@pikku/mongodb 0.12.9 → 0.12.11

package/CHANGELOG.md

@@ -1,5 +1,79 @@
 # @pikku/mongodb
 
+## 0.12.11
+
+### Patch Changes
+
+- e3d4454: Add job groups, so one shared queue can stay fair without splitting into one
+  queue per producer.
+
+  A job may now carry `group: { id, tier }`, and a worker may cap how many jobs
+  of any one group run at once via `groupConcurrency`. On pg-boss this maps to
+  `localGroupConcurrency`, which excludes at-capacity groups from the fetch query
+  itself, so a capped group costs nothing rather than being fetched and restored.
+  BullMQ declares it unsupported (groups are a BullMQ Pro feature) — being
+  push-based, it can simply use a queue per group at no polling cost.
+
+  Workflow services accept a `queueStrategy`. The default `'per-workflow'` is
+  unchanged: every workflow gets its own `wf-orchestrator-*` / `wf-step-*` queue,
+  which is also what lets serverless providers deploy one unit per workflow. The
+  new `'shared-groups'` routes every workflow through the shared
+  orchestrator/step-worker queues and isolates them by group instead, so a
+  monolith runs one set of pollers rather than one per workflow — on a
+  pull-based backend with dozens of workflows that is the difference between
+  hundreds of poll loops and twenty. It is for single-process runtimes only; a
+  per-unit serverless deploy still needs the per-workflow queues to route to its
+  units.
+
+- Updated dependencies [24252b8]
+- Updated dependencies [e3d4454]
+  - @pikku/core@0.12.69
+
+## 0.12.10
+
+### Patch Changes
+
+- 4324652: Scope AI agent thread reads to the calling session.
+
+  The generated thread-management functions (`getAgentThreads`,
+  `getAgentThreadMessages`, `getAgentThreadRuns`, `deleteAgentThread`) keyed purely
+  off a caller-supplied `threadId` and treated `resourceId` as an optional filter,
+  so omitting it enumerated every tenant's threads.
+  - `listThreads` gains an `owners` **authorization constraint** (distinct from the
+    `resourceId` filter): an empty array matches nothing, and it is always derived
+    from the session, never from input. Implemented across the Kysely, Redis and
+    MongoDB agent run services, with LIKE/regex metacharacter escaping so an owner
+    id containing `_` or `%` cannot match a foreign owner.
+  - The three `threadId`-keyed functions are now guarded by an `isThreadOwner`
+    `pikkuPermission` rather than an in-body check. A thread that does not exist is
+    denied rather than 404'd, so it is indistinguishable from one owned by someone
+    else.
+  - New `@pikku/core/ai-agent` helpers: `canAccessThread`, `threadOwnerConstraint`,
+    `sessionPrincipals`, `isOwnedByPrincipal`.
+
+  Services destructured by a wired function are now non-optional inside it.
+
+  The inspector already aggregated the services used by every wired `func`,
+  `permissions` and `middleware` into `RequiredSingletonServices`, but the
+  generated function types defaulted their service parameter to the raw `Services`
+  — so a service declared `foo?: Foo` still arrived as possibly-undefined, forcing
+  `if (!foo) throw new MissingServiceError(...)` guards that could never fire.
+  Generated types now expose `WiredSingletonServices` / `WiredServices`
+  (`RequiredSingletonServices & Services`) and default the `RequiredServices`
+  generic of functions, permissions, middleware, auth and approval-description
+  helpers to them. Optionality now means only what it should: "this service may
+  not be created, because nothing uses it".
+
+- Updated dependencies [5f19016]
+- Updated dependencies [78e4778]
+- Updated dependencies [4324652]
+- Updated dependencies [de044f8]
+- Updated dependencies [cd1a811]
+- Updated dependencies [19fa6f0]
+- Updated dependencies [b501612]
+- Updated dependencies [eb37b1e]
+  - @pikku/core@0.12.66
+
 ## 0.12.9
 
 ### Patch Changes

package/dist/src/mongodb-agent-run-service.d.ts

@@ -9,6 +9,7 @@ export declare class MongoDBAgentRunService implements AgentRunService {
     listThreads(options?: {
         agentName?: string;
         resourceId?: string;
+        owners?: string[];
         limit?: number;
         offset?: number;
     }): Promise<AIThread[]>;

package/dist/src/mongodb-agent-run-service.js

@@ -1,3 +1,6 @@
+// Owner ids are untrusted input to the regex, so metacharacters must not be
+// able to widen the prefix match.
+const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 export class MongoDBAgentRunService {
     threads;
     messages;
@@ -10,11 +13,21 @@ export class MongoDBAgentRunService {
         this.runs = db.collection('ai_run');
     }
     async listThreads(options) {
-        const { agentName, resourceId, limit = 50, offset = 0 } = options ?? {};
+        const { agentName, resourceId, owners, limit = 50, offset = 0, } = options ?? {};
+        // An owners constraint is an authorization boundary, so an empty list must
+        // match nothing rather than degrade to "no filter".
+        if (owners && owners.length === 0)
+            return [];
         let filter = {};
         if (resourceId) {
             filter.resourceId = resourceId;
         }
+        if (owners) {
+            filter.$or = owners.flatMap((owner) => [
+                { resourceId: owner },
+                { resourceId: { $regex: `^${escapeRegExp(owner)}:` } },
+            ]);
+        }
         if (agentName) {
             const threadIds = await this.runs.distinct('threadId', {
                 agentName,

package/dist/src/mongodb-workflow-service.d.ts

@@ -1,5 +1,5 @@
 import type { SerializedError } from '@pikku/core';
-import { PikkuWorkflowService, type WorkflowPlannedStep, type WorkflowRun, type WorkflowRunWire, type StepState, type StepStatus, type WorkflowStatus, type WorkflowVersionStatus } from '@pikku/core/workflow';
+import { PikkuWorkflowService, type WorkflowPlannedStep, type WorkflowQueueOptions, type WorkflowRun, type WorkflowRunWire, type StepState, type StepStatus, type WorkflowStatus, type WorkflowVersionStatus } from '@pikku/core/workflow';
 import type { Db } from 'mongodb';
 export declare class MongoDBWorkflowService extends PikkuWorkflowService {
     private initialized;
@@ -8,7 +8,7 @@ export declare class MongoDBWorkflowService extends PikkuWorkflowService {
     private steps;
     private stepHistory;
     private versions;
-    constructor(db: Db);
+    constructor(db: Db, options?: WorkflowQueueOptions);
     init(): Promise<void>;
     protected createRunImpl(workflowName: string, input: any, inline: boolean, graphHash: string, wire: WorkflowRunWire, options?: {
         deterministic?: boolean;

package/dist/src/mongodb-workflow-service.js

@@ -7,8 +7,8 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
     steps;
     stepHistory;
     versions;
-    constructor(db) {
-        super();
+    constructor(db, options = {}) {
+        super(options);
         this.runService = new MongoDBWorkflowRunService(db);
         this.runs = db.collection('workflow_runs');
         this.steps = db.collection('workflow_step');
@@ -216,13 +216,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
             .limit(1)
             .toArray();
         if (latestHistory.length > 0) {
-            await this.stepHistory.updateOne({ _id: latestHistory[0]._id }, {
-                $set: {
-                    status: 'failed',
-                    error: serializedError,
-                    failedAt: new Date(),
-                },
-            });
+            await this.stepHistory.updateOne({ _id: latestHistory[0]._id }, { $set: { status: 'failed', error: serializedError, failedAt: new Date() } });
         }
     }
     async createRetryAttemptImpl(stepId, status) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/mongodb",
-  "version": "0.12.9",
+  "version": "0.12.11",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
   "module": "dist/src/index.js",
@@ -17,7 +17,7 @@
     "prepublishOnly": "yarn build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.44"
+    "@pikku/core": "^0.12.69"
   },
   "dependencies": {
     "mongodb": "^6.12.0"

package/run-tests.sh

@@ -38,16 +38,16 @@ if [ ${#files[@]} -eq 0 ]; then
 fi
 
 # Construct the node command
-node_cmd="node --import tsx --test"
+node_cmd=(node --import tsx --test)
 
 # Append options based on flags
 if [ "$watch_mode" = true ]; then
-  node_cmd="$node_cmd --watch"
+  node_cmd+=(--watch)
 fi
 
 if [ "$coverage_mode" = true ]; then
-  node_cmd="$node_cmd --test-coverage-include=\"src/**/*.{ts,js}\" --test-coverage-exclude=\"**/dist/**\" --experimental-test-coverage --test-reporter=lcov --test-reporter-destination=lcov.info"
+  node_cmd+=(--test-coverage-include="src/**/*.{ts,js}" --test-coverage-exclude="**/dist/**" --experimental-test-coverage --test-reporter=lcov --test-reporter-destination=lcov.info)
 fi
 
 # Execute the node command with the expanded list of files
-$node_cmd "${files[@]}"
+"${node_cmd[@]}" "${files[@]}"

package/src/mongodb-agent-run-service.ts

@@ -6,6 +6,11 @@ import type {
 } from '@pikku/core/ai-agent'
 import type { Db, Collection } from 'mongodb'
 
+// Owner ids are untrusted input to the regex, so metacharacters must not be
+// able to widen the prefix match.
+const escapeRegExp = (value: string) =>
+  value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+
 interface AIThreadDoc {
   _id: string
   resourceId: string
@@ -71,10 +76,21 @@ export class MongoDBAgentRunService implements AgentRunService {
   async listThreads(options?: {
     agentName?: string
     resourceId?: string
+    owners?: string[]
     limit?: number
     offset?: number
   }): Promise<AIThread[]> {
-    const { agentName, resourceId, limit = 50, offset = 0 } = options ?? {}
+    const {
+      agentName,
+      resourceId,
+      owners,
+      limit = 50,
+      offset = 0,
+    } = options ?? {}
+
+    // An owners constraint is an authorization boundary, so an empty list must
+    // match nothing rather than degrade to "no filter".
+    if (owners && owners.length === 0) return []
 
     let filter: Record<string, any> = {}
 
@@ -82,6 +98,13 @@ export class MongoDBAgentRunService implements AgentRunService {
       filter.resourceId = resourceId
     }
 
+    if (owners) {
+      filter.$or = owners.flatMap((owner) => [
+        { resourceId: owner },
+        { resourceId: { $regex: `^${escapeRegExp(owner)}:` } },
+      ])
+    }
+
     if (agentName) {
       const threadIds = await this.runs.distinct('threadId', {
         agentName,

package/src/mongodb-workflow-service.ts

@@ -2,6 +2,7 @@ import type { SerializedError } from '@pikku/core'
 import {
   PikkuWorkflowService,
   type WorkflowPlannedStep,
+  type WorkflowQueueOptions,
   type WorkflowRun,
   type WorkflowRunWire,
   type StepState,
@@ -77,8 +78,8 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
   private stepHistory: Collection<WorkflowStepHistoryDoc>
   private versions: Collection<WorkflowVersionDoc>
 
-  constructor(db: Db) {
-    super()
+  constructor(db: Db, options: WorkflowQueueOptions = {}) {
+    super(options)
     this.runService = new MongoDBWorkflowRunService(db)
     this.runs = db.collection<WorkflowRunDoc>('workflow_runs')
     this.steps = db.collection<WorkflowStepDoc>('workflow_step')