@opengeni/db 3.6.0 → 3.7.4-canary.0

package/drizzle/0382_organization_api_key_provenance.sql

@@ -0,0 +1,91 @@
+-- deployment-mode: rolling
+-- Organization-wide workspace authority must come from an explicitly issued
+-- organization key, never from the historical workspace_id IS NULL shape.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+ALTER TABLE api_keys
+  ADD COLUMN credential_kind text;
+
+ALTER TABLE api_keys NO FORCE ROW LEVEL SECURITY;
+
+UPDATE api_keys
+SET
+  credential_kind = CASE
+    WHEN workspace_id IS NOT NULL THEN 'workspace'
+    ELSE 'legacy_account'
+  END,
+  revoked_at = CASE
+    WHEN workspace_id IS NULL THEN COALESCE(revoked_at, CURRENT_TIMESTAMP)
+    ELSE revoked_at
+  END,
+  updated_at = CASE
+    WHEN workspace_id IS NULL AND revoked_at IS NULL THEN CURRENT_TIMESTAMP
+    ELSE updated_at
+  END;
+
+ALTER TABLE api_keys FORCE ROW LEVEL SECURITY;
+
+CREATE FUNCTION opengeni_private.normalize_api_key_credential_kind()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY INVOKER
+SET search_path = pg_catalog, public
+AS $function$
+BEGIN
+  IF NEW.workspace_id IS NOT NULL THEN
+    NEW.credential_kind := 'workspace';
+  ELSIF NEW.credential_kind IS NULL THEN
+    -- The previous application version omitted this column. Its organization-key
+    -- route is the only null-workspace insert path with this exact fixed grant.
+    IF NEW.permissions = '["account:read","workspace:create","workspace:read","workspace:admin","api_keys:manage"]'::jsonb THEN
+      NEW.credential_kind := 'organization';
+    ELSE
+      NEW.credential_kind := 'legacy_account';
+    END IF;
+  END IF;
+
+  -- Old application versions authorize every active null-workspace row by
+  -- shape alone. Keep ambiguous legacy rows unusable through that old lookup
+  -- path for the entire rolling window; only the exact previous organization
+  -- writer above may create an active null-workspace credential.
+  IF NEW.credential_kind = 'legacy_account' AND NEW.revoked_at IS NULL THEN
+    NEW.revoked_at := CURRENT_TIMESTAMP;
+    NEW.updated_at := CURRENT_TIMESTAMP;
+  END IF;
+
+  RETURN NEW;
+END;
+$function$;
+
+REVOKE ALL ON FUNCTION opengeni_private.normalize_api_key_credential_kind() FROM PUBLIC;
+
+CREATE TRIGGER api_keys_00_normalize_credential_kind
+BEFORE INSERT OR UPDATE OF workspace_id, credential_kind, permissions, revoked_at
+ON api_keys
+FOR EACH ROW
+EXECUTE FUNCTION opengeni_private.normalize_api_key_credential_kind();
+
+ALTER TABLE api_keys
+  ALTER COLUMN credential_kind SET NOT NULL;
+
+ALTER TABLE api_keys
+  ADD CONSTRAINT api_keys_credential_kind_check
+  CHECK (
+    (workspace_id IS NOT NULL AND credential_kind = 'workspace')
+    OR
+    (workspace_id IS NULL AND credential_kind = 'organization')
+    OR
+    (workspace_id IS NULL AND credential_kind = 'legacy_account' AND revoked_at IS NOT NULL)
+  ) NOT VALID;
+
+ALTER TABLE api_keys
+  VALIDATE CONSTRAINT api_keys_credential_kind_check;
+
+CREATE INDEX api_keys_organization_account_idx
+  ON api_keys (account_id, created_at DESC)
+  WHERE credential_kind = 'organization';
+
+COMMENT ON COLUMN api_keys.credential_kind IS
+  'Persisted API-key provenance. Only organization keys receive organization-wide shared-workspace authority; ambiguous legacy account keys are revoked.';

package/drizzle/0383_codex_cooldown_reconciliation.sql

@@ -0,0 +1,51 @@
+-- deployment-mode: rolling
+--
+-- Give Codex cooldowns typed provenance plus an independent revision. A fresh
+-- provider usage read may then clear only the exact quota cooldown it observed
+-- before the request; generic backpressure and a concurrently newer refusal
+-- remain authoritative. Legacy writers do not know these columns, so the
+-- trigger advances the revision and removes typed auto-clear authority whenever
+-- they change exhausted_until alone during a rolling deployment.
+
+ALTER TABLE "codex_subscription_credentials"
+  ADD COLUMN "exhausted_kind" text,
+  ADD COLUMN "exhausted_revision" bigint NOT NULL DEFAULT 0,
+  ADD CONSTRAINT "codex_credentials_exhausted_kind_chk" CHECK (
+    ("exhausted_until" IS NULL AND "exhausted_kind" IS NULL)
+    OR (
+      "exhausted_until" IS NOT NULL
+      AND ("exhausted_kind" IS NULL OR "exhausted_kind" IN ('quota', 'rate_limit'))
+    )
+  );
+
+CREATE OR REPLACE FUNCTION opengeni_private.codex_cooldown_revision_guard()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $function$
+BEGIN
+  IF NEW.exhausted_until IS DISTINCT FROM OLD.exhausted_until THEN
+    IF NEW.exhausted_revision = OLD.exhausted_revision THEN
+      -- Compatibility path for a pre-0382 writer: retain the cooldown but do
+      -- not let a new usage reader mistake its unknown cause for quota.
+      NEW.exhausted_kind := NULL;
+      NEW.exhausted_revision := OLD.exhausted_revision + 1;
+    ELSIF NEW.exhausted_revision <> OLD.exhausted_revision + 1 THEN
+      RAISE EXCEPTION 'Codex cooldown revision must advance exactly once';
+    END IF;
+  ELSIF NEW.exhausted_kind IS DISTINCT FROM OLD.exhausted_kind
+    OR NEW.exhausted_revision IS DISTINCT FROM OLD.exhausted_revision
+  THEN
+    IF NEW.exhausted_revision <> OLD.exhausted_revision + 1 THEN
+      RAISE EXCEPTION 'Codex cooldown metadata revision must advance exactly once';
+    END IF;
+  END IF;
+  RETURN NEW;
+END
+$function$;
+
+CREATE TRIGGER codex_cooldown_revision_guard
+  BEFORE UPDATE OF exhausted_until, exhausted_kind, exhausted_revision
+  ON "codex_subscription_credentials"
+  FOR EACH ROW
+  EXECUTE FUNCTION opengeni_private.codex_cooldown_revision_guard();

package/drizzle/0384_codex_cooldown_revision_guard_privileges.sql

@@ -0,0 +1,6 @@
+-- deployment-mode: rolling
+-- Trigger helpers are owner-internal implementation details. PostgreSQL grants
+-- PUBLIC execute on new functions by default, so remove the inherited privilege
+-- that exposed this guard to unrelated runtime roles.
+
+REVOKE ALL ON FUNCTION opengeni_private.codex_cooldown_revision_guard() FROM PUBLIC;

package/drizzle/0385_connected_machine_legacy_tilde_workdirs.sql

@@ -0,0 +1,25 @@
+-- deployment-mode: rolling
+-- Native Connected Machine workspace roots made tilde paths invalid. Repair
+-- only legacy sessions whose active machine has reported an exact root; leave
+-- ambiguous/offline legacy rows untouched rather than guessing a user home.
+
+-- Migrations run as the NOSUPERUSER/NOBYPASSRLS table owner. Temporarily let
+-- that owner see the joined rows; application roles remain policy-bound.
+ALTER TABLE "sessions" NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE "sandboxes" NO FORCE ROW LEVEL SECURITY;
+ALTER TABLE "enrollments" NO FORCE ROW LEVEL SECURITY;
+
+UPDATE "sessions" AS session
+SET "working_dir" =
+  rtrim(enrollment."workspace_root", '/') || '/' || substring(session."working_dir" FROM 3)
+FROM "sandboxes" AS sandbox
+JOIN "enrollments" AS enrollment ON enrollment."id" = sandbox."enrollment_id"
+WHERE session."active_sandbox_id" = sandbox."id"
+  AND session."working_dir" LIKE '~/%'
+  AND enrollment."status" = 'active'
+  AND enrollment."workspace_root" IS NOT NULL
+  AND enrollment."workspace_root" <> '';
+
+ALTER TABLE "enrollments" FORCE ROW LEVEL SECURITY;
+ALTER TABLE "sandboxes" FORCE ROW LEVEL SECURITY;
+ALTER TABLE "sessions" FORCE ROW LEVEL SECURITY;

package/drizzle/0386_local_organization_administration.sql

@@ -0,0 +1,157 @@
+-- deployment-mode: maintenance
+--
+-- The canonical single-user local bootstrap already grants `dev` account-owner
+-- authority in the application, but its durable organization membership was
+-- left at the default member role. Converge that exact built-in identity and
+-- admit it to organization Codex administration without broadening configured,
+-- delegated, API-key, service, or agent principals.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+CREATE OR REPLACE FUNCTION opengeni_private.assign_managed_self_organization_owner()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $body$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM managed_accounts account
+    WHERE account.id = NEW.account_id
+      AND (
+        (
+          account.external_source = 'better-auth:user'
+          AND NEW.subject_id = 'user:' || account.external_id
+        ) OR (
+          account.external_source = 'opengeni:local'
+          AND account.external_id = 'default'
+          AND NEW.subject_id = 'dev'
+        )
+      )
+  ) THEN
+    NEW.role := 'owner';
+  END IF;
+  RETURN NEW;
+END
+$body$;
+
+DO $pin_local_owner_trigger$
+DECLARE data_schema text := current_schema();
+BEGIN
+  EXECUTE format(
+    'ALTER FUNCTION opengeni_private.assign_managed_self_organization_owner() SET search_path = pg_catalog, %I, pg_temp',
+    data_schema
+  );
+END
+$pin_local_owner_trigger$;
+
+ALTER TABLE organization_memberships NO FORCE ROW LEVEL SECURITY;
+UPDATE organization_memberships membership
+SET role = 'owner',
+    authorization_revision = membership.authorization_revision + 1,
+    updated_at = clock_timestamp()
+FROM managed_accounts account
+WHERE account.id = membership.account_id
+  AND account.external_source = 'opengeni:local'
+  AND account.external_id = 'default'
+  AND membership.subject_id = 'dev'
+  AND membership.status = 'active'
+  AND membership.role <> 'owner';
+ALTER TABLE organization_memberships FORCE ROW LEVEL SECURITY;
+
+DO $codex_scope_visibility_schema$
+DECLARE data_schema text := current_schema();
+BEGIN
+  EXECUTE format($ddl$
+    CREATE OR REPLACE FUNCTION opengeni_private.codex_organization_scope_visible(
+      p_account_id uuid
+    ) RETURNS boolean
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE
+      workspace_value uuid := opengeni_private.current_workspace_id();
+      subject_value text := opengeni_private.current_subject_id();
+      visible boolean := false;
+      previous_lifecycle text := pg_catalog.current_setting(
+        'opengeni.organization_tenancy_lifecycle', true
+      );
+    BEGIN
+      IF p_account_id IS NULL
+        OR p_account_id IS DISTINCT FROM opengeni_private.current_account_id()
+      THEN
+        RETURN false;
+      END IF;
+      IF workspace_value IS NOT NULL THEN
+        PERFORM pg_catalog.set_config(
+          'opengeni.organization_tenancy_lifecycle',
+          'organization_membership_lifecycle', true
+        );
+        SELECT EXISTS (
+          SELECT 1 FROM %1$I.workspaces workspace
+          WHERE workspace.account_id = p_account_id AND workspace.id = workspace_value
+        ) AND NOT EXISTS (
+          SELECT 1 FROM %1$I.organization_memberships membership
+          WHERE membership.account_id = p_account_id
+            AND membership.personal_workspace_id = workspace_value
+        ) INTO visible;
+        PERFORM pg_catalog.set_config(
+          'opengeni.organization_tenancy_lifecycle', coalesce(previous_lifecycle, ''), true
+        );
+        RETURN coalesce(visible, false);
+      END IF;
+      IF subject_value IS NULL OR NOT (
+        subject_value LIKE 'user:%%'
+        OR (
+          subject_value = 'dev'
+          AND EXISTS (
+            SELECT 1 FROM %1$I.managed_accounts account
+            WHERE account.id = p_account_id
+              AND account.external_source = 'opengeni:local'
+              AND account.external_id = 'default'
+          )
+        )
+      ) THEN
+        RETURN false;
+      END IF;
+      PERFORM pg_catalog.set_config(
+        'opengeni.organization_tenancy_lifecycle',
+        'organization_membership_lifecycle', true
+      );
+      SELECT EXISTS (
+        SELECT 1 FROM %1$I.organization_memberships membership
+        WHERE membership.account_id = p_account_id
+          AND membership.subject_id = subject_value
+          AND membership.status = 'active'
+          AND membership.role IN ('owner', 'admin')
+      ) INTO visible;
+      PERFORM pg_catalog.set_config(
+        'opengeni.organization_tenancy_lifecycle', coalesce(previous_lifecycle, ''), true
+      );
+      RETURN coalesce(visible, false);
+    EXCEPTION WHEN OTHERS THEN
+      PERFORM pg_catalog.set_config(
+        'opengeni.organization_tenancy_lifecycle', coalesce(previous_lifecycle, ''), true
+      );
+      RAISE;
+    END
+    $function$
+  $ddl$, data_schema);
+END
+$codex_scope_visibility_schema$;
+
+REVOKE ALL ON FUNCTION opengeni_private.assign_managed_self_organization_owner() FROM PUBLIC;
+REVOKE ALL ON FUNCTION opengeni_private.codex_organization_scope_visible(uuid) FROM PUBLIC;
+
+DO $grants$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT EXECUTE ON FUNCTION opengeni_private.assign_managed_self_organization_owner()
+      TO opengeni_app;
+    GRANT EXECUTE ON FUNCTION opengeni_private.codex_organization_scope_visible(uuid)
+      TO opengeni_app;
+  END IF;
+END
+$grants$;

package/drizzle/0387_bound_host_export_session_payloads.sql

@@ -0,0 +1,165 @@
+-- deployment-mode: rolling
+-- Host export is an optional bounded projection. Canonical session_events keeps
+-- the complete lossless payload; an oversized projection must never roll back
+-- the source event or a later lifecycle transaction that closes pending work.
+
+SET lock_timeout = '5s';
+SET statement_timeout = '10min';
+
+DO $migration$
+DECLARE target_schema text := current_schema();
+BEGIN
+  EXECUTE format($create$
+    CREATE OR REPLACE FUNCTION opengeni_private.enqueue_host_session_event_export()
+    RETURNS trigger
+    LANGUAGE plpgsql
+    SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE
+      v_enabled boolean;
+      v_initiator jsonb;
+      v_context jsonb := '{}'::jsonb;
+      v_origin text;
+      v_source_payload_bytes integer;
+      v_export_payload jsonb;
+      v_export_payload_codec_version smallint;
+      v_payload_bytes integer;
+    BEGIN
+      IF NEW.type IN (
+        'agent.message.delta', 'agent.reasoning.delta',
+        'sandbox.command.output.delta', 'terminal.pty.output.delta'
+      ) THEN
+        RETURN NEW;
+      END IF;
+
+      SELECT c.session_events_enabled INTO v_enabled
+      FROM %1$I.host_export_config c WHERE c.id = 1
+      FOR SHARE;
+      IF coalesce(v_enabled, false) = false THEN
+        RETURN NEW;
+      END IF;
+
+      IF NEW.turn_id IS NOT NULL THEN
+        SELECT
+          CASE WHEN octet_length(t.initiator_subject_id) <= 1024 THEN
+            jsonb_strip_nulls(jsonb_build_object(
+              'kind', t.initiator_kind,
+              'subjectId', t.initiator_subject_id,
+              'label', CASE
+                WHEN jsonb_typeof(t.initiator_context -> 'label') = 'string'
+                THEN left(t.initiator_context ->> 'label', 256)
+                ELSE NULL
+              END
+            ))
+          ELSE NULL END,
+          jsonb_strip_nulls(jsonb_build_object(
+            'label', CASE
+              WHEN jsonb_typeof(t.initiator_context -> 'label') = 'string'
+              THEN left(t.initiator_context ->> 'label', 256)
+              ELSE NULL
+            END,
+            'backfill', CASE
+              WHEN jsonb_typeof(t.initiator_context -> 'backfill') = 'boolean'
+              THEN t.initiator_context -> 'backfill'
+              ELSE NULL
+            END,
+            'attributionOmitted', CASE
+              WHEN octet_length(t.initiator_subject_id) > 1024 THEN 'subject_id_too_large'
+              ELSE NULL
+            END
+          )),
+          t.source
+        INTO v_initiator, v_context, v_origin
+        FROM %1$I.session_turns t
+        WHERE t.workspace_id = NEW.workspace_id AND t.id = NEW.turn_id;
+      ELSIF NEW.type = 'session.created' THEN
+        SELECT
+          CASE WHEN octet_length(s.created_by_subject_id) <= 1024 THEN
+            jsonb_strip_nulls(jsonb_build_object(
+              'kind', s.created_by_kind,
+              'subjectId', s.created_by_subject_id,
+              'label', CASE
+                WHEN jsonb_typeof(s.created_by_context -> 'label') = 'string'
+                THEN left(s.created_by_context ->> 'label', 256)
+                ELSE NULL
+              END
+            ))
+          ELSE NULL END,
+          jsonb_strip_nulls(jsonb_build_object(
+            'label', CASE
+              WHEN jsonb_typeof(s.created_by_context -> 'label') = 'string'
+              THEN left(s.created_by_context ->> 'label', 256)
+              ELSE NULL
+            END,
+            'backfill', CASE
+              WHEN jsonb_typeof(s.created_by_context -> 'backfill') = 'boolean'
+              THEN s.created_by_context -> 'backfill'
+              ELSE NULL
+            END,
+            'attributionOmitted', CASE
+              WHEN octet_length(s.created_by_subject_id) > 1024 THEN 'subject_id_too_large'
+              ELSE NULL
+            END
+          )),
+          NULL
+        INTO v_initiator, v_context, v_origin
+        FROM %1$I.sessions s
+        WHERE s.workspace_id = NEW.workspace_id AND s.id = NEW.session_id;
+      END IF;
+
+      v_source_payload_bytes := octet_length(NEW.payload::text);
+      v_export_payload := NEW.payload;
+      v_export_payload_codec_version := NEW.payload_codec_version;
+      IF v_source_payload_bytes > 65536 THEN
+        v_export_payload := jsonb_build_object(
+          '_hostExport', jsonb_build_object(
+            'payloadMode', 'summary',
+            'payloadTruncated', true,
+            'originalBytes', v_source_payload_bytes,
+            'sourceEventId', NEW.id,
+            'fullPayload', 'retained in canonical session event'
+          ),
+          'preview', '[host-export payload omitted at bounded projection boundary]'
+        );
+        -- The projection is literal PostgreSQL JSON, not an application-codec
+        -- envelope. Preserve codec truth only when the original payload is kept.
+        v_export_payload_codec_version := NULL;
+      END IF;
+
+      v_payload_bytes := octet_length(v_export_payload::text)
+        + octet_length(NEW.type)
+        + coalesce(octet_length(NEW.client_event_id), 0)
+        + coalesce(octet_length(NEW.turn_association), 0)
+        + coalesce(octet_length(NEW.duplicate_reason), 0)
+        + octet_length(coalesce(v_initiator, 'null'::jsonb)::text)
+        + octet_length(v_context::text)
+        + 768;
+      INSERT INTO %1$I.host_export_outbox (
+        export_kind, source_id, account_id, workspace_id, session_id,
+        turn_id, turn_generation, turn_attempt_id, session_sequence,
+        client_event_id, turn_association, duplicate_of_event_id, duplicate_reason,
+        event_type, idempotency_key, initiator, initiator_context, origin,
+        payload, payload_codec_version, envelope_bytes, occurred_at,
+        source_recorded_at, enqueued_at
+      ) VALUES (
+        'session_event', NEW.id, NEW.account_id, NEW.workspace_id, NEW.session_id,
+        NEW.turn_id, NEW.turn_generation, NEW.turn_attempt_id, NEW.sequence,
+        NEW.client_event_id, NEW.turn_association, NEW.duplicate_of_event_id,
+        NEW.duplicate_reason,
+        NEW.type, 'session_event:' || NEW.id::text, v_initiator,
+        coalesce(v_context, '{}'::jsonb), v_origin, v_export_payload,
+        v_export_payload_codec_version, greatest(1, v_payload_bytes), NEW.occurred_at,
+        NEW.created_at, clock_timestamp()
+      )
+      ON CONFLICT (export_kind, source_id) DO NOTHING;
+      RETURN NEW;
+    END $function$;
+  $create$, target_schema);
+END
+$migration$;
+
+COMMENT ON COLUMN host_export_outbox.payload IS
+  'Immutable bounded host projection. Canonical session_events retains the complete payload; oversized host projections carry an explicit content-free truncation receipt.';
+COMMENT ON COLUMN host_export_outbox.payload_codec_version IS
+  'Codec truth for the stored host projection. NULL means literal SQL JSON, including oversized-payload projections; 1 means the original application-coded payload was retained exactly.';