@opengeni/db 4.3.2 → 4.3.3-canary.1

package/src/computer-sessions.ts

@@ -504,7 +504,11 @@ export async function prepareComputerSessionCreate(
           state: "prepared",
           actorSubjectId: input.actorSubjectId,
         })
-        .onConflictDoNothing({ target: schema.interactionOperations.operationId })
+        // The operation also has a workspace/operation unique index. Concurrent
+        // speculative inserts can collide there even when the primary-key
+        // arbiter would deduplicate them. Arbitrate every constraint, then use
+        // the scoped lookup and immutable request checks below to authorize replay.
+        .onConflictDoNothing()
         .returning();
       if (!insertedOperation) {
         const existing = await loadOperation(tx, input.workspaceId, input.operationId);

package/src/connection-token-resolver.ts

@@ -126,6 +126,8 @@ export type ResolveConnectionCredentialResult =
       connectionVersion?: number;
       /** Metadata-only owner attribution from the immediate pre-use fence. */
       connectionUseAttribution?: ConnectionUseAttribution;
+      /** Metadata-only equality key from current live authority; never credentials or authorization. */
+      operationAuthorityDigest?: string;
       /**
        * Revalidate the exact accepted attempt immediately before one target
        * provider request. Credential lookup/refresh is a separate audited

package/src/database.ts

@@ -715,12 +715,24 @@ export async function withSessionActivityRlsContext<T>(
   fn: (db: SessionActivityDatabase) => Promise<T>,
   transactionConfig?: PgTransactionConfig,
   fenceMode: "shared" | "none" = "shared",
+  organizationMembershipFence = false,
 ): Promise<T> {
   await assertSessionActivityGateEntry(db);
   return await withRlsContext(
     db,
     context,
     async (scopedDb) => {
+      if (organizationMembershipFence) {
+        // Claim can inherit membership-fenced authority after locking sessions.
+        // Acquire membership before even a shared tenancy fence: an exclusive
+        // tenancy/control waiter can otherwise complete the same lock cycle.
+        await scopedDb.execute(sql`select pg_advisory_xact_lock(
+          hashtextextended(${`organization-membership:${context.accountId}`}, 0))`);
+        if (fenceMode === "shared") {
+          await scopedDb.execute(sql`select pg_advisory_xact_lock_shared(
+            hashtextextended(${`session-tenancy:${context.workspaceId}`}, 0))`);
+        }
+      }
       const gate = await beginSessionActivityGate(scopedDb, context.workspaceId);
       const value = await fn(gate.db);
       // The finalizer must never trust tenant GUCs that arbitrary callback code
@@ -733,7 +745,7 @@ export async function withSessionActivityRlsContext<T>(
       return value;
     },
     transactionConfig,
-    fenceMode,
+    organizationMembershipFence ? "none" : fenceMode,
   );
 }
 
@@ -807,10 +819,19 @@ export async function withSessionActivitySavepoint<T>(
 export async function retrySessionActivityRls<T>(
   db: Database,
   workspaceId: string,
-  options: IdempotentPersistenceTransactionOptions,
+  options: IdempotentPersistenceTransactionOptions & {
+    /** Claim can inherit membership-fenced causal authority after locking the
+     * session. Acquire that fence before tenancy/control/session instead. An
+     * enclosing transaction must preserve this same lock prefix. */
+    organizationMembershipFence?: boolean;
+  },
   fn: (db: SessionActivityDatabase) => Promise<T>,
 ): Promise<T> {
   return await runIdempotentPersistenceTransaction(options, async () => {
+    if (options.organizationMembershipFence) {
+      const context = { ...(await rlsContextForWorkspace(db, workspaceId)), workspaceId };
+      return await withSessionActivityRlsContext(db, context, fn, undefined, "shared", true);
+    }
     return await withWorkspaceSessionActivityRls(db, workspaceId, fn);
   });
 }

package/src/host-mcp-bindings.ts

@@ -588,7 +588,19 @@ export async function inheritChildHostMcpTurnAuthorities(
 export async function authorizeDirectHostMcpUse(
   db: Database,
   request: McpCredentialsRequest,
+  /** Internal metadata observer; called only after every live authorization fence succeeds. */
+  onAuthorized?: (snapshot: HostMcpAcceptedAuthority) => void,
 ): Promise<boolean> {
+  const snapshot = await resolveDirectHostMcpUseAuthority(db, request);
+  if (!snapshot) return false;
+  onAuthorized?.(snapshot);
+  return true;
+}
+
+async function resolveDirectHostMcpUseAuthority(
+  db: Database,
+  request: McpCredentialsRequest,
+): Promise<HostMcpAcceptedAuthority | false> {
   if (!request.attemptId || !request.connectionRef.hostBinding) return false;
   const current = await getHostMcpLiveAttempt(
     db,
@@ -735,7 +747,8 @@ export async function authorizeDirectHostMcpUse(
     return (
       live !== null &&
       live.id === request.turnId &&
-      live.executionGeneration === request.executionGeneration
+      live.executionGeneration === request.executionGeneration &&
+      a
     );
   });
 }