@opengeni/db 5.0.1 → 6.0.0

package/src/connection-authority.ts

@@ -1,26 +1,12 @@
 import {
-  ConnectionAuthorityGrant,
-  ConnectionAuthoritySummary,
   ConnectionUseDenialReason,
   ConnectionUseAttribution,
-  ConnectionUseAuthorizationResult,
-  ConnectionUseAuthoritySnapshot,
-  type IssueConnectionUseGrantRequest,
   type ConnectionUseDenialReason as ConnectionUseDenialReasonValue,
 } from "@opengeni/contracts/connection-authority";
-import {
-  ConnectionKind,
-  type ConnectionKind as ConnectionKindValue,
-  type UserResourceDelegation,
-} from "@opengeni/contracts";
+import { ConnectionKind, type ConnectionKind as ConnectionKindValue } from "@opengeni/contracts";
 import { sql } from "drizzle-orm";
 import { getExternalLinkTurnAuthorization } from "./external-link-work";
 import { rawRows, setSubjectRlsContext, withRlsContext, type Database } from "./database";
-import {
-  issueSelfUserResourceGrant,
-  listSelfUserResourceAuthorities,
-  revokeSelfUserResourceGrant,
-} from "./user-resource-authority";
 
 async function withOwnerContext<T>(
   db: Database,
@@ -33,151 +19,19 @@ async function withOwnerContext<T>(
   });
 }
 
-export async function listSelfConnectionAuthorities(
+/** Called only after the core layer has established the authenticated sender. */
+export async function listOwnedConnectionAccounts(
   db: Database,
   input: { accountId: string; workspaceId: string; subjectId: string },
-): Promise<ConnectionAuthoritySummary[]> {
-  const page = await listSelfUserResourceAuthorities(db, {
-    ...input,
-    resourceKind: "connection",
-    limit: 100,
-  });
-  return page.authorities.map(({ resourceKind: _resourceKind, ...authority }) =>
-    ConnectionAuthoritySummary.parse(authority),
-  );
-}
-
-export async function issueSelfConnectionUseGrant(
-  db: Database,
-  input: {
-    accountId: string;
-    workspaceId: string;
-    subjectId: string;
-    authorityId: string;
-    request: IssueConnectionUseGrantRequest;
-  },
-) {
-  return ConnectionAuthorityGrant.parse(
-    await issueSelfUserResourceGrant(db, {
-      accountId: input.accountId,
-      workspaceId: input.workspaceId,
-      subjectId: input.subjectId,
-      authorityId: input.authorityId,
-      resourceKind: "connection",
-      mode: input.request.mode,
-      context: input.request.context,
-      sessionId: input.request.sessionId ?? null,
-      expectedAuthorityEpoch: input.request.expectedAuthorityEpoch ?? null,
-      workspaceSharedAcknowledged: input.request.workspaceSharedAcknowledged,
-    }),
-  );
-}
-
-export async function revokeSelfConnectionUseGrant(
-  db: Database,
-  input: { accountId: string; workspaceId: string; subjectId: string; grantId: string },
-): Promise<{ grantId: string; generation: number; status: "revoked"; revokedAt: string }> {
-  return await revokeSelfUserResourceGrant(db, input);
-}
-
-/**
- * Resolves the immutable physical origin for one explicit common-user
- * connection selection. The SECURITY DEFINER database boundary proves the
- * owning human, active organization membership, target-workspace access, and
- * exact authority/grant generations without exposing credentials or allowing
- * an ambient cross-workspace inventory.
- */
-export async function resolvePersonalConnectionAuthoritySelectionOrigin(
-  db: Database,
-  input: {
-    accountId: string;
-    targetWorkspaceId: string;
-    subjectId: string;
-    connectionId: string;
-    delegation: UserResourceDelegation;
-  },
-): Promise<string | null> {
-  return await withOwnerContext(
-    db,
-    {
-      accountId: input.accountId,
-      workspaceId: input.targetWorkspaceId,
-      subjectId: input.subjectId,
-    },
-    async (scopedDb) => {
-      const [row] = await rawRows<{ originWorkspaceId: string }>(
-        scopedDb,
-        sql`
-          select origin_workspace_id as "originWorkspaceId"
-          from resolve_personal_connection_authority_selection(
-            ${input.accountId}::uuid, ${input.targetWorkspaceId}::uuid,
-            ${input.subjectId}, ${input.connectionId}::uuid,
-            ${JSON.stringify(input.delegation)}::text::jsonb
-          )
-        `,
-      );
-      return row?.originWorkspaceId ?? null;
-    },
-  );
-}
-
-export async function resolveConnectionUseAuthority(
-  db: Database,
-  input: { snapshot: unknown },
-): Promise<ConnectionUseAuthorizationResult> {
-  const snapshot = ConnectionUseAuthoritySnapshot.parse(input.snapshot);
-  return await withRlsContext(
-    db,
-    { accountId: snapshot.organizationId, workspaceId: snapshot.targetWorkspaceId },
-    async (scopedDb) => {
-      if (snapshot.ownerSubjectId) {
-        await setSubjectRlsContext(scopedDb, snapshot.ownerSubjectId);
-      }
-      const [row] = await rawRows<{
-        authorizationStatus: "authorized" | "denied";
-        denialReason: string | null;
-        connectionId: string | null;
-        connectionGeneration: number | null;
-        authorityScope: "workspace" | "user" | null;
-        ownerSubjectId: string | null;
-        authorityId: string | null;
-        grantId: string | null;
-      }>(
-        scopedDb,
-        sql`
-          select authorization_status as "authorizationStatus",
-            denial_reason as "denialReason", connection_id as "connectionId",
-            connection_generation::int as "connectionGeneration",
-            authority_scope as "authorityScope", owner_subject_id as "ownerSubjectId",
-            authority_id as "authorityId", grant_id as "grantId"
-          from resolve_connection_use_authority(
-            ${snapshot.organizationId}::uuid, ${snapshot.targetWorkspaceId}::uuid,
-            ${snapshot.targetSessionId}::uuid, ${JSON.stringify(snapshot)}::text::jsonb
-          )
-        `,
-      );
-      if (!row) throw new Error("connection use authorization was not returned");
-      if (row.authorizationStatus === "denied") {
-        return ConnectionUseAuthorizationResult.parse({
-          status: "denied",
-          reason: row.denialReason,
-        });
-      }
-      return ConnectionUseAuthorizationResult.parse({
-        status: "authorized",
-        attribution: ConnectionUseAttribution.parse({
-          organizationId: snapshot.organizationId,
-          workspaceId: snapshot.targetWorkspaceId,
-          sessionId: snapshot.targetSessionId,
-          connectionId: row.connectionId,
-          connectionGeneration: row.connectionGeneration,
-          scope: row.authorityScope,
-          ownerSubjectId: row.ownerSubjectId,
-          authorityId: row.authorityId,
-          grantId: row.grantId,
-        }),
-      });
-    },
+): Promise<Array<{ connectionId: string; originWorkspaceId: string }>> {
+  return withOwnerContext(db, input, async (tx) =>
+    rawRows<{ connectionId: string; originWorkspaceId: string }>(
+      tx,
+      sql`
+      select connection_id as "connectionId", origin_workspace_id as "originWorkspaceId"
+      from list_owned_connection_accounts(${input.accountId}::uuid, ${input.workspaceId}::uuid)
+    `,
+    ),
   );
 }
 

package/src/connection-refresh-lock.ts

@@ -0,0 +1,22 @@
+import { sql } from "drizzle-orm";
+import { setSubjectRlsContext, withRlsContext, type Database } from "./database";
+import type { ConnectionCredentialForBroker } from "./connection-token-resolver";
+
+/** Serialize rotating-token exchange across workers, not only within one process. */
+export async function withConnectionRefreshLock<T>(
+  db: Database,
+  credential: ConnectionCredentialForBroker,
+  work: (lockedDb: Database) => Promise<T>,
+): Promise<T> {
+  return withRlsContext(
+    db,
+    { accountId: credential.accountId, workspaceId: credential.workspaceId },
+    async (tx) => {
+      if (credential.subjectId) await setSubjectRlsContext(tx, credential.subjectId);
+      await tx.execute(
+        sql`select pg_advisory_xact_lock(hashtextextended(${`connection-refresh:${credential.id}`}, 0))`,
+      );
+      return work(tx);
+    },
+  );
+}