@opengeni/db 4.2.2 → 4.3.2-canary.0

package/src/session-tenancy.ts

@@ -95,6 +95,7 @@ export type TransitionSessionVisibilityInput = {
   targetVisibility: SessionTenancyVisibility;
   expectedAuthorityEpoch: number;
   operationKey: string;
+  beforeCommit?: (tx: Database) => Promise<void>;
 };
 
 export type TransitionSessionVisibilityResult = {
@@ -124,6 +125,7 @@ export type ForkSessionContentInput = {
   operationKey: string;
   runtimeRequest?: ForkSessionRuntimeRequest;
   runtimeConfiguration?: ForkSessionRuntimeConfiguration;
+  beforeCommit?: (tx: Database) => Promise<void>;
 };
 
 export type ForkSessionRuntimeRequest = {
@@ -469,6 +471,7 @@ export async function transitionSessionVisibility(
         );
         const result = rows[0];
         if (!result) throw new Error("Session visibility transition returned no result");
+        await input.beforeCommit?.(scopedDb);
         return result;
       },
       undefined,
@@ -545,6 +548,7 @@ export async function forkSessionContent(
           );
           const result = rows[0];
           if (!result) throw new Error("Session fork returned no result");
+          await input.beforeCommit?.(scopedDb);
           return result;
         }
         const rows = await rawRows<ForkSessionContentResult>(
@@ -577,6 +581,7 @@ export async function forkSessionContent(
         );
         const result = rows[0];
         if (!result) throw new Error("Session fork returned no result");
+        await input.beforeCommit?.(scopedDb);
         return result;
       },
       undefined,
@@ -649,6 +654,7 @@ export async function replayAppliedSessionFork(
             ${runtimeDigest}
           )`,
           );
+          await input.beforeCommit?.(scopedDb);
           return rows[0] ?? null;
         }
         const rows = await rawRows<ForkSessionContentResult>(
@@ -678,6 +684,7 @@ export async function replayAppliedSessionFork(
           ${SESSION_TENANCY_ACTIVATION_VERSION}
         )`,
         );
+        await input.beforeCommit?.(scopedDb);
         return rows[0] ?? null;
       },
     );

package/src/workspace-artifacts.ts

@@ -538,7 +538,11 @@ async function assertAttemptAuthority(
       FOR NO KEY UPDATE OF session
     ), locked_turn AS MATERIALIZED (
       SELECT turn.id, turn.account_id, turn.workspace_id, turn.session_id,
-        turn.active_attempt_id, turn.execution_generation, turn.initiator_subject_id
+        turn.active_attempt_id, turn.execution_generation,
+        coalesce(
+          turn.initiating_human_subject_id,
+          case when turn.initiator_kind = 'subject' then turn.initiator_subject_id end
+        ) as initiating_human_subject_id
       FROM session_turns turn
       JOIN locked_session session
         ON session.id = turn.session_id
@@ -548,8 +552,10 @@ async function assertAttemptAuthority(
         AND turn.active_attempt_id = ${input.sourceAttemptId}::uuid
         AND turn.execution_generation = ${input.sourceExecutionGeneration}
         AND turn.status IN ('running', 'requires_action', 'recovering', 'waiting_capacity')
-        AND turn.initiator_kind = 'subject'
-        AND length(btrim(turn.initiator_subject_id)) BETWEEN 1 AND 1024
+        AND length(btrim(coalesce(
+          turn.initiating_human_subject_id,
+          case when turn.initiator_kind = 'subject' then turn.initiator_subject_id end
+        ))) BETWEEN 1 AND 1024
       FOR UPDATE OF turn
     ), locked_attempt AS MATERIALIZED (
       SELECT attempt.id, attempt.account_id, attempt.workspace_id,
@@ -578,7 +584,7 @@ async function assertAttemptAuthority(
   `)) as unknown as Array<{ id: string }>;
   if (!rows[0]) {
     throw new WorkspaceArtifactOperationError(
-      "Artifact mutation requires the exact active attempt and execution generation",
+      "Artifact mutation requires the exact active attempt, execution generation, and immutable human authority",
     );
   }
 }

package/src/workspace-authority.ts

@@ -54,10 +54,10 @@ import { rawRows, type Database } from "./database";
  * adding a caller, that stamp is the part you have to get right; this function
  * will happily answer `true` for any subject you scope a transaction to.
  *
- * Non-`user:` subjects (API keys, delegated service principals, configured and
- * local principals) can never own an organization membership, so they
- * short-circuit to the plain membership answer instead of tripping
- * `list_self_organization_memberships`' `42501`.
+ * Persisted `external_user:` subjects also have an organization membership and
+ * an exact Personal pointer. They use the same consistency check only after the
+ * API's dedicated verified external proof, never a native-cookie stamp. Other
+ * service/configured/local subjects retain the plain membership answer.
  */
 export async function subjectHasLiveWorkspaceAuthorityInScope(
   scopedDb: Database,
@@ -83,7 +83,7 @@ export async function subjectHasLiveWorkspaceAuthorityInScope(
         and workspace_id = ${input.workspaceId}
       limit 1`,
   );
-  if (!input.subjectId.startsWith("user:")) {
+  if (!input.subjectId.startsWith("user:") && !input.subjectId.startsWith("external_user:")) {
     return Boolean(membershipRow);
   }
   const [organizationMembershipResult] = await rawRows<{ result: unknown }>(