@opengeni/db 3.6.0 → 3.7.3-canary.0

package/src/company-profile-agent-policy.ts

@@ -0,0 +1,126 @@
+import {
+  CompanyProfileAgentPolicy,
+  CompanyProfileAgentPolicyMode,
+  type CompanyProfileAgentPolicy as CompanyProfileAgentPolicyType,
+  type CompanyProfileAgentPolicyMode as CompanyProfileAgentPolicyModeType,
+} from "@opengeni/contracts";
+import { sql } from "drizzle-orm";
+import { rawRows, withRlsContext, withSessionRlsActorContext, type Database } from "./database";
+import { nestedPostgresSqlState } from "./persistence-errors";
+
+export class CompanyProfileAgentPolicyError extends Error {
+  readonly name = "CompanyProfileAgentPolicyError";
+
+  constructor(
+    readonly code: "authority_unavailable" | "policy_conflict" | "operation_reused" | "invalid",
+    message: string,
+    options?: ErrorOptions,
+  ) {
+    super(message, options);
+  }
+}
+
+function translate(error: unknown): never {
+  const state = nestedPostgresSqlState(error);
+  if (state === "42501") {
+    throw new CompanyProfileAgentPolicyError(
+      "authority_unavailable",
+      "An active organization owner is required to manage company-profile agent autonomy.",
+      { cause: error },
+    );
+  }
+  if (state === "40001") {
+    throw new CompanyProfileAgentPolicyError(
+      "policy_conflict",
+      "The company-profile agent policy changed in another request. Reload and try again.",
+      { cause: error },
+    );
+  }
+  if (state === "23505" || state === "P1851") {
+    throw new CompanyProfileAgentPolicyError(
+      "operation_reused",
+      "The company-profile agent policy operation id was already used for different input.",
+      { cause: error },
+    );
+  }
+  if (state === "22023" || state === "23514" || state === "55000") {
+    throw new CompanyProfileAgentPolicyError(
+      "invalid",
+      "The company-profile agent policy request is invalid.",
+      { cause: error },
+    );
+  }
+  throw error;
+}
+
+async function withHumanPolicyContext<T>(
+  db: Database,
+  input: { accountId: string; workspaceId: string; actorSubjectId: string },
+  fn: (scoped: Database) => Promise<T>,
+): Promise<T> {
+  return await withSessionRlsActorContext({ subjectId: input.actorSubjectId }, async () =>
+    withRlsContext(
+      db,
+      { accountId: input.accountId, workspaceId: input.workspaceId },
+      async (scoped) => {
+        await scoped.execute(
+          sql`select set_config('opengeni.principal_kind', 'human_session', true)`,
+        );
+        return await fn(scoped);
+      },
+    ),
+  );
+}
+
+export async function getCompanyProfileAgentPolicy(
+  db: Database,
+  input: { accountId: string; workspaceId: string; actorSubjectId: string },
+): Promise<CompanyProfileAgentPolicyType> {
+  try {
+    return await withHumanPolicyContext(db, input, async (scoped) => {
+      const [row] = await rawRows<{ result: unknown }>(
+        scoped,
+        sql`select get_company_profile_agent_policy(
+          ${input.accountId}::uuid,
+          ${input.workspaceId}::uuid,
+          ${input.actorSubjectId}
+        ) as result`,
+      );
+      return CompanyProfileAgentPolicy.parse(row?.result);
+    });
+  } catch (error) {
+    translate(error);
+  }
+}
+
+export async function updateCompanyProfileAgentPolicy(
+  db: Database,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    actorSubjectId: string;
+    mode: CompanyProfileAgentPolicyModeType;
+    expectedVersion: number;
+    operationId: string;
+  },
+): Promise<CompanyProfileAgentPolicyType> {
+  const mode = CompanyProfileAgentPolicyMode.parse(input.mode);
+  try {
+    return await withHumanPolicyContext(db, input, async (scoped) => {
+      const [row] = await rawRows<{ result: unknown }>(
+        scoped,
+        sql`select update_company_profile_agent_policy(
+          ${input.accountId}::uuid,
+          ${input.workspaceId}::uuid,
+          ${input.actorSubjectId},
+          ${mode},
+          ${input.expectedVersion}::bigint,
+          ${input.operationId}::uuid
+        ) as result`,
+      );
+      return CompanyProfileAgentPolicy.parse(row?.result);
+    });
+  } catch (error) {
+    translate(error);
+  }
+}

package/src/company-profile-schema.ts

@@ -1,10 +1,12 @@
 import { sql } from "drizzle-orm";
 import type {
   CompanyProfileAgentHumanInputPrompt,
+  CompanyProfileAgentPolicyMode,
   CompanyProfileSnapshotEntry,
 } from "@opengeni/contracts";
 import {
   bigint,
+  boolean,
   check,
   index,
   integer,
@@ -111,6 +113,57 @@ export const companyProfileActivationEvents = pgTable(
   }),
 );
 
+export const organizationCompanyProfileAgentPolicies = pgTable(
+  "organization_company_profile_agent_policies",
+  {
+    accountId: uuid("account_id").primaryKey(),
+    mode: text("mode").$type<CompanyProfileAgentPolicyMode>().notNull().default("suggest"),
+    version: bigint("version", { mode: "number" }).notNull().default(0),
+    updatedByMembershipId: uuid("updated_by_membership_id"),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    mode: check(
+      "organization_company_profile_agent_policies_mode_check",
+      sql`${table.mode} in ('off', 'suggest', 'automatic')`,
+    ),
+    version: check(
+      "organization_company_profile_agent_policies_version_check",
+      sql`${table.version} >= 0`,
+    ),
+  }),
+);
+
+export const organizationCompanyProfileAgentPolicyEvents = pgTable(
+  "organization_company_profile_agent_policy_events",
+  {
+    id: uuid("id").primaryKey(),
+    accountId: uuid("account_id").notNull(),
+    actorMembershipId: uuid("actor_membership_id").notNull(),
+    requestedMode: text("requested_mode").$type<CompanyProfileAgentPolicyMode>().notNull(),
+    expectedVersion: bigint("expected_version", { mode: "number" }).notNull(),
+    resultMode: text("result_mode").$type<CompanyProfileAgentPolicyMode>().notNull(),
+    resultVersion: bigint("result_version", { mode: "number" }).notNull(),
+    resultUpdatedAt: timestamp("result_updated_at", { withTimezone: true }).notNull(),
+    changed: boolean("changed").notNull(),
+  },
+  (table) => ({
+    accountTimeline: index("organization_company_profile_agent_policy_events_account_idx").on(
+      table.accountId,
+      table.resultVersion,
+    ),
+    modes: check(
+      "organization_company_profile_agent_policy_events_mode_check",
+      sql`${table.requestedMode} in ('off', 'suggest', 'automatic')
+        and ${table.resultMode} in ('off', 'suggest', 'automatic')`,
+    ),
+    versions: check(
+      "organization_company_profile_agent_policy_events_version_check",
+      sql`${table.expectedVersion} >= 0 and ${table.resultVersion} > 0`,
+    ),
+  }),
+);
+
 export const companyProfileSnapshots = pgTable(
   "company_profile_snapshots",
   {
@@ -164,6 +217,8 @@ export const companyProfileAgentProposalReceipts = pgTable(
     revisionId: uuid("revision_id").notNull(),
     expectedCurrentRevisionId: uuid("expected_current_revision_id"),
     expectedActivationVersion: bigint("expected_activation_version", { mode: "number" }).notNull(),
+    policyMode: text("policy_mode").$type<CompanyProfileAgentPolicyMode>().notNull(),
+    policyVersion: bigint("policy_version", { mode: "number" }).notNull(),
     reason: text("reason").notNull(),
     humanInput: jsonb("human_input").$type<CompanyProfileAgentHumanInputPrompt>().notNull(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -193,7 +248,9 @@ export const companyProfileAgentProposalReceipts = pgTable(
     ),
     generation: check(
       "company_profile_agent_proposals_generation_check",
-      sql`${table.executionGeneration} > 0 and ${table.expectedActivationVersion} >= 0`,
+      sql`${table.executionGeneration} > 0
+        and ${table.expectedActivationVersion} >= 0
+        and ${table.policyVersion} >= 0`,
     ),
     subject: check(
       "company_profile_agent_proposals_subject_check",
@@ -204,6 +261,10 @@ export const companyProfileAgentProposalReceipts = pgTable(
       sql`char_length(btrim(${table.reason})) between 1 and 4096
         and octet_length(convert_to(btrim(${table.reason}), 'UTF8')) <= 16384`,
     ),
+    policyMode: check(
+      "company_profile_agent_proposals_policy_mode_check",
+      sql`${table.policyMode} in ('suggest', 'automatic')`,
+    ),
     humanInputShape: check(
       "company_profile_agent_proposals_human_input_check",
       sql`jsonb_typeof(${table.humanInput}) = 'object'
@@ -261,3 +322,56 @@ export const companyProfileAgentConfirmationReceipts = pgTable(
     ),
   }),
 );
+
+export const companyProfileAgentAutomaticActivationReceipts = pgTable(
+  "company_profile_agent_automatic_activation_receipts",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    operationId: uuid("operation_id").notNull(),
+    inputHash: text("input_hash").notNull(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    sessionId: uuid("session_id").notNull(),
+    turnId: uuid("turn_id").notNull(),
+    activationAttemptId: uuid("activation_attempt_id").notNull(),
+    executionGeneration: integer("execution_generation").notNull(),
+    proposalReceiptId: uuid("proposal_receipt_id").notNull(),
+    proposalRevisionId: uuid("proposal_revision_id").notNull(),
+    initiatingHumanSubjectId: text("initiating_human_subject_id").notNull(),
+    initiatingMembershipId: uuid("initiating_membership_id").notNull(),
+    policyVersion: bigint("policy_version", { mode: "number" }).notNull(),
+    activationEventId: uuid("activation_event_id").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    accountOperation: uniqueIndex(
+      "company_profile_agent_automatic_activations_account_operation_uq",
+    ).on(table.accountId, table.operationId),
+    proposal: uniqueIndex("company_profile_agent_automatic_activations_proposal_uq").on(
+      table.accountId,
+      table.proposalReceiptId,
+    ),
+    activationEvent: uniqueIndex("company_profile_agent_automatic_activations_event_uq").on(
+      table.accountId,
+      table.activationEventId,
+    ),
+    turn: index("company_profile_agent_automatic_activations_turn_idx").on(
+      table.workspaceId,
+      table.sessionId,
+      table.turnId,
+      table.executionGeneration,
+    ),
+    hash: check(
+      "company_profile_agent_automatic_activations_input_hash_check",
+      sql`${table.inputHash} ~ '^[0-9a-f]{64}$'`,
+    ),
+    generation: check(
+      "company_profile_agent_automatic_activations_generation_check",
+      sql`${table.executionGeneration} > 0 and ${table.policyVersion} >= 0`,
+    ),
+    subject: check(
+      "company_profile_agent_automatic_activations_subject_check",
+      sql`octet_length(btrim(${table.initiatingHumanSubjectId})) between 1 and 1024`,
+    ),
+  }),
+);

package/src/database.ts

@@ -374,16 +374,14 @@ export async function setRlsContext(db: Database, context: RlsContext): Promise<
   if (typeof context.accountId !== "string" || context.accountId.trim() === "") {
     throw new Error("setRlsContext: a non-empty accountId is required to establish an RLS context");
   }
-  await db.execute(sql`select set_config('opengeni.account_id', ${context.accountId}, true)`);
-  await db.execute(
-    sql`select set_config('opengeni.workspace_id', ${context.workspaceId ?? ""}, true)`,
-  );
   // Transaction-local writer identity covers supported injected/embedded
   // database handles whose connection-level application_name is host-owned.
   // Standalone createDb connections also carry version receipts in their exact
   // application_name, while old OpenGeni binaries set neither current receipt.
-  await db.execute(sql`select set_config('opengeni.lossless_content_writer', '1', true)`);
   await db.execute(sql`select
+    set_config('opengeni.account_id', ${context.accountId}, true),
+    set_config('opengeni.workspace_id', ${context.workspaceId ?? ""}, true),
+    set_config('opengeni.lossless_content_writer', '1', true),
     set_config('opengeni.sandbox_recovery_protocol_v2', '1', true),
     set_config('opengeni.pending_tool_event_output_v1', '1', true),
     set_config('opengeni.session_variable_set_attachments_v1', '1', true)`);