@opengeni/db 3.4.0-canary.2 → 3.6.0

package/drizzle/0366_session_discovery_title_search_index.sql

@@ -0,0 +1,5 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE INDEX CONCURRENTLY IF NOT EXISTS sessions_discovery_title_fts_idx
+  ON sessions USING gin (to_tsvector('simple', title))
+  WHERE title IS NOT NULL;

package/drizzle/0367_session_discovery_goal_search_index.sql

@@ -0,0 +1,5 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE INDEX CONCURRENTLY IF NOT EXISTS session_goals_discovery_active_text_fts_idx
+  ON session_goals USING gin (to_tsvector('simple', text))
+  WHERE status = 'active';

package/drizzle/0368_session_discovery_claim_search_index.sql

@@ -0,0 +1,6 @@
+-- deployment-mode: rolling
+-- opengeni:concurrent-index lock-timeout=5s
+CREATE INDEX CONCURRENTLY IF NOT EXISTS session_work_claims_discovery_text_fts_idx
+  ON session_work_claims USING gin (
+    to_tsvector('simple', canonical_key || ' ' || coalesce(display_label, ''))
+  );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "3.4.0-canary.2",
+  "version": "3.6.0",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -51,6 +51,10 @@
       "types": "./dist/canonical-human-identities.d.ts",
       "import": "./dist/canonical-human-identities.js"
     },
+    "./managed-auth-session-sets": {
+      "types": "./dist/managed-auth-session-sets.d.ts",
+      "import": "./dist/managed-auth-session-sets.js"
+    },
     "./session-tenancy": {
       "types": "./dist/session-tenancy.d.ts",
       "import": "./dist/session-tenancy.js"
@@ -74,11 +78,11 @@
     "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/codemode": "^0.4.15-canary.2",
-    "@opengeni/codex": "^0.2.19-canary.3",
-    "@opengeni/config": "^0.20.1-canary.2",
-    "@opengeni/contracts": "^2.5.0-canary.2",
-    "@opengeni/network": "^0.2.3-canary.3",
+    "@opengeni/codemode": "^0.4.17",
+    "@opengeni/codex": "^0.2.19",
+    "@opengeni/config": "^0.22.0",
+    "@opengeni/contracts": "^2.7.0",
+    "@opengeni/network": "^0.2.3",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },

package/src/canonical-human-identities.ts

@@ -18,6 +18,37 @@ export type CanonicalHumanSessionAuthority = {
   identityStatus: "active" | "recovery_required" | "disputed" | "disabled";
 };
 
+export type CanonicalHumanExactLoginBinding = {
+  id: string;
+  identityId: string;
+  revision: number;
+  status: "active" | "recovery_pending" | "stale" | "disputed" | "revoked";
+};
+
+export async function getCanonicalHumanExactLoginBindingForAuthUser(
+  db: Database,
+  input: { authUserId: string; providerId: string },
+): Promise<CanonicalHumanExactLoginBinding> {
+  const [row] = await rawRows<{
+    result:
+      | (Omit<CanonicalHumanExactLoginBinding, "revision"> & { revision: number | string })
+      | null;
+  }>(
+    db,
+    sql`
+      select get_canonical_human_exact_login_binding(
+        ${input.authUserId}, ${input.providerId}
+      ) as result
+    `,
+  );
+  if (!row?.result) {
+    throw new CanonicalHumanIdentityAuthorityError(
+      "Authentication did not prove exactly one canonical login binding",
+    );
+  }
+  return { ...row.result, revision: Number(row.result.revision) };
+}
+
 export class CanonicalHumanIdentityConflictError extends Error {
   readonly name = "CanonicalHumanIdentityConflictError";
   readonly code = "CANONICAL_HUMAN_IDENTITY_CONFLICT";
@@ -36,6 +67,15 @@ export class CanonicalHumanIdentityOperationReuseError extends Error {
   }
 }
 
+export class CanonicalHumanIdentityMutationInFlightError extends Error {
+  readonly name = "CanonicalHumanIdentityMutationInFlightError";
+  readonly code = "CANONICAL_HUMAN_IDENTITY_MUTATION_IN_FLIGHT";
+
+  constructor() {
+    super("Another request is still using this browser actor");
+  }
+}
+
 export class CanonicalHumanIdentityNotFoundError extends Error {
   readonly name = "CanonicalHumanIdentityNotFoundError";
 
@@ -65,6 +105,7 @@ function mapSqlError(error: unknown): never {
   const state = nestedPostgresSqlState(error);
   if (state === "40001") throw new CanonicalHumanIdentityConflictError();
   if (state === "23505") throw new CanonicalHumanIdentityOperationReuseError();
+  if (state === "55P03") throw new CanonicalHumanIdentityMutationInFlightError();
   if (state === "P0002") throw new CanonicalHumanIdentityNotFoundError();
   if (state === "42501") {
     throw new CanonicalHumanIdentityAuthorityError(
@@ -111,6 +152,17 @@ export async function ensureCanonicalHumanIdentityForAuthUser(
   db: Database,
   authUserId: string,
 ): Promise<CanonicalHumanSessionAuthority> {
+  try {
+    const existing = await getCanonicalHumanIdentityProjection(db, authUserId);
+    return {
+      identityId: existing.activeIdentity.id,
+      identityRevision: existing.activeIdentity.identityRevision,
+      authRevision: existing.activeIdentity.authRevision,
+      identityStatus: existing.activeIdentity.status,
+    };
+  } catch (error) {
+    if (!(error instanceof CanonicalHumanIdentityNotFoundError)) throw error;
+  }
   const [user] = await rawRows<{ displayName: string }>(
     db,
     sql`
@@ -264,6 +316,11 @@ export type ApplyCanonicalHumanIdentityOperationInput = {
   providerId?: string | null;
   providerAccountId?: string | null;
   reason: string;
+  actorFence?: {
+    authorityHash: string;
+    actorEpoch: string;
+    requestId: string;
+  };
 };
 
 export async function applyCanonicalHumanIdentityOperation(
@@ -271,14 +328,46 @@ export async function applyCanonicalHumanIdentityOperation(
   input: ApplyCanonicalHumanIdentityOperationInput,
 ): Promise<CanonicalHumanIdentityMutationResponseType> {
   try {
-    const [row] = await rawRows<{
-      outcome: CanonicalHumanIdentityMutationOutcome;
-      identityId: string;
-      identityRevision: number | string;
-      authRevision: number | string;
-    }>(
-      db,
-      sql`
+    if (input.actorFence) {
+      return await db.transaction(async (tx) => {
+        const txDb = tx as unknown as Database;
+        await rawRows(
+          txDb,
+          sql`select managed_auth_actor_mutation_fence(
+            ${input.actorFence!.authorityHash}, ${input.actorFence!.actorEpoch}::bigint,
+            ${input.actorFence!.requestId}::uuid
+          )`,
+        );
+        return await applyCanonicalHumanIdentityOperationInner(txDb, input);
+      });
+    }
+    return await applyCanonicalHumanIdentityOperationInner(db, input);
+  } catch (error) {
+    if (
+      error instanceof CanonicalHumanIdentityConflictError ||
+      error instanceof CanonicalHumanIdentityOperationReuseError ||
+      error instanceof CanonicalHumanIdentityMutationInFlightError ||
+      error instanceof CanonicalHumanIdentityNotFoundError ||
+      error instanceof CanonicalHumanIdentityAuthorityError
+    ) {
+      throw error;
+    }
+    mapSqlError(error);
+  }
+}
+
+async function applyCanonicalHumanIdentityOperationInner(
+  db: Database,
+  input: ApplyCanonicalHumanIdentityOperationInput,
+): Promise<CanonicalHumanIdentityMutationResponseType> {
+  const [row] = await rawRows<{
+    outcome: CanonicalHumanIdentityMutationOutcome;
+    identityId: string;
+    identityRevision: number | string;
+    authRevision: number | string;
+  }>(
+    db,
+    sql`
         select
           outcome,
           identity_id as "identityId",
@@ -295,23 +384,12 @@ export async function applyCanonicalHumanIdentityOperation(
           ${input.reason}
         )
       `,
-    );
-    if (!row) throw new CanonicalHumanIdentityNotFoundError();
-    const identity = await getCanonicalHumanIdentityProjection(db, input.authUserId);
-    return CanonicalHumanIdentityMutationResponse.parse({
-      outcome: row.outcome,
-      operationId: input.operationId,
-      identity,
-    });
-  } catch (error) {
-    if (
-      error instanceof CanonicalHumanIdentityConflictError ||
-      error instanceof CanonicalHumanIdentityOperationReuseError ||
-      error instanceof CanonicalHumanIdentityNotFoundError ||
-      error instanceof CanonicalHumanIdentityAuthorityError
-    ) {
-      throw error;
-    }
-    mapSqlError(error);
-  }
+  );
+  if (!row) throw new CanonicalHumanIdentityNotFoundError();
+  const identity = await getCanonicalHumanIdentityProjection(db, input.authUserId);
+  return CanonicalHumanIdentityMutationResponse.parse({
+    outcome: row.outcome,
+    operationId: input.operationId,
+    identity,
+  });
 }