@bevel-software/platform-core-backend 0.19.0 → 0.21.0

package/migrations/0000_core_init.sql

@@ -173,51 +173,51 @@ CREATE TABLE IF NOT EXISTS "users" (
 --> statement-breakpoint
 DO $$ BEGIN
 	IF NOT EXISTS (
-		SELECT 1 FROM pg_constraint WHERE conname = 'api_tokens_user_id_users_id_fk' AND conrelid = 'public.api_tokens'::regclass
+		SELECT 1 FROM pg_constraint WHERE conname = 'api_tokens_user_id_users_id_fk' AND conrelid = to_regclass('api_tokens')
 	) THEN
-		ALTER TABLE "api_tokens" ADD CONSTRAINT "api_tokens_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;
+		ALTER TABLE "api_tokens" ADD CONSTRAINT "api_tokens_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE no action ON UPDATE no action;
 	END IF;
 END $$;--> statement-breakpoint
 DO $$ BEGIN
 	IF NOT EXISTS (
-		SELECT 1 FROM pg_constraint WHERE conname = 'file_locks_holder_user_id_users_id_fk' AND conrelid = 'public.file_locks'::regclass
+		SELECT 1 FROM pg_constraint WHERE conname = 'file_locks_holder_user_id_users_id_fk' AND conrelid = to_regclass('file_locks')
 	) THEN
-		ALTER TABLE "file_locks" ADD CONSTRAINT "file_locks_holder_user_id_users_id_fk" FOREIGN KEY ("holder_user_id") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;
+		ALTER TABLE "file_locks" ADD CONSTRAINT "file_locks_holder_user_id_users_id_fk" FOREIGN KEY ("holder_user_id") REFERENCES "users"("id") ON DELETE no action ON UPDATE no action;
 	END IF;
 END $$;--> statement-breakpoint
 DO $$ BEGIN
 	IF NOT EXISTS (
-		SELECT 1 FROM pg_constraint WHERE conname = 'oauth_auth_codes_client_id_oauth_clients_client_id_fk' AND conrelid = 'public.oauth_auth_codes'::regclass
+		SELECT 1 FROM pg_constraint WHERE conname = 'oauth_auth_codes_client_id_oauth_clients_client_id_fk' AND conrelid = to_regclass('oauth_auth_codes')
 	) THEN
-		ALTER TABLE "oauth_auth_codes" ADD CONSTRAINT "oauth_auth_codes_client_id_oauth_clients_client_id_fk" FOREIGN KEY ("client_id") REFERENCES "public"."oauth_clients"("client_id") ON DELETE no action ON UPDATE no action;
+		ALTER TABLE "oauth_auth_codes" ADD CONSTRAINT "oauth_auth_codes_client_id_oauth_clients_client_id_fk" FOREIGN KEY ("client_id") REFERENCES "oauth_clients"("client_id") ON DELETE no action ON UPDATE no action;
 	END IF;
 END $$;--> statement-breakpoint
 DO $$ BEGIN
 	IF NOT EXISTS (
-		SELECT 1 FROM pg_constraint WHERE conname = 'oauth_auth_codes_user_id_users_id_fk' AND conrelid = 'public.oauth_auth_codes'::regclass
+		SELECT 1 FROM pg_constraint WHERE conname = 'oauth_auth_codes_user_id_users_id_fk' AND conrelid = to_regclass('oauth_auth_codes')
 	) THEN
-		ALTER TABLE "oauth_auth_codes" ADD CONSTRAINT "oauth_auth_codes_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;
+		ALTER TABLE "oauth_auth_codes" ADD CONSTRAINT "oauth_auth_codes_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE no action ON UPDATE no action;
 	END IF;
 END $$;--> statement-breakpoint
 DO $$ BEGIN
 	IF NOT EXISTS (
-		SELECT 1 FROM pg_constraint WHERE conname = 'oauth_tokens_client_id_oauth_clients_client_id_fk' AND conrelid = 'public.oauth_tokens'::regclass
+		SELECT 1 FROM pg_constraint WHERE conname = 'oauth_tokens_client_id_oauth_clients_client_id_fk' AND conrelid = to_regclass('oauth_tokens')
 	) THEN
-		ALTER TABLE "oauth_tokens" ADD CONSTRAINT "oauth_tokens_client_id_oauth_clients_client_id_fk" FOREIGN KEY ("client_id") REFERENCES "public"."oauth_clients"("client_id") ON DELETE no action ON UPDATE no action;
+		ALTER TABLE "oauth_tokens" ADD CONSTRAINT "oauth_tokens_client_id_oauth_clients_client_id_fk" FOREIGN KEY ("client_id") REFERENCES "oauth_clients"("client_id") ON DELETE no action ON UPDATE no action;
 	END IF;
 END $$;--> statement-breakpoint
 DO $$ BEGIN
 	IF NOT EXISTS (
-		SELECT 1 FROM pg_constraint WHERE conname = 'oauth_tokens_user_id_users_id_fk' AND conrelid = 'public.oauth_tokens'::regclass
+		SELECT 1 FROM pg_constraint WHERE conname = 'oauth_tokens_user_id_users_id_fk' AND conrelid = to_regclass('oauth_tokens')
 	) THEN
-		ALTER TABLE "oauth_tokens" ADD CONSTRAINT "oauth_tokens_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;
+		ALTER TABLE "oauth_tokens" ADD CONSTRAINT "oauth_tokens_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE no action ON UPDATE no action;
 	END IF;
 END $$;--> statement-breakpoint
 DO $$ BEGIN
 	IF NOT EXISTS (
-		SELECT 1 FROM pg_constraint WHERE conname = 'secrets_user_id_users_id_fk' AND conrelid = 'public.secrets'::regclass
+		SELECT 1 FROM pg_constraint WHERE conname = 'secrets_user_id_users_id_fk' AND conrelid = to_regclass('secrets')
 	) THEN
-		ALTER TABLE "secrets" ADD CONSTRAINT "secrets_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;
+		ALTER TABLE "secrets" ADD CONSTRAINT "secrets_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE cascade ON UPDATE no action;
 	END IF;
 END $$;--> statement-breakpoint
 CREATE UNIQUE INDEX IF NOT EXISTS "change_requests_number_unq" ON "change_requests" USING btree ("number");--> statement-breakpoint

package/migrations/0003_deployment_settings.sql

@@ -6,4 +6,4 @@ CREATE TABLE "deployment_settings" (
 	"updated_at" timestamp DEFAULT now() NOT NULL
 );
 --> statement-breakpoint
-ALTER TABLE "deployment_settings" ADD CONSTRAINT "deployment_settings_updated_by_users_id_fk" FOREIGN KEY ("updated_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;
+ALTER TABLE "deployment_settings" ADD CONSTRAINT "deployment_settings_updated_by_users_id_fk" FOREIGN KEY ("updated_by") REFERENCES "users"("id") ON DELETE set null ON UPDATE no action;

package/migrations/0005_github_facade.sql

@@ -22,4 +22,4 @@ CREATE TABLE "github_facade_identity" (
 );
 --> statement-breakpoint
 ALTER TABLE "api_tokens" ADD COLUMN "kind" text DEFAULT 'key' NOT NULL;--> statement-breakpoint
-ALTER TABLE "github_facade_codes" ADD CONSTRAINT "github_facade_codes_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;
+ALTER TABLE "github_facade_codes" ADD CONSTRAINT "github_facade_codes_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE cascade ON UPDATE no action;

package/migrations/0012_agent_audit.sql

@@ -0,0 +1,41 @@
+CREATE TABLE "agent_connections" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"user_id" uuid NOT NULL,
+	"client_id" text NOT NULL,
+	"client_name" text,
+	"connected_at" timestamp DEFAULT now() NOT NULL,
+	"last_used_at" timestamp,
+	"revoked_at" timestamp,
+	"revoked_by" text
+);
+--> statement-breakpoint
+CREATE TABLE "agent_events" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"user_id" uuid NOT NULL,
+	"key_id" uuid,
+	"connection_id" uuid,
+	"kind" text NOT NULL,
+	"manual" text,
+	"name" text NOT NULL,
+	"outcome" text NOT NULL,
+	"duration_ms" integer,
+	"at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "agent_events_kind" CHECK ("agent_events"."kind" IN ('capability', 'tool', 'skill')),
+	CONSTRAINT "agent_events_outcome" CHECK ("agent_events"."outcome" IN ('ok', 'error', 'denied')),
+	CONSTRAINT "agent_events_principal" CHECK (("agent_events"."key_id" IS NULL) <> ("agent_events"."connection_id" IS NULL))
+);
+--> statement-breakpoint
+ALTER TABLE "oauth_tokens" ADD COLUMN "connection_id" uuid;--> statement-breakpoint
+ALTER TABLE "agent_connections" ADD CONSTRAINT "agent_connections_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_connections" ADD CONSTRAINT "agent_connections_client_id_oauth_clients_client_id_fk" FOREIGN KEY ("client_id") REFERENCES "oauth_clients"("client_id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_events" ADD CONSTRAINT "agent_events_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_events" ADD CONSTRAINT "agent_events_key_id_api_tokens_id_fk" FOREIGN KEY ("key_id") REFERENCES "api_tokens"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_events" ADD CONSTRAINT "agent_events_connection_id_agent_connections_id_fk" FOREIGN KEY ("connection_id") REFERENCES "agent_connections"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "agent_connections_by_user" ON "agent_connections" USING btree ("user_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "agent_connections_live_unq" ON "agent_connections" USING btree ("user_id","client_id") WHERE "agent_connections"."revoked_at" is null;--> statement-breakpoint
+CREATE INDEX "agent_events_by_key" ON "agent_events" USING btree ("key_id","at");--> statement-breakpoint
+CREATE INDEX "agent_events_by_connection" ON "agent_events" USING btree ("connection_id","at");--> statement-breakpoint
+CREATE INDEX "agent_events_by_at" ON "agent_events" USING btree ("at");--> statement-breakpoint
+CREATE INDEX "agent_events_by_user" ON "agent_events" USING btree ("user_id");--> statement-breakpoint
+ALTER TABLE "oauth_tokens" ADD CONSTRAINT "oauth_tokens_connection_id_agent_connections_id_fk" FOREIGN KEY ("connection_id") REFERENCES "agent_connections"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "oauth_tokens_by_connection" ON "oauth_tokens" USING btree ("connection_id");

package/migrations/0013_agent_identity_and_key_soft_delete.sql

@@ -0,0 +1,29 @@
+-- An agent connection is the AGENT per person, not the OAuth client
+-- registration: Claude registers a fresh client on every re-authorisation,
+-- so keying by registration gave one person a row per sign-in. The key is
+-- now the folded client name (the client id for a name-less registration).
+-- Rows that already exist are backfilled with the same fold the provider
+-- applies, and the live duplicates each person has under one key are MERGED
+-- into the earliest of them: their tokens and events move to it, so nothing
+-- an agent did is lost, and the rest are removed.
+--
+-- Written by hand around the generated DDL, since the generated version
+-- would add a NOT NULL column to a populated table and build a unique index
+-- over rows that still collide. Guarded, like 0011: a database built from a
+-- head where this already ran no-ops instead of failing.
+DROP INDEX IF EXISTS "agent_connections_live_unq";--> statement-breakpoint
+ALTER TABLE "agent_connections" ADD COLUMN IF NOT EXISTS "agent_key" text;--> statement-breakpoint
+UPDATE "agent_connections" SET "agent_key" = COALESCE(NULLIF(lower(btrim("client_name")), ''), "client_id") WHERE "agent_key" IS NULL;--> statement-breakpoint
+CREATE TEMP TABLE "agent_connection_dupes" AS
+SELECT "id", first_value("id") OVER (PARTITION BY "user_id", "agent_key" ORDER BY "connected_at", "id") AS "keeper"
+FROM "agent_connections"
+WHERE "revoked_at" IS NULL;--> statement-breakpoint
+DELETE FROM "agent_connection_dupes" WHERE "id" = "keeper";--> statement-breakpoint
+UPDATE "oauth_tokens" t SET "connection_id" = d."keeper" FROM "agent_connection_dupes" d WHERE t."connection_id" = d."id";--> statement-breakpoint
+UPDATE "agent_events" e SET "connection_id" = d."keeper" FROM "agent_connection_dupes" d WHERE e."connection_id" = d."id";--> statement-breakpoint
+UPDATE "agent_connections" k SET "last_used_at" = GREATEST(k."last_used_at", (SELECT MAX(a."last_used_at") FROM "agent_connections" a JOIN "agent_connection_dupes" d ON d."id" = a."id" WHERE d."keeper" = k."id")) WHERE k."id" IN (SELECT DISTINCT "keeper" FROM "agent_connection_dupes");--> statement-breakpoint
+DELETE FROM "agent_connections" a USING "agent_connection_dupes" d WHERE a."id" = d."id";--> statement-breakpoint
+DROP TABLE "agent_connection_dupes";--> statement-breakpoint
+ALTER TABLE "agent_connections" ALTER COLUMN "agent_key" SET NOT NULL;--> statement-breakpoint
+ALTER TABLE "api_tokens" ADD COLUMN IF NOT EXISTS "deleted_at" timestamp;--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "agent_connections_live_unq" ON "agent_connections" USING btree ("user_id","agent_key") WHERE "agent_connections"."revoked_at" is null;