@opengeni/db 0.31.1 → 0.36.1

package/src/slack-task-policy-schema.ts

@@ -0,0 +1,130 @@
+import type { SlackTaskPolicyContent } from "@opengeni/contracts";
+import { sql } from "drizzle-orm";
+import {
+  bigint,
+  check,
+  index,
+  jsonb,
+  pgTable,
+  text,
+  timestamp,
+  uniqueIndex,
+  uuid,
+} from "drizzle-orm/pg-core";
+
+export const slackTaskPolicyRevisions = pgTable(
+  "slack_task_policy_revisions",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    operationId: uuid("operation_id").notNull(),
+    requestFingerprint: text("request_fingerprint").notNull(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    revision: bigint("revision", { mode: "number" })
+      .notNull()
+      .default(sql`nextval('slack_task_policy_revision_seq')`),
+    policy: jsonb("policy").$type<SlackTaskPolicyContent>().notNull(),
+    policyHash: text("policy_hash").notNull(),
+    supersedesRevisionId: uuid("supersedes_revision_id"),
+    createdBySubjectId: text("created_by_subject_id").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceOperation: uniqueIndex("slack_task_policy_revisions_workspace_operation_uq").on(
+      table.workspaceId,
+      table.operationId,
+    ),
+    workspaceRevision: uniqueIndex("slack_task_policy_revisions_workspace_revision_uq").on(
+      table.workspaceId,
+      table.revision,
+    ),
+    workspaceHistory: index("slack_task_policy_revisions_workspace_history_idx").on(
+      table.workspaceId,
+      table.revision,
+    ),
+    receipt: check(
+      "slack_task_policy_revisions_receipt_chk",
+      sql`${table.requestFingerprint} ~ '^[0-9a-f]{64}$' and ${table.policyHash} ~ '^[0-9a-f]{64}$'`,
+    ),
+  }),
+);
+
+export const slackTaskPolicyHeads = pgTable(
+  "slack_task_policy_heads",
+  {
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").primaryKey(),
+    revisionId: uuid("revision_id").notNull(),
+    revision: bigint("revision", { mode: "number" }).notNull(),
+    policyHash: text("policy_hash").notNull(),
+    activationVersion: bigint("activation_version", { mode: "number" }).notNull(),
+    activatedAt: timestamp("activated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    account: index("slack_task_policy_heads_account_idx").on(table.accountId),
+  }),
+);
+
+export const slackTaskPolicyActivationEvents = pgTable(
+  "slack_task_policy_activation_events",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    operationId: uuid("operation_id").notNull(),
+    requestFingerprint: text("request_fingerprint").notNull(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    activationVersion: bigint("activation_version", { mode: "number" }).notNull(),
+    oldRevisionId: uuid("old_revision_id"),
+    oldRevision: bigint("old_revision", { mode: "number" }),
+    oldPolicyHash: text("old_policy_hash"),
+    newRevisionId: uuid("new_revision_id").notNull(),
+    newRevision: bigint("new_revision", { mode: "number" }).notNull(),
+    newPolicyHash: text("new_policy_hash").notNull(),
+    actorSubjectId: text("actor_subject_id").notNull(),
+    reason: text("reason").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceOperation: uniqueIndex("slack_task_policy_events_workspace_operation_uq").on(
+      table.workspaceId,
+      table.operationId,
+    ),
+    workspaceVersion: uniqueIndex("slack_task_policy_events_workspace_version_uq").on(
+      table.workspaceId,
+      table.activationVersion,
+    ),
+    workspaceTimeline: index("slack_task_policy_events_workspace_time_idx").on(
+      table.workspaceId,
+      table.createdAt,
+      table.id,
+    ),
+  }),
+);
+
+export const slackSharedTaskOrigins = pgTable(
+  "slack_shared_task_origins",
+  {
+    interactionId: uuid("interaction_id").primaryKey(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    connectionId: uuid("connection_id").notNull(),
+    sessionId: uuid("session_id").notNull(),
+    slackTeamId: text("slack_team_id").notNull(),
+    sourceChannelId: text("source_channel_id").notNull(),
+    sourceThreadTs: text("source_thread_ts").notNull(),
+    initiatingSlackUserId: text("initiating_slack_user_id").notNull(),
+    policyRevisionId: uuid("policy_revision_id").notNull(),
+    policyHash: text("policy_hash").notNull(),
+    policyActivationVersion: bigint("policy_activation_version", { mode: "number" }).notNull(),
+    publicationMode: text("publication_mode")
+      .$type<"never" | "approval_required" | "allow">()
+      .notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceSession: uniqueIndex("slack_shared_task_origins_workspace_session_uq").on(
+      table.workspaceId,
+      table.sessionId,
+    ),
+  }),
+);

package/src/slack-task-policy.ts

@@ -0,0 +1,341 @@
+import { createHash, randomUUID } from "node:crypto";
+import {
+  SlackTaskPolicyContent,
+  canonicalizeSlackTaskPolicy,
+  type SlackTaskPolicyActivationEvent,
+  type SlackTaskPolicyHead,
+  type SlackTaskPolicyListResponse,
+  type SlackTaskPolicyMutationResponse,
+  type SlackTaskPolicyRevision,
+} from "@opengeni/contracts";
+import { and, desc, eq, sql } from "drizzle-orm";
+import type { Database } from "./database";
+import { rawRows, withRlsContext } from "./database";
+import { nestedPostgresSqlState } from "./persistence-errors";
+import * as schema from "./schema";
+
+type RevisionRow = typeof schema.slackTaskPolicyRevisions.$inferSelect;
+type HeadRow = typeof schema.slackTaskPolicyHeads.$inferSelect;
+type EventRow = typeof schema.slackTaskPolicyActivationEvents.$inferSelect;
+type OriginRow = typeof schema.slackSharedTaskOrigins.$inferSelect;
+
+export type SlackSharedTaskOrigin = {
+  interactionId: string;
+  accountId: string;
+  workspaceId: string;
+  connectionId: string;
+  sessionId: string;
+  slackTeamId: string;
+  sourceChannelId: string;
+  sourceThreadTs: string;
+  initiatingSlackUserId: string;
+  policyRevisionId: string;
+  policyHash: string;
+  policyActivationVersion: number;
+  publicationMode: "never" | "approval_required" | "allow";
+  createdAt: Date;
+};
+
+export class SlackTaskPolicyConflictError extends Error {
+  readonly name = "SlackTaskPolicyConflictError";
+  readonly code = "SLACK_TASK_POLICY_CONFLICT";
+  constructor(readonly currentHead: SlackTaskPolicyHead | null) {
+    super("The active Slack task policy changed in another request");
+  }
+}
+
+export class SlackTaskPolicyOperationReuseError extends Error {
+  readonly name = "SlackTaskPolicyOperationReuseError";
+  readonly code = "SLACK_TASK_POLICY_OPERATION_REUSED";
+  constructor() {
+    super("The Slack task-policy operation id was already used for another request");
+  }
+}
+
+export class SlackTaskPolicyInvalidOperationError extends Error {
+  readonly name = "SlackTaskPolicyInvalidOperationError";
+}
+
+export class SlackTaskPolicyAuthorityError extends Error {
+  readonly name = "SlackTaskPolicyAuthorityError";
+
+  constructor(message = "Slack task-policy administration requires exact workspace authority") {
+    super(message);
+  }
+}
+
+function iso(value: Date | string): string {
+  return (value instanceof Date ? value : new Date(value)).toISOString();
+}
+
+function revisionFromRow(row: RevisionRow): SlackTaskPolicyRevision {
+  return {
+    id: row.id,
+    operationId: row.operationId,
+    accountId: row.accountId,
+    workspaceId: row.workspaceId,
+    revision: row.revision,
+    policy: canonicalizeSlackTaskPolicy(SlackTaskPolicyContent.parse(row.policy)),
+    policyHash: row.policyHash,
+    supersedesRevisionId: row.supersedesRevisionId,
+    createdBySubjectId: row.createdBySubjectId,
+    createdAt: iso(row.createdAt),
+  };
+}
+
+function headFromRow(row: HeadRow): SlackTaskPolicyHead {
+  return {
+    accountId: row.accountId,
+    workspaceId: row.workspaceId,
+    revisionId: row.revisionId,
+    revision: row.revision,
+    policyHash: row.policyHash,
+    activationVersion: row.activationVersion,
+    activatedAt: iso(row.activatedAt),
+  };
+}
+
+function eventFromRow(row: EventRow): SlackTaskPolicyActivationEvent {
+  return {
+    id: row.id,
+    operationId: row.operationId,
+    accountId: row.accountId,
+    workspaceId: row.workspaceId,
+    activationVersion: row.activationVersion,
+    oldRevision:
+      row.oldRevisionId === null
+        ? null
+        : { id: row.oldRevisionId, revision: row.oldRevision!, policyHash: row.oldPolicyHash! },
+    newRevision: {
+      id: row.newRevisionId,
+      revision: row.newRevision,
+      policyHash: row.newPolicyHash,
+    },
+    actorSubjectId: row.actorSubjectId,
+    reason: row.reason,
+    createdAt: iso(row.createdAt),
+  };
+}
+
+async function currentSlackTaskPolicyHead(
+  db: Database,
+  accountId: string,
+  workspaceId: string,
+): Promise<SlackTaskPolicyHead | null> {
+  return (await getActiveSlackTaskPolicy(db, { accountId, workspaceId }))?.head ?? null;
+}
+
+export async function getActiveSlackTaskPolicy(
+  db: Database,
+  input: { accountId: string; workspaceId: string },
+): Promise<{ head: SlackTaskPolicyHead; revision: SlackTaskPolicyRevision } | null> {
+  return await withRlsContext(db, input, async (scopedDb) => {
+    const [row] = await scopedDb
+      .select({
+        head: schema.slackTaskPolicyHeads,
+        revision: schema.slackTaskPolicyRevisions,
+      })
+      .from(schema.slackTaskPolicyHeads)
+      .innerJoin(
+        schema.slackTaskPolicyRevisions,
+        and(
+          eq(schema.slackTaskPolicyRevisions.id, schema.slackTaskPolicyHeads.revisionId),
+          eq(schema.slackTaskPolicyRevisions.workspaceId, schema.slackTaskPolicyHeads.workspaceId),
+        ),
+      )
+      .where(
+        and(
+          eq(schema.slackTaskPolicyHeads.accountId, input.accountId),
+          eq(schema.slackTaskPolicyHeads.workspaceId, input.workspaceId),
+        ),
+      )
+      .limit(1);
+    return row ? { head: headFromRow(row.head), revision: revisionFromRow(row.revision) } : null;
+  });
+}
+
+export async function listSlackTaskPolicy(
+  db: Database,
+  input: { accountId: string; workspaceId: string; limit?: number },
+): Promise<SlackTaskPolicyListResponse> {
+  return await withRlsContext(db, input, async (scopedDb) => {
+    const limit = Math.max(1, Math.min(100, input.limit ?? 50));
+    const [active, revisions, events] = await Promise.all([
+      getActiveSlackTaskPolicy(scopedDb, input),
+      scopedDb
+        .select()
+        .from(schema.slackTaskPolicyRevisions)
+        .where(eq(schema.slackTaskPolicyRevisions.workspaceId, input.workspaceId))
+        .orderBy(desc(schema.slackTaskPolicyRevisions.revision))
+        .limit(limit),
+      scopedDb
+        .select()
+        .from(schema.slackTaskPolicyActivationEvents)
+        .where(eq(schema.slackTaskPolicyActivationEvents.workspaceId, input.workspaceId))
+        .orderBy(desc(schema.slackTaskPolicyActivationEvents.activationVersion))
+        .limit(limit),
+    ]);
+    return {
+      current: active?.head ?? null,
+      activeRevision: active?.revision ?? null,
+      revisions: revisions.map(revisionFromRow),
+      activationEvents: events.map(eventFromRow),
+    };
+  });
+}
+
+export async function updateSlackTaskPolicy(
+  db: Database,
+  input: {
+    operationId?: string;
+    accountId: string;
+    workspaceId: string;
+    policy: SlackTaskPolicyContent;
+    expectedCurrentRevisionId: string | null;
+    expectedActivationVersion: number;
+    actorSubjectId: string;
+    principalKind: "human_session" | undefined;
+    reason: string;
+  },
+): Promise<SlackTaskPolicyMutationResponse> {
+  if (input.principalKind !== "human_session" || input.actorSubjectId.trim().length === 0) {
+    throw new SlackTaskPolicyAuthorityError(
+      "Slack task-policy changes require an exact authenticated human actor",
+    );
+  }
+  const operationId = input.operationId ?? randomUUID();
+  const policy = canonicalizeSlackTaskPolicy(input.policy);
+  const requestFingerprint = createHash("sha256")
+    .update(
+      JSON.stringify([
+        "slack_task_policy_operation",
+        1,
+        input.accountId,
+        input.workspaceId,
+        policy,
+        input.expectedCurrentRevisionId,
+        input.expectedActivationVersion,
+        input.actorSubjectId,
+        input.reason,
+      ]),
+      "utf8",
+    )
+    .digest("hex");
+
+  try {
+    return await withRlsContext(db, input, async (scopedDb) => {
+      await scopedDb.execute(
+        sql`select set_config('opengeni.subject_id', ${input.actorSubjectId}, true)`,
+      );
+      await scopedDb.execute(
+        sql`select set_config('opengeni.principal_kind', 'human_session', true)`,
+      );
+      const [receipt] = await rawRows<{ revisionId: string; eventId: string }>(
+        scopedDb,
+        sql`select revision_id as "revisionId", event_id as "eventId"
+            from slack_task_policy_update(
+              ${operationId}::uuid,
+              ${requestFingerprint},
+              ${input.accountId}::uuid,
+              ${input.workspaceId}::uuid,
+              ${JSON.stringify(policy)}::jsonb,
+              ${input.expectedCurrentRevisionId}::uuid,
+              ${input.expectedActivationVersion}::bigint,
+              ${input.actorSubjectId},
+              ${input.reason}
+            )`,
+      );
+      if (!receipt) throw new Error("Slack task-policy update returned no lifecycle receipt");
+      const [[revision], [head], [event]] = await Promise.all([
+        scopedDb
+          .select()
+          .from(schema.slackTaskPolicyRevisions)
+          .where(eq(schema.slackTaskPolicyRevisions.id, receipt.revisionId))
+          .limit(1),
+        scopedDb
+          .select()
+          .from(schema.slackTaskPolicyHeads)
+          .where(eq(schema.slackTaskPolicyHeads.workspaceId, input.workspaceId))
+          .limit(1),
+        scopedDb
+          .select()
+          .from(schema.slackTaskPolicyActivationEvents)
+          .where(eq(schema.slackTaskPolicyActivationEvents.id, receipt.eventId))
+          .limit(1),
+      ]);
+      if (!revision || !head || !event) {
+        throw new Error("Slack task-policy lifecycle receipt was incomplete");
+      }
+      return {
+        revision: revisionFromRow(revision),
+        head: headFromRow(head),
+        event: eventFromRow(event),
+      };
+    });
+  } catch (error) {
+    const state = nestedPostgresSqlState(error);
+    if (state === "P1471") throw new SlackTaskPolicyOperationReuseError();
+    if (state === "40001") {
+      throw new SlackTaskPolicyConflictError(
+        await currentSlackTaskPolicyHead(db, input.accountId, input.workspaceId),
+      );
+    }
+    if (state === "42501") {
+      throw new SlackTaskPolicyAuthorityError(error instanceof Error ? error.message : undefined);
+    }
+    if (state === "22023") throw new SlackTaskPolicyInvalidOperationError();
+    throw error;
+  }
+}
+
+function originFromRow(row: OriginRow): SlackSharedTaskOrigin {
+  return { ...row };
+}
+
+export async function saveSlackSharedTaskOrigin(
+  db: Database,
+  input: Omit<SlackSharedTaskOrigin, "createdAt">,
+): Promise<SlackSharedTaskOrigin> {
+  return await withRlsContext(db, input, async (scopedDb) => {
+    const [created] = await scopedDb
+      .insert(schema.slackSharedTaskOrigins)
+      .values(input)
+      .onConflictDoNothing({ target: schema.slackSharedTaskOrigins.interactionId })
+      .returning();
+    if (created) return originFromRow(created);
+    const [existing] = await scopedDb
+      .select()
+      .from(schema.slackSharedTaskOrigins)
+      .where(eq(schema.slackSharedTaskOrigins.interactionId, input.interactionId))
+      .limit(1);
+    if (!existing) throw new Error("Slack shared-task origin conflict could not be resolved");
+    for (const [key, value] of Object.entries(input)) {
+      if (existing[key as keyof OriginRow] !== value) {
+        throw new SlackTaskPolicyInvalidOperationError(
+          "Slack shared-task origin identity conflicted with immutable evidence",
+        );
+      }
+    }
+    return originFromRow(existing);
+  });
+}
+
+export async function getSlackSharedTaskOrigin(
+  db: Database,
+  input: { accountId: string; workspaceId: string; interactionId: string },
+): Promise<SlackSharedTaskOrigin | null> {
+  return await withRlsContext(db, input, async (scopedDb) => {
+    const [row] = await scopedDb
+      .select()
+      .from(schema.slackSharedTaskOrigins)
+      .where(
+        and(
+          eq(schema.slackSharedTaskOrigins.accountId, input.accountId),
+          eq(schema.slackSharedTaskOrigins.workspaceId, input.workspaceId),
+          eq(schema.slackSharedTaskOrigins.interactionId, input.interactionId),
+        ),
+      )
+      .limit(1);
+    return row ? originFromRow(row) : null;
+  });
+}

package/src/task-notes-schema.ts

@@ -0,0 +1,135 @@
+import {
+  customType,
+  index,
+  integer,
+  pgTable,
+  text,
+  timestamp,
+  uniqueIndex,
+  uuid,
+} from "drizzle-orm/pg-core";
+import { sql } from "drizzle-orm";
+
+const xid8 = customType<{ data: string; driverData: string }>({
+  dataType: () => "xid8",
+});
+
+// Cross-row validation, lifecycle-only mutation, exact-attempt authority,
+// restrictive session-visibility RLS, and grants are owned by migration 0239.
+export const taskNotes = pgTable(
+  "task_notes",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    rootSessionId: uuid("root_session_id").notNull(),
+    kind: text("kind").notNull(),
+    text: text("text").notNull(),
+    textHash: text("text_hash").notNull(),
+    status: text("status").notNull().default("active"),
+    version: integer("version").notNull().default(1),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    createOperationId: uuid("create_operation_id").notNull(),
+    createInputHash: text("create_input_hash").notNull(),
+    createdByActorKind: text("created_by_actor_kind").notNull(),
+    createdByActorSubjectId: text("created_by_actor_subject_id").notNull(),
+    createdByInitiatingHumanSubjectId: text("created_by_initiating_human_subject_id"),
+    createdBySessionId: uuid("created_by_session_id").notNull(),
+    createdByTurnId: uuid("created_by_turn_id").notNull(),
+    createdByAttemptId: uuid("created_by_attempt_id").notNull(),
+    createdByExecutionGeneration: integer("created_by_execution_generation").notNull(),
+    archiveOperationId: uuid("archive_operation_id"),
+    archiveInputHash: text("archive_input_hash"),
+    archivedByActorKind: text("archived_by_actor_kind"),
+    archivedByActorSubjectId: text("archived_by_actor_subject_id"),
+    archivedByInitiatingHumanSubjectId: text("archived_by_initiating_human_subject_id"),
+    archivedBySessionId: uuid("archived_by_session_id"),
+    archivedByTurnId: uuid("archived_by_turn_id"),
+    archivedByAttemptId: uuid("archived_by_attempt_id"),
+    archivedByExecutionGeneration: integer("archived_by_execution_generation"),
+    archivedAt: timestamp("archived_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceIdentity: uniqueIndex("task_notes_workspace_id_uq").on(table.workspaceId, table.id),
+    workspaceRootIdentity: uniqueIndex("task_notes_workspace_root_id_uq").on(
+      table.workspaceId,
+      table.rootSessionId,
+      table.id,
+    ),
+    createOperation: uniqueIndex("task_notes_workspace_create_operation_uq").on(
+      table.workspaceId,
+      table.createOperationId,
+    ),
+    archiveOperation: uniqueIndex("task_notes_workspace_archive_operation_uq")
+      .on(table.workspaceId, table.archiveOperationId)
+      .where(sql`${table.archiveOperationId} is not null`),
+    rootActive: index("task_notes_root_active_idx").on(
+      table.workspaceId,
+      table.rootSessionId,
+      table.status,
+      table.expiresAt,
+      table.updatedAt,
+      table.id,
+    ),
+  }),
+);
+
+export const taskNoteEvents = pgTable(
+  "task_note_events",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    rootSessionId: uuid("root_session_id").notNull(),
+    noteId: uuid("note_id").notNull(),
+    eventType: text("event_type").notNull(),
+    noteVersion: integer("note_version").notNull(),
+    operationId: uuid("operation_id").notNull(),
+    inputHash: text("input_hash").notNull(),
+    textHash: text("text_hash").notNull(),
+    reason: text("reason"),
+    actorKind: text("actor_kind").notNull(),
+    actorSubjectId: text("actor_subject_id").notNull(),
+    initiatingHumanSubjectId: text("initiating_human_subject_id"),
+    actorSessionId: uuid("actor_session_id").notNull(),
+    actorTurnId: uuid("actor_turn_id").notNull(),
+    actorAttemptId: uuid("actor_attempt_id").notNull(),
+    actorExecutionGeneration: integer("actor_execution_generation").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    operation: uniqueIndex("task_note_events_workspace_operation_uq").on(
+      table.workspaceId,
+      table.operationId,
+    ),
+    noteVersion: uniqueIndex("task_note_events_note_version_uq").on(
+      table.workspaceId,
+      table.noteId,
+      table.noteVersion,
+    ),
+    rootTimeline: index("task_note_events_root_timeline_idx").on(
+      table.workspaceId,
+      table.rootSessionId,
+      table.createdAt,
+      table.id,
+    ),
+  }),
+);
+
+export const taskNoteWriteCapabilities = pgTable(
+  "task_note_write_capabilities",
+  {
+    backendPid: integer("backend_pid").notNull(),
+    transactionId: xid8("transaction_id").notNull(),
+    capabilityId: uuid("capability_id").notNull(),
+  },
+  (table) => ({
+    identity: uniqueIndex("task_note_write_capabilities_identity_uq").on(
+      table.backendPid,
+      table.transactionId,
+      table.capabilityId,
+    ),
+  }),
+);