@sixb/pg 0.1.7 → 0.1.9

package/src/index.ts

@@ -10,9 +10,14 @@ import type {
   StorageTransactionOptions,
 } from "@sixb/core"
 import { ProviderMaterializationTransactionLifecycle } from "@sixb/core/internal/ontology-storage-provider"
+import {
+  createTransactionStorageProxy,
+  throwNestedStorageTransaction,
+} from "@sixb/core/internal/storage"
 import {
   createAgentOperationScope,
   createAuthOperationScope,
+  createObjectOperationScope,
   createOntologyOperationScope,
   createOperationScopedFacade,
   createStorageOperationScope,
@@ -22,15 +27,14 @@ import {
   type AiCostStorage,
   type AiLimitStorage,
   type AiUsageStorage,
-  createTransactionStorageProxy,
   type ObjectStorage,
   StorageTransactionError,
-  throwNestedStorageTransaction,
 } from "@sixb/core/storage"
 import { PgAgentStorage } from "./agents"
 import { PgAuthStorage } from "./auth-storage"
 import { PgConnectorConnectionStorage } from "./connector-connection-storage"
 import { createPostgresStorageMigrators, dropSchema } from "./migrations"
+import { PgObjectStorage } from "./objects"
 import { PgOntologyStorage, type PgOntologyTransactionContext } from "./ontology-storage"
 import { PgActionRunStorage } from "./pg-action-run-storage"
 import { PgAiCostStorage } from "./pg-ai-cost-storage"
@@ -38,7 +42,6 @@ import { PgAiLimitStorage } from "./pg-ai-limit-storage"
 import { PgAiUsageStorage } from "./pg-ai-usage-storage"
 import { createPgClient, type SQL, type SQLClient } from "./pg-client"
 import { PgExecutionStorage } from "./pg-execution-storage"
-import { PgObjectStorage } from "./pg-object-storage"
 import { PgPipelineRunStorage } from "./pg-pipeline-run-storage"
 import { PgProjectionRunStorage } from "./pg-projection-run-storage"
 import { PgRulesStorage } from "./pg-rules-storage"
@@ -47,6 +50,8 @@ import { PgTimeseriesStorage } from "./pg-timeseries-storage"
 import { PgWebhookRunStorage } from "./pg-webhook-run-storage"
 import { PgWorkflowInterventionStorage } from "./pg-workflow-intervention-storage"
 import { PgWorkflowRunStorage } from "./pg-workflow-run-storage"
+import { PgShareGrantStorage } from "./share-grant-storage"
+import { PgShareSessionStorage } from "./share-session-storage"
 import { isRetryableTransactionConflict } from "./storage-errors"
 import { registerPostgresStorageTestingAdapter } from "./testing"
 import { type PgStoreClient, runPgTransaction } from "./transactions"
@@ -151,6 +156,8 @@ export class PostgresStorage implements MigrationCapableStorage {
   readonly webhookRuns: PgWebhookRunStorage
   readonly rules: PgRulesStorage
   readonly connectorConnections: PgConnectorConnectionStorage
+  readonly shareGrants: PgShareGrantStorage
+  readonly shareSessions: PgShareSessionStorage
   readonly migrators: readonly StorageMigrator[]
 
   private readonly sql: SQL
@@ -208,7 +215,7 @@ export class PostgresStorage implements MigrationCapableStorage {
       },
       () => this.assertRootOperationAvailable()
     )
-    this.objects = createOperationScopedFacade(stores.objects, scope)
+    this.objects = createObjectOperationScope(stores.objects, scope)
     this.ontology = createOntologyOperationScope(stores.ontology, scope)
     this.auth = createAuthOperationScope(stores.auth, scope)
     this.executions = createOperationScopedFacade(stores.executions, scope)
@@ -226,6 +233,8 @@ export class PostgresStorage implements MigrationCapableStorage {
     this.webhookRuns = createOperationScopedFacade(stores.webhookRuns, scope)
     this.rules = createOperationScopedFacade(stores.rules, scope)
     this.connectorConnections = createOperationScopedFacade(stores.connectorConnections, scope)
+    this.shareGrants = createOperationScopedFacade(stores.shareGrants, scope)
+    this.shareSessions = createOperationScopedFacade(stores.shareSessions, scope)
     registerPostgresStorageTestingAdapter(this, (durationMs) =>
       stores.connectorConnections.advanceTimeForTesting(durationMs)
     )
@@ -334,7 +343,9 @@ function createPostgresStores(
   }
 ): PostgresStoreSet {
   const auth = new PgAuthStorage({ sql })
-  const executions = new PgExecutionStorage(sql, auth)
+  const shareGrants = new PgShareGrantStorage(sql)
+  const shareSessions = new PgShareSessionStorage(sql)
+  const executions = new PgExecutionStorage(sql, auth, shareSessions)
   return {
     objects: new PgObjectStorage(sql),
     ontology: new PgOntologyStorage({
@@ -358,6 +369,8 @@ function createPostgresStores(
     webhookRuns: new PgWebhookRunStorage(sql, executions),
     rules: new PgRulesStorage(sql),
     connectorConnections: new PgConnectorConnectionStorage(sql),
+    shareGrants,
+    shareSessions,
   }
 }
 
@@ -380,6 +393,8 @@ interface PostgresStoreSet {
   readonly webhookRuns: PgWebhookRunStorage
   readonly rules: PgRulesStorage
   readonly connectorConnections: PgConnectorConnectionStorage
+  readonly shareGrants: PgShareGrantStorage
+  readonly shareSessions: PgShareSessionStorage
 }
 
 function resolveTimeoutMillis(value: number | undefined, label: string): number | undefined {

package/src/migrations/035-share-grants.sql

@@ -0,0 +1,57 @@
+CREATE TABLE share_grants (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  definition_id TEXT NOT NULL CHECK (length(trim(definition_id)) > 0),
+  target_object_type_id TEXT NOT NULL CHECK (length(trim(target_object_type_id)) > 0),
+  target_primary_id TEXT NOT NULL CHECK (length(trim(target_primary_id)) > 0),
+  issued_by_type TEXT NOT NULL CHECK (issued_by_type IN ('user', 'serviceAccount')),
+  issued_by_id TEXT NOT NULL CHECK (length(trim(issued_by_id)) > 0),
+  authority_version INTEGER NOT NULL CHECK (authority_version > 0),
+  authority_snapshot JSONB NOT NULL CHECK (
+    jsonb_typeof(authority_snapshot) = 'object'
+    AND jsonb_typeof(authority_snapshot -> 'version') = 'number'
+    AND (authority_snapshot ->> 'version')::integer = authority_version
+    AND jsonb_typeof(authority_snapshot -> 'access') = 'object'
+  ),
+  authority_digest TEXT NOT NULL CHECK (authority_digest ~ '^[0-9a-f]{64}$'),
+  token_hash TEXT NOT NULL CHECK (token_hash ~ '^[0-9a-f]{64}$'),
+  destination_path TEXT NOT NULL CHECK (
+    left(destination_path, 1) = '/'
+    AND position('?' IN destination_path) = 0
+    AND position('#' IN destination_path) = 0
+    AND position(chr(92) IN destination_path) = 0
+  ),
+  created_at TIMESTAMPTZ NOT NULL,
+  expires_at TIMESTAMPTZ NOT NULL,
+  revoked_at TIMESTAMPTZ,
+  revoked_by_type TEXT CHECK (
+    revoked_by_type IS NULL OR revoked_by_type IN ('user', 'serviceAccount', 'system')
+  ),
+  revoked_by_id TEXT CHECK (
+    revoked_by_id IS NULL OR length(trim(revoked_by_id)) > 0
+  ),
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, token_hash),
+  CHECK (expires_at > created_at),
+  CHECK (revoked_at IS NULL OR revoked_at >= created_at),
+  CHECK (
+    (revoked_at IS NULL AND revoked_by_type IS NULL AND revoked_by_id IS NULL)
+    OR
+    (revoked_at IS NOT NULL AND revoked_by_type IS NOT NULL AND revoked_by_id IS NOT NULL)
+  )
+);
+
+CREATE INDEX idx_share_grants_project_created
+  ON share_grants (project_id, created_at DESC, id DESC);
+CREATE INDEX idx_share_grants_definition_target
+  ON share_grants (
+    project_id,
+    definition_id,
+    target_object_type_id,
+    target_primary_id,
+    created_at DESC,
+    id DESC
+  );
+CREATE INDEX idx_share_grants_expiry
+  ON share_grants (project_id, expires_at)
+  WHERE revoked_at IS NULL;

package/src/migrations/036-share-sessions.sql

@@ -0,0 +1,173 @@
+-- Shared sessions and their execution provenance.
+CREATE TABLE share_sessions (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  grant_id TEXT NOT NULL CHECK (length(trim(grant_id)) > 0),
+  token_hash TEXT NOT NULL CHECK (token_hash ~ '^[0-9a-f]{64}$'),
+  created_at TIMESTAMPTZ NOT NULL,
+  expires_at TIMESTAMPTZ NOT NULL,
+  absolute_expires_at TIMESTAMPTZ NOT NULL,
+  revoked_at TIMESTAMPTZ,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, id, grant_id),
+  UNIQUE (project_id, token_hash),
+  FOREIGN KEY (project_id, grant_id)
+    REFERENCES share_grants (project_id, id),
+  CHECK (expires_at > created_at),
+  CHECK (absolute_expires_at > created_at),
+  CHECK (expires_at <= absolute_expires_at),
+  CHECK (revoked_at IS NULL OR revoked_at >= created_at)
+);
+
+CREATE INDEX idx_share_sessions_grant
+  ON share_sessions (project_id, grant_id, created_at DESC, id DESC);
+
+CREATE INDEX idx_share_sessions_expiry
+  ON share_sessions (project_id, expires_at)
+  WHERE revoked_at IS NULL;
+
+ALTER TABLE executions
+  ADD COLUMN authority_delegation_kind TEXT,
+  ADD COLUMN authority_delegation_id TEXT,
+  ADD COLUMN authority_delegation_session_id TEXT;
+
+-- The original authority checks were unnamed. Drop exactly the checks that mention
+-- authority_kind, then replace them with stable names and the delegated variant below.
+DO $$
+DECLARE authority_constraint RECORD;
+BEGIN
+  FOR authority_constraint IN
+    SELECT conname
+    FROM pg_constraint
+    WHERE conrelid = 'executions'::regclass
+      AND contype = 'c'
+      AND pg_get_constraintdef(oid) LIKE '%authority_kind%'
+  LOOP
+    EXECUTE format('ALTER TABLE executions DROP CONSTRAINT %I', authority_constraint.conname);
+  END LOOP;
+END $$;
+
+ALTER TABLE executions
+  ADD CONSTRAINT executions_authority_kind_check CHECK (
+    authority_kind IN ('principal', 'trustedPrimitive', 'delegated', 'kernel', 'disabled')
+  ),
+  ADD CONSTRAINT executions_authority_delegation_kind_check CHECK (
+    authority_delegation_kind IS NULL OR authority_delegation_kind = 'share'
+  ),
+  ADD CONSTRAINT executions_authority_shape_check CHECK (
+    (
+      authority_kind = 'principal'
+      AND num_nonnulls(authority_user_id, authority_service_account_id) = 1
+      AND num_nonnulls(authority_session_id, authority_access_token_id) <= 1
+      AND (authority_session_id IS NULL OR authority_user_id IS NOT NULL)
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'trustedPrimitive'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NOT NULL
+      AND authority_primitive_id IS NOT NULL
+      AND length(trim(authority_primitive_id)) > 0
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'delegated'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NOT NULL
+      AND authority_delegation_kind = 'share'
+      AND authority_delegation_id IS NOT NULL
+      AND length(trim(authority_delegation_id)) > 0
+      AND authority_delegation_session_id IS NOT NULL
+      AND length(trim(authority_delegation_session_id)) > 0
+    )
+    OR (
+      authority_kind = 'kernel'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NOT NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'disabled'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+  ),
+  ADD CONSTRAINT executions_executor_authority_check CHECK (
+    (
+      executor_kind = 'request'
+      AND source_kind = 'http'
+      AND executor_id = source_id
+      AND (
+        (
+          authority_kind = 'principal'
+          AND requested_by_user_id IS NOT DISTINCT FROM authority_user_id
+          AND requested_by_service_account_id IS NOT DISTINCT FROM authority_service_account_id
+        )
+        OR (
+          authority_kind IN ('delegated', 'disabled')
+          AND requested_by_user_id IS NULL
+          AND requested_by_service_account_id IS NULL
+        )
+      )
+    )
+    OR (
+      executor_kind IN ('action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow')
+      AND authority_kind = 'trustedPrimitive'
+      AND executor_kind = authority_primitive_kind
+    )
+    OR (
+      executor_kind = 'agent'
+      AND source_kind = 'execution'
+      AND (
+        (
+          authority_kind = 'principal'
+          AND authority_service_account_id IS NOT NULL
+          AND authority_session_id IS NULL
+          AND authority_access_token_id IS NULL
+        )
+        OR (
+          authority_kind = 'principal'
+          AND authority_user_id IS NOT NULL
+          AND num_nonnulls(authority_session_id, authority_access_token_id) = 1
+        )
+        OR authority_kind = 'disabled'
+      )
+    )
+    OR (executor_kind = 'kernel' AND authority_kind = 'kernel')
+  ),
+  ADD CONSTRAINT fk_executions_share_session
+    FOREIGN KEY (project_id, authority_delegation_session_id, authority_delegation_id)
+    REFERENCES share_sessions (project_id, id, grant_id)
+    ON DELETE RESTRICT;

package/src/migrations/037-execution-requester-groups.sql

@@ -0,0 +1,21 @@
+ALTER TABLE executions ADD COLUMN requester_group_ids JSONB NOT NULL DEFAULT '[]'::jsonb;
+
+-- Keep historical admission snapshots; never reconstruct them from current memberships.
+WITH RECURSIVE attribution(project_id, id, groups) AS (
+  SELECT e.project_id, e.id, COALESCE(w.requester_group_ids, a.requester_group_ids, '[]'::jsonb)
+  FROM executions e
+  LEFT JOIN workflow_runs w ON w.project_id = e.project_id AND w.execution_id = e.id
+  LEFT JOIN agent_runs a ON a.project_id = e.project_id AND a.execution_id = e.id
+  WHERE e.parent_execution_id IS NULL
+  UNION ALL
+  SELECT e.project_id, e.id, COALESCE(w.requester_group_ids, a.requester_group_ids, p.groups)
+  FROM executions e
+  JOIN attribution p ON p.project_id = e.project_id AND p.id = e.parent_execution_id
+  LEFT JOIN workflow_runs w ON w.project_id = e.project_id AND w.execution_id = e.id
+  LEFT JOIN agent_runs a ON a.project_id = e.project_id AND a.execution_id = e.id
+)
+UPDATE executions e SET requester_group_ids = a.groups
+FROM attribution a WHERE a.project_id = e.project_id AND a.id = e.id;
+
+ALTER TABLE workflow_runs DROP COLUMN requester_group_ids;
+ALTER TABLE agent_runs DROP COLUMN requester_group_ids;

package/src/migrations.ts

@@ -85,6 +85,8 @@ import retireAgentDefinitionsSql from "./migrations/033-retire-agent-definitions
 import deviceAuthorizationsSql from "./migrations/034-device-authorizations.sql" with {
   type: "text",
 }
+import shareGrantsSql from "./migrations/035-share-grants.sql" with { type: "text" }
+import shareSessionsSql from "./migrations/036-share-sessions.sql" with { type: "text" }
 import type { SQL, SQLClient } from "./pg-client"
 
 export interface PostgresMigrationContext {
@@ -372,6 +374,9 @@ export const postgresStorageMigrations = defineMigrations<PostgresMigrationConte
     pgSql("032-conversation-run-spec", conversationRunSpecSql),
     pgSql("033-retire-agent-definitions", retireAgentDefinitionsSql),
     pgSql("034-device-authorizations", deviceAuthorizationsSql),
+    pgSql("035-share-grants", shareGrantsSql),
+    pgSql("036-share-sessions", shareSessionsSql),
+    pgSql("037-execution-requester-groups", executionRequesterGroupsSql),
   ],
 })
 
@@ -384,3 +389,7 @@ interface PostgresMigrationRow {
   readonly started_at: Date | string
   readonly finished_at: Date | string | null
 }
+
+import executionRequesterGroupsSql from "./migrations/037-execution-requester-groups.sql" with {
+  type: "text",
+}

package/src/objects/index.ts

@@ -0,0 +1 @@
+export { PgObjectStorage } from "./storage"