@consiliency/agent-board-schema 1.2.0

package/migrations/20260512000000_agent_board_auth_provisioning_rpcs.sql

@@ -0,0 +1,622 @@
+create or replace function agent_board._is_service_role()
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select coalesce(auth.role(), '') = 'service_role'
+    or (
+      coalesce(auth.role(), '') = ''
+      and session_user in ('postgres', 'supabase_admin')
+    )
+$$;
+
+create or replace function agent_board._resolved_actor_agent_id(
+  p_supplied_agent_id uuid,
+  p_param_name text
+)
+returns uuid
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_current_agent_id uuid;
+begin
+  if agent_board._is_service_role() then
+    if p_supplied_agent_id is null then
+      raise exception '% is required for service_role callers', p_param_name using errcode = '22023';
+    end if;
+    return p_supplied_agent_id;
+  end if;
+
+  v_current_agent_id := agent_board.current_agent_id();
+  if v_current_agent_id is null then
+    raise exception 'current agent principal not resolved' using errcode = '42501';
+  end if;
+
+  if p_supplied_agent_id is not null and p_supplied_agent_id <> v_current_agent_id then
+    raise exception '% must match current_agent_id()', p_param_name using errcode = '42501';
+  end if;
+
+  return v_current_agent_id;
+end;
+$$;
+
+create or replace function agent_board._require_platform_admin_user_id()
+returns uuid
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_user_id uuid;
+begin
+  if agent_board._is_service_role() then
+    return null;
+  end if;
+
+  v_user_id := auth.uid();
+  if v_user_id is null then
+    raise exception 'authenticated caller required' using errcode = '42501';
+  end if;
+
+  if not exists (
+    select 1
+      from public.user_org_roles uor
+     where uor.user_id = v_user_id
+       and uor.role = 'platform_admin'
+  ) then
+    raise exception 'platform_admin role required' using errcode = '42501';
+  end if;
+
+  return v_user_id;
+end;
+$$;
+
+create or replace function agent_board._normalize_provision_slug(p_slug text)
+returns text
+language plpgsql
+immutable
+security definer
+set search_path = ''
+as $$
+declare
+  v_slug text := lower(coalesce(trim(p_slug), ''));
+begin
+  if v_slug = '' or v_slug !~ '^[a-z0-9]+(?:[-_][a-z0-9]+)*$' then
+    raise exception 'slug must match ^[a-z0-9]+(?:[-_][a-z0-9]+)*$' using errcode = '22023';
+  end if;
+
+  return v_slug;
+end;
+$$;
+
+create or replace function agent_board._default_provision_display_name(p_slug text)
+returns text
+language sql
+immutable
+security definer
+set search_path = ''
+as $$
+  select replace(initcap(replace(p_slug, '-', ' ')), '_', ' ')
+$$;
+
+create or replace function agent_board._ensure_agent_auth_user(
+  p_slug text
+)
+returns uuid
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_email text := format('agent+%s@agent-board.local', p_slug);
+  v_user_id uuid;
+begin
+  select u.id
+    into v_user_id
+    from auth.users u
+   where lower(u.email) = v_email
+   limit 1;
+
+  if v_user_id is not null then
+    return v_user_id;
+  end if;
+
+  v_user_id := gen_random_uuid();
+
+  insert into auth.users (
+    id,
+    instance_id,
+    email,
+    email_confirmed_at,
+    encrypted_password,
+    created_at,
+    updated_at,
+    raw_app_meta_data,
+    raw_user_meta_data,
+    aud,
+    role
+  )
+  values (
+    v_user_id,
+    '00000000-0000-0000-0000-000000000000',
+    v_email,
+    now(),
+    '',
+    now(),
+    now(),
+    jsonb_build_object('provider', 'agent_board', 'providers', jsonb_build_array('agent_board')),
+    jsonb_build_object('slug', p_slug, 'issuer', 'agent_board.provision_agent'),
+    'authenticated',
+    'authenticated'
+  );
+
+  insert into auth.identities (
+    id,
+    user_id,
+    provider_id,
+    provider,
+    identity_data,
+    last_sign_in_at,
+    created_at,
+    updated_at
+  )
+  values (
+    gen_random_uuid(),
+    v_user_id,
+    p_slug,
+    'agent_board',
+    jsonb_build_object('sub', p_slug, 'slug', p_slug),
+    now(),
+    now(),
+    now()
+  )
+  on conflict do nothing;
+
+  return v_user_id;
+end;
+$$;
+
+create or replace function agent_board._current_agent_has_board_access(
+  p_board_id uuid
+)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select
+    agent_board._is_service_role()
+    or exists (
+      select 1
+        from agent_board.board_memberships bm
+       where bm.board_id = p_board_id
+         and bm.agent_id = agent_board.current_agent_id()
+         and bm.membership_state in ('joined', 'subscribed')
+    )
+$$;
+
+create or replace function agent_board._current_agent_can_access_thread(
+  p_thread_id uuid
+)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select
+    agent_board._is_service_role()
+    or exists (
+      select 1
+        from agent_board.threads t
+       where t.id = p_thread_id
+         and (
+           t.created_by_agent_id = agent_board.current_agent_id()
+           or exists (
+             select 1
+               from agent_board.messages m
+              where m.thread_id = t.id
+                and m.author_agent_id = agent_board.current_agent_id()
+           )
+           or exists (
+             select 1
+               from agent_board.tasks task
+              where task.thread_id = t.id
+                and (
+                  task.created_by_agent_id = agent_board.current_agent_id()
+                  or task.assigned_agent_id = agent_board.current_agent_id()
+                )
+           )
+           or exists (
+             select 1
+               from agent_board.read_receipts rr
+              where rr.thread_id = t.id
+                and rr.agent_id = agent_board.current_agent_id()
+           )
+           or exists (
+             select 1
+               from agent_board.claims c
+              where c.thread_id = t.id
+                and c.agent_id = agent_board.current_agent_id()
+           )
+           or exists (
+             select 1
+               from agent_board.inbox_items ii
+               left join agent_board.messages im on im.id = ii.source_message_id
+               left join agent_board.tasks it on it.id = ii.source_task_id
+               left join agent_board.delegations ide on ide.id = ii.source_delegation_id
+               left join agent_board.tasks idt on idt.id = ide.child_task_id
+              where ii.recipient_agent_id = agent_board.current_agent_id()
+                and (
+                  im.thread_id = t.id
+                  or it.thread_id = t.id
+                  or idt.thread_id = t.id
+                )
+           )
+           or exists (
+             select 1
+               from agent_board.delivery_recipients dr
+               join agent_board.messages bm on bm.id = dr.source_message_id
+              where dr.board_id is not null
+                and bm.thread_id = t.id
+                and agent_board._current_agent_has_board_access(dr.board_id)
+           )
+         )
+    )
+$$;
+
+create or replace function agent_board._current_agent_can_access_task(
+  p_task_id uuid
+)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select
+    agent_board._is_service_role()
+    or exists (
+      select 1
+        from agent_board.tasks t
+       where t.id = p_task_id
+         and (
+           t.created_by_agent_id = agent_board.current_agent_id()
+           or t.assigned_agent_id = agent_board.current_agent_id()
+           or agent_board._current_agent_can_access_thread(t.thread_id)
+         )
+    )
+$$;
+
+create or replace function agent_board._mint_agent_refresh_token()
+returns text
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  select encode(extensions.gen_random_bytes(32), 'hex')
+$$;
+
+create or replace function agent_board._issue_agent_credential(
+  p_agent_id uuid,
+  p_credential_label text,
+  p_replaces_credential_id uuid default null,
+  p_metadata jsonb default '{}'::jsonb
+)
+returns table(
+  credential_id uuid,
+  refresh_token text,
+  expires_at timestamptz,
+  created_at timestamptz,
+  replaces_credential_id uuid
+)
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_refresh_token text;
+  v_expires_at timestamptz := now() + interval '30 days';
+  v_created_at timestamptz := now();
+  v_credential_id uuid;
+begin
+  v_refresh_token := agent_board._mint_agent_refresh_token();
+
+  insert into agent_board.agent_credentials(
+    agent_id,
+    refresh_token_hash,
+    hash_version,
+    credential_label,
+    expires_at,
+    replaces_credential_id,
+    metadata,
+    created_at,
+    updated_at
+  )
+  values (
+    p_agent_id,
+    extensions.digest(v_refresh_token, 'sha256'),
+    1,
+    p_credential_label,
+    v_expires_at,
+    p_replaces_credential_id,
+    coalesce(p_metadata, '{}'::jsonb),
+    v_created_at,
+    v_created_at
+  )
+  returning id into v_credential_id;
+
+  if p_replaces_credential_id is not null then
+    update agent_board.agent_credentials
+       set revoked_at = coalesce(revoked_at, v_created_at),
+           rotated_at = coalesce(rotated_at, v_created_at),
+           replaced_by_credential_id = v_credential_id,
+           updated_at = v_created_at
+     where id = p_replaces_credential_id;
+  end if;
+
+  return query
+  select v_credential_id, v_refresh_token, v_expires_at, v_created_at, p_replaces_credential_id;
+end;
+$$;
+
+create or replace function agent_board.provision_agent(
+  p_slug text,
+  p_kind text,
+  p_scopes jsonb default '[]'::jsonb,
+  p_owner_user_id uuid default null
+)
+returns table(
+  agent_id uuid,
+  auth_user_id uuid,
+  credential_id uuid,
+  refresh_token text,
+  expires_at timestamptz,
+  created_at timestamptz
+)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_slug text;
+  v_kind text;
+  v_owner_user_id uuid;
+  v_admin_user_id uuid;
+  v_auth_user_id uuid;
+  v_agent agent_board.agents%rowtype;
+  v_credential record;
+begin
+  v_admin_user_id := agent_board._require_platform_admin_user_id();
+  v_slug := agent_board._normalize_provision_slug(p_slug);
+  v_kind := lower(coalesce(trim(p_kind), ''));
+  v_owner_user_id := p_owner_user_id;
+
+  if v_kind not in ('human', 'agent', 'system') then
+    raise exception 'kind must be one of human, agent, or system' using errcode = '22023';
+  end if;
+
+  if v_kind = 'system' then
+    v_owner_user_id := null;
+  elsif v_owner_user_id is null then
+    raise exception 'owner_user_id is required for human and agent principals' using errcode = '22023';
+  elsif not exists (select 1 from auth.users where id = v_owner_user_id) then
+    raise exception 'owner user not found' using errcode = 'P0002';
+  end if;
+
+  select *
+    into v_agent
+    from agent_board.agents
+   where handle = v_slug
+   limit 1
+   for update;
+
+  v_auth_user_id := coalesce(v_agent.auth_user_id, agent_board._ensure_agent_auth_user(v_slug));
+
+  if v_agent.id is null then
+    insert into agent_board.agents(
+      agent_type,
+      kind,
+      handle,
+      display_name,
+      status,
+      auth_user_id,
+      owner_user_id,
+      metadata
+    )
+    values (
+      v_kind,
+      v_kind::agent_board.agent_kind,
+      v_slug,
+      agent_board._default_provision_display_name(v_slug),
+      'active',
+      v_auth_user_id,
+      v_owner_user_id,
+      jsonb_build_object(
+        'scopes', coalesce(p_scopes, '[]'::jsonb),
+        'provisionedByUserId', v_admin_user_id,
+        'provisionedAt', now()
+      )
+    )
+    returning * into v_agent;
+  else
+    update agent_board.agents a
+       set agent_type = v_kind,
+           kind = v_kind::agent_board.agent_kind,
+           status = 'active',
+           auth_user_id = v_auth_user_id,
+           owner_user_id = v_owner_user_id,
+           metadata = coalesce(a.metadata, '{}'::jsonb)
+             || jsonb_build_object(
+               'scopes', coalesce(p_scopes, '[]'::jsonb),
+               'provisionedByUserId', v_admin_user_id,
+               'provisionedAt', now()
+             ),
+           updated_at = now()
+     where a.id = v_agent.id
+     returning * into v_agent;
+  end if;
+
+  select *
+    into v_credential
+    from agent_board._issue_agent_credential(
+      v_agent.id,
+      'provisioned',
+      (
+        select ac.id
+          from agent_board.agent_credentials ac
+         where ac.agent_id = v_agent.id
+           and ac.revoked_at is null
+         order by ac.created_at desc
+         limit 1
+      ),
+      jsonb_build_object('issuedByUserId', v_admin_user_id, 'issuedAt', now(), 'scopes', coalesce(p_scopes, '[]'::jsonb))
+    );
+
+  return query
+  select v_agent.id, v_auth_user_id, v_credential.credential_id, v_credential.refresh_token, v_credential.expires_at, v_credential.created_at;
+end;
+$$;
+
+create or replace function agent_board.rotate_agent_token(
+  p_agent_id uuid
+)
+returns table(
+  agent_id uuid,
+  credential_id uuid,
+  refresh_token text,
+  expires_at timestamptz,
+  rotated_at timestamptz,
+  replaces_credential_id uuid
+)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_admin_user_id uuid;
+  v_agent agent_board.agents%rowtype;
+  v_previous_credential_id uuid;
+  v_credential record;
+begin
+  v_admin_user_id := agent_board._require_platform_admin_user_id();
+
+  select *
+    into v_agent
+    from agent_board.agents
+   where id = p_agent_id
+   limit 1
+   for update;
+
+  if v_agent.id is null then
+    raise exception 'agent not found' using errcode = 'P0002';
+  end if;
+
+  select ac.id
+    into v_previous_credential_id
+    from agent_board.agent_credentials ac
+   where ac.agent_id = p_agent_id
+     and ac.revoked_at is null
+   order by ac.created_at desc
+   limit 1
+   for update;
+
+  select *
+    into v_credential
+    from agent_board._issue_agent_credential(
+      p_agent_id,
+      'rotated',
+      v_previous_credential_id,
+      jsonb_build_object('rotatedByUserId', v_admin_user_id, 'rotatedAt', now())
+    );
+
+  return query
+  select p_agent_id, v_credential.credential_id, v_credential.refresh_token, v_credential.expires_at, v_credential.created_at, v_credential.replaces_credential_id;
+end;
+$$;
+
+create or replace function agent_board.revoke_agent(
+  p_agent_id uuid,
+  p_reason text default null
+)
+returns table(
+  agent_id uuid,
+  status text,
+  revoked_credential_count integer,
+  revoked_at timestamptz
+)
+language plpgsql
+security definer
+set search_path = agent_board, public
+as $$
+declare
+  v_admin_user_id uuid;
+  v_agent agent_board.agents%rowtype;
+  v_revoked_at timestamptz := now();
+  v_revoked_count integer := 0;
+begin
+  v_admin_user_id := agent_board._require_platform_admin_user_id();
+
+  update agent_board.agents a
+     set status = 'suspended',
+         updated_at = v_revoked_at,
+         metadata = coalesce(a.metadata, '{}'::jsonb)
+           || jsonb_build_object(
+             'revokedByUserId', v_admin_user_id,
+             'revokedAt', v_revoked_at,
+             'revocationReason', nullif(trim(p_reason), '')
+           )
+   where a.id = p_agent_id
+   returning * into v_agent;
+
+  if v_agent.id is null then
+    raise exception 'agent not found' using errcode = 'P0002';
+  end if;
+
+  update agent_board.agent_credentials ac
+     set revoked_at = coalesce(ac.revoked_at, v_revoked_at),
+         updated_at = v_revoked_at,
+         metadata = coalesce(ac.metadata, '{}'::jsonb)
+           || jsonb_build_object(
+             'revokedByUserId', v_admin_user_id,
+             'revokedAt', v_revoked_at,
+             'revocationReason', nullif(trim(p_reason), '')
+           )
+   where ac.agent_id = p_agent_id
+     and ac.revoked_at is null;
+
+  get diagnostics v_revoked_count = row_count;
+
+  return query
+  select v_agent.id, v_agent.status, v_revoked_count, v_revoked_at;
+end;
+$$;
+
+revoke all on function agent_board._is_service_role() from public, anon, authenticated;
+revoke all on function agent_board._resolved_actor_agent_id(uuid, text) from public, anon, authenticated;
+revoke all on function agent_board._require_platform_admin_user_id() from public, anon, authenticated;
+revoke all on function agent_board._normalize_provision_slug(text) from public, anon, authenticated;
+revoke all on function agent_board._default_provision_display_name(text) from public, anon, authenticated;
+revoke all on function agent_board._ensure_agent_auth_user(text) from public, anon, authenticated;
+revoke all on function agent_board._current_agent_has_board_access(uuid) from public, anon, authenticated;
+revoke all on function agent_board._current_agent_can_access_thread(uuid) from public, anon, authenticated;
+revoke all on function agent_board._current_agent_can_access_task(uuid) from public, anon, authenticated;
+revoke all on function agent_board._mint_agent_refresh_token() from public, anon, authenticated;
+revoke all on function agent_board._issue_agent_credential(uuid, text, uuid, jsonb) from public, anon, authenticated;
+
+revoke all on function agent_board.provision_agent(text, text, jsonb, uuid) from public, anon;
+revoke all on function agent_board.rotate_agent_token(uuid) from public, anon;
+revoke all on function agent_board.revoke_agent(uuid, text) from public, anon;
+
+grant execute on all functions in schema agent_board to service_role;
+grant execute on function agent_board.provision_agent(text, text, jsonb, uuid) to authenticated;
+grant execute on function agent_board.rotate_agent_token(uuid) to authenticated;
+grant execute on function agent_board.revoke_agent(uuid, text) to authenticated;