@opengeni/db 1.0.1 → 3.2.0-canary.0

package/src/user-resource-authority.ts

@@ -0,0 +1,377 @@
+import {
+  PersonalResourceAttachmentSummary,
+  type PersonalResourceAttachmentIntent,
+  USER_RESOURCE_ACTION_BY_KIND,
+  type UserResourceDelegation,
+  type UserResourceKind,
+} from "@opengeni/contracts";
+import { sql } from "drizzle-orm";
+import { rawRows, setSubjectRlsContext, withRlsContext, type Database } from "./database";
+import { nestedPostgresSqlState } from "./persistence-errors";
+
+export type UserResourceAuthorityGrant = {
+  grantId: string;
+  targetWorkspaceId: string;
+  targetSessionId: string | null;
+  action: (typeof USER_RESOURCE_ACTION_BY_KIND)[UserResourceKind];
+  mode: "once" | "session" | "always";
+  context: "user_private" | "workspace_shared";
+  authorityEpoch: number | null;
+  generation: number;
+  status: "active" | "consumed" | "revoked" | "expired";
+  expiresAt: string | null;
+  delegation: UserResourceDelegation;
+};
+
+export type UserResourceAuthoritySummary = {
+  authorityId: string;
+  resourceKind: UserResourceKind;
+  resourceId: string;
+  originWorkspaceId: string | null;
+  generation: number;
+  status: "active" | "retained" | "revoked";
+  grants: UserResourceAuthorityGrant[];
+};
+
+export type AcceptedTurnPersonalResourceAttachment = {
+  summary: PersonalResourceAttachmentSummary;
+  replay: boolean;
+};
+
+export class PersonalResourceAttachmentAcceptanceError extends Error {
+  readonly name = "PersonalResourceAttachmentAcceptanceError";
+  constructor(
+    readonly kind: "invalid" | "forbidden" | "conflict",
+    options?: ErrorOptions,
+  ) {
+    super(
+      kind === "invalid"
+        ? "The personal-resource attachment request is invalid"
+        : kind === "forbidden"
+          ? "The personal-resource attachment is not authorized"
+          : "The personal-resource attachment conflicts with accepted work",
+      options,
+    );
+  }
+}
+
+/**
+ * Issue and freeze the locked session's personal Variable Set/Rig/Connected
+ * Machine closure on
+ * one already-inserted logical turn. The caller owns the surrounding accepted-
+ * work transaction; this helper must never be called as a standalone grant
+ * mutation.
+ */
+export async function acceptTurnPersonalResourceAttachmentInTransaction(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    subjectId: string;
+    intent: PersonalResourceAttachmentIntent & { expectedAuthorityEpoch: number };
+  },
+): Promise<AcceptedTurnPersonalResourceAttachment> {
+  await setSubjectRlsContext(db, input.subjectId);
+  let row:
+    | {
+        grantMode: "once" | "session" | "always";
+        grantContext: "user_private" | "workspace_shared";
+        resourceCount: number;
+        resourceKinds: Array<"variable_set" | "rig" | "connected_machine">;
+        sharedOutputWarningVersion: 1;
+        replay: boolean;
+      }
+    | undefined;
+  try {
+    [row] = await rawRows(
+      db,
+      sql`
+        select grant_mode as "grantMode", grant_context as "grantContext",
+          resource_count::int as "resourceCount", resource_kinds as "resourceKinds",
+          shared_output_warning_version::int as "sharedOutputWarningVersion", replay
+        from accept_turn_personal_resource_attachment(
+          ${input.accountId}::uuid, ${input.workspaceId}::uuid,
+          ${input.sessionId}::uuid, ${input.turnId}::uuid, ${input.intent.mode},
+          ${input.intent.expectedAuthorityEpoch},
+          ${input.intent.workspaceSharedAcknowledged},
+          ${input.intent.sharedOutputWarningVersion}
+        )
+      `,
+    );
+  } catch (error) {
+    const sqlState = nestedPostgresSqlState(error);
+    if (sqlState === "22023") {
+      throw new PersonalResourceAttachmentAcceptanceError("invalid", { cause: error });
+    }
+    if (sqlState === "42501") {
+      throw new PersonalResourceAttachmentAcceptanceError("forbidden", { cause: error });
+    }
+    if (sqlState === "23505") {
+      throw new PersonalResourceAttachmentAcceptanceError("conflict", { cause: error });
+    }
+    throw error;
+  }
+  if (!row) throw new Error("atomic personal-resource attachment was not returned");
+  return {
+    summary: PersonalResourceAttachmentSummary.parse({
+      mode: row.grantMode,
+      context: row.grantContext,
+      resourceCount: row.resourceCount,
+      resourceKinds: row.resourceKinds,
+      sharedOutputWarningVersion: row.sharedOutputWarningVersion,
+    }),
+    replay: row.replay,
+  };
+}
+
+type AuthorityRow = Omit<
+  UserResourceAuthorityGrant,
+  "grantId" | "targetWorkspaceId" | "delegation"
+> & {
+  authorityId: string;
+  organizationId: string;
+  resourceKind: UserResourceKind;
+  resourceId: string;
+  originWorkspaceId: string | null;
+  authorityGeneration: number;
+  authorityStatus: UserResourceAuthoritySummary["status"];
+  grantId: string | null;
+  targetWorkspaceId: string | null;
+};
+
+function rfc3339(value: string | null): string | null {
+  if (value === null) return null;
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) throw new Error("invalid database timestamptz projection");
+  return date.toISOString();
+}
+
+async function withOwnerContext<T>(
+  db: Database,
+  input: { accountId: string; workspaceId: string; subjectId: string },
+  fn: (db: Database) => Promise<T>,
+): Promise<T> {
+  return await withRlsContext(db, input, async (scopedDb) => {
+    await setSubjectRlsContext(scopedDb, input.subjectId);
+    return await fn(scopedDb);
+  });
+}
+
+export async function listSelfUserResourceAuthorities(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    resourceKind: UserResourceKind;
+    cursor?: string | undefined;
+    limit: number;
+  },
+): Promise<{ authorities: UserResourceAuthoritySummary[]; nextCursor: string | null }> {
+  return await withOwnerContext(db, input, async (scopedDb) => {
+    const rows = await rawRows<AuthorityRow>(
+      scopedDb,
+      sql`
+      select authority_id as "authorityId", organization_id as "organizationId",
+        resource_kind as "resourceKind", resource_id as "resourceId",
+        origin_workspace_id as "originWorkspaceId",
+        authority_generation::int as "authorityGeneration",
+        authority_status as "authorityStatus", grant_id as "grantId",
+        target_workspace_id as "targetWorkspaceId", target_session_id as "targetSessionId",
+        action, grant_mode as mode, grant_context as context,
+        authority_epoch::int as "authorityEpoch",
+        grant_generation::int as generation, grant_status as status,
+        expires_at::text as "expiresAt"
+      from list_self_user_resource_authorities(
+        ${input.accountId}::uuid, ${input.workspaceId}::uuid, ${input.resourceKind},
+        ${input.cursor ?? null}::uuid, ${input.limit + 1}
+      )
+    `,
+    );
+    const grouped = new Map<string, UserResourceAuthoritySummary>();
+    for (const row of rows) {
+      const authority = grouped.get(row.authorityId) ?? {
+        authorityId: row.authorityId,
+        resourceKind: row.resourceKind,
+        resourceId: row.resourceId,
+        originWorkspaceId: row.originWorkspaceId,
+        generation: row.authorityGeneration,
+        status: row.authorityStatus,
+        grants: [],
+      };
+      if (row.grantId && row.targetWorkspaceId) {
+        authority.grants.push({
+          grantId: row.grantId,
+          targetWorkspaceId: row.targetWorkspaceId,
+          targetSessionId: row.targetSessionId,
+          action: row.action,
+          mode: row.mode,
+          context: row.context,
+          authorityEpoch: row.authorityEpoch,
+          generation: row.generation,
+          status: row.status,
+          expiresAt: rfc3339(row.expiresAt),
+          delegation: {
+            authorityId: row.authorityId,
+            grantId: row.grantId,
+            organizationId: row.organizationId,
+            workspaceId: row.targetWorkspaceId,
+            sessionId: row.targetSessionId,
+            action: row.action,
+            mode: row.mode,
+            context: row.context,
+            authorityEpoch: row.authorityEpoch,
+            authorityGeneration: row.authorityGeneration,
+            grantGeneration: row.generation,
+          },
+        });
+      }
+      grouped.set(row.authorityId, authority);
+    }
+    const values = [...grouped.values()];
+    const hasMore = values.length > input.limit;
+    const authorities = hasMore ? values.slice(0, input.limit) : values;
+    return {
+      authorities,
+      nextCursor: hasMore ? (authorities.at(-1)?.authorityId ?? null) : null,
+    };
+  });
+}
+
+export async function issueSelfUserResourceGrant(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    authorityId: string;
+    resourceKind: UserResourceKind;
+    mode: "session" | "always";
+    context: "user_private" | "workspace_shared";
+    sessionId?: string | null;
+    expectedAuthorityEpoch?: number | null;
+    workspaceSharedAcknowledged: boolean;
+  },
+): Promise<UserResourceAuthorityGrant> {
+  return await withOwnerContext(db, input, async (scopedDb) => {
+    const [row] = await rawRows<
+      Omit<UserResourceAuthorityGrant, "delegation"> & {
+        organizationId: string;
+        authorityGeneration: number;
+      }
+    >(
+      scopedDb,
+      sql`
+      select grant_id as "grantId", organization_id as "organizationId",
+        authority_generation::int as "authorityGeneration",
+        target_workspace_id as "targetWorkspaceId",
+        target_session_id as "targetSessionId", action, grant_mode as mode,
+        grant_context as context, authority_epoch::int as "authorityEpoch",
+        grant_generation::int as generation,
+        grant_status as status, expires_at::text as "expiresAt"
+      from issue_self_user_resource_grant(
+        ${input.accountId}::uuid, ${input.authorityId}::uuid, ${input.workspaceId}::uuid,
+        ${input.resourceKind}, ${input.mode}, ${input.context},
+        ${input.sessionId ?? null}::uuid, ${input.expectedAuthorityEpoch ?? null}::integer,
+        ${input.workspaceSharedAcknowledged}
+      )
+    `,
+    );
+    if (!row) throw new Error("user-resource grant was not returned");
+    const { organizationId, authorityGeneration, ...grant } = row;
+    return {
+      ...grant,
+      expiresAt: rfc3339(grant.expiresAt),
+      delegation: {
+        authorityId: input.authorityId,
+        grantId: grant.grantId,
+        organizationId,
+        workspaceId: grant.targetWorkspaceId,
+        sessionId: grant.targetSessionId,
+        action: grant.action,
+        mode: grant.mode,
+        context: grant.context,
+        authorityEpoch: grant.authorityEpoch,
+        authorityGeneration,
+        grantGeneration: grant.generation,
+      },
+    };
+  });
+}
+
+export async function revokeSelfUserResourceGrant(
+  db: Database,
+  input: { accountId: string; workspaceId: string; subjectId: string; grantId: string },
+): Promise<{ grantId: string; generation: number; status: "revoked"; revokedAt: string }> {
+  return await withOwnerContext(db, input, async (scopedDb) => {
+    const [row] = await rawRows<{
+      grantId: string;
+      generation: number;
+      status: "revoked";
+      revokedAt: string;
+    }>(
+      scopedDb,
+      sql`
+      select grant_id as "grantId", grant_generation::int as generation,
+        grant_status as status, revoked_at::text as "revokedAt"
+      from revoke_self_user_resource_grant(
+        ${input.accountId}::uuid, ${input.workspaceId}::uuid, ${input.grantId}::uuid
+      )
+    `,
+    );
+    if (!row) throw new Error("user-resource grant was not returned");
+    return { ...row, revokedAt: rfc3339(row.revokedAt)! };
+  });
+}
+
+export async function resolveSessionAttemptPersonalResources(
+  db: Database,
+  input: { accountId: string; workspaceId: string; subjectId: string | null; attemptId: string },
+): Promise<void> {
+  await withRlsContext(db, input, async (scopedDb) => {
+    if (input.subjectId) await setSubjectRlsContext(scopedDb, input.subjectId);
+    await scopedDb.execute(sql`select authorize_session_attempt_personal_resource_reads(
+      ${input.accountId}::uuid, ${input.workspaceId}::uuid, ${input.attemptId}::uuid
+    )`);
+  });
+}
+
+export type PersonalDocumentAuthority = {
+  authorityId: string;
+  ownerOrganizationMembershipId: string;
+  authorityGeneration: number;
+};
+
+/**
+ * Create the common organization-user authority before inserting a personal
+ * Document. Returns null for a configured/local or rolling-legacy subject that
+ * has no eligible active organization membership, preserving the existing
+ * workspace-anchored personal lane. Call this inside the same database
+ * transaction as the Document insert so a failed write cannot leave an orphan
+ * authority.
+ */
+export async function createPersonalDocumentAuthority(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    documentId: string;
+  },
+): Promise<PersonalDocumentAuthority | null> {
+  await setSubjectRlsContext(db, input.subjectId);
+  const [row] = await rawRows<PersonalDocumentAuthority>(
+    db,
+    sql`
+      select authority_id as "authorityId",
+        owner_organization_membership_id as "ownerOrganizationMembershipId",
+        authority_generation::int as "authorityGeneration"
+      from create_personal_document_authority(
+        ${input.accountId}::uuid, ${input.workspaceId}::uuid, ${input.documentId}::uuid
+      )
+    `,
+  );
+  return row ?? null;
+}

package/src/workspace-authority.ts

@@ -0,0 +1,160 @@
+import { OrganizationMember } from "@opengeni/contracts";
+import { sql } from "drizzle-orm";
+import { rawRows, type Database } from "./database";
+
+/**
+ * THE canonical live-workspace-authority resolver for one exact subject, run on
+ * a handle that is ALREADY inside the caller's transaction with that subject's
+ * RLS context applied.
+ *
+ * `getWorkspaceGrant` is a bare `workspace_memberships` join and is therefore
+ * NOT a complete authority answer: a managed human's personal workspace
+ * deliberately has no row in that table (migration 0219 raises on one), so its
+ * owner's access is the `organization_memberships.personal_workspace_id`
+ * pointer instead. Any seam that re-derives "does this subject still hold
+ * workspace authority here" from that bare join denies the one human who always
+ * belongs. This module exists so that rule has exactly one implementation.
+ *
+ * Seams that must serialize the answer with their own writes — session listing,
+ * session pins, the composer draft — call this variant so the read and the write
+ * share one transaction snapshot and one advisory fence. Seams that need to ask
+ * about a subject that is NOT the caller call
+ * {@link namedSubjectHasLiveWorkspaceAuthority} (`@opengeni/db`), which is a thin
+ * scope wrapper over exactly this body.
+ *
+ * True when the subject currently holds workspace authority the same way the
+ * route-time access builder derives it: a `workspace_memberships` row whose
+ * owning organization membership (when one exists) is active, or an active
+ * organization membership whose personal-workspace pointer is exactly this
+ * workspace. Never infers authority any other way; a deleted membership row and
+ * a suspended/revoked organization membership are both false. Only the
+ * membership's own `personal_workspace_id` counts as stated authority — nothing
+ * is read from `created_by`, a default workspace, a resource name, or current
+ * access.
+ *
+ * # This function is NOT an authorization. Read this before relying on it.
+ *
+ * It answers "does subject X hold authority over workspace W". It does NOT
+ * establish that the caller is X. Nothing here authenticates anybody.
+ *
+ * The scope assertion below is a **consistency check, not an authorization**.
+ * It prevents one thing: a caller naming a third-party subject while its
+ * transaction is scoped to someone else. It cannot detect a caller that scoped
+ * the transaction to an attacker-chosen subject in the first place, because
+ * `withWorkspaceSubjectRls(db, workspaceId, subjectId, ...)` takes that subject
+ * from its argument too. At today's three call sites both sides come from the
+ * same variable, so the check is a tautology there and fires only if a future
+ * refactor makes them diverge. Treat it as a tripwire against that refactor —
+ * never as evidence that the subject was authenticated.
+ *
+ * **The actual authorization for the personal-workspace exception lives in the
+ * API layer**: `AccessGrantAuthorization.canonicalManagedHumanSession`
+ * (`@opengeni/core`), stamped only where a Better Auth cookie was verified. A
+ * caller that has not proven that must not enable the exception. If you are
+ * adding a caller, that stamp is the part you have to get right; this function
+ * will happily answer `true` for any subject you scope a transaction to.
+ *
+ * Non-`user:` subjects (API keys, delegated service principals, configured and
+ * local principals) can never own an organization membership, so they
+ * short-circuit to the plain membership answer instead of tripping
+ * `list_self_organization_memberships`' `42501`.
+ */
+export async function subjectHasLiveWorkspaceAuthorityInScope(
+  scopedDb: Database,
+  input: { accountId: string; workspaceId: string; subjectId: string },
+): Promise<boolean> {
+  // CONSISTENCY CHECK, NOT AN AUTHORIZATION. This function deliberately does not
+  // set `opengeni.subject_id`, so it cannot be handed a scope of its own — that
+  // makes the oracle shape unrepresentable here. But the scope it inherits was
+  // set by `withWorkspaceSubjectRls` from ITS caller's argument, so a match
+  // proves only that one caller used one subject consistently; it proves
+  // nothing about who that subject is. Authorization is the API layer's
+  // canonical-managed-cookie stamp. See the doc comment above.
+  const scopedSubjectId = await subjectIdInRlsScope(scopedDb);
+  if (scopedSubjectId !== input.subjectId) {
+    throw new Error(
+      "subjectHasLiveWorkspaceAuthorityInScope: subject does not match the applied RLS scope",
+    );
+  }
+  const [membershipRow] = await rawRows<{ present: number }>(
+    scopedDb,
+    sql`select 1 as present from workspace_memberships
+      where subject_id = ${input.subjectId}
+        and workspace_id = ${input.workspaceId}
+      limit 1`,
+  );
+  if (!input.subjectId.startsWith("user:")) {
+    return Boolean(membershipRow);
+  }
+  const [organizationMembershipResult] = await rawRows<{ result: unknown }>(
+    scopedDb,
+    sql`select list_self_organization_memberships(${input.subjectId}) as result`,
+  );
+  const organizationMemberships = OrganizationMember.array().parse(
+    organizationMembershipResult?.result ?? [],
+  );
+  const selfOrganizationMembership = organizationMemberships.find(
+    (organizationMembership) => organizationMembership.organizationId === input.accountId,
+  );
+  if (membershipRow) {
+    // Mirror the access builder's inactive-organization filter: a persisted
+    // membership row is dead while its organization membership is
+    // suspended/revoked. A subject with no organization membership at all
+    // (legacy/standalone) keeps its persisted row's authority.
+    return !selfOrganizationMembership || selfOrganizationMembership.status === "active";
+  }
+  return (
+    selfOrganizationMembership?.status === "active" &&
+    selfOrganizationMembership.personalWorkspaceId === input.workspaceId
+  );
+}
+
+/**
+ * The applied subject GUC, or `""` when none is set. `""` is the canonical
+ * "unset" for this GUC: `current_subject_id()` is
+ * `nullif(current_setting('opengeni.subject_id', true), '')` (0239 precedent), so
+ * a caller restoring `""` genuinely clears it rather than pinning an empty
+ * subject. Never throws, so it is safe for capturing a prior value that may
+ * legitimately be absent.
+ */
+export async function rlsSubjectIdOrEmpty(scopedDb: Database): Promise<string> {
+  const [row] = await rawRows<{ subjectId: string | null }>(
+    scopedDb,
+    sql`select current_setting('opengeni.subject_id', true) as "subjectId"`,
+  );
+  return row?.subjectId ?? "";
+}
+
+/**
+ * The subject of the caller's ALREADY-applied RLS scope, required to be present.
+ * Used by the in-scope resolver to check that a caller is asking about its own
+ * scope rather than naming a third party — a consistency check, not proof that
+ * anything authenticated that subject.
+ */
+async function subjectIdInRlsScope(scopedDb: Database): Promise<string> {
+  const subjectId = await rlsSubjectIdOrEmpty(scopedDb);
+  if (!subjectId) {
+    throw new Error("RLS subject context is not applied on the active backend");
+  }
+  return subjectId;
+}
+
+/**
+ * The tenant account of the caller's ALREADY-applied RLS scope. `withRlsContext`
+ * sets and read-back-verifies this GUC on the pinned backend before running the
+ * scoped body, so it is exact rather than a re-derivation — which lets a seam
+ * that only received a workspace id consult
+ * {@link subjectHasLiveWorkspaceAuthorityInScope} without a second round trip to
+ * resolve the account.
+ */
+export async function accountIdInRlsScope(scopedDb: Database): Promise<string> {
+  const [row] = await rawRows<{ accountId: string | null }>(
+    scopedDb,
+    sql`select current_setting('opengeni.account_id', true) as "accountId"`,
+  );
+  const accountId = row?.accountId ?? "";
+  if (!accountId) {
+    throw new Error("RLS account context is not applied on the active backend");
+  }
+  return accountId;
+}

package/src/workspace-instruction-policies-schema.ts

@@ -172,6 +172,55 @@ export const workspaceInstructionPolicyActivationEvents = pgTable(
   }),
 );
 
+export const workspaceInstructionPolicyDeactivationEvents = pgTable(
+  "workspace_instruction_policy_deactivation_events",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    operationId: uuid("operation_id").notNull(),
+    requestFingerprint: text("request_fingerprint").notNull(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    kind: text("kind").notNull(),
+    scope: text("scope").notNull(),
+    roleKey: text("role_key"),
+    type: text("type").notNull(),
+    activationVersion: bigint("activation_version", { mode: "number" }).notNull(),
+    oldRevisionId: uuid("old_revision_id").notNull(),
+    oldRevision: bigint("old_revision", { mode: "number" }).notNull(),
+    oldContentHash: text("old_content_hash").notNull(),
+    actorSubjectId: text("actor_subject_id").notNull(),
+    reason: text("reason").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    workspaceOperation: uniqueIndex(
+      "workspace_instruction_policy_deactivate_workspace_operation_uq",
+    ).on(table.workspaceId, table.operationId),
+    workspaceActivationVersion: uniqueIndex(
+      "workspace_instruction_policy_deactivations_target_version_uq",
+    ).on(
+      table.workspaceId,
+      table.kind,
+      table.scope,
+      sql`coalesce(${table.roleKey}, '')`,
+      table.activationVersion,
+    ),
+    workspaceTimeline: index("workspace_instruction_policy_deactivations_workspace_time_idx").on(
+      table.workspaceId,
+      table.createdAt,
+      table.id,
+    ),
+    target: check(
+      "workspace_instruction_policy_deactivations_target_chk",
+      sql`(
+        (${table.kind} = 'charter' and ${table.scope} = 'global' and ${table.roleKey} is null)
+        or (${table.kind} = 'policy' and ${table.scope} = 'global' and ${table.roleKey} is null)
+        or (${table.kind} = 'policy' and ${table.scope} = 'role' and ${table.roleKey} is not null)
+      )`,
+    ),
+  }),
+);
+
 export const workspaceInstructionPolicyOnboardingProposals = pgTable(
   "workspace_instruction_policy_onboarding_proposals",
   {
@@ -211,6 +260,9 @@ export const workspaceInstructionPolicyOnboardingProposals = pgTable(
       sql`coalesce(${table.roleKey}, '')`,
       table.sourceId,
       table.sourceVersion,
+      // One proposal per source per baseline: a rebaselined successor is
+      // admissible, a duplicate against the same baseline is not.
+      table.baselineActivationVersion,
     ),
     workspaceTimeline: index(
       "workspace_instruction_policy_onboarding_proposals_workspace_time_idx",
@@ -239,7 +291,7 @@ export const workspaceInstructionPolicyOnboardingProposals = pgTable(
         ${table.baselineRevisionId} is null
         and ${table.baselineRevision} is null
         and ${table.baselineContentHash} is null
-        and ${table.baselineActivationVersion} = 0
+        and ${table.baselineActivationVersion} >= 0
         and ${table.baselineActivatedAt} is null
       ) or (
         ${table.baselineRevisionId} is not null