@opengeni/db 0.28.9 → 0.36.0

package/dist/slack-task-policy.d.ts

@@ -0,0 +1,65 @@
+import { SlackTaskPolicyContent, type SlackTaskPolicyHead, type SlackTaskPolicyListResponse, type SlackTaskPolicyMutationResponse, type SlackTaskPolicyRevision } from "@opengeni/contracts";
+import type { Database } from "./database.js";
+export type SlackSharedTaskOrigin = {
+    interactionId: string;
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    sessionId: string;
+    slackTeamId: string;
+    sourceChannelId: string;
+    sourceThreadTs: string;
+    initiatingSlackUserId: string;
+    policyRevisionId: string;
+    policyHash: string;
+    policyActivationVersion: number;
+    publicationMode: "never" | "approval_required" | "allow";
+    createdAt: Date;
+};
+export declare class SlackTaskPolicyConflictError extends Error {
+    readonly currentHead: SlackTaskPolicyHead | null;
+    readonly name = "SlackTaskPolicyConflictError";
+    readonly code = "SLACK_TASK_POLICY_CONFLICT";
+    constructor(currentHead: SlackTaskPolicyHead | null);
+}
+export declare class SlackTaskPolicyOperationReuseError extends Error {
+    readonly name = "SlackTaskPolicyOperationReuseError";
+    readonly code = "SLACK_TASK_POLICY_OPERATION_REUSED";
+    constructor();
+}
+export declare class SlackTaskPolicyInvalidOperationError extends Error {
+    readonly name = "SlackTaskPolicyInvalidOperationError";
+}
+export declare class SlackTaskPolicyAuthorityError extends Error {
+    readonly name = "SlackTaskPolicyAuthorityError";
+    constructor(message?: string);
+}
+export declare function getActiveSlackTaskPolicy(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+}): Promise<{
+    head: SlackTaskPolicyHead;
+    revision: SlackTaskPolicyRevision;
+} | null>;
+export declare function listSlackTaskPolicy(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    limit?: number;
+}): Promise<SlackTaskPolicyListResponse>;
+export declare function updateSlackTaskPolicy(db: Database, input: {
+    operationId?: string;
+    accountId: string;
+    workspaceId: string;
+    policy: SlackTaskPolicyContent;
+    expectedCurrentRevisionId: string | null;
+    expectedActivationVersion: number;
+    actorSubjectId: string;
+    principalKind: "human_session" | undefined;
+    reason: string;
+}): Promise<SlackTaskPolicyMutationResponse>;
+export declare function saveSlackSharedTaskOrigin(db: Database, input: Omit<SlackSharedTaskOrigin, "createdAt">): Promise<SlackSharedTaskOrigin>;
+export declare function getSlackSharedTaskOrigin(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    interactionId: string;
+}): Promise<SlackSharedTaskOrigin | null>;

package/dist/slack-user-link-access.d.ts

@@ -0,0 +1,54 @@
+import { type Permission, type SlackUserLinkAccessRequest } from "@opengeni/contracts";
+import { type Database } from "./database.js";
+export declare class SlackUserLinkAccessPersistenceError extends Error {
+    readonly code: "not_found" | "subject_mismatch" | "claim_mismatch" | "version_conflict" | "state_conflict" | "idempotency_conflict" | "slack_identity_conflict";
+    constructor(code: "not_found" | "subject_mismatch" | "claim_mismatch" | "version_conflict" | "state_conflict" | "idempotency_conflict" | "slack_identity_conflict");
+}
+export type PrepareSlackUserLinkAccessInput = {
+    accountId: string;
+    workspaceId: string;
+    tokenDigest: string;
+    connectionId: string;
+    slackTeamId: string;
+    slackUserId: string;
+    subjectId: string;
+    subjectLabel?: string | null;
+    expiresAt: Date;
+};
+export type SlackUserLinkAccessMutationInput = {
+    workspaceId: string;
+    requestId: string;
+    actorSubjectId: string;
+    expectedVersion: number;
+    idempotencyKey: string;
+};
+export type ApproveSlackUserLinkAccessInput = SlackUserLinkAccessMutationInput & {
+    role?: string;
+    permissions: Permission[];
+};
+/**
+ * Persist one verified Slack bearer as token-free, subject-bound state. A
+ * second fresh bearer for the same exact subject/provider principal supersedes
+ * only that subject's older active intent; another subject's row is untouched.
+ */
+export declare function prepareSlackUserLinkAccessRequest(db: Database, input: PrepareSlackUserLinkAccessInput, now?: Date): Promise<SlackUserLinkAccessRequest>;
+export declare function getSlackUserLinkAccessRequestForSubject(db: Database, input: {
+    workspaceId: string;
+    requestId: string;
+    subjectId: string;
+}, now?: Date): Promise<SlackUserLinkAccessRequest | null>;
+export declare function requestSlackUserLinkWorkspaceAccess(db: Database, input: SlackUserLinkAccessMutationInput, now?: Date): Promise<SlackUserLinkAccessRequest>;
+export declare function cancelSlackUserLinkAccessRequest(db: Database, input: SlackUserLinkAccessMutationInput, now?: Date): Promise<SlackUserLinkAccessRequest>;
+export declare function denySlackUserLinkAccessRequest(db: Database, input: SlackUserLinkAccessMutationInput, now?: Date): Promise<SlackUserLinkAccessRequest>;
+export declare function approveSlackUserLinkAccessRequest(db: Database, input: ApproveSlackUserLinkAccessInput, now?: Date): Promise<SlackUserLinkAccessRequest>;
+/**
+ * Complete a prepared/pending link only when the subject's live membership
+ * already grants sessions:create (or workspace:admin). This is used both for
+ * ordinary already-authorized links and after a separate canonical member grant.
+ */
+export declare function completeSlackUserLinkAccessIfGranted(db: Database, input: {
+    workspaceId: string;
+    requestId: string;
+    subjectId: string;
+}, now?: Date): Promise<SlackUserLinkAccessRequest | null>;
+export declare function listPendingSlackUserLinkAccessRequests(db: Database, workspaceId: string, now?: Date): Promise<SlackUserLinkAccessRequest[]>;