@opengeni/db 0.28.1 → 0.31.1

package/drizzle/0195_editable_artifact_import_authorization.sql

@@ -0,0 +1,203 @@
+-- deployment-mode: rolling
+-- Treat artifact creation and Office import as scope-level origin operations.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+CREATE UNIQUE INDEX "files_scope_id_uq"
+  ON "files" ("account_id", "workspace_id", "id");
+
+ALTER TABLE "editable_artifact_blob_refs"
+  ADD COLUMN "source_file_id" uuid,
+  ADD CONSTRAINT "editable_artifact_blob_refs_source_kind_chk" CHECK (
+    ("kind" = 'original_import') = ("source_file_id" IS NOT NULL)
+  ) NOT VALID,
+  ADD CONSTRAINT "editable_artifact_blob_refs_source_file_fk"
+    FOREIGN KEY ("account_id", "workspace_id", "source_file_id")
+    REFERENCES "files" ("account_id", "workspace_id", "id")
+    ON DELETE RESTRICT NOT VALID;
+
+ALTER TABLE "editable_artifact_blob_refs"
+  VALIDATE CONSTRAINT "editable_artifact_blob_refs_source_kind_chk";
+ALTER TABLE "editable_artifact_blob_refs"
+  VALIDATE CONSTRAINT "editable_artifact_blob_refs_source_file_fk";
+
+CREATE OR REPLACE FUNCTION opengeni_private.authorize_editable_artifact_actor(
+  p_account_id uuid,
+  p_workspace_id uuid,
+  p_artifact_id text,
+  p_actor_kind text,
+  p_actor_subject_id text,
+  p_agent_session_id text,
+  p_agent_turn_id text,
+  p_agent_attempt_id text,
+  p_agent_generation integer,
+  p_service_name text,
+  p_permission text,
+  p_data_schema name DEFAULT pg_catalog.current_schema()
+) RETURNS TABLE (allowed boolean, authorization_revision bigint)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog, pg_temp
+AS $body$
+DECLARE data_schema name;
+DECLARE required_permission text;
+DECLARE current_revision bigint;
+DECLARE principal_allowed boolean := false;
+BEGIN
+  IF p_account_id IS NULL OR p_workspace_id IS NULL
+    OR p_artifact_id IS NULL
+    OR p_artifact_id !~ '^[0-9a-f]{32}$' OR p_artifact_id ~ '^0+$'
+    OR p_actor_kind IS NULL OR p_actor_kind NOT IN ('human', 'agent', 'service')
+    OR p_actor_subject_id IS NULL
+    OR octet_length(p_actor_subject_id) NOT BETWEEN 1 AND 1024
+    OR p_actor_subject_id <> btrim(p_actor_subject_id)
+    OR p_permission IS NULL
+    OR p_permission NOT IN ('create', 'read', 'edit', 'import', 'export', 'manage')
+    OR NOT opengeni_private.editable_artifact_scope_matches_context(
+      p_account_id, p_workspace_id
+    )
+  THEN
+    RAISE EXCEPTION 'editable artifact authorization request is invalid'
+      USING ERRCODE = '22023';
+  END IF;
+  IF (p_actor_kind = 'human' AND (
+      p_agent_session_id IS NOT NULL OR p_agent_turn_id IS NOT NULL
+      OR p_agent_attempt_id IS NOT NULL OR p_agent_generation IS NOT NULL
+      OR p_service_name IS NOT NULL
+    )) OR (p_actor_kind = 'agent' AND (
+      p_agent_session_id IS NULL OR p_agent_turn_id IS NULL
+      OR p_agent_attempt_id IS NULL OR p_agent_generation IS NULL
+      OR p_agent_generation < 0 OR p_service_name IS NOT NULL
+    )) OR (p_actor_kind = 'service' AND (
+      p_agent_session_id IS NOT NULL OR p_agent_turn_id IS NOT NULL
+      OR p_agent_attempt_id IS NOT NULL OR p_agent_generation IS NOT NULL
+      OR p_service_name IS NULL
+    ))
+  THEN
+    RAISE EXCEPTION 'editable artifact authorization actor is invalid'
+      USING ERRCODE = '22023';
+  END IF;
+
+  data_schema := opengeni_private.resolve_editable_artifact_data_schema(p_data_schema);
+  required_permission := CASE
+    WHEN p_permission IN ('read', 'export') THEN 'artifacts:read'
+    ELSE 'artifacts:publish'
+  END;
+
+  IF p_permission IN ('create', 'import') THEN
+    current_revision := opengeni_private.ensure_editable_artifact_scope_authorization_head(
+      p_account_id, p_workspace_id, data_schema
+    );
+  ELSE
+    EXECUTE pg_catalog.format($query$
+      SELECT artifact.authorization_revision
+      FROM %I.editable_artifacts artifact
+      WHERE artifact.account_id = $1 AND artifact.workspace_id = $2
+        AND artifact.id = $3
+    $query$, data_schema)
+      INTO current_revision
+      USING p_account_id, p_workspace_id, p_artifact_id;
+    current_revision := coalesce(current_revision, 1);
+  END IF;
+
+  IF p_actor_kind = 'agent' THEN
+    EXECUTE pg_catalog.format($query$
+      SELECT true
+      FROM %I.sessions session
+      JOIN %I.session_turns turn
+        ON turn.account_id = session.account_id
+        AND turn.workspace_id = session.workspace_id
+        AND turn.session_id = session.id
+      JOIN %I.session_turn_attempts attempt
+        ON attempt.account_id = turn.account_id
+        AND attempt.workspace_id = turn.workspace_id
+        AND attempt.session_id = turn.session_id
+        AND attempt.turn_id = turn.id
+      WHERE session.account_id = $1 AND session.workspace_id = $2
+        AND session.id::text = $3
+        AND turn.id::text = $4
+        AND attempt.id::text = $5
+        AND session.active_turn_id = turn.id
+        AND turn.active_attempt_id = attempt.id
+        AND turn.execution_generation = $6
+        AND attempt.execution_generation = $6
+        AND turn.status IN ('running', 'requires_action', 'recovering', 'waiting_capacity')
+        AND attempt.state IN ('claimed', 'running')
+        AND attempt.closed_at IS NULL AND attempt.quiesced_at IS NULL
+        AND NOT EXISTS (
+          SELECT 1
+          FROM %I.session_attempt_interruptions interruption
+          WHERE interruption.account_id = session.account_id
+            AND interruption.workspace_id = session.workspace_id
+            AND interruption.session_id = session.id
+            AND interruption.attempt_id = attempt.id
+            AND interruption.state IN ('pending', 'delivered', 'acknowledged')
+        )
+        AND (
+          session.first_party_mcp_permissions IS NULL
+          OR session.first_party_mcp_permissions ? $7
+          OR session.first_party_mcp_permissions ? 'workspace:admin'
+        )
+      LIMIT 1
+      FOR SHARE OF session, turn, attempt
+    $query$, data_schema, data_schema, data_schema, data_schema)
+      INTO principal_allowed
+      USING p_account_id, p_workspace_id, p_agent_session_id,
+        p_agent_turn_id, p_agent_attempt_id, p_agent_generation,
+        required_permission;
+  ELSIF p_actor_kind = 'service'
+    AND p_service_name = 'api_key'
+    AND p_actor_subject_id ~ '^api_key:[0-9a-fA-F-]{36}$'
+  THEN
+    EXECUTE pg_catalog.format($query$
+      SELECT true
+      FROM %I.api_keys api_key
+      WHERE api_key.account_id = $1 AND api_key.workspace_id = $2
+        AND api_key.id::text = substring($3 from 9)
+        AND api_key.revoked_at IS NULL
+        AND (api_key.expires_at IS NULL OR api_key.expires_at > pg_catalog.clock_timestamp())
+        AND (api_key.permissions ? $4 OR api_key.permissions ? 'workspace:admin')
+      LIMIT 1
+      FOR SHARE OF api_key
+    $query$, data_schema)
+      INTO principal_allowed
+      USING p_account_id, p_workspace_id, p_actor_subject_id, required_permission;
+  ELSIF p_actor_kind = 'human'
+    OR (p_actor_kind = 'service' AND p_service_name = 'configured_key')
+  THEN
+    EXECUTE pg_catalog.format($query$
+      SELECT true
+      FROM %I.workspace_memberships membership
+      WHERE membership.account_id = $1 AND membership.workspace_id = $2
+        AND membership.subject_id = $3
+        AND (membership.permissions ? $4 OR membership.permissions ? 'workspace:admin')
+      LIMIT 1
+      FOR SHARE OF membership
+    $query$, data_schema)
+      INTO principal_allowed
+      USING p_account_id, p_workspace_id, p_actor_subject_id, required_permission;
+  ELSE
+    principal_allowed := false;
+  END IF;
+
+  RETURN QUERY SELECT coalesce(principal_allowed, false), current_revision;
+END;
+$body$;
+
+REVOKE ALL ON FUNCTION opengeni_private.authorize_editable_artifact_actor(
+  uuid, uuid, text, text, text, text, text, text, integer, text, text, name
+) FROM PUBLIC;
+
+DO $runtime_authorization_grant$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.authorize_editable_artifact_actor(
+      uuid, uuid, text, text, text, text, text, text, integer, text, text, name
+    ) TO opengeni_app;
+  END IF;
+END;
+$runtime_authorization_grant$;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0196_rig_provider_images.sql

@@ -0,0 +1,152 @@
+-- deployment-mode: rolling
+-- Exact rig-version definitions remain immutable. This additive operational
+-- metadata records build-once provider image status and immutable identities.
+
+ALTER TABLE rig_versions
+  ADD COLUMN provider_images jsonb NOT NULL DEFAULT '{}'::jsonb;
+
+ALTER TABLE rig_versions
+  ADD CONSTRAINT rig_versions_provider_images_object_chk
+  CHECK (jsonb_typeof(provider_images) = 'object');
+
+-- Reuse the existing provider-artifact ledger and global GC. A rig-version
+-- reference protects the exact image for that immutable version. A verified
+-- change protects it only while its base remains active/promotable; rejected,
+-- failed, abandoned-after-supersession, and deleted targets fall back to the
+-- ordinary candidate/current collection path.
+DO $rig_provider_image_checkpoint_gc$
+DECLARE data_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.claim_sandbox_checkpoint_artifacts(
+      p_claim_id uuid,
+      p_limit integer,
+      p_claim_ttl_ms bigint
+    )
+    RETURNS TABLE (
+      id uuid,
+      provider_backend text,
+      provider_binding_key text,
+      provider_binding jsonb,
+      object_kind text,
+      object_id text,
+      delete_attempts integer
+    )
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    BEGIN
+      IF p_claim_id IS NULL THEN
+        RAISE EXCEPTION 'checkpoint artifact claim id is required'
+          USING ERRCODE = '22023';
+      END IF;
+      IF p_limit IS NULL OR p_limit < 1 OR p_limit > 500 THEN
+        RAISE EXCEPTION 'checkpoint artifact claim limit must be between 1 and 500'
+          USING ERRCODE = '22023';
+      END IF;
+      IF p_claim_ttl_ms IS NULL
+        OR p_claim_ttl_ms < 1000
+        OR p_claim_ttl_ms > 3600000
+      THEN
+        RAISE EXCEPTION 'checkpoint artifact claim TTL must be between 1s and 1h'
+          USING ERRCODE = '22023';
+      END IF;
+
+      PERFORM pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2', '1', true);
+
+      WITH stale_claims AS MATERIALIZED (
+        SELECT artifact.id
+        FROM %1$I.sandbox_checkpoint_artifacts artifact
+        WHERE artifact.state = 'deleting'
+          AND artifact.delete_claimed_at
+            < pg_catalog.now()
+              - pg_catalog.make_interval(secs => p_claim_ttl_ms / 1000.0)
+        ORDER BY artifact.delete_claimed_at, artifact.id
+        FOR UPDATE SKIP LOCKED
+        LIMIT p_limit
+      )
+      UPDATE %1$I.sandbox_checkpoint_artifacts artifact SET
+        state = 'delete_failed',
+        delete_after = pg_catalog.now(),
+        delete_claim_id = null,
+        delete_claimed_at = null,
+        last_delete_error = coalesce(
+          last_delete_error, 'stale delete claim recovered'
+        ),
+        updated_at = pg_catalog.now()
+      FROM stale_claims
+      WHERE artifact.id = stale_claims.id;
+
+      RETURN QUERY
+      WITH candidates AS (
+        SELECT artifact.id
+        FROM %1$I.sandbox_checkpoint_artifacts artifact
+        WHERE (
+            (
+              artifact.state = 'candidate'
+              AND artifact.created_at < pg_catalog.now() - interval '15 minutes'
+            )
+            OR (
+              artifact.state IN ('current', 'previous')
+              AND artifact.created_at < pg_catalog.now() - interval '15 minutes'
+            )
+            OR (
+              artifact.state IN ('delete_pending', 'delete_failed')
+              AND coalesce(artifact.delete_after, artifact.created_at)
+                <= pg_catalog.now()
+            )
+          )
+          AND NOT EXISTS (
+            SELECT 1 FROM %1$I.sandbox_leases lease
+            WHERE lease.current_checkpoint_artifact_id = artifact.id
+               OR lease.previous_checkpoint_artifact_id = artifact.id
+               OR (
+                 artifact.provenance = 'native_capture'
+                 AND lease.id = artifact.source_lease_id
+                 AND lease.lease_epoch = artifact.source_lease_epoch
+                 AND lease.instance_id = artifact.source_instance_id
+                 AND lease.backend = artifact.provider_backend
+                 AND lease.archive_capture_id IS NOT NULL
+                 AND lease.archive_capture_generation
+                   = artifact.source_workspace_generation
+               )
+          )
+          AND NOT EXISTS (
+            SELECT 1
+            FROM %1$I.rig_versions version
+            CROSS JOIN LATERAL pg_catalog.jsonb_each(version.provider_images) provider_image
+            WHERE provider_image.value ->> 'artifactId' = artifact.id::text
+              AND provider_image.value ->> 'status' = 'ready'
+          )
+          AND NOT EXISTS (
+            SELECT 1
+            FROM %1$I.rig_changes change
+            JOIN %1$I.rig_versions base
+              ON base.id = change.base_version_id
+             AND base.workspace_id = change.workspace_id
+             AND base.active = true
+            WHERE change.status IN ('verifying', 'proposed')
+              AND change.verification #>> '{providerImage,artifactId}' = artifact.id::text
+              AND change.verification #>> '{providerImage,status}' = 'ready'
+          )
+        ORDER BY coalesce(artifact.delete_after, artifact.created_at), artifact.id
+        FOR UPDATE SKIP LOCKED
+        LIMIT p_limit
+      )
+      UPDATE %1$I.sandbox_checkpoint_artifacts artifact SET
+        state = 'deleting',
+        delete_attempts = artifact.delete_attempts + 1,
+        delete_claim_id = p_claim_id,
+        delete_claimed_at = pg_catalog.now(),
+        updated_at = pg_catalog.now()
+      FROM candidates
+      WHERE artifact.id = candidates.id
+      RETURNING artifact.id, artifact.provider_backend, artifact.provider_binding_key,
+        artifact.provider_binding, artifact.object_kind, artifact.object_id,
+        artifact.delete_attempts;
+    END;
+    $function$;
+  $create$, data_schema);
+END
+$rig_provider_image_checkpoint_gc$;