@opengeni/db 3.2.0-canary.0 → 3.4.0-canary.0

package/drizzle/0356_set_based_insights_session_visibility.sql

@@ -0,0 +1,237 @@
+-- deployment-mode: rolling
+-- Insights scans model_call_facts and usage_events across thousands of rows.
+-- Their ordinary restrictive policies deliberately call
+-- session_reference_visible() for each row, which is correct for point reads
+-- but makes analytical scans execute one nested sessions lookup per fact. Keep
+-- those table policies unchanged for every ordinary caller. These two bounded
+-- read-only functions reproduce the same account/workspace/subject visibility
+-- rule inside one set-based join and expose no data outside the existing fact
+-- shapes. Only roles that already SELECT both fact tables receive EXECUTE.
+DO $set_based_insights_session_visibility_functions$
+DECLARE
+  data_schema text := pg_catalog.current_schema();
+BEGIN
+  EXECUTE pg_catalog.format($ddl$
+    CREATE OR REPLACE FUNCTION opengeni_private.visible_workspace_insights_model_call_facts(
+      p_workspace_id uuid,
+      p_since timestamp with time zone,
+      p_until timestamp with time zone
+    ) RETURNS SETOF %1$I.model_call_facts
+    LANGUAGE plpgsql
+    STABLE
+    SECURITY DEFINER
+    SET search_path = pg_catalog, %1$I, opengeni_private, pg_temp
+    AS $function$
+    DECLARE
+      context_account_id uuid;
+      context_workspace_id uuid;
+      context_subject_id text;
+    BEGIN
+      PERFORM opengeni_private.session_variable_set_attachments_protocol_v1_active();
+      BEGIN
+        context_account_id := nullif(
+          pg_catalog.current_setting('opengeni.account_id', true), ''
+        )::uuid;
+        context_workspace_id := nullif(
+          pg_catalog.current_setting('opengeni.workspace_id', true), ''
+        )::uuid;
+      EXCEPTION WHEN invalid_text_representation THEN
+        RAISE EXCEPTION 'Insights RLS context is malformed'
+          USING ERRCODE = '42501';
+      END;
+      context_subject_id := nullif(
+        pg_catalog.current_setting('opengeni.subject_id', true), ''
+      );
+      IF context_account_id IS NULL
+        OR context_workspace_id IS NULL
+        OR context_workspace_id <> p_workspace_id
+      THEN
+        RAISE EXCEPTION 'Insights RLS context does not match the requested workspace'
+          USING ERRCODE = '42501';
+      END IF;
+      IF p_since IS NULL
+        OR p_until IS NULL
+        OR p_until <= p_since
+        OR (
+          p_until <> 'infinity'::timestamp with time zone
+          AND p_until - p_since > interval '370 days'
+        )
+        OR (
+          p_until = 'infinity'::timestamp with time zone
+          AND p_since < CURRENT_TIMESTAMP - interval '370 days'
+        )
+      THEN
+        RAISE EXCEPTION 'Insights fact window must be positive and at most 370 days'
+          USING ERRCODE = '22023';
+      END IF;
+
+      RETURN QUERY
+      SELECT fact.*
+      FROM %1$I.model_call_facts fact
+      INNER JOIN %1$I.sessions session_row
+        ON session_row.account_id = fact.account_id
+        AND session_row.workspace_id = fact.workspace_id
+        AND session_row.id = fact.session_id
+      WHERE fact.account_id = context_account_id
+        AND fact.workspace_id = p_workspace_id
+        AND fact.occurred_at >= p_since
+        AND fact.occurred_at < p_until
+        AND (
+          context_subject_id IS NULL
+          OR session_row.visibility = 'workspace_shared'
+          OR %1$I.session_private_actor_visible(
+            session_row.account_id,
+            session_row.workspace_id,
+            session_row.owner_organization_membership_id,
+            session_row.owner_subject_id
+          )
+        );
+    END
+    $function$;
+  $ddl$, data_schema);
+
+  EXECUTE pg_catalog.format($ddl$
+    CREATE OR REPLACE FUNCTION opengeni_private.visible_workspace_insights_usage_events(
+      p_workspace_id uuid,
+      p_since timestamp with time zone,
+      p_until timestamp with time zone
+    ) RETURNS SETOF %1$I.usage_events
+    LANGUAGE plpgsql
+    STABLE
+    SECURITY DEFINER
+    SET search_path = pg_catalog, %1$I, opengeni_private, pg_temp
+    AS $function$
+    DECLARE
+      context_account_id uuid;
+      context_workspace_id uuid;
+      context_subject_id text;
+    BEGIN
+      PERFORM opengeni_private.session_variable_set_attachments_protocol_v1_active();
+      BEGIN
+        context_account_id := nullif(
+          pg_catalog.current_setting('opengeni.account_id', true), ''
+        )::uuid;
+        context_workspace_id := nullif(
+          pg_catalog.current_setting('opengeni.workspace_id', true), ''
+        )::uuid;
+      EXCEPTION WHEN invalid_text_representation THEN
+        RAISE EXCEPTION 'Insights RLS context is malformed'
+          USING ERRCODE = '42501';
+      END;
+      context_subject_id := nullif(
+        pg_catalog.current_setting('opengeni.subject_id', true), ''
+      );
+      IF context_account_id IS NULL
+        OR context_workspace_id IS NULL
+        OR context_workspace_id <> p_workspace_id
+      THEN
+        RAISE EXCEPTION 'Insights RLS context does not match the requested workspace'
+          USING ERRCODE = '42501';
+      END IF;
+      IF p_since IS NULL
+        OR p_until IS NULL
+        OR p_until <= p_since
+        OR (
+          p_until <> 'infinity'::timestamp with time zone
+          AND p_until - p_since > interval '370 days'
+        )
+        OR (
+          p_until = 'infinity'::timestamp with time zone
+          AND p_since < CURRENT_TIMESTAMP - interval '370 days'
+        )
+      THEN
+        RAISE EXCEPTION 'Insights fact window must be positive and at most 370 days'
+          USING ERRCODE = '22023';
+      END IF;
+
+      RETURN QUERY
+      SELECT usage_row.*
+      FROM %1$I.usage_events usage_row
+      LEFT JOIN %1$I.sessions session_row
+        ON session_row.account_id = usage_row.account_id
+        AND session_row.workspace_id = usage_row.workspace_id
+        AND session_row.id = usage_row.session_id
+      WHERE usage_row.account_id = context_account_id
+        AND usage_row.workspace_id = p_workspace_id
+        AND usage_row.occurred_at >= p_since
+        AND usage_row.occurred_at < p_until
+        AND (
+          usage_row.session_id IS NULL
+          OR (
+            session_row.id IS NOT NULL
+            AND (
+              context_subject_id IS NULL
+              OR session_row.visibility = 'workspace_shared'
+              OR %1$I.session_private_actor_visible(
+                session_row.account_id,
+                session_row.workspace_id,
+                session_row.owner_organization_membership_id,
+                session_row.owner_subject_id
+              )
+            )
+          )
+        );
+    END
+    $function$;
+  $ddl$, data_schema);
+END
+$set_based_insights_session_visibility_functions$;
+
+REVOKE ALL ON FUNCTION
+  opengeni_private.visible_workspace_insights_model_call_facts(
+    uuid, timestamp with time zone, timestamp with time zone
+  )
+FROM PUBLIC;
+REVOKE ALL ON FUNCTION
+  opengeni_private.visible_workspace_insights_usage_events(
+    uuid, timestamp with time zone, timestamp with time zone
+  )
+FROM PUBLIC;
+
+-- Rolling compatibility is limited to the explicitly configured application
+-- roles. Do not infer application authority from fact-table SELECT: operator,
+-- export, or reporting roles may intentionally lack sessions/private-schema
+-- access even when they can inspect these fact tables through ordinary RLS.
+DO $set_based_insights_session_visibility_grants$
+DECLARE
+  data_schema text := pg_catalog.current_schema();
+  role_name text;
+BEGIN
+  FOR role_name IN
+    SELECT role_row.rolname
+    FROM pg_catalog.jsonb_array_elements_text(
+      pg_catalog.current_setting('opengeni.migration_application_roles')::jsonb
+    ) configured(value)
+    INNER JOIN pg_catalog.pg_roles role_row
+      ON role_row.rolname = configured.value
+    WHERE pg_catalog.has_table_privilege(
+        role_row.rolname,
+        pg_catalog.format('%I.model_call_facts', data_schema),
+        'SELECT'
+      )
+      AND pg_catalog.has_table_privilege(
+        role_row.rolname,
+        pg_catalog.format('%I.usage_events', data_schema),
+        'SELECT'
+      )
+    ORDER BY role_row.rolname COLLATE "C"
+  LOOP
+    EXECUTE pg_catalog.format(
+      'GRANT USAGE ON SCHEMA opengeni_private TO %I',
+      role_name
+    );
+    EXECUTE pg_catalog.format(
+      'GRANT EXECUTE ON FUNCTION '
+        || 'opengeni_private.visible_workspace_insights_model_call_facts('
+        || 'uuid, timestamp with time zone, timestamp with time zone) TO %I',
+      role_name
+    );
+    EXECUTE pg_catalog.format(
+      'GRANT EXECUTE ON FUNCTION '
+        || 'opengeni_private.visible_workspace_insights_usage_events('
+        || 'uuid, timestamp with time zone, timestamp with time zone) TO %I',
+      role_name
+    );
+  END LOOP;
+END
+$set_based_insights_session_visibility_grants$;

package/drizzle/0357_rig_platform_base_only.sql

@@ -0,0 +1,44 @@
+-- deployment-mode: maintenance
+-- Rig definitions may customize setup and checks, but the deployment owns the
+-- sandbox base image. Preserve historical image-bearing rows for audit and
+-- harmless active/provider metadata updates while rejecting every new image
+-- override at the storage boundary.
+
+SET LOCAL lock_timeout = '5s';
+
+CREATE OR REPLACE FUNCTION opengeni_private.enforce_rig_platform_base_only_v1()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $function$
+BEGIN
+  IF TG_OP = 'INSERT' AND NEW.image IS NOT NULL THEN
+    RAISE EXCEPTION
+      'Rig image overrides are unsupported; Rigs use the deployment platform sandbox image'
+      USING ERRCODE = '23514',
+        CONSTRAINT = 'rig_versions_platform_base_only';
+  END IF;
+
+  IF TG_OP = 'UPDATE'
+    AND NEW.image IS NOT NULL
+    AND NEW.image IS DISTINCT FROM OLD.image
+  THEN
+    RAISE EXCEPTION
+      'Rig image overrides are unsupported; Rigs use the deployment platform sandbox image'
+      USING ERRCODE = '23514',
+        CONSTRAINT = 'rig_versions_platform_base_only';
+  END IF;
+
+  RETURN NEW;
+END
+$function$;
+
+REVOKE ALL ON FUNCTION opengeni_private.enforce_rig_platform_base_only_v1() FROM PUBLIC;
+
+CREATE TRIGGER rig_versions_platform_base_only
+BEFORE INSERT OR UPDATE OF image ON rig_versions
+FOR EACH ROW
+EXECUTE FUNCTION opengeni_private.enforce_rig_platform_base_only_v1();
+
+COMMENT ON COLUMN rig_versions.image IS
+  'Legacy audit field only. Runtime ignores it and new non-null values are rejected.';

package/drizzle/0358_pr_review_managed_github_app.sql

@@ -0,0 +1,108 @@
+-- deployment-mode: rolling
+-- A deployment-owned, least-privilege GitHub App can be installed through the
+-- same owner-proof browser flow as the platform App. Workspace registrations
+-- reference that managed identity rather than copying its private key. The
+-- credential-free route table resolves an already-authenticated GitHub
+-- delivery to one exact Pack source and repository binding.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+ALTER TABLE pr_review_app_registrations
+  ADD COLUMN installation_id text,
+  ADD COLUMN provider_account_login text,
+  ADD COLUMN provider_account_type text,
+  ADD COLUMN github_actor_id text,
+  ADD COLUMN authority_kind text,
+  ADD COLUMN authority_checked_at timestamptz,
+  ADD COLUMN authority_expires_at timestamptz,
+  ADD COLUMN authority_nonce text;
+
+ALTER TABLE pr_review_app_registrations
+  DROP CONSTRAINT pr_review_app_registrations_credential_chk;
+
+ALTER TABLE pr_review_app_registrations
+  ADD CONSTRAINT pr_review_app_registrations_credential_chk CHECK (
+    (provider = 'github' AND credential_kind = 'github_app'
+      AND credential_encrypted IS NOT NULL AND app_id IS NOT NULL
+      AND installation_id IS NULL)
+    OR
+    (provider = 'github' AND credential_kind = 'managed_github_app'
+      AND credential_encrypted IS NULL AND app_id IS NOT NULL
+      AND installation_id IS NOT NULL
+      AND provider_account_type IN ('User', 'Organization')
+      AND github_actor_id ~ '^[1-9][0-9]*$'
+      AND authority_kind IN ('personal_owner', 'organization_owner')
+      AND authority_checked_at IS NOT NULL
+      AND authority_expires_at IS NOT NULL
+      AND authority_expires_at > authority_checked_at
+      AND octet_length(authority_nonce) BETWEEN 16 AND 256)
+    OR
+    (provider IN ('gitlab', 'azure_devops') AND credential_kind = 'provider_token'
+      AND credential_encrypted IS NOT NULL AND installation_id IS NULL)
+  );
+
+CREATE UNIQUE INDEX pr_review_managed_github_workspace_installation_uq
+  ON pr_review_app_registrations (workspace_id, installation_id)
+  WHERE credential_kind = 'managed_github_app';
+
+CREATE UNIQUE INDEX pr_review_managed_github_authority_nonce_uq
+  ON pr_review_app_registrations (authority_nonce)
+  WHERE authority_nonce IS NOT NULL;
+
+-- Append-only consumption receipts keep every successful OAuth state
+-- single-use even after the registration advances to a newer authority proof.
+CREATE TABLE pr_review_managed_github_authority_nonces (
+  authority_nonce text PRIMARY KEY,
+  account_id uuid NOT NULL REFERENCES managed_accounts(id) ON DELETE CASCADE,
+  workspace_id uuid NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  installation_id text NOT NULL,
+  authority_expires_at timestamptz NOT NULL,
+  consumed_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  CONSTRAINT pr_review_managed_github_authority_nonces_workspace_account_fk
+    FOREIGN KEY (workspace_id, account_id)
+    REFERENCES workspaces(id, account_id) ON DELETE CASCADE,
+  CONSTRAINT pr_review_managed_github_authority_nonces_identity_chk CHECK (
+    octet_length(authority_nonce) BETWEEN 16 AND 256
+    AND installation_id ~ '^[1-9][0-9]*$'
+    AND authority_expires_at > consumed_at
+  )
+);
+
+ALTER TABLE pr_review_managed_github_authority_nonces ENABLE ROW LEVEL SECURITY;
+ALTER TABLE pr_review_managed_github_authority_nonces FORCE ROW LEVEL SECURITY;
+CREATE POLICY pr_review_managed_github_authority_nonces_tenant
+  ON pr_review_managed_github_authority_nonces
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+-- Credential-free global routing only. The shared webhook secret is verified
+-- over the bounded raw body before these provider ids are parsed or resolved;
+-- the FORCE-RLS source, trigger, Pack installation, and binding remain the
+-- acceptance and dispatch authorities.
+CREATE TABLE pr_review_managed_github_routes (
+  binding_id uuid PRIMARY KEY REFERENCES pr_review_repository_bindings(id) ON DELETE CASCADE,
+  account_id uuid NOT NULL REFERENCES managed_accounts(id) ON DELETE CASCADE,
+  workspace_id uuid NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  registration_id uuid NOT NULL,
+  source_id uuid NOT NULL,
+  installation_id text NOT NULL,
+  provider_repository_id text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT pr_review_managed_github_routes_workspace_account_fk
+    FOREIGN KEY (workspace_id, account_id)
+    REFERENCES workspaces(id, account_id) ON DELETE CASCADE,
+  CONSTRAINT pr_review_managed_github_routes_registration_fk
+    FOREIGN KEY (workspace_id, registration_id)
+    REFERENCES pr_review_app_registrations(workspace_id, id) ON DELETE CASCADE,
+  CONSTRAINT pr_review_managed_github_routes_source_fk
+    FOREIGN KEY (workspace_id, source_id)
+    REFERENCES automation_sources(workspace_id, id) ON DELETE CASCADE,
+  CONSTRAINT pr_review_managed_github_routes_identity_chk CHECK (
+    installation_id ~ '^[1-9][0-9]*$'
+    AND provider_repository_id ~ '^[1-9][0-9]*$'
+  )
+);
+
+CREATE UNIQUE INDEX pr_review_managed_github_route_identity_uq
+  ON pr_review_managed_github_routes (installation_id, provider_repository_id);