@opengeni/db 3.7.4-canary.0 → 3.8.2-canary.0

package/dist/session-background-commands.js

@@ -12,9 +12,9 @@ import {
   settleClaimedConnectedMachineBackgroundCommand,
   settleConnectedMachineSessionBackgroundCommand,
   settleSessionBackgroundCommandForRetainedProcess
-} from "./chunk-JP6IYGYI.js";
-import "./chunk-ZTSJPFDH.js";
-import "./chunk-DXJ2WY6W.js";
+} from "./chunk-CITYUGMW.js";
+import "./chunk-HZV7O6JR.js";
+import "./chunk-53A2PEHT.js";
 import "./chunk-PZ5AY32C.js";
 export {
   backgroundCommandActivityForSessions,

package/dist/session-tenancy.js

@@ -14,9 +14,9 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-VDXHLVDE.js";
-import "./chunk-ZTSJPFDH.js";
-import "./chunk-DXJ2WY6W.js";
+} from "./chunk-RLQVPOVR.js";
+import "./chunk-HZV7O6JR.js";
+import "./chunk-53A2PEHT.js";
 import "./chunk-PZ5AY32C.js";
 export {
   SessionTenancyAccessError,

package/dist/video-generation.js

@@ -29,9 +29,9 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-JS3AWDKZ.js";
-import "./chunk-ZTSJPFDH.js";
-import "./chunk-DXJ2WY6W.js";
+} from "./chunk-5S4BQAHX.js";
+import "./chunk-HZV7O6JR.js";
+import "./chunk-53A2PEHT.js";
 import "./chunk-PZ5AY32C.js";
 export {
   ACTIVE_VIDEO_GENERATION_STATUSES,

package/drizzle/0390_organization_model_provider_connections.sql

@@ -0,0 +1,197 @@
+-- deployment-mode: maintenance
+-- Organization-owned Vercel AI Gateway/OpenRouter credentials and model catalog.
+-- Personal workspaces are deliberately excluded from runtime inheritance.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+DO $scope_visibility$
+DECLARE data_schema text := current_schema();
+BEGIN
+  EXECUTE format($ddl$
+    CREATE OR REPLACE FUNCTION opengeni_private.organization_model_provider_scope_visible(
+      p_account_id uuid
+    ) RETURNS boolean
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path = pg_catalog
+    AS $function$
+    DECLARE
+      workspace_value uuid := opengeni_private.current_workspace_id();
+      subject_value text := opengeni_private.current_subject_id();
+      visible boolean := false;
+      previous_lifecycle text := pg_catalog.current_setting(
+        'opengeni.organization_tenancy_lifecycle', true
+      );
+    BEGIN
+      IF p_account_id IS NULL
+        OR p_account_id IS DISTINCT FROM opengeni_private.current_account_id()
+      THEN RETURN false; END IF;
+
+      PERFORM pg_catalog.set_config(
+        'opengeni.organization_tenancy_lifecycle',
+        'organization_membership_lifecycle', true
+      );
+      IF workspace_value IS NOT NULL THEN
+        SELECT EXISTS (
+          SELECT 1 FROM %1$I.workspaces workspace
+          WHERE workspace.account_id = p_account_id AND workspace.id = workspace_value
+        ) AND NOT EXISTS (
+          SELECT 1 FROM %1$I.organization_memberships membership
+          WHERE membership.account_id = p_account_id
+            AND membership.personal_workspace_id = workspace_value
+        ) INTO visible;
+      ELSIF subject_value IS NOT NULL AND (
+        subject_value LIKE 'user:%%'
+        OR (
+          subject_value = 'dev'
+          AND EXISTS (
+            SELECT 1 FROM %1$I.managed_accounts account
+            WHERE account.id = p_account_id
+              AND account.external_source = 'opengeni:local'
+              AND account.external_id = 'default'
+          )
+        )
+      ) THEN
+        SELECT EXISTS (
+          SELECT 1 FROM %1$I.organization_memberships membership
+          WHERE membership.account_id = p_account_id
+            AND membership.subject_id = subject_value
+            AND membership.status = 'active'
+            AND membership.role IN ('owner', 'admin')
+        ) INTO visible;
+      END IF;
+      PERFORM pg_catalog.set_config(
+        'opengeni.organization_tenancy_lifecycle', coalesce(previous_lifecycle, ''), true
+      );
+      RETURN coalesce(visible, false);
+    EXCEPTION WHEN OTHERS THEN
+      PERFORM pg_catalog.set_config(
+        'opengeni.organization_tenancy_lifecycle', coalesce(previous_lifecycle, ''), true
+      );
+      RAISE;
+    END
+    $function$;
+  $ddl$, data_schema);
+END
+$scope_visibility$;
+
+CREATE TABLE organization_model_provider_connections (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  account_id uuid NOT NULL REFERENCES managed_accounts(id) ON DELETE CASCADE,
+  provider_kind text NOT NULL CHECK (provider_kind IN ('vercel_gateway', 'openrouter')),
+  status text NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'revoked')),
+  credential_encrypted text NOT NULL,
+  version integer NOT NULL DEFAULT 1 CHECK (version > 0),
+  operation_id uuid NOT NULL,
+  request_hash text NOT NULL CHECK (request_hash ~ '^[a-f0-9]{64}$'),
+  updated_by_subject_id text NOT NULL CHECK (octet_length(updated_by_subject_id) BETWEEN 1 AND 1024),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (account_id, provider_kind),
+  UNIQUE (account_id, provider_kind, operation_id)
+);
+
+CREATE TABLE organization_model_provider_connection_operations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  account_id uuid NOT NULL REFERENCES managed_accounts(id) ON DELETE CASCADE,
+  provider_kind text NOT NULL CHECK (provider_kind IN ('vercel_gateway', 'openrouter')),
+  operation_id uuid NOT NULL,
+  request_hash text NOT NULL CHECK (request_hash ~ '^[a-f0-9]{64}$'),
+  result_status text NOT NULL CHECK (result_status IN ('active', 'revoked')),
+  result_version integer NOT NULL CHECK (result_version > 0),
+  result_created_at timestamptz NOT NULL,
+  result_updated_at timestamptz NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (account_id, provider_kind, operation_id)
+);
+
+CREATE TABLE organization_model_provider_custom_models (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  account_id uuid NOT NULL REFERENCES managed_accounts(id) ON DELETE CASCADE,
+  provider_kind text NOT NULL CHECK (provider_kind IN ('vercel_gateway', 'openrouter')),
+  upstream_model_id text NOT NULL CHECK (
+    octet_length(upstream_model_id) BETWEEN 1 AND 238
+    AND upstream_model_id ~ '^[!-~]+$' AND upstream_model_id !~ '[|]'
+  ),
+  label text CHECK (
+    label IS NULL OR (octet_length(label) BETWEEN 1 AND 128 AND label !~ '[\r\n|]')
+  ),
+  version integer NOT NULL DEFAULT 1 CHECK (version > 0),
+  create_operation_id uuid NOT NULL,
+  create_request_hash text NOT NULL CHECK (create_request_hash ~ '^[a-f0-9]{64}$'),
+  delete_operation_id uuid,
+  delete_request_hash text,
+  created_by_subject_id text NOT NULL CHECK (octet_length(created_by_subject_id) BETWEEN 1 AND 1024),
+  retired_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CHECK (
+    (delete_operation_id IS NULL AND delete_request_hash IS NULL)
+    OR (delete_operation_id IS NOT NULL AND delete_request_hash ~ '^[a-f0-9]{64}$' AND retired_at IS NOT NULL)
+  ),
+  UNIQUE (account_id, provider_kind, create_operation_id)
+);
+CREATE UNIQUE INDEX organization_model_provider_custom_models_active_uq
+  ON organization_model_provider_custom_models(account_id, provider_kind, upstream_model_id)
+  WHERE retired_at IS NULL;
+CREATE UNIQUE INDEX organization_model_provider_custom_models_delete_operation_uq
+  ON organization_model_provider_custom_models(account_id, provider_kind, delete_operation_id)
+  WHERE delete_operation_id IS NOT NULL;
+
+ALTER TABLE organization_model_provider_connections ENABLE ROW LEVEL SECURITY;
+ALTER TABLE organization_model_provider_connections FORCE ROW LEVEL SECURITY;
+ALTER TABLE organization_model_provider_connection_operations ENABLE ROW LEVEL SECURITY;
+ALTER TABLE organization_model_provider_connection_operations FORCE ROW LEVEL SECURITY;
+ALTER TABLE organization_model_provider_custom_models ENABLE ROW LEVEL SECURITY;
+ALTER TABLE organization_model_provider_custom_models FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY organization_model_provider_scope
+  ON organization_model_provider_connections
+  USING (opengeni_private.organization_model_provider_scope_visible(account_id))
+  WITH CHECK (opengeni_private.organization_model_provider_scope_visible(account_id));
+CREATE POLICY organization_model_provider_scope
+  ON organization_model_provider_connection_operations
+  USING (opengeni_private.organization_model_provider_scope_visible(account_id))
+  WITH CHECK (opengeni_private.organization_model_provider_scope_visible(account_id));
+CREATE POLICY organization_model_provider_scope
+  ON organization_model_provider_custom_models
+  USING (opengeni_private.organization_model_provider_scope_visible(account_id))
+  WITH CHECK (opengeni_private.organization_model_provider_scope_visible(account_id));
+
+REVOKE ALL ON organization_model_provider_connections FROM PUBLIC;
+REVOKE ALL ON organization_model_provider_connection_operations FROM PUBLIC;
+REVOKE ALL ON organization_model_provider_custom_models FROM PUBLIC;
+REVOKE ALL ON FUNCTION opengeni_private.organization_model_provider_scope_visible(uuid) FROM PUBLIC;
+
+DO $application_grants$
+DECLARE
+  data_schema text := current_schema();
+  application_role text;
+BEGIN
+  FOR application_role IN
+    SELECT role_value.rolname
+    FROM pg_catalog.jsonb_array_elements_text(
+      coalesce(nullif(current_setting('opengeni.migration_application_roles', true), ''), '[]')::jsonb
+    ) configured(value)
+    JOIN pg_catalog.pg_roles role_value ON role_value.rolname = configured.value
+    UNION SELECT 'opengeni_app'
+      WHERE EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'opengeni_app')
+  LOOP
+    EXECUTE format(
+      'GRANT SELECT, INSERT, UPDATE ON TABLE %1$I.organization_model_provider_connections, %1$I.organization_model_provider_connection_operations, %1$I.organization_model_provider_custom_models TO %2$I',
+      data_schema, application_role
+    );
+    EXECUTE format(
+      'GRANT EXECUTE ON FUNCTION opengeni_private.organization_model_provider_scope_visible(uuid) TO %I',
+      application_role
+    );
+  END LOOP;
+END
+$application_grants$;
+
+COMMENT ON TABLE organization_model_provider_connections IS
+  'Encrypted organization-owned Vercel AI Gateway/OpenRouter credentials inherited by shared workspaces only.';
+COMMENT ON TABLE organization_model_provider_connection_operations IS
+  'Durable secret-free idempotency receipts for organization provider connection mutations.';
+COMMENT ON TABLE organization_model_provider_custom_models IS
+  'Retained organization provider model generations; active rows are fresh-selection authority.';

package/drizzle/0391_sandbox_provider_deadline_interaction_followup.sql

@@ -0,0 +1,295 @@
+-- deployment-mode: rolling
+-- Repair the post-0388 provider-deadline interaction lifecycle without
+-- widening ordinary interaction expiry or weakening the session-tenancy fence.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+-- The TTL-aware fence inventory below must discover due lease-free controller
+-- transitions before the SECURITY DEFINER reaper opens its fenced owner scope.
+-- Keep this as inventory-only SELECT authority; the 0388 fenced owner policies
+-- remain the sole mutation path after every workspace advisory lock is held.
+DO $interaction_reaper_inventory_policies$
+DECLARE
+  target_schema text := pg_catalog.current_schema();
+  target_schema_oid oid := pg_catalog.current_schema()::pg_catalog.regnamespace;
+  migration_owner text := current_user;
+  table_name text;
+BEGIN
+  FOREACH table_name IN ARRAY ARRAY[
+    'browser_sessions',
+    'computer_sessions',
+    'interaction_operations'
+  ] LOOP
+    EXECUTE pg_catalog.format(
+      'DROP POLICY IF EXISTS session_tenancy_fence_inventory_read ON %I.%I',
+      target_schema,
+      table_name
+    );
+    EXECUTE pg_catalog.format(
+      'CREATE POLICY session_tenancy_fence_inventory_read ON %I.%I '
+        || 'FOR SELECT USING ('
+        || '%I.session_tenancy_fence_owner_policy_active('
+        || 'current_user::text, %L::text, %s::oid, workspace_id, true))',
+      target_schema,
+      table_name,
+      target_schema,
+      migration_owner,
+      target_schema_oid
+    );
+  END LOOP;
+END
+$interaction_reaper_inventory_policies$;
+
+-- The no-argument helper remains installed for reap_sandbox_leases() and old
+-- in-flight callers. The interaction reaper uses this overload so its bounded
+-- stale-operation batch can also see lease-free Connected Machine and attached-
+-- device workspaces. Because SKIP LOCKED can advance beyond any preselected
+-- operation row, fence every currently due workspace, but no healthy lease-free
+-- interaction workspace, in canonical UUID order before taking row locks.
+CREATE OR REPLACE FUNCTION acquire_sandbox_reaper_session_tenancy_fences(
+  p_interaction_holder_ttl_ms bigint
+)
+RETURNS integer
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $interaction_reaper_fences$
+DECLARE
+  inventory_capability_id uuid;
+  workspace_id_value uuid;
+  locked_count integer := 0;
+BEGIN
+  IF p_interaction_holder_ttl_ms <= 0 THEN
+    RETURN 0;
+  END IF;
+  PERFORM pg_catalog.set_config('opengeni.sandbox_recovery_protocol_v2', '1', true);
+  inventory_capability_id :=
+    opengeni_private.open_session_tenancy_fence_inventory(
+      session_tenancy_fence_target_schema()
+    );
+  FOR workspace_id_value IN
+    SELECT candidate.workspace_id
+    FROM (
+      SELECT lease.workspace_id
+      FROM sandbox_leases lease
+      WHERE lease.workspace_id IS NOT NULL
+        AND (
+          lease.liveness <> 'cold'
+          OR EXISTS (
+            SELECT 1
+            FROM sandbox_lease_holders holder
+            WHERE holder.lease_id = lease.id
+          )
+        )
+      UNION
+      SELECT operation.workspace_id
+      FROM interaction_operations operation
+      WHERE operation.workspace_id IS NOT NULL
+        -- Lease-free prepared operations remain replayable. A dispatched
+        -- operation is the first controller-side effect and is the only
+        -- lease-free transition the ordinary stale-transition reaper settles.
+        AND operation.state = 'dispatched'
+        AND operation.updated_at
+          < pg_catalog.now()
+            - pg_catalog.make_interval(
+                secs => p_interaction_holder_ttl_ms / 1000.0
+              )
+        AND (
+          EXISTS (
+            SELECT 1
+            FROM browser_sessions browser
+            WHERE operation.resource_kind = 'browser_session'
+              AND operation.account_id = browser.account_id
+              AND operation.workspace_id = browser.workspace_id
+              AND operation.resource_id = browser.id
+              AND browser.lifecycle IN (
+                'starting', 'suspending', 'restoring', 'ending'
+              )
+          )
+          OR EXISTS (
+            SELECT 1
+            FROM computer_sessions computer
+            WHERE operation.resource_kind = 'computer_session'
+              AND operation.account_id = computer.account_id
+              AND operation.workspace_id = computer.workspace_id
+              AND operation.resource_id = computer.id
+              AND computer.lifecycle IN ('starting', 'ending')
+          )
+        )
+    ) candidate
+    ORDER BY candidate.workspace_id
+  LOOP
+    PERFORM acquire_session_tenancy_fence(workspace_id_value);
+    locked_count := locked_count + 1;
+  END LOOP;
+  PERFORM opengeni_private.close_session_tenancy_fence_inventory(
+    inventory_capability_id
+  );
+  RETURN locked_count;
+EXCEPTION WHEN OTHERS THEN
+  PERFORM opengeni_private.close_session_tenancy_fence_inventory(
+    inventory_capability_id
+  );
+  RAISE;
+END
+$interaction_reaper_fences$;
+
+REVOKE ALL ON FUNCTION
+  acquire_sandbox_reaper_session_tenancy_fences(bigint)
+  FROM PUBLIC;
+
+-- CREATE OR REPLACE records `SET search_path FROM CURRENT` from the migrator
+-- connection. Re-pin this overload to the exact target schema before callers
+-- can invoke the enclosing reaper, so a caller-created temp relation cannot
+-- shadow its lease-free inventory before workspace fences are acquired.
+DO $pin_interaction_reaper_fence_helper$
+DECLARE
+  target_schema text := pg_catalog.current_schema();
+BEGIN
+  EXECUTE pg_catalog.format(
+    'ALTER FUNCTION %I.acquire_sandbox_reaper_session_tenancy_fences(bigint) '
+      || 'SET search_path = pg_catalog, %I, pg_temp',
+    target_schema,
+    target_schema
+  );
+END
+$pin_interaction_reaper_fence_helper$;
+
+-- Patch only the exact 0388 definition. The interaction reaper keeps the
+-- canonical advisory-fence -> owner capability -> operation -> lease -> holder
+-- ordering. The holder EXISTS is an unlocked eligibility read before LIMIT;
+-- lease rows are still the first ownership rows locked by the deadline phase.
+DO $provider_deadline_interaction_followup$
+DECLARE
+  data_schema text := pg_catalog.current_schema();
+  definition text;
+  patched text;
+  fence_anchor constant text :=
+    E'      PERFORM acquire_sandbox_reaper_session_tenancy_fences();';
+  fence_replacement constant text :=
+    E'      -- 0391 provider-deadline interaction follow-up: inventory due\n'
+    || E'      -- lease-free transitions before any interaction row lock.\n'
+    || E'      PERFORM acquire_sandbox_reaper_session_tenancy_fences(\n'
+    || E'        p_interaction_holder_ttl_ms\n'
+    || E'      );';
+  liveness_anchor constant text :=
+    E'          AND lease.liveness IN (''warming'', ''warm'')';
+  liveness_replacement constant text :=
+    E'          AND lease.liveness IN (''warming'', ''warm'', ''draining'')';
+  deadline_anchor constant text :=
+    E'          AND lease.provider_deadline_at <= pg_catalog.now()';
+  deadline_replacement text;
+  occurrences integer;
+BEGIN
+  SELECT pg_catalog.pg_get_functiondef(
+    'opengeni_private.reap_stale_interaction_transitions(bigint)'::regprocedure
+  ) INTO definition;
+
+  IF definition IS NULL
+    OR pg_catalog.strpos(definition, 'deadline_lease_ids uuid[]') = 0
+    OR pg_catalog.strpos(definition, 'provider_deadline_rotation') = 0
+    OR pg_catalog.strpos(definition, 'open_session_tenancy_fenced_access') = 0
+    OR pg_catalog.strpos(definition, 'LIMIT 500') = 0
+  THEN
+    RAISE EXCEPTION '0391 interaction reaper prerequisite definition drift'
+      USING ERRCODE = '55000';
+  END IF;
+
+  IF pg_catalog.strpos(
+    definition,
+    '0391 provider-deadline interaction follow-up'
+  ) > 0 THEN
+    IF pg_catalog.strpos(
+      definition,
+      'acquire_sandbox_reaper_session_tenancy_fences('
+    ) = 0
+      OR pg_catalog.strpos(
+        definition,
+        'p_interaction_holder_ttl_ms'
+      ) = 0
+      OR pg_catalog.strpos(
+        definition,
+        'lease.liveness IN (''warming'', ''warm'', ''draining'')'
+      ) = 0
+      OR pg_catalog.strpos(
+        definition,
+        'interaction_holder.kind = ''interaction'''
+      ) = 0
+    THEN
+      RAISE EXCEPTION '0391 interaction reaper replay definition drift'
+        USING ERRCODE = '55000';
+    END IF;
+  ELSE
+    patched := definition;
+
+    occurrences := (
+      pg_catalog.length(patched)
+        - pg_catalog.length(pg_catalog.replace(patched, fence_anchor, ''))
+    ) / pg_catalog.length(fence_anchor);
+    IF occurrences <> 1 THEN
+      RAISE EXCEPTION '0391 interaction reaper fence anchor drift'
+        USING ERRCODE = '55000';
+    END IF;
+    patched := pg_catalog.replace(patched, fence_anchor, fence_replacement);
+
+    occurrences := (
+      pg_catalog.length(patched)
+        - pg_catalog.length(pg_catalog.replace(patched, liveness_anchor, ''))
+    ) / pg_catalog.length(liveness_anchor);
+    IF occurrences <> 1 THEN
+      RAISE EXCEPTION '0391 interaction reaper liveness anchor drift'
+        USING ERRCODE = '55000';
+    END IF;
+    patched := pg_catalog.replace(
+      patched,
+      liveness_anchor,
+      liveness_replacement
+    );
+
+    occurrences := (
+      pg_catalog.length(patched)
+        - pg_catalog.length(pg_catalog.replace(patched, deadline_anchor, ''))
+    ) / pg_catalog.length(deadline_anchor);
+    IF occurrences <> 1 THEN
+      RAISE EXCEPTION '0391 interaction reaper deadline anchor drift'
+        USING ERRCODE = '55000';
+    END IF;
+    deadline_replacement := deadline_anchor || pg_catalog.format(
+      E'\n          AND EXISTS (\n'
+        || E'            SELECT 1\n'
+        || E'            FROM %I.sandbox_lease_holders interaction_holder\n'
+        || E'            WHERE interaction_holder.lease_id = lease.id\n'
+        || E'              AND interaction_holder.kind = ''interaction''\n'
+        || E'          )',
+      data_schema
+    );
+    patched := pg_catalog.replace(
+      patched,
+      deadline_anchor,
+      deadline_replacement
+    );
+
+    IF pg_catalog.strpos(
+      patched,
+      '0391 provider-deadline interaction follow-up'
+    ) = 0
+      OR pg_catalog.strpos(
+        patched,
+        'lease.liveness IN (''warming'', ''warm'', ''draining'')'
+      ) = 0
+      OR pg_catalog.strpos(
+        patched,
+        'interaction_holder.kind = ''interaction'''
+      ) = 0
+    THEN
+      RAISE EXCEPTION '0391 interaction reaper patch failed'
+        USING ERRCODE = '55000';
+    END IF;
+
+    EXECUTE patched;
+  END IF;
+END
+$provider_deadline_interaction_followup$;
+
+RESET statement_timeout;
+RESET lock_timeout;