@opengeni/core 3.0.1 → 3.1.2

package/src/sandbox/runtime-settings.ts

@@ -1,7 +1,7 @@
-import type { Settings } from "@opengeni/config";
+import { sandboxImageAllowlist, type Settings } from "@opengeni/config";
 import {
-  CapabilityPack,
-  StoredCapabilityPack,
+  resolveWorkspaceDefaultSandboxImage,
+  type AccessGrant,
   type RigVersion,
   type Session,
   type SandboxBackend,
@@ -9,11 +9,17 @@ import {
 } from "@opengeni/contracts";
 import {
   getRigVersion,
-  getWorkspacePack,
-  listPackInstallations,
+  getScheduledScopedRigVersionMetadata,
+  getWorkspace,
+  nestedPostgresSqlState,
   type Database,
 } from "@opengeni/db";
 import { resolveModalCheckpointProviderBinding } from "@opengeni/runtime/sandbox";
+import { HTTPException } from "hono/http-exception";
+import {
+  grantHasAgentAttemptAuthority,
+  requireLiveAgentAttemptAuthorization,
+} from "../session-authorization";
 import {
   rigProviderImageContentHash,
   rigProviderImageMatchesDefinition,
@@ -41,6 +47,29 @@ export function managedSessionGroupBackend(
   return backend === "none" || backend === "selfhosted" ? null : backend;
 }
 
+const SESSION_GROUP_MACHINE_NAMES: Record<ManagedSessionGroupBackend, string> = {
+  local: "this computer",
+  docker: "Docker",
+  modal: "Modal",
+  daytona: "Daytona",
+  runloop: "Runloop",
+  e2b: "E2B",
+  blaxel: "Blaxel",
+  cloudflare: "Cloudflare",
+  vercel: "Vercel",
+  opensandbox: "OpenSandbox",
+};
+
+/** Display name and kind for the session's own managed box. The kind is the
+ * real provider. Callers must not collapse local, Docker, or other providers
+ * into Modal. */
+export function sessionGroupMachinePresentation(backend: ManagedSessionGroupBackend): {
+  name: string;
+  kind: ManagedSessionGroupBackend;
+} {
+  return { name: SESSION_GROUP_MACHINE_NAMES[backend], kind: backend };
+}
+
 /** A machine-home row carries the machine's host OS; its managed group uses the
  * platform's canonical managed-sandbox OS instead. Ordinary sessions preserve
  * their explicitly selected OS. */
@@ -51,74 +80,25 @@ export function managedSessionGroupOs(
   return sessionBackend === "selfhosted" ? "linux" : sessionOs;
 }
 
-/** Pre-V2 Packs are the sole compatibility path where a Pack can still own a
- * sandbox image. V2 installations select a Rig instead. Keep this predicate at
- * the shared runtime boundary so turns, API-direct tools, viewers, Browser and
- * Computer cannot resolve different physical machines for the same session. */
-export function packInstallationUsesLegacyRuntime(input: {
-  manifestSnapshot: unknown | null;
-  manifestDigest: string | null;
-}): boolean {
-  return input.manifestSnapshot === null && input.manifestDigest === null;
-}
-
-export async function resolveWorkspaceLegacyRuntimePacks(
-  db: Database,
-  workspaceId: string,
-): Promise<CapabilityPack[]> {
-  const installations = await listPackInstallations(db, workspaceId);
-  const packs: CapabilityPack[] = [];
-  for (const installation of installations) {
-    if (installation.status !== "active" || !packInstallationUsesLegacyRuntime(installation)) {
-      continue;
-    }
-    const registration = await getWorkspacePack(db, workspaceId, installation.packId);
-    if (!registration)
-      throw new Error(`Enabled Pack ${installation.packId} has no registered manifest`);
-    const parsed = StoredCapabilityPack.safeParse(registration.pack);
-    if (!parsed.success)
-      throw new Error(
-        `Enabled Pack ${installation.packId} requires repair: ${parsed.error.message}`,
-      );
-    packs.push(parsed.data);
-  }
-  return packs;
-}
-
-export function legacySandboxRuntimeFromPacks(packs: readonly CapabilityPack[]): {
-  sandboxImage: string | null;
-  sandboxProviderImages: CapabilityPack["sandboxProviderImages"] | null;
-} {
-  const imagePacks = packs.filter(
-    (pack) => typeof pack.sandboxImage === "string" && pack.sandboxImage.trim().length > 0,
-  );
-  if (imagePacks.length > 1) {
-    const ids = imagePacks
-      .map((pack) => pack.id)
-      .sort()
-      .join(", ");
-    throw new Error(
-      `Multiple enabled packs declare a sandbox image (${ids}). Only one enabled pack per workspace may declare sandboxImage; disable the others and retry.`,
-    );
-  }
-  return {
-    sandboxImage: imagePacks[0]?.sandboxImage?.trim() ?? null,
-    sandboxProviderImages: imagePacks[0]?.sandboxProviderImages ?? null,
-  };
-}
-
-export function settingsWithPackSandboxImage(
+/**
+ * Apply a workspace's selected sandbox image. The deployment keeps authority:
+ * only an image that is on its allowlist right now is used, so removing an
+ * entry returns every workspace that chose it to the deployment image. The
+ * lease treats the image as shared state, so a change rotates a live box
+ * through the normal capture-and-restore path instead of reusing it.
+ */
+export function settingsWithWorkspaceSandboxImage(
   settings: Settings,
-  sandboxImage: string | null,
-  sandboxProviderImages: CapabilityPack["sandboxProviderImages"] | null = null,
+  workspaceSettings: unknown,
+  backend: SandboxBackend,
 ): Settings {
-  if (!sandboxImage) return settings;
-  return {
-    ...settings,
-    dockerImage: sandboxImage,
-    modalImageRef: sandboxImage,
-    modalImageId: sandboxProviderImages?.modal?.imageId,
-  };
+  const image = resolveWorkspaceDefaultSandboxImage(workspaceSettings);
+  if (!image || !sandboxImageAllowlist(settings).includes(image)) return settings;
+  if (backend === "docker") return { ...settings, dockerImage: image };
+  if (backend === "modal") {
+    return { ...settings, modalImageRef: image, modalImageId: undefined };
+  }
+  return settings;
 }
 
 export function settingsWithRigImage(settings: Settings, rigImage: string | null): Settings {
@@ -272,27 +252,121 @@ export type SessionSandboxRuntime = {
   rigVersion: RigVersion | null;
 };
 
+/** The subject a direct attach resolves under when no human subject drives it
+ *  (the same sentinel the attach Variable Set defaults use). It holds no
+ *  organization membership, so it can resolve organization and workspace
+ *  Sandbox Environments but never a personal one. */
+const SESSION_ATTACH_SUBJECT = "session-attach";
+
+/** Who a direct attach resolves a session's Sandbox Environment as: an explicit
+ *  subject (null for a service attach), or the authenticated route grant. */
+export type SessionAttachRigAuthority = { subjectId: string | null } | { grant: AccessGrant };
+
+/**
+ * The subject whose scoped visibility applies. An agent-attempt grant carries a
+ * technical worker identity with no organization membership, so it resolves as
+ * its live attempt's frozen initiating human, as the MCP Sandbox Environment and
+ * fleet tools do; an attempt without one resolves as the service sentinel.
+ */
+async function sessionAttachRigSubjectId(
+  db: Database,
+  authority: SessionAttachRigAuthority,
+): Promise<string | null> {
+  if (!("grant" in authority)) return authority.subjectId;
+  const { grant } = authority;
+  if (!grantHasAgentAttemptAuthority(grant)) return grant.subjectId;
+  const callerSessionId = grant.metadata?.["sessionId"];
+  if (typeof callerSessionId !== "string") return null;
+  const actor = await requireLiveAgentAttemptAuthorization(db, grant, callerSessionId);
+  return actor.initiatingHumanSubjectId;
+}
+
+/** The scoped seam's refusal for a subject that is an organization member but
+ *  has no current access to the session's workspace. Other 42501 failures
+ *  (grants, capability rows) remain errors. */
+function isWorkspaceAccessRefusal(error: unknown): boolean {
+  if (nestedPostgresSqlState(error) !== "42501") return false;
+  let current: unknown = error;
+  for (let depth = 0; depth < 8 && current instanceof Error; depth += 1) {
+    if (current.message.includes("lacks current workspace access")) return true;
+    current = current.cause;
+  }
+  return false;
+}
+
+/**
+ * The exact frozen Sandbox Environment version a session is bound to, resolved
+ * for a direct attach (terminal, Files, desktop viewer, Browser, Computer).
+ *
+ * A version homed in the session's own workspace resolves physically under the
+ * session access the route already enforced, exactly as before. An
+ * organization Sandbox Environment, or a personal one used outside its home
+ * workspace, keeps its versions in that home workspace, so those resolve
+ * through the same scoped authority the attach Variable Set defaults and
+ * scheduled tasks use: same organization, active, and visible to the attaching
+ * subject in the session's workspace.
+ */
+async function resolveSessionRigVersion(
+  db: Database,
+  session: Pick<Session, "accountId" | "workspaceId"> & { rigId: string; rigVersionId: string },
+  authority: SessionAttachRigAuthority,
+): Promise<RigVersion | null> {
+  const local = await getRigVersion(db, session.workspaceId, session.rigId, session.rigVersionId);
+  if (local) return local;
+  const subjectId = await sessionAttachRigSubjectId(db, authority);
+  let scoped: Awaited<ReturnType<typeof getScheduledScopedRigVersionMetadata>>;
+  try {
+    scoped = await getScheduledScopedRigVersionMetadata(
+      db,
+      {
+        accountId: session.accountId,
+        workspaceId: session.workspaceId,
+        subjectId: subjectId ?? SESSION_ATTACH_SUBJECT,
+      },
+      session.rigId,
+      session.rigVersionId,
+    );
+  } catch (error) {
+    if (!isWorkspaceAccessRefusal(error)) throw error;
+    console.warn("[session-attach] sandbox environment refused without workspace access", {
+      workspaceId: session.workspaceId,
+      rigId: session.rigId,
+      rigVersionId: session.rigVersionId,
+    });
+    return null;
+  }
+  return scoped?.version.rigId === session.rigId ? scoped.version : null;
+}
+
 export async function resolveSessionSandboxRuntime(
   db: Database,
   settings: Settings,
-  session: Pick<Session, "workspaceId" | "sandboxBackend" | "rigId" | "rigVersionId">,
+  session: Pick<Session, "accountId" | "workspaceId" | "sandboxBackend" | "rigId" | "rigVersionId">,
+  /** Who drives the attach; pass the route grant whenever one exists. */
+  authority: SessionAttachRigAuthority,
 ): Promise<SessionSandboxRuntime> {
-  const [packs, rigVersion] = await Promise.all([
-    resolveWorkspaceLegacyRuntimePacks(db, session.workspaceId),
+  const rigVersion =
     session.rigId && session.rigVersionId
-      ? getRigVersion(db, session.workspaceId, session.rigId, session.rigVersionId)
-      : Promise.resolve(null),
-  ]);
+      ? await resolveSessionRigVersion(
+          db,
+          { ...session, rigId: session.rigId, rigVersionId: session.rigVersionId },
+          authority,
+        )
+      : null;
   if (session.rigVersionId && !rigVersion) {
-    throw new Error(`Frozen rig version ${session.rigVersionId} is unavailable`);
+    throw new HTTPException(403, {
+      message: "This session's Sandbox Environment version is not available.",
+    });
   }
-  const legacy = legacySandboxRuntimeFromPacks(packs);
-  // A Rig is always a setup/check layer over the deployment-owned platform
-  // sandbox. Legacy pre-v2 Pack image compatibility remains available only to
-  // rig-less sessions; it cannot replace the base beneath a Rig.
-  const logicalSettings = rigVersion
-    ? settings
-    : settingsWithPackSandboxImage(settings, legacy.sandboxImage, legacy.sandboxProviderImages);
+  // Setup and checks layer on the deployment image, or on the workspace's
+  // allowlisted selection of one.
+  const logicalSettings = sandboxImageAllowlist(settings).length
+    ? settingsWithWorkspaceSandboxImage(
+        settings,
+        (await getWorkspace(db, session.workspaceId))?.settings,
+        session.sandboxBackend,
+      )
+    : settings;
   return {
     settings: {
       ...logicalSettings,

package/src/session-authorization.ts

@@ -1,4 +1,5 @@
 import {
+  canonicalSessionAuthorizationOperation,
   SessionAuthorizationActor,
   SessionAuthorizationDecision,
   SessionAuthorizationListScope,
@@ -10,8 +11,11 @@ import {
   type SessionAuthorizationTarget,
   type SessionScopeSubjectId,
 } from "@opengeni/contracts";
+import { AsyncLocalStorage } from "node:async_hooks";
 import {
+  currentSessionRlsActorIdentityKey,
   getSessionAuthorityProjection,
+  getSessionAuthorizationTargetProjection,
   getSession,
   getSessionTurnForAttempt,
   getSlackInteractionSessionAccessForSession,
@@ -20,9 +24,86 @@ import {
   type SessionRlsActorContext,
 } from "@opengeni/db";
 import type { AppDependencies } from "./dependencies";
+import {
+  currentSiteSessionOrigin,
+  siteOriginsMatch,
+  siteSessionOriginFromMetadata,
+} from "./site-session-origin";
+import { siteAgentMayReachSession } from "./site-agent-clamp";
 
 export type SessionAuthorizationDependencies = Pick<AppDependencies, "db" | "sessionAuthorization">;
 
+/**
+ * Identical caller-session and attempt reads shared by the authorization
+ * checks of one first-party MCP request. Phases bound reuse to checks that run
+ * back to back: the route's own checks, then only checks a tool handler starts
+ * synchronously on entry. Anything later (a re-check after a wait or a write)
+ * reads fresh. Results are keyed by database handle and session RLS actor, so
+ * a read is only reused under the exact visibility it was made with.
+ */
+type SessionAuthorizationReads = {
+  phase: "route" | "handoff" | "dispatch" | "closed";
+  readonly results: WeakMap<Database, Map<string, unknown>>;
+};
+
+const sessionAuthorizationReads = new AsyncLocalStorage<SessionAuthorizationReads>();
+
+/** Scope read reuse to one request; it never outlives `fn`. */
+export async function withSessionAuthorizationReadReuse<T>(
+  fn: (reuse: { handOffToToolDispatch(): void }) => Promise<T>,
+): Promise<T> {
+  const reads: SessionAuthorizationReads = { phase: "route", results: new WeakMap() };
+  const handOffToToolDispatch = () => {
+    if (reads.phase === "route") reads.phase = "handoff";
+  };
+  try {
+    return await sessionAuthorizationReads.run(reads, () => fn({ handOffToToolDispatch }));
+  } finally {
+    reads.phase = "closed";
+  }
+}
+
+/**
+ * Invoke a tool handler so that authorization checks it starts before its
+ * first await reuse the route's reads. Later checks, and every other dispatch
+ * in the same request, read fresh.
+ */
+export function dispatchWithSessionAuthorizationReadReuse<T>(handler: () => T): T {
+  const reads = sessionAuthorizationReads.getStore();
+  if (reads?.phase !== "handoff") return handler();
+  reads.phase = "dispatch";
+  try {
+    return handler();
+  } finally {
+    reads.phase = "closed";
+  }
+}
+
+/** Call before the first await, so the phase is the one the check started in. */
+function claimSessionAuthorizationReads(): SessionAuthorizationReads | null {
+  const reads = sessionAuthorizationReads.getStore();
+  return reads?.phase === "route" || reads?.phase === "dispatch" ? reads : null;
+}
+
+async function reusableAuthorizationRead<T>(
+  reads: SessionAuthorizationReads | null,
+  db: Database,
+  key: readonly string[],
+  read: () => Promise<T>,
+): Promise<T> {
+  if (!reads) return await read();
+  const scopedKey = JSON.stringify([...key, currentSessionRlsActorIdentityKey()]);
+  let results = reads.results.get(db);
+  if (results?.has(scopedKey)) return results.get(scopedKey) as T;
+  const value = await read();
+  if (!results) {
+    results = new Map();
+    reads.results.set(db, results);
+  }
+  results.set(scopedKey, value);
+  return value;
+}
+
 /** Maximum time an omitted host hint leaves a live session stream unchecked. */
 export const SESSION_AUTHORIZATION_DEFAULT_REAUTHORIZE_MS = 15_000;
 
@@ -120,7 +201,6 @@ export function agentAccessListScopeForViewer(
 
 type ResolvedSessionAuthorizationTarget = {
   target: SessionAuthorizationTarget;
-  parentSessionId: string | null;
 };
 
 /**
@@ -178,7 +258,8 @@ export async function requireLiveAgentAttemptAuthorization(
   grant: AccessGrant,
   callerSessionId: string,
 ): Promise<Extract<SessionAuthorizationActor, { kind: "agent_attempt" }>> {
-  const { actor } = await resolveSessionAuthorizationActor(db, grant);
+  const reads = claimSessionAuthorizationReads();
+  const { actor } = await resolveSessionAuthorizationActor(db, grant, reads);
   if (actor.kind !== "agent_attempt" || actor.callerSessionId !== callerSessionId) {
     throw new SessionAuthorizationDeniedError("caller_stale");
   }
@@ -205,16 +286,42 @@ export async function requireSessionAuthorization(
     surface: SessionAuthorizationSurface;
   },
 ): Promise<ResolvedSessionAuthorization | null> {
+  const reads = claimSessionAuthorizationReads();
   const port = deps.sessionAuthorization;
   const isAgentAttempt = grantHasAgentAttemptAuthority(grant);
-  const [slackAccess, authority] = await Promise.all([
-    getSlackInteractionSessionAccessForSession(deps.db, {
-      accountId: grant.accountId,
-      workspaceId: grant.workspaceId,
-      sessionId: input.sessionId,
-    }),
-    getSessionAuthorityProjection(deps.db, grant.workspaceId, input.sessionId),
-  ]);
+  // Callers can supply a transaction handle. Both reads open nested RLS
+  // savepoints, which must not race on the same PostgreSQL connection.
+  const slackAccess = await getSlackInteractionSessionAccessForSession(deps.db, {
+    accountId: grant.accountId,
+    workspaceId: grant.workspaceId,
+    sessionId: input.sessionId,
+  });
+  const authority = await getSessionAuthorityProjection(
+    deps.db,
+    grant.workspaceId,
+    input.sessionId,
+  );
+
+  // The projection is read under the caller's own RLS context, so a missing
+  // session and one the caller may not see (another member's private session)
+  // are the same answer. Every request-facing surface refuses both here,
+  // before a route-specific read can observe the difference or fail on the
+  // absent row. In-process `core` callers keep the standalone null result and
+  // their own not-found handling.
+  if (!authority && input.surface !== "core") {
+    throw new SessionAuthorizationDeniedError("not_found");
+  }
+
+  // A request from a Site page (an HTTP frame request, or a tool the page
+  // called) may act on a session only when that same Site, or for a frame
+  // without a published Site the same mounted frame, started it. Anything
+  // else is indistinguishable from a missing session.
+  const siteOrigin = currentSiteSessionOrigin();
+  if (siteOrigin && authority && !input.operation.endsWith(".read")) {
+    const session = await getSession(deps.db, grant.workspaceId, input.sessionId);
+    if (!siteOriginsMatch(siteOrigin, siteSessionOriginFromMetadata(session?.metadata)))
+      throw new SessionAuthorizationDeniedError("not_found");
+  }
 
   // Preserve the standalone workspace-shared path. Private sessions continue
   // through the durable actor and ownership checks even without a host port.
@@ -228,10 +335,13 @@ export async function requireSessionAuthorization(
   }
   if (!authority) throw new SessionAuthorizationDeniedError("not_found");
 
-  const [resolvedActor, resolvedTarget] = await Promise.all([
-    resolveSessionAuthorizationActor(deps.db, grant),
-    resolveSessionAuthorizationTarget(deps.db, grant, input.sessionId),
-  ]);
+  const resolvedActor = await resolveSessionAuthorizationActor(deps.db, grant, reads);
+  const resolvedTarget = await resolveSessionAuthorizationTarget(
+    deps.db,
+    grant,
+    input.sessionId,
+    reads,
+  );
   const actor = resolvedActor.actor;
   const target = resolvedTarget.target;
   const agentRelatedSessionAccess =
@@ -247,6 +357,23 @@ export async function requireSessionAuthorization(
   if (actor.kind === "agent_attempt" && input.operation === "session.approval.write") {
     throw new SessionAuthorizationDeniedError("forbidden");
   }
+  // An agent started from a Site page acts with that page's reach: it may
+  // read, message, steer or control only sessions that act for the same Site
+  // (its own lineage, or another session that Site started), never a session
+  // a person started elsewhere. Reads count too: a transcript is data the
+  // Site page must not reach. Indistinguishable from a missing session.
+  if (
+    actor.kind === "agent_attempt" &&
+    target.sessionId !== actor.callerSessionId &&
+    !(await siteAgentMayReachSession(
+      deps.db,
+      { accountId: grant.accountId, workspaceId: grant.workspaceId },
+      { sessionId: actor.callerSessionId, turnId: actor.turnId },
+      target.sessionId,
+    ))
+  ) {
+    throw new SessionAuthorizationDeniedError("not_found");
+  }
 
   if (authority.visibility === "user_private") {
     const allowed =
@@ -290,12 +417,18 @@ export async function requireSessionAuthorization(
 
   let rawDecision: unknown;
   try {
+    // Adapt once, before the host decision. Never retry a denial under an alias.
+    const operation = canonicalSessionAuthorizationOperation(input.operation);
     rawDecision = await port.authorizeSession({
       accountId: grant.accountId,
       workspaceId: grant.workspaceId,
       actor,
       target,
-      operation: input.operation,
+      operation:
+        operation === "session.model_account.write" &&
+        port.capabilities?.modelAccountOperation !== true
+          ? "session.codex_account.write"
+          : operation,
       surface: input.surface,
     });
   } catch (error) {
@@ -325,10 +458,11 @@ export async function requireSessionAuthorizationListScope(
   grant: AccessGrant,
   surface: SessionAuthorizationSurface,
 ): Promise<SessionAuthorizationListScope | null> {
+  const reads = claimSessionAuthorizationReads();
   const port = deps.sessionAuthorization;
   const isAgentAttempt = grantHasAgentAttemptAuthority(grant);
   if (!port && !isAgentAttempt) return null;
-  const { actor, callerAccess } = await resolveSessionAuthorizationActor(deps.db, grant);
+  const { actor, callerAccess } = await resolveSessionAuthorizationActor(deps.db, grant, reads);
   // Standalone agents retain compact workspace discovery only while the signed
   // caller attempt is still the exact live attempt, and only within their own
   // declared agent-access reach (migration 0427). The viewer is derived from
@@ -357,7 +491,7 @@ export async function requireSessionAuthorizationListScope(
   if (!parsed.success) {
     throw new SessionAuthorizationUnavailableError({ cause: parsed.error });
   }
-  // A host never supplies the viewer: OpenGeni resolved it above from durable
+  // A host never supplies the viewer: Opengeni resolved it above from durable
   // state, so a host-returned value is dropped before the intersection.
   const hostScope: SessionAuthorizationListScope =
     parsed.data.kind === "all"
@@ -374,19 +508,25 @@ async function resolveSessionAuthorizationTarget(
   db: Database,
   grant: AccessGrant,
   sessionId: string,
+  reads: SessionAuthorizationReads | null,
 ): Promise<ResolvedSessionAuthorizationTarget> {
-  const session = await getSession(db, grant.workspaceId, sessionId);
+  const session = await reusableAuthorizationRead(
+    reads,
+    db,
+    ["target-identity", grant.workspaceId, sessionId],
+    () => getSessionAuthorizationTargetProjection(db, grant.workspaceId, sessionId),
+  );
   if (!session || session.accountId !== grant.accountId) {
     throw new SessionAuthorizationDeniedError("not_found");
   }
   return {
     target: { sessionId: session.id, rootSessionId: session.rootSessionId },
-    parentSessionId: session.parentSessionId,
   };
 }
 async function resolveSessionAuthorizationActor(
   db: Database,
   grant: AccessGrant,
+  reads: SessionAuthorizationReads | null,
 ): Promise<ResolvedSessionAuthorizationActor> {
   const callerSessionId = grant.metadata?.["sessionId"];
   const turnId = grant.metadata?.["turnId"];
@@ -414,10 +554,19 @@ async function resolveSessionAuthorizationActor(
   ) {
     throw new SessionAuthorizationDeniedError("caller_stale");
   }
-  const [callerSession, turn] = await Promise.all([
-    getSession(db, grant.workspaceId, callerSessionId),
-    getSessionTurnForAttempt(db, grant.workspaceId, callerSessionId, attemptId),
-  ]);
+  // These scoped reads can also open nested savepoints on a transaction handle.
+  const callerSession = await reusableAuthorizationRead(
+    reads,
+    db,
+    ["session", grant.workspaceId, callerSessionId],
+    () => getSession(db, grant.workspaceId, callerSessionId),
+  );
+  const turn = await reusableAuthorizationRead(
+    reads,
+    db,
+    ["turn", grant.workspaceId, callerSessionId, attemptId],
+    () => getSessionTurnForAttempt(db, grant.workspaceId, callerSessionId, attemptId),
+  );
   if (
     !callerSession ||
     callerSession.accountId !== grant.accountId ||