@opengeni/db 3.6.0 → 3.7.4-canary.0

package/drizzle/0375_session_recovery_observability.sql

@@ -0,0 +1,73 @@
+-- deployment-mode: rolling
+-- Expose one content-free, bounded-cardinality aggregate for durable recovery
+-- states that process-local turn gauges cannot see.
+
+CREATE OR REPLACE FUNCTION opengeni_private.count_session_recovery_backlog()
+RETURNS TABLE (state text, count bigint)
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $count_session_recovery_backlog$
+  WITH recovery_states(state) AS (
+    VALUES ('quiescence_missing'::text), ('projection_stale'::text)
+  ), candidates AS (
+    SELECT CASE
+      WHEN attempt.quiesced_at IS NULL THEN 'quiescence_missing'::text
+      ELSE 'projection_stale'::text
+    END AS state
+    FROM sessions session
+    JOIN session_turns turn
+      ON turn.workspace_id = session.workspace_id
+     AND turn.session_id = session.id
+     AND turn.id = session.active_turn_id
+    JOIN LATERAL (
+      SELECT candidate.id, candidate.state, candidate.outcome, candidate.quiesced_at
+      FROM session_turn_attempts candidate
+      WHERE candidate.workspace_id = turn.workspace_id
+        AND candidate.session_id = turn.session_id
+        AND candidate.turn_id = turn.id
+      ORDER BY candidate.execution_generation DESC, candidate.updated_at DESC, candidate.id DESC
+      LIMIT 1
+    ) attempt ON true
+    WHERE session.status = 'recovering'
+      AND turn.status = 'recovering'
+      AND turn.active_attempt_id IS NULL
+      AND attempt.state = 'closed'
+      AND attempt.outcome = 'interrupted_recoverable'
+      AND (
+        EXISTS (
+          SELECT 1
+          FROM session_attempt_interruptions interruption
+          WHERE interruption.workspace_id = session.workspace_id
+            AND interruption.session_id = session.id
+            AND interruption.attempt_id = attempt.id
+            AND interruption.state IN ('settled', 'rejected_stale')
+        )
+        OR EXISTS (
+          SELECT 1
+          FROM session_events event
+          WHERE event.workspace_id = session.workspace_id
+            AND event.session_id = session.id
+            AND event.turn_id = turn.id
+            AND event.turn_attempt_id = attempt.id
+            AND event.type = 'turn.recovery.requested'
+        )
+      )
+  )
+  SELECT recovery_states.state, count(candidates.state)::bigint
+  FROM recovery_states
+  LEFT JOIN candidates USING (state)
+  GROUP BY recovery_states.state
+  ORDER BY recovery_states.state;
+$count_session_recovery_backlog$;
+
+REVOKE ALL ON FUNCTION opengeni_private.count_session_recovery_backlog() FROM PUBLIC;
+
+DO $session_recovery_observability_grants$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.count_session_recovery_backlog() TO opengeni_app;
+  END IF;
+END
+$session_recovery_observability_grants$;

package/drizzle/0376_organization_workspace_inventory.sql

@@ -0,0 +1,88 @@
+-- deployment-mode: rolling
+-- Account-scoped organization API keys need one complete shared-workspace
+-- inventory without direct runtime access to organization membership rows.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+CREATE FUNCTION list_organization_workspace_ids(p_account_id uuid)
+RETURNS TABLE (workspace_id uuid)
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $body$
+DECLARE
+  previous_lifecycle text := current_setting('opengeni.organization_tenancy_lifecycle', true);
+BEGIN
+  IF p_account_id IS NULL
+    OR p_account_id IS DISTINCT FROM opengeni_private.current_account_id()
+    OR opengeni_private.current_workspace_id() IS NOT NULL
+  THEN
+    RAISE EXCEPTION 'organization workspace inventory authority required'
+      USING ERRCODE = '42501';
+  END IF;
+
+  PERFORM pg_catalog.set_config(
+    'opengeni.organization_tenancy_lifecycle',
+    'organization_membership_lifecycle', true
+  );
+
+  RETURN QUERY
+  SELECT workspace.id
+  FROM workspaces workspace
+  WHERE workspace.account_id = p_account_id
+    AND NOT EXISTS (
+      SELECT 1
+      FROM organization_memberships membership
+      WHERE membership.account_id = p_account_id
+        AND membership.personal_workspace_id = workspace.id
+    );
+
+  PERFORM pg_catalog.set_config(
+    'opengeni.organization_tenancy_lifecycle', coalesce(previous_lifecycle, ''), true
+  );
+  RETURN;
+EXCEPTION WHEN OTHERS THEN
+  PERFORM pg_catalog.set_config(
+    'opengeni.organization_tenancy_lifecycle', coalesce(previous_lifecycle, ''), true
+  );
+  RAISE;
+END
+$body$;
+
+REVOKE ALL ON FUNCTION list_organization_workspace_ids(uuid) FROM PUBLIC;
+
+DO $pin_and_grant_organization_workspace_inventory$
+DECLARE
+  data_schema text := current_schema();
+  application_role text;
+BEGIN
+  EXECUTE format(
+    'ALTER FUNCTION %I.list_organization_workspace_ids(uuid) '
+      'SET search_path = pg_catalog, %I, pg_temp',
+    data_schema, data_schema
+  );
+
+  FOR application_role IN
+    SELECT role_value.rolname
+    FROM pg_catalog.jsonb_array_elements_text(
+      coalesce(
+        nullif(current_setting('opengeni.migration_application_roles', true), ''),
+        '[]'
+      )::jsonb
+    ) configured(value)
+    JOIN pg_catalog.pg_roles role_value
+      ON role_value.rolname = configured.value
+    UNION
+    SELECT 'opengeni_app'
+    WHERE EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'opengeni_app')
+  LOOP
+    EXECUTE format(
+      'GRANT EXECUTE ON FUNCTION %I.list_organization_workspace_ids(uuid) TO %I',
+      data_schema, application_role
+    );
+  END LOOP;
+END
+$pin_and_grant_organization_workspace_inventory$;
+
+COMMENT ON FUNCTION list_organization_workspace_ids(uuid) IS
+  'Complete content-free organization workspace inventory. Canonical personal-workspace pointers are excluded under exact account scope.';

package/drizzle/0377_scoped_rig_health_projection.sql

@@ -0,0 +1,80 @@
+-- deployment-mode: rolling
+-- Keep the access-controlled Rig projection in parity with the ordinary
+-- workspace query: terminal verification evidence for the active version must
+-- be visible to REST and first-party MCP callers instead of staying unknown.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+CREATE OR REPLACE FUNCTION scoped_rig_json(p_rig_id uuid) RETURNS jsonb
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path FROM CURRENT AS $$
+  SELECT pg_catalog.jsonb_build_object(
+    'id', rig.id, 'accountId', rig.account_id, 'workspaceId', rig.workspace_id,
+    'scope', rig.authority_scope, 'generation', rig.generation, 'status', rig.status,
+    'name', rig.name, 'description', rig.description, 'createdBy', rig.created_by,
+    'activeVersion', (
+      SELECT pg_catalog.jsonb_build_object(
+        'id', version.id, 'rigId', version.rig_id, 'version', version.version,
+        'image', version.image, 'setupScript', version.setup_script,
+        'checks', version.checks, 'credentialHooks', version.credential_hooks,
+        'defaultVariableSetIds', version.default_variable_set_ids,
+        'changelog', version.changelog, 'providerImages', version.provider_images,
+        'createdBy', version.created_by, 'active', version.active,
+        'createdAt', version.created_at
+      ) FROM rig_versions version
+      WHERE version.rig_id = rig.id AND version.account_id = rig.account_id
+        AND version.active = true LIMIT 1
+    ),
+    'activeVersionHealth', (
+      SELECT pg_catalog.jsonb_build_object(
+        'checkHealth', coalesce(health.check_health, 'unknown'),
+        'lastVerifiedAt', health.verified_at
+      )
+      FROM rig_versions active_version
+      LEFT JOIN LATERAL (
+        SELECT candidate.check_health, candidate.verified_at
+        FROM (
+          SELECT CASE change.verification ->> 'passed'
+              WHEN 'true' THEN 'passing' WHEN 'false' THEN 'failing' END AS check_health,
+            coalesce(
+              nullif(change.verification ->> 'finishedAt', '')::timestamptz,
+              change.updated_at
+            ) AS verified_at
+          FROM rig_changes change
+          WHERE change.account_id = active_version.account_id
+            AND change.workspace_id = active_version.workspace_id
+            AND change.result_version_id = active_version.id
+            AND change.verification ->> 'passed' IN ('true', 'false')
+          UNION ALL
+          SELECT CASE event.action WHEN 'rig.verification.passed' THEN 'passing'
+              ELSE 'failing' END,
+            coalesce(
+              nullif(event.metadata ->> 'finishedAt', '')::timestamptz,
+              event.occurred_at
+            )
+          FROM audit_events event
+          WHERE event.account_id = active_version.account_id
+            AND event.workspace_id = active_version.workspace_id
+            AND event.target_type = 'rig'
+            AND event.target_id = rig.id::text
+            AND event.action IN ('rig.verification.passed', 'rig.verification.failed')
+            AND event.metadata ->> 'versionId' = active_version.id::text
+        ) candidate
+        ORDER BY candidate.verified_at DESC
+        LIMIT 1
+      ) health ON true
+      WHERE active_version.rig_id = rig.id
+        AND active_version.account_id = rig.account_id
+        AND active_version.active = true
+      LIMIT 1
+    ),
+    'versionCount', (SELECT count(*)::integer FROM rig_versions version
+      WHERE version.rig_id = rig.id AND version.account_id = rig.account_id),
+    'createdAt', rig.created_at, 'updatedAt', rig.updated_at
+  ) FROM rigs rig WHERE rig.id = p_rig_id
+$$;
+
+REVOKE ALL ON FUNCTION scoped_rig_json(uuid) FROM PUBLIC;
+
+COMMENT ON FUNCTION scoped_rig_json(uuid) IS
+  'Access-controlled Rig projection with active-version health from the latest terminal change or audit verification evidence.';

package/drizzle/0378_scoped_rig_health_audit_timestamp.sql

@@ -0,0 +1,77 @@
+-- deployment-mode: rolling
+-- Repair the already-ledgered scoped Rig health projection so generic audit
+-- metadata can never abort a SECURITY DEFINER read. Audit occurrence time is
+-- the trusted ordering and display timestamp for audit-backed evidence.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+CREATE OR REPLACE FUNCTION scoped_rig_json(p_rig_id uuid) RETURNS jsonb
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path FROM CURRENT AS $$
+  SELECT pg_catalog.jsonb_build_object(
+    'id', rig.id, 'accountId', rig.account_id, 'workspaceId', rig.workspace_id,
+    'scope', rig.authority_scope, 'generation', rig.generation, 'status', rig.status,
+    'name', rig.name, 'description', rig.description, 'createdBy', rig.created_by,
+    'activeVersion', (
+      SELECT pg_catalog.jsonb_build_object(
+        'id', version.id, 'rigId', version.rig_id, 'version', version.version,
+        'image', version.image, 'setupScript', version.setup_script,
+        'checks', version.checks, 'credentialHooks', version.credential_hooks,
+        'defaultVariableSetIds', version.default_variable_set_ids,
+        'changelog', version.changelog, 'providerImages', version.provider_images,
+        'createdBy', version.created_by, 'active', version.active,
+        'createdAt', version.created_at
+      ) FROM rig_versions version
+      WHERE version.rig_id = rig.id AND version.account_id = rig.account_id
+        AND version.active = true LIMIT 1
+    ),
+    'activeVersionHealth', (
+      SELECT pg_catalog.jsonb_build_object(
+        'checkHealth', coalesce(health.check_health, 'unknown'),
+        'lastVerifiedAt', health.verified_at
+      )
+      FROM rig_versions active_version
+      LEFT JOIN LATERAL (
+        SELECT candidate.check_health, candidate.verified_at
+        FROM (
+          SELECT CASE change.verification ->> 'passed'
+              WHEN 'true' THEN 'passing' WHEN 'false' THEN 'failing' END AS check_health,
+            coalesce(
+              nullif(change.verification ->> 'finishedAt', '')::timestamptz,
+              change.updated_at
+            ) AS verified_at
+          FROM rig_changes change
+          WHERE change.account_id = active_version.account_id
+            AND change.workspace_id = active_version.workspace_id
+            AND change.result_version_id = active_version.id
+            AND change.verification ->> 'passed' IN ('true', 'false')
+          UNION ALL
+          SELECT CASE event.action WHEN 'rig.verification.passed' THEN 'passing'
+              ELSE 'failing' END,
+            event.occurred_at
+          FROM audit_events event
+          WHERE event.account_id = active_version.account_id
+            AND event.workspace_id = active_version.workspace_id
+            AND event.target_type = 'rig'
+            AND event.target_id = rig.id::text
+            AND event.action IN ('rig.verification.passed', 'rig.verification.failed')
+            AND event.metadata ->> 'versionId' = active_version.id::text
+        ) candidate
+        ORDER BY candidate.verified_at DESC
+        LIMIT 1
+      ) health ON true
+      WHERE active_version.rig_id = rig.id
+        AND active_version.account_id = rig.account_id
+        AND active_version.active = true
+      LIMIT 1
+    ),
+    'versionCount', (SELECT count(*)::integer FROM rig_versions version
+      WHERE version.rig_id = rig.id AND version.account_id = rig.account_id),
+    'createdAt', rig.created_at, 'updatedAt', rig.updated_at
+  ) FROM rigs rig WHERE rig.id = p_rig_id
+$$;
+
+REVOKE ALL ON FUNCTION scoped_rig_json(uuid) FROM PUBLIC;
+
+COMMENT ON FUNCTION scoped_rig_json(uuid) IS
+  'Access-controlled Rig projection with active-version health from terminal evidence and trusted audit occurrence timestamps.';