@opengeni/db 0.36.1 → 3.1.0-canary.0

package/src/interaction-placement-loss.ts

@@ -0,0 +1,234 @@
+import { and, eq, inArray, sql } from "drizzle-orm";
+import { type Database, withRlsContext } from "./database";
+import {
+  advanceWorkspaceInteractionRevision,
+  readWorkspaceInteractionRevision,
+} from "./interaction-revisions";
+import * as schema from "./schema";
+
+export const SOURCE_PLACEMENT_CHANGED = "source_placement_changed";
+
+const CONNECTED_PLACEMENT_LIVE_LIFECYCLES = [
+  "starting",
+  "active",
+  "suspending",
+  "restoring",
+  "ending",
+] as const;
+
+export type TerminalizeStaleConnectedInteractionPlacementResult = {
+  sourcePlacementChanged: boolean;
+  changed: boolean;
+  browserSessionIds: string[];
+  computerSessionIds: string[];
+  revision: number;
+};
+
+/**
+ * Reconcile interaction resources after their source task moves away from a
+ * Connected Machine. The source row is the race fence: a stale route lookup
+ * may never retire resources while that machine is still the active placement.
+ * Browser and Desktop resources are settled together because headed browsers
+ * can share one physical controller with a linked Desktop.
+ */
+export async function terminalizeStaleConnectedInteractionPlacement(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    sourceSessionId: string;
+    connectedSandboxId: string;
+  },
+): Promise<TerminalizeStaleConnectedInteractionPlacementResult> {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) =>
+      await scopedDb.transaction(async (tx) => {
+        const [source] = await tx
+          .select({ activeSandboxId: schema.sessions.activeSandboxId })
+          .from(schema.sessions)
+          .where(
+            and(
+              eq(schema.sessions.accountId, input.accountId),
+              eq(schema.sessions.workspaceId, input.workspaceId),
+              eq(schema.sessions.id, input.sourceSessionId),
+            ),
+          )
+          .for("update")
+          .limit(1);
+
+        const sourcePlacementChanged =
+          source !== undefined && source.activeSandboxId !== input.connectedSandboxId;
+        if (!sourcePlacementChanged) {
+          return {
+            sourcePlacementChanged: false,
+            changed: false,
+            browserSessionIds: [],
+            computerSessionIds: [],
+            revision: await readWorkspaceInteractionRevision(tx, input.workspaceId),
+          };
+        }
+
+        const browserRows = await tx
+          .select({ id: schema.browserSessions.id })
+          .from(schema.browserSessions)
+          .innerJoin(
+            schema.browserSessionAssociations,
+            and(
+              eq(schema.browserSessionAssociations.browserSessionId, schema.browserSessions.id),
+              eq(schema.browserSessionAssociations.workspaceId, input.workspaceId),
+              eq(schema.browserSessionAssociations.sessionId, input.sourceSessionId),
+              eq(schema.browserSessionAssociations.relationship, "created"),
+            ),
+          )
+          .where(
+            and(
+              eq(schema.browserSessions.accountId, input.accountId),
+              eq(schema.browserSessions.workspaceId, input.workspaceId),
+              eq(schema.browserSessions.placementKind, "connected_machine"),
+              eq(schema.browserSessions.connectedSandboxId, input.connectedSandboxId),
+              inArray(schema.browserSessions.lifecycle, [...CONNECTED_PLACEMENT_LIVE_LIFECYCLES]),
+            ),
+          );
+        const computerRows = await tx
+          .select({ id: schema.computerSessions.id })
+          .from(schema.computerSessions)
+          .innerJoin(
+            schema.computerSessionAssociations,
+            and(
+              eq(schema.computerSessionAssociations.computerSessionId, schema.computerSessions.id),
+              eq(schema.computerSessionAssociations.workspaceId, input.workspaceId),
+              eq(schema.computerSessionAssociations.sessionId, input.sourceSessionId),
+              eq(schema.computerSessionAssociations.relationship, "created"),
+            ),
+          )
+          .where(
+            and(
+              eq(schema.computerSessions.accountId, input.accountId),
+              eq(schema.computerSessions.workspaceId, input.workspaceId),
+              eq(schema.computerSessions.placementKind, "connected_machine"),
+              eq(schema.computerSessions.connectedSandboxId, input.connectedSandboxId),
+              inArray(schema.computerSessions.lifecycle, [...CONNECTED_PLACEMENT_LIVE_LIFECYCLES]),
+            ),
+          );
+
+        const browserSessionIds = [...new Set(browserRows.map((row) => row.id))].sort();
+        const computerSessionIds = [...new Set(computerRows.map((row) => row.id))].sort();
+        const resourceIds = [...browserSessionIds, ...computerSessionIds];
+        if (resourceIds.length === 0) {
+          return {
+            sourcePlacementChanged: true,
+            changed: false,
+            browserSessionIds,
+            computerSessionIds,
+            revision: await readWorkspaceInteractionRevision(tx, input.workspaceId),
+          };
+        }
+
+        const operationRows = await tx
+          .select({ operationId: schema.interactionOperations.operationId })
+          .from(schema.interactionOperations)
+          .where(
+            and(
+              eq(schema.interactionOperations.accountId, input.accountId),
+              eq(schema.interactionOperations.workspaceId, input.workspaceId),
+              inArray(schema.interactionOperations.resourceId, resourceIds),
+              inArray(schema.interactionOperations.state, ["prepared", "dispatched"]),
+            ),
+          );
+        const operationIds = operationRows.map((row) => row.operationId).sort();
+
+        // Stable lock order matches the attached-device generation-loss path.
+        for (const operationId of operationIds) {
+          await tx.execute(sql`
+            select operation_id from interaction_operations
+            where workspace_id = ${input.workspaceId} and operation_id = ${operationId}
+            for update
+          `);
+        }
+        for (const browserSessionId of browserSessionIds) {
+          await tx.execute(sql`
+            select id from browser_sessions
+            where workspace_id = ${input.workspaceId} and id = ${browserSessionId}
+            for update
+          `);
+        }
+        for (const computerSessionId of computerSessionIds) {
+          await tx.execute(sql`
+            select id from computer_sessions
+            where workspace_id = ${input.workspaceId} and id = ${computerSessionId}
+            for update
+          `);
+        }
+
+        const now = new Date();
+        if (operationIds.length > 0) {
+          await tx
+            .update(schema.interactionOperations)
+            .set({
+              state: "outcome_unknown",
+              errorCode: "outcome_unknown",
+              errorMessage: "The source task moved to another placement",
+              errorRetryable: false,
+              errorDetails: { reason: SOURCE_PLACEMENT_CHANGED },
+              settledAt: now,
+              updatedAt: now,
+            })
+            .where(
+              and(
+                eq(schema.interactionOperations.workspaceId, input.workspaceId),
+                inArray(schema.interactionOperations.operationId, operationIds),
+                inArray(schema.interactionOperations.state, ["prepared", "dispatched"]),
+              ),
+            );
+        }
+        if (browserSessionIds.length > 0) {
+          await tx
+            .update(schema.browserSessions)
+            .set({
+              lifecycle: "lost",
+              failureCode: SOURCE_PLACEMENT_CHANGED,
+              updatedAt: now,
+            })
+            .where(
+              and(
+                eq(schema.browserSessions.workspaceId, input.workspaceId),
+                inArray(schema.browserSessions.id, browserSessionIds),
+                inArray(schema.browserSessions.lifecycle, [...CONNECTED_PLACEMENT_LIVE_LIFECYCLES]),
+              ),
+            );
+        }
+        if (computerSessionIds.length > 0) {
+          await tx
+            .update(schema.computerSessions)
+            .set({
+              lifecycle: "lost",
+              failureCode: SOURCE_PLACEMENT_CHANGED,
+              updatedAt: now,
+            })
+            .where(
+              and(
+                eq(schema.computerSessions.workspaceId, input.workspaceId),
+                inArray(schema.computerSessions.id, computerSessionIds),
+                inArray(schema.computerSessions.lifecycle, [
+                  ...CONNECTED_PLACEMENT_LIVE_LIFECYCLES,
+                ]),
+              ),
+            );
+        }
+        const revision = await advanceWorkspaceInteractionRevision(
+          tx,
+          input.accountId,
+          input.workspaceId,
+        );
+        return {
+          sourcePlacementChanged: true,
+          changed: true,
+          browserSessionIds,
+          computerSessionIds,
+          revision,
+        };
+      }),
+  );
+}

package/src/knowledge-source-sync-schema.ts

@@ -5,6 +5,7 @@ import {
   integer,
   jsonb,
   pgTable,
+  primaryKey,
   text,
   timestamp,
   uniqueIndex,
@@ -173,6 +174,7 @@ export const knowledgeSourceSyncIndexObligations = pgTable(
     objectLifecycleGeneration: bigint("object_lifecycle_generation", { mode: "number" }).notNull(),
     objectVersionGeneration: bigint("object_version_generation", { mode: "number" }).notNull(),
     citationLocator: jsonb("citation_locator").$type<Record<string, unknown>>().notNull(),
+    googleDriveAclEvidenceId: uuid("google_drive_acl_evidence_id"),
     aclEligibility: text("acl_eligibility").notNull().default("pending"),
     status: text("status").notNull().default("pending"),
     failureCode: text("failure_code"),
@@ -190,3 +192,84 @@ export const knowledgeSourceSyncIndexObligations = pgTable(
     ),
   }),
 );
+
+export const googleDriveObjectAclEvidence = pgTable(
+  "google_drive_object_acl_evidence",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    sourceId: uuid("source_id").notNull(),
+    knowledgeSourceObjectId: uuid("knowledge_source_object_id").notNull(),
+    knowledgeDocumentVersionId: uuid("knowledge_document_version_id").notNull(),
+    documentId: uuid("document_id").notNull(),
+    fileId: uuid("file_id").notNull(),
+    indexObligationId: uuid("index_obligation_id").notNull(),
+    connectionId: uuid("connection_id").notNull(),
+    connectionVersion: bigint("connection_version", { mode: "number" }).notNull(),
+    sourcePrincipalHash: text("source_principal_hash").notNull(),
+    sourceSyncGeneration: bigint("source_sync_generation", { mode: "number" }).notNull(),
+    sourceConfigGeneration: bigint("source_config_generation", { mode: "number" }).notNull(),
+    sourceLifecycleGeneration: bigint("source_lifecycle_generation", { mode: "number" }).notNull(),
+    objectLifecycleGeneration: bigint("object_lifecycle_generation", {
+      mode: "number",
+    }).notNull(),
+    objectVersionGeneration: bigint("object_version_generation", { mode: "number" }).notNull(),
+    providerRevision: text("provider_revision"),
+    driveId: text("drive_id"),
+    aclRevision: text("acl_revision").notNull(),
+    aclHash: text("acl_hash").notNull(),
+    eligibility: text("eligibility").notNull(),
+    observedAt: timestamp("observed_at", { withTimezone: true }).notNull(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    citationLocator: jsonb("citation_locator").$type<Record<string, unknown>>().notNull(),
+    operationId: text("operation_id").notNull(),
+    inputHash: text("input_hash").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    obligationOperation: uniqueIndex("google_drive_object_acl_evidence_obligation_uq").on(
+      table.indexObligationId,
+      table.operationId,
+    ),
+    version: index("google_drive_object_acl_evidence_version_idx").on(
+      table.knowledgeDocumentVersionId,
+      table.expiresAt,
+      table.createdAt,
+    ),
+    file: index("google_drive_object_acl_evidence_file_idx").on(
+      table.accountId,
+      table.fileId,
+      table.expiresAt,
+    ),
+  }),
+);
+
+export const googleDriveObjectAclPrincipals = pgTable(
+  "google_drive_object_acl_principals",
+  {
+    evidenceId: uuid("evidence_id").notNull(),
+    ordinal: integer("ordinal").notNull(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    principalType: text("principal_type").notNull(),
+    permissionIdHash: text("permission_id_hash"),
+    emailHash: text("email_hash"),
+    domainHash: text("domain_hash"),
+    role: text("role").notNull(),
+    inherited: boolean("inherited").notNull().default(false),
+    allowFileDiscovery: boolean("allow_file_discovery"),
+    expirationTime: timestamp("expiration_time", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    identity: primaryKey({ columns: [table.evidenceId, table.ordinal] }),
+    match: index("google_drive_object_acl_principals_match_idx").on(
+      table.evidenceId,
+      table.principalType,
+      table.permissionIdHash,
+      table.emailHash,
+      table.domainHash,
+    ),
+  }),
+);