@opengeni/db 3.6.0 → 3.7.4-canary.0

package/drizzle/0372_ordered_variable_set_runtime_authority.sql

@@ -0,0 +1,287 @@
+-- deployment-mode: rolling
+-- Migration 0352 activated ordered session Variable Set selections and extended
+-- accepted personal-resource grants, but four runtime authorization seams
+-- still consulted only the legacy final-entry `sessions.variable_set_id` alias.
+-- A selected set earlier in `variable_set_ids` could therefore be accepted and
+-- snapshotted correctly, then rejected during materialization or an exact agent
+-- secret read. Keep every public signature, return type, grant, search path, and
+-- audit behavior unchanged while switching those selection checks to the full
+-- ordered session selection.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+DO $repair_ordered_variable_set_runtime_authority$
+DECLARE
+  data_schema text := pg_catalog.current_schema();
+  patch_record record;
+  function_oid regprocedure;
+  definition text;
+  patched text;
+  occurrences integer;
+BEGIN
+  FOR patch_record IN
+    SELECT * FROM (VALUES
+      (
+        'materialize_scoped_variable_set_for_attempt(uuid,uuid,uuid,uuid,uuid,integer,uuid)',
+        'session_value.variable_set_id = variable_set_row.id',
+        'coalesce(session_value.variable_set_ids, ''[]''::jsonb) ? variable_set_row.id::text'
+      ),
+      (
+        'read_scoped_variable_set_secret(uuid,uuid,uuid,text,text,text,uuid,uuid,uuid,integer)',
+        'session_value.variable_set_id = variable_set_row.id',
+        'coalesce(session_value.variable_set_ids, ''[]''::jsonb) ? variable_set_row.id::text'
+      ),
+      (
+        'authorize_session_attempt_personal_resource_reads(uuid,uuid,uuid)',
+        'variable_set.id = session_value.variable_set_id',
+        'coalesce(session_value.variable_set_ids, ''[]''::jsonb) ? variable_set.id::text'
+      )
+    ) AS patches(function_signature, old_anchor, new_anchor)
+  LOOP
+    function_oid := pg_catalog.to_regprocedure(
+      pg_catalog.quote_ident(data_schema) || '.' || patch_record.function_signature
+    );
+    IF function_oid IS NULL THEN
+      RAISE EXCEPTION '0372 required function is unavailable: %',
+        patch_record.function_signature
+        USING ERRCODE = '55000';
+    END IF;
+
+    definition := pg_catalog.pg_get_functiondef(function_oid);
+    occurrences := (
+      pg_catalog.length(definition)
+        - pg_catalog.length(pg_catalog.replace(definition, patch_record.old_anchor, ''))
+    ) / pg_catalog.length(patch_record.old_anchor);
+    IF occurrences <> 1 OR pg_catalog.strpos(definition, patch_record.new_anchor) > 0 THEN
+      RAISE EXCEPTION '0372 ordered Variable Set authority definition drift: %',
+        patch_record.function_signature
+        USING ERRCODE = '55000';
+    END IF;
+
+    patched := pg_catalog.replace(
+      definition,
+      patch_record.old_anchor,
+      patch_record.new_anchor
+    );
+    IF pg_catalog.strpos(patched, patch_record.new_anchor) = 0
+      OR pg_catalog.strpos(patched, patch_record.old_anchor) > 0
+    THEN
+      RAISE EXCEPTION '0372 ordered Variable Set authority patch failed: %',
+        patch_record.function_signature
+        USING ERRCODE = '55000';
+    END IF;
+    EXECUTE patched;
+  END LOOP;
+END
+$repair_ordered_variable_set_runtime_authority$;
+
+-- The direct session-attach lane has no attempt snapshot to resolve. Admit a
+-- user-scoped set only through the exact live owner membership, resource
+-- authority, and session/always grant that accepted work issued for this
+-- session. Every mutable authority row is locked before ciphertext egress so a
+-- concurrent revocation wins before a later attach or attach retry.
+CREATE OR REPLACE FUNCTION materialize_scoped_variable_set_for_session(
+  p_account_id uuid,
+  p_workspace_id uuid,
+  p_session_id uuid,
+  p_variable_set_id uuid
+) RETURNS TABLE (
+  variable_set_id uuid,
+  variable_set_name text,
+  variable_set_description text,
+  authority_scope text,
+  variable_set_generation bigint,
+  variable_name text,
+  value_encrypted text
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $$
+DECLARE
+  selected_row record;
+  variable_set_row workspace_variable_sets%ROWTYPE;
+  session_authority_epoch integer;
+  session_authority_visibility text;
+  session_owner_membership uuid;
+  audit_subject text;
+  causal_human text;
+BEGIN
+  IF p_account_id IS DISTINCT FROM nullif(
+      pg_catalog.current_setting('opengeni.account_id', true), ''
+    )::uuid
+    OR p_workspace_id IS DISTINCT FROM nullif(
+      pg_catalog.current_setting('opengeni.workspace_id', true), ''
+    )::uuid
+  THEN
+    RAISE EXCEPTION 'variable-set session materialization scope mismatch'
+      USING ERRCODE = '42501';
+  END IF;
+
+  audit_subject := coalesce(
+    nullif(pg_catalog.current_setting('opengeni.subject_id', true), ''),
+    'service:session'
+  );
+  causal_human := coalesce(
+    nullif(pg_catalog.current_setting('opengeni.initiating_human_subject_id', true), ''),
+    CASE WHEN audit_subject LIKE 'user:%' THEN audit_subject END
+  );
+
+  INSERT INTO opengeni_private.variable_set_authority_capabilities (
+    backend_pid, transaction_id, capability_kind
+  ) VALUES (pg_catalog.pg_backend_pid(), pg_catalog.pg_current_xact_id(), 'materialize')
+  ON CONFLICT DO NOTHING;
+  INSERT INTO opengeni_private.personal_resource_delegation_capabilities (
+    backend_pid, transaction_id, capability_kind
+  ) VALUES (pg_catalog.pg_backend_pid(), pg_catalog.pg_current_xact_id(), 'resolve')
+  ON CONFLICT DO NOTHING;
+
+  SELECT variable_set AS selected_set,
+    session_value.authority_epoch AS session_epoch,
+    session_value.visibility AS session_visibility,
+    session_value.owner_organization_membership_id AS session_owner_membership
+  INTO STRICT selected_row
+  FROM sessions session_value
+  JOIN workspace_variable_sets variable_set
+    ON variable_set.id = p_variable_set_id
+   AND variable_set.account_id = session_value.account_id
+  WHERE session_value.id = p_session_id
+    AND session_value.account_id = p_account_id
+    AND session_value.workspace_id = p_workspace_id
+    AND coalesce(session_value.variable_set_ids, '[]'::jsonb) ? p_variable_set_id::text
+    AND session_value.status IN (
+      'queued', 'running', 'idle', 'requires_action', 'recovering', 'waiting_capacity'
+    )
+    AND variable_set.status = 'active'
+    AND (
+      variable_set.authority_scope IN ('organization', 'user')
+      OR (
+        variable_set.authority_scope = 'workspace'
+        AND variable_set.workspace_id = p_workspace_id
+      )
+    )
+  FOR SHARE OF session_value, variable_set;
+  variable_set_row := selected_row.selected_set;
+  session_authority_epoch := selected_row.session_epoch;
+  session_authority_visibility := selected_row.session_visibility;
+  session_owner_membership := selected_row.session_owner_membership;
+
+  IF variable_set_row.authority_scope = 'user' THEN
+    PERFORM 1
+    FROM organization_memberships membership
+    JOIN organization_user_resource_authorities authority
+      ON authority.id = variable_set_row.authority_id
+     AND authority.account_id = membership.account_id
+     AND authority.organization_membership_id = membership.id
+     AND authority.resource_kind = 'variable_set'
+     AND authority.resource_id = variable_set_row.id
+     AND authority.origin_workspace_id IS NOT DISTINCT FROM variable_set_row.origin_workspace_id
+     AND authority.generation = variable_set_row.generation
+     AND authority.status = 'active'
+     AND authority.revoked_at IS NULL
+    JOIN organization_user_resource_grants grant_value
+      ON grant_value.account_id = authority.account_id
+     AND grant_value.authority_id = authority.id
+     AND grant_value.owner_organization_membership_id = membership.id
+     AND grant_value.workspace_id = p_workspace_id
+     AND grant_value.action = 'variable_set.use'
+     AND grant_value.context = session_authority_visibility
+     AND grant_value.status = 'active'
+     AND (grant_value.expires_at IS NULL OR grant_value.expires_at > clock_timestamp())
+     AND (
+       (
+         grant_value.mode = 'session'
+         AND grant_value.session_id = p_session_id
+         AND grant_value.authority_epoch = session_authority_epoch
+       )
+       OR (
+         grant_value.mode = 'always'
+         AND grant_value.session_id IS NULL
+         AND grant_value.authority_epoch IS NULL
+       )
+     )
+    WHERE membership.id = variable_set_row.owner_organization_membership_id
+      AND membership.account_id = p_account_id
+      AND membership.subject_id = causal_human
+      AND membership.status = 'active'
+      AND membership.revoked_at IS NULL
+      AND membership.authorization_revision > 0
+      AND (
+        membership.personal_workspace_id = p_workspace_id
+        OR EXISTS (
+          SELECT 1
+          FROM workspace_memberships workspace_membership
+          WHERE workspace_membership.account_id = membership.account_id
+            AND workspace_membership.workspace_id = p_workspace_id
+            AND workspace_membership.subject_id = membership.subject_id
+        )
+      )
+      AND (
+        session_authority_visibility = 'workspace_shared'
+        OR session_owner_membership = membership.id
+      )
+    ORDER BY grant_value.id
+    FOR SHARE OF membership, authority, grant_value;
+    IF NOT FOUND THEN
+      RAISE EXCEPTION 'personal variable-set session grant is not exact or current'
+        USING ERRCODE = '42501';
+    END IF;
+  END IF;
+
+  INSERT INTO audit_events (
+    account_id, workspace_id, subject_id, action, target_type, target_id,
+    metadata, metadata_codec_version
+  ) VALUES (
+    p_account_id, p_workspace_id, audit_subject,
+    'variable_set.materialized', 'workspace_variable_set',
+    variable_set_row.id::text,
+    pg_catalog.jsonb_build_object(
+      'variableSetId', variable_set_row.id,
+      'scope', variable_set_row.authority_scope,
+      'generation', variable_set_row.generation,
+      'actorKind', 'session_attach',
+      'sessionId', p_session_id,
+      'causalHumanSubjectId', causal_human,
+      'authorityEpoch', session_authority_epoch,
+      'authorityVisibility', session_authority_visibility,
+      'authorityOwnerOrganizationMembershipId', session_owner_membership,
+      'ownerAuthorityId', variable_set_row.authority_id,
+      'ownerOrganizationMembershipId', variable_set_row.owner_organization_membership_id,
+      'originWorkspaceId', variable_set_row.origin_workspace_id
+    ),
+    1
+  );
+
+  RETURN QUERY
+  SELECT selected.id, selected.name, selected.description,
+    selected.authority_scope, selected.generation,
+    variable.name, variable.value_encrypted
+  FROM workspace_variable_sets selected
+  LEFT JOIN workspace_variable_set_variables variable
+    ON variable.account_id = selected.account_id
+   AND variable.variable_set_id = selected.id
+  WHERE selected.id = variable_set_row.id
+  ORDER BY variable.name;
+
+  DELETE FROM opengeni_private.personal_resource_delegation_capabilities
+  WHERE backend_pid = pg_catalog.pg_backend_pid()
+    AND transaction_id = pg_catalog.pg_current_xact_id_if_assigned()
+    AND capability_kind = 'resolve';
+  DELETE FROM opengeni_private.variable_set_authority_capabilities
+  WHERE backend_pid = pg_catalog.pg_backend_pid()
+    AND transaction_id = pg_catalog.pg_current_xact_id_if_assigned()
+    AND capability_kind = 'materialize';
+  RETURN;
+EXCEPTION WHEN OTHERS THEN
+  DELETE FROM opengeni_private.personal_resource_delegation_capabilities
+  WHERE backend_pid = pg_catalog.pg_backend_pid()
+    AND transaction_id = pg_catalog.pg_current_xact_id_if_assigned()
+    AND capability_kind = 'resolve';
+  DELETE FROM opengeni_private.variable_set_authority_capabilities
+  WHERE backend_pid = pg_catalog.pg_backend_pid()
+    AND transaction_id = pg_catalog.pg_current_xact_id_if_assigned()
+    AND capability_kind = 'materialize';
+  RAISE;
+END
+$$;

package/drizzle/0373_sandbox_shared_preparation.sql

@@ -0,0 +1,59 @@
+-- deployment-mode: rolling
+-- Durable single-flight coordination for immutable, lease-scoped sandbox setup.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+ALTER TABLE sandbox_leases
+  ADD COLUMN shared_preparation_lease_epoch integer,
+  ADD COLUMN shared_preparation_instance_id text,
+  ADD COLUMN shared_preparation_spec_hash text,
+  ADD COLUMN shared_preparation_status text,
+  ADD COLUMN shared_preparation_claim_id uuid,
+  ADD COLUMN shared_preparation_owner_attempt_id uuid,
+  ADD COLUMN shared_preparation_attempt integer,
+  ADD COLUMN shared_preparation_revision integer NOT NULL DEFAULT 0,
+  ADD COLUMN shared_preparation_started_at timestamptz,
+  ADD COLUMN shared_preparation_deadline_at timestamptz,
+  ADD COLUMN shared_preparation_settled_at timestamptz;
+
+ALTER TABLE sandbox_leases
+  ADD CONSTRAINT sandbox_leases_shared_preparation_check CHECK (
+    (
+      shared_preparation_status IS NULL
+      AND shared_preparation_lease_epoch IS NULL
+      AND shared_preparation_instance_id IS NULL
+      AND shared_preparation_spec_hash IS NULL
+      AND shared_preparation_claim_id IS NULL
+      AND shared_preparation_owner_attempt_id IS NULL
+      AND shared_preparation_attempt IS NULL
+      AND shared_preparation_started_at IS NULL
+      AND shared_preparation_deadline_at IS NULL
+      AND shared_preparation_settled_at IS NULL
+    ) OR (
+      shared_preparation_status IN ('running', 'completed', 'failed')
+      AND shared_preparation_lease_epoch IS NOT NULL
+      AND shared_preparation_lease_epoch >= 0
+      AND nullif(btrim(shared_preparation_instance_id), '') IS NOT NULL
+      AND shared_preparation_spec_hash ~ '^sha256:[0-9a-f]{64}$'
+      AND shared_preparation_claim_id IS NOT NULL
+      AND shared_preparation_owner_attempt_id IS NOT NULL
+      AND shared_preparation_attempt IS NOT NULL
+      AND shared_preparation_attempt > 0
+      AND shared_preparation_started_at IS NOT NULL
+      AND shared_preparation_deadline_at > shared_preparation_started_at
+      AND (
+        (shared_preparation_status = 'running' AND shared_preparation_settled_at IS NULL)
+        OR (shared_preparation_status IN ('completed', 'failed')
+          AND shared_preparation_settled_at IS NOT NULL)
+      )
+    )
+  ) NOT VALID;
+
+ALTER TABLE sandbox_leases
+  VALIDATE CONSTRAINT sandbox_leases_shared_preparation_check;
+
+COMMENT ON COLUMN sandbox_leases.shared_preparation_spec_hash IS
+  'Non-secret immutable setup specification coordinated once for the exact lease epoch and provider instance.';
+COMMENT ON COLUMN sandbox_leases.shared_preparation_revision IS
+  'Monotonic durable join cursor. Waiters treat notifications as hints and always re-read this lease row.';

package/drizzle/0374_session_event_cursors.sql

@@ -0,0 +1,315 @@
+-- deployment-mode: rolling
+-- Phase A of the narrow session-event sequencer: mirror and verify every
+-- committed append before any writer stops using sessions.last_sequence.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+CREATE TABLE session_event_cursors (
+  session_id uuid PRIMARY KEY REFERENCES sessions(id) ON DELETE CASCADE,
+  account_id uuid NOT NULL REFERENCES managed_accounts(id) ON DELETE CASCADE,
+  workspace_id uuid NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  last_sequence integer NOT NULL DEFAULT 0,
+  revision bigint NOT NULL DEFAULT 0,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT session_event_cursors_sequence_check CHECK (last_sequence >= 0),
+  CONSTRAINT session_event_cursors_revision_check CHECK (revision >= 0),
+  CONSTRAINT session_event_cursors_workspace_account_fk
+    FOREIGN KEY (workspace_id, account_id)
+    REFERENCES workspaces(id, account_id)
+    ON DELETE CASCADE,
+  CONSTRAINT session_event_cursors_workspace_session_fk
+    FOREIGN KEY (workspace_id, session_id)
+    REFERENCES sessions(workspace_id, id)
+    ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX session_event_cursors_workspace_session_idx
+  ON session_event_cursors(workspace_id, session_id);
+
+COMMENT ON TABLE session_event_cursors IS
+  'Narrow exact per-session event cursor. Migration 0374 mirrors sessions.last_sequence; a later activation may make this row the allocator and admission gate.';
+COMMENT ON COLUMN session_event_cursors.revision IS
+  'Monotonic count of successful event-insert statements that advanced this cursor.';
+
+ALTER TABLE session_event_cursors ENABLE ROW LEVEL SECURITY;
+ALTER TABLE session_event_cursors FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY workspace_isolation ON session_event_cursors
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+-- The cursor is a direct session reference and must preserve private-session
+-- visibility just like every other FORCE-RLS session-owned runtime table.
+CREATE POLICY session_visibility_isolation ON session_event_cursors AS RESTRICTIVE
+  USING (session_reference_visible(account_id, workspace_id, session_id))
+  WITH CHECK (session_reference_visible(account_id, workspace_id, session_id));
+
+DO $session_event_cursor_owner_policies$
+DECLARE
+  target_schema text := pg_catalog.current_schema();
+  target_schema_oid oid := pg_catalog.current_schema()::pg_catalog.regnamespace;
+  migration_owner text := current_user;
+BEGIN
+  EXECUTE pg_catalog.format(
+    'CREATE POLICY session_tenancy_fence_inventory_read ON %I.session_event_cursors '
+      || 'FOR SELECT USING ('
+      || '%I.session_tenancy_fence_owner_policy_active('
+      || 'current_user, %L, %s::oid, workspace_id, true))',
+    target_schema,
+    target_schema,
+    migration_owner,
+    target_schema_oid
+  );
+  EXECUTE pg_catalog.format(
+    'CREATE POLICY session_tenancy_fenced_owner_write ON %I.session_event_cursors '
+      || 'FOR ALL USING ('
+      || '%I.session_tenancy_fence_owner_policy_active('
+      || 'current_user, %L, %s::oid, workspace_id, false)) '
+      || 'WITH CHECK ('
+      || '%I.session_tenancy_fence_owner_policy_active('
+      || 'current_user, %L, %s::oid, workspace_id, false))',
+    target_schema,
+    target_schema,
+    migration_owner,
+    target_schema_oid,
+    target_schema,
+    migration_owner,
+    target_schema_oid
+  );
+END
+$session_event_cursor_owner_policies$;
+
+-- FORCE RLS remains enabled for runtime roles. Temporarily let the table owner
+-- inspect all existing rows while the migration transaction holds the DDL
+-- locks, then restore FORCE before commit.
+ALTER TABLE sessions NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE session_events NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE session_event_cursors NO FORCE ROW LEVEL SECURITY;
+
+DO $session_event_cursor_parity$
+DECLARE
+  mismatch record;
+BEGIN
+  SELECT
+    sessions.id AS session_id,
+    sessions.last_sequence AS stored_sequence,
+    COUNT(session_events.sequence)::integer AS event_count,
+    MIN(session_events.sequence)::integer AS first_event_sequence,
+    MAX(session_events.sequence)::integer AS last_event_sequence
+  INTO mismatch
+  FROM sessions
+  LEFT JOIN session_events
+    ON session_events.workspace_id = sessions.workspace_id
+   AND session_events.session_id = sessions.id
+  GROUP BY sessions.id, sessions.last_sequence
+  HAVING COUNT(session_events.sequence)::integer <> sessions.last_sequence
+    OR (
+      sessions.last_sequence = 0
+      AND (
+        MIN(session_events.sequence) IS NOT NULL
+        OR MAX(session_events.sequence) IS NOT NULL
+      )
+    )
+    OR (
+      sessions.last_sequence > 0
+      AND (
+        MIN(session_events.sequence)::integer <> 1
+        OR MAX(session_events.sequence)::integer <> sessions.last_sequence
+      )
+    )
+  LIMIT 1;
+
+  IF FOUND THEN
+    RAISE EXCEPTION USING
+      ERRCODE = '55000',
+      MESSAGE = 'session event cursor backfill refused because sessions.last_sequence diverges from durable event history',
+      DETAIL = pg_catalog.format(
+        'session_id=%s stored_sequence=%s event_count=%s first_event_sequence=%s last_event_sequence=%s',
+        mismatch.session_id,
+        mismatch.stored_sequence,
+        mismatch.event_count,
+        mismatch.first_event_sequence,
+        mismatch.last_event_sequence
+      );
+  END IF;
+END
+$session_event_cursor_parity$;
+
+INSERT INTO session_event_cursors (
+  session_id,
+  account_id,
+  workspace_id,
+  last_sequence
+)
+SELECT id, account_id, workspace_id, last_sequence
+FROM sessions;
+
+ALTER TABLE session_event_cursors FORCE ROW LEVEL SECURITY;
+ALTER TABLE session_events FORCE ROW LEVEL SECURITY;
+ALTER TABLE sessions FORCE ROW LEVEL SECURITY;
+
+CREATE FUNCTION initialize_session_event_cursors_for_inserted_sessions()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path FROM CURRENT
+AS $initialize_session_event_cursors$
+BEGIN
+  INSERT INTO session_event_cursors (
+    session_id,
+    account_id,
+    workspace_id,
+    last_sequence
+  )
+  -- A session row must exist before any event can reference it, so a newly
+  -- inserted session has no durable event history yet. Some lifecycle
+  -- functions pre-seed sessions.last_sequence for events they insert later in
+  -- the same transaction; copying that future projection here would make the
+  -- first real event look like a duplicate.
+  SELECT id, account_id, workspace_id, 0
+  FROM inserted_sessions
+  ON CONFLICT (session_id) DO NOTHING;
+  RETURN NULL;
+END
+$initialize_session_event_cursors$;
+
+CREATE TRIGGER sessions_initialize_event_cursors
+AFTER INSERT ON sessions
+REFERENCING NEW TABLE AS inserted_sessions
+FOR EACH STATEMENT
+EXECUTE FUNCTION initialize_session_event_cursors_for_inserted_sessions();
+
+CREATE FUNCTION advance_session_event_cursors_for_inserted_events()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $advance_session_event_cursors$
+DECLARE
+  fenced_access_capability_id uuid;
+  inserted_group record;
+  current_sequence integer;
+BEGIN
+  -- Runtime writers already hold the exact workspace tenancy fence before an
+  -- event insert. Open only the transaction-local owner capability needed for
+  -- this trigger to inspect and advance the FORCE-RLS cursor under that fence.
+  fenced_access_capability_id :=
+    opengeni_private.open_session_tenancy_fenced_access(
+      session_tenancy_fence_target_schema()
+    );
+  FOR inserted_group IN
+    SELECT
+      account_id,
+      workspace_id,
+      session_id,
+      MIN(sequence)::integer AS first_sequence,
+      MAX(sequence)::integer AS last_sequence,
+      COUNT(*)::integer AS sequence_count,
+      COUNT(DISTINCT sequence)::integer AS distinct_sequence_count
+    FROM inserted_session_events
+    GROUP BY account_id, workspace_id, session_id
+    ORDER BY workspace_id, session_id
+  LOOP
+    SELECT last_sequence
+    INTO current_sequence
+    FROM session_event_cursors
+    WHERE account_id = inserted_group.account_id
+      AND workspace_id = inserted_group.workspace_id
+      AND session_id = inserted_group.session_id
+    FOR UPDATE;
+
+    IF NOT FOUND THEN
+      RAISE EXCEPTION USING
+        ERRCODE = '55000',
+        MESSAGE = 'session event cursor is missing for an inserted event',
+        DETAIL = pg_catalog.format(
+          'workspace_id=%s session_id=%s',
+          inserted_group.workspace_id,
+          inserted_group.session_id
+        );
+    END IF;
+
+    IF inserted_group.distinct_sequence_count <> inserted_group.sequence_count
+      OR inserted_group.first_sequence <> current_sequence + 1
+      OR inserted_group.last_sequence <> current_sequence + inserted_group.sequence_count
+    THEN
+      RAISE EXCEPTION USING
+        ERRCODE = '55000',
+        MESSAGE = 'session event insert does not exactly continue the durable cursor',
+        DETAIL = pg_catalog.format(
+          'workspace_id=%s session_id=%s current=%s first=%s last=%s count=%s distinct=%s',
+          inserted_group.workspace_id,
+          inserted_group.session_id,
+          current_sequence,
+          inserted_group.first_sequence,
+          inserted_group.last_sequence,
+          inserted_group.sequence_count,
+          inserted_group.distinct_sequence_count
+        );
+    END IF;
+
+    UPDATE session_event_cursors
+    SET last_sequence = inserted_group.last_sequence,
+        revision = revision + 1,
+        updated_at = now()
+    WHERE account_id = inserted_group.account_id
+      AND workspace_id = inserted_group.workspace_id
+      AND session_id = inserted_group.session_id
+      AND last_sequence = current_sequence;
+
+    IF NOT FOUND THEN
+      RAISE EXCEPTION USING
+        ERRCODE = '40001',
+        MESSAGE = 'session event cursor changed while applying an inserted event statement';
+    END IF;
+  END LOOP;
+  PERFORM opengeni_private.close_session_tenancy_fenced_access(
+    fenced_access_capability_id
+  );
+  RETURN NULL;
+EXCEPTION WHEN OTHERS THEN
+  PERFORM opengeni_private.close_session_tenancy_fenced_access(
+    fenced_access_capability_id
+  );
+  RAISE;
+END
+$advance_session_event_cursors$;
+
+-- Trigger functions may resolve target-schema relations, but pg_temp must not
+-- precede those relations. In particular, the SECURITY DEFINER event trigger
+-- must not be redirected through caller-owned temporary objects.
+DO $session_event_cursor_function_paths$
+DECLARE
+  target_schema text := pg_catalog.current_schema();
+BEGIN
+  EXECUTE pg_catalog.format(
+    'ALTER FUNCTION %I.initialize_session_event_cursors_for_inserted_sessions() '
+      || 'SET search_path = pg_catalog, %I, pg_temp',
+    target_schema,
+    target_schema
+  );
+  EXECUTE pg_catalog.format(
+    'ALTER FUNCTION %I.advance_session_event_cursors_for_inserted_events() '
+      || 'SET search_path = pg_catalog, %I, pg_temp',
+    target_schema,
+    target_schema
+  );
+END
+$session_event_cursor_function_paths$;
+
+REVOKE ALL ON FUNCTION advance_session_event_cursors_for_inserted_events() FROM PUBLIC;
+
+CREATE TRIGGER session_events_advance_event_cursors
+AFTER INSERT ON session_events
+REFERENCING NEW TABLE AS inserted_session_events
+FOR EACH STATEMENT
+EXECUTE FUNCTION advance_session_event_cursors_for_inserted_events();
+
+DO $session_event_cursor_runtime_grants$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON session_event_cursors TO opengeni_app;
+  END IF;
+END
+$session_event_cursor_runtime_grants$;