@team-semicolon/semicolony-cli 4.18.92 → 4.18.93

package/migrations/192_workspace_asset_management.sql

@@ -0,0 +1,237 @@
+-- 192_workspace_asset_management.sql
+--
+-- Add explicit, project-bound read/write capabilities to the existing
+-- immutable workspace asset projection. Worker issuance continues to pass
+-- through the hardened migration-170 issuer. The operator amendment function
+-- repairs both halves together so a recently rotated read-less worker key can
+-- be granted useful access without an ad-hoc table write.
+--
+-- Slack actors keep their exact Phase-6 credential scopes because the
+-- decision recorder pins that array. Asset capabilities are derived from a
+-- separate DB binding table by the Gateway resolver.
+--
+-- The migration runner owns BEGIN/COMMIT.
+
+ALTER TABLE semicolony.workspace_projection_grants
+  DROP CONSTRAINT workspace_projection_grants_capability_check;
+ALTER TABLE semicolony.workspace_projection_grants
+  DROP CONSTRAINT workspace_projection_grants_check;
+ALTER TABLE semicolony.workspace_projection_grants
+  ADD CONSTRAINT workspace_projection_grants_capability_check
+  CHECK (capability IN ('credentials-read', 'assets-read', 'assets-write', 'skills-read'));
+ALTER TABLE semicolony.workspace_projection_grants
+  ADD CONSTRAINT workspace_projection_grants_environment_contract_check
+  CHECK (
+    (capability = 'credentials-read' AND cardinality(environments) > 0)
+    OR (capability IN ('assets-read', 'assets-write', 'skills-read')
+        AND cardinality(environments) = 0)
+  );
+
+CREATE OR REPLACE FUNCTION semicolony.issue_worker_asset_gateway_credential(
+  p_team_tenant_id uuid,
+  p_worker_id text,
+  p_device_id text,
+  p_token_hash text,
+  p_token_prefix text,
+  p_scopes text[],
+  p_issued_by text,
+  p_expires_days integer,
+  p_workspace_grants jsonb
+)
+RETURNS uuid
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_credential_id uuid;
+  v_base_grants jsonb;
+  v_base_scopes text[];
+  v_write_count integer;
+BEGIN
+  IF jsonb_typeof(p_workspace_grants) <> 'array' THEN
+    RAISE EXCEPTION 'workspace grants must be a JSON array' USING ERRCODE = '22023';
+  END IF;
+  SELECT count(*)::integer
+    INTO v_write_count
+    FROM jsonb_array_elements(p_workspace_grants) AS grant_row(value)
+   WHERE grant_row.value ->> 'capability' = 'assets-write';
+  IF v_write_count < 1 OR NOT ('workspace:assets-write' = ANY(p_scopes)) THEN
+    RAISE EXCEPTION 'asset write scope and grant are required' USING ERRCODE = '22023';
+  END IF;
+  IF cardinality(p_scopes) <> (
+    SELECT count(DISTINCT requested.scope)::integer FROM unnest(p_scopes) AS requested(scope)
+  ) THEN
+    RAISE EXCEPTION 'worker credential scopes contain duplicates' USING ERRCODE = '22023';
+  END IF;
+  IF EXISTS (
+    SELECT 1
+      FROM jsonb_array_elements(p_workspace_grants) AS write_grant(value)
+     WHERE write_grant.value ->> 'capability' = 'assets-write'
+       AND (
+         jsonb_typeof(write_grant.value) <> 'object'
+         OR write_grant.value ->> 'projectId' !~ '^[a-z][a-z0-9-]{0,99}$'
+         OR write_grant.value -> 'environments' <> '[]'::jsonb
+         OR NOT EXISTS (
+           SELECT 1
+             FROM jsonb_array_elements(p_workspace_grants) AS read_grant(value)
+            WHERE read_grant.value ->> 'projectId' = write_grant.value ->> 'projectId'
+              AND read_grant.value ->> 'capability' = 'assets-read'
+              AND read_grant.value -> 'environments' = '[]'::jsonb
+         )
+       )
+  ) THEN
+    RAISE EXCEPTION 'every asset write grant requires a paired read grant'
+      USING ERRCODE = '22023';
+  END IF;
+
+  SELECT coalesce(jsonb_agg(grant_row.value), '[]'::jsonb)
+    INTO v_base_grants
+    FROM jsonb_array_elements(p_workspace_grants) AS grant_row(value)
+   WHERE grant_row.value ->> 'capability' <> 'assets-write';
+  SELECT array_agg(scope ORDER BY ordinal)
+    INTO v_base_scopes
+    FROM unnest(p_scopes) WITH ORDINALITY AS requested(scope, ordinal)
+   WHERE scope <> 'workspace:assets-write';
+
+  v_credential_id := semicolony.issue_worker_gateway_credential(
+    p_team_tenant_id,
+    p_worker_id,
+    p_device_id,
+    p_token_hash,
+    p_token_prefix,
+    v_base_scopes,
+    p_issued_by,
+    p_expires_days,
+    v_base_grants
+  );
+
+  INSERT INTO semicolony.workspace_projection_grants (
+    gateway_credential_id, project_id, capability, environments
+  )
+  SELECT
+    v_credential_id,
+    grant_row.value ->> 'projectId',
+    'assets-write',
+    ARRAY[]::text[]
+  FROM jsonb_array_elements(p_workspace_grants) AS grant_row(value)
+  WHERE grant_row.value ->> 'capability' = 'assets-write';
+
+  UPDATE semicolony.gateway_credentials
+     SET scopes = p_scopes
+   WHERE id = v_credential_id;
+
+  RETURN v_credential_id;
+END;
+$function$;
+
+REVOKE ALL ON FUNCTION semicolony.issue_worker_asset_gateway_credential(
+  uuid, text, text, text, text, text[], text, integer, jsonb
+) FROM PUBLIC, sc_app, sc_provider;
+GRANT EXECUTE ON FUNCTION semicolony.issue_worker_asset_gateway_credential(
+  uuid, text, text, text, text, text[], text, integer, jsonb
+) TO sc_app;
+
+CREATE TABLE semicolony.worker_agent_actor_capabilities (
+  installation_id text NOT NULL,
+  actor_id text NOT NULL,
+  capability text NOT NULL CHECK (capability IN ('assets:read', 'assets:write')),
+  status text NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'revoked')),
+  granted_by text NOT NULL DEFAULT 'migration-192',
+  granted_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  PRIMARY KEY (installation_id, actor_id, capability),
+  FOREIGN KEY (installation_id, actor_id)
+    REFERENCES semicolony.worker_agent_actor_bindings(installation_id, actor_id)
+    ON DELETE CASCADE
+);
+
+INSERT INTO semicolony.worker_agent_actor_capabilities (
+  installation_id, actor_id, capability
+)
+SELECT binding.installation_id, binding.actor_id, capability
+  FROM semicolony.worker_agent_actor_bindings AS binding
+ CROSS JOIN (VALUES ('assets:read'), ('assets:write')) AS capabilities(capability)
+ WHERE binding.status = 'active'
+ON CONFLICT (installation_id, actor_id, capability) DO NOTHING;
+
+REVOKE ALL ON TABLE semicolony.worker_agent_actor_capabilities
+  FROM PUBLIC, sc_app, sc_provider;
+GRANT SELECT ON TABLE semicolony.worker_agent_actor_capabilities TO sc_app;
+
+CREATE OR REPLACE FUNCTION semicolony.grant_worker_asset_write(
+  p_credential_id uuid,
+  p_project_id text,
+  p_granted_by text,
+  p_reason text
+)
+RETURNS uuid
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_amendment_id uuid;
+  v_previous_scopes text[];
+  v_next_scopes text[];
+BEGIN
+  IF p_credential_id IS NULL
+     OR p_project_id IS NULL OR p_project_id !~ '^[a-z][a-z0-9-]{0,99}$'
+     OR NULLIF(btrim(coalesce(p_granted_by, '')), '') IS NULL
+     OR NULLIF(btrim(coalesce(p_reason, '')), '') IS NULL THEN
+    RAISE EXCEPTION 'credential, project, grantor, and reason are required'
+      USING ERRCODE = '22023';
+  END IF;
+
+  SELECT gc.scopes
+    INTO v_previous_scopes
+    FROM semicolony.gateway_credentials AS gc
+   WHERE gc.id = p_credential_id
+     AND gc.status = 'active'
+     AND gc.revoked_at IS NULL
+     AND (gc.expires_at IS NULL OR gc.expires_at > clock_timestamp())
+     AND gc.metadata ->> 'credential_kind' = 'worker'
+   FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'active worker credential not found' USING ERRCODE = 'P0002';
+  END IF;
+  INSERT INTO semicolony.workspace_projection_grants (
+    gateway_credential_id, project_id, capability, environments, status,
+    expires_at, metadata
+  )
+  SELECT
+    p_credential_id, p_project_id, capabilities.capability, ARRAY[]::text[], 'active',
+    NULL, jsonb_build_object('granted_by', btrim(p_granted_by), 'reason', btrim(p_reason))
+  FROM (VALUES ('assets-read'), ('assets-write')) AS capabilities(capability)
+  ON CONFLICT (gateway_credential_id, project_id, capability) DO UPDATE
+     SET status = 'active',
+         expires_at = NULL,
+         metadata = EXCLUDED.metadata;
+
+  v_next_scopes := v_previous_scopes;
+  IF NOT ('workspace:assets-read' = ANY(v_next_scopes)) THEN
+    v_next_scopes := array_append(v_next_scopes, 'workspace:assets-read');
+  END IF;
+  IF NOT ('workspace:assets-write' = ANY(v_next_scopes)) THEN
+    v_next_scopes := array_append(v_next_scopes, 'workspace:assets-write');
+  END IF;
+
+  INSERT INTO semicolony.gateway_credential_scope_amendments (
+    credential_id, previous_scopes, next_scopes, reason, amended_by
+  ) VALUES (
+    p_credential_id, v_previous_scopes, v_next_scopes,
+    btrim(p_reason), btrim(p_granted_by)
+  )
+  RETURNING amendment_id INTO v_amendment_id;
+
+  UPDATE semicolony.gateway_credentials
+     SET scopes = v_next_scopes
+   WHERE id = p_credential_id;
+
+  RETURN v_amendment_id;
+END;
+$function$;
+
+REVOKE ALL ON FUNCTION semicolony.grant_worker_asset_write(uuid, text, text, text)
+  FROM PUBLIC, sc_app, sc_provider;
+GRANT EXECUTE ON FUNCTION semicolony.grant_worker_asset_write(uuid, text, text, text)
+  TO sc_app;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-semicolon/semicolony-cli",
-  "version": "4.18.92",
+  "version": "4.18.93",
   "description": "SemiColony CLI - AI operations and agent orchestration installer",
   "main": "dist/bundle.js",
   "bin": {