@opengeni/db 1.4.5-canary.38533006839001 → 2.0.1

package/dist/attached-browser-devices.d.ts

@@ -18,6 +18,14 @@ export type ReconcileAttachedBrowserInventoryResult = {
     changed: boolean;
     revision: number;
 };
+/** Who is looking at a workspace's attached browsers. Personal (Only me)
+ *  machines show their browsers only to their owner, exactly like the machines
+ *  themselves; for an agent this is the person its turn acts for. */
+export type AttachedBrowserViewer = {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+};
 /** Reconcile one full browser-bridge snapshot. The enrollment row serializes
  *  concurrent heartbeats; a lower revision from the same bridge generation is
  *  ignored, and a replay only refreshes liveness. */
@@ -44,14 +52,10 @@ export declare function disconnectAttachedBrowserDevices(db: Database, input: {
     changed: boolean;
     revision: number;
 }>;
-export declare function listAttachedBrowserDevices(db: Database, input: {
-    accountId: string;
-    workspaceId: string;
+export declare function listAttachedBrowserDevices(db: Database, input: AttachedBrowserViewer & {
     includeDisconnected?: boolean;
 }): Promise<AttachedBrowserDeviceListResponseValue>;
-export declare function getAttachedBrowserDevice(db: Database, input: {
-    accountId: string;
-    workspaceId: string;
+export declare function getAttachedBrowserDevice(db: Database, input: AttachedBrowserViewer & {
     deviceId: string;
 }): Promise<AttachedBrowserDeviceValue>;
 export {};

package/dist/{chunk-V5RB2JM3.js → chunk-3CSN5YUS.js}

@@ -624,7 +624,8 @@ var VAULT_RUNTIME_ROUTINES = [
   "apply_secret_answers(uuid, uuid, jsonb, jsonb)",
   "link_provider_vault(jsonb, jsonb)",
   "provider_vault_sync_target(uuid, jsonb)",
-  "provider_vault_item_ref(uuid, uuid, text, jsonb)"
+  "provider_vault_item_ref(uuid, uuid, text, jsonb)",
+  "provider_connection_home_workspace(uuid)"
 ];
 var VAULT_TABLES = [
   "vaults",
@@ -6481,8 +6482,12 @@ BEGIN
         vault_table text;
       BEGIN
         FOREACH vault_routine IN ARRAY ARRAY[${VAULT_RUNTIME_ROUTINES.map((routine) => literal(routine)).join(", ")}] LOOP
-          EXECUTE format('REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC', ${literal(schema)}, vault_routine);
-          EXECUTE format('GRANT EXECUTE ON FUNCTION %I.%s TO %I', ${literal(schema)}, vault_routine, ${literal(role)});
+          -- Later vault routines arrive with later migrations; runtime posture
+          -- reports any that are missing.
+          IF to_regprocedure(format('%I.%s', ${literal(schema)}, vault_routine)) IS NOT NULL THEN
+            EXECUTE format('REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC', ${literal(schema)}, vault_routine);
+            EXECUTE format('GRANT EXECUTE ON FUNCTION %I.%s TO %I', ${literal(schema)}, vault_routine, ${literal(role)});
+          END IF;
         END LOOP;
         FOREACH vault_table IN ARRAY ARRAY[${VAULT_TABLES.map((table) => literal(table)).join(", ")}] LOOP
           EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.%I FROM %I', ${literal(schema)}, vault_table, ${literal(role)});
@@ -7407,4 +7412,4 @@ export {
   provisionRoles,
   runProvisionRolesCli
 };
-//# sourceMappingURL=chunk-V5RB2JM3.js.map
+//# sourceMappingURL=chunk-3CSN5YUS.js.map