@opengeni/db 3.4.0-canary.2 → 3.5.2-canary.0

package/dist/{chunk-O6FTELKH.js → chunk-FJHEWYV5.js}

@@ -1,11 +1,11 @@
 import {
   withRlsContext
-} from "./chunk-H7MXYG7R.js";
+} from "./chunk-X6T2P3L3.js";
 import {
   sandboxRetainedProcesses,
   sessionBackgroundCommands,
   sessions
-} from "./chunk-C2AFP7SB.js";
+} from "./chunk-6NYKC5DD.js";
 
 // src/session-background-commands.ts
 import { and, desc, eq, inArray, sql } from "drizzle-orm";
@@ -513,4 +513,4 @@ export {
   settleSessionBackgroundCommandForRetainedProcess,
   settleConnectedMachineSessionBackgroundCommand
 };
-//# sourceMappingURL=chunk-O6FTELKH.js.map
+//# sourceMappingURL=chunk-FJHEWYV5.js.map

package/dist/{chunk-ZWRIPCTR.js → chunk-NRGUX3M5.js}

@@ -1,7 +1,7 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-H7MXYG7R.js";
+} from "./chunk-X6T2P3L3.js";
 
 // src/editable-artifacts.ts
 import { createHash } from "crypto";
@@ -3540,4 +3540,4 @@ export {
   PostgresEditableArtifactStore,
   PostgresEditableArtifactLiveReadStore
 };
-//# sourceMappingURL=chunk-ZWRIPCTR.js.map
+//# sourceMappingURL=chunk-NRGUX3M5.js.map

package/dist/{chunk-TRBOWUG3.js → chunk-ORKVXHL2.js}

@@ -5,7 +5,7 @@ import {
   withWorkspaceRls,
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls
-} from "./chunk-H7MXYG7R.js";
+} from "./chunk-X6T2P3L3.js";
 
 // src/session-tenancy.ts
 import { createHash } from "crypto";
@@ -481,4 +481,4 @@ export {
   forkSessionContent,
   replayAppliedSessionFork
 };
-//# sourceMappingURL=chunk-TRBOWUG3.js.map
+//# sourceMappingURL=chunk-ORKVXHL2.js.map

package/dist/{chunk-PYMY3AJW.js → chunk-PERPE2UY.js}

@@ -381,6 +381,49 @@ var CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES = [
   "canonical_human_login_bindings",
   "canonical_human_identity_operations"
 ];
+var MANAGED_AUTH_SESSION_SET_ROUTINES = [
+  "get_canonical_human_exact_login_binding(text, text)",
+  "managed_auth_session_set_authority_state(text)",
+  "managed_auth_session_set_snapshot(text, text, boolean, boolean, boolean)",
+  "managed_auth_session_set_bootstrap(text, text, text, text, uuid, text, bigint, bigint)",
+  "managed_auth_session_set_begin_transaction(text, text, text, uuid, text, bigint, uuid, bigint, text, text, uuid, uuid, text, timestamp with time zone)",
+  "managed_auth_session_set_complete_transaction(text, text, uuid, text, bigint, bigint, uuid, text, text, text)",
+  "managed_auth_session_set_mutate(text, text, uuid, text, bigint, bigint, text, uuid, uuid, uuid, text, text)",
+  "managed_auth_actor_mutation_fence(text, bigint, uuid)",
+  "managed_auth_actor_mutation_lease_acquire(text, bigint, uuid, integer)",
+  "managed_auth_actor_mutation_lease_release(text, uuid)",
+  "managed_auth_actor_mutation_lease_validate(text, bigint, uuid)",
+  "managed_auth_adopted_session_snapshot(text)",
+  "managed_auth_isolated_session_reap(integer)",
+  "managed_auth_expired_session_set_reap(integer)",
+  "managed_auth_session_set_operation_receipt(text, uuid, text, text)"
+];
+var MANAGED_AUTH_SESSION_SET_AUTHORITY_TABLES = [
+  "managed_auth_actor_mutation_leases",
+  "managed_auth_browser_installations",
+  "managed_auth_session_sets",
+  "managed_auth_login_slots",
+  "managed_auth_login_return_intents",
+  "managed_auth_login_transaction_rate_limits",
+  "managed_auth_login_transactions",
+  "managed_auth_session_set_operations"
+];
+var ORGANIZATION_RECOVERY_ROUTINES = [
+  "get_organization_recovery_overview(uuid, text, jsonb, text, text)",
+  "organization_recovery_command(jsonb)"
+];
+var ORGANIZATION_RECOVERY_AUTHORITY_TABLES = [
+  "organization_recovery_approvals",
+  "organization_recovery_command_receipts",
+  "organization_recovery_custodian_acceptances",
+  "organization_recovery_custodians",
+  "organization_recovery_events",
+  "organization_recovery_notification_attempts",
+  "organization_recovery_notification_outbox",
+  "organization_recovery_operations",
+  "organization_recovery_policies",
+  "organization_recovery_policy_heads"
+];
 var SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE = "session_private_actor_visible(uuid, uuid, uuid, text)";
 var SESSION_REFERENCE_VISIBLE_ROUTINE = "session_reference_visible(uuid, uuid, uuid)";
 var TASK_NOTE_CAPABILITY_ROUTINES = [
@@ -551,6 +594,8 @@ var RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES = [
   ...SCOPED_COMPUTE_AUTHORITY_ROUTINES,
   ...SCHEDULED_PERSONAL_RESOURCE_ROUTINES,
   ...CANONICAL_HUMAN_IDENTITY_ROUTINES,
+  ...MANAGED_AUTH_SESSION_SET_ROUTINES,
+  ...ORGANIZATION_RECOVERY_ROUTINES,
   ...TASK_NOTE_CAPABILITY_ROUTINES,
   SESSION_PRIVATE_ACTOR_VISIBLE_ROUTINE,
   SESSION_REFERENCE_VISIBLE_ROUTINE,
@@ -726,6 +771,14 @@ var FORCE_RLS_TABLES = [
   "machine_metrics_latest",
   "machine_metrics_series",
   "machine_removal_operations",
+  "managed_auth_actor_mutation_leases",
+  "managed_auth_browser_installations",
+  "managed_auth_login_return_intents",
+  "managed_auth_login_slots",
+  "managed_auth_login_transaction_rate_limits",
+  "managed_auth_login_transactions",
+  "managed_auth_session_set_operations",
+  "managed_auth_session_sets",
   "memory_slack_publication_configurations",
   "memory_slack_publication_receipts",
   "memory_slack_publications",
@@ -740,6 +793,16 @@ var FORCE_RLS_TABLES = [
   "organization_private_session_setting_events",
   "organization_private_session_settings",
   "organization_profile_events",
+  "organization_recovery_approvals",
+  "organization_recovery_command_receipts",
+  "organization_recovery_custodian_acceptances",
+  "organization_recovery_custodians",
+  "organization_recovery_events",
+  "organization_recovery_notification_attempts",
+  "organization_recovery_notification_outbox",
+  "organization_recovery_operations",
+  "organization_recovery_policies",
+  "organization_recovery_policy_heads",
   "organization_shared_workspace_administration_capabilities",
   "organization_user_resource_authorities",
   "organization_user_resource_grants",
@@ -1201,6 +1264,14 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "host_export_cursor_state",
   "host_export_dead_letters",
   "host_export_outbox",
+  "managed_auth_actor_mutation_leases",
+  "managed_auth_browser_installations",
+  "managed_auth_login_return_intents",
+  "managed_auth_login_slots",
+  "managed_auth_login_transaction_rate_limits",
+  "managed_auth_login_transactions",
+  "managed_auth_session_set_operations",
+  "managed_auth_session_sets",
   "organization_invitation_binding_events",
   "organization_membership_invitations",
   "organization_membership_lifecycle_events",
@@ -1209,6 +1280,16 @@ var PROTECTED_NO_DIRECT_DML_TABLES = [
   "organization_private_session_setting_events",
   "organization_private_session_settings",
   "organization_profile_events",
+  "organization_recovery_approvals",
+  "organization_recovery_command_receipts",
+  "organization_recovery_custodian_acceptances",
+  "organization_recovery_custodians",
+  "organization_recovery_events",
+  "organization_recovery_notification_attempts",
+  "organization_recovery_notification_outbox",
+  "organization_recovery_operations",
+  "organization_recovery_policies",
+  "organization_recovery_policy_heads",
   "organization_shared_workspace_administration_capabilities",
   "organization_user_resource_authorities",
   "organization_user_resource_grants",
@@ -1308,6 +1389,8 @@ function difference(left, right) {
 }
 async function inspectRuntimeDatabasePosture(db, options) {
   const targetSchema = options.targetSchema?.trim() || "public";
+  const targetSchemaCapabilityRoutines = options.targetSchemaCapabilityRoutines ?? RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES;
+  const targetSchemaForbiddenRoutines = options.targetSchemaForbiddenRoutines ?? RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES;
   return await db.transaction(
     async (tx) => {
       const identityRows = resultRows(
@@ -1525,10 +1608,9 @@ async function inspectRuntimeDatabasePosture(db, options) {
             and (p.proname || '(' || pg_catalog.oidvectortypes(p.proargtypes) || ')') = any(
               array[
                 ${sql.join(
-          [
-            ...RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES,
-            ...RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES
-          ].map((name) => sql`${name}`),
+          [...targetSchemaCapabilityRoutines, ...targetSchemaForbiddenRoutines].map(
+            (name) => sql`${name}`
+          ),
           sql`, `
         )}
               ]::text[]
@@ -1617,6 +1699,8 @@ function evaluateRuntimeDatabasePosture(posture, options) {
   const protectedNoDirectDmlTables = new Set(
     options.protectedNoDirectDmlTables ?? (options.protectedTables ? [] : PROTECTED_NO_DIRECT_DML_TABLES)
   );
+  const targetSchemaCapabilityRoutines = options.targetSchemaCapabilityRoutines ?? RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES;
+  const targetSchemaForbiddenRoutines = options.targetSchemaForbiddenRoutines ?? RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES;
   if (identity.currentUser !== expectedRole || identity.sessionUser !== expectedRole) {
     violations.push(
       `runtime identity must be ${expectedRole} (current_user=${identity.currentUser}, session_user=${identity.sessionUser})`
@@ -1737,7 +1821,7 @@ function evaluateRuntimeDatabasePosture(posture, options) {
     if (table.policyCount < 1) violations.push(`table ${tableName} has no RLS policy`);
   }
   const targetSchemaOwner = posture.schemas.find((schema) => schema.name === targetSchema)?.owner;
-  for (const forbiddenRoutine of RUNTIME_TARGET_SCHEMA_FORBIDDEN_ROUTINES) {
+  for (const forbiddenRoutine of targetSchemaForbiddenRoutines) {
     const matches = posture.targetRoutines.filter((routine2) => routine2.name === forbiddenRoutine);
     if (matches.length !== 1) {
       violations.push(
@@ -1764,7 +1848,7 @@ function evaluateRuntimeDatabasePosture(posture, options) {
       violations.push(`PUBLIC has forbidden owner-internal helper ${routine.name}`);
     }
   }
-  for (const expectedRoutine of RUNTIME_TARGET_SCHEMA_CAPABILITY_ROUTINES) {
+  for (const expectedRoutine of targetSchemaCapabilityRoutines) {
     const matches = posture.targetRoutines.filter((routine2) => routine2.name === expectedRoutine);
     if (matches.length !== 1) {
       violations.push(
@@ -2017,6 +2101,42 @@ function evaluateRuntimeDatabasePosture(posture, options) {
           );
         }
       }
+    } else if (ORGANIZATION_RECOVERY_ROUTINES.includes(routine.name)) {
+      const authorityTables = ORGANIZATION_RECOVERY_AUTHORITY_TABLES.filter(
+        (tableName) => tableByName.has(tableName)
+      ).map((tableName) => tableByName.get(tableName));
+      const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+      if (authorityTables.length !== ORGANIZATION_RECOVERY_AUTHORITY_TABLES.length) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} organization recovery authority tables are missing`
+        );
+      } else if (authorityOwners.size !== 1) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+        );
+      } else if (routine.owner !== authorityTables[0].owner) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+        );
+      }
+    } else if (MANAGED_AUTH_SESSION_SET_ROUTINES.includes(routine.name)) {
+      const authorityTables = MANAGED_AUTH_SESSION_SET_AUTHORITY_TABLES.filter(
+        (tableName) => tableByName.has(tableName)
+      ).map((tableName) => tableByName.get(tableName));
+      const authorityOwners = new Set(authorityTables.map((table) => table.owner));
+      if (authorityTables.length !== MANAGED_AUTH_SESSION_SET_AUTHORITY_TABLES.length) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} managed auth session-set authority tables are missing`
+        );
+      } else if (authorityOwners.size !== 1) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} authority table owners do not match: ${authorityTables.map((table) => `${table.name}=${table.owner}`).join(", ")}`
+        );
+      } else if (routine.owner !== authorityTables[0].owner) {
+        violations.push(
+          `target-schema runtime capability ${routine.name} owner ${routine.owner} does not match authority table owner ${authorityTables[0].owner}`
+        );
+      }
     } else if (CANONICAL_HUMAN_IDENTITY_ROUTINES.includes(routine.name)) {
       const authorityTables = CANONICAL_HUMAN_IDENTITY_AUTHORITY_TABLES.filter(
         (tableName) => tableByName.has(tableName)
@@ -3183,6 +3303,27 @@ async function grantAppRoleIfSchemaExists(sql2, role, schema) {
     "finalize_organization_retention_deletion(uuid,uuid,uuid,text)",
     "complete_organization_retention_deletion(uuid,uuid,uuid,text)"
   ].map(literal).join(", ")}]`;
+  const managedAuthSessionSetRoutines = `ARRAY[${[
+    "get_canonical_human_exact_login_binding(text,text)",
+    "managed_auth_session_set_authority_state(text)",
+    "managed_auth_session_set_snapshot(text,text,boolean,boolean,boolean)",
+    "managed_auth_session_set_bootstrap(text,text,text,text,uuid,text,bigint,bigint)",
+    "managed_auth_session_set_begin_transaction(text,text,text,uuid,text,bigint,uuid,bigint,text,text,uuid,uuid,text,timestamp with time zone)",
+    "managed_auth_session_set_complete_transaction(text,text,uuid,text,bigint,bigint,uuid,text,text,text)",
+    "managed_auth_session_set_mutate(text,text,uuid,text,bigint,bigint,text,uuid,uuid,uuid,text,text)",
+    "managed_auth_actor_mutation_fence(text,bigint,uuid)",
+    "managed_auth_actor_mutation_lease_acquire(text,bigint,uuid,integer)",
+    "managed_auth_actor_mutation_lease_release(text,uuid)",
+    "managed_auth_actor_mutation_lease_validate(text,bigint,uuid)",
+    "managed_auth_adopted_session_snapshot(text)",
+    "managed_auth_isolated_session_reap(integer)",
+    "managed_auth_expired_session_set_reap(integer)",
+    "managed_auth_session_set_operation_receipt(text,uuid,text,text)"
+  ].map(literal).join(", ")}]`;
+  const organizationRecoveryRoutines = `ARRAY[${[
+    "get_organization_recovery_overview(uuid,text,jsonb,text,text)",
+    "organization_recovery_command(jsonb)"
+  ].map(literal).join(", ")}]`;
   await sql2.unsafe(`
 DO $$
 DECLARE
@@ -3876,6 +4017,30 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    FOREACH routine_signature IN ARRAY ${managedAuthSessionSetRoutines} LOOP
+      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature)) IS NOT NULL THEN
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC',
+          ${literal(schema)}, routine_signature
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',
+          ${literal(schema)}, routine_signature, ${literal(role)}
+        );
+      END IF;
+    END LOOP;
+    FOREACH routine_signature IN ARRAY ${organizationRecoveryRoutines} LOOP
+      IF to_regprocedure(format('%I.%s', ${literal(schema)}, routine_signature)) IS NOT NULL THEN
+        EXECUTE format(
+          'REVOKE ALL ON FUNCTION %I.%s FROM PUBLIC',
+          ${literal(schema)}, routine_signature
+        );
+        EXECUTE format(
+          'GRANT EXECUTE ON FUNCTION %I.%s TO %I',
+          ${literal(schema)}, routine_signature, ${literal(role)}
+        );
+      END IF;
+    END LOOP;
     -- Migration 0225 creates these target-schema-local session visibility
     -- capabilities before opengeni_app may exist. Re-converge their exact
     -- EXECUTE grants for migrate-then-provision installs without granting
@@ -4821,4 +4986,4 @@ export {
   runtimeDatabaseReadyCheck,
   provisionRoles
 };
-//# sourceMappingURL=chunk-PYMY3AJW.js.map
+//# sourceMappingURL=chunk-PERPE2UY.js.map