@opengeni/db 1.0.1 → 3.2.0-canary.0

package/drizzle/0241_enrollment_agent_runtime.sql

@@ -0,0 +1,70 @@
+-- deployment-mode: rolling
+-- Persist the exact running Connected Machine build/capabilities and one
+-- authoritative self-update state. Progress is fenced to the process connection
+-- generation that accepted it; completion is confirmed by the successor Hello.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+ALTER TABLE "enrollments"
+  ADD COLUMN "agent_version" text,
+  ADD COLUMN "agent_binary_sha256" text,
+  ADD COLUMN "agent_update_channel" text,
+  ADD COLUMN "agent_capabilities" jsonb NOT NULL DEFAULT '{}'::jsonb,
+  ADD COLUMN "agent_update_operation_id" uuid,
+  ADD COLUMN "agent_update_status" text,
+  ADD COLUMN "agent_update_target_version" text,
+  ADD COLUMN "agent_update_expected_binary_sha256" text,
+  ADD COLUMN "agent_update_error_code" text,
+  ADD COLUMN "agent_update_retryable" boolean NOT NULL DEFAULT false,
+  ADD COLUMN "agent_update_rolled_back" boolean NOT NULL DEFAULT false,
+  ADD COLUMN "agent_update_connection_instance_id" text,
+  ADD COLUMN "agent_update_connection_generation" integer,
+  ADD COLUMN "agent_update_requested_at" timestamptz,
+  ADD COLUMN "agent_update_updated_at" timestamptz,
+  ADD COLUMN "agent_update_completed_at" timestamptz;
+
+ALTER TABLE "enrollments"
+  ADD CONSTRAINT "enrollments_agent_binary_sha256_chk" CHECK (
+    "agent_binary_sha256" IS NULL OR "agent_binary_sha256" ~ '^[0-9a-f]{64}$'
+  ) NOT VALID,
+  ADD CONSTRAINT "enrollments_agent_update_channel_chk" CHECK (
+    "agent_update_channel" IS NULL OR "agent_update_channel" IN ('stable', 'beta')
+  ) NOT VALID,
+  ADD CONSTRAINT "enrollments_agent_update_expected_binary_sha256_chk" CHECK (
+    "agent_update_expected_binary_sha256" IS NULL
+      OR "agent_update_expected_binary_sha256" ~ '^[0-9a-f]{64}$'
+  ) NOT VALID,
+  ADD CONSTRAINT "enrollments_agent_update_state_shape_chk" CHECK (
+    ("agent_update_operation_id" IS NULL
+      AND "agent_update_status" IS NULL
+      AND "agent_update_target_version" IS NULL
+      AND "agent_update_connection_instance_id" IS NULL
+      AND "agent_update_connection_generation" IS NULL
+      AND "agent_update_requested_at" IS NULL
+      AND "agent_update_updated_at" IS NULL)
+    OR
+    ("agent_update_operation_id" IS NOT NULL
+      AND "agent_update_status" IN (
+        'requested', 'accepted', 'waiting_for_idle', 'downloading', 'verifying',
+        'applying', 'restarting', 'succeeded', 'failed'
+      )
+      AND "agent_update_target_version" IS NOT NULL
+      AND "agent_update_connection_instance_id" IS NOT NULL
+      AND "agent_update_connection_generation" IS NOT NULL
+      AND "agent_update_connection_generation" >= 0
+      AND "agent_update_requested_at" IS NOT NULL
+      AND "agent_update_updated_at" IS NOT NULL)
+  ) NOT VALID;
+
+ALTER TABLE "enrollments"
+  VALIDATE CONSTRAINT "enrollments_agent_binary_sha256_chk";
+ALTER TABLE "enrollments"
+  VALIDATE CONSTRAINT "enrollments_agent_update_channel_chk";
+ALTER TABLE "enrollments"
+  VALIDATE CONSTRAINT "enrollments_agent_update_expected_binary_sha256_chk";
+ALTER TABLE "enrollments"
+  VALIDATE CONSTRAINT "enrollments_agent_update_state_shape_chk";
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0244_slack_app_home_refresh_queue.sql

@@ -0,0 +1,120 @@
+-- deployment-mode: rolling
+-- Durable, coalesced, per-user Slack App Home refreshes. Signed Events API
+-- ingress records only bounded provider identifiers and acknowledges before
+-- host authorization, task projection, or Slack views.publish network work.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+CREATE TABLE "slack_app_home_refreshes" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "connection_id" uuid NOT NULL REFERENCES "connections"("id") ON DELETE CASCADE,
+  "slack_team_id" text NOT NULL,
+  "slack_user_id" text NOT NULL,
+  "provider_event_id" text NOT NULL,
+  "provider_view_hash" text,
+  "desired_revision" integer NOT NULL DEFAULT 1,
+  "processed_revision" integer NOT NULL DEFAULT 0,
+  "claim_holder_id" uuid,
+  "claim_expires_at" timestamptz,
+  "attempt_count" integer NOT NULL DEFAULT 0,
+  "retry_at" timestamptz,
+  "last_error_code" text,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "slack_app_home_refreshes_connection_user_uq"
+    UNIQUE ("connection_id", "slack_user_id"),
+  CONSTRAINT "slack_app_home_refreshes_workspace_account_fk"
+    FOREIGN KEY ("workspace_id", "account_id")
+    REFERENCES "workspaces"("id", "account_id") ON DELETE CASCADE,
+  CONSTRAINT "slack_app_home_refreshes_bounds_check"
+    CHECK (
+      octet_length("slack_team_id") BETWEEN 1 AND 64
+      AND octet_length("slack_user_id") BETWEEN 1 AND 64
+      AND octet_length("provider_event_id") BETWEEN 1 AND 256
+      AND ("provider_view_hash" IS NULL
+        OR octet_length("provider_view_hash") BETWEEN 1 AND 256)
+      AND ("last_error_code" IS NULL
+        OR octet_length("last_error_code") BETWEEN 1 AND 128)
+    ),
+  CONSTRAINT "slack_app_home_refreshes_revisions_check"
+    CHECK (
+      "desired_revision" > 0
+      AND "processed_revision" >= 0
+      AND "processed_revision" <= "desired_revision"
+      AND "attempt_count" >= 0
+    ),
+  CONSTRAINT "slack_app_home_refreshes_claim_check"
+    CHECK (("claim_holder_id" IS NULL) = ("claim_expires_at" IS NULL))
+);
+
+CREATE INDEX "slack_app_home_refreshes_pending_idx"
+  ON "slack_app_home_refreshes" ("retry_at", "updated_at", "id")
+  WHERE "processed_revision" < "desired_revision";
+
+ALTER TABLE "slack_app_home_refreshes" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "slack_app_home_refreshes" FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY workspace_isolation ON "slack_app_home_refreshes"
+  USING (opengeni_private.workspace_rls_visible("account_id", "workspace_id"))
+  WITH CHECK (opengeni_private.workspace_rls_visible("account_id", "workspace_id"));
+
+DO $privileged_functions$
+DECLARE data_schema text := current_schema();
+BEGIN
+  EXECUTE format($ddl$
+    CREATE OR REPLACE FUNCTION opengeni_private.claim_slack_app_home_refresh(
+      p_holder uuid,
+      p_lease_ms integer
+    )
+    RETURNS SETOF %1$I.slack_app_home_refreshes
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    BEGIN
+      IF p_lease_ms < 1000 OR p_lease_ms > 300000 THEN
+        RAISE EXCEPTION 'invalid Slack App Home claim lease';
+      END IF;
+      RETURN QUERY
+      WITH candidate AS (
+        SELECT refresh.id
+        FROM %1$I.slack_app_home_refreshes refresh
+        WHERE refresh.processed_revision < refresh.desired_revision
+          AND (refresh.retry_at IS NULL OR refresh.retry_at <= now())
+          AND (refresh.claim_holder_id IS NULL OR refresh.claim_expires_at <= now())
+        ORDER BY refresh.retry_at NULLS FIRST, refresh.updated_at, refresh.id
+        FOR UPDATE SKIP LOCKED
+        LIMIT 1
+      )
+      UPDATE %1$I.slack_app_home_refreshes refresh
+      SET claim_holder_id = p_holder,
+          claim_expires_at = now() + make_interval(secs => p_lease_ms::double precision / 1000),
+          retry_at = NULL,
+          attempt_count = refresh.attempt_count + 1,
+          updated_at = now()
+      FROM candidate
+      WHERE refresh.id = candidate.id
+      RETURNING refresh.*;
+    END
+    $function$
+  $ddl$, data_schema);
+END
+$privileged_functions$;
+
+REVOKE ALL ON FUNCTION opengeni_private.claim_slack_app_home_refresh(uuid, integer) FROM PUBLIC;
+
+DO $runtime_grants$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON "slack_app_home_refreshes" TO opengeni_app;
+    GRANT EXECUTE ON FUNCTION opengeni_private.claim_slack_app_home_refresh(uuid, integer)
+      TO opengeni_app;
+  END IF;
+END
+$runtime_grants$;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0245_model_context_contribution_facts.sql

@@ -0,0 +1,88 @@
+-- deployment-mode: rolling
+-- Persist the existing content-free Company Brain contribution estimate beside
+-- each authoritative model-call fact so Workspace Insights can report it.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+ALTER TABLE "model_call_facts"
+  ADD COLUMN IF NOT EXISTS "context_contributions" jsonb;
+
+CREATE OR REPLACE FUNCTION opengeni_private.model_context_contributions_valid(value jsonb)
+RETURNS boolean
+LANGUAGE plpgsql
+IMMUTABLE
+PARALLEL SAFE
+SET search_path = pg_catalog, public
+AS $$
+DECLARE
+  contribution jsonb;
+  contribution_source text;
+  metric text;
+  seen_sources text[] := ARRAY[]::text[];
+BEGIN
+  IF value IS NULL THEN
+    RETURN true;
+  END IF;
+  IF jsonb_typeof(value) <> 'array'
+    OR jsonb_array_length(value) > 6
+    OR octet_length(value::text) > 8192
+  THEN
+    RETURN false;
+  END IF;
+
+  FOR contribution IN SELECT element FROM jsonb_array_elements(value) AS entries(element)
+  LOOP
+    IF jsonb_typeof(contribution) <> 'object'
+      OR (SELECT count(*) FROM pg_catalog.jsonb_object_keys(contribution)) <> 4
+      OR NOT (contribution ?& ARRAY['source', 'items', 'utf8Bytes', 'estimatedTokens'])
+    THEN
+      RETURN false;
+    END IF;
+
+    contribution_source := contribution->>'source';
+    IF contribution_source NOT IN (
+      'workspace_instruction_policy',
+      'legacy_workspace_instructions',
+      'preference_registry_descriptor',
+      'company_profile',
+      'legacy_memory_v1',
+      'runtime_skill_catalog'
+    ) OR contribution_source = ANY(seen_sources)
+    THEN
+      RETURN false;
+    END IF;
+    seen_sources := array_append(seen_sources, contribution_source);
+
+    FOREACH metric IN ARRAY ARRAY['items', 'utf8Bytes', 'estimatedTokens']
+    LOOP
+      IF jsonb_typeof(contribution->metric) <> 'number'
+        OR contribution->>metric !~ '^(0|[1-9][0-9]{0,15})$'
+        OR (contribution->>metric)::numeric > 9007199254740991
+      THEN
+        RETURN false;
+      END IF;
+    END LOOP;
+  END LOOP;
+  RETURN true;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION opengeni_private.model_context_contributions_valid(jsonb)
+  FROM PUBLIC;
+DO $model_context_contributions_function_grant$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.model_context_contributions_valid(jsonb)
+      TO opengeni_app;
+  END IF;
+END
+$model_context_contributions_function_grant$;
+
+ALTER TABLE "model_call_facts"
+  DROP CONSTRAINT IF EXISTS "model_call_facts_context_contributions_check",
+  ADD CONSTRAINT "model_call_facts_context_contributions_check"
+  CHECK (opengeni_private.model_context_contributions_valid("context_contributions")) NOT VALID;
+
+ALTER TABLE "model_call_facts"
+  VALIDATE CONSTRAINT "model_call_facts_context_contributions_check";

package/drizzle/0246_integration_personal_instance_authority.sql

@@ -0,0 +1,70 @@
+-- deployment-mode: rolling
+-- Bind every personal Integration Facet instance Connection replacement to the
+-- exact current Connection subject. The application also checks this before
+-- its upsert; this trigger is the fail-closed boundary for direct SQL writers.
+
+CREATE OR REPLACE FUNCTION capability_v2_validate_facet_binding()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+DECLARE
+  previous_connection_subject_id text;
+  requested_connection_subject_id text;
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1
+    FROM integration_facet_definitions definition
+    JOIN capability_facet_installations installation
+      ON installation.id = NEW.integration_facet_installation_id
+     AND installation.facet_id = definition.integration_facet_id
+    WHERE definition.id = NEW.facet_definition_id
+      AND installation.account_id = NEW.account_id
+      AND installation.workspace_id = NEW.workspace_id
+  ) THEN
+    RAISE EXCEPTION 'Facet binding does not match its Integration installation or tenant'
+      USING ERRCODE = '23514';
+  END IF;
+
+  IF NEW.connection_id IS NOT NULL AND NOT EXISTS (
+    SELECT 1 FROM connections connection
+    WHERE connection.id = NEW.connection_id
+      AND connection.account_id = NEW.account_id
+      AND connection.workspace_id = NEW.workspace_id
+  ) THEN
+    RAISE EXCEPTION 'Facet binding Connection belongs to another tenant'
+      USING ERRCODE = '23514';
+  END IF;
+
+  IF TG_OP = 'UPDATE'
+    AND OLD.connection_id IS NOT NULL
+    AND NEW.connection_id IS DISTINCT FROM OLD.connection_id
+  THEN
+    SELECT connection.subject_id
+    INTO previous_connection_subject_id
+    FROM connections connection
+    WHERE connection.id = OLD.connection_id
+      AND connection.account_id = OLD.account_id
+      AND connection.workspace_id = OLD.workspace_id;
+    IF NOT FOUND THEN
+      RAISE EXCEPTION 'Personal Integration instance belongs to another subject'
+        USING ERRCODE = '42501';
+    END IF;
+    IF previous_connection_subject_id IS NOT NULL THEN
+      IF NEW.connection_id IS NOT NULL THEN
+        SELECT connection.subject_id
+        INTO requested_connection_subject_id
+        FROM connections connection
+        WHERE connection.id = NEW.connection_id
+          AND connection.account_id = NEW.account_id
+          AND connection.workspace_id = NEW.workspace_id;
+      END IF;
+      IF requested_connection_subject_id IS DISTINCT FROM previous_connection_subject_id THEN
+        RAISE EXCEPTION 'Personal Integration instance Connection ownership cannot be changed'
+          USING ERRCODE = '42501';
+      END IF;
+    END IF;
+  END IF;
+
+  RETURN NEW;
+END;
+$$;