@opengeni/db 0.31.1 → 0.36.0

package/src/pack-components.ts

@@ -17,9 +17,9 @@ import {
 } from "./capability-integrations";
 import { withRlsContext, withWorkspaceRls, type Database } from "./database";
 import {
-  addIntegrationFeatureBindingOwner,
-  removeIntegrationFeatureBindingOwner,
-  removeIntegrationFeatureBindingOwnersForOwner,
+  addIntegrationFacetBindingOwner,
+  removeIntegrationFacetBindingOwner,
+  removeIntegrationFacetBindingOwnersForOwner,
 } from "./integration-bindings";
 import * as schema from "./schema";
 
@@ -224,7 +224,7 @@ export async function adoptPackComponentReferences(
             retainedFacetInstallationIds.push(facetInstallationId);
           }
           for (const bindingId of target.bindingIds) {
-            await addIntegrationFeatureBindingOwner(tx, bindingId, {
+            await addIntegrationFacetBindingOwner(tx, bindingId, {
               accountId: input.accountId,
               workspaceId: input.workspaceId,
               owner: { kind: "pack", id: input.packInstallationId, removable: true },
@@ -402,13 +402,13 @@ export async function finalizePackComponentOwnership(
         }
         const retainedBindings = new Set(input.retainedBindingIds);
         const ownedBindings = await tx
-          .select({ bindingId: schema.integrationFeatureBindingOwners.bindingId })
-          .from(schema.integrationFeatureBindingOwners)
+          .select({ bindingId: schema.integrationFacetBindingOwners.bindingId })
+          .from(schema.integrationFacetBindingOwners)
           .where(
             and(
-              eq(schema.integrationFeatureBindingOwners.workspaceId, input.workspaceId),
-              eq(schema.integrationFeatureBindingOwners.ownerKind, "pack"),
-              eq(schema.integrationFeatureBindingOwners.ownerId, input.packInstallationId),
+              eq(schema.integrationFacetBindingOwners.workspaceId, input.workspaceId),
+              eq(schema.integrationFacetBindingOwners.ownerKind, "pack"),
+              eq(schema.integrationFacetBindingOwners.ownerId, input.packInstallationId),
             ),
           );
         for (const bindingId of [
@@ -418,7 +418,7 @@ export async function finalizePackComponentOwnership(
               .filter((ownedBindingId) => !retainedBindings.has(ownedBindingId)),
           ),
         ]) {
-          await removeIntegrationFeatureBindingOwner(tx, {
+          await removeIntegrationFacetBindingOwner(tx, {
             workspaceId: input.workspaceId,
             bindingId,
             owner: { kind: "pack", id: input.packInstallationId },
@@ -505,18 +505,18 @@ async function previewPackComponentReleaseInRlsContext(
       bindingIds.length === 0
         ? []
         : await scopedDb
-            .select({ id: schema.integrationFeatureBindingOwners.id })
-            .from(schema.integrationFeatureBindingOwners)
+            .select({ id: schema.integrationFacetBindingOwners.id })
+            .from(schema.integrationFacetBindingOwners)
             .where(
               and(
-                inArray(schema.integrationFeatureBindingOwners.bindingId, bindingIds),
+                inArray(schema.integrationFacetBindingOwners.bindingId, bindingIds),
                 effectiveCapabilityOwnerSql(
-                  schema.integrationFeatureBindingOwners.ownerKind,
-                  schema.integrationFeatureBindingOwners.ownerId,
+                  schema.integrationFacetBindingOwners.ownerKind,
+                  schema.integrationFacetBindingOwners.ownerId,
                 ),
                 or(
-                  ne(schema.integrationFeatureBindingOwners.ownerKind, "pack"),
-                  ne(schema.integrationFeatureBindingOwners.ownerId, packInstallationId),
+                  ne(schema.integrationFacetBindingOwners.ownerKind, "pack"),
+                  ne(schema.integrationFacetBindingOwners.ownerId, packInstallationId),
                 ),
               ),
             )
@@ -546,7 +546,7 @@ export async function releasePackComponents(
           input.workspaceId,
           input.packInstallationId,
         );
-        await removeIntegrationFeatureBindingOwnersForOwner(tx, {
+        await removeIntegrationFacetBindingOwnersForOwner(tx, {
           workspaceId: input.workspaceId,
           owner: { kind: "pack", id: input.packInstallationId },
         });
@@ -597,7 +597,7 @@ async function resolvePackComponentTargets(
     } else if (reference.kind === "integration") {
       targets.push(await resolveIntegrationReference(db, workspaceId, reference, integrations));
     } else {
-      targets.push(await resolveFeatureReference(db, workspaceId, reference, integrations));
+      targets.push(await resolveFacetReference(db, workspaceId, reference, integrations));
     }
   }
   return targets;
@@ -655,13 +655,13 @@ async function resolvePluginReference(
     ? []
     : (
         await db
-          .select({ id: schema.integrationFeatureBindingOwners.bindingId })
-          .from(schema.integrationFeatureBindingOwners)
+          .select({ id: schema.integrationFacetBindingOwners.bindingId })
+          .from(schema.integrationFacetBindingOwners)
           .where(
             and(
-              eq(schema.integrationFeatureBindingOwners.workspaceId, workspaceId),
-              eq(schema.integrationFeatureBindingOwners.ownerKind, "plugin"),
-              eq(schema.integrationFeatureBindingOwners.ownerId, row.pluginInstallationId),
+              eq(schema.integrationFacetBindingOwners.workspaceId, workspaceId),
+              eq(schema.integrationFacetBindingOwners.ownerKind, "plugin"),
+              eq(schema.integrationFacetBindingOwners.ownerId, row.pluginInstallationId),
             ),
           )
       ).map((entry) => entry.id);
@@ -781,10 +781,10 @@ async function resolveIntegrationReference(
   };
 }
 
-async function resolveFeatureReference(
+async function resolveFacetReference(
   db: Database,
   workspaceId: string,
-  reference: Extract<CapabilityPackComponentReference, { kind: "feature" }>,
+  reference: Extract<CapabilityPackComponentReference, { kind: "facet" }>,
   integrations: readonly ApiIntegrationRuntime[],
 ): Promise<ResolvedPackComponentTarget> {
   const integration = integrations.find(
@@ -793,7 +793,7 @@ async function resolveFeatureReference(
       candidate.instanceKey === reference.instanceKey,
   );
   if (!integration) {
-    return missingTarget(reference, "feature", reference.capabilityId, reference.configDigest);
+    return missingTarget(reference, "facet", reference.capabilityId, reference.configDigest);
   }
   const [integrationFacetInstallationId] = await integrationFacetInstallationIds(
     db,
@@ -801,29 +801,29 @@ async function resolveFeatureReference(
     "integration",
   );
   if (!integrationFacetInstallationId) {
-    return missingTarget(reference, "feature", reference.capabilityId, reference.configDigest);
+    return missingTarget(reference, "facet", reference.capabilityId, reference.configDigest);
   }
   const [binding] = await db
     .select({
-      id: schema.integrationFeatureBindings.id,
-      config: schema.integrationFeatureBindings.config,
-      status: schema.integrationFeatureBindings.status,
-      displayName: schema.integrationFeatureBindings.displayName,
+      id: schema.integrationFacetBindings.id,
+      config: schema.integrationFacetBindings.config,
+      status: schema.integrationFacetBindings.status,
+      displayName: schema.integrationFacetBindings.displayName,
     })
-    .from(schema.integrationFeatureBindings)
+    .from(schema.integrationFacetBindings)
     .innerJoin(
-      schema.integrationFeatureFacets,
-      eq(schema.integrationFeatureFacets.id, schema.integrationFeatureBindings.featureFacetId),
+      schema.integrationFacetDefinitions,
+      eq(schema.integrationFacetDefinitions.id, schema.integrationFacetBindings.facetDefinitionId),
     )
     .where(
       and(
-        eq(schema.integrationFeatureBindings.workspaceId, workspaceId),
+        eq(schema.integrationFacetBindings.workspaceId, workspaceId),
         eq(
-          schema.integrationFeatureBindings.integrationFacetInstallationId,
+          schema.integrationFacetBindings.integrationFacetInstallationId,
           integrationFacetInstallationId,
         ),
-        eq(schema.integrationFeatureFacets.featureKey, reference.featureKey),
-        eq(schema.integrationFeatureBindings.bindingKey, reference.bindingKey),
+        eq(schema.integrationFacetDefinitions.facetKey, reference.facetKey),
+        eq(schema.integrationFacetBindings.bindingKey, reference.bindingKey),
       ),
     )
     .limit(1);
@@ -835,20 +835,20 @@ async function resolveFeatureReference(
   return {
     resolution: {
       key: reference.key,
-      kind: "feature",
+      kind: "facet",
       capabilityId: reference.capabilityId,
       required: reference.required,
       status: !binding ? "missing" : exact ? "ready" : "mismatch",
       expectedDigest: reference.configDigest,
       actualDigest,
       resolvedId: exact ? binding.id : null,
-      label: binding?.displayName ?? reference.featureKey,
+      label: binding?.displayName ?? reference.facetKey,
     },
     facetInstallationIds: exact ? [integrationFacetInstallationId] : [],
     bindingIds: exact ? [binding.id] : [],
     metadata: {
       instanceKey: reference.instanceKey,
-      featureKey: reference.featureKey,
+      facetKey: reference.facetKey,
       bindingKey: reference.bindingKey,
     },
   };
@@ -926,7 +926,7 @@ function mapStoredPackComponent(
     row.kind !== "plugin" &&
     row.kind !== "skill" &&
     row.kind !== "integration" &&
-    row.kind !== "feature" &&
+    row.kind !== "facet" &&
     row.kind !== "inline_skill"
   ) {
     throw new Error(`Unknown Pack component kind: ${row.kind}`);

package/src/pack-installations.ts

@@ -272,40 +272,6 @@ export async function finalizePackInstallationOperation(
           )
           .returning();
         if (!installation) throw new Error("Pack installation was not found during finalize");
-        await tx
-          .insert(schema.capabilityInstallations)
-          .values({
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            capabilityId: `pack:${input.packId}`,
-            kind: "pack",
-            status: "active",
-            config: {},
-            metadata: {
-              platformVersion: 2,
-              packInstallationId: input.packInstallationId,
-              manifestDigest: installation.manifestDigest,
-            },
-            enabledAt: now,
-            updatedAt: now,
-          })
-          .onConflictDoUpdate({
-            target: [
-              schema.capabilityInstallations.workspaceId,
-              schema.capabilityInstallations.capabilityId,
-            ],
-            set: {
-              status: "active",
-              config: {},
-              metadata: {
-                platformVersion: 2,
-                packInstallationId: input.packInstallationId,
-                manifestDigest: installation.manifestDigest,
-              },
-              enabledAt: now,
-              updatedAt: now,
-            },
-          });
         const [completed] = await tx
           .update(schema.capabilityOperations)
           .set({
@@ -617,15 +583,6 @@ export async function finalizePackUninstallOperation(
               eq(schema.packInstallations.packId, input.packId),
             ),
           );
-        await tx
-          .update(schema.capabilityInstallations)
-          .set({ status: "disabled", updatedAt: now })
-          .where(
-            and(
-              eq(schema.capabilityInstallations.workspaceId, input.workspaceId),
-              eq(schema.capabilityInstallations.capabilityId, `pack:${input.packId}`),
-            ),
-          );
         const [completed] = await tx
           .update(schema.capabilityOperations)
           .set({

package/src/plugin-packages.ts

@@ -10,8 +10,8 @@ import {
 } from "./capability-components";
 import { setSubjectRlsContext, withRlsContext, withWorkspaceRls, type Database } from "./database";
 import {
-  removeIntegrationFeatureBindingOwner,
-  removeIntegrationFeatureBindingOwnersForOwner,
+  removeIntegrationFacetBindingOwner,
+  removeIntegrationFacetBindingOwnersForOwner,
 } from "./integration-bindings";
 import * as schema from "./schema";
 
@@ -489,13 +489,13 @@ export async function finalizePluginPackageInstall(
           );
         }
         const ownedBindings = await tx
-          .select({ bindingId: schema.integrationFeatureBindingOwners.bindingId })
-          .from(schema.integrationFeatureBindingOwners)
+          .select({ bindingId: schema.integrationFacetBindingOwners.bindingId })
+          .from(schema.integrationFacetBindingOwners)
           .where(
             and(
-              eq(schema.integrationFeatureBindingOwners.workspaceId, input.workspaceId),
-              eq(schema.integrationFeatureBindingOwners.ownerKind, "plugin"),
-              eq(schema.integrationFeatureBindingOwners.ownerId, input.pluginInstallationId),
+              eq(schema.integrationFacetBindingOwners.workspaceId, input.workspaceId),
+              eq(schema.integrationFacetBindingOwners.ownerKind, "plugin"),
+              eq(schema.integrationFacetBindingOwners.ownerId, input.pluginInstallationId),
             ),
           );
         const retainedBindings = new Set(input.retainedBindingIds);
@@ -506,7 +506,7 @@ export async function finalizePluginPackageInstall(
               .filter((candidateId) => !retainedBindings.has(candidateId)),
           ),
         ]) {
-          await removeIntegrationFeatureBindingOwner(tx, {
+          await removeIntegrationFacetBindingOwner(tx, {
             workspaceId: input.workspaceId,
             bindingId,
             owner: { kind: "plugin", id: input.pluginInstallationId },
@@ -923,7 +923,7 @@ export async function uninstallPluginPackage(
           input.workspaceId,
           plugin.pluginInstallationId,
         );
-        await removeIntegrationFeatureBindingOwnersForOwner(tx, {
+        await removeIntegrationFacetBindingOwnersForOwner(tx, {
           workspaceId: input.workspaceId,
           owner: { kind: "plugin", id: plugin.pluginInstallationId },
         });

package/src/provision-roles.ts

@@ -613,6 +613,28 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format(
+        '%I.create_task_note_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid,text,text,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.create_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.archive_task_note_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, uuid, uuid, integer, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.list_task_notes_for_attempt(uuid, uuid, uuid, uuid, uuid, integer, boolean, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format(
         '%I.workspace_instruction_policy_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
@@ -691,6 +713,18 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format(
+        '%I.slack_task_policy_update(uuid,text,uuid,uuid,jsonb,uuid,bigint,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.slack_task_policy_update(uuid, text, uuid, uuid, jsonb, uuid, bigint, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format(
         '%I.scoped_knowledge_apply_lifecycle(uuid,text,uuid,text,bigint,text,text,text,text,text,text)',
@@ -723,6 +757,204 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format(
+        '%I.ensure_managed_human_personal_workspace(uuid,text,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.ensure_managed_human_personal_workspace(uuid, text, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.ensure_managed_human_personal_workspace(uuid, text, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(format('%I.ensure_canonical_human_identity(text,text)', ${literal(schema)})) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.ensure_canonical_human_identity(text, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.ensure_canonical_human_identity(text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(format('%I.validate_canonical_human_session(text,text,boolean)', ${literal(schema)})) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.validate_canonical_human_session(text, text, boolean) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.validate_canonical_human_session(text, text, boolean) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(format('%I.get_canonical_human_identity_projection(text)', ${literal(schema)})) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.get_canonical_human_identity_projection(text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.get_canonical_human_identity_projection(text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(format('%I.apply_canonical_human_identity_operation(uuid,text,bigint,text,uuid,text,text,text)', ${literal(schema)})) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.apply_canonical_human_identity_operation(uuid, text, bigint, text, uuid, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    -- Migration 0225 creates these target-schema-local session visibility
+    -- capabilities before opengeni_app may exist. Re-converge their exact
+    -- EXECUTE grants for migrate-then-provision installs without granting
+    -- blanket execution on target-schema routines.
+    IF to_regprocedure(
+      format(
+        '%I.session_private_actor_visible(uuid,uuid,uuid,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.session_private_actor_visible(uuid, uuid, uuid, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.session_private_actor_visible(uuid, uuid, uuid, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.session_reference_visible(uuid,uuid,uuid)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.session_reference_visible(uuid, uuid, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.session_reference_visible(uuid, uuid, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.transition_session_visibility(uuid,uuid,uuid,text,text,integer,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.transition_session_visibility(uuid, uuid, uuid, text, text, integer, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.fork_session_content(uuid,uuid,uuid,text,uuid,text,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.fork_session_content(uuid, uuid, uuid, text, uuid, text, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.create_xai_subscription_credential(uuid,uuid,text,text,text,text,text,text,text,timestamptz)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.create_xai_subscription_credential(uuid, uuid, text, text, text, text, text, text, text, timestamptz) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.create_xai_subscription_credential(uuid, uuid, text, text, text, text, text, text, text, timestamptz) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.disconnect_xai_subscription_credential(uuid, uuid, text, uuid, jsonb) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.disconnect_xai_subscription_credential(uuid, uuid, text, uuid, jsonb) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.resolve_xai_authority_pool(uuid, uuid, text, jsonb) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.resolve_xai_authority_pool(uuid, uuid, text, jsonb) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.revalidate_xai_subscription_authority(uuid, text, uuid, jsonb) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.revalidate_xai_subscription_authority(uuid, text, uuid, jsonb) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.xai_provider_account_authority_snapshot_v1_valid(jsonb) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.xai_provider_account_authority_snapshot_v1_valid(jsonb) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.xai_subscription_authority_live(uuid, uuid, text, uuid, text, uuid, uuid, bigint) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.xai_subscription_authority_live(uuid, uuid, text, uuid, text, uuid, uuid, bigint) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+      EXECUTE format(
+        'REVOKE ALL ON FUNCTION %I.xai_subscription_pool_visible(uuid, uuid, text, text, uuid) FROM PUBLIC',
+        ${literal(schema)}
+      );
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.xai_subscription_pool_visible(uuid, uuid, text, text, uuid) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     IF to_regprocedure(
       format(
         '%I.scoped_knowledge_advance_source_acl(uuid,uuid,bigint,bigint,uuid,text,text,text,text,text,text)',