@sanoma-ai/workflows 0.11.12 → 0.11.14

package/src/db/identity.ts

@@ -0,0 +1,61 @@
+import { sql } from "drizzle-orm";
+import { bigint, boolean, check, pgSchema, text, timestamp, unique, uuid } from "drizzle-orm/pg-core";
+
+// The cloud identity broker's tables, in the schema `sanoma_identity` an administrator installs
+// with `CLOUD_IDENTITY_SQL` (`cloud-identity.ts`) and `CLOUD_IDENTITY_AUDIT_SQL`
+// (`identity-service.ts`), with their grants: the runtime never makes them, so no migration is
+// generated from this model. `installed-schemas.test.ts` holds the install SQL to it.
+
+export const identity = pgSchema("sanoma_identity");
+
+const when = () => timestamp({ withTimezone: true });
+
+/** Each enrolled deployment and the service account it may act as. */
+export const identityDeployments = identity.table("deployments", {
+  id: text().primaryKey(),
+  company: text().notNull(),
+  environment: text().notNull(),
+  serviceAccount: text().notNull(),
+  enabled: boolean().notNull().default(true),
+});
+
+/** Each deployment credential's hash, never the credential, with its generation and validity. */
+export const identityCredentials = identity.table(
+  "credentials",
+  {
+    hash: text().primaryKey(),
+    deployment: text()
+      .notNull()
+      .references(() => identityDeployments.id),
+    generation: bigint({ mode: "number" }).notNull(),
+    validFrom: when().notNull().defaultNow(),
+    validUntil: when().notNull(),
+    revoked: boolean().notNull().default(false),
+  },
+  (t) => [
+    unique("credentials_deployment_generation").on(t.deployment, t.generation),
+    check("credentials_hash", sql`${t.hash} ~ '^[0-9a-f]{64}$'`),
+    check("credentials_generation", sql`${t.generation} > 0`),
+    check("credentials_validity", sql`${t.validUntil} > ${t.validFrom}`),
+    check("credentials_finite", sql`isfinite(${t.validFrom}) AND isfinite(${t.validUntil})`),
+  ],
+);
+
+/** Each issuance decision, without token values. */
+export const identityAuditEvents = identity.table(
+  "audit_events",
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    recordedAt: when()
+      .notNull()
+      .default(sql`clock_timestamp()`),
+    result: text().$type<"issued" | "denied" | "unavailable">().notNull(),
+    deployment: text(),
+    company: text(),
+    environment: text(),
+    serviceAccount: text(),
+    generation: bigint({ mode: "number" }),
+    expiresAt: when(),
+  },
+  (t) => [check("audit_events_result", sql`${t.result} IN ('issued', 'denied', 'unavailable')`)],
+);

package/src/db/index.ts

@@ -0,0 +1,12 @@
+// `@sanoma-ai/workflows/db`, server-only: the runtime's tables and the database they are read
+// with, for the packages that share them (the connectors' stores, the app's tests), and the
+// migrator a connector applies its own generated folder with, under the preparation's lock. Never
+// a workflow's import: the shipped `oxlint.json` refuses it, as it does `/wakeup-service`.
+
+export { type Db, databaseOn, pgCode, underPreparationLock } from "../db.ts";
+export * from "./company.ts";
+export * from "./dbos.ts";
+export * from "./identity.ts";
+export * from "./kms.ts";
+export * from "./migrate.ts";
+export * from "./wakeup.ts";

package/src/db/kms.ts

@@ -0,0 +1,41 @@
+import { sql } from "drizzle-orm";
+import { boolean, check, jsonb, pgSchema, primaryKey, text, timestamp, uuid } from "drizzle-orm/pg-core";
+import type { Envelope } from "../kms-secrets.ts";
+
+// The KMS secret store's tables, in the schema `sanoma_kms` an administrator installs with
+// `KMS_SECRETS_SQL` (`kms-secrets.ts`) and `sanoma.secretStore.prepare` (`storage-provisioning.ts`),
+// with their grants: the runtime never makes them, so no migration is generated from this model.
+// `installed-schemas.test.ts` holds the install SQL to it.
+
+export const kms = pgSchema("sanoma_kms");
+
+/** Each secret's envelope, by company, namespace and path. */
+export const kmsSecrets = kms.table(
+  "secrets",
+  {
+    company: text().notNull(),
+    namespace: text().notNull(),
+    path: text().notNull(),
+    version: uuid().notNull(),
+    envelope: jsonb().$type<Envelope>().notNull(),
+    updatedBy: text().notNull(),
+    updatedAt: timestamp({ withTimezone: true })
+      .notNull()
+      .defaultNow()
+      .$onUpdate(() => sql`now()`),
+  },
+  (t) => [primaryKey({ columns: [t.company, t.namespace, t.path] })],
+);
+
+/** The one row binding the database to its company and environment, and the runtime role's credential hash. */
+export const kmsDeployment = kms.table(
+  "deployment",
+  {
+    singleton: boolean().primaryKey().default(true),
+    company: text().notNull(),
+    environment: text().notNull(),
+    runtimeRole: text().notNull(),
+    credentialHash: text().notNull(),
+  },
+  (t) => [check("deployment_singleton", sql`${t.singleton}`)],
+);

package/src/db/migrate.ts

@@ -0,0 +1,71 @@
+import { fileURLToPath } from "node:url";
+import { sql } from "drizzle-orm";
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+import type { Db } from "../db.ts";
+import companyJournal from "../../drizzle/company/meta/_journal.json" with { type: "json" };
+import wakeupJournal from "../../drizzle/wakeup/meta/_journal.json" with { type: "json" };
+
+// The generated migrations (`pnpm --filter @sanoma-ai/workflows generate`), one folder per
+// database the runtime makes tables in, each with its own journal table in the schema `drizzle`,
+// since the wakeup service's database may be a company's own. A connector's tables have folders
+// of their own, shaped the same (`@sanoma-ai/connector-better-auth`). The Worker, which never
+// migrates, checks a database against the journal shipped with the package
+// (`migrationsApplied`), with no file read: the journal is imported.
+
+/** Drizzle's journal, `meta/_journal.json` of a migrations folder. */
+export interface MigrationsJournal {
+  entries: { idx: number; when: number; tag: string }[];
+}
+
+/** A migrations folder with the journal table recording what of it a database has. */
+export interface Migrations {
+  /**
+   * The folder, beside the module declaring it (`new URL("../drizzle/<name>/", import.meta.url)`,
+   * from `src/` and from `dist/` alike), asked for only when migrating, never in the Worker.
+   */
+  folder(): URL;
+  /** Its journal table in the schema `drizzle`. */
+  table: string;
+  journal: MigrationsJournal;
+}
+
+/** The tables every company database gets (`db/company.ts`). */
+export const COMPANY_MIGRATIONS = {
+  folder: () => new URL("../../drizzle/company/", import.meta.url),
+  table: "__drizzle_migrations",
+  journal: companyJournal,
+} satisfies Migrations;
+
+/** The wakeup service's tables (`db/wakeup.ts`). */
+export const WAKEUP_MIGRATIONS = {
+  folder: () => new URL("../../drizzle/wakeup/", import.meta.url),
+  table: "__drizzle_migrations_wakeup",
+  journal: wakeupJournal,
+} satisfies Migrations;
+
+/**
+ * Applies to `db` the migrations of `of` its database has not had, in one transaction, recording
+ * each in the journal table. Drizzle's migrator compares only the newest timestamp, so a migration
+ * older than the newest applied is skipped: the repository's `scripts/check-journal.ts` keeps a
+ * branch from adding one. Two processes migrating one database at once race (the migrator takes no lock): callers
+ * hold `underPreparationLock`.
+ */
+export const applyMigrations = (db: Db, of: Migrations): Promise<void> =>
+  migrate(db, { migrationsFolder: fileURLToPath(of.folder()), migrationsTable: of.table });
+
+/**
+ * Whether the database `db` is on has had every migration of `of`: each journal entry's `when`
+ * is a `created_at` of its journal table, whatever else the table holds (a database a newer
+ * release migrated serves this one, as after a rollback). False with no journal table.
+ */
+export async function migrationsApplied(db: Db, of: Migrations): Promise<boolean> {
+  const present = await db.execute<{ present: boolean }>(
+    sql`SELECT to_regclass(${`drizzle.${of.table}`}) IS NOT NULL AS present`,
+  );
+  if (present.rows[0]?.present !== true) return false;
+  const { rows } = await db.execute<{ at: string }>(
+    sql`SELECT created_at::text AS at FROM drizzle.${sql.identifier(of.table)}`,
+  );
+  const applied = new Set(rows.map((row) => Number(row.at)));
+  return of.journal.entries.every((entry) => applied.has(entry.when));
+}

package/src/db/wakeup.ts

@@ -0,0 +1,41 @@
+import { sql } from "drizzle-orm";
+import { index, integer, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+
+// The wakeup service's tables (`wakeup-service.ts`), in the service's own database: never a
+// company's, which every company database gets. Migrations under `drizzle/wakeup/`.
+
+const when = () => timestamp({ withTimezone: true });
+
+/** One account per party that registers instances, its token's hash alone. */
+export const wakeupAccounts = pgTable("sanoma_wakeup_accounts", {
+  id: uuid().primaryKey(),
+  tokenHash: text().notNull().unique(),
+  label: text().notNull(),
+  createdAt: when().notNull().defaultNow(),
+  revokedAt: when(),
+});
+
+/** Each registered instance: its URL, its token's hash and its registered wake. */
+export const wakeupInstances = pgTable(
+  "sanoma_wakeup_instances",
+  {
+    id: uuid().primaryKey(),
+    accountId: uuid()
+      .notNull()
+      .references(() => wakeupAccounts.id),
+    url: text().notNull(),
+    tokenHash: text().notNull().unique(),
+    at: when(),
+    calledAt: when(),
+    attempts: integer().notNull().default(0),
+    nextAttemptAt: when(),
+    lastError: text(),
+    createdAt: when().notNull().defaultNow(),
+  },
+  (t) => [
+    index("sanoma_wakeup_instances_at")
+      .on(t.at)
+      .where(sql`${t.at} IS NOT NULL`),
+    index("sanoma_wakeup_instances_account").on(t.accountId),
+  ],
+);