@opengeni/core 3.0.1 → 3.1.2

package/src/rigs/index.ts

@@ -11,7 +11,6 @@ import type {
   ProposeRigChangeRequest,
   Rig,
   RigChange,
-  ResourceAuthorityScope,
   RigVersion,
   UpdateRigRequest,
 } from "@opengeni/contracts";
@@ -26,7 +25,6 @@ import {
   getRigByName,
   getRigChange,
   getRigVersion,
-  getVariableSet,
   listRigChanges,
   listRigVersions,
   recordAuditEvent,
@@ -37,8 +35,7 @@ import {
   type Database,
 } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
-import { boundedParallelMap } from "@opengeni/runtime/mcp-network";
-import { requirePermission } from "../access";
+import { variableSetsRemovedError } from "../domain/encryption-key";
 import { rigProviderImagesFromVerification } from "./provider-images";
 
 export * from "./provider-images";
@@ -46,34 +43,9 @@ export * from "./provider-images";
 export const MAX_RIGS_PER_WORKSPACE = 50;
 export const MAX_CHECKS_PER_RIG = 100;
 export const MAX_CREDENTIAL_HOOKS_PER_RIG = 50;
-export const MAX_DEFAULT_VARIABLE_SETS_PER_RIG = 25;
-export const RIG_DEFAULT_VARIABLE_SET_LOAD_CONCURRENCY = 4;
-
-type VariableSetEnvironment = { values: Record<string, string> } | null;
-
-/** Load complete rig defaults concurrently while preserving listed precedence. */
-export async function loadRigDefaultVariableSetEnvironment(
-  variableSetIds: readonly string[],
-  load: (variableSetId: string) => Promise<VariableSetEnvironment>,
-): Promise<Record<string, string>> {
-  const variableSets = await boundedParallelMap(
-    variableSetIds,
-    RIG_DEFAULT_VARIABLE_SET_LOAD_CONCURRENCY,
-    load,
-  );
-  const values: Record<string, string> = {};
-  for (const variableSet of variableSets) {
-    Object.assign(values, variableSet?.values ?? {});
-  }
-  return values;
-}
-
-/** Rig defaults layer below the session's explicitly selected variable set. */
-export function mergeRigDefaultVariableSetEnvironment(
-  rigDefaultValues: Record<string, string>,
-  sessionValues: Record<string, string>,
-): Record<string, string> {
-  return { ...rigDefaultValues, ...sessionValues };
+/** Rig default Variable Sets were removed with Variable Sets (RM-1). */
+function assertNoDefaultVariableSets(ids: ReadonlyArray<string> | null | undefined): void {
+  if (ids?.length) throw variableSetsRemovedError("defaultVariableSetIds");
 }
 
 export type RigServices = {
@@ -128,7 +100,7 @@ export async function requireRigForApi(
 ): Promise<Rig> {
   const rig = await getRig(db, grant, rigId);
   if (!rig) {
-    throw new HTTPException(404, { message: "rig not found" });
+    throw new HTTPException(404, { message: "sandbox environment not found" });
   }
   return rig;
 }
@@ -143,7 +115,7 @@ export async function requireRigChangeForApi(
   // RLS + the workspace clause make a cross-workspace id indistinguishable from
   // missing; the rigId clause keeps the change addressable only under its rig.
   if (!change || change.rigId !== rigId) {
-    throw new HTTPException(404, { message: "rig change not found" });
+    throw new HTTPException(404, { message: "sandbox environment change not found" });
   }
   return change;
 }
@@ -151,7 +123,7 @@ export async function requireRigChangeForApi(
 function trimmedRigName(name: string): string {
   const trimmed = name.trim();
   if (!trimmed) {
-    throw new HTTPException(422, { message: "rig name is required" });
+    throw new HTTPException(422, { message: "sandbox environment name is required" });
   }
   return trimmed;
 }
@@ -165,58 +137,13 @@ function assertUniqueCheckNames(checks: ReadonlyArray<{ name: string }> | undefi
   for (const check of checks) {
     if (seen.has(check.name)) {
       throw new HTTPException(422, {
-        message: `duplicate rig check name: ${check.name}`,
+        message: `duplicate sandbox environment check name: ${check.name}`,
       });
     }
     seen.add(check.name);
   }
 }
 
-// Every referenced default variable set must exist in the workspace. RLS makes a
-// cross-workspace id indistinguishable from a missing one, so both map to 422.
-async function assertVariableSetsExist(
-  db: Database,
-  access: AccessGrant,
-  rigScope: ResourceAuthorityScope,
-  ids: ReadonlyArray<string> | undefined,
-): Promise<void> {
-  if (ids === undefined) {
-    return;
-  }
-  requirePermission(access, "variable-sets:attach");
-  if (ids.length === 0) {
-    return;
-  }
-  requirePermission(access, "variable-sets:use");
-  const unique = [...new Set(ids)];
-  for (const id of unique) {
-    const variableSet = await getVariableSet(db, access, id);
-    if (!variableSet) {
-      throw new HTTPException(422, {
-        message: `unknown defaultVariableSetId: ${id}`,
-      });
-    }
-    if (!variableSetScopeAllowedForRig(rigScope, variableSet.scope)) {
-      throw new HTTPException(422, {
-        message: `${rigScope}-scoped rigs cannot use ${variableSet.scope}-scoped variable sets`,
-      });
-    }
-  }
-}
-
-/** A resource may depend only on Variable Sets whose audience is no narrower
- * than its own. User-owned rigs may use anything visible to their owner. */
-export function variableSetScopeAllowedForRig(
-  rigScope: ResourceAuthorityScope,
-  variableSetScope: ResourceAuthorityScope,
-): boolean {
-  return (
-    rigScope === "user" ||
-    variableSetScope === "organization" ||
-    (rigScope === "workspace" && variableSetScope === "workspace")
-  );
-}
-
 export async function createRigForApi(
   deps: RigServices,
   grant: AccessGrant,
@@ -225,20 +152,15 @@ export async function createRigForApi(
 ): Promise<Rig> {
   const name = trimmedRigName(payload.name);
   assertUniqueCheckNames(payload.checks);
-  await assertVariableSetsExist(
-    deps.db,
-    grant,
-    payload.scope,
-    payload.defaultVariableSetIds.length > 0 ? payload.defaultVariableSetIds : undefined,
-  );
+  assertNoDefaultVariableSets(payload.defaultVariableSetIds);
   if ((await countRigs(deps.db, grant, payload.scope)) >= MAX_RIGS_PER_WORKSPACE) {
     throw new HTTPException(422, {
-      message: `a workspace supports at most ${MAX_RIGS_PER_WORKSPACE} rigs`,
+      message: `a workspace supports at most ${MAX_RIGS_PER_WORKSPACE} sandbox environments`,
     });
   }
   if (await getRigByName(deps.db, grant, name, payload.scope)) {
     throw new HTTPException(409, {
-      message: `rig name is already in use: ${name}`,
+      message: `sandbox environment name is already in use: ${name}`,
     });
   }
   const createdBy = rigActorForGrant(grant);
@@ -281,7 +203,7 @@ export async function updateRigForApi(
     const existing = await getRigByName(deps.db, grant, name, rig.scope);
     if (existing && existing.id !== rig.id) {
       throw new HTTPException(409, {
-        message: `rig name is already in use: ${name}`,
+        message: `sandbox environment name is already in use: ${name}`,
       });
     }
   }
@@ -339,17 +261,12 @@ export async function proposeRigChangeForApi(
   const workspaceId = rig.workspaceId;
   if (!rig.activeVersion) {
     throw new HTTPException(422, {
-      message: "rig has no active version to base a change on",
+      message: "sandbox environment has no active version to base a change on",
     });
   }
   if (request.kind === "definition_edit") {
     assertUniqueCheckNames(request.payload.checks);
-    await assertVariableSetsExist(
-      deps.db,
-      grant,
-      rig.scope,
-      request.payload.defaultVariableSetIds ?? undefined,
-    );
+    assertNoDefaultVariableSets(request.payload.defaultVariableSetIds);
   }
   const change = await createRigChange(deps.db, {
     accountId: grant.accountId,
@@ -412,7 +329,7 @@ async function promoteChangeWithActiveCas(
   } catch (error) {
     if (error instanceof RigActiveVersionChangedError) {
       throw new HTTPException(409, {
-        message: `rig moved since this change was verified (base ${error.expectedVersionId}, now ${error.actualVersionId ?? "none"}); re-verify before promoting`,
+        message: `sandbox environment moved since this change was verified (base ${error.expectedVersionId}, now ${error.actualVersionId ?? "none"}); re-verify before promoting`,
       });
     }
     if (error instanceof RigChangeTransitionError) {
@@ -435,15 +352,15 @@ export async function promoteSetupAppendChange(
   }
   if (change.status !== "proposed" && change.status !== "verifying") {
     throw new HTTPException(409, {
-      message: `rig change is ${change.status}; cannot promote`,
+      message: `sandbox environment change is ${change.status}; cannot promote`,
     });
   }
   if (!change.baseVersionId) {
-    throw new HTTPException(422, { message: "rig change has no base version" });
+    throw new HTTPException(422, { message: "sandbox environment change has no base version" });
   }
   const base = await getRigVersion(deps.db, rig.workspaceId, rig.id, change.baseVersionId);
   if (!base) {
-    throw new HTTPException(404, { message: "base rig version not found" });
+    throw new HTTPException(404, { message: "base sandbox environment version not found" });
   }
   const payload = change.payload as { command?: unknown; note?: unknown };
   if (typeof payload.command !== "string" || !payload.command.trim()) {
@@ -510,7 +427,7 @@ export async function promoteVerifiedDefinitionEditChangeForApi(
   }
   if (change.status !== "proposed") {
     throw new HTTPException(409, {
-      message: `rig change is ${change.status}; cannot promote`,
+      message: `sandbox environment change is ${change.status}; cannot promote`,
     });
   }
   if (change.verification?.passed !== true) {
@@ -519,11 +436,11 @@ export async function promoteVerifiedDefinitionEditChangeForApi(
     });
   }
   if (!change.baseVersionId) {
-    throw new HTTPException(422, { message: "rig change has no base version" });
+    throw new HTTPException(422, { message: "sandbox environment change has no base version" });
   }
   const base = await getRigVersion(deps.db, rig.workspaceId, rig.id, change.baseVersionId);
   if (!base) {
-    throw new HTTPException(404, { message: "base rig version not found" });
+    throw new HTTPException(404, { message: "base sandbox environment version not found" });
   }
   const payload = change.payload as {
     setupScript?: unknown;
@@ -590,15 +507,10 @@ export async function createRigVersionForApi(
   payload: RigDefinitionEditPayload,
 ): Promise<RigVersion> {
   if (!rig.activeVersion) {
-    throw new HTTPException(422, { message: "rig has no active version" });
+    throw new HTTPException(422, { message: "sandbox environment has no active version" });
   }
   assertUniqueCheckNames(payload.checks);
-  await assertVariableSetsExist(
-    deps.db,
-    grant,
-    rig.scope,
-    payload.defaultVariableSetIds ?? undefined,
-  );
+  assertNoDefaultVariableSets(payload.defaultVariableSetIds);
   const base = rig.activeVersion;
   const version = await createRigVersion(
     deps.db,