@fayz-ai/plugin-agenda 0.16.1 → 0.17.0

package/dist/index.js

@@ -10585,6 +10585,222 @@ END $$;
 -- pool must be REVOKED AT GOOGLE, not assumed gone \u2014 which is also why every
 -- tenant re-consents after this file runs.
 `;
+var MIGRATION_008_THE_OUTBOUND_HALF = `-- ---------------------------------------------------------------------------
+-- Google Calendar \u2014 the outbound half that 007 does not install
+-- ---------------------------------------------------------------------------
+-- 007 is the credential-free install: it creates the five plg_calendar_* tables
+-- from zero, with no column a Google grant could ever sit in. What it does NOT
+-- create is the trigger on public.appointments that pushes a booking OUT to
+-- Google, because that trigger never lived in those tables.
+--
+-- Only 001 and 002 create \`trg_gcal_push\`, and 001 is the file whose credential
+-- columns 007 exists to prevent. So there is no ordering of the existing files
+-- that gives a fresh pool the outbound direction without also giving it, for a
+-- while, a plaintext refresh-token column.
+--
+-- The result on a pool installed by 007 alone: Google \u2192 Fayz works, Fayz \u2192
+-- Google is silent. Not an error, not a warning \u2014 appointments simply never
+-- reach the calendar. Discovered on cluster-squash-test after 007 came up green
+-- and the tables were correct.
+--
+-- This file is the missing half, and nothing else:
+--
+--   \xA71  public.fn_gcal_push_booking  \u2014 verbatim the definition 005 settled on:
+--       vault first (\`gcal_sync_url\` + \`gcal_outbound_secret\`), the legacy GUC
+--       only as a fallback that WARNs, and a no-op when neither is configured.
+--       Reproduced rather than referenced because 005 cannot run here: it
+--       replaces a function 001 created, and 001 is the file we are avoiding.
+--   \xA72  trg_gcal_push on public.appointments \u2014 the shape 002 re-asserts.
+--
+-- A pool that already ran 001\u2192006 gets an identical function and an identical
+-- trigger, which is why this is safe to apply anywhere: every statement is
+-- CREATE OR REPLACE / DROP-then-CREATE.
+--
+-- WITHOUT THE VAULT SECRETS THIS IS INERT ON PURPOSE. The function reads
+-- \`gcal_sync_url\` and \`gcal_outbound_secret\` from the vault and returns without
+-- pushing when they are absent, so installing the trigger before the secrets
+-- exist cannot break an INSERT into appointments \u2014 the most load-bearing table
+-- the agenda has.
+--
+-- Idempotent and replay-safe.
+-- ---------------------------------------------------------------------------
+
+-- ===========================================================================
+-- \xA71 \u2014 the push, as 005 defined it
+-- ===========================================================================
+CREATE OR REPLACE FUNCTION public.fn_gcal_push_booking() RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, extensions, net, vault
+AS $$
+DECLARE
+  url      text;
+  key      text;
+  legacy   boolean := false;
+  rec      record := COALESCE(NEW, OLD);
+  op       text := lower(TG_OP);
+  corr     text := NULLIF(current_setting('app.booking_correlation_id', true), '');
+BEGIN
+  -- Unchanged from 004: inbound Google writes mark themselves, and a write
+  -- carrying that marker is never echoed back.
+  IF current_setting('app.booking_origin', true) = 'google' THEN
+    RETURN COALESCE(NEW, OLD);
+  END IF;
+
+  -- Vault first. Wrapped because a pool without the vault extension must
+  -- degrade to the fallback, not abort the booking write.
+  BEGIN
+    SELECT decrypted_secret INTO url
+      FROM vault.decrypted_secrets WHERE name = 'gcal_sync_url'
+      ORDER BY created_at DESC LIMIT 1;
+    SELECT decrypted_secret INTO key
+      FROM vault.decrypted_secrets WHERE name = 'gcal_outbound_secret'
+      ORDER BY created_at DESC LIMIT 1;
+  EXCEPTION WHEN OTHERS THEN
+    url := NULL;
+    key := NULL;
+  END;
+
+  -- Legacy pools provisioned per 001's header keep working, and say so.
+  IF NULLIF(url, '') IS NULL OR NULLIF(key, '') IS NULL THEN
+    url := COALESCE(NULLIF(url, ''), current_setting('app.gcal_sync_url', true));
+    key := COALESCE(NULLIF(key, ''), current_setting('app.gcal_service_key', true));
+    legacy := NULLIF(key, '') IS NOT NULL;
+  END IF;
+
+  -- Not configured is not an error: an unconfigured pool degrades to "Google is
+  -- not updated", never to "the appointment could not be saved".
+  IF NULLIF(url, '') IS NULL OR NULLIF(key, '') IS NULL THEN
+    RETURN COALESCE(NEW, OLD);
+  END IF;
+
+  IF legacy THEN
+    RAISE WARNING 'gcal outbound is still using app.gcal_service_key; move it to the vault secret gcal_outbound_secret and rotate the service-role key';
+  END IF;
+
+  -- Does THIS tenant have a calendar at all?
+  --
+  -- Added here, not inherited from 005. The vault secrets are per POOL and the
+  -- integration is per TENANT, so without this every appointment write in the
+  -- pool posted to the sync function \u2014 including for tenants that never
+  -- connected Google. On the cluster this was installed against that is 354.989
+  -- appointments across several tenants, all of them paying for an HTTP round
+  -- trip whose only possible answer is "no integration".
+  --
+  -- The function would have answered correctly; the cost is the asking. Indexed
+  -- by tenant (idx_plg_calendar_integrations_tenant), so the guard is a lookup,
+  -- not a scan.
+  --
+  -- A tenant who DISCONNECTS stops pushing from that moment, which means a
+  -- booking deleted afterwards leaves its Google event behind. That is the right
+  -- trade: the alternative is pushing on behalf of someone who revoked us.
+  IF NOT EXISTS (
+    SELECT 1 FROM public.plg_calendar_integrations i
+     WHERE i.tenant_id = rec.tenant_id AND i.active
+  ) THEN
+    RETURN COALESCE(NEW, OLD);
+  END IF;
+
+  BEGIN
+    PERFORM net.http_post(
+      url := url,
+      headers := jsonb_build_object(
+        'Content-Type', 'application/json',
+        -- REQUIRED. The deployed function authorises push_event on this header
+        -- alone; without it every push 400s, silently, forever.
+        'Authorization', 'Bearer ' || key
+      ),
+      body := jsonb_build_object(
+        'action', 'push_event',
+        'op', op,
+        'bookingId', rec.id,
+        'tenantId', rec.tenant_id,
+        -- Carried so a delete can still be honoured after the row is gone.
+        'googleEventId', rec.metadata->>'googleCalendarEventId',
+        'calendarId', rec.metadata->>'gcalCalendarId',
+        'correlationId', COALESCE(corr, gen_random_uuid()::text)
+      )
+    );
+  EXCEPTION WHEN OTHERS THEN
+    -- Missing pg_net, a bad URL, a full queue: the appointment is still saved.
+    -- The deployed trigger lacks this wrapper; 004 added it here after a pool
+    -- with the settings present but the extension missing took an INSERT down.
+    RAISE WARNING 'gcal push skipped for booking %: %', rec.id, SQLERRM;
+  END;
+
+  RETURN COALESCE(NEW, OLD);
+END $$;
+
+-- \xA72 \u2500\u2500 cleanup \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Redefining the function stops the key being PREFERRED; it does not stop it
+-- being STORED. Settings live in pg_db_role_setting per (database, role), so the
+-- sweep is driven off the catalog rather than off the one ALTER DATABASE form
+-- \`001\` happened to show.
+--
+-- CONDITIONAL ON PURPOSE: the setting is cleared only where Vault already
+-- supplies \`gcal_outbound_secret\`, i.e. only where \xA71 provably never needs the
+-- fallback. Anywhere else it is left in place and reported, because clearing it
+-- there would disarm the push with no error anyone can see. On the live pool
+-- this loop finds nothing \u2014 the setting is not present on any role or database \u2014
+-- and that is the expected result, not a failure.
+DO $$
+DECLARE
+  r          record;
+  has_vault  boolean := false;
+BEGIN
+  BEGIN
+    SELECT EXISTS (
+      SELECT 1 FROM vault.decrypted_secrets
+      WHERE name = 'gcal_outbound_secret' AND NULLIF(decrypted_secret, '') IS NOT NULL
+    ) INTO has_vault;
+  EXCEPTION WHEN OTHERS THEN
+    has_vault := false;
+  END;
+
+  FOR r IN
+    SELECT d.datname, a.rolname
+    FROM pg_db_role_setting s
+    LEFT JOIN pg_database d ON d.oid = s.setdatabase
+    LEFT JOIN pg_roles    a ON a.oid = s.setrole
+    WHERE EXISTS (
+      SELECT 1 FROM unnest(s.setconfig) AS c WHERE c LIKE 'app.gcal_service_key=%'
+    )
+  LOOP
+    IF NOT has_vault THEN
+      RAISE WARNING 'app.gcal_service_key is still set (database %, role %) and is the ONLY outbound credential \u2014 create the vault secret gcal_outbound_secret first, then re-run this migration',
+        r.datname, r.rolname;
+      CONTINUE;
+    END IF;
+    BEGIN
+      IF r.rolname IS NULL THEN
+        EXECUTE format('ALTER DATABASE %I RESET app.gcal_service_key', r.datname);
+      ELSIF r.datname IS NULL THEN
+        EXECUTE format('ALTER ROLE %I RESET app.gcal_service_key', r.rolname);
+      ELSE
+        EXECUTE format('ALTER ROLE %I IN DATABASE %I RESET app.gcal_service_key', r.rolname, r.datname);
+      END IF;
+    EXCEPTION WHEN OTHERS THEN
+      RAISE WARNING 'could not clear app.gcal_service_key (database %, role %): % \u2014 clear it by hand, and rotate the key either way',
+        r.datname, r.rolname, SQLERRM;
+    END;
+  END LOOP;
+END $$;
+
+-- ===========================================================================
+-- \xA72 \u2014 the trigger 007 left out
+--
+-- AFTER INSERT OR UPDATE OR DELETE: a booking that is moved or cancelled has to
+-- reach Google too, and a trigger that only fired on INSERT would leave the
+-- calendar showing an appointment the CRM no longer has.
+-- ===========================================================================
+DROP TRIGGER IF EXISTS trg_gcal_push ON public.appointments;
+CREATE TRIGGER trg_gcal_push
+  AFTER INSERT OR UPDATE OR DELETE ON public.appointments
+  FOR EACH ROW EXECUTE FUNCTION public.fn_gcal_push_booking();
+
+COMMENT ON FUNCTION public.fn_gcal_push_booking() IS
+  'Pushes a booking to Google Calendar over pg_net, authorised by the vault secret gcal_outbound_secret. Inert while the vault secrets are absent (008).';
+`;
 
 // src/integrations/google-calendar/connector.ts
 var googleCalendarConnector = {
@@ -10723,6 +10939,12 @@ function createGoogleCalendarPlugin() {
         version: "0.9.3",
         sql: MIGRATION_007_CREDENTIAL_FREE_INSTALL,
         description: "Install the whole connector schema in its post-FAY-1359 shape, from zero, with no credential column at any point \u2014 the five tables the beauty pool had dropped, plus a gate that drops a token column wherever it is still found and refuses to finish if one survives"
+      },
+      {
+        id: "google-calendar-008_the_outbound_half",
+        version: "0.16.2",
+        sql: MIGRATION_008_THE_OUTBOUND_HALF,
+        description: "Install trg_gcal_push and the 005 push function on a pool that came up through 007. 007 creates the tables but not the trigger, and the only files that create it (001, 002) also create the credential columns 007 exists to prevent \u2014 so a fresh pool silently had inbound only. Inert until the vault secrets exist"
       }
     ]
   };