@team-semicolon/semicolony-cli 4.18.51 → 4.18.52

package/migrations/155_hive_cron_occurrence_lease_provider_grants.sql

@@ -0,0 +1,44 @@
+-- @schema-retarget: off
+-- Hive cron v2 occurrence lease mutation privileges for the provider role.
+-- Migration 154 remains the evidence-writer privilege boundary; this migration is
+-- narrowly additive for lease acquisition and failed-occurrence release.
+-- The migration runner supplies the transaction boundary; do not add one here.
+
+DO $$
+DECLARE
+  role_state record;
+BEGIN
+  SELECT rolcanlogin, rolsuper, rolcreatedb, rolcreaterole,
+         rolinherit, rolreplication, rolbypassrls
+    INTO role_state
+    FROM pg_roles
+   WHERE rolname = 'sc_provider';
+
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'sc_provider role missing; migration 135 required';
+  END IF;
+
+  IF NOT role_state.rolcanlogin
+     OR role_state.rolsuper
+     OR role_state.rolcreatedb
+     OR role_state.rolcreaterole
+     OR role_state.rolinherit
+     OR role_state.rolreplication
+     OR role_state.rolbypassrls THEN
+    RAISE EXCEPTION 'sc_provider role attributes are unsafe';
+  END IF;
+END $$;
+
+REVOKE ALL PRIVILEGES
+  ON TABLE semicolony.cron_read_action_occurrence_leases
+  FROM sc_provider;
+
+REVOKE ALL
+  ON FUNCTION semicolony.hive_cron_acquire_lease(text, text, text)
+  FROM PUBLIC, sc_app, sc_provider;
+REVOKE ALL
+  ON FUNCTION semicolony.hive_cron_release_failed(text, text, text)
+  FROM PUBLIC, sc_app, sc_provider;
+
+GRANT EXECUTE ON FUNCTION semicolony.hive_cron_acquire_lease(text, text, text) TO sc_provider;
+GRANT EXECUTE ON FUNCTION semicolony.hive_cron_release_failed(text, text, text) TO sc_provider;

package/migrations/156_hive_cron_relay_outbox_provider_grants.sql

@@ -0,0 +1,47 @@
+-- @schema-retarget: off
+-- Hive cron v2 relay outbox mutation privilege for the provider role.
+-- The migration runner supplies the transaction boundary; do not add one here.
+
+DO $$
+DECLARE
+  role_state record;
+BEGIN
+  SELECT rolcanlogin, rolsuper, rolcreatedb, rolcreaterole,
+         rolinherit, rolreplication, rolbypassrls
+    INTO role_state
+    FROM pg_roles
+   WHERE rolname = 'sc_provider';
+
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'sc_provider role missing; migration 135 required';
+  END IF;
+
+  IF NOT role_state.rolcanlogin
+     OR role_state.rolsuper
+     OR role_state.rolcreatedb
+     OR role_state.rolcreaterole
+     OR role_state.rolinherit
+     OR role_state.rolreplication
+     OR role_state.rolbypassrls THEN
+    RAISE EXCEPTION 'sc_provider role attributes are unsafe';
+  END IF;
+END $$;
+
+REVOKE ALL PRIVILEGES
+  ON TABLE semicolony.cron_read_action_relay_outbox
+  FROM sc_provider;
+
+REVOKE ALL
+  ON FUNCTION semicolony.hive_cron_put_outbox(text, text, text)
+  FROM PUBLIC, sc_app, sc_provider;
+REVOKE ALL
+  ON FUNCTION semicolony.hive_cron_get_outbox(text, text, text)
+  FROM PUBLIC, sc_app, sc_provider;
+REVOKE ALL
+  ON FUNCTION semicolony.hive_cron_complete_outbox(text, text, text, text, text)
+  FROM PUBLIC, sc_app, sc_provider;
+
+GRANT EXECUTE ON FUNCTION semicolony.hive_cron_put_outbox(text, text, text) TO sc_provider;
+GRANT EXECUTE ON FUNCTION semicolony.hive_cron_get_outbox(text, text, text) TO sc_provider;
+GRANT EXECUTE ON FUNCTION semicolony.hive_cron_complete_outbox(text, text, text, text, text)
+  TO sc_provider;

package/migrations/157_hive_cron_trusted_config_revisions.sql

@@ -0,0 +1,243 @@
+-- @schema-retarget: off
+-- Hive cron v2 append-only trusted configuration revisions.
+-- This migration creates no configuration row and enables no cron job.
+-- The migration runner supplies the transaction boundary; do not add one here.
+
+CREATE OR REPLACE FUNCTION semicolony.hive_cron_valid_trusted_config_shape(p_action_kind text, p_payload jsonb)
+RETURNS boolean
+LANGUAGE plpgsql
+IMMUTABLE
+STRICT
+SET search_path = pg_catalog
+AS $$
+DECLARE
+  endpoint jsonb;
+  endpoint_service_id text;
+  endpoint_origin text;
+  endpoint_service_ids text[] := ARRAY[]::text[];
+  endpoint_origins text[] := ARRAY[]::text[];
+  previous_endpoint_service_id text;
+  project_entry jsonb;
+  project_id text;
+  project_ids text[] := ARRAY[]::text[];
+  previous_project_id text;
+BEGIN
+  IF pg_catalog.jsonb_typeof(p_payload) IS DISTINCT FROM 'object'
+     OR pg_catalog.octet_length(p_payload::text) > 65536
+     OR (p_payload::text COLLATE "C") ~* '(token|secret|password|authorization|credential)'
+     OR (p_payload::text COLLATE "C") ~* '-----BEGIN [^-]*(PRIVATE KEY|OPENSSH PRIVATE KEY)-----' THEN
+    RETURN false;
+  END IF;
+
+  IF p_action_kind = 'service-health-check' THEN
+    IF NOT (p_payload ? 'endpoints')
+       OR (p_payload - 'endpoints') <> '{}'::jsonb
+       OR pg_catalog.jsonb_typeof(p_payload->'endpoints') IS DISTINCT FROM 'array' THEN
+      RETURN false;
+    END IF;
+    IF pg_catalog.jsonb_array_length(p_payload->'endpoints') <> 4 THEN
+      RETURN false;
+    END IF;
+
+    FOR endpoint IN
+      SELECT value FROM pg_catalog.jsonb_array_elements(p_payload->'endpoints')
+    LOOP
+      IF pg_catalog.jsonb_typeof(endpoint) IS DISTINCT FROM 'object' THEN
+        RETURN false;
+      END IF;
+      IF NOT (endpoint ? 'serviceId')
+         OR NOT (endpoint ? 'origin')
+         OR (endpoint - 'serviceId' - 'origin') <> '{}'::jsonb
+         OR pg_catalog.jsonb_typeof(endpoint->'serviceId') IS DISTINCT FROM 'string'
+         OR pg_catalog.jsonb_typeof(endpoint->'origin') IS DISTINCT FROM 'string' THEN
+        RETURN false;
+      END IF;
+
+      endpoint_service_id := endpoint->>'serviceId';
+      endpoint_origin := endpoint->>'origin';
+      IF pg_catalog.char_length(endpoint_service_id) > 64
+         OR (endpoint_service_id COLLATE "C") !~ '^[a-z][a-z0-9]*(-[a-z0-9]+)*$'
+         OR endpoint_service_id = ANY(endpoint_service_ids)
+         OR (previous_endpoint_service_id IS NOT NULL
+             AND (endpoint_service_id COLLATE "C")
+                   <= (previous_endpoint_service_id COLLATE "C"))
+         OR pg_catalog.char_length(endpoint_origin) > 261
+         OR (endpoint_origin COLLATE "C") !~ '^https://[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*\.[a-z]{2,63}$'
+         OR (endpoint_origin COLLATE "C") ~ '^https://([0-9]{1,3}\.){3}[0-9]{1,3}$'
+         OR (endpoint_origin COLLATE "C") ~ '(^https://|\.)xn--'
+         OR (endpoint_origin COLLATE "C") ~ '^https://(localhost|local|internal)$'
+         OR (endpoint_origin COLLATE "C") ~ '\.(localhost|local|internal)$'
+         OR endpoint_origin = ANY(endpoint_origins) THEN
+        RETURN false;
+      END IF;
+      previous_endpoint_service_id := endpoint_service_id;
+      endpoint_service_ids := pg_catalog.array_append(endpoint_service_ids, endpoint_service_id);
+      endpoint_origins := pg_catalog.array_append(endpoint_origins, endpoint_origin);
+    END LOOP;
+    RETURN true;
+  END IF;
+
+  IF p_action_kind = 'weekly-code-quality-scan' THEN
+    IF NOT (p_payload ? 'projectIds')
+       OR (p_payload - 'projectIds') <> '{}'::jsonb
+       OR pg_catalog.jsonb_typeof(p_payload->'projectIds') IS DISTINCT FROM 'array' THEN
+      RETURN false;
+    END IF;
+    IF pg_catalog.jsonb_array_length(p_payload->'projectIds') NOT BETWEEN 1 AND 32 THEN
+      RETURN false;
+    END IF;
+
+    FOR project_entry IN
+      SELECT value FROM pg_catalog.jsonb_array_elements(p_payload->'projectIds')
+    LOOP
+      IF pg_catalog.jsonb_typeof(project_entry) IS DISTINCT FROM 'string' THEN
+        RETURN false;
+      END IF;
+      project_id := project_entry #>> '{}';
+      IF pg_catalog.char_length(project_id) > 255
+         OR (project_id COLLATE "C") !~ '^[a-z0-9]([a-z0-9._-]{0,62}[a-z0-9])?(/[a-z0-9]([a-z0-9._-]{0,62}[a-z0-9])?)+$'
+         OR pg_catalog.lower(pg_catalog.right(project_id, 4)) = '.git'
+         OR pg_catalog.lower(pg_catalog.right(project_id, 5)) = '.atom'
+         OR 'land' = ANY(pg_catalog.regexp_split_to_array(project_id, '[/._-]'))
+         OR project_id = ANY(project_ids) THEN
+        RETURN false;
+      END IF;
+      IF previous_project_id IS NOT NULL
+         AND (project_id COLLATE "C") <= (previous_project_id COLLATE "C") THEN
+        RETURN false;
+      END IF;
+      previous_project_id := project_id;
+      project_ids := pg_catalog.array_append(project_ids, project_id);
+    END LOOP;
+    RETURN true;
+  END IF;
+
+  RETURN false;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION semicolony.hive_cron_valid_trusted_config_shape(text, jsonb)
+FROM PUBLIC, sc_app, sc_provider;
+
+CREATE TABLE IF NOT EXISTS semicolony.cron_read_action_trusted_config_revisions (
+  bot_id                  TEXT NOT NULL CHECK (bot_id = 'semi'),
+  job_id                  TEXT NOT NULL,
+  runtime_source          TEXT NOT NULL CHECK (runtime_source = 'hive-cron-v2'),
+  action_kind             TEXT NOT NULL CHECK (
+    btrim(action_kind) = action_kind
+    AND char_length(action_kind) BETWEEN 1 AND 128
+    AND action_kind !~ '[[:cntrl:]]'
+  ),
+  action_version          INTEGER NOT NULL CHECK (action_version > 0),
+  action_contract_digest  TEXT NOT NULL CHECK (
+    action_contract_digest ~ '^[a-f0-9]{64}$'
+  ),
+  config_revision         INTEGER NOT NULL CHECK (config_revision > 0),
+  source_ref              TEXT NOT NULL CHECK (
+    (source_ref COLLATE "C") ~ '^kb:[a-z0-9]([a-z0-9._-]{0,126}[a-z0-9])?/[a-z0-9]([a-z0-9._-]{0,126}[a-z0-9])?/[a-z0-9]([a-z0-9._-]{0,126}[a-z0-9])?$'
+  ),
+  config_payload          JSONB NOT NULL CHECK (
+    jsonb_typeof(config_payload) = 'object'
+    AND octet_length(config_payload::text) <= 65536
+  ),
+  config_digest           TEXT NOT NULL CHECK (
+    config_digest ~ '^sha256:[a-f0-9]{64}$'
+  ),
+  approved_by             TEXT NOT NULL CHECK (
+    (approved_by COLLATE "C") ~ '^[a-z0-9]([a-z0-9._-]{0,126}[a-z0-9])?$'
+  ),
+  approved_at             TIMESTAMPTZ NOT NULL,
+  created_at              TIMESTAMPTZ NOT NULL DEFAULT now(),
+  PRIMARY KEY (bot_id, job_id, runtime_source, config_revision),
+  FOREIGN KEY (bot_id, job_id, runtime_source)
+    REFERENCES semicolony.cron_capability_templates (bot_id, job_id, runtime_source),
+  CHECK (semicolony.hive_cron_valid_trusted_config_shape(action_kind, config_payload))
+);
+
+COMMENT ON TABLE semicolony.cron_read_action_trusted_config_revisions IS
+  'Reviewed inert configuration revisions for Hive cron typed read actions; contains no credentials.';
+
+COMMENT ON COLUMN semicolony.cron_read_action_trusted_config_revisions.action_contract_digest IS
+  'Action contract reviewed with this revision; the loader compares it to the mutable current template.';
+
+COMMENT ON COLUMN semicolony.cron_read_action_trusted_config_revisions.config_digest IS
+  'SHA-256 of the canonical identity, action contract, revision, source reference, and payload envelope.';
+
+CREATE OR REPLACE FUNCTION semicolony.hive_cron_get_trusted_config(p_job_id text)
+RETURNS TABLE (
+  bot_id text,
+  job_id text,
+  runtime_source text,
+  action_kind text,
+  action_version integer,
+  action_contract_digest text,
+  config_revision integer,
+  source_ref text,
+  config_payload jsonb,
+  config_digest text,
+  approved_by text,
+  approved_at timestamptz,
+  created_at timestamptz,
+  current_action_kind text,
+  current_action_version integer,
+  current_action_contract_digest text
+)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $$
+  SELECT config.bot_id,
+         config.job_id,
+         config.runtime_source,
+         config.action_kind,
+         config.action_version,
+         config.action_contract_digest,
+         config.config_revision,
+         config.source_ref,
+         config.config_payload,
+         config.config_digest,
+         config.approved_by,
+         config.approved_at,
+         config.created_at,
+         template.action_kind,
+         template.action_version,
+         template.action_contract_digest
+    FROM semicolony.cron_capability_templates AS template
+    JOIN LATERAL (
+      SELECT revision.bot_id,
+             revision.job_id,
+             revision.runtime_source,
+             revision.action_kind,
+             revision.action_version,
+             revision.action_contract_digest,
+             revision.config_revision,
+             revision.source_ref,
+             revision.config_payload,
+             revision.config_digest,
+             revision.approved_by,
+             revision.approved_at,
+             revision.created_at
+        FROM semicolony.cron_read_action_trusted_config_revisions AS revision
+       WHERE revision.bot_id = template.bot_id
+         AND revision.job_id = template.job_id
+         AND revision.runtime_source = template.runtime_source
+       ORDER BY revision.config_revision DESC
+       LIMIT 1
+    ) AS config ON true
+   WHERE template.bot_id = 'semi'
+     AND template.job_id = p_job_id
+     AND template.runtime_source = 'hive-cron-v2'
+     AND template.action_kind IS NOT NULL
+     AND template.action_version IS NOT NULL
+     AND template.action_contract_digest IS NOT NULL;
+$$;
+
+REVOKE ALL PRIVILEGES ON TABLE
+  semicolony.cron_read_action_trusted_config_revisions
+FROM PUBLIC, sc_app, sc_provider;
+
+REVOKE ALL ON FUNCTION semicolony.hive_cron_get_trusted_config(text)
+FROM PUBLIC, sc_app, sc_provider;
+
+GRANT EXECUTE ON FUNCTION semicolony.hive_cron_get_trusted_config(text)
+TO sc_provider;