@opengeni/db 0.31.1 → 0.36.1

package/drizzle/0236_browser_identity_lifecycle.sql

@@ -0,0 +1,39 @@
+-- deployment-mode: maintenance
+-- Complete the saved-browser lifecycle with optimistic metadata updates and
+-- replay-safe mutation receipts. Immutable revisions remain untouched.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '30s';
+
+ALTER TABLE "browser_identities"
+  ADD COLUMN "version" bigint NOT NULL DEFAULT 1;
+
+ALTER TABLE "browser_identities"
+  DROP CONSTRAINT "browser_identities_values_check";
+
+ALTER TABLE "browser_identities"
+  ADD CONSTRAINT "browser_identities_values_check" CHECK (
+    octet_length("name") BETWEEN 1 AND 200
+    AND "name" = btrim("name")
+    AND octet_length("created_by_subject_id") BETWEEN 1 AND 1024
+    AND "version" > 0
+    AND "head_generation" >= 0
+    AND "revision_count" >= 0
+    AND (
+      ("head_generation" = 0 AND "default_revision_id" IS NULL)
+      OR ("head_generation" > 0 AND "default_revision_id" IS NOT NULL)
+    )
+  );
+
+ALTER TABLE "interaction_resource_operations"
+  DROP CONSTRAINT "interaction_resource_operations_resource_kind_check";
+
+ALTER TABLE "interaction_resource_operations"
+  ADD CONSTRAINT "interaction_resource_operations_resource_kind_check"
+  CHECK ("resource_kind" IN (
+    'browser_identity',
+    'network_route',
+    'site_auth_connection',
+    'auth_run',
+    'intervention',
+    'browser_download'
+  ));

package/drizzle/0236_session_visibility_slack_policy.sql

@@ -0,0 +1,72 @@
+-- deployment-mode: rolling
+-- Forward-repair direct session references introduced after migration 0225.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+DO $session_visibility_slack_task_repair$
+DECLARE
+  data_schema text := current_schema();
+  target_table text;
+  policy_expression text;
+BEGIN
+  IF pg_catalog.to_regprocedure(
+    pg_catalog.format('%I.session_private_actor_visible(uuid,uuid,uuid,text)', data_schema)
+  ) IS NULL OR pg_catalog.to_regprocedure(
+    pg_catalog.format('%I.session_reference_visible(uuid,uuid,uuid)', data_schema)
+  ) IS NULL THEN
+    RAISE EXCEPTION 'session visibility helper chain is missing'
+      USING ERRCODE = '42883';
+  END IF;
+
+  EXECUTE pg_catalog.format(
+    'REVOKE ALL ON FUNCTION %I.session_private_actor_visible(uuid,uuid,uuid,text) FROM PUBLIC',
+    data_schema
+  );
+  EXECUTE pg_catalog.format(
+    'REVOKE ALL ON FUNCTION %I.session_reference_visible(uuid,uuid,uuid) FROM PUBLIC',
+    data_schema
+  );
+  IF EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE pg_catalog.format(
+      'GRANT EXECUTE ON FUNCTION %I.session_private_actor_visible(uuid,uuid,uuid,text) TO opengeni_app',
+      data_schema
+    );
+    EXECUTE pg_catalog.format(
+      'GRANT EXECUTE ON FUNCTION %I.session_reference_visible(uuid,uuid,uuid) TO opengeni_app',
+      data_schema
+    );
+  END IF;
+
+  FOREACH target_table IN ARRAY ARRAY[
+    'slack_interaction_action_handles',
+    'slack_shared_task_origins',
+    'xai_capacity_waiters',
+    'xai_session_account_pins'
+  ]
+  LOOP
+    IF pg_catalog.to_regclass(pg_catalog.format('%I.%I', data_schema, target_table)) IS NULL THEN
+      RAISE EXCEPTION 'session visibility repair table is missing: %', target_table
+        USING ERRCODE = '42P01';
+    END IF;
+
+    policy_expression := pg_catalog.format(
+      '%I.session_reference_visible(account_id, workspace_id, session_id)',
+      data_schema
+    );
+    EXECUTE pg_catalog.format(
+      'DROP POLICY IF EXISTS session_visibility_isolation ON %I.%I',
+      data_schema,
+      target_table
+    );
+    EXECUTE pg_catalog.format(
+      'CREATE POLICY session_visibility_isolation ON %I.%I AS RESTRICTIVE '
+        || 'FOR ALL USING (%s) WITH CHECK (%s)',
+      data_schema,
+      target_table,
+      policy_expression,
+      policy_expression
+    );
+  END LOOP;
+END
+$session_visibility_slack_task_repair$;

package/drizzle/0237_interaction_transition_reaper.sql

@@ -0,0 +1,263 @@
+-- deployment-mode: maintenance
+-- Settle controller transitions whose API owner disappeared after dispatch.
+-- Active Browser/Computer sessions are deliberately excluded: their durable
+-- placement must survive a hidden UI, a closed laptop, and long human login.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '30s';
+
+DO $transition_reaper$
+DECLARE data_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.reap_stale_interaction_transitions(
+      p_interaction_holder_ttl_ms bigint
+    )
+    RETURNS integer
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE
+      stale_operation_ids uuid[] := ARRAY[]::uuid[];
+      stale_browser_ids uuid[] := ARRAY[]::uuid[];
+      stale_computer_ids uuid[] := ARRAY[]::uuid[];
+      changed_workspace_ids uuid[] := ARRAY[]::uuid[];
+      orphan_workspace_ids uuid[] := ARRAY[]::uuid[];
+      affected_lease_ids uuid[] := ARRAY[]::uuid[];
+      settled_count integer := 0;
+    BEGIN
+      IF p_interaction_holder_ttl_ms <= 0 THEN
+        RETURN 0;
+      END IF;
+
+      -- The exact lifecycle operation is the request-owner heartbeat. Long
+      -- controller calls pulse updated_at; a stale dispatched operation means
+      -- the caller vanished. Prepared operations cannot have a physical side
+      -- effect yet and remain replayable, so they are intentionally excluded.
+      SELECT coalesce(pg_catalog.array_agg(candidate.operation_id), ARRAY[]::uuid[])
+      INTO stale_operation_ids
+      FROM (
+        SELECT operation.operation_id
+        FROM %1$I.interaction_operations operation
+        WHERE operation.state = 'dispatched'
+          AND operation.updated_at
+            < pg_catalog.now()
+              - pg_catalog.make_interval(
+                  secs => p_interaction_holder_ttl_ms / 1000.0
+                )
+          AND (
+            EXISTS (
+              SELECT 1
+              FROM %1$I.browser_sessions browser
+              WHERE operation.resource_kind = 'browser_session'
+                AND operation.account_id = browser.account_id
+                AND operation.workspace_id = browser.workspace_id
+                AND operation.resource_id = browser.id
+                AND browser.lifecycle IN (
+                  'starting', 'suspending', 'restoring', 'ending'
+                )
+            )
+            OR EXISTS (
+              SELECT 1
+              FROM %1$I.computer_sessions computer
+              WHERE operation.resource_kind = 'computer_session'
+                AND operation.account_id = computer.account_id
+                AND operation.workspace_id = computer.workspace_id
+                AND operation.resource_id = computer.id
+                AND computer.lifecycle IN ('starting', 'ending')
+            )
+          )
+        ORDER BY operation.updated_at, operation.operation_id
+        LIMIT 500
+        FOR UPDATE OF operation SKIP LOCKED
+      ) candidate;
+
+      SELECT coalesce(
+               pg_catalog.array_agg(operation.resource_id)
+                 FILTER (WHERE operation.resource_kind = 'browser_session'),
+               ARRAY[]::uuid[]
+             ),
+             coalesce(
+               pg_catalog.array_agg(operation.resource_id)
+                 FILTER (WHERE operation.resource_kind = 'computer_session'),
+               ARRAY[]::uuid[]
+             ),
+             coalesce(
+               pg_catalog.array_agg(DISTINCT operation.workspace_id),
+               ARRAY[]::uuid[]
+             )
+      INTO stale_browser_ids, stale_computer_ids, changed_workspace_ids
+      FROM %1$I.interaction_operations operation
+      WHERE operation.operation_id = ANY(stale_operation_ids);
+
+      -- Lock every affected lease before its holder, matching lease acquire,
+      -- release and the ordinary global reaper. Connected-machine transitions
+      -- have no lease and still settle through the same operation contract.
+      SELECT coalesce(pg_catalog.array_agg(DISTINCT holder.lease_id), ARRAY[]::uuid[])
+      INTO affected_lease_ids
+      FROM %1$I.sandbox_lease_holders holder
+      WHERE holder.kind = 'interaction'
+        AND (
+          holder.holder_id IN (
+            SELECT 'browser-session:' || id::text
+            FROM pg_catalog.unnest(stale_browser_ids) ids(id)
+          )
+          OR holder.holder_id IN (
+            SELECT 'computer-session:' || id::text
+            FROM pg_catalog.unnest(stale_computer_ids) ids(id)
+          )
+        );
+
+      PERFORM lease.id
+      FROM %1$I.sandbox_leases lease
+      WHERE lease.id = ANY(affected_lease_ids)
+      ORDER BY lease.id
+      FOR UPDATE OF lease;
+
+      PERFORM holder.id
+      FROM %1$I.sandbox_lease_holders holder
+      WHERE holder.lease_id = ANY(affected_lease_ids)
+        AND holder.kind = 'interaction'
+        AND (
+          holder.holder_id IN (
+            SELECT 'browser-session:' || id::text
+            FROM pg_catalog.unnest(stale_browser_ids) ids(id)
+          )
+          OR holder.holder_id IN (
+            SELECT 'computer-session:' || id::text
+            FROM pg_catalog.unnest(stale_computer_ids) ids(id)
+          )
+        )
+      ORDER BY holder.id
+      FOR UPDATE OF holder;
+
+      UPDATE %1$I.interaction_operations operation
+      SET state = 'outcome_unknown',
+          error_code = 'controller_transition_expired',
+          error_message = 'Interaction controller transition heartbeat expired',
+          error_retryable = false,
+          error_details = pg_catalog.jsonb_build_object(
+            'reason', 'transition_heartbeat_expired'
+          ),
+          settled_at = pg_catalog.now(),
+          updated_at = pg_catalog.now()
+      WHERE operation.operation_id = ANY(stale_operation_ids)
+        AND operation.state = 'dispatched';
+      GET DIAGNOSTICS settled_count = ROW_COUNT;
+
+      -- Outcome is unknown: retain the exact controller binding so a subsequent
+      -- end/cleanup can target the same generation. The lease holder is released
+      -- below; provider drain remains the final physical cleanup fence.
+      UPDATE %1$I.browser_sessions browser
+      SET lifecycle = 'lost',
+          failure_code = 'controller_transition_expired',
+          updated_at = pg_catalog.now()
+      WHERE browser.id = ANY(stale_browser_ids)
+        AND browser.lifecycle IN (
+          'starting', 'suspending', 'restoring', 'ending'
+        );
+
+      UPDATE %1$I.computer_sessions computer
+      SET lifecycle = 'lost',
+          failure_code = 'controller_transition_expired',
+          updated_at = pg_catalog.now()
+      WHERE computer.id = ANY(stale_computer_ids)
+        AND computer.lifecycle IN ('starting', 'ending');
+
+      -- Terminal/mismatched interaction holders are lifecycle orphans. Include
+      -- the transitions settled above plus missed best-effort releases after a
+      -- successful suspend/end/failure. Active controllers remain immortal.
+      SELECT coalesce(pg_catalog.array_agg(DISTINCT holder.lease_id), ARRAY[]::uuid[]),
+             coalesce(pg_catalog.array_agg(DISTINCT holder.workspace_id), ARRAY[]::uuid[])
+      INTO affected_lease_ids, orphan_workspace_ids
+      FROM %1$I.sandbox_lease_holders holder
+      JOIN %1$I.sandbox_leases lease ON lease.id = holder.lease_id
+      WHERE holder.kind = 'interaction'
+        AND NOT (
+          EXISTS (
+            SELECT 1
+            FROM %1$I.browser_sessions browser
+            WHERE holder.holder_id = ('browser-session:' || browser.id::text)
+              AND holder.account_id = browser.account_id
+              AND holder.workspace_id = browser.workspace_id
+              AND browser.controller_host_sandbox_group_id = lease.sandbox_group_id
+              AND browser.lifecycle IN (
+                'starting', 'active', 'suspending', 'restoring', 'ending'
+              )
+          )
+          OR EXISTS (
+            SELECT 1
+            FROM %1$I.computer_sessions computer
+            WHERE holder.holder_id = ('computer-session:' || computer.id::text)
+              AND holder.account_id = computer.account_id
+              AND holder.workspace_id = computer.workspace_id
+              AND computer.sandbox_group_id = lease.sandbox_group_id
+              AND computer.lifecycle IN (
+                'starting', 'active', 'suspending', 'restoring', 'ending'
+              )
+          )
+        );
+
+      PERFORM lease.id
+      FROM %1$I.sandbox_leases lease
+      WHERE lease.id = ANY(affected_lease_ids)
+      ORDER BY lease.id
+      FOR UPDATE OF lease;
+
+      DELETE FROM %1$I.sandbox_lease_holders holder
+      USING %1$I.sandbox_leases lease
+      WHERE holder.lease_id = lease.id
+        AND holder.lease_id = ANY(affected_lease_ids)
+        AND holder.kind = 'interaction'
+        AND NOT (
+          EXISTS (
+            SELECT 1
+            FROM %1$I.browser_sessions browser
+            WHERE holder.holder_id = ('browser-session:' || browser.id::text)
+              AND holder.account_id = browser.account_id
+              AND holder.workspace_id = browser.workspace_id
+              AND browser.controller_host_sandbox_group_id = lease.sandbox_group_id
+              AND browser.lifecycle IN (
+                'starting', 'active', 'suspending', 'restoring', 'ending'
+              )
+          )
+          OR EXISTS (
+            SELECT 1
+            FROM %1$I.computer_sessions computer
+            WHERE holder.holder_id = ('computer-session:' || computer.id::text)
+              AND holder.account_id = computer.account_id
+              AND holder.workspace_id = computer.workspace_id
+              AND computer.sandbox_group_id = lease.sandbox_group_id
+              AND computer.lifecycle IN (
+                'starting', 'active', 'suspending', 'restoring', 'ending'
+              )
+          )
+        );
+
+      UPDATE %1$I.workspace_interaction_revisions revision
+      SET revision = revision.revision + 1,
+          updated_at = pg_catalog.now()
+      WHERE revision.workspace_id = ANY(changed_workspace_ids || orphan_workspace_ids);
+
+      RETURN settled_count;
+    END;
+    $function$;
+  $create$, data_schema);
+END
+$transition_reaper$;
+
+REVOKE ALL ON FUNCTION opengeni_private.reap_stale_interaction_transitions(bigint)
+  FROM PUBLIC;
+
+DO $reaper_grant$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION
+      opengeni_private.reap_stale_interaction_transitions(bigint)
+      TO opengeni_app;
+  END IF;
+END
+$reaper_grant$;
+
+RESET statement_timeout;
+RESET lock_timeout;