcaClient = createOrcaClient;
@@ -387615,12 +387617,39 @@ class InstanceService {
     const [row] = await this.db.select({ tenantId: instances.tenantId }).from(instances).where(eq(instances.id, id)).limit(1);
     return this.sealTenantFor(row?.tenantId ?? null);
   }
+  async findBySlackIdentity(teamId, userId) {
+    const [row] = await this.db.select().from(instances).where(and2(eq(instances.slackConnectionMethod, "oauth"), eq(instances.slackTeamId, teamId), userId === null ? isNull2(instances.slackUserId) : eq(instances.slackUserId, userId))).limit(1);
+    if (!row)
+      return;
+    rememberInstanceOwners([row]);
+    return openInstanceCredentials(row);
+  }
   async create(data) {
-    const rowTenant = data.tenantId ?? null;
-    const [created] = await this.db.insert(instances).values(sealInstanceCredentials(this.sealTenantFor(rowTenant), data)).returning();
+    const created = await this.insert(data, false);
     if (!created) {
       throw new Error("Failed to create instance");
     }
+    return created;
+  }
+  async createSlackOAuth(data) {
+    return this.insert({ ...data, slackConnectionMethod: "oauth" }, true);
+  }
+  async insert(data, slackIdentityConflict) {
+    const rowTenant = data.tenantId ?? null;
+    const query = this.db.insert(instances).values(sealInstanceCredentials(this.sealTenantFor(rowTenant), data));
+    if (slackIdentityConflict) {
+      query.onConflictDoNothing(data.slackUserId == null ? {
+        target: instances.slackTeamId,
+        where: sql`${instances.slackConnectionMethod} = 'oauth' AND ${instances.slackUserId} IS NULL`
+      } : {
+        target: [instances.slackTeamId, instances.slackUserId],
+        where: sql`${instances.slackConnectionMethod} = 'oauth' AND ${instances.slackUserId} IS NOT NULL`
+      });
+    }
+    const [created] = await query.returning();
+    if (!created) {
+      return null;
+    }
     rememberInstanceOwners([created]);
     if (this.eventBus) {
       await this.eventBus.publish("instance.connected", {
@@ -412858,19 +412887,8 @@ function isAllowedReturnTo(returnTo, publicOrigin) {
   }
   return url.origin === publicOrigin && url.search === "" && url.hash === "";
 }
-function matchesIdentity(row, input) {
-  if (row.channel !== "slack" || row.slackTeamId !== input.teamId)
-    return false;
-  if (input.mode === "user")
-    return row.slackUserId === input.userId && row.slackAuthMode === "user";
-  return row.slackUserId == null && (row.slackAuthMode ?? "bot") === "bot";
-}
-async function findExisting(instances2, input) {
-  const page = await instances2.list({ channel: ["slack"], limit: SLACK_LOOKUP_LIMIT });
-  if (page.hasMore) {
-    log127.warn("Slack OAuth identity lookup truncated; add a service finder", { limit: SLACK_LOOKUP_LIMIT });
-  }
-  return page.items.find((row) => matchesIdentity(row, input));
+function findExisting(instances2, input) {
+  return instances2.findBySlackIdentity(input.teamId, input.mode === "user" ? input.userId : null);
 }
 function baseName(input) {
   const team = (input.teamName ?? input.teamId).trim() || input.teamId;
@@ -412903,7 +412921,7 @@ async function createWithUniqueName(instances2, input) {
   for (let attempt = 1;attempt <= NAME_SUFFIX_ATTEMPTS; attempt++) {
     const name = attempt === 1 ? base2 : `${base2} ${attempt}`;
     try {
-      return await instances2.create({
+      return await instances2.createSlackOAuth({
         name,
         channel: "slack",
         profileName: input.mode === "user" ? input.displayName ?? null : input.teamName ?? null,
@@ -412956,8 +412974,14 @@ function resolvePlugin(registry5) {
 async function upsertSlackOAuthInstance(deps, input) {
   const plugin13 = resolvePlugin(deps.channelRegistry);
   const existing = await findExisting(deps.instances, input);
-  const row = existing ? await deps.instances.update(existing.id, credentialColumns(input)) : await createWithUniqueName(deps.instances, input);
-  const created = !existing;
+  let row = existing ? null : await createWithUniqueName(deps.instances, input);
+  const created = row !== null;
+  if (!row) {
+    const current = existing ?? await findExisting(deps.instances, input);
+    if (!current)
+      throw new Error("slack-oauth: identity conflict but no row found");
+    row = await deps.instances.update(current.id, credentialColumns(input));
+  }
   log127.info(created ? "Slack OAuth instance created" : "Slack OAuth instance re-authorized", {
     instanceId: row.id,
     teamId: input.teamId,
@@ -412972,7 +412996,7 @@ async function upsertSlackOAuthInstance(deps, input) {
   }
   return { instanceId: row.id, created };
 }
-var log127, SLACK_LOOKUP_LIMIT = 1000, NAME_MAX = 200, NAME_SUFFIX_ATTEMPTS = 20;
+var log127, NAME_MAX = 200, NAME_SUFFIX_ATTEMPTS = 20;
 var init_slack_oauth2 = __esm(() => {
   init_src4();
   init_src();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/omni",
-  "version": "2.260923.5",
+  "version": "2.260923.6",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/automagik-dev/omni.git",