@opengeni/db 3.1.0-canary.0 → 3.2.0-canary.0

package/dist/{chunk-ZZ5LJEFX.js → chunk-NAB6FKFN.js}

@@ -1,11 +1,11 @@
 import {
   withRlsContext
-} from "./chunk-SCPUJS53.js";
+} from "./chunk-AZHW7R5V.js";
 import {
   sandboxRetainedProcesses,
   sessionBackgroundCommands,
   sessions
-} from "./chunk-PR2WMLOQ.js";
+} from "./chunk-KRLPEMLH.js";
 
 // src/session-background-commands.ts
 import { and, desc, eq, inArray, sql } from "drizzle-orm";
@@ -513,4 +513,4 @@ export {
   settleSessionBackgroundCommandForRetainedProcess,
   settleConnectedMachineSessionBackgroundCommand
 };
-//# sourceMappingURL=chunk-ZZ5LJEFX.js.map
+//# sourceMappingURL=chunk-NAB6FKFN.js.map

package/dist/{chunk-OF5OBB76.js → chunk-UZNXG44K.js}

@@ -248,10 +248,13 @@ var USER_RESOURCE_LIFECYCLE_ROUTINES = [
   "revoke_self_user_resource_grant(uuid, uuid, uuid)",
   "authorize_session_attempt_personal_resource_reads(uuid, uuid, uuid)"
 ];
+var CONNECTION_CONVERGENCE_AUDIT_CAPABILITY_ROUTINE = "connection_authority_convergence_audit_capability_active(uuid)";
 var CONNECTION_AUTHORITY_ROUTINES = [
+  CONNECTION_CONVERGENCE_AUDIT_CAPABILITY_ROUTINE,
   "resolve_personal_connection_authority_selection(uuid, uuid, text, uuid, jsonb)",
   "resolve_accepted_connection_use(uuid, uuid, uuid, uuid, uuid, integer, uuid, text, text, uuid, text, text, text, text)",
-  "resolve_connection_use_authority(uuid, uuid, uuid, jsonb)"
+  "resolve_connection_use_authority(uuid, uuid, uuid, jsonb)",
+  "inspect_organization_connection_authority_convergence(uuid, integer, uuid)"
 ];
 var PERSONAL_GITHUB_REPOSITORY_AUTHORITY_ROUTINES = [
   "get_self_personal_github_repository_selection(uuid, uuid, text, uuid)",
@@ -299,7 +302,14 @@ var DOCUMENT_MIGRATION_CAPABILITY_TABLE = "document_migration_capabilities";
 var DOCUMENT_MIGRATION_AUTHORITY_ROUTINES = [
   "list_document_authority_reclassifications(uuid, uuid, text, uuid, integer, timestamp with time zone, uuid)",
   "reclassify_document_authority(jsonb)",
-  "run_document_default_collection_backfill(jsonb)"
+  "run_document_default_collection_backfill(jsonb)",
+  "list_document_default_collection_backfill_runs(jsonb)",
+  "get_document_default_collection_backfill_audit(jsonb)",
+  "list_organization_document_authority_reclassifications(jsonb)"
+];
+var DOCUMENT_MIGRATION_AUDIT_INTERNAL_ROUTINES = [
+  "document_migration_audit_capability_active(text)",
+  "assert_document_migration_audit_authority(jsonb)"
 ];
 var VARIABLE_SET_AUTHORITY_ROUTINES = [
   "create_scoped_variable_set(uuid, uuid, text, text, text, jsonb, boolean)",
@@ -518,10 +528,17 @@ var RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES = [
   XAI_REVALIDATE_CREDENTIAL_ROUTINE,
   XAI_SNAPSHOT_VALIDATOR_ROUTINE
 ];
+var RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINES = [
+  CONNECTION_CONVERGENCE_AUDIT_CAPABILITY_ROUTINE
+];
+var RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINE_SET = new Set(
+  RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINES
+);
 var RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES = [
   ORGANIZATION_PRIVATE_SESSIONS_ENABLED_ROUTINE,
   SESSION_TENANCY_QUIESCENCE_ROUTINE,
-  TENANCY_BACKFILL_ACTIVATION_EVIDENCE_ROUTINE
+  TENANCY_BACKFILL_ACTIVATION_EVIDENCE_ROUTINE,
+  ...DOCUMENT_MIGRATION_AUDIT_INTERNAL_ROUTINES
 ];
 var RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES = [
   SESSION_REFERENCE_VISIBLE_ROUTINE,
@@ -2035,7 +2052,12 @@ function evaluateRuntimeDatabasePosture(posture, options) {
     if (!routine.execute) {
       violations.push(`runtime role lacks target-schema capability ${routine.name}`);
     }
-    if (routine.publicExecute) {
+    const publicPolicyPredicate = RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINE_SET.has(
+      routine.name
+    );
+    if (publicPolicyPredicate && !routine.publicExecute) {
+      violations.push(`PUBLIC lacks required shared-policy predicate ${routine.name}`);
+    } else if (!publicPolicyPredicate && routine.publicExecute) {
       violations.push(`PUBLIC has forbidden target-schema capability ${routine.name}`);
     }
   }
@@ -3080,6 +3102,7 @@ BEGIN
     FOREACH routine_signature IN ARRAY ARRAY[
       'classify_organization_connection_authority(uuid,text)',
       'backfill_organization_connection_authority(uuid,integer,boolean)',
+      'inspect_organization_connection_authority_convergence(uuid,integer,uuid)',
       'check_organization_tenancy_parity(uuid,integer,integer)'
     ] LOOP
       IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature))
@@ -3093,6 +3116,18 @@ BEGIN
         );
       END IF;
     END LOOP;
+    IF to_regclass(
+      format(
+        '%I.connection_authority_convergence_audit_capabilities',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'REVOKE ALL PRIVILEGES ON TABLE %I.connection_authority_convergence_audit_capabilities FROM %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     -- Migration 0110 creates this target-schema-local SECURITY DEFINER
     -- capability before opengeni_app may exist. Re-converge its exact EXECUTE
     -- grant here so the supported migrate-then-provision order is equivalent to
@@ -4001,6 +4036,21 @@ BEGIN
       EXECUTE format('GRANT SELECT ON TABLE %I.document_authority_reclassifications TO %I', ${literal(schema)}, ${literal(role)});
       EXECUTE format('REVOKE INSERT, UPDATE, DELETE ON TABLE %I.document_authority_reclassifications FROM %I', ${literal(schema)}, ${literal(role)});
       EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.document_default_collection_backfill_runs, %I.document_default_collection_backfill_operations, %I.document_default_collection_backfill_receipts FROM %I', ${literal(schema)}, ${literal(schema)}, ${literal(schema)}, ${literal(role)});
+      IF to_regprocedure(
+        format('%I.list_document_default_collection_backfill_runs(jsonb)', ${literal(schema)})
+      ) IS NOT NULL THEN
+        EXECUTE format('REVOKE ALL ON FUNCTION %I.list_document_default_collection_backfill_runs(jsonb) FROM PUBLIC', ${literal(schema)});
+        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_document_default_collection_backfill_runs(jsonb) TO %I', ${literal(schema)}, ${literal(role)});
+        EXECUTE format('REVOKE ALL ON FUNCTION %I.get_document_default_collection_backfill_audit(jsonb) FROM PUBLIC', ${literal(schema)});
+        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.get_document_default_collection_backfill_audit(jsonb) TO %I', ${literal(schema)}, ${literal(role)});
+        EXECUTE format('REVOKE ALL ON FUNCTION %I.list_organization_document_authority_reclassifications(jsonb) FROM PUBLIC', ${literal(schema)});
+        EXECUTE format('GRANT EXECUTE ON FUNCTION %I.list_organization_document_authority_reclassifications(jsonb) TO %I', ${literal(schema)}, ${literal(role)});
+        EXECUTE format('REVOKE ALL ON FUNCTION %I.document_migration_audit_capability_active(text) FROM PUBLIC', ${literal(schema)});
+        EXECUTE format('REVOKE ALL ON FUNCTION %I.document_migration_audit_capability_active(text) FROM %I', ${literal(schema)}, ${literal(role)});
+        EXECUTE format('REVOKE ALL ON FUNCTION %I.assert_document_migration_audit_authority(jsonb) FROM PUBLIC', ${literal(schema)});
+        EXECUTE format('REVOKE ALL ON FUNCTION %I.assert_document_migration_audit_authority(jsonb) FROM %I', ${literal(schema)}, ${literal(role)});
+        EXECUTE format('REVOKE ALL PRIVILEGES ON TABLE %I.document_migration_audit_capabilities FROM %I', ${literal(schema)}, ${literal(role)});
+      END IF;
     END IF;
     IF to_regprocedure(
       format('%I.create_scoped_variable_set(uuid,uuid,text,text,text,jsonb,boolean)', ${literal(schema)})
@@ -4435,6 +4485,7 @@ if (import.meta.main) {
 
 export {
   RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES,
+  RUNTIME_TARGET_SCHEMA_PUBLIC_POLICY_PREDICATE_ROUTINES,
   RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES,
   RUNTIME_TARGET_SCHEMA_INVOKER_ROUTINES,
   FORCE_RLS_TABLES,
@@ -4454,4 +4505,4 @@ export {
   runtimeDatabaseReadyCheck,
   provisionRoles
 };
-//# sourceMappingURL=chunk-OF5OBB76.js.map
+//# sourceMappingURL=chunk-UZNXG44K.js.map