@opengeni/db 1.0.1 → 3.2.0-canary.0

package/dist/slack-routing.d.ts

@@ -0,0 +1,268 @@
+import { type Database } from "./database.js";
+import * as schema from "./schema.js";
+/** The installation binding's own tenancy: credential, identity, and inbox. */
+export type SlackRouteHome = {
+    accountId: string;
+    workspaceId: string;
+};
+/** How a stored route was decided. `picker` is a human answering the Slack card. */
+export type SlackRouteSource = "picker" | "admin";
+export type SlackChannelRoute = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    slackTeamId: string;
+    slackChannelId: string;
+    targetAccountId: string;
+    targetWorkspaceId: string;
+    decidedBySubjectId: string;
+    decidedBySlackUserId: string;
+    source: SlackRouteSource;
+    version: number;
+    createdAt: Date;
+    updatedAt: Date;
+};
+export type SlackUserDmRoute = Omit<SlackChannelRoute, "slackChannelId"> & {
+    slackUserId: string;
+};
+export type UpsertSlackChannelRouteInput = {
+    connectionId: string;
+    slackTeamId: string;
+    slackChannelId: string;
+    targetAccountId: string;
+    targetWorkspaceId: string;
+    decidedBySubjectId: string;
+    decidedBySlackUserId: string;
+    source: SlackRouteSource;
+};
+export type UpsertSlackUserDmRouteInput = Omit<UpsertSlackChannelRouteInput, "slackChannelId"> & {
+    slackUserId: string;
+};
+/** Ids only. Never content, never a subject. */
+export type SlackInteractionTenancy = {
+    accountId: string;
+    workspaceId: string;
+    interactionId: string;
+};
+/** One workspace a Slack-linked subject may start work in. */
+export type SlackRoutableWorkspace = {
+    accountId: string;
+    workspaceId: string;
+    label: string;
+    /** True for the subject's own personal workspace, which has no membership row. */
+    personal: boolean;
+};
+/**
+ * Resolve which tenancy owns the `slack_interactions` row for one exact
+ * connection-scoped route key, through the content-free SECURITY DEFINER probe.
+ *
+ * Thread continuation must cross workspaces: `slack_interactions_route_uq` is
+ * `(connection_id, route_key)` and therefore connection-global, while every
+ * ordinary interaction read is workspace-fenced and would miss a thread whose
+ * interaction lives in a routed workspace.
+ *
+ * This returns IDS ONLY. It cannot widen visibility, because the caller must
+ * re-read the full row under the returned tenancy's own RLS - which is what
+ * `getSlackInteractionById` already does.
+ */
+export declare function probeSlackInteractionTenancy(db: Database, input: {
+    accountId: string;
+    connectionId: string;
+    routeKey: string;
+}): Promise<SlackInteractionTenancy | null>;
+/**
+ * Which workspace owns one Slack action handle.
+ *
+ * A button click arrives on an inbox row that carries the installation's
+ * tenancy and names the handle only by id, while the handle lives in the
+ * workspace that owns its session. Content-free, ids only: the caller must
+ * re-read the full handle under the returned tenancy's own RLS, where every
+ * existing authorization check already lives.
+ */
+export declare function probeSlackActionHandleTenancy(db: Database, input: {
+    accountId: string;
+    connectionId: string;
+    handleId: string;
+}): Promise<SlackRouteHome | null>;
+/** Every channel route this installation has, for the admin surface. */
+export declare function listSlackChannelRoutes(db: Database, home: SlackRouteHome, input: {
+    connectionId: string;
+}): Promise<SlackChannelRoute[]>;
+export declare function getSlackChannelRoute(db: Database, home: SlackRouteHome, input: {
+    connectionId: string;
+    slackChannelId: string;
+}): Promise<SlackChannelRoute | null>;
+export declare function getSlackUserDmRoute(db: Database, home: SlackRouteHome, input: {
+    connectionId: string;
+    slackUserId: string;
+}): Promise<SlackUserDmRoute | null>;
+/**
+ * The ask-once memory for a channel. A repeat write for the same
+ * `(connectionId, slackChannelId)` re-points the channel and bumps `version`;
+ * it never creates a second row, so a channel always has exactly one answer.
+ *
+ * The caller is responsible for having authorized `target*` for the deciding
+ * subject through `resolveSlackTargetAuthority` first - a stored route is
+ * memory, never authority, and every later use re-authorizes it live.
+ */
+export declare function upsertSlackChannelRoute(db: Database, home: SlackRouteHome, input: UpsertSlackChannelRouteInput): Promise<SlackChannelRoute>;
+/** The ask-once memory for one Slack human's direct messages. */
+export declare function upsertSlackUserDmRoute(db: Database, home: SlackRouteHome, input: UpsertSlackUserDmRouteInput): Promise<SlackUserDmRoute>;
+/** Clear a channel's stored answer; the next message asks again. */
+export declare function deleteSlackChannelRoute(db: Database, home: SlackRouteHome, input: {
+    connectionId: string;
+    slackChannelId: string;
+}): Promise<boolean>;
+/** Clear one Slack human's stored DM answer; DMs fall back to the derived personal workspace. */
+export declare function deleteSlackUserDmRoute(db: Database, home: SlackRouteHome, input: {
+    connectionId: string;
+    slackUserId: string;
+}): Promise<boolean>;
+/**
+ * THE workspaces one subject may start Slack work in, within one organization.
+ *
+ * This is deliberately one function so the "workspaces this subject may create
+ * sessions in" question has a single implementation that a future shared
+ * candidate-set contract can replace wholesale, rather than several call sites
+ * each re-deriving it slightly differently.
+ *
+ * Two independent sources, unioned:
+ *
+ * 1. `workspace_memberships` joined to `workspaces` in this account, filtered
+ *    to memberships that actually permit starting work (`sessions:create`, or
+ *    `workspace:admin` which implies it).
+ * 2. The subject's OWN personal workspace, from the active organization
+ *    membership's `personalWorkspaceId` pointer.
+ *
+ * `listWorkspacesForSubject` is NOT usable here: it is a bare membership join
+ * with no permission filter, and it cannot see personal workspaces at all,
+ * because a managed human's personal workspace deliberately has no
+ * `workspace_memberships` row.
+ *
+ * The personal-workspace id is DERIVED from the membership pointer. It is never
+ * accepted from a Slack payload, a route row, or a caller argument.
+ *
+ * Ordered stably by label then workspace id, with plain code-unit comparison so
+ * two hosts with different ICU data cannot render a picker differently.
+ *
+ * ORACLE, NOT AN AUTHORIZATION. This answers "what could this named subject use"
+ * for whatever subject it is handed; it does not establish that the caller IS
+ * that subject. Pass only a subject authenticated out of band - for Slack, one
+ * named by a durable `slack_bot_user_links` row. Never pass a subject taken
+ * from a request payload.
+ */
+export declare function listNamedSubjectSlackRoutableWorkspaces(db: Database, input: {
+    accountId: string;
+    subjectId: string;
+}): Promise<SlackRoutableWorkspace[]>;
+/** The trigger kinds a picker can be opened from, mirroring the table's CHECK. */
+export type SlackRoutePromptTriggerKind = (typeof schema.slackRoutePrompts.$inferSelect)["triggerKind"];
+/** A pending first-use picker plus the workspaces it offered. */
+export type SlackRoutePrompt = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    inboxId: string;
+    slackTeamId: string;
+    slackUserId: string;
+    slackChannelId: string;
+    slackMessageTs: string;
+    providerEventId: string;
+    triggerKind: SlackRoutePromptTriggerKind;
+    requestText: string;
+    hasFiles: boolean;
+    slackThreadTs: string | null;
+    messageOperationId: string;
+    status: "pending" | "answered" | "expired" | "cancelled";
+    expiresAt: Date;
+    options: readonly SlackRoutePromptOption[];
+};
+export type SlackRoutePromptOption = {
+    id: string;
+    candidateAccountId: string;
+    candidateWorkspaceId: string;
+    candidateLabel: string;
+    position: number;
+};
+/**
+ * Open one first-use picker for a conversation, or return the one already open.
+ *
+ * Three separate uniques make this idempotent from three directions: Slack's
+ * retries of one event collide on `(connection_id, provider_event_id)`, a
+ * replayed inbox row collides on `(connection_id, inbox_id)`, and a genuinely
+ * different message in the same conversation collides on the partial pending
+ * index. The last one is why a second message never posts a second card: the
+ * person is already being asked the same question.
+ */
+export declare function openSlackRoutePrompt(db: Database, home: SlackRouteHome, input: {
+    connectionId: string;
+    inboxId: string;
+    slackTeamId: string;
+    slackUserId: string;
+    slackChannelId: string;
+    slackMessageTs: string;
+    providerEventId: string;
+    triggerKind: SlackRoutePromptTriggerKind;
+    requestText: string;
+    hasFiles: boolean;
+    slackThreadTs: string | null;
+    messageOperationId: string;
+    expiresAt: Date;
+    candidates: readonly SlackRoutableWorkspace[];
+    now?: Date;
+}): Promise<{
+    opened: boolean;
+    prompt: SlackRoutePrompt;
+} | null>;
+/**
+ * The prompt one offered button belongs to.
+ *
+ * The button's `value` is the option row id, which is a UUID precisely because
+ * the block-action normalizer already requires that shape. The option rows are a
+ * prompt-time SNAPSHOT and are never authority: the caller must re-authorize the
+ * chosen workspace live.
+ */
+export declare function getSlackRoutePromptByOption(db: Database, home: SlackRouteHome, optionId: string): Promise<{
+    prompt: SlackRoutePrompt;
+    chosen: SlackRoutePromptOption;
+} | null>;
+/**
+ * Settle a prompt without answering it: the person pressed the cancel action, or
+ * it aged out. Only a still-pending row moves, so this cannot overwrite an
+ * answer that landed first.
+ */
+export declare function settleSlackRoutePrompt(db: Database, home: SlackRouteHome, input: {
+    promptId: string;
+    status: "expired" | "cancelled";
+}): Promise<boolean>;
+/**
+ * Answer a picker: freeze the choice, remember it, and re-queue the request.
+ *
+ * All three commit together. The route row is the ask-once memory, so a later
+ * message in that conversation never asks again, and the re-queued inbox row is
+ * what actually starts the work the person asked for before they were
+ * interrupted by the question.
+ *
+ * The re-queued row carries a DERIVED provider event id, not the original one.
+ * The original inbox row still exists and is settled, so re-using its id would
+ * collide with the inbox's own `(connection_id, provider_event_id)` dedupe and
+ * silently queue nothing at all. Deriving it from the prompt keeps the insert
+ * idempotent for exactly this answer, so a double-click cannot create two
+ * sessions.
+ *
+ * Only a still-pending prompt answers. A second click, an expiry sweep, or a
+ * cancel that landed first all leave `answered: false` and change nothing.
+ */
+export declare function answerSlackRoutePrompt(db: Database, home: SlackRouteHome, input: {
+    promptId: string;
+    targetAccountId: string;
+    targetWorkspaceId: string;
+    answeredBySubjectId: string;
+    decidedBySlackUserId: string;
+    now?: Date;
+}): Promise<{
+    answered: boolean;
+    queuedProviderEventId: string | null;
+}>;

package/dist/slack-task-policy-schema.d.ts

@@ -772,6 +772,40 @@ export declare const slackSharedTaskOrigins: import("drizzle-orm/pg-core").PgTab
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        policyAccountId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "policy_account_id";
+            tableName: "slack_shared_task_origins";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        policyWorkspaceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "policy_workspace_id";
+            tableName: "slack_shared_task_origins";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         policyHash: import("drizzle-orm/pg-core").PgColumn<{
             name: "policy_hash";
             tableName: "slack_shared_task_origins";

package/dist/slack-task-policy.d.ts

@@ -11,6 +11,14 @@ export type SlackSharedTaskOrigin = {
     sourceThreadTs: string;
     initiatingSlackUserId: string;
     policyRevisionId: string;
+    /**
+     * Home tenancy of the frozen policy revision. The row's own
+     * `accountId`/`workspaceId` are the routed task's, which is a different
+     * workspace once Slack workspace routing is on. Null on rows written before
+     * routing existed, where the two were always equal.
+     */
+    policyAccountId: string | null;
+    policyWorkspaceId: string | null;
     policyHash: string;
     policyActivationVersion: number;
     publicationMode: "never" | "approval_required" | "allow";

package/dist/slack-user-link-access.d.ts

@@ -22,9 +22,32 @@ export type SlackUserLinkAccessMutationInput = {
     expectedVersion: number;
     idempotencyKey: string;
 };
+/**
+ * The Slack team one access request was raised from.
+ *
+ * The public request shape deliberately omits it, but an approver has to
+ * resolve the installation binding to know where the identity link belongs, and
+ * for a routed request that is not the workspace being granted.
+ */
+export declare function slackUserLinkAccessRequestTeam(db: Database, input: {
+    workspaceId: string;
+    requestId: string;
+}): Promise<{
+    slackTeamId: string;
+    connectionId: string;
+} | null>;
+/**
+ * The tenancy an identity link belongs to. See `withSlackIdentityHomeScope`.
+ */
+export type SlackIdentityHome = {
+    accountId: string;
+    workspaceId: string;
+};
 export type ApproveSlackUserLinkAccessInput = SlackUserLinkAccessMutationInput & {
     role?: string;
     permissions: Permission[];
+    /** The installation's tenancy, when it differs from the routed request's. */
+    identityHome?: SlackIdentityHome;
 };
 /**
  * Persist one verified Slack bearer as token-free, subject-bound state. A
@@ -36,6 +59,8 @@ export declare function getSlackUserLinkAccessRequestForSubject(db: Database, in
     workspaceId: string;
     requestId: string;
     subjectId: string;
+    /** The installation's tenancy, when it differs from the routed request's. */
+    identityHome?: SlackIdentityHome;
 }, now?: Date): Promise<SlackUserLinkAccessRequest | null>;
 export declare function requestSlackUserLinkWorkspaceAccess(db: Database, input: SlackUserLinkAccessMutationInput, now?: Date): Promise<SlackUserLinkAccessRequest>;
 export declare function cancelSlackUserLinkAccessRequest(db: Database, input: SlackUserLinkAccessMutationInput, now?: Date): Promise<SlackUserLinkAccessRequest>;
@@ -50,5 +75,8 @@ export declare function completeSlackUserLinkAccessIfGranted(db: Database, input
     workspaceId: string;
     requestId: string;
     subjectId: string;
+    /** The installation's tenancy, when it differs from the routed request's. */
+    identityHome?: SlackIdentityHome;
 }, now?: Date): Promise<SlackUserLinkAccessRequest | null>;
 export declare function listPendingSlackUserLinkAccessRequests(db: Database, workspaceId: string, now?: Date): Promise<SlackUserLinkAccessRequest[]>;
+export declare function workspaceMembershipPermissionsAllowSlackLink(value: unknown): boolean;