@opengeni/db 0.12.1 → 0.12.6

package/src/new-session-drafts.ts

@@ -1,6 +1,7 @@
 import type {
   NewSessionDraftOptions,
   ReasoningEffort,
+  RepositoryResourceRef,
   ResourceRef,
   ToolRef,
 } from "@opengeni/contracts";
@@ -26,6 +27,34 @@ export class NewSessionDraftAccessError extends Error {
   }
 }
 
+type StoredNewSessionDraftOptions = NewSessionDraftOptions & {
+  /** JSONB-only compatibility marker; deliberately not part of public options. */
+  toolsProvided?: boolean;
+};
+
+function storedOptions(
+  options: NewSessionDraftOptions,
+  toolsProvided: boolean,
+): StoredNewSessionDraftOptions {
+  return { ...options, toolsProvided };
+}
+
+export function newSessionDraftToolsProvided(row: NewSessionDraftRow): boolean {
+  const options = row.sessionOptions as StoredNewSessionDraftOptions;
+  // Rows written before the explicitness marker was introduced always carried
+  // a `tools` array. Treat a markerless row as explicit rather than widening a
+  // narrowed (including empty) legacy selection to today's workspace defaults.
+  // New rows always write the marker, so an explicit false remains omitted /
+  // workspace-default policy.
+  return options.toolsProvided === true || !Object.hasOwn(options, "toolsProvided");
+}
+
+export function publicNewSessionDraftOptions(row: NewSessionDraftRow): NewSessionDraftOptions {
+  const options = { ...(row.sessionOptions as StoredNewSessionDraftOptions) };
+  delete options.toolsProvided;
+  return options;
+}
+
 export async function getNewSessionDraftInTransaction(
   db: Database,
   input: { workspaceId: string; subjectId: string; lock?: boolean },
@@ -54,6 +83,7 @@ export async function saveNewSessionDraftInTransaction(
     text: string;
     resources: ResourceRef[];
     tools: ToolRef[];
+    toolsProvided: boolean;
     model: string;
     reasoningEffort: ReasoningEffort;
     options: NewSessionDraftOptions;
@@ -96,7 +126,9 @@ export async function saveNewSessionDraftInTransaction(
     tools: input.tools,
     model: input.model,
     reasoningEffort: input.reasoningEffort,
-    sessionOptions: input.options,
+    // Keep the explicit/omitted policy in the existing JSONB extension point;
+    // adding a column here would turn a client preference into a migration.
+    sessionOptions: storedOptions(input.options, input.toolsProvided),
     updatedAt: new Date(),
   };
   if (current) {
@@ -124,21 +156,110 @@ export async function saveNewSessionDraftInTransaction(
   throw new NewSessionDraftConflictError(raced?.revision ?? 0);
 }
 
-/** Delete only the submitted revision; a newer sibling-tab revision survives. */
-export async function consumeNewSessionDraftInTransaction(
+function safeRepositoryResource(resource: RepositoryResourceRef): RepositoryResourceRef {
+  // A repository's URI/ref/mount and GitHub identity are ordinary selection
+  // state. Credential bindings, connection refs, access intent, and generic
+  // provider ids are per-session authorization/runtime state and must not seed
+  // the next create.
+  return {
+    kind: "repository",
+    uri: resource.uri,
+    ref: resource.ref,
+    ...(resource.mountPath ? { mountPath: resource.mountPath } : {}),
+    ...(resource.subpath ? { subpath: resource.subpath } : {}),
+    ...(resource.githubInstallationId
+      ? { githubInstallationId: resource.githubInstallationId }
+      : {}),
+    ...(resource.githubRepositoryId ? { githubRepositoryId: resource.githubRepositoryId } : {}),
+  };
+}
+
+function safeWorkingDir(value: unknown, targetSandboxId: string | undefined): string | undefined {
+  if (!targetSandboxId || typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  // Only a workspace-root-relative path is safe to remember. Absolute host
+  // paths and traversal would leak or unexpectedly target a different machine
+  // location after the user changes machines.
+  if (
+    !trimmed ||
+    trimmed === "." ||
+    trimmed === ".." ||
+    trimmed.includes("\u0000") ||
+    trimmed.startsWith("/") ||
+    trimmed.startsWith("\\") ||
+    /^[A-Za-z]:[\\/]/.test(trimmed) ||
+    trimmed.split(/[\\/]+/).some((part) => part === "..")
+  ) {
+    return undefined;
+  }
+  return trimmed;
+}
+
+/**
+ * Replace one exact accepted draft with the next-create safe seed. The row is
+ * locked before the revision check so a concurrent save either commits first
+ * and wins (this returns false), or observes the incremented seed revision and
+ * reports a typed OCC conflict. A missing row is an idempotent no-op.
+ */
+export async function seedNewSessionDraftInTransaction(
   db: Database,
   input: { workspaceId: string; subjectId: string; expectedRevision: number },
 ): Promise<boolean> {
   if (input.expectedRevision === 0) return false;
-  const deleted = await db
-    .delete(schema.newSessionDrafts)
+  const [current] = await db
+    .select()
+    .from(schema.newSessionDrafts)
     .where(
       and(
         eq(schema.newSessionDrafts.workspaceId, input.workspaceId),
         eq(schema.newSessionDrafts.subjectId, input.subjectId),
+      ),
+    )
+    .for("update")
+    .limit(1);
+  if (!current || current.revision !== input.expectedRevision) return false;
+
+  const options = current.sessionOptions as StoredNewSessionDraftOptions;
+  const targetSandboxId =
+    typeof options.targetSandboxId === "string" ? options.targetSandboxId : undefined;
+  const safeOptions: NewSessionDraftOptions = {
+    ...(options.sandboxBackend ? { sandboxBackend: options.sandboxBackend } : {}),
+    ...(targetSandboxId ? { targetSandboxId } : {}),
+    ...(safeWorkingDir(options.workingDir, targetSandboxId)
+      ? { workingDir: safeWorkingDir(options.workingDir, targetSandboxId) }
+      : {}),
+    ...(options.variableSetId ? { variableSetId: options.variableSetId } : {}),
+    ...(options.rigId ? { rigId: options.rigId } : {}),
+  };
+  const resources = (Array.isArray(current.resources) ? current.resources : []).flatMap((raw) => {
+    if (!raw || typeof raw !== "object" || (raw as { kind?: unknown }).kind !== "repository") {
+      return [];
+    }
+    return [safeRepositoryResource(raw as RepositoryResourceRef)];
+  });
+  const [seeded] = await db
+    .update(schema.newSessionDrafts)
+    .set({
+      revision: current.revision + 1,
+      text: "",
+      resources,
+      // The explicit array is retained only when the caller explicitly pinned
+      // tools. Omitted workspace-default policy is represented by [] + false.
+      tools: newSessionDraftToolsProvided(current) ? current.tools : [],
+      model: current.model,
+      reasoningEffort: current.reasoningEffort,
+      sessionOptions: storedOptions(safeOptions, newSessionDraftToolsProvided(current)),
+      updatedAt: new Date(),
+    })
+    .where(
+      and(
+        eq(schema.newSessionDrafts.id, current.id),
         eq(schema.newSessionDrafts.revision, input.expectedRevision),
       ),
     )
     .returning({ id: schema.newSessionDrafts.id });
-  return deleted.length > 0;
+  return Boolean(seeded);
 }
+
+/** @deprecated Kept as a compatibility name for low-level callers. */
+export const consumeNewSessionDraftInTransaction = seedNewSessionDraftInTransaction;

package/src/provision-roles.ts

@@ -1,5 +1,10 @@
 import postgres from "postgres";
 import type { RlsStrategy } from "./index";
+import {
+  RUNTIME_FULL_DML_TABLES,
+  RUNTIME_READ_INSERT_TABLES,
+  RUNTIME_READ_ONLY_TABLES,
+} from "./runtime-posture";
 
 export type ProvisionResult = {
   appRole: string | null;
@@ -101,7 +106,12 @@ export async function provisionRoles(
           "OPENGENI_APP_DATABASE_PASSWORD (or appPassword) is required for rlsStrategy 'force'",
         );
       }
-      await ensureLoginRole(sql, appRole, appPassword);
+      // Ownership and role-graph edges cannot be safely guessed away. Refuse to
+      // mutate an existing role until an operator has explicitly transferred
+      // objects/removed memberships; role attributes and direct grants, however,
+      // are deterministic and are converged below on every run.
+      await assertAppRoleSafeToNormalize(sql, appRole);
+      await ensureRestrictedAppLoginRole(sql, appRole, appPassword);
       provisionedAppRole = appRole;
     }
 
@@ -166,6 +176,108 @@ END $$;
 `);
 }
 
+async function ensureRestrictedAppLoginRole(
+  sql: postgres.Sql,
+  role: string,
+  password: string,
+): Promise<void> {
+  await sql.unsafe(`
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN
+    EXECUTE format(
+      'CREATE ROLE %I WITH LOGIN NOSUPERUSER NOBYPASSRLS NOCREATEROLE NOCREATEDB NOREPLICATION NOINHERIT PASSWORD %L',
+      ${literal(role)},
+      ${literal(password)}
+    );
+  ELSE
+    EXECUTE format(
+      'ALTER ROLE %I WITH LOGIN NOSUPERUSER NOBYPASSRLS NOCREATEROLE NOCREATEDB NOREPLICATION NOINHERIT PASSWORD %L',
+      ${literal(role)},
+      ${literal(password)}
+    );
+  END IF;
+END $$;
+`);
+}
+
+/**
+ * Fail rather than silently revoking role relationships or transferring owned
+ * objects. Those operations have effects outside OpenGeni's runtime grant
+ * contract and require an explicit, audited operator decision.
+ */
+async function assertAppRoleSafeToNormalize(sql: postgres.Sql, role: string): Promise<void> {
+  const exists = await sql<{ exists: boolean }[]>`
+    select exists(select 1 from pg_roles where rolname = ${role}) as exists
+  `;
+  if (!exists[0]?.exists) {
+    return;
+  }
+
+  const memberships = await sql<{ relationship: string }[]>`
+    select ('inherits:' || parent.rolname)::text as relationship
+    from pg_auth_members membership
+    join pg_roles member on member.oid = membership.member
+    join pg_roles parent on parent.oid = membership.roleid
+    where member.rolname = ${role}
+    union all
+    select ('member:' || member.rolname)::text as relationship
+    from pg_auth_members membership
+    join pg_roles member on member.oid = membership.member
+    join pg_roles parent on parent.oid = membership.roleid
+    where parent.rolname = ${role}
+    order by relationship
+  `;
+  if (memberships.length > 0) {
+    throw new Error(
+      `Refusing to normalize app role ${role}: remove role relationships first (${memberships
+        .map((row) => row.relationship)
+        .join(", ")})`,
+    );
+  }
+
+  const ownedObjects = await sql<{ object_name: string }[]>`
+    select ('database:' || d.datname)::text as object_name
+    from pg_database d
+    join pg_roles owner on owner.oid = d.datdba
+    where owner.rolname = ${role}
+    union all
+    select ('schema:' || n.nspname)::text as object_name
+    from pg_namespace n
+    join pg_roles owner on owner.oid = n.nspowner
+    where owner.rolname = ${role}
+      and n.nspname <> 'information_schema'
+      and n.nspname !~ '^pg_'
+    union all
+    select ('relation:' || n.nspname || '.' || c.relname)::text as object_name
+    from pg_class c
+    join pg_namespace n on n.oid = c.relnamespace
+    join pg_roles owner on owner.oid = c.relowner
+    where owner.rolname = ${role}
+      and n.nspname <> 'information_schema'
+      and n.nspname !~ '^pg_'
+    union all
+    select (
+      'routine:' || n.nspname || '.' || p.proname || '(' ||
+      pg_get_function_identity_arguments(p.oid) || ')'
+    )::text as object_name
+    from pg_proc p
+    join pg_namespace n on n.oid = p.pronamespace
+    join pg_roles owner on owner.oid = p.proowner
+    where owner.rolname = ${role}
+      and n.nspname <> 'information_schema'
+      and n.nspname !~ '^pg_'
+    order by object_name
+  `;
+  if (ownedObjects.length > 0) {
+    throw new Error(
+      `Refusing to normalize app role ${role}: transfer owned objects first (${ownedObjects
+        .map((row) => row.object_name)
+        .join(", ")})`,
+    );
+  }
+}
+
 async function ensureDatabase(sql: postgres.Sql, database: string, owner: string): Promise<void> {
   const existing = await sql<{ exists: boolean }[]>`
     select exists(select 1 from pg_database where datname = ${database}) as exists
@@ -203,16 +315,86 @@ async function grantAppRoleIfSchemaExists(
   role: string,
   schema: string,
 ): Promise<void> {
+  const runtimeFullDmlTables = `ARRAY[${RUNTIME_FULL_DML_TABLES.map(literal).join(", ")}]`;
+  const runtimeReadOnlyTables = `ARRAY[${RUNTIME_READ_ONLY_TABLES.map(literal).join(", ")}]`;
+  const runtimeReadInsertTables = `ARRAY[${RUNTIME_READ_INSERT_TABLES.map(literal).join(", ")}]`;
   await sql.unsafe(`
 DO $$
+DECLARE
+  owner_role text := current_user;
+  runtime_table text;
 BEGIN
+  EXECUTE format('REVOKE CREATE ON DATABASE %I FROM %I', current_database(), ${literal(role)});
   IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(schema)}) THEN
     EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});
-    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});
+    EXECUTE format('REVOKE CREATE ON SCHEMA %I FROM %I', ${literal(schema)}, ${literal(role)});
+    EXECUTE format('REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA %I FROM %I', ${literal(schema)}, ${literal(role)});
+    FOREACH runtime_table IN ARRAY ${runtimeFullDmlTables} LOOP
+      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
+        EXECUTE format(
+          'GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE %I.%I TO %I',
+          ${literal(schema)},
+          runtime_table,
+          ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    FOREACH runtime_table IN ARRAY ${runtimeReadOnlyTables} LOOP
+      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
+        EXECUTE format(
+          'GRANT SELECT ON TABLE %I.%I TO %I',
+          ${literal(schema)},
+          runtime_table,
+          ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    FOREACH runtime_table IN ARRAY ${runtimeReadInsertTables} LOOP
+      IF to_regclass(format('%I.%I', ${literal(schema)}, runtime_table)) IS NOT NULL THEN
+        EXECUTE format(
+          'GRANT SELECT, INSERT ON TABLE %I.%I TO %I',
+          ${literal(schema)},
+          runtime_table,
+          ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    -- Migration 0110 creates this target-schema-local SECURITY DEFINER
+    -- capability before opengeni_app may exist. Re-converge its exact EXECUTE
+    -- grant here so the supported migrate-then-provision order is equivalent to
+    -- provisioning the role before that migration.
+    IF to_regprocedure(
+      format('%I.lock_nested_agent_depth_configuration()', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.lock_nested_agent_depth_configuration() TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    EXECUTE format('GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});
+    EXECUTE format(
+      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA %I REVOKE ALL PRIVILEGES ON TABLES FROM %I',
+      owner_role,
+      ${literal(schema)},
+      ${literal(role)}
+    );
+    EXECUTE format(
+      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA %I GRANT USAGE, SELECT ON SEQUENCES TO %I',
+      owner_role,
+      ${literal(schema)},
+      ${literal(role)}
+    );
   END IF;
   IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private') THEN
     EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});
+    EXECUTE format('REVOKE CREATE ON SCHEMA opengeni_private FROM %I', ${literal(role)});
     EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_private TO %I', ${literal(role)});
+    EXECUTE format(
+      'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA opengeni_private GRANT EXECUTE ON FUNCTIONS TO %I',
+      owner_role,
+      ${literal(role)}
+    );
   END IF;
 END $$;
 `);

package/src/runtime-posture-cli.ts

@@ -0,0 +1,57 @@
+import { dbSearchPath, getSettings } from "@opengeni/config";
+import {
+  assertRuntimeDatabasePosture,
+  createDb,
+  FORCE_RLS_TABLES,
+  PROTECTED_NO_DIRECT_DML_TABLES,
+  RUNTIME_FULL_DML_TABLES,
+  RUNTIME_READ_INSERT_TABLES,
+  RUNTIME_READ_ONLY_TABLES,
+} from "./index";
+
+const settings = getSettings();
+const searchPath = dbSearchPath(settings);
+const client = createDb(settings.databaseUrl, {
+  ...(searchPath ? { searchPath } : {}),
+  rlsStrategy: settings.rlsStrategy,
+  max: 1,
+});
+
+try {
+  const posture = await assertRuntimeDatabasePosture(client.db, {
+    rlsStrategy: settings.rlsStrategy,
+    expectedRole: settings.runtimeDatabaseRole,
+    targetSchema: settings.dbSchema.trim() || "public",
+  });
+  // Structural evidence only: never print a connection string, secret, GUC, or
+  // tenant row. The command is intended for release Jobs and audit artifacts.
+  console.log(
+    JSON.stringify({
+      ok: true,
+      rlsStrategy: settings.rlsStrategy,
+      currentUser: posture.identity.currentUser,
+      sessionUser: posture.identity.sessionUser,
+      memberships: posture.memberships.length,
+      ownedSchemas: posture.ownedSchemas.length,
+      ownedRelations: posture.ownedRelations.length,
+      declaredProtectedTables: FORCE_RLS_TABLES.length,
+      activeProtectedTables: posture.tables.filter((table) => table.rlsActive).length,
+      declaredFullDmlTables: RUNTIME_FULL_DML_TABLES.length,
+      privilegedFullDmlTables: posture.tables.filter(
+        (table) =>
+          table.select &&
+          table.insert &&
+          table.update &&
+          table.delete &&
+          !table.truncate &&
+          !table.references &&
+          !table.trigger,
+      ).length,
+      declaredReadOnlyTables: RUNTIME_READ_ONLY_TABLES.length,
+      declaredReadInsertTables: RUNTIME_READ_INSERT_TABLES.length,
+      declaredProtectedNoDirectDmlTables: PROTECTED_NO_DIRECT_DML_TABLES.length,
+    }),
+  );
+} finally {
+  await client.close();
+}