@opengeni/db 0.7.3 → 0.9.3

package/drizzle/0094_quarantine_credential_bearing_catalog_urls.sql

@@ -0,0 +1,51 @@
+-- deployment-mode: rolling
+-- Catalog endpoints are public data. Remove opaque query/fragment/userinfo/path URLs
+-- imported before the catalog hygiene gate and prevent their continued use.
+DELETE FROM "capability_installations" AS "installation"
+WHERE EXISTS (
+  SELECT 1
+  FROM "capability_catalog_items" AS "registry_item"
+  WHERE
+    "registry_item"."id" = "installation"."capability_id"
+    AND "registry_item"."workspace_id" IS NULL
+    AND "registry_item"."source" = 'registry'
+    AND "registry_item"."metadata" ->> 'registry' = 'integrations.sh'
+    AND (
+      "registry_item"."endpoint_url" LIKE '%?%'
+      OR "registry_item"."endpoint_url" LIKE '%#%'
+      OR "registry_item"."endpoint_url" ~* '^https?://[^/?#]*@'
+      OR "registry_item"."endpoint_url" ~* '^https?://[^/?#]+/(?:[^/?#]*/)*[^/?#]{24,}(?:/|$)'
+      OR "registry_item"."mcp_url" LIKE '%?%'
+      OR "registry_item"."mcp_url" LIKE '%#%'
+      OR "registry_item"."mcp_url" ~* '^https?://[^/?#]*@'
+      OR "registry_item"."mcp_url" ~* '^https?://[^/?#]+/(?:[^/?#]*/)*[^/?#]{24,}(?:/|$)'
+    )
+)
+AND NOT EXISTS (
+  SELECT 1
+  FROM "capability_catalog_items" AS "workspace_item"
+  WHERE
+    "workspace_item"."workspace_id" = "installation"."workspace_id"
+    AND "workspace_item"."id" = "installation"."capability_id"
+);
+
+DELETE FROM "capability_catalog_items"
+WHERE
+  "source" = 'registry'
+  AND "metadata" ->> 'registry' = 'integrations.sh'
+  AND (
+    "endpoint_url" LIKE '%?%'
+    OR "endpoint_url" LIKE '%#%'
+    OR "endpoint_url" ~* '^https?://[^/?#]*@'
+    OR "endpoint_url" ~* '^https?://[^/?#]+/(?:[^/?#]*/)*[^/?#]{24,}(?:/|$)'
+    OR "mcp_url" LIKE '%?%'
+    OR "mcp_url" LIKE '%#%'
+    OR "mcp_url" ~* '^https?://[^/?#]*@'
+    OR "mcp_url" ~* '^https?://[^/?#]+/(?:[^/?#]*/)*[^/?#]{24,}(?:/|$)'
+  );
+
+-- Earlier import diagnostics may contain the same URLs. Counts remain in their
+-- dedicated columns; the unstructured diagnostic payload is not authoritative.
+UPDATE "import_batches"
+SET "details" = '{}'::jsonb, "updated_at" = NOW()
+WHERE "source" = 'integrations.sh';

package/drizzle/0095_github_existing_installations.sql

@@ -0,0 +1,84 @@
+-- deployment-mode: rolling
+
+ALTER TABLE "github_installations"
+  ADD COLUMN IF NOT EXISTS "repository_scope" text NOT NULL DEFAULT 'all';
+ALTER TABLE "github_installations"
+  ADD COLUMN IF NOT EXISTS "linked_by_subject_id" text;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'github_installations_repository_scope_check'
+      AND conrelid = 'github_installations'::regclass
+  ) THEN
+    ALTER TABLE "github_installations"
+      ADD CONSTRAINT "github_installations_repository_scope_check"
+      CHECK ("repository_scope" IN ('all', 'selected'));
+  END IF;
+END $$;
+
+CREATE TABLE IF NOT EXISTS "github_installation_repositories" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "installation_id" integer NOT NULL,
+  "repository_id" bigint NOT NULL,
+  "created_at" timestamptz NOT NULL DEFAULT now()
+);
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'github_installation_repositories_workspace_account_fk'
+      AND conrelid = 'github_installation_repositories'::regclass
+  ) THEN
+    ALTER TABLE "github_installation_repositories"
+      ADD CONSTRAINT "github_installation_repositories_workspace_account_fk"
+      FOREIGN KEY ("workspace_id", "account_id")
+      REFERENCES "workspaces"("id", "account_id") ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'github_installation_repositories_installation_fk'
+      AND conrelid = 'github_installation_repositories'::regclass
+  ) THEN
+    ALTER TABLE "github_installation_repositories"
+      ADD CONSTRAINT "github_installation_repositories_installation_fk"
+      FOREIGN KEY ("workspace_id", "installation_id")
+      REFERENCES "github_installations"("workspace_id", "installation_id") ON DELETE CASCADE;
+  END IF;
+END $$;
+
+CREATE UNIQUE INDEX IF NOT EXISTS "github_install_repo_workspace_installation_repo_idx"
+  ON "github_installation_repositories" ("workspace_id", "installation_id", "repository_id");
+CREATE INDEX IF NOT EXISTS "github_install_repo_workspace_installation_idx"
+  ON "github_installation_repositories" ("workspace_id", "installation_id");
+
+ALTER TABLE "github_installation_repositories" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "github_installation_repositories" FORCE ROW LEVEL SECURITY;
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE schemaname = current_schema()
+      AND tablename = 'github_installation_repositories'
+      AND policyname = 'workspace_isolation'
+  ) THEN
+    DROP POLICY workspace_isolation ON "github_installation_repositories";
+  END IF;
+END $$;
+CREATE POLICY workspace_isolation ON "github_installation_repositories"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO opengeni_app',
+      current_schema()
+    );
+  END IF;
+END $$;

package/drizzle/0096_session_turn_initiators.sql

@@ -0,0 +1,97 @@
+-- deployment-mode: rolling
+-- Existing rows and old rolling-deploy writers receive an explicit service
+-- sentinel. Host credential resolvers must reject that sentinel; it is never
+-- inferred back to a session creator.
+
+ALTER TABLE "sessions"
+  ADD COLUMN IF NOT EXISTS "created_by_kind" text NOT NULL DEFAULT 'service',
+  ADD COLUMN IF NOT EXISTS "created_by_subject_id" text NOT NULL DEFAULT 'unattributed-legacy',
+  ADD COLUMN IF NOT EXISTS "created_by_context" jsonb NOT NULL DEFAULT '{"backfill":true}'::jsonb;
+
+ALTER TABLE "session_turns"
+  ADD COLUMN IF NOT EXISTS "initiator_kind" text NOT NULL DEFAULT 'service',
+  ADD COLUMN IF NOT EXISTS "initiator_subject_id" text NOT NULL DEFAULT 'unattributed-legacy',
+  ADD COLUMN IF NOT EXISTS "initiator_context" jsonb NOT NULL DEFAULT '{"backfill":true}'::jsonb;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'sessions_created_by_kind_check'
+      AND conrelid = 'sessions'::regclass
+  ) THEN
+    ALTER TABLE "sessions"
+      ADD CONSTRAINT "sessions_created_by_kind_check"
+      CHECK ("created_by_kind" IN ('subject', 'service')) NOT VALID;
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'session_turns_initiator_kind_check'
+      AND conrelid = 'session_turns'::regclass
+  ) THEN
+    ALTER TABLE "session_turns"
+      ADD CONSTRAINT "session_turns_initiator_kind_check"
+      CHECK ("initiator_kind" IN ('subject', 'service')) NOT VALID;
+  END IF;
+END $$;
+
+ALTER TABLE "sessions" VALIDATE CONSTRAINT "sessions_created_by_kind_check";
+ALTER TABLE "session_turns" VALIDATE CONSTRAINT "session_turns_initiator_kind_check";
+
+CREATE OR REPLACE FUNCTION opengeni_private.prevent_session_creator_mutation()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NEW.created_by_kind IS DISTINCT FROM OLD.created_by_kind
+    OR NEW.created_by_subject_id IS DISTINCT FROM OLD.created_by_subject_id
+    OR NEW.created_by_context IS DISTINCT FROM OLD.created_by_context
+  THEN
+    RAISE EXCEPTION 'session creator is immutable' USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION opengeni_private.prevent_session_turn_initiator_mutation()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NEW.initiator_kind IS DISTINCT FROM OLD.initiator_kind
+    OR NEW.initiator_subject_id IS DISTINCT FROM OLD.initiator_subject_id
+    OR NEW.initiator_context IS DISTINCT FROM OLD.initiator_context
+  THEN
+    RAISE EXCEPTION 'session turn initiator is immutable' USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_trigger
+    WHERE tgname = 'sessions_creator_immutable'
+      AND tgrelid = 'sessions'::regclass
+      AND NOT tgisinternal
+  ) THEN
+    CREATE TRIGGER sessions_creator_immutable
+      BEFORE UPDATE OF created_by_kind, created_by_subject_id, created_by_context
+      ON "sessions"
+      FOR EACH ROW
+      EXECUTE FUNCTION opengeni_private.prevent_session_creator_mutation();
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_trigger
+    WHERE tgname = 'session_turns_initiator_immutable'
+      AND tgrelid = 'session_turns'::regclass
+      AND NOT tgisinternal
+  ) THEN
+    CREATE TRIGGER session_turns_initiator_immutable
+      BEFORE UPDATE OF initiator_kind, initiator_subject_id, initiator_context
+      ON "session_turns"
+      FOR EACH ROW
+      EXECUTE FUNCTION opengeni_private.prevent_session_turn_initiator_mutation();
+  END IF;
+END $$;