@opengeni/db 1.0.1 → 3.1.0-canary.0

package/dist/slack-routing.d.ts

@@ -0,0 +1,153 @@
+import { type Database } from "./database.js";
+/** The installation binding's own tenancy: credential, identity, and inbox. */
+export type SlackRouteHome = {
+    accountId: string;
+    workspaceId: string;
+};
+/** How a stored route was decided. `picker` is a human answering the Slack card. */
+export type SlackRouteSource = "picker" | "admin";
+export type SlackChannelRoute = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    slackTeamId: string;
+    slackChannelId: string;
+    targetAccountId: string;
+    targetWorkspaceId: string;
+    decidedBySubjectId: string;
+    decidedBySlackUserId: string;
+    source: SlackRouteSource;
+    version: number;
+    createdAt: Date;
+    updatedAt: Date;
+};
+export type SlackUserDmRoute = Omit<SlackChannelRoute, "slackChannelId"> & {
+    slackUserId: string;
+};
+export type UpsertSlackChannelRouteInput = {
+    connectionId: string;
+    slackTeamId: string;
+    slackChannelId: string;
+    targetAccountId: string;
+    targetWorkspaceId: string;
+    decidedBySubjectId: string;
+    decidedBySlackUserId: string;
+    source: SlackRouteSource;
+};
+export type UpsertSlackUserDmRouteInput = Omit<UpsertSlackChannelRouteInput, "slackChannelId"> & {
+    slackUserId: string;
+};
+/** Ids only. Never content, never a subject. */
+export type SlackInteractionTenancy = {
+    accountId: string;
+    workspaceId: string;
+    interactionId: string;
+};
+/** One workspace a Slack-linked subject may start work in. */
+export type SlackRoutableWorkspace = {
+    accountId: string;
+    workspaceId: string;
+    label: string;
+    /** True for the subject's own personal workspace, which has no membership row. */
+    personal: boolean;
+};
+/**
+ * Resolve which tenancy owns the `slack_interactions` row for one exact
+ * connection-scoped route key, through the content-free SECURITY DEFINER probe.
+ *
+ * Thread continuation must cross workspaces: `slack_interactions_route_uq` is
+ * `(connection_id, route_key)` and therefore connection-global, while every
+ * ordinary interaction read is workspace-fenced and would miss a thread whose
+ * interaction lives in a routed workspace.
+ *
+ * This returns IDS ONLY. It cannot widen visibility, because the caller must
+ * re-read the full row under the returned tenancy's own RLS - which is what
+ * `getSlackInteractionById` already does.
+ */
+export declare function probeSlackInteractionTenancy(db: Database, input: {
+    accountId: string;
+    connectionId: string;
+    routeKey: string;
+}): Promise<SlackInteractionTenancy | null>;
+/**
+ * Which workspace owns one Slack action handle.
+ *
+ * A button click arrives on an inbox row that carries the installation's
+ * tenancy and names the handle only by id, while the handle lives in the
+ * workspace that owns its session. Content-free, ids only: the caller must
+ * re-read the full handle under the returned tenancy's own RLS, where every
+ * existing authorization check already lives.
+ */
+export declare function probeSlackActionHandleTenancy(db: Database, input: {
+    accountId: string;
+    connectionId: string;
+    handleId: string;
+}): Promise<SlackRouteHome | null>;
+export declare function getSlackChannelRoute(db: Database, home: SlackRouteHome, input: {
+    connectionId: string;
+    slackChannelId: string;
+}): Promise<SlackChannelRoute | null>;
+export declare function getSlackUserDmRoute(db: Database, home: SlackRouteHome, input: {
+    connectionId: string;
+    slackUserId: string;
+}): Promise<SlackUserDmRoute | null>;
+/**
+ * The ask-once memory for a channel. A repeat write for the same
+ * `(connectionId, slackChannelId)` re-points the channel and bumps `version`;
+ * it never creates a second row, so a channel always has exactly one answer.
+ *
+ * The caller is responsible for having authorized `target*` for the deciding
+ * subject through `resolveSlackTargetAuthority` first - a stored route is
+ * memory, never authority, and every later use re-authorizes it live.
+ */
+export declare function upsertSlackChannelRoute(db: Database, home: SlackRouteHome, input: UpsertSlackChannelRouteInput): Promise<SlackChannelRoute>;
+/** The ask-once memory for one Slack human's direct messages. */
+export declare function upsertSlackUserDmRoute(db: Database, home: SlackRouteHome, input: UpsertSlackUserDmRouteInput): Promise<SlackUserDmRoute>;
+/** Clear a channel's stored answer; the next message asks again. */
+export declare function deleteSlackChannelRoute(db: Database, home: SlackRouteHome, input: {
+    connectionId: string;
+    slackChannelId: string;
+}): Promise<boolean>;
+/** Clear one Slack human's stored DM answer; DMs fall back to the derived personal workspace. */
+export declare function deleteSlackUserDmRoute(db: Database, home: SlackRouteHome, input: {
+    connectionId: string;
+    slackUserId: string;
+}): Promise<boolean>;
+/**
+ * THE workspaces one subject may start Slack work in, within one organization.
+ *
+ * This is deliberately one function so the "workspaces this subject may create
+ * sessions in" question has a single implementation that a future shared
+ * candidate-set contract can replace wholesale, rather than several call sites
+ * each re-deriving it slightly differently.
+ *
+ * Two independent sources, unioned:
+ *
+ * 1. `workspace_memberships` joined to `workspaces` in this account, filtered
+ *    to memberships that actually permit starting work (`sessions:create`, or
+ *    `workspace:admin` which implies it).
+ * 2. The subject's OWN personal workspace, from the active organization
+ *    membership's `personalWorkspaceId` pointer.
+ *
+ * `listWorkspacesForSubject` is NOT usable here: it is a bare membership join
+ * with no permission filter, and it cannot see personal workspaces at all,
+ * because a managed human's personal workspace deliberately has no
+ * `workspace_memberships` row.
+ *
+ * The personal-workspace id is DERIVED from the membership pointer. It is never
+ * accepted from a Slack payload, a route row, or a caller argument.
+ *
+ * Ordered stably by label then workspace id, with plain code-unit comparison so
+ * two hosts with different ICU data cannot render a picker differently.
+ *
+ * ORACLE, NOT AN AUTHORIZATION. This answers "what could this named subject use"
+ * for whatever subject it is handed; it does not establish that the caller IS
+ * that subject. Pass only a subject authenticated out of band - for Slack, one
+ * named by a durable `slack_bot_user_links` row. Never pass a subject taken
+ * from a request payload.
+ */
+export declare function listNamedSubjectSlackRoutableWorkspaces(db: Database, input: {
+    accountId: string;
+    subjectId: string;
+}): Promise<SlackRoutableWorkspace[]>;

package/dist/slack-task-policy-schema.d.ts

@@ -772,6 +772,40 @@ export declare const slackSharedTaskOrigins: import("drizzle-orm/pg-core").PgTab
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        policyAccountId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "policy_account_id";
+            tableName: "slack_shared_task_origins";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        policyWorkspaceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "policy_workspace_id";
+            tableName: "slack_shared_task_origins";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         policyHash: import("drizzle-orm/pg-core").PgColumn<{
             name: "policy_hash";
             tableName: "slack_shared_task_origins";

package/dist/slack-task-policy.d.ts

@@ -11,6 +11,14 @@ export type SlackSharedTaskOrigin = {
     sourceThreadTs: string;
     initiatingSlackUserId: string;
     policyRevisionId: string;
+    /**
+     * Home tenancy of the frozen policy revision. The row's own
+     * `accountId`/`workspaceId` are the routed task's, which is a different
+     * workspace once Slack workspace routing is on. Null on rows written before
+     * routing existed, where the two were always equal.
+     */
+    policyAccountId: string | null;
+    policyWorkspaceId: string | null;
     policyHash: string;
     policyActivationVersion: number;
     publicationMode: "never" | "approval_required" | "allow";

package/dist/slack-user-link-access.d.ts

@@ -52,3 +52,4 @@ export declare function completeSlackUserLinkAccessIfGranted(db: Database, input
     subjectId: string;
 }, now?: Date): Promise<SlackUserLinkAccessRequest | null>;
 export declare function listPendingSlackUserLinkAccessRequests(db: Database, workspaceId: string, now?: Date): Promise<SlackUserLinkAccessRequest[]>;
+export declare function workspaceMembershipPermissionsAllowSlackLink(value: unknown): boolean;