@opengeni/db 3.7.4 → 4.0.0-canary.0

package/drizzle/0395_scheduled_task_unclaimed_occurrence_invalidation.sql

@@ -0,0 +1,154 @@
+-- deployment-mode: rolling
+-- Pausing or soft-deleting a scheduled task is a durable first-claim cutoff.
+-- Runs whose scheduler-owned turn already exists remain accepted work and keep
+-- their normal attempt/recovery lifecycle. Every earlier occurrence becomes a
+-- terminal receipt, so a later Resume cannot revive a deposit accepted before
+-- the lifecycle boundary.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+-- Old claimers do not inspect scheduled_task_runs.status after this migration
+-- marks an occurrence terminal. Keep the rolling boundary safe in the database:
+-- every binary must cross this state transition before it can create the
+-- scheduler-owned turn or start provider work.
+CREATE FUNCTION fence_terminal_scheduled_occurrence_delivery()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $body$
+DECLARE
+  run_status text;
+BEGIN
+  SELECT run.status INTO run_status
+  FROM scheduled_task_runs run
+  WHERE run.id = OLD.scheduled_task_run_id
+    AND run.account_id = OLD.account_id
+    AND run.workspace_id = OLD.workspace_id
+    AND run.session_id = OLD.session_id
+    AND run.action_kind = 'agent_turn'
+  FOR UPDATE;
+
+  IF run_status IS DISTINCT FROM 'dispatched' THEN
+    RAISE EXCEPTION 'terminal scheduled occurrence cannot be delivered'
+      USING ERRCODE = '42501';
+  END IF;
+  RETURN NEW;
+END
+$body$;
+
+CREATE TRIGGER scheduled_terminal_occurrence_delivery_fence
+BEFORE UPDATE OF state ON session_system_updates
+FOR EACH ROW
+WHEN (
+  OLD.scheduled_task_run_id IS NOT NULL
+  AND OLD.state = 'pending'
+  AND NEW.state = 'delivered'
+)
+EXECUTE FUNCTION fence_terminal_scheduled_occurrence_delivery();
+
+CREATE FUNCTION invalidate_unclaimed_scheduled_agent_runs_on_task_inactive()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $body$
+DECLARE
+  run_row record;
+  invalidation_error text;
+BEGIN
+  invalidation_error := CASE
+    -- 0275 introduced deleted_at. JSON row introspection keeps this rolling
+    -- trigger installable in legacy-upgrade fixtures that intentionally replay
+    -- 0275 after the current tail, while current schemas still classify delete.
+    WHEN pg_catalog.to_jsonb(OLD) ->> 'deleted_at' IS NULL
+      AND pg_catalog.to_jsonb(NEW) ->> 'deleted_at' IS NOT NULL
+      THEN 'scheduled_task_deleted_before_claim'
+    ELSE 'scheduled_task_paused_before_claim'
+  END;
+
+  INSERT INTO opengeni_private.scheduled_personal_resource_capabilities (
+    backend_pid, transaction_id, capability_kind
+  ) VALUES (
+    pg_catalog.pg_backend_pid(), pg_catalog.pg_current_xact_id(), 'run_lifecycle'
+  )
+  ON CONFLICT DO NOTHING;
+
+  -- Run admission takes the task row first. Deposit and claim both lock the run
+  -- before they can publish an occurrence or a scheduler-owned turn. Once this
+  -- loop owns a run, a fresh turn lookup therefore decides the race exactly:
+  -- no turn means no claim crossed the lifecycle boundary.
+  FOR run_row IN
+    SELECT run.id
+    FROM scheduled_task_runs run
+    WHERE run.account_id = NEW.account_id
+      AND run.workspace_id = NEW.workspace_id
+      AND run.task_id = NEW.id
+      AND run.action_kind = 'agent_turn'
+      AND run.status IN ('queued', 'dispatched')
+    ORDER BY run.id
+    FOR UPDATE
+  LOOP
+    IF NOT EXISTS (
+      SELECT 1
+      FROM session_turns turn_value
+      WHERE turn_value.account_id = NEW.account_id
+        AND turn_value.workspace_id = NEW.workspace_id
+        AND turn_value.scheduled_task_run_id = run_row.id
+    ) THEN
+      UPDATE scheduled_task_runs run
+      SET status = 'skipped',
+        error = invalidation_error,
+        completed_at = pg_catalog.clock_timestamp(),
+        updated_at = pg_catalog.clock_timestamp()
+      WHERE run.id = run_row.id
+        AND run.account_id = NEW.account_id
+        AND run.workspace_id = NEW.workspace_id
+        AND run.status IN ('queued', 'dispatched');
+    END IF;
+  END LOOP;
+
+  DELETE FROM opengeni_private.scheduled_personal_resource_capabilities
+  WHERE backend_pid = pg_catalog.pg_backend_pid()
+    AND transaction_id = pg_catalog.pg_current_xact_id_if_assigned()
+    AND capability_kind = 'run_lifecycle';
+  RETURN NEW;
+EXCEPTION WHEN OTHERS THEN
+  DELETE FROM opengeni_private.scheduled_personal_resource_capabilities
+  WHERE backend_pid = pg_catalog.pg_backend_pid()
+    AND transaction_id = pg_catalog.pg_current_xact_id_if_assigned()
+    AND capability_kind = 'run_lifecycle';
+  RAISE;
+END
+$body$;
+
+CREATE TRIGGER scheduled_task_unclaimed_occurrence_invalidation
+AFTER UPDATE OF status ON scheduled_tasks
+FOR EACH ROW
+WHEN (OLD.status = 'active' AND NEW.status = 'paused')
+EXECUTE FUNCTION invalidate_unclaimed_scheduled_agent_runs_on_task_inactive();
+
+REVOKE ALL ON FUNCTION
+  invalidate_unclaimed_scheduled_agent_runs_on_task_inactive()
+  FROM PUBLIC;
+REVOKE ALL ON FUNCTION fence_terminal_scheduled_occurrence_delivery() FROM PUBLIC;
+
+DO $pin_scheduled_task_unclaimed_invalidation$
+DECLARE
+  data_schema text := pg_catalog.current_schema();
+BEGIN
+  EXECUTE pg_catalog.format(
+    'ALTER FUNCTION %I.invalidate_unclaimed_scheduled_agent_runs_on_task_inactive() '
+      || 'SET search_path = pg_catalog, %I, pg_temp',
+    data_schema,
+    data_schema
+  );
+  EXECUTE pg_catalog.format(
+    'ALTER FUNCTION %I.fence_terminal_scheduled_occurrence_delivery() '
+      || 'SET search_path = pg_catalog, %I, pg_temp',
+    data_schema,
+    data_schema
+  );
+END
+$pin_scheduled_task_unclaimed_invalidation$;

package/drizzle/0396_model_call_equivalent_credit_cost.sql

@@ -0,0 +1,28 @@
+-- deployment-mode: rolling
+-- Preserve the hypothetical OpenGeni credit price separately from both the
+-- upstream provider estimate and the amount actually priced to credits.
+-- Historical external facts remain unknown rather than being recomputed with
+-- today's margin or provider rates.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '5min';
+
+ALTER TABLE "model_call_facts"
+  ADD COLUMN IF NOT EXISTS "equivalent_credit_cost_micros" bigint;
+
+ALTER TABLE "model_call_facts"
+  DROP CONSTRAINT IF EXISTS "model_call_facts_equivalent_credit_cost_check",
+  ADD CONSTRAINT "model_call_facts_equivalent_credit_cost_check"
+    CHECK (
+      "equivalent_credit_cost_micros" IS NULL
+      OR (
+        "equivalent_credit_cost_micros" >= 0
+        AND "estimated_provider_cost_micros" IS NOT NULL
+      )
+    ) NOT VALID;
+
+ALTER TABLE "model_call_facts"
+  VALIDATE CONSTRAINT "model_call_facts_equivalent_credit_cost_check";
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0397_sandbox_deadline_rotation_preemption.sql

@@ -0,0 +1,113 @@
+-- deployment-mode: rolling
+-- A finite provider lifetime is a hard destruction boundary. Once the normal
+-- lead-time rotation request is durable, persistent Browser/Computer placement
+-- must yield while enough time remains to quiesce writers and capture the exact
+-- workspace generation. Waiting until the provider deadline keeps the lease
+-- holder alive until the same instant the provider may destroy the box.
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+DO $sandbox_deadline_rotation_preemption$
+DECLARE
+  definition text;
+  patched text;
+  eligibility_anchor constant text :=
+    E'          AND lease.provider_deadline_at <= pg_catalog.now()';
+  eligibility_replacement constant text :=
+    E'          -- 0397 deadline rotation preemption: an automatic finite-lifetime\n'
+    || E'          -- rotation yields persistent controllers at the lead boundary;\n'
+    || E'          -- unrelated operator rotations retain the hard-deadline fallback.\n'
+    || E'          AND (\n'
+    || E'            lease.rotation_reason = ''provider_deadline''\n'
+    || E'            OR lease.provider_deadline_at <= pg_catalog.now()\n'
+    || E'          )';
+  message_anchor constant text :=
+    E'          error_message = ''Interaction controller reached its sandbox provider deadline'',';
+  message_replacement constant text :=
+    E'          error_message = ''Interaction controller yielded for sandbox provider rotation'',';
+  occurrences integer;
+BEGIN
+  SELECT pg_catalog.pg_get_functiondef(
+    'opengeni_private.reap_stale_interaction_transitions(bigint)'::regprocedure
+  ) INTO definition;
+
+  IF definition IS NULL
+    OR pg_catalog.strpos(
+      definition,
+      '0391 provider-deadline interaction follow-up'
+    ) = 0
+    OR pg_catalog.strpos(
+      definition,
+      'interaction_holder.kind = ''interaction'''
+    ) = 0
+    OR pg_catalog.strpos(definition, 'provider_deadline_rotation') = 0
+  THEN
+    RAISE EXCEPTION '0397 interaction rotation prerequisite definition drift'
+      USING ERRCODE = '55000';
+  END IF;
+
+  IF pg_catalog.strpos(definition, '0397 deadline rotation preemption') > 0 THEN
+    IF pg_catalog.strpos(
+      definition,
+      'lease.rotation_reason = ''provider_deadline'''
+    ) = 0
+      OR pg_catalog.strpos(
+        definition,
+        'Interaction controller yielded for sandbox provider rotation'
+      ) = 0
+    THEN
+      RAISE EXCEPTION '0397 interaction rotation replay definition drift'
+        USING ERRCODE = '55000';
+    END IF;
+  ELSE
+    patched := definition;
+
+    occurrences := (
+      pg_catalog.length(patched)
+        - pg_catalog.length(pg_catalog.replace(patched, eligibility_anchor, ''))
+    ) / pg_catalog.length(eligibility_anchor);
+    IF occurrences <> 1 THEN
+      RAISE EXCEPTION '0397 interaction rotation eligibility anchor drift'
+        USING ERRCODE = '55000';
+    END IF;
+    patched := pg_catalog.replace(
+      patched,
+      eligibility_anchor,
+      eligibility_replacement
+    );
+
+    occurrences := (
+      pg_catalog.length(patched)
+        - pg_catalog.length(pg_catalog.replace(patched, message_anchor, ''))
+    ) / pg_catalog.length(message_anchor);
+    IF occurrences <> 1 THEN
+      RAISE EXCEPTION '0397 interaction rotation message anchor drift'
+        USING ERRCODE = '55000';
+    END IF;
+    patched := pg_catalog.replace(
+      patched,
+      message_anchor,
+      message_replacement
+    );
+
+    IF pg_catalog.strpos(patched, '0397 deadline rotation preemption') = 0
+      OR pg_catalog.strpos(
+        patched,
+        'lease.rotation_reason = ''provider_deadline'''
+      ) = 0
+      OR pg_catalog.strpos(
+        patched,
+        'OR lease.provider_deadline_at <= pg_catalog.now()'
+      ) = 0
+    THEN
+      RAISE EXCEPTION '0397 interaction rotation patch failed'
+        USING ERRCODE = '55000';
+    END IF;
+
+    EXECUTE patched;
+  END IF;
+END
+$sandbox_deadline_rotation_preemption$;
+
+RESET statement_timeout;
+RESET lock_timeout;

package/drizzle/0398_organization_workspace_management_entry.sql

@@ -0,0 +1,206 @@
+-- deployment-mode: rolling
+-- Shared-workspace creators receive explicit operational administration while
+-- organization administrators retain a separate, content-blind lifecycle
+-- authority for the workspace management surface.
+
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '10min';
+
+ALTER FUNCTION organization_workspace_command(jsonb)
+  RENAME TO organization_workspace_command_without_creator_access;
+
+REVOKE ALL ON FUNCTION organization_workspace_command_without_creator_access(jsonb) FROM PUBLIC;
+
+CREATE FUNCTION organization_workspace_command(p_command jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $body$
+DECLARE
+  result jsonb;
+  actor_membership_id uuid;
+  creator_grant_operation_id uuid;
+  creator_grant_operation_hash text;
+BEGIN
+  result := organization_workspace_command_without_creator_access(p_command);
+  IF p_command ->> 'action' IS DISTINCT FROM 'create' THEN
+    RETURN result;
+  END IF;
+  -- A create receipt written before this migration has no child grant receipt.
+  -- Preserve that historical outcome instead of turning a retry into a new
+  -- privilege grant after rollout.
+  IF coalesce((result ->> 'replay')::boolean, false) THEN
+    RETURN result;
+  END IF;
+
+  SELECT membership.id INTO actor_membership_id
+  FROM organization_memberships membership
+  WHERE membership.account_id = nullif(p_command ->> 'organizationId', '')::uuid
+    AND membership.subject_id = p_command ->> 'actorSubjectId'
+    AND membership.status = 'active'
+    AND membership.role IN ('owner', 'admin');
+  IF actor_membership_id IS NULL THEN
+    RAISE EXCEPTION 'organization administration required' USING ERRCODE = '42501';
+  END IF;
+
+  -- Derive one stable, private follow-up operation from the public create key.
+  -- A committed create can therefore be retried safely after a lost response,
+  -- without ever re-elevating a creator who was deliberately demoted later.
+  creator_grant_operation_hash := pg_catalog.md5(
+    'organization-workspace-creator-admin:' || (p_command ->> 'operationId')
+  );
+  creator_grant_operation_id := (
+    pg_catalog.substr(creator_grant_operation_hash, 1, 12)
+    || '5'
+    || pg_catalog.substr(creator_grant_operation_hash, 14, 3)
+    || '8'
+    || pg_catalog.substr(creator_grant_operation_hash, 18)
+  )::uuid;
+
+  result := result || organization_workspace_command_without_creator_access(
+    pg_catalog.jsonb_build_object(
+      'action', 'grant',
+      'organizationId', p_command ->> 'organizationId',
+      'actorSubjectId', p_command ->> 'actorSubjectId',
+      'workspaceId', result ->> 'workspaceId',
+      'targetOrganizationMembershipId', actor_membership_id,
+      'role', 'admin',
+      'operationId', creator_grant_operation_id
+    )
+  );
+  RETURN result;
+END
+$body$;
+
+CREATE FUNCTION authorize_organization_shared_workspace_administration(
+  p_account_id uuid,
+  p_workspace_id uuid,
+  p_actor_subject_id text
+) RETURNS void
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path FROM CURRENT
+AS $body$
+DECLARE
+  actor organization_memberships%ROWTYPE;
+BEGIN
+  IF p_account_id IS NULL OR p_workspace_id IS NULL OR p_actor_subject_id IS NULL
+    OR p_account_id IS DISTINCT FROM opengeni_private.current_account_id()
+    OR p_workspace_id IS DISTINCT FROM opengeni_private.current_workspace_id()
+    OR p_actor_subject_id IS DISTINCT FROM opengeni_private.current_subject_id()
+  THEN
+    RAISE EXCEPTION 'organization workspace administration is invalid'
+      USING ERRCODE = '22023';
+  END IF;
+
+  PERFORM pg_catalog.pg_advisory_xact_lock(
+    pg_catalog.hashtextextended('organization-membership:' || p_account_id::text, 0)
+  );
+  PERFORM pg_catalog.set_config(
+    'opengeni.organization_tenancy_lifecycle',
+    'organization_membership_lifecycle', true
+  );
+  PERFORM 1 FROM managed_accounts account
+  WHERE account.id = p_account_id FOR KEY SHARE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'organization not found' USING ERRCODE = 'P0002';
+  END IF;
+
+  SELECT * INTO actor FROM organization_memberships membership
+  WHERE membership.account_id = p_account_id
+    AND membership.subject_id = p_actor_subject_id
+  FOR SHARE;
+  IF NOT FOUND OR actor.status <> 'active' OR actor.role NOT IN ('owner', 'admin') THEN
+    RAISE EXCEPTION 'organization administration required' USING ERRCODE = '42501';
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM workspaces workspace
+    WHERE workspace.account_id = p_account_id AND workspace.id = p_workspace_id
+  ) THEN
+    RAISE EXCEPTION 'workspace not found' USING ERRCODE = 'P0002';
+  END IF;
+  IF EXISTS (
+    SELECT 1 FROM organization_memberships membership
+    WHERE membership.account_id = p_account_id
+      AND membership.personal_workspace_id = p_workspace_id
+  ) THEN
+    RAISE EXCEPTION 'personal workspaces are not administrable'
+      USING ERRCODE = '42501';
+  END IF;
+END
+$body$;
+
+REVOKE ALL ON FUNCTION organization_workspace_command(jsonb) FROM PUBLIC;
+REVOKE ALL ON FUNCTION authorize_organization_shared_workspace_administration(uuid,uuid,text)
+  FROM PUBLIC;
+
+DO $pin_and_grant$
+DECLARE
+  data_schema text := current_schema();
+  legacy_owner oid;
+  grantee_name text;
+BEGIN
+  EXECUTE format(
+    'ALTER FUNCTION %I.organization_workspace_command_without_creator_access(jsonb) SET search_path = pg_catalog, %I, pg_temp',
+    data_schema, data_schema
+  );
+  EXECUTE format(
+    'ALTER FUNCTION %I.organization_workspace_command(jsonb) SET search_path = pg_catalog, %I, pg_temp',
+    data_schema, data_schema
+  );
+  EXECUTE format(
+    'ALTER FUNCTION %I.authorize_organization_shared_workspace_administration(uuid,uuid,text) SET search_path = pg_catalog, %I, pg_temp',
+    data_schema, data_schema
+  );
+  -- Renaming preserved the legacy function's ACL. Atomically move every
+  -- supported runtime role to the replacement wrapper before removing its
+  -- bypass access, so a migrate-then-provision rollout has no outage window.
+  SELECT function.proowner INTO legacy_owner
+  FROM pg_catalog.pg_proc function
+  WHERE function.oid =
+    'organization_workspace_command_without_creator_access(jsonb)'::regprocedure;
+  FOR grantee_name IN
+    SELECT role.rolname
+    FROM pg_catalog.pg_proc function
+    CROSS JOIN LATERAL pg_catalog.aclexplode(
+      coalesce(function.proacl, pg_catalog.acldefault('f', function.proowner))
+    ) grant_value
+    JOIN pg_catalog.pg_roles role ON role.oid = grant_value.grantee
+    WHERE function.oid =
+        'organization_workspace_command_without_creator_access(jsonb)'::regprocedure
+      AND grant_value.privilege_type = 'EXECUTE'
+      AND grant_value.grantee <> legacy_owner
+  LOOP
+    EXECUTE format(
+      'GRANT EXECUTE ON FUNCTION %I.organization_workspace_command(jsonb) TO %I',
+      data_schema, grantee_name
+    );
+    EXECUTE format(
+      'GRANT EXECUTE ON FUNCTION %I.authorize_organization_shared_workspace_administration(uuid,uuid,text) TO %I',
+      data_schema, grantee_name
+    );
+    EXECUTE format(
+      'REVOKE EXECUTE ON FUNCTION %I.organization_workspace_command_without_creator_access(jsonb) FROM %I',
+      data_schema, grantee_name
+    );
+  END LOOP;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    EXECUTE format(
+      'REVOKE ALL ON FUNCTION %I.organization_workspace_command_without_creator_access(jsonb) FROM opengeni_app',
+      data_schema
+    );
+    EXECUTE format(
+      'GRANT EXECUTE ON FUNCTION %I.organization_workspace_command(jsonb) TO opengeni_app',
+      data_schema
+    );
+    EXECUTE format(
+      'GRANT EXECUTE ON FUNCTION %I.authorize_organization_shared_workspace_administration(uuid,uuid,text) TO opengeni_app',
+      data_schema
+    );
+  END IF;
+END
+$pin_and_grant$;
+
+COMMENT ON FUNCTION organization_workspace_command(jsonb) IS
+  'Idempotent organization-admin shared-workspace command. A create atomically materializes an explicit named admin grant for its creator.';
+COMMENT ON FUNCTION authorize_organization_shared_workspace_administration(uuid,uuid,text) IS
+  'Transaction-scoped, content-blind organization owner/admin authority for managing one shared workspace. It grants no operational workspace access.';