@segmentstream-cloud/ontology 0.23.0 → 0.24.1

package/dist/service/schemas.d.ts

@@ -40,6 +40,26 @@ export declare const Validation: Schema.Struct<{
     }>>;
 }>;
 export declare const HistoryEntry: Schema.decodeTo<Schema.Struct<{
+    readonly execution: Schema.optionalKey<Schema.Struct<{
+        readonly issuer: Schema.String;
+        readonly audience: Schema.String;
+        readonly organizationId: Schema.String;
+        readonly workspaceId: Schema.String;
+        readonly subject: Schema.String;
+        readonly deploymentId: Schema.String;
+        readonly ontologyDeploymentId: Schema.String;
+        readonly servingOntologyDeploymentId: Schema.String;
+        readonly ontologyOrigin: Schema.String;
+        readonly environment: Schema.Literal<"production">;
+        readonly jobName: Schema.String;
+        readonly runId: Schema.String;
+        readonly executionId: Schema.NullOr<Schema.String>;
+        readonly attemptId: Schema.String;
+        readonly generation: Schema.Number;
+        readonly tokenId: Schema.String;
+        readonly issuedAt: Schema.Number;
+        readonly expiresAt: Schema.Number;
+    }>>;
     readonly id: Schema.String;
     readonly recordId: Schema.String;
     readonly action: Schema.String;
@@ -52,6 +72,26 @@ export declare const HistoryEntry: Schema.decodeTo<Schema.Struct<{
         readonly after: Schema.Codec<Schema.Json, Schema.Json, never, never>;
     }>>;
 }>, Schema.Struct<{
+    readonly execution: Schema.toEncoded<Schema.optionalKey<Schema.Struct<{
+        readonly issuer: Schema.String;
+        readonly audience: Schema.String;
+        readonly organizationId: Schema.String;
+        readonly workspaceId: Schema.String;
+        readonly subject: Schema.String;
+        readonly deploymentId: Schema.String;
+        readonly ontologyDeploymentId: Schema.String;
+        readonly servingOntologyDeploymentId: Schema.String;
+        readonly ontologyOrigin: Schema.String;
+        readonly environment: Schema.Literal<"production">;
+        readonly jobName: Schema.String;
+        readonly runId: Schema.String;
+        readonly executionId: Schema.NullOr<Schema.String>;
+        readonly attemptId: Schema.String;
+        readonly generation: Schema.Number;
+        readonly tokenId: Schema.String;
+        readonly issuedAt: Schema.Number;
+        readonly expiresAt: Schema.Number;
+    }>>>;
     readonly id: Schema.toEncoded<Schema.String>;
     readonly record_id: Schema.toEncoded<Schema.String>;
     readonly action: Schema.toEncoded<Schema.String>;
@@ -66,6 +106,26 @@ export declare const HistoryEntry: Schema.decodeTo<Schema.Struct<{
 }>, never, never>;
 export declare const HistoryPage: Schema.decodeTo<Schema.Struct<{
     readonly items: Schema.$Array<Schema.decodeTo<Schema.Struct<{
+        readonly execution: Schema.optionalKey<Schema.Struct<{
+            readonly issuer: Schema.String;
+            readonly audience: Schema.String;
+            readonly organizationId: Schema.String;
+            readonly workspaceId: Schema.String;
+            readonly subject: Schema.String;
+            readonly deploymentId: Schema.String;
+            readonly ontologyDeploymentId: Schema.String;
+            readonly servingOntologyDeploymentId: Schema.String;
+            readonly ontologyOrigin: Schema.String;
+            readonly environment: Schema.Literal<"production">;
+            readonly jobName: Schema.String;
+            readonly runId: Schema.String;
+            readonly executionId: Schema.NullOr<Schema.String>;
+            readonly attemptId: Schema.String;
+            readonly generation: Schema.Number;
+            readonly tokenId: Schema.String;
+            readonly issuedAt: Schema.Number;
+            readonly expiresAt: Schema.Number;
+        }>>;
         readonly id: Schema.String;
         readonly recordId: Schema.String;
         readonly action: Schema.String;
@@ -78,6 +138,26 @@ export declare const HistoryPage: Schema.decodeTo<Schema.Struct<{
             readonly after: Schema.Codec<Schema.Json, Schema.Json, never, never>;
         }>>;
     }>, Schema.Struct<{
+        readonly execution: Schema.toEncoded<Schema.optionalKey<Schema.Struct<{
+            readonly issuer: Schema.String;
+            readonly audience: Schema.String;
+            readonly organizationId: Schema.String;
+            readonly workspaceId: Schema.String;
+            readonly subject: Schema.String;
+            readonly deploymentId: Schema.String;
+            readonly ontologyDeploymentId: Schema.String;
+            readonly servingOntologyDeploymentId: Schema.String;
+            readonly ontologyOrigin: Schema.String;
+            readonly environment: Schema.Literal<"production">;
+            readonly jobName: Schema.String;
+            readonly runId: Schema.String;
+            readonly executionId: Schema.NullOr<Schema.String>;
+            readonly attemptId: Schema.String;
+            readonly generation: Schema.Number;
+            readonly tokenId: Schema.String;
+            readonly issuedAt: Schema.Number;
+            readonly expiresAt: Schema.Number;
+        }>>>;
         readonly id: Schema.toEncoded<Schema.String>;
         readonly record_id: Schema.toEncoded<Schema.String>;
         readonly action: Schema.toEncoded<Schema.String>;
@@ -93,6 +173,26 @@ export declare const HistoryPage: Schema.decodeTo<Schema.Struct<{
     readonly nextCursor: Schema.NullOr<Schema.String>;
 }>, Schema.Struct<{
     readonly items: Schema.toEncoded<Schema.$Array<Schema.decodeTo<Schema.Struct<{
+        readonly execution: Schema.optionalKey<Schema.Struct<{
+            readonly issuer: Schema.String;
+            readonly audience: Schema.String;
+            readonly organizationId: Schema.String;
+            readonly workspaceId: Schema.String;
+            readonly subject: Schema.String;
+            readonly deploymentId: Schema.String;
+            readonly ontologyDeploymentId: Schema.String;
+            readonly servingOntologyDeploymentId: Schema.String;
+            readonly ontologyOrigin: Schema.String;
+            readonly environment: Schema.Literal<"production">;
+            readonly jobName: Schema.String;
+            readonly runId: Schema.String;
+            readonly executionId: Schema.NullOr<Schema.String>;
+            readonly attemptId: Schema.String;
+            readonly generation: Schema.Number;
+            readonly tokenId: Schema.String;
+            readonly issuedAt: Schema.Number;
+            readonly expiresAt: Schema.Number;
+        }>>;
         readonly id: Schema.String;
         readonly recordId: Schema.String;
         readonly action: Schema.String;
@@ -105,6 +205,26 @@ export declare const HistoryPage: Schema.decodeTo<Schema.Struct<{
             readonly after: Schema.Codec<Schema.Json, Schema.Json, never, never>;
         }>>;
     }>, Schema.Struct<{
+        readonly execution: Schema.toEncoded<Schema.optionalKey<Schema.Struct<{
+            readonly issuer: Schema.String;
+            readonly audience: Schema.String;
+            readonly organizationId: Schema.String;
+            readonly workspaceId: Schema.String;
+            readonly subject: Schema.String;
+            readonly deploymentId: Schema.String;
+            readonly ontologyDeploymentId: Schema.String;
+            readonly servingOntologyDeploymentId: Schema.String;
+            readonly ontologyOrigin: Schema.String;
+            readonly environment: Schema.Literal<"production">;
+            readonly jobName: Schema.String;
+            readonly runId: Schema.String;
+            readonly executionId: Schema.NullOr<Schema.String>;
+            readonly attemptId: Schema.String;
+            readonly generation: Schema.Number;
+            readonly tokenId: Schema.String;
+            readonly issuedAt: Schema.Number;
+            readonly expiresAt: Schema.Number;
+        }>>>;
         readonly id: Schema.toEncoded<Schema.String>;
         readonly record_id: Schema.toEncoded<Schema.String>;
         readonly action: Schema.toEncoded<Schema.String>;
@@ -259,6 +379,7 @@ export declare const Catalog: Schema.decodeTo<Schema.Struct<{
     }>, {
         readonly builtIn: "built_in";
     }>>;
+    readonly runtimeCapabilities: Schema.optionalKey<Schema.$Array<Schema.String>>;
     readonly version: Schema.Int;
     readonly hash: Schema.String;
     readonly signIn: Schema.optionalKey<Schema.Struct<{
@@ -388,6 +509,7 @@ export declare const Catalog: Schema.decodeTo<Schema.Struct<{
     }>, {
         readonly builtIn: "built_in";
     }>>>;
+    readonly runtimeCapabilities: Schema.toEncoded<Schema.optionalKey<Schema.$Array<Schema.String>>>;
     readonly version: Schema.toEncoded<Schema.Int>;
     readonly hash: Schema.toEncoded<Schema.String>;
     readonly sign_in: Schema.toEncoded<Schema.optionalKey<Schema.Struct<{

package/dist/storage/attachments.js

@@ -128,7 +128,7 @@ export function attachmentRuntime(ontology, sql, provider) {
             ]);
         }
         // The member must still be active; a deactivated member's agent reads nothing.
-        yield* authorizeBlobOperation(ontology, sql, caller.principal.id, []);
+        yield* authorizeBlobOperation(ontology, sql, caller.principal.id, [], caller.principal.execution);
         return row;
     });
     /**
@@ -154,7 +154,7 @@ export function attachmentRuntime(ontology, sql, provider) {
             });
         }
         const reserved = yield* sql.withTransaction(Effect.gen(function* () {
-            yield* authorizeBlobOperation(ontology, sql, caller.principal.id, []);
+            yield* authorizeBlobOperation(ontology, sql, caller.principal.id, [], caller.principal.execution);
             yield* sql.unsafe(`SELECT pg_advisory_xact_lock(818724)`);
             const [existing] = yield* sql.unsafe(`SELECT id::text FROM "${ATTACHMENTS_TABLE}"
              WHERE owner_id = $1::uuid AND conversation = $2 AND source_ref = $3`, [caller.principal.id, caller.conversation, input.sourceRef]);
@@ -272,7 +272,7 @@ export function attachmentRuntime(ontology, sql, provider) {
     });
     /** The caller's attachments in this chat and session that are still readable, newest first. */
     const list = (caller) => sql.withTransaction(Effect.gen(function* () {
-        yield* authorizeBlobOperation(ontology, sql, caller.principal.id, []);
+        yield* authorizeBlobOperation(ontology, sql, caller.principal.id, [], caller.principal.execution);
         const rows = yield* sql.unsafe(`${SELECT} WHERE a.owner_id = $1::uuid AND a.conversation = $2 AND a.branch_id = $3
              AND a.state IN ('ready', 'promoted') AND a.expires_at > now()
              AND (a.session_id IS NULL OR a.session_id = $4)
@@ -365,7 +365,7 @@ export function attachmentRuntime(ontology, sql, provider) {
                         `${row.content_type}, ${row.size} bytes.`,
                 });
             }
-            yield* authorizeBlobOperation(ontology, sql, caller.principal.id, found.permissions);
+            yield* authorizeBlobOperation(ontology, sql, caller.principal.id, found.permissions, caller.principal.execution);
             const [earlier] = yield* sql.unsafe(`SELECT id::text, promotion FROM "${ATTACHMENTS_TABLE}"
              WHERE sha256 = $1 AND branch_id = $2 AND state = 'promoted' AND id <> $3::uuid
                AND promotion->>'action' = $4 AND promotion->>'deduplicated_from' IS NULL

package/dist/storage/authorization.d.ts

@@ -5,4 +5,4 @@ import { PermissionDenied } from "../errors.js";
 /** Re-read user and roles in the same transaction that authorizes a storage operation. */
 export declare function authorizeBlobOperation(ontology: Ontology, sql: {
     readonly unsafe: (text: string, args: ReadonlyArray<unknown>) => Effect.Effect<ReadonlyArray<Readonly<Record<string, unknown>>>, SqlError>;
-}, principalId: string, required: ReadonlyArray<string>): Effect.Effect<undefined, PermissionDenied | SqlError, never>;
+}, principalId: string, required: ReadonlyArray<string>, execution?: import("../runtime/workload.js").WorkloadExecution): Effect.Effect<undefined, PermissionDenied | SqlError, never>;

package/dist/storage/authorization.js

@@ -2,7 +2,7 @@ import { Effect } from "effect";
 import { missingPermission, permissionsOf } from "../permissions.js";
 import { PermissionDenied } from "../errors.js";
 /** Re-read user and roles in the same transaction that authorizes a storage operation. */
-export function authorizeBlobOperation(ontology, sql, principalId, required) {
+export function authorizeBlobOperation(ontology, sql, principalId, required, execution) {
     return Effect.gen(function* () {
         const [catalog] = yield* sql.unsafe(`SELECT hash FROM "_ontology" WHERE id = true FOR SHARE`, []);
         if (catalog?.hash !== ontology.manifest.hash) {
@@ -10,17 +10,22 @@ export function authorizeBlobOperation(ontology, sql, principalId, required) {
                 message: "The deployed ontology no longer matches the database catalog.",
             });
         }
-        const users = yield* sql.unsafe(`SELECT kind::text, active FROM "user" WHERE id = $1::uuid FOR SHARE`, [principalId]);
+        const users = yield* sql.unsafe(`SELECT kind::text, active, identity_provider, identity_subject FROM "user" WHERE id = $1::uuid FOR SHARE`, [principalId]);
         const user = users[0];
         const roles = yield* sql.unsafe(`SELECT role FROM "_user_roles" WHERE user_id = $1::uuid FOR SHARE`, [principalId]);
         const held = roles.map((row) => String(row.role));
         if (user?.kind === "member") {
             held.push("member");
         }
+        const worker = execution !== undefined &&
+            user?.kind === "service" &&
+            user.identity_provider === "segmentstream-ontology-workload" &&
+            user.identity_subject === `pipeline-workers:${execution.workspaceId}`;
         const missing = missingPermission(required, {
-            permissions: permissionsOf(ontology.roles, held),
+            ...(worker ? { execution } : {}),
+            permissions: worker ? ["*:*"] : permissionsOf(ontology.roles, held),
         });
-        if (!user?.active || missing) {
+        if (!user?.active || missing || (execution !== undefined && !worker)) {
             return yield* new PermissionDenied({
                 message: "The member cannot use this file operation.",
                 ...(missing ? { permission: missing } : {}),

package/dist/storage/sessions.js

@@ -98,7 +98,7 @@ export function blobRuntime(ontology, sql, provider) {
         if (!found || row.manifest_hash !== ontology.manifest.hash) {
             return yield* conflict();
         }
-        yield* authorizeBlobOperation(ontology, sql, principal.id, found.permissions);
+        yield* authorizeBlobOperation(ontology, sql, principal.id, found.permissions, principal.execution);
         return row;
     });
     const begin = (input, principal) => Effect.gen(function* () {
@@ -129,7 +129,7 @@ export function blobRuntime(ontology, sql, provider) {
         const claim = randomUUID();
         const key = `revisions/${blobId}`;
         const reservation = yield* sql.withTransaction(Effect.gen(function* () {
-            yield* authorizeBlobOperation(ontology, sql, principal.id, found.permissions);
+            yield* authorizeBlobOperation(ontology, sql, principal.id, found.permissions, principal.execution);
             if (input.recordId) {
                 yield* makeOntologyRuntime(ontology, sql).get({
                     entity: input.entity,
@@ -310,7 +310,7 @@ export function blobRuntime(ontology, sql, provider) {
             });
         }
         const blob = yield* sql.withTransaction(Effect.gen(function* () {
-            yield* authorizeBlobOperation(ontology, sql, principal.id, [`${entityName}:read`]);
+            yield* authorizeBlobOperation(ontology, sql, principal.id, [`${entityName}:read`], principal.execution);
             let revisionId = input.revisionId;
             if (!revisionId) {
                 const record = yield* makeOntologyRuntime(ontology, sql).get({

package/dist/storage/writes.js

@@ -39,7 +39,7 @@ export function resolveBlobWrites(context, entity, recordId, values, creating) {
                     }
                     return context.run(statement, params);
                 },
-            }, context.scope.principalId, authored ? [authored.permission] : generatedActionPermissions(actionEntity, actionName)).pipe(Effect.catchTag("PermissionDenied", () => Effect.fail(reject())));
+            }, context.scope.principalId, authored ? [authored.permission] : generatedActionPermissions(actionEntity, actionName), context.scope.execution).pipe(Effect.catchTag("PermissionDenied", () => Effect.fail(reject())));
             const params = new Params();
             const rows = yield* context.run(`SELECT u.*, b.id::text AS blob_id, b.filename, b.content_type, b.size::text AS size,
           to_char(b.created_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') AS created_at

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@segmentstream-cloud/ontology",
-  "version": "0.23.0",
+  "version": "0.24.1",
   "description": "Define a SegmentStream workspace app's ontology: entities, relationships, roles and actions, written with Effect.",
   "license": "Apache-2.0",
   "author": "SegmentStream",
@@ -44,6 +44,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "lint": "eslint src tests --config ../../eslint.config.mjs",
     "test": "vitest run",
+    "test:postgres": "vitest run --config vitest.postgres.config.ts",
     "prepack": "npm run build"
   },
   "dependencies": {