@opengeni/db 0.28.9 → 0.36.0

package/drizzle/0216_browser_auth_health_evidence.sql

@@ -0,0 +1,137 @@
+-- deployment-mode: maintenance
+-- Causally ordered SiteAuth health evidence. Browser runs remain independent;
+-- only the newest-started terminal evidence may change the shared projection.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '30s';
+
+CREATE SEQUENCE "auth_runs_health_sequence_seq" AS bigint;
+
+ALTER TABLE "auth_runs"
+  ADD COLUMN "purpose" text NOT NULL DEFAULT 'authenticate',
+  ADD COLUMN "health_sequence" bigint NOT NULL
+    DEFAULT nextval('auth_runs_health_sequence_seq'::regclass);
+
+ALTER SEQUENCE "auth_runs_health_sequence_seq"
+  OWNED BY "auth_runs"."health_sequence";
+
+-- The volatile default gives legacy rows values, but physical row order is not
+-- causal. Re-rank the bounded pre-cutover history before admitting writers.
+WITH ordered AS (
+  SELECT
+    "id",
+    row_number() OVER (ORDER BY "created_at", "id")::bigint AS "health_sequence"
+  FROM "auth_runs"
+)
+UPDATE "auth_runs" AS run
+SET "health_sequence" = ordered."health_sequence"
+FROM ordered
+WHERE run."id" = ordered."id";
+
+SELECT setval(
+  'auth_runs_health_sequence_seq'::regclass,
+  greatest(coalesce((SELECT max("health_sequence") FROM "auth_runs"), 0), 1),
+  coalesce((SELECT max("health_sequence") FROM "auth_runs"), 0) > 0
+);
+
+ALTER TABLE "auth_runs"
+  ADD CONSTRAINT "auth_runs_health_evidence_check" CHECK (
+    "purpose" IN ('authenticate', 'health_check', 'repair')
+    AND "health_sequence" > 0
+  );
+
+ALTER TABLE "site_auth_connections"
+  ADD COLUMN "last_checked_at" timestamptz,
+  ADD COLUMN "next_check_at" timestamptz,
+  ADD COLUMN "health_sequence" bigint NOT NULL DEFAULT 0;
+
+-- Existing successful verification is preserved. Existing terminal failures,
+-- which the old writer failed to project, become repair evidence now.
+WITH latest AS (
+  SELECT DISTINCT ON (run."site_auth_connection_id")
+    run."site_auth_connection_id",
+    run."id",
+    run."state",
+    run."purpose",
+    run."health_sequence",
+    run."verified_url",
+    run."failure_code",
+    run."settled_at"
+  FROM "auth_runs" AS run
+  WHERE run."state" IN ('verified', 'failed')
+    AND run."settled_at" IS NOT NULL
+  ORDER BY run."site_auth_connection_id", run."health_sequence" DESC
+)
+UPDATE "site_auth_connections" AS connection
+SET
+  "verification_state" = CASE
+    WHEN latest."state" = 'verified' THEN 'verified'
+    WHEN latest."purpose" = 'repair' THEN 'failed'
+    ELSE 'needs_repair'
+  END,
+  "last_verified_at" = CASE
+    WHEN latest."state" = 'verified' THEN latest."settled_at"
+    ELSE connection."last_verified_at"
+  END,
+  "last_verified_url" = CASE
+    WHEN latest."state" = 'verified' THEN latest."verified_url"
+    ELSE connection."last_verified_url"
+  END,
+  "repair_code" = CASE
+    WHEN latest."state" = 'verified' THEN NULL
+    ELSE latest."failure_code"
+  END,
+  "last_checked_at" = latest."settled_at",
+  "health_sequence" = latest."health_sequence"
+FROM latest
+WHERE connection."id" = latest."site_auth_connection_id";
+
+UPDATE "site_auth_connections"
+SET
+  "next_check_at" = CASE
+    WHEN "status" = 'active' AND "health_policy"->>'mode' = 'maintained'
+      THEN CASE
+        WHEN "last_checked_at" IS NULL THEN now()
+        ELSE "last_checked_at"
+          + ((("health_policy"->>'intervalSeconds')::bigint) * interval '1 second')
+      END
+    ELSE NULL
+  END,
+  "version" = "version" + 1,
+  "updated_at" = now();
+
+ALTER TABLE "site_auth_connections"
+  ADD CONSTRAINT "site_auth_connections_health_check" CHECK (
+    (
+      (
+        "health_sequence" = 0
+        AND "last_checked_at" IS NULL
+      ) OR (
+        "health_sequence" > 0
+        AND "last_checked_at" IS NOT NULL
+      )
+    ) AND (
+      (
+        "status" = 'active'
+        AND "health_policy"->>'mode' = 'maintained'
+        AND "next_check_at" IS NOT NULL
+      ) OR (
+        NOT ("status" = 'active' AND "health_policy"->>'mode' = 'maintained')
+        AND "next_check_at" IS NULL
+      )
+    )
+  );
+
+CREATE INDEX "site_auth_connections_health_maintenance_idx"
+  ON "site_auth_connections" ("workspace_id", "next_check_at", "id");
+
+REVOKE ALL ON SEQUENCE "auth_runs_health_sequence_seq" FROM PUBLIC;
+DO $browser_auth_health_role_grants$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'GRANT USAGE, SELECT ON SEQUENCE %I.auth_runs_health_sequence_seq TO opengeni_app',
+      current_schema()
+    );
+  END IF;
+END
+$browser_auth_health_role_grants$;

package/drizzle/0216_pack_component_ownership.sql

@@ -0,0 +1,235 @@
+-- deployment-mode: rolling
+-- Additive Pack installation evidence and component ownership. Old API/worker
+-- binaries continue to use the original columns; new binaries freeze the
+-- reviewed manifest and populate the normalized component ledger.
+
+ALTER TABLE "pack_installations"
+  ADD COLUMN "version" integer NOT NULL DEFAULT 1,
+  ADD COLUMN "manifest_snapshot" jsonb,
+  ADD COLUMN "manifest_digest" text,
+  ADD COLUMN "selected_rig_id" uuid REFERENCES "rigs"("id") ON DELETE SET NULL,
+  ADD COLUMN "installed_by_subject_id" text;
+
+ALTER TABLE "pack_installations"
+  ADD CONSTRAINT "pack_installations_version_chk" CHECK ("version" > 0) NOT VALID,
+  ADD CONSTRAINT "pack_installations_manifest_chk" CHECK (
+    ("manifest_snapshot" IS NULL AND "manifest_digest" IS NULL)
+    OR (
+      jsonb_typeof("manifest_snapshot") = 'object'
+      AND octet_length(convert_to("manifest_snapshot"::text, 'UTF8')) <= 1048576
+      AND "manifest_digest" ~ '^[0-9a-f]{64}$'
+    )
+  ) NOT VALID,
+  ADD CONSTRAINT "pack_installations_actor_chk" CHECK (
+    "installed_by_subject_id" IS NULL
+    OR length(btrim("installed_by_subject_id")) BETWEEN 1 AND 1024
+  ) NOT VALID,
+  ADD CONSTRAINT "pack_installations_status_chk" CHECK (
+    "status" IN ('installing', 'active', 'needs_attention', 'disabled')
+  ) NOT VALID;
+
+ALTER TABLE "pack_installations"
+  VALIDATE CONSTRAINT "pack_installations_version_chk";
+ALTER TABLE "pack_installations"
+  VALIDATE CONSTRAINT "pack_installations_manifest_chk";
+ALTER TABLE "pack_installations"
+  VALIDATE CONSTRAINT "pack_installations_actor_chk";
+ALTER TABLE "pack_installations"
+  VALIDATE CONSTRAINT "pack_installations_status_chk";
+
+CREATE INDEX "pack_installations_workspace_rig_idx"
+  ON "pack_installations" ("workspace_id", "selected_rig_id")
+  WHERE "selected_rig_id" IS NOT NULL;
+
+CREATE TABLE "pack_installation_components" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "pack_installation_id" uuid NOT NULL REFERENCES "pack_installations"("id") ON DELETE CASCADE,
+  "component_key" text NOT NULL,
+  "kind" text NOT NULL,
+  "capability_id" text NOT NULL,
+  "resolved_id" text NOT NULL,
+  "digest" text NOT NULL,
+  "metadata" jsonb NOT NULL DEFAULT '{}'::jsonb,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "pack_installation_components_key_chk" CHECK (
+    length("component_key") BETWEEN 1 AND 128
+    AND "component_key" ~ '^[a-z0-9]([a-z0-9._/-]*[a-z0-9])?$'
+  ),
+  CONSTRAINT "pack_installation_components_kind_chk" CHECK (
+    "kind" IN ('plugin', 'skill', 'integration', 'feature', 'inline_skill')
+  ),
+  CONSTRAINT "pack_installation_components_identity_chk" CHECK (
+    length("capability_id") BETWEEN 1 AND 512
+    AND length("resolved_id") BETWEEN 1 AND 512
+    AND "capability_id" !~ '[[:cntrl:]]'
+    AND "resolved_id" !~ '[[:cntrl:]]'
+    AND "digest" ~ '^[0-9a-f]{64}$'
+  ),
+  CONSTRAINT "pack_installation_components_metadata_chk" CHECK (
+    jsonb_typeof("metadata") = 'object'
+    AND octet_length(convert_to("metadata"::text, 'UTF8')) <= 131072
+  ),
+  CONSTRAINT "pack_installation_components_pack_key_uq"
+    UNIQUE ("pack_installation_id", "component_key")
+);
+
+CREATE INDEX "pack_installation_components_workspace_capability_idx"
+  ON "pack_installation_components" ("workspace_id", "kind", "capability_id");
+
+CREATE OR REPLACE FUNCTION pack_v2_validate_installation()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NEW."manifest_snapshot" IS NOT NULL
+    AND NEW."manifest_snapshot" ->> 'id' IS DISTINCT FROM NEW."pack_id"
+  THEN
+    RAISE EXCEPTION 'pack installation snapshot id does not match pack_id'
+      USING ERRCODE = '23514';
+  END IF;
+  IF NEW."selected_rig_id" IS NOT NULL AND NOT EXISTS (
+    SELECT 1 FROM "rigs" r
+    WHERE r."id" = NEW."selected_rig_id"
+      AND r."account_id" = NEW."account_id"
+      AND r."workspace_id" = NEW."workspace_id"
+  ) THEN
+    RAISE EXCEPTION 'pack installation Rig belongs to another tenant'
+      USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER pack_installations_v2_validate
+  BEFORE INSERT OR UPDATE ON "pack_installations"
+  FOR EACH ROW EXECUTE FUNCTION pack_v2_validate_installation();
+
+CREATE OR REPLACE FUNCTION pack_v2_validate_component()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM "pack_installations" i
+    WHERE i."id" = NEW."pack_installation_id"
+      AND i."account_id" = NEW."account_id"
+      AND i."workspace_id" = NEW."workspace_id"
+  ) THEN
+    RAISE EXCEPTION 'Pack component does not match its installation tenant'
+      USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER pack_installation_components_validate
+  BEFORE INSERT OR UPDATE ON "pack_installation_components"
+  FOR EACH ROW EXECUTE FUNCTION pack_v2_validate_component();
+
+-- Harden the polymorphic owner identity added by 0202 now that first-class
+-- Pack installation ids exist. Direct/migration owners remain textual, and
+-- rolling legacy Pack owners remain valid when they are not UUID-shaped.
+CREATE OR REPLACE FUNCTION capability_v2_validate_component_owner()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM "capability_facet_installations" i
+    WHERE i."id" = NEW."facet_installation_id"
+      AND i."account_id" = NEW."account_id"
+      AND i."workspace_id" = NEW."workspace_id"
+  ) THEN
+    RAISE EXCEPTION 'component owner does not match its facet installation tenant'
+      USING ERRCODE = '23514';
+  END IF;
+  IF NEW."owner_kind" = 'plugin' THEN
+    IF NEW."owner_id" !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$' THEN
+      RAISE EXCEPTION 'plugin component owner belongs to another tenant or does not exist'
+        USING ERRCODE = '23514';
+    ELSIF NOT EXISTS (
+        SELECT 1 FROM "capability_plugin_installations" p
+        WHERE p."id" = NEW."owner_id"::uuid
+          AND p."account_id" = NEW."account_id"
+          AND p."workspace_id" = NEW."workspace_id"
+      ) THEN
+      RAISE EXCEPTION 'plugin component owner belongs to another tenant or does not exist'
+        USING ERRCODE = '23514';
+    END IF;
+  ELSIF NEW."owner_kind" = 'pack'
+    AND NEW."owner_id" ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'
+  THEN
+    IF NOT EXISTS (
+      SELECT 1 FROM "pack_installations" p
+      WHERE p."id" = NEW."owner_id"::uuid
+        AND p."account_id" = NEW."account_id"
+        AND p."workspace_id" = NEW."workspace_id"
+    ) THEN
+      RAISE EXCEPTION 'Pack component owner belongs to another tenant or does not exist'
+        USING ERRCODE = '23514';
+    END IF;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION capability_v2_validate_feature_binding_owner()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM "integration_feature_bindings" b
+    WHERE b."id" = NEW."binding_id"
+      AND b."account_id" = NEW."account_id"
+      AND b."workspace_id" = NEW."workspace_id"
+  ) THEN
+    RAISE EXCEPTION 'feature binding owner does not match its binding tenant'
+      USING ERRCODE = '23514';
+  END IF;
+  IF NEW."owner_kind" = 'plugin' THEN
+    IF NEW."owner_id" !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$' THEN
+      RAISE EXCEPTION 'plugin feature binding owner belongs to another tenant or does not exist'
+        USING ERRCODE = '23514';
+    ELSIF NOT EXISTS (
+        SELECT 1 FROM "capability_plugin_installations" p
+        WHERE p."id" = NEW."owner_id"::uuid
+          AND p."account_id" = NEW."account_id"
+          AND p."workspace_id" = NEW."workspace_id"
+      ) THEN
+      RAISE EXCEPTION 'plugin feature binding owner belongs to another tenant or does not exist'
+        USING ERRCODE = '23514';
+    END IF;
+  ELSIF NEW."owner_kind" = 'pack'
+    AND NEW."owner_id" ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'
+  THEN
+    IF NOT EXISTS (
+      SELECT 1 FROM "pack_installations" p
+      WHERE p."id" = NEW."owner_id"::uuid
+        AND p."account_id" = NEW."account_id"
+        AND p."workspace_id" = NEW."workspace_id"
+    ) THEN
+      RAISE EXCEPTION 'Pack feature binding owner belongs to another tenant or does not exist'
+        USING ERRCODE = '23514';
+    END IF;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+ALTER TABLE "pack_installation_components" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "pack_installation_components" FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY workspace_isolation ON "pack_installation_components"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON "pack_installation_components" TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0217_capability_definition_delete_authority.sql

@@ -0,0 +1,32 @@
+-- deployment-mode: rolling
+-- Shared capability and Integration definitions are globally readable catalog
+-- data, not tenant lifecycle rows. Revoke ordinary runtime deletion authority
+-- without narrowing the installation, binding, owner, or operation lifecycle.
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    REVOKE DELETE ON
+      "capability_plugins",
+      "capability_plugin_versions",
+      "capability_facets",
+      "capability_integration_facets",
+      "capability_mcp_facets",
+      "capability_api_facets",
+      "capability_skill_facets",
+      "capability_skill_files",
+      "integration_spec_revisions",
+      "integration_tools",
+      "integration_feature_facets"
+    FROM opengeni_app;
+
+    GRANT SELECT, INSERT, UPDATE, DELETE ON
+      "capability_plugin_installations",
+      "capability_facet_installations",
+      "capability_component_owners",
+      "integration_feature_bindings",
+      "integration_feature_binding_owners",
+      "capability_operations"
+    TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0217_external_browser_auth_operations.sql

@@ -0,0 +1,22 @@
+-- deployment-mode: maintenance
+-- Extend the durable interaction-operation journal with provider-managed
+-- browser authentication. No rows are rewritten and no authority is exposed.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '30s';
+
+ALTER TABLE "interaction_resource_operations"
+  DROP CONSTRAINT "interaction_resource_operations_kind_check";
+
+ALTER TABLE "interaction_resource_operations"
+  ADD CONSTRAINT "interaction_resource_operations_kind_check"
+  CHECK ("kind" IN (
+    'create',
+    'update',
+    'start',
+    'report',
+    'protected_fill',
+    'external_auth',
+    'verify',
+    'resolve',
+    'save'
+  ));