@opengeni/db 3.2.2 → 3.3.0

package/dist/{chunk-AYZC65QU.js → chunk-CGSINPLW.js}

@@ -1,7 +1,7 @@
 import {
   rawRows,
   withWorkspaceSubjectRls
-} from "./chunk-6UU7OVUN.js";
+} from "./chunk-JTBJGSUZ.js";
 
 // src/connect-attempts.ts
 import { createHash } from "crypto";
@@ -245,4 +245,4 @@ export {
   claimConnectOperation,
   finishConnectOperation
 };
-//# sourceMappingURL=chunk-AYZC65QU.js.map
+//# sourceMappingURL=chunk-CGSINPLW.js.map

package/dist/{chunk-VCJAYIPH.js → chunk-FX2PSMGH.js}

@@ -1,7 +1,7 @@
 import {
   setSubjectRlsContext,
   withRlsContext
-} from "./chunk-6UU7OVUN.js";
+} from "./chunk-JTBJGSUZ.js";
 
 // src/connection-token-resolver.ts
 import {
@@ -863,4 +863,4 @@ export {
   refreshOAuthConnectionCredential,
   isPrivateAddress
 };
-//# sourceMappingURL=chunk-VCJAYIPH.js.map
+//# sourceMappingURL=chunk-FX2PSMGH.js.map

package/dist/{chunk-HMKUJ6NI.js → chunk-HQWXEF77.js}

@@ -566,6 +566,12 @@ var SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_PREDICATE_ROUTINE = "scheduled_person
 var SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_TABLE = "scheduled_personal_resource_capabilities";
 var VARIABLE_SET_CAPABILITY_PREDICATE_ROUTINE = "variable_set_authority_capability_active(text)";
 var VARIABLE_SET_CAPABILITY_TABLE = "variable_set_authority_capabilities";
+var SITE_CANCELLATION_CAPABILITY_TABLE = "site_session_cancellation_capabilities";
+var SITE_CANCELLATION_PREDICATE = "site_session_cancellation_capability_active(uuid, uuid, uuid, uuid)";
+var SITE_CANCELLATION_PRIVATE_ROUTINES = [
+  "begin_site_session_cancellation(uuid, uuid, uuid, uuid)",
+  "end_site_session_cancellation(uuid)"
+];
 var PERSONAL_DOCUMENT_CAPABILITY_PREDICATE_ROUTINE = "personal_document_authority_capability_active(text)";
 var PERSONAL_DOCUMENT_CAPABILITY_TABLE = "personal_document_authority_capabilities";
 var PERSONAL_DOCUMENT_AUTHORITY_ROUTINES = [
@@ -2627,15 +2633,15 @@ async function inspectRuntimeDatabasePosture(db, options) {
             -- Column-only grants on capability tables are also unsafe; a pin
             -- table must remain EXECUTE-only even after column ACL drift.
             (has_table_privilege(current_user, c.oid, 'SELECT') or
-              ((c.relname in ('modal_native_origin_read_capabilities','modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}) or
+              ((c.relname in ('modal_native_origin_read_capabilities','modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}, ${SITE_CANCELLATION_CAPABILITY_TABLE}) or
                 c.relname in (select jsonb_array_elements_text(${JSON.stringify([...RUNTIME_ALLOWANCE_PRIVATE_TABLES, ...RUNTIME_SESSION_USAGE_LIMIT_PRIVATE_TABLES, "session_usage_limit_capabilities"])}::jsonb))) and
                 has_any_column_privilege(current_user, c.oid, 'SELECT'))) as can_select,
             (has_table_privilege(current_user, c.oid, 'INSERT') or
-              ((c.relname in ('modal_native_origin_read_capabilities','modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}) or
+              ((c.relname in ('modal_native_origin_read_capabilities','modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}, ${SITE_CANCELLATION_CAPABILITY_TABLE}) or
                 c.relname in (select jsonb_array_elements_text(${JSON.stringify([...RUNTIME_ALLOWANCE_PRIVATE_TABLES, ...RUNTIME_SESSION_USAGE_LIMIT_PRIVATE_TABLES, "session_usage_limit_capabilities"])}::jsonb))) and
                 has_any_column_privilege(current_user, c.oid, 'INSERT'))) as can_insert,
             (has_table_privilege(current_user, c.oid, 'UPDATE') or
-              ((c.relname in ('modal_native_origin_read_capabilities','modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}) or
+              ((c.relname in ('modal_native_origin_read_capabilities','modal_inventory_read_capabilities','usage_allowance_capabilities','session_import_batches', ${ARTIFACT_PINS_TABLE}, ${SITE_CANCELLATION_CAPABILITY_TABLE}) or
                 c.relname in (select jsonb_array_elements_text(${JSON.stringify([...RUNTIME_ALLOWANCE_PRIVATE_TABLES, ...RUNTIME_SESSION_USAGE_LIMIT_PRIVATE_TABLES, "session_usage_limit_capabilities"])}::jsonb))) and
                 has_any_column_privilege(current_user, c.oid, 'UPDATE'))) as can_update,
             has_table_privilege(current_user, c.oid, 'DELETE') as can_delete,
@@ -2657,6 +2663,7 @@ async function inspectRuntimeDatabasePosture(db, options) {
               ${PERSONAL_RESOURCE_CAPABILITY_TABLE},
               ${SCHEDULED_PERSONAL_RESOURCE_CAPABILITY_TABLE},
               ${VARIABLE_SET_CAPABILITY_TABLE},
+              ${SITE_CANCELLATION_CAPABILITY_TABLE},
               ${VAULT_CAPABILITY_TABLE},
               ${PERSONAL_DOCUMENT_CAPABILITY_TABLE},
               ${DOCUMENT_MIGRATION_CAPABILITY_TABLE},
@@ -2721,7 +2728,8 @@ async function inspectRuntimeDatabasePosture(db, options) {
               from aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) acl
               where acl.grantee = 0 and acl.privilege_type = 'EXECUTE'
             ) as public_execute,
-            p.prosecdef as security_definer
+            p.prosecdef as security_definer,
+            p.proconfig as configuration
           from pg_proc p
           join pg_namespace n on n.oid = p.pronamespace
           where n.nspname = ${targetSchema}
@@ -2729,9 +2737,11 @@ async function inspectRuntimeDatabasePosture(db, options) {
             and (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')') = any(
               array[
                 ${sql.join(
-          [...targetSchemaCapabilityRoutines, ...targetSchemaForbiddenRoutines].map(
-            (name) => sql`${name}`
-          ),
+          [
+            ...targetSchemaCapabilityRoutines,
+            ...targetSchemaForbiddenRoutines,
+            SITE_CANCELLATION_PREDICATE
+          ].map((name) => sql`${name}`),
           sql`, `
         )}
               ]::text[]
@@ -2743,7 +2753,8 @@ async function inspectRuntimeDatabasePosture(db, options) {
         owner: row.owner,
         execute: row.can_execute,
         publicExecute: row.public_execute,
-        securityDefiner: row.security_definer
+        securityDefiner: row.security_definer,
+        configuration: row.configuration
       })).sort((left, right) => left.name.localeCompare(right.name));
       const privateRoutines = resultRows(
         await tx.execute(sql`
@@ -4626,6 +4637,28 @@ function evaluateRuntimeDatabasePosture(posture, options) {
       violations.push("organization usage aggregate capability is missing or unsafe");
     }
   }
+  const siteCancellation = posture.privateTables.find(
+    (table) => table.name === SITE_CANCELLATION_CAPABILITY_TABLE
+  );
+  const siteCancellationPredicate = posture.targetRoutines.filter(
+    (routine) => routine.name === SITE_CANCELLATION_PREDICATE
+  );
+  const siteCancellationRoutines = posture.privateRoutines.filter(
+    (routine) => SITE_CANCELLATION_PRIVATE_ROUTINES.includes(routine.name)
+  );
+  if (!options.protectedTables || siteCancellation || siteCancellationPredicate.length || siteCancellationRoutines.length) {
+    if (!siteCancellation || siteCancellation.owner === expectedRole || siteCancellation.owner !== tableByName.get("sessions")?.owner || siteCancellation.select || siteCancellation.insert || siteCancellation.update || siteCancellation.delete || siteCancellation.truncate || siteCancellation.references || siteCancellation.trigger)
+      violations.push("Site cancellation capability ledger is missing or unsafe");
+    const predicate = siteCancellationPredicate[0];
+    if (siteCancellationPredicate.length !== 1 || !predicate?.securityDefiner || !predicate.execute || !predicate.publicExecute || predicate.owner !== siteCancellation?.owner || !predicate.configuration?.includes("search_path=pg_catalog"))
+      violations.push("Site cancellation policy predicate is missing or unsafe");
+    for (const name of SITE_CANCELLATION_PRIVATE_ROUTINES) {
+      const matches = siteCancellationRoutines.filter((routine2) => routine2.name === name);
+      const routine = matches[0];
+      if (matches.length !== 1 || !routine?.securityDefiner || !routine.execute || routine.publicExecute || routine.owner !== siteCancellation?.owner || !(name.startsWith("end_") ? routine.configuration?.includes("search_path=pg_catalog") : safeSearchPath(routine)))
+        violations.push(`Site cancellation routine ${name} is missing or unsafe`);
+    }
+  }
   const modelCallFactsOwner = tableByName.get("model_call_facts")?.owner;
   const modelFactCapabilityRoutines = new Set(
     options.modelFactCapabilityRoutines ?? MODEL_FACT_CAPABILITY_ROUTINES.map(([name]) => name)
@@ -7086,6 +7119,21 @@ BEGIN
       REVOKE ALL ON FUNCTION opengeni_private.insights_raw_amount_inputs(uuid,uuid,timestamptz,timestamptz) FROM PUBLIC;
       REVOKE ALL ON FUNCTION opengeni_private.insights_usage_payer(text,text), opengeni_private.insights_usage_filter(jsonb,jsonb) FROM PUBLIC;
     END IF;
+    IF to_regprocedure('opengeni_private.insights_site_usage(uuid,uuid,timestamptz,timestamptz,text)') IS NOT NULL THEN
+      REVOKE ALL ON FUNCTION opengeni_private.insights_site_usage(uuid,uuid,timestamptz,timestamptz,text) FROM PUBLIC;
+    END IF;
+    IF to_regclass('opengeni_private.site_session_cancellation_capabilities') IS NOT NULL THEN
+      EXECUTE format('REVOKE ALL ON TABLE opengeni_private.site_session_cancellation_capabilities FROM %I', ${literal(role)});
+      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.site_session_cancellation_capabilities FROM %I',
+        (SELECT string_agg(quote_ident(attname),',' ORDER BY attnum) FROM pg_attribute
+          WHERE attrelid='opengeni_private.site_session_cancellation_capabilities'::regclass AND attnum>0 AND NOT attisdropped), ${literal(role)});
+      REVOKE ALL ON TABLE opengeni_private.site_session_cancellation_capabilities FROM PUBLIC;
+      EXECUTE format('REVOKE ALL (%s) ON TABLE opengeni_private.site_session_cancellation_capabilities FROM PUBLIC',
+        (SELECT string_agg(quote_ident(attname),',' ORDER BY attnum) FROM pg_attribute
+          WHERE attrelid='opengeni_private.site_session_cancellation_capabilities'::regclass AND attnum>0 AND NOT attisdropped));
+      REVOKE ALL ON FUNCTION opengeni_private.begin_site_session_cancellation(uuid,uuid,uuid,uuid),
+        opengeni_private.end_site_session_cancellation(uuid) FROM PUBLIC;
+    END IF;
     IF to_regclass('opengeni_private.usage_allowance_capabilities') IS NOT NULL THEN
       EXECUTE format('REVOKE ALL ON TABLE opengeni_private.usage_allowance_capabilities FROM %I', ${literal(role)});
       EXECUTE format('REVOKE ALL (backend_pid,transaction_id,data_schema,account_id,workspace_id) ON TABLE opengeni_private.usage_allowance_capabilities FROM %I', ${literal(role)});
@@ -7455,4 +7503,4 @@ export {
   provisionRoles,
   runProvisionRolesCli
 };
-//# sourceMappingURL=chunk-HMKUJ6NI.js.map
+//# sourceMappingURL=chunk-HQWXEF77.js.map