@opengeni/db 1.0.1 → 3.2.0-canary.0

package/drizzle/0341_slack_routing_probe_organization_fence.sql

@@ -0,0 +1,109 @@
+-- deployment-mode: rolling
+-- Fence both Slack routing tenancy probes on the organization the caller is
+-- acting for.
+--
+-- Neither probe carried an account predicate. Both are SECURITY DEFINER and
+-- both return tenancy ids, so a caller holding another organization's
+-- connection UUID plus a route key or a handle id learned that organization's
+-- account, workspace and interaction ids. Exploitability is low today, because
+-- connection ids are never caller-supplied and the Slack signature check
+-- already fences the team, but the predicate is one line and every sibling
+-- authority routine carries it.
+--
+-- Rolling by expand-and-contract: the fenced three-argument routines are added
+-- alongside the existing two-argument ones rather than replacing them, so an
+-- old image keeps resolving thread continuation and button clicks through the
+-- signature it knows. A later migration drops the unfenced pair once the fleet
+-- is on an image that calls the fenced one; dropping them here would break
+-- every running old worker the moment this commits.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+DO $slack_fenced_interaction_probe$
+DECLARE data_schema text := current_schema();
+BEGIN
+  EXECUTE format($ddl$
+    CREATE FUNCTION opengeni_private.resolve_slack_interaction_tenancy(
+      p_account_id uuid,
+      p_connection_id uuid,
+      p_route_key text
+    )
+    RETURNS TABLE (account_id uuid, workspace_id uuid, interaction_id uuid)
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = %1$I, pg_catalog
+    AS $body$
+    BEGIN
+      IF p_account_id IS NULL OR p_connection_id IS NULL OR p_route_key IS NULL THEN
+        RETURN;
+      END IF;
+      INSERT INTO opengeni_private.slack_routing_runtime_capabilities (
+        backend_pid, transaction_id, capability_kind
+      ) VALUES (
+        pg_catalog.pg_backend_pid(), pg_catalog.pg_current_xact_id(), 'interaction_tenancy'
+      ) ON CONFLICT DO NOTHING;
+      BEGIN
+        RETURN QUERY
+          SELECT I.account_id, I.workspace_id, I.id
+          FROM slack_interactions I
+          WHERE I.account_id = p_account_id
+            AND I.connection_id = p_connection_id
+            AND I.route_key = p_route_key
+          LIMIT 1;
+        DELETE FROM opengeni_private.slack_routing_runtime_capabilities
+        WHERE backend_pid = pg_catalog.pg_backend_pid()
+          AND transaction_id = pg_catalog.pg_current_xact_id_if_assigned()
+          AND capability_kind = 'interaction_tenancy';
+        RETURN;
+      EXCEPTION WHEN OTHERS THEN
+        DELETE FROM opengeni_private.slack_routing_runtime_capabilities
+        WHERE backend_pid = pg_catalog.pg_backend_pid()
+          AND transaction_id = pg_catalog.pg_current_xact_id_if_assigned()
+          AND capability_kind = 'interaction_tenancy';
+        RAISE;
+      END;
+    END;
+    $body$
+  $ddl$, data_schema);
+END
+$slack_fenced_interaction_probe$;
+
+REVOKE ALL ON FUNCTION opengeni_private.resolve_slack_interaction_tenancy(uuid, uuid, text)
+  FROM PUBLIC;
+
+CREATE FUNCTION opengeni_private.resolve_slack_action_handle_tenancy(
+  p_account_id uuid,
+  p_connection_id uuid,
+  p_handle_id uuid
+)
+RETURNS TABLE (account_id uuid, workspace_id uuid)
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = opengeni_private, pg_catalog
+AS $$
+  SELECT T.account_id, T.workspace_id
+  FROM slack_action_handle_tenancy T
+  WHERE T.account_id = p_account_id
+    AND T.handle_id = p_handle_id
+    AND T.connection_id = p_connection_id
+  LIMIT 1
+$$;
+
+REVOKE ALL ON FUNCTION
+  opengeni_private.resolve_slack_action_handle_tenancy(uuid, uuid, uuid) FROM PUBLIC;
+
+DO $grants$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION
+      opengeni_private.resolve_slack_interaction_tenancy(uuid, uuid, text) TO opengeni_app;
+    GRANT EXECUTE ON FUNCTION
+      opengeni_private.resolve_slack_action_handle_tenancy(uuid, uuid, uuid) TO opengeni_app;
+  END IF;
+END
+$grants$;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0342_slack_route_prompt_single_pending.sql

@@ -0,0 +1,32 @@
+-- deployment-mode: rolling
+-- One pending Slack route picker per person per conversation.
+--
+-- `slack_route_prompts` is unique on `(connection_id, inbox_id)` and
+-- `(connection_id, provider_event_id)`, both keyed to the originating event, so
+-- Slack's retries of one event cannot post a second card but two DIFFERENT
+-- messages each open their own. One person would get two cards for the same
+-- question, and answering either would write the route while the other stayed
+-- live and answerable.
+--
+-- The key includes `slack_user_id` on purpose. A shared channel has many people
+-- in it, and asking one of them must not swallow another's request: each person
+-- is asked once. A direct message is already one channel per person, so the same
+-- index covers both surfaces.
+--
+-- Expiry is not part of the predicate, because `now()` is not immutable and a
+-- partial index cannot call it. A timed-out row is settled `expired`
+-- opportunistically by the writer before it opens a new prompt, which is what
+-- keeps a card nobody ever clicked from holding the slot forever.
+--
+-- Rolling and safe to build without CONCURRENTLY: the table has no rows and no
+-- writer until the picker ships in this same change.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+CREATE UNIQUE INDEX "slack_route_prompts_pending_conversation_uq"
+  ON "slack_route_prompts" ("connection_id", "slack_channel_id", "slack_user_id")
+  WHERE "status" = 'pending';
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0343_personal_document_force_rls_lock_repair.sql

@@ -0,0 +1,146 @@
+-- deployment-mode: rolling
+-- Repair the two personal-Document membership reads shipped by 0258. A
+-- row-locking SELECT is also subject to an UPDATE policy; the capability only
+-- grants SELECT, so a real NOSUPERUSER/NOBYPASSRLS migration owner saw zero
+-- memberships and silently selected the legacy workspace-anchored lane.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+-- The checker cannot distinguish the function-body source strings below from
+-- top-level executable membership probes. Keep the migration owner's own
+-- transformation/assertion block inside the house owner-only window; ordinary
+-- runtime roles remain RLS-bound throughout and FORCE is restored atomically.
+ALTER TABLE organization_memberships NO FORCE ROW LEVEL SECURITY;
+
+DO $repair_personal_document_membership_reads$
+DECLARE
+  data_schema text := pg_catalog.current_schema();
+  function_oid regprocedure;
+  definition text;
+  repaired text;
+  old_fragment text;
+  new_fragment text;
+BEGIN
+  function_oid := pg_catalog.to_regprocedure(
+    pg_catalog.format('%I.create_personal_document_authority(uuid,uuid,uuid)', data_schema)
+  );
+  IF function_oid IS NULL THEN
+    RAISE EXCEPTION 'create_personal_document_authority is unavailable for repair'
+      USING ERRCODE = '55000';
+  END IF;
+  definition := pg_catalog.pg_get_functiondef(function_oid);
+  old_fragment := $old$
+      SELECT membership.* INTO member_row
+      FROM organization_memberships membership
+      WHERE membership.account_id = p_account_id
+        AND membership.subject_id = caller_subject
+        AND membership.status = 'active'
+        AND membership.revoked_at IS NULL
+      FOR SHARE;
+$old$;
+  new_fragment := $new$
+      SELECT membership.* INTO member_row
+      FROM organization_memberships membership
+      WHERE membership.account_id = p_account_id
+        AND membership.subject_id = caller_subject
+        AND membership.status = 'active'
+        AND membership.revoked_at IS NULL;
+
+      -- The plain control probe makes a future command/policy mismatch loud.
+      -- With this migration's non-locking read the two predicates are
+      -- identical. If a later revision restores a locking read without its
+      -- exact policy, the capability-visible control row cannot silently fall
+      -- through to the legacy authority lane.
+      IF NOT FOUND AND EXISTS (
+        SELECT 1
+        FROM organization_memberships membership
+        WHERE membership.account_id = p_account_id
+          AND membership.subject_id = caller_subject
+          AND membership.status = 'active'
+          AND membership.revoked_at IS NULL
+      ) THEN
+        RAISE EXCEPTION 'personal document membership read was RLS-blinded'
+          USING ERRCODE = '55000';
+      END IF;
+$new$;
+  repaired := pg_catalog.replace(definition, old_fragment, new_fragment);
+  IF repaired = definition THEN
+    RAISE EXCEPTION 'create_personal_document_authority repair shape changed'
+      USING ERRCODE = '55000';
+  END IF;
+  EXECUTE repaired;
+
+  function_oid := pg_catalog.to_regprocedure(
+    pg_catalog.format(
+      '%I.prepare_session_attempt_personal_document_reads(uuid,uuid,uuid,uuid)',
+      data_schema
+    )
+  );
+  IF function_oid IS NULL THEN
+    RAISE EXCEPTION 'prepare_session_attempt_personal_document_reads is unavailable for repair'
+      USING ERRCODE = '55000';
+  END IF;
+  definition := pg_catalog.pg_get_functiondef(function_oid);
+  old_fragment := $old$
+      SELECT membership.* INTO member_row
+      FROM organization_memberships membership
+      WHERE membership.account_id = p_account_id
+        AND membership.subject_id = initiating_subject
+        AND membership.status = 'active'
+        AND membership.revoked_at IS NULL
+      FOR SHARE;
+$old$;
+  new_fragment := $new$
+      SELECT membership.* INTO member_row
+      FROM organization_memberships membership
+      WHERE membership.account_id = p_account_id
+        AND membership.subject_id = initiating_subject
+        AND membership.status = 'active'
+        AND membership.revoked_at IS NULL;
+
+      IF NOT FOUND AND EXISTS (
+        SELECT 1
+        FROM organization_memberships membership
+        WHERE membership.account_id = p_account_id
+          AND membership.subject_id = initiating_subject
+          AND membership.status = 'active'
+          AND membership.revoked_at IS NULL
+      ) THEN
+        RAISE EXCEPTION 'personal document admission membership read was RLS-blinded'
+          USING ERRCODE = '55000';
+      END IF;
+$new$;
+  repaired := pg_catalog.replace(definition, old_fragment, new_fragment);
+  IF repaired = definition THEN
+    RAISE EXCEPTION 'prepare_session_attempt_personal_document_reads repair shape changed'
+      USING ERRCODE = '55000';
+  END IF;
+
+  -- The later portable-document scan has the same command mismatch: locking
+  -- both documents and authorities makes PostgreSQL require UPDATE-applicable
+  -- policies, while this admission capability is intentionally read-only.
+  -- Snapshot foreign keys take the durable referential pins at insertion.
+  definition := repaired;
+  old_fragment := $old$
+        ORDER BY document_value.id
+        FOR SHARE OF document_value, authority
+$old$;
+  new_fragment := $new$
+        ORDER BY document_value.id
+$new$;
+  repaired := pg_catalog.replace(definition, old_fragment, new_fragment);
+  IF repaired = definition THEN
+    RAISE EXCEPTION 'prepare_session_attempt_personal_document_reads document scan repair shape changed'
+      USING ERRCODE = '55000';
+  END IF;
+  EXECUTE repaired;
+END
+$repair_personal_document_membership_reads$;
+
+ALTER TABLE organization_memberships FORCE ROW LEVEL SECURITY;
+
+COMMENT ON FUNCTION create_personal_document_authority(uuid, uuid, uuid) IS
+  'Creates portable personal Document authority for an exact active organization membership; 0343 removes an RLS-blind row lock and fails loudly on visibility drift.';
+COMMENT ON FUNCTION prepare_session_attempt_personal_document_reads(uuid, uuid, uuid, uuid) IS
+  'Freezes exact-attempt personal Document reads; 0343 removes RLS-blind membership and portable-document row locks and fails loudly on definition or visibility drift.';

package/drizzle/0344_private_session_visibility_transition_gate.sql

@@ -0,0 +1,85 @@
+-- deployment-mode: rolling
+-- A committed visibility transition replays from its applied command receipt
+-- without issuing another sessions UPDATE. Gate the actual state change so
+-- replay remains recoverable after an owner disables private sessions, while a
+-- fresh shared-workspace transition fails closed. Personal workspaces retain
+-- the same exemption as private create and private fork destinations.
+
+-- Migration 0323's settings routines install this marker before reading the
+-- actor membership, but the shared lifecycle policy never admitted it. Keep
+-- this authority narrow and separate from that shared marker list. The UPDATE
+-- policy is required because the mutating seam locks the actor with FOR SHARE.
+DO $organization_private_session_settings_membership_policies$
+DECLARE
+  data_schema text := pg_catalog.current_schema();
+  migration_owner text := current_user;
+  marker constant text :=
+    'current_setting(''opengeni.organization_tenancy_lifecycle'', true) '
+      || '= ''organization_private_session_settings'' AND account_id = nullif('
+      || 'current_setting(''opengeni.account_id'', true), '''')::uuid';
+BEGIN
+  EXECUTE pg_catalog.format(
+    'CREATE POLICY organization_private_session_settings_membership_read '
+      || 'ON %I.organization_memberships FOR SELECT '
+      || 'USING (current_user = %L AND %s)',
+    data_schema, migration_owner, marker
+  );
+  EXECUTE pg_catalog.format(
+    'CREATE POLICY organization_private_session_settings_membership_lock '
+      || 'ON %I.organization_memberships FOR UPDATE '
+      || 'USING (current_user = %L AND %s)',
+    data_schema, migration_owner, marker
+  );
+END
+$organization_private_session_settings_membership_policies$;
+
+CREATE FUNCTION guard_private_session_visibility_transition()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $$
+BEGIN
+  IF OLD.visibility IS DISTINCT FROM NEW.visibility
+    AND NEW.visibility = 'user_private'
+    AND NOT EXISTS (
+      SELECT 1
+      FROM organization_memberships membership
+      WHERE membership.account_id = NEW.account_id
+        AND membership.personal_workspace_id = NEW.workspace_id
+        AND membership.status = 'active'
+    )
+    AND NOT organization_private_sessions_enabled(NEW.account_id)
+  THEN
+    RAISE EXCEPTION
+      'private sessions are not enabled for this organization''s shared workspaces'
+      USING ERRCODE = '55000';
+  END IF;
+  RETURN NEW;
+END
+$$;
+
+REVOKE ALL ON FUNCTION guard_private_session_visibility_transition() FROM PUBLIC;
+
+DROP TRIGGER IF EXISTS session_01_private_visibility_setting_fence ON sessions;
+CREATE TRIGGER session_01_private_visibility_setting_fence
+BEFORE UPDATE OF visibility ON sessions
+FOR EACH ROW
+WHEN (OLD.visibility IS DISTINCT FROM NEW.visibility AND NEW.visibility = 'user_private')
+EXECUTE FUNCTION guard_private_session_visibility_transition();
+
+DO $$
+DECLARE
+  data_schema text := current_schema();
+BEGIN
+  EXECUTE format(
+    'ALTER FUNCTION %I.guard_private_session_visibility_transition() '
+      || 'SET search_path = pg_catalog, %I, pg_temp',
+    data_schema,
+    data_schema
+  );
+END
+$$;
+
+COMMENT ON FUNCTION guard_private_session_visibility_transition() IS
+  'Refuses a fresh transition to user_private in a shared workspace while the organization private-session setting is disabled; applied receipt replay performs no UPDATE and remains valid.';