@opengeni/db 4.2.2 → 4.3.0-canary.0

package/src/session-tenancy.ts

@@ -95,6 +95,7 @@ export type TransitionSessionVisibilityInput = {
   targetVisibility: SessionTenancyVisibility;
   expectedAuthorityEpoch: number;
   operationKey: string;
+  beforeCommit?: (tx: Database) => Promise<void>;
 };
 
 export type TransitionSessionVisibilityResult = {
@@ -124,6 +125,7 @@ export type ForkSessionContentInput = {
   operationKey: string;
   runtimeRequest?: ForkSessionRuntimeRequest;
   runtimeConfiguration?: ForkSessionRuntimeConfiguration;
+  beforeCommit?: (tx: Database) => Promise<void>;
 };
 
 export type ForkSessionRuntimeRequest = {
@@ -469,6 +471,7 @@ export async function transitionSessionVisibility(
         );
         const result = rows[0];
         if (!result) throw new Error("Session visibility transition returned no result");
+        await input.beforeCommit?.(scopedDb);
         return result;
       },
       undefined,
@@ -545,6 +548,7 @@ export async function forkSessionContent(
           );
           const result = rows[0];
           if (!result) throw new Error("Session fork returned no result");
+          await input.beforeCommit?.(scopedDb);
           return result;
         }
         const rows = await rawRows<ForkSessionContentResult>(
@@ -577,6 +581,7 @@ export async function forkSessionContent(
         );
         const result = rows[0];
         if (!result) throw new Error("Session fork returned no result");
+        await input.beforeCommit?.(scopedDb);
         return result;
       },
       undefined,
@@ -649,6 +654,7 @@ export async function replayAppliedSessionFork(
             ${runtimeDigest}
           )`,
           );
+          await input.beforeCommit?.(scopedDb);
           return rows[0] ?? null;
         }
         const rows = await rawRows<ForkSessionContentResult>(
@@ -678,6 +684,7 @@ export async function replayAppliedSessionFork(
           ${SESSION_TENANCY_ACTIVATION_VERSION}
         )`,
         );
+        await input.beforeCommit?.(scopedDb);
         return rows[0] ?? null;
       },
     );

package/src/workspace-authority.ts

@@ -54,10 +54,10 @@ import { rawRows, type Database } from "./database";
  * adding a caller, that stamp is the part you have to get right; this function
  * will happily answer `true` for any subject you scope a transaction to.
  *
- * Non-`user:` subjects (API keys, delegated service principals, configured and
- * local principals) can never own an organization membership, so they
- * short-circuit to the plain membership answer instead of tripping
- * `list_self_organization_memberships`' `42501`.
+ * Persisted `external_user:` subjects also have an organization membership and
+ * an exact Personal pointer. They use the same consistency check only after the
+ * API's dedicated verified external proof, never a native-cookie stamp. Other
+ * service/configured/local subjects retain the plain membership answer.
  */
 export async function subjectHasLiveWorkspaceAuthorityInScope(
   scopedDb: Database,
@@ -83,7 +83,7 @@ export async function subjectHasLiveWorkspaceAuthorityInScope(
         and workspace_id = ${input.workspaceId}
       limit 1`,
   );
-  if (!input.subjectId.startsWith("user:")) {
+  if (!input.subjectId.startsWith("user:") && !input.subjectId.startsWith("external_user:")) {
     return Boolean(membershipRow);
   }
   const [organizationMembershipResult] = await rawRows<{ result: unknown }>(