@opengeni/db 1.0.1 → 3.1.0-canary.0

package/drizzle/0341_slack_routing_probe_organization_fence.sql

@@ -0,0 +1,109 @@
+-- deployment-mode: rolling
+-- Fence both Slack routing tenancy probes on the organization the caller is
+-- acting for.
+--
+-- Neither probe carried an account predicate. Both are SECURITY DEFINER and
+-- both return tenancy ids, so a caller holding another organization's
+-- connection UUID plus a route key or a handle id learned that organization's
+-- account, workspace and interaction ids. Exploitability is low today, because
+-- connection ids are never caller-supplied and the Slack signature check
+-- already fences the team, but the predicate is one line and every sibling
+-- authority routine carries it.
+--
+-- Rolling by expand-and-contract: the fenced three-argument routines are added
+-- alongside the existing two-argument ones rather than replacing them, so an
+-- old image keeps resolving thread continuation and button clicks through the
+-- signature it knows. A later migration drops the unfenced pair once the fleet
+-- is on an image that calls the fenced one; dropping them here would break
+-- every running old worker the moment this commits.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+DO $slack_fenced_interaction_probe$
+DECLARE data_schema text := current_schema();
+BEGIN
+  EXECUTE format($ddl$
+    CREATE FUNCTION opengeni_private.resolve_slack_interaction_tenancy(
+      p_account_id uuid,
+      p_connection_id uuid,
+      p_route_key text
+    )
+    RETURNS TABLE (account_id uuid, workspace_id uuid, interaction_id uuid)
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = %1$I, pg_catalog
+    AS $body$
+    BEGIN
+      IF p_account_id IS NULL OR p_connection_id IS NULL OR p_route_key IS NULL THEN
+        RETURN;
+      END IF;
+      INSERT INTO opengeni_private.slack_routing_runtime_capabilities (
+        backend_pid, transaction_id, capability_kind
+      ) VALUES (
+        pg_catalog.pg_backend_pid(), pg_catalog.pg_current_xact_id(), 'interaction_tenancy'
+      ) ON CONFLICT DO NOTHING;
+      BEGIN
+        RETURN QUERY
+          SELECT I.account_id, I.workspace_id, I.id
+          FROM slack_interactions I
+          WHERE I.account_id = p_account_id
+            AND I.connection_id = p_connection_id
+            AND I.route_key = p_route_key
+          LIMIT 1;
+        DELETE FROM opengeni_private.slack_routing_runtime_capabilities
+        WHERE backend_pid = pg_catalog.pg_backend_pid()
+          AND transaction_id = pg_catalog.pg_current_xact_id_if_assigned()
+          AND capability_kind = 'interaction_tenancy';
+        RETURN;
+      EXCEPTION WHEN OTHERS THEN
+        DELETE FROM opengeni_private.slack_routing_runtime_capabilities
+        WHERE backend_pid = pg_catalog.pg_backend_pid()
+          AND transaction_id = pg_catalog.pg_current_xact_id_if_assigned()
+          AND capability_kind = 'interaction_tenancy';
+        RAISE;
+      END;
+    END;
+    $body$
+  $ddl$, data_schema);
+END
+$slack_fenced_interaction_probe$;
+
+REVOKE ALL ON FUNCTION opengeni_private.resolve_slack_interaction_tenancy(uuid, uuid, text)
+  FROM PUBLIC;
+
+CREATE FUNCTION opengeni_private.resolve_slack_action_handle_tenancy(
+  p_account_id uuid,
+  p_connection_id uuid,
+  p_handle_id uuid
+)
+RETURNS TABLE (account_id uuid, workspace_id uuid)
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = opengeni_private, pg_catalog
+AS $$
+  SELECT T.account_id, T.workspace_id
+  FROM slack_action_handle_tenancy T
+  WHERE T.account_id = p_account_id
+    AND T.handle_id = p_handle_id
+    AND T.connection_id = p_connection_id
+  LIMIT 1
+$$;
+
+REVOKE ALL ON FUNCTION
+  opengeni_private.resolve_slack_action_handle_tenancy(uuid, uuid, uuid) FROM PUBLIC;
+
+DO $grants$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION
+      opengeni_private.resolve_slack_interaction_tenancy(uuid, uuid, text) TO opengeni_app;
+    GRANT EXECUTE ON FUNCTION
+      opengeni_private.resolve_slack_action_handle_tenancy(uuid, uuid, uuid) TO opengeni_app;
+  END IF;
+END
+$grants$;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "1.0.1",
+  "version": "3.1.0-canary.0",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -54,6 +54,10 @@
     "./session-tenancy": {
       "types": "./dist/session-tenancy.d.ts",
       "import": "./dist/session-tenancy.js"
+    },
+    "./session-background-commands": {
+      "types": "./dist/session-background-commands.d.ts",
+      "import": "./dist/session-background-commands.js"
     }
   },
   "publishConfig": {
@@ -70,11 +74,11 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "^0.4.4",
-    "@opengeni/codex": "^0.2.17",
-    "@opengeni/config": "^0.16.4",
-    "@opengeni/contracts": "^1.0.1",
-    "@opengeni/network": "^0.2.2",
+    "@opengeni/codemode": "^0.4.12-canary.0",
+    "@opengeni/codex": "^0.2.18-canary.0",
+    "@opengeni/config": "^0.19.0-canary.0",
+    "@opengeni/contracts": "^2.2.0-canary.0",
+    "@opengeni/network": "^0.2.2-canary.0",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },

package/src/attached-browser-devices.ts

@@ -8,7 +8,7 @@ import {
   type AttachedBrowserDeviceListResponse as AttachedBrowserDeviceListResponseValue,
   type AttachedBrowserInventorySnapshot as AttachedBrowserInventorySnapshotValue,
 } from "@opengeni/contracts";
-import { and, asc, desc, eq, inArray, isNull } from "drizzle-orm";
+import { and, asc, desc, eq, inArray, isNull, sql } from "drizzle-orm";
 import { type Database, withRlsContext } from "./database";
 import {
   advanceWorkspaceInteractionRevision,
@@ -16,6 +16,12 @@ import {
 } from "./interaction-revisions";
 import * as schema from "./schema";
 
+const ATTACHED_DEVICE_LIVE_LIFECYCLES = ["starting", "active", "suspending", "restoring"] as const;
+// `ending` stays off this list so an in-flight `/end` can finish physical
+// teardown (`stopCapture` + helper exit) after Chrome reconnects.
+
+const CONTROLLER_TRANSITION_EXPIRED = "controller_transition_expired";
+
 type DeviceRow = typeof schema.attachedBrowserDevices.$inferSelect;
 
 const CONSISTENT_READ = {
@@ -156,13 +162,29 @@ export async function reconcileAttachedBrowserInventory(
           .where(eq(schema.attachedBrowserDevices.workspaceId, input.workspaceId))
           .for("update");
         const byId = new Map(rows.map((row) => [row.id, row]));
+        const generationChangedDeviceIds = new Set<string>();
         let changed = false;
         for (const device of snapshot.devices) {
           const existing = byId.get(device.id);
+          let reclaimingRevokedEnrollment = false;
           if (existing && existing.enrollmentId !== input.enrollmentId) {
-            throw new AttachedBrowserInventoryConflictError(
-              "attached browser device id is already owned by another enrollment",
-            );
+            const [previousEnrollment] = await tx
+              .select({ status: schema.enrollments.status })
+              .from(schema.enrollments)
+              .where(
+                and(
+                  eq(schema.enrollments.id, existing.enrollmentId),
+                  eq(schema.enrollments.accountId, input.accountId),
+                  eq(schema.enrollments.workspaceId, input.workspaceId),
+                ),
+              )
+              .limit(1);
+            if (previousEnrollment?.status !== "revoked") {
+              throw new AttachedBrowserInventoryConflictError(
+                "attached browser device id is already owned by another active enrollment",
+              );
+            }
+            reclaimingRevokedEnrollment = true;
           }
           if (!existing) {
             await tx.insert(schema.attachedBrowserDevices).values({
@@ -189,10 +211,15 @@ export async function reconcileAttachedBrowserInventory(
             changed = true;
             continue;
           }
-          const materialChanged = !sameAnnouncement(existing, device);
+          if (existing.connectionGeneration !== device.connectionGeneration) {
+            generationChangedDeviceIds.add(device.id);
+          }
+          const materialChanged =
+            reclaimingRevokedEnrollment || !sameAnnouncement(existing, device);
           await tx
             .update(schema.attachedBrowserDevices)
             .set({
+              enrollmentId: input.enrollmentId,
               name: device.name,
               profileLabel: device.profileLabel,
               browserName: device.browserName,
@@ -217,6 +244,15 @@ export async function reconcileAttachedBrowserInventory(
           changed ||= materialChanged;
         }
 
+        if (
+          await terminalizeStaleAttachedDeviceSessions(tx, {
+            workspaceId: input.workspaceId,
+            deviceIds: [...generationChangedDeviceIds],
+          })
+        ) {
+          changed = true;
+        }
+
         const announced = new Set(snapshot.devices.map((device) => device.id));
         const disconnectedIds = rows
           .filter(
@@ -275,6 +311,153 @@ export async function reconcileAttachedBrowserInventory(
   );
 }
 
+/** A new physical Chrome generation cannot inherit a prior controller token.
+ *  Mark every still-live BrowserSession/ComputerSession on that exact device
+ *  lost in place. Never rewrite placementInstanceId onto the successor. */
+async function terminalizeStaleAttachedDeviceSessions(
+  tx: Database,
+  input: { workspaceId: string; deviceIds: readonly string[] },
+): Promise<boolean> {
+  if (input.deviceIds.length === 0) return false;
+
+  const browserRows = await tx
+    .select({ id: schema.browserSessions.id })
+    .from(schema.browserSessions)
+    .where(
+      and(
+        eq(schema.browserSessions.workspaceId, input.workspaceId),
+        eq(schema.browserSessions.placementKind, "attached_device"),
+        inArray(schema.browserSessions.deviceId, [...input.deviceIds]),
+        inArray(schema.browserSessions.lifecycle, [...ATTACHED_DEVICE_LIVE_LIFECYCLES]),
+      ),
+    );
+  const computerRows = await tx
+    .select({ id: schema.computerSessions.id })
+    .from(schema.computerSessions)
+    .where(
+      and(
+        eq(schema.computerSessions.workspaceId, input.workspaceId),
+        eq(schema.computerSessions.placementKind, "attached_device"),
+        inArray(schema.computerSessions.deviceId, [...input.deviceIds]),
+        inArray(schema.computerSessions.lifecycle, [...ATTACHED_DEVICE_LIVE_LIFECYCLES]),
+      ),
+    );
+  if (browserRows.length === 0 && computerRows.length === 0) return false;
+
+  const browserIds = browserRows.map((row) => row.id).sort();
+  const computerIds = computerRows.map((row) => row.id).sort();
+  const resourceIds = [...browserIds, ...computerIds];
+  const operations = await tx
+    .select({ operationId: schema.interactionOperations.operationId })
+    .from(schema.interactionOperations)
+    .where(
+      and(
+        eq(schema.interactionOperations.workspaceId, input.workspaceId),
+        inArray(schema.interactionOperations.resourceId, resourceIds),
+        inArray(schema.interactionOperations.state, ["prepared", "dispatched"]),
+      ),
+    );
+  const operationIds = operations.map((row) => row.operationId).sort();
+  for (const operationId of operationIds) {
+    await tx.execute(sql`
+      select operation_id from interaction_operations
+      where workspace_id = ${input.workspaceId} and operation_id = ${operationId}
+      for update
+    `);
+  }
+  for (const browserSessionId of browserIds) {
+    await tx.execute(sql`
+      select id from browser_sessions
+      where workspace_id = ${input.workspaceId} and id = ${browserSessionId}
+      for update
+    `);
+  }
+  for (const computerSessionId of computerIds) {
+    await tx.execute(sql`
+      select id from computer_sessions
+      where workspace_id = ${input.workspaceId} and id = ${computerSessionId}
+      for update
+    `);
+  }
+
+  const now = new Date();
+  if (operationIds.length > 0) {
+    await tx
+      .update(schema.interactionOperations)
+      .set({
+        state: "outcome_unknown",
+        errorCode: "outcome_unknown",
+        errorMessage: "Attached Chrome connection generation changed",
+        errorRetryable: false,
+        errorDetails: { reason: "connection_generation_changed" },
+        settledAt: now,
+        updatedAt: now,
+      })
+      .where(
+        and(
+          eq(schema.interactionOperations.workspaceId, input.workspaceId),
+          inArray(schema.interactionOperations.operationId, operationIds),
+          inArray(schema.interactionOperations.state, ["prepared", "dispatched"]),
+        ),
+      );
+  }
+  if (browserIds.length > 0) {
+    await tx
+      .update(schema.browserSessions)
+      .set({
+        lifecycle: "lost",
+        failureCode: CONTROLLER_TRANSITION_EXPIRED,
+        updatedAt: now,
+      })
+      .where(
+        and(
+          eq(schema.browserSessions.workspaceId, input.workspaceId),
+          inArray(schema.browserSessions.id, browserIds),
+          inArray(schema.browserSessions.lifecycle, [...ATTACHED_DEVICE_LIVE_LIFECYCLES]),
+        ),
+      );
+  }
+  if (computerIds.length > 0) {
+    await tx
+      .update(schema.computerSessions)
+      .set({
+        lifecycle: "lost",
+        failureCode: CONTROLLER_TRANSITION_EXPIRED,
+        updatedAt: now,
+      })
+      .where(
+        and(
+          eq(schema.computerSessions.workspaceId, input.workspaceId),
+          inArray(schema.computerSessions.id, computerIds),
+          inArray(schema.computerSessions.lifecycle, [...ATTACHED_DEVICE_LIVE_LIFECYCLES]),
+        ),
+      );
+  }
+  return true;
+}
+
+/** Lock the device row first (same order as inventory) and prove the live
+ *  physical generation still matches this controller placement. */
+export async function attachedDeviceGenerationMatches(
+  tx: Database,
+  input: { workspaceId: string; deviceId: string; placementInstanceId: string },
+): Promise<boolean> {
+  const [device] = await tx
+    .select({
+      connectionGeneration: schema.attachedBrowserDevices.connectionGeneration,
+    })
+    .from(schema.attachedBrowserDevices)
+    .where(
+      and(
+        eq(schema.attachedBrowserDevices.workspaceId, input.workspaceId),
+        eq(schema.attachedBrowserDevices.id, input.deviceId),
+      ),
+    )
+    .for("update")
+    .limit(1);
+  return device?.connectionGeneration === input.placementInstanceId;
+}
+
 /** Immediately mark every live Chrome profile on a cleanly disconnected agent
  *  offline. Historical endpoint rows remain discoverable and reconnect in place. */
 export async function disconnectAttachedBrowserDevices(
@@ -336,8 +519,53 @@ export async function listAttachedBrowserDevices(
           asc(schema.attachedBrowserDevices.name),
           asc(schema.attachedBrowserDevices.id),
         );
+      const inventories = await scopedDb
+        .select({
+          enrollmentId: schema.attachedBrowserInventories.enrollmentId,
+          bridgeGeneration: schema.attachedBrowserInventories.bridgeGeneration,
+          revision: schema.attachedBrowserInventories.revision,
+          observedAt: schema.attachedBrowserInventories.observedAt,
+          enrollmentStatus: schema.enrollments.status,
+          connectionLeaseExpiresAt: schema.enrollments.connectionLeaseExpiresAt,
+          wentOfflineAt: schema.enrollments.wentOfflineAt,
+        })
+        .from(schema.attachedBrowserInventories)
+        .innerJoin(
+          schema.enrollments,
+          and(
+            eq(schema.enrollments.id, schema.attachedBrowserInventories.enrollmentId),
+            eq(schema.enrollments.workspaceId, schema.attachedBrowserInventories.workspaceId),
+          ),
+        )
+        .where(eq(schema.attachedBrowserInventories.workspaceId, input.workspaceId))
+        .orderBy(
+          desc(schema.attachedBrowserInventories.observedAt),
+          asc(schema.attachedBrowserInventories.enrollmentId),
+        );
+      const connectedProfilesByEnrollment = new Map<string, number>();
+      for (const row of rows) {
+        if (row.disconnectedAt !== null) continue;
+        connectedProfilesByEnrollment.set(
+          row.enrollmentId,
+          (connectedProfilesByEnrollment.get(row.enrollmentId) ?? 0) + 1,
+        );
+      }
       return AttachedBrowserDeviceListResponse.parse({
         revision: await readWorkspaceInteractionRevision(scopedDb, input.workspaceId),
+        bridges: inventories.map((inventory) => ({
+          enrollmentId: inventory.enrollmentId,
+          state:
+            inventory.enrollmentStatus === "active" &&
+            inventory.wentOfflineAt === null &&
+            inventory.connectionLeaseExpiresAt !== null &&
+            inventory.connectionLeaseExpiresAt.getTime() > Date.now()
+              ? "online"
+              : "offline",
+          bridgeGeneration: inventory.bridgeGeneration,
+          inventoryRevision: inventory.revision,
+          connectedProfileCount: connectedProfilesByEnrollment.get(inventory.enrollmentId) ?? 0,
+          lastSeenAt: inventory.observedAt.toISOString(),
+        })),
         devices: rows.map(deviceFromRow),
       });
     },