@sixb/core 0.1.12 → 0.1.14

package/src/storage/ontology/provider.ts

@@ -6,10 +6,13 @@ import {
 } from "../../materialization/errors"
 import type {
   EffectiveLinkSnapshot,
+  ExpectedLinkRevision,
+  ExpectedLinkScopeRevision,
+  ExpectedObjectRevision,
   OntologyLinkRef,
   OntologyObjectRef,
 } from "../../materialization/model"
-import { projectionEntityKey } from "../../materialization/refs"
+import { linkRefKey, objectRefKey, projectionEntityKey } from "../../materialization/refs"
 import type { OntologyCommitOriginSelector, OntologyCommitWrite } from "./commits"
 import type {
   FinalizeMaterializationInput,
@@ -485,6 +488,61 @@ export function effectiveConflict(message: string): MaterializationConflictError
   return new MaterializationConflictError("effective-state", message)
 }
 
+/**
+ * Rejects a commit whose expected object no longer matches its current effective row.
+ *
+ * Every provider checks commit expectations through these helpers, so a failed expectation is always
+ * the `expectation` conflict kind: an Action run reports exactly that kind as a read conflict.
+ */
+export function assertExpectedObjectRevision(
+  current: { readonly version: number; readonly lastCommitId: string | null } | null,
+  expected: ExpectedObjectRevision
+): void {
+  if (!expected.exists) {
+    if (current) {
+      throw expectationConflict(`Expected object ${objectRefKey(expected.ref)} to be absent.`)
+    }
+    return
+  }
+  if (
+    !current ||
+    current.version !== expected.version ||
+    current.lastCommitId !== expected.lastCommitId
+  ) {
+    throw expectationConflict(`Expected object ${objectRefKey(expected.ref)} changed.`)
+  }
+}
+
+/** `currentLastCommitId` is `undefined` when the link has no effective row. */
+export function assertExpectedLinkRevision(
+  currentLastCommitId: string | null | undefined,
+  expected: ExpectedLinkRevision
+): void {
+  if (!expected.exists) {
+    if (currentLastCommitId !== undefined) {
+      throw expectationConflict(`Expected link ${linkRefKey(expected.ref)} to be absent.`)
+    }
+    return
+  }
+  if (currentLastCommitId === undefined || currentLastCommitId !== expected.lastCommitId) {
+    throw expectationConflict(`Expected link ${linkRefKey(expected.ref)} changed.`)
+  }
+}
+
+export function assertExpectedLinkScopeRevision(
+  currentFingerprint: string | undefined,
+  expected: ExpectedLinkScopeRevision
+): void {
+  if (currentFingerprint === expected.fingerprint) return
+  throw expectationConflict(
+    `Expected link scope changed for ${expected.source.objectTypeId}:${expected.source.primaryId}.${expected.linkId}.`
+  )
+}
+
+function expectationConflict(message: string): MaterializationConflictError {
+  return new MaterializationConflictError("expectation", message)
+}
+
 export function materializationWorkColumns(record: MaterializationWorkRecord): {
   readonly lane: "none" | "apply" | "cardinality" | "event"
   readonly majorOrder: number

package/src/storage/operation-scope.ts

@@ -206,6 +206,7 @@ export function createAuthOperationScope<T extends AuthStorage>(
     groupMemberships: createOperationScopedFacade(target.groupMemberships, scope),
     magicLinks: createOperationScopedFacade(target.magicLinks, scope),
     oidcAuthorizationAttempts: createOperationScopedFacade(target.oidcAuthorizationAttempts, scope),
+    deviceAuthorizations: createOperationScopedFacade(target.deviceAuthorizations, scope),
   }) as T
 }
 

package/src/storage/types.ts

@@ -300,7 +300,6 @@ export type {
   ListWorkflowInterventionsInput,
   ListWorkflowInterventionsResult,
   SubmitWorkflowInterventionInput,
-  WorkflowInterventionActor,
   WorkflowInterventionRecord,
   WorkflowInterventionStatus,
   WorkflowInterventionStorage,

package/src/storage/workflow-interventions/index.ts

@@ -7,7 +7,6 @@ export type {
   ListWorkflowInterventionsInput,
   ListWorkflowInterventionsResult,
   SubmitWorkflowInterventionInput,
-  WorkflowInterventionActor,
   WorkflowInterventionRecord,
   WorkflowInterventionStatus,
   WorkflowInterventionStorage,

package/src/storage/workflow-interventions/types.ts

@@ -1,12 +1,8 @@
+import type { Principal } from "../../auth"
 import type { WorkflowIOSnapshot } from "../workflow-runs"
 
 export type WorkflowInterventionStatus = "pending" | "submitted" | "cancelled" | "expired"
 
-export interface WorkflowInterventionActor {
-  readonly principalType: "user" | "serviceAccount" | "system"
-  readonly principalId: string
-}
-
 export interface WorkflowInterventionRecord {
   readonly id: string
   readonly projectId: string
@@ -23,10 +19,10 @@ export interface WorkflowInterventionRecord {
   readonly requestedAt: Date
   readonly expiresAt?: Date
   readonly submittedAt?: Date
-  readonly submittedBy?: WorkflowInterventionActor
+  readonly submittedBy?: Principal
   readonly response?: WorkflowIOSnapshot
   readonly cancelledAt?: Date
-  readonly cancelledBy?: WorkflowInterventionActor
+  readonly cancelledBy?: Principal
   readonly expiredAt?: Date
 }
 
@@ -51,14 +47,14 @@ export interface SubmitWorkflowInterventionInput {
   readonly id: string
   readonly response: WorkflowIOSnapshot
   readonly submittedAt?: Date
-  readonly submittedBy?: WorkflowInterventionActor
+  readonly submittedBy?: Principal
 }
 
 export interface CancelWorkflowInterventionInput {
   readonly projectId: string
   readonly id: string
   readonly cancelledAt?: Date
-  readonly cancelledBy?: WorkflowInterventionActor
+  readonly cancelledBy?: Principal
 }
 
 export interface ExpireWorkflowInterventionInput {

package/src/testing/action-execution.ts

@@ -1,4 +1,4 @@
-import type { TrustedPrimitiveRef } from "../execution"
+import type { AuthorizablePrincipal, TrustedPrimitiveRef } from "../execution"
 import type { ActionRunRecord, QueueActionRunInput, Storage } from "../storage"
 import type { ExecutionStorage } from "../storage/executions"
 
@@ -11,6 +11,8 @@ export async function createTestActionExecution(
     readonly runId: string
     readonly executionId?: string
     readonly requesterGroupIds?: readonly string[]
+    /** Must name an existing auth principal. The parent request then carries its authority. */
+    readonly requestedBy?: AuthorizablePrincipal
   }
 ): Promise<string> {
   const parentExecutionId = `test_request_execution:${input.runId}`
@@ -24,22 +26,28 @@ export async function createTestActionExecution(
   const existing = await executions.getById({ projectId: input.projectId, id: executionId })
   if (existing) return executionId
 
+  const requestedBy = input.requestedBy
   const parent = await executions.getById({ projectId: input.projectId, id: parentExecutionId })
   if (!parent) {
     await executions.create({
       id: parentExecutionId,
       requesterGroupIds: input.requesterGroupIds ?? [],
       projectId: input.projectId,
+      ...(requestedBy === undefined ? {} : { requestedBy }),
       executor: { type: "request", requestId: `test_request:${input.runId}` },
       source: { type: "http", requestId: `test_request:${input.runId}` },
       correlationId: `test_correlation:${input.runId}`,
-      authorizationRef: { type: "disabled" },
+      authorizationRef:
+        requestedBy === undefined
+          ? { type: "disabled" }
+          : { type: "principal", principal: requestedBy },
     })
   }
   await executions.create({
     id: executionId,
     requesterGroupIds: input.requesterGroupIds ?? [],
     projectId: input.projectId,
+    ...(requestedBy === undefined ? {} : { requestedBy }),
     executor: { type: "primitive", kind: primitive.kind, runId: primitive.runId },
     source: { type: "execution", executionId: parentExecutionId },
     correlationId: `test_correlation:${input.runId}`,
@@ -54,6 +62,7 @@ export async function queueTestActionRun(
   storage: Pick<Storage, "actionRuns" | "executions">,
   input: Omit<QueueActionRunInput, "executionId"> & {
     readonly requesterGroupIds?: readonly string[]
+    readonly requestedBy?: AuthorizablePrincipal
   }
 ): Promise<ActionRunRecord> {
   if (!storage.actionRuns) throw new Error("Action run storage is not configured for this test.")
@@ -62,7 +71,8 @@ export async function queueTestActionRun(
     actionId: input.actionId,
     runId: input.id,
     requesterGroupIds: input.requesterGroupIds,
+    ...(input.requestedBy === undefined ? {} : { requestedBy: input.requestedBy }),
   })
-  const { requesterGroupIds: _groups, ...run } = input
+  const { requesterGroupIds: _groups, requestedBy: _requestedBy, ...run } = input
   return storage.actionRuns.queue({ ...run, executionId })
 }