@opengeni/db 1.0.2 → 1.1.0

package/src/runtime-posture.ts

@@ -80,6 +80,12 @@ export const SANDBOX_FILE_PUBLICATION_RUNTIME_ROUTINES = [
   "list_sandbox_file_publications(uuid, uuid, jsonb)",
 ] as const;
 const SANDBOX_FILE_PUBLICATIONS_TABLE = "sandbox_file_publications";
+export const ARTIFACT_PIN_RUNTIME_ROUTINES = [
+  "update_artifact_pin(uuid, uuid, text, text, boolean)",
+  "list_artifact_pins(uuid, uuid)",
+  "list_sandbox_file_publications_pinned(uuid, uuid, jsonb)",
+] as const;
+const ARTIFACT_PINS_TABLE = "artifact_catalog_pins";
 export const SCHEDULED_SLACK_BOT_MESSAGE_RUNTIME_ROUTINES = [
   "prepare_scheduled_slack_bot_message(uuid, uuid, uuid, uuid, uuid, integer, text, text, text)",
   "read_scheduled_slack_bot_message(uuid, uuid, uuid, uuid)",
@@ -1732,7 +1738,6 @@ export type RuntimeDatabasePostureOptions = {
   targetSchemaForbiddenRoutines?: readonly string[];
   /** Frozen binary contract; current callers require both additive Insights capabilities. */
   modelFactCapabilityRoutines?: readonly string[];
-  organizationTenancyCanonicalActivationEnabled?: boolean;
 };
 
 export type RuntimeDatabaseIdentity = {
@@ -1803,6 +1808,8 @@ export type RuntimePrivateTablePosture = {
   truncate?: boolean;
   references?: boolean;
   trigger?: boolean;
+  /** Effective relation ACL privileges not represented by the named flags. */
+  extraPrivileges?: string[];
 };
 
 export type RuntimeDatabasePosture = {
@@ -1816,7 +1823,6 @@ export type RuntimeDatabasePosture = {
   privateTables: RuntimePrivateTablePosture[];
   targetRoutines: RuntimeTargetRoutinePosture[];
   privateRoutines: RuntimeRoutinePosture[];
-  sessionTenancyProductActivationPresent: boolean;
   sessionVariableSetAttachmentsCutoverPresent: boolean;
   claudeSubscriptionPoolActivationPresent: boolean;
 };
@@ -1942,14 +1948,6 @@ export async function inspectRuntimeDatabasePosture(
         bypassRls: identity.rolbypassrls,
       };
 
-      // The forward-only activation receipt outlives topology. Embedded/scoped
-      // deployments must enforce the same environment interlock as standalone
-      // FORCE-RLS deployments, so inspect the value-free predicate before the
-      // scoped catalog fast-path.
-      const activationRows = resultRows<{ activated: boolean }>(
-        await tx.execute(sql`select session_tenancy_any_product_activation() as activated`),
-      );
-      const sessionTenancyProductActivationPresent = activationRows[0]?.activated === true;
       const variableSetCutoverRows = resultRows<{ present: boolean }>(
         await tx.execute(sql`
           select to_regprocedure(
@@ -1980,7 +1978,6 @@ export async function inspectRuntimeDatabasePosture(
           privateTables: [],
           targetRoutines: [],
           privateRoutines: [],
-          sessionTenancyProductActivationPresent,
           sessionVariableSetAttachmentsCutoverPresent,
           claudeSubscriptionPoolActivationPresent,
         };
@@ -2115,6 +2112,7 @@ export async function inspectRuntimeDatabasePosture(
         can_truncate: boolean;
         can_references: boolean;
         can_trigger: boolean;
+        extra_privileges: string[];
       }>(
         await tx.execute(sql`
           select
@@ -2124,25 +2122,31 @@ export async function inspectRuntimeDatabasePosture(
             c.relforcerowsecurity as rls_forced,
             row_security_active(c.oid) as rls_active,
             (select count(*)::int from pg_policy policy where policy.polrelid = c.oid) as policy_count,
-            -- Column-only grants on the inventory stamp are also unsafe; in
-            -- particular INSERT can mint authority without a table grant.
+            -- Column-only grants on capability tables are also unsafe; a pin
+            -- table must remain EXECUTE-only even after column ACL drift.
             (has_table_privilege(current_user, c.oid, 'SELECT') or
-              ((c.relname in ('modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches') or
+              ((c.relname in ('modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}) or
                 c.relname in (select jsonb_array_elements_text(${JSON.stringify(RUNTIME_ALLOWANCE_PRIVATE_TABLES)}::jsonb))) and
                 has_any_column_privilege(current_user, c.oid, 'SELECT'))) as can_select,
             (has_table_privilege(current_user, c.oid, 'INSERT') or
-              ((c.relname in ('modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches') or
+              ((c.relname in ('modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}) or
                 c.relname in (select jsonb_array_elements_text(${JSON.stringify(RUNTIME_ALLOWANCE_PRIVATE_TABLES)}::jsonb))) and
                 has_any_column_privilege(current_user, c.oid, 'INSERT'))) as can_insert,
             (has_table_privilege(current_user, c.oid, 'UPDATE') or
-              ((c.relname in ('modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches') or
+              ((c.relname in ('modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}) or
                 c.relname in (select jsonb_array_elements_text(${JSON.stringify(RUNTIME_ALLOWANCE_PRIVATE_TABLES)}::jsonb))) and
                 has_any_column_privilege(current_user, c.oid, 'UPDATE'))) as can_update,
             has_table_privilege(current_user, c.oid, 'DELETE') as can_delete,
             has_table_privilege(current_user, c.oid, 'TRUNCATE') as can_truncate,
             (has_table_privilege(current_user, c.oid, 'REFERENCES') or
               has_any_column_privilege(current_user, c.oid, 'REFERENCES')) as can_references,
-            has_table_privilege(current_user, c.oid, 'TRIGGER') as can_trigger
+            has_table_privilege(current_user, c.oid, 'TRIGGER') as can_trigger,
+            CASE WHEN c.relname = ${ARTIFACT_PINS_TABLE} THEN ARRAY(
+              SELECT DISTINCT acl.privilege_type FROM aclexplode(coalesce(c.relacl, acldefault('r', c.relowner))) acl
+              WHERE acl.privilege_type NOT IN ('SELECT','INSERT','UPDATE','DELETE','TRUNCATE','REFERENCES','TRIGGER')
+                AND CASE WHEN acl.grantee = 0 THEN true ELSE pg_has_role(current_user, acl.grantee, 'USAGE') END
+              ORDER BY acl.privilege_type
+            ) ELSE ARRAY[]::text[] END AS extra_privileges
           from pg_class c
           join pg_namespace n on n.oid = c.relnamespace
           where n.nspname = 'opengeni_private'
@@ -2156,6 +2160,7 @@ export async function inspectRuntimeDatabasePosture(
               ${SCOPED_COMPUTE_CAPABILITY_TABLE},
               ${CONNECTION_TENANCY_BACKFILL_CAPABILITY_TABLE},
               ${SANDBOX_FILE_PUBLICATIONS_TABLE},
+              ${ARTIFACT_PINS_TABLE},
               ${SCHEDULED_SLACK_BOT_MESSAGES_TABLE},
               ${ORGANIZATION_SIGNUP_USE_CASES_TABLE},
               ${SLACK_FILE_UPLOAD_OPERATIONS_TABLE},
@@ -2193,6 +2198,7 @@ export async function inspectRuntimeDatabasePosture(
         truncate: row.can_truncate,
         references: row.can_references,
         trigger: row.can_trigger,
+        ...(row.extra_privileges?.length ? { extraPrivileges: row.extra_privileges } : {}),
       }));
 
       const targetRoutines = resultRows<{
@@ -2284,7 +2290,6 @@ export async function inspectRuntimeDatabasePosture(
         privateTables,
         targetRoutines,
         privateRoutines,
-        sessionTenancyProductActivationPresent,
         sessionVariableSetAttachmentsCutoverPresent,
         claudeSubscriptionPoolActivationPresent,
       };
@@ -2321,15 +2326,6 @@ export function evaluateRuntimeDatabasePosture(
     violations.push("database is missing the 0352 session Variable Set attachment runtime receipt");
   }
 
-  if (
-    posture.sessionTenancyProductActivationPresent &&
-    options.organizationTenancyCanonicalActivationEnabled !== true
-  ) {
-    violations.push(
-      "session-tenancy product activation is durable but OPENGENI_ORGANIZATION_TENANCY_CANONICAL_ACTIVATION_ENABLED is not true",
-    );
-  }
-
   if (!identity.currentUser || !identity.sessionUser) {
     violations.push("database identity is empty");
   }
@@ -3886,6 +3882,47 @@ export function evaluateRuntimeDatabasePosture(
     }
   }
 
+  const pinTables = posture.privateTables.filter((table) => table.name === ARTIFACT_PINS_TABLE);
+  if (pinTables.length !== 1) {
+    if (!options.protectedTables)
+      violations.push("artifact pin private relation is missing or ambiguous");
+  } else {
+    const table = pinTables[0]!;
+    if (!table.rlsEnabled || !table.rlsForced || !table.rlsActive || (table.policyCount ?? 0) < 1)
+      violations.push("artifact pin relation lacks active FORCE-RLS workspace isolation");
+    if (
+      table.select ||
+      table.insert ||
+      table.update ||
+      table.delete ||
+      table.truncate ||
+      table.references ||
+      table.trigger ||
+      table.extraPrivileges?.length ||
+      table.owner === expectedRole
+    )
+      violations.push("runtime role has forbidden direct artifact pin authority");
+    if (tableByName.get("files")?.owner && table.owner !== tableByName.get("files")!.owner)
+      violations.push("artifact pin owner does not match workspace authority");
+    const quotedSchema = `"${targetSchema.replaceAll('"', '""')}"`;
+    const searchPaths = new Set([
+      `search_path=pg_catalog, ${quotedSchema}, pg_temp`,
+      `search_path=pg_catalog, ${/^[a-z_][a-z0-9_]*$/.test(targetSchema) ? targetSchema : quotedSchema}, pg_temp`,
+    ]);
+    for (const name of ARTIFACT_PIN_RUNTIME_ROUTINES) {
+      const routines = posture.privateRoutines.filter((routine) => routine.name === name);
+      if (
+        routines.length !== 1 ||
+        !routines[0]!.execute ||
+        routines[0]!.publicExecute ||
+        !routines[0]!.securityDefiner ||
+        routines[0]!.owner !== table.owner ||
+        !routines[0]!.configuration?.some((configuration) => searchPaths.has(configuration))
+      )
+        violations.push(`artifact pin capability ${name} is missing or unsafe`);
+    }
+  }
+
   const slackFileUploadTables = posture.privateTables.filter(
     (table) => table.name === SLACK_FILE_UPLOAD_OPERATIONS_TABLE,
   );

package/src/schema.ts

@@ -5870,6 +5870,23 @@ export const sandboxFilePublications = opengeniPrivateSchema.table(
   }),
 );
 
+/** Shared discovery pins; no content or access authority. SQL owns target validation. */
+export const artifactCatalogPins = opengeniPrivateSchema.table(
+  "artifact_catalog_pins",
+  {
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id")
+      .notNull()
+      .references(() => workspaces.id, { onDelete: "cascade" }),
+    kind: text("kind").notNull(),
+    artifactId: text("artifact_id").notNull(),
+    pinnedAt: timestamp("pinned_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    pk: primaryKey({ columns: [table.accountId, table.workspaceId, table.kind, table.artifactId] }),
+  }),
+);
+
 /** Source-session upload fence; never stores file bytes or expiring upload URLs. */
 export const slackFileUploadOperations = opengeniPrivateSchema.table(
   "slack_file_upload_operations",

package/src/session-tenancy.ts

@@ -8,12 +8,13 @@ import {
   rawRows,
   type Database,
   rlsContextForWorkspace,
-  withWorkspaceRls,
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls,
 } from "./database";
 import { nestedPostgresSqlState } from "./persistence-errors";
 
+// Frozen SQL protocol argument: every organization is activated at version 1
+// since migration 0611, but the lifecycle routines still require it explicitly.
 const SESSION_TENANCY_ACTIVATION_VERSION = 1;
 
 export class SessionTenancyConflictError extends Error {
@@ -34,10 +35,16 @@ export class SessionTenancyConflictError extends Error {
   }
 }
 
+/**
+ * The organization's owner/admin Only-me setting does not permit a new private
+ * session (or private transition) in this shared workspace. Activation itself is
+ * universal since migration 0611; the name and the SESSION_TENANCY_NOT_ACTIVATED
+ * wire code are kept for client compatibility.
+ */
 export class SessionTenancyNotActivatedError extends Error {
   readonly name = "SessionTenancyNotActivatedError";
   constructor(options?: ErrorOptions) {
-    super("Session tenancy product surface is not activated for this organization", options);
+    super("Only-me chats are not enabled for this organization", options);
   }
 }
 
@@ -151,23 +158,6 @@ export type ForkSessionContentResult = {
   runtimeEventSequence: number | null;
 };
 
-export async function sessionTenancyProductActivated(
-  db: Database,
-  workspaceId: string,
-): Promise<boolean> {
-  const { accountId } = await rlsContextForWorkspace(db, workspaceId);
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const rows = await rawRows<{ activated: boolean }>(
-      scopedDb,
-      sql`select session_tenancy_product_activated(
-        ${accountId}::uuid,
-        ${SESSION_TENANCY_ACTIVATION_VERSION}
-      ) as activated`,
-    );
-    return rows[0]?.activated === true;
-  });
-}
-
 export async function getPrivateSessionCreatePolicy(
   db: Database,
   input: { workspaceId: string; actorSubjectId: string },
@@ -286,15 +276,6 @@ export async function closePrivateSessionCreateCapability(
   await db.execute(sql`select close_private_session_create_capability(${capabilityId}::uuid)`);
 }
 
-async function assertSessionTenancyProductActivated(
-  db: Database,
-  workspaceId: string,
-): Promise<void> {
-  if (!(await sessionTenancyProductActivated(db, workspaceId))) {
-    throw new SessionTenancyNotActivatedError();
-  }
-}
-
 function mapSessionTenancyPersistenceError(
   error: unknown,
   options: { authorityEpochConflict: boolean },
@@ -420,7 +401,6 @@ export async function transitionSessionVisibility(
   if (!input.operationKey.trim()) throw new Error("operationKey must not be empty");
   const requestHash = canonicalSessionVisibilityTransitionHash(input);
   const { accountId } = await rlsContextForWorkspace(db, input.workspaceId);
-  await assertSessionTenancyProductActivated(db, input.workspaceId);
   try {
     return await withWorkspaceSubjectSessionActivityRls(
       db,
@@ -505,7 +485,6 @@ export async function forkSessionContent(
     throw new Error("Resolved session fork runtime configuration does not match its request");
   }
   const { accountId } = await rlsContextForWorkspace(db, input.sourceWorkspaceId);
-  await assertSessionTenancyProductActivated(db, input.sourceWorkspaceId);
   const requestHash = canonicalSessionForkHash(input);
   try {
     return await withWorkspaceSubjectRls(
@@ -616,7 +595,6 @@ export async function replayAppliedSessionFork(
     throw new Error("The first session fork contract is same-workspace only");
   }
   const { accountId } = await rlsContextForWorkspace(db, input.sourceWorkspaceId);
-  await assertSessionTenancyProductActivated(db, input.sourceWorkspaceId);
   const requestHash = canonicalSessionForkHash(input);
   try {
     return await withWorkspaceSubjectRls(