autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260723134329_google_lsa_integration_rls.sql

@@ -0,0 +1,205 @@
+-- Local Services Ads settings and cached spend are accessed only by
+-- authenticated server routes using the service role, matching the Facebook
+-- Ads integration's posture. The browser gets no direct table access.
+alter table "public"."google_lsa_connection" enable row level security;
+alter table "public"."settings_google_lsa" enable row level security;
+alter table "public"."google_lsa_daily_spend" enable row level security;
+
+revoke all on table "public"."google_lsa_connection" from public;
+revoke all on table "public"."google_lsa_connection" from "anon";
+revoke all on table "public"."google_lsa_connection" from "authenticated";
+
+revoke all on table "public"."settings_google_lsa" from public;
+revoke all on table "public"."settings_google_lsa" from "anon";
+revoke all on table "public"."settings_google_lsa" from "authenticated";
+
+revoke all on table "public"."google_lsa_daily_spend" from public;
+revoke all on table "public"."google_lsa_daily_spend" from "anon";
+revoke all on table "public"."google_lsa_daily_spend" from "authenticated";
+
+grant all on table "public"."google_lsa_connection" to "service_role";
+grant all on table "public"."settings_google_lsa" to "service_role";
+grant all on table "public"."google_lsa_daily_spend" to "service_role";
+
+revoke all on function "public"."set_google_lsa_selected_account"(
+    "uuid",
+    "text",
+    "text",
+    "text",
+    "text"
+) from public;
+revoke all on function "public"."set_google_lsa_selected_account"(
+    "uuid",
+    "text",
+    "text",
+    "text",
+    "text"
+) from "anon";
+revoke all on function "public"."set_google_lsa_selected_account"(
+    "uuid",
+    "text",
+    "text",
+    "text",
+    "text"
+) from "authenticated";
+grant execute on function "public"."set_google_lsa_selected_account"(
+    "uuid",
+    "text",
+    "text",
+    "text",
+    "text"
+) to "service_role";
+
+revoke all on function "public"."clear_google_lsa_selected_account"(
+    "uuid"
+) from public;
+revoke all on function "public"."clear_google_lsa_selected_account"(
+    "uuid"
+) from "anon";
+revoke all on function "public"."clear_google_lsa_selected_account"(
+    "uuid"
+) from "authenticated";
+grant execute on function "public"."clear_google_lsa_selected_account"(
+    "uuid"
+) to "service_role";
+
+revoke all on function "public"."upsert_google_lsa_daily_spend"(
+    "uuid",
+    "uuid",
+    "text",
+    "text",
+    jsonb
+) from public;
+revoke all on function "public"."upsert_google_lsa_daily_spend"(
+    "uuid",
+    "uuid",
+    "text",
+    "text",
+    jsonb
+) from "anon";
+revoke all on function "public"."upsert_google_lsa_daily_spend"(
+    "uuid",
+    "uuid",
+    "text",
+    "text",
+    jsonb
+) from "authenticated";
+grant execute on function "public"."upsert_google_lsa_daily_spend"(
+    "uuid",
+    "uuid",
+    "text",
+    "text",
+    jsonb
+) to "service_role";
+
+revoke all on function "public"."set_google_lsa_source"(
+    "uuid",
+    "uuid"
+) from public;
+revoke all on function "public"."set_google_lsa_source"(
+    "uuid",
+    "uuid"
+) from "anon";
+revoke all on function "public"."set_google_lsa_source"(
+    "uuid",
+    "uuid"
+) from "authenticated";
+grant execute on function "public"."set_google_lsa_source"(
+    "uuid",
+    "uuid"
+) to "service_role";
+
+revoke all on function "public"."clear_google_lsa_source"(
+    "uuid"
+) from public;
+revoke all on function "public"."clear_google_lsa_source"(
+    "uuid"
+) from "anon";
+revoke all on function "public"."clear_google_lsa_source"(
+    "uuid"
+) from "authenticated";
+grant execute on function "public"."clear_google_lsa_source"(
+    "uuid"
+) to "service_role";
+
+revoke all on function "public"."get_google_lsa_report"(
+    "uuid",
+    date,
+    date
+) from public;
+revoke all on function "public"."get_google_lsa_report"(
+    "uuid",
+    date,
+    date
+) from "anon";
+revoke all on function "public"."get_google_lsa_report"(
+    "uuid",
+    date,
+    date
+) from "authenticated";
+grant execute on function "public"."get_google_lsa_report"(
+    "uuid",
+    date,
+    date
+) to "service_role";
+
+revoke all on function "public"."get_google_lsa_job_sales_breakdown"(
+    "uuid",
+    date,
+    date,
+    integer,
+    integer
+) from public;
+revoke all on function "public"."get_google_lsa_job_sales_breakdown"(
+    "uuid",
+    date,
+    date,
+    integer,
+    integer
+) from "anon";
+revoke all on function "public"."get_google_lsa_job_sales_breakdown"(
+    "uuid",
+    date,
+    date,
+    integer,
+    integer
+) from "authenticated";
+grant execute on function "public"."get_google_lsa_job_sales_breakdown"(
+    "uuid",
+    date,
+    date,
+    integer,
+    integer
+) to "service_role";
+
+revoke all on function "public"."append_google_lsa_source_name_on_rename"()
+from public;
+revoke all on function "public"."append_google_lsa_source_name_on_rename"()
+from "anon";
+revoke all on function "public"."append_google_lsa_source_name_on_rename"()
+from "authenticated";
+revoke all on function "public"."append_google_lsa_source_name_on_rename"()
+from "service_role";
+
+revoke all on function "public"."prevent_google_lsa_source_name_collision"()
+from public;
+revoke all on function "public"."prevent_google_lsa_source_name_collision"()
+from "anon";
+revoke all on function "public"."prevent_google_lsa_source_name_collision"()
+from "authenticated";
+revoke all on function "public"."prevent_google_lsa_source_name_collision"()
+from "service_role";
+
+revoke all on function "public"."prevent_google_lsa_duplicate_ads_source_assignment"()
+from public;
+revoke all on function "public"."prevent_google_lsa_duplicate_ads_source_assignment"()
+from "anon";
+revoke all on function "public"."prevent_google_lsa_duplicate_ads_source_assignment"()
+from "authenticated";
+revoke all on function "public"."prevent_google_lsa_duplicate_ads_source_assignment"()
+from "service_role";
+
+revoke all on function "public"."set_google_lsa_updated_at"() from public;
+revoke all on function "public"."set_google_lsa_updated_at"() from "anon";
+revoke all on function "public"."set_google_lsa_updated_at"() from "authenticated";
+grant execute on function "public"."set_google_lsa_updated_at"() to "service_role";

package/dist/dist/migrations/20260723150640_google_lsa_hardening.sql

@@ -0,0 +1,169 @@
+-- Hardening pass on the Google LSA integration (review findings):
+-- 1) Serialize first-time account selection: SELECT ... FOR UPDATE on zero
+--    rows locks nothing, so two concurrent first-time selections could both
+--    take the insert path and the loser died with a raw unique_violation.
+--    An advisory lock keyed on the company closes the window.
+-- 2) Close the reverse direction of Facebook <-> LSA lead-source exclusivity:
+--    the LSA settings trigger already refuses a source assigned to Facebook
+--    Ads, but nothing on settings_facebook_ads refused a source assigned to
+--    LSA. Attach a guard trigger to settings_facebook_ads when that table
+--    exists (it ships in the facebook-ads-integration branch; if that branch
+--    is applied later, it must attach this trigger itself — flagged in the
+--    PR).
+-- 3) Index job_source(company_id, name): the report's attribution-ambiguity
+--    check and the source-name collision guards were seq-scanning the whole
+--    table; this also benefits the Facebook Ads report which runs the same
+--    check.
+
+create or replace function "public"."set_google_lsa_selected_account"(
+    "p_company_id" "uuid",
+    "p_customer_id" "text",
+    "p_account_name" "text",
+    "p_currency" "text",
+    "p_timezone_name" "text"
+)
+returns boolean
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+    "v_connection_id" "uuid";
+    "v_previous_customer_id" "text";
+    "v_account_changed" boolean;
+begin
+    if "p_company_id" is null then
+        raise exception 'company_id is required' using errcode = '22023';
+    end if;
+
+    -- Serializes concurrent first-time selections for the same company; the
+    -- row lock below only protects the already-exists path.
+    perform pg_advisory_xact_lock(
+        hashtextextended("p_company_id"::text || ':google-lsa-connection', 0)
+    );
+
+    if coalesce("p_customer_id", '') !~ '^[0-9]{1,20}$'
+        or nullif(btrim("p_account_name"), '') is null
+        or coalesce("p_currency", '') !~ '^[A-Z]{3}$'
+        or nullif(btrim("p_timezone_name"), '') is null
+    then
+        raise exception 'complete account metadata is required when selecting an account'
+            using errcode = '22023';
+    end if;
+
+    select "id", "customer_id"
+    into "v_connection_id", "v_previous_customer_id"
+    from "public"."google_lsa_connection"
+    where "company_id" = "p_company_id"
+    for update;
+
+    if not found then
+        insert into "public"."google_lsa_connection" (
+            "company_id",
+            "customer_id",
+            "account_name",
+            "currency",
+            "timezone_name"
+        )
+        values (
+            "p_company_id",
+            "p_customer_id",
+            "p_account_name",
+            "p_currency",
+            "p_timezone_name"
+        );
+        return true;
+    end if;
+
+    "v_account_changed" :=
+        "v_previous_customer_id" is distinct from "p_customer_id";
+
+    update "public"."google_lsa_connection"
+    set
+        "customer_id" = "p_customer_id",
+        "account_name" = "p_account_name",
+        "currency" = "p_currency",
+        "timezone_name" = "p_timezone_name",
+        "last_synced_at" = case
+            when "v_account_changed" then null
+            else "last_synced_at"
+        end,
+        "backfill_completed_at" = case
+            when "v_account_changed" then null
+            else "backfill_completed_at"
+        end,
+        "last_sync_error" = null
+    where "id" = "v_connection_id";
+
+    if "v_account_changed" then
+        delete from "public"."google_lsa_daily_spend"
+        where "connection_id" = "v_connection_id";
+    end if;
+
+    return "v_account_changed";
+end;
+$$;
+
+alter function "public"."set_google_lsa_selected_account"(
+    "uuid",
+    "text",
+    "text",
+    "text",
+    "text"
+) owner to "postgres";
+
+-- Guard for the settings_facebook_ads side of the exclusivity invariant.
+-- Uses the same company:source advisory lock key as the other assignment
+-- guards so concurrent cross-table assignments serialize.
+create or replace function "public"."prevent_facebook_ads_source_conflicts_with_lsa"()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+    if new."source_id" is null then
+        return new;
+    end if;
+
+    perform pg_advisory_xact_lock(
+        hashtextextended(
+            new."company_id"::text || ':' || new."source_id"::text,
+            0
+        )
+    );
+
+    if exists (
+        select 1
+        from "public"."settings_google_lsa"
+        where "company_id" = new."company_id"
+          and "source_id" = new."source_id"
+    ) then
+        raise exception 'Lead source is already assigned to Local Services Ads'
+            using
+                errcode = '23505',
+                constraint = 'ads_source_platform_unique';
+    end if;
+
+    return new;
+end;
+$$;
+
+alter function "public"."prevent_facebook_ads_source_conflicts_with_lsa"()
+owner to "postgres";
+
+-- settings_facebook_ads ships in the facebook-ads-integration branch, so the
+-- trigger can only be attached when that table exists.
+do $$
+begin
+    if to_regclass('public.settings_facebook_ads') is not null then
+        execute 'create or replace trigger "prevent_facebook_ads_source_conflicts_with_lsa_trigger" '
+            || 'before insert or update of "source_id" on "public"."settings_facebook_ads" '
+            || 'for each row '
+            || 'execute function "public"."prevent_facebook_ads_source_conflicts_with_lsa"()';
+    end if;
+end
+$$;
+
+create index if not exists "job_source_company_name_idx"
+    on "public"."job_source" ("company_id", "name");

package/dist/dist/migrations/20260723150641_google_lsa_hardening_rls.sql

@@ -0,0 +1,12 @@
+-- prevent_facebook_ads_source_conflicts_with_lsa is trigger-only: revoked
+-- from every role, matching the other assignment-guard trigger functions.
+-- set_google_lsa_selected_account keeps its existing grants (CREATE OR
+-- REPLACE preserves ACLs).
+revoke all on function "public"."prevent_facebook_ads_source_conflicts_with_lsa"()
+from public;
+revoke all on function "public"."prevent_facebook_ads_source_conflicts_with_lsa"()
+from "anon";
+revoke all on function "public"."prevent_facebook_ads_source_conflicts_with_lsa"()
+from "authenticated";
+revoke all on function "public"."prevent_facebook_ads_source_conflicts_with_lsa"()
+from "service_role";

package/dist/dist/migrations/20260724230721_google_lsa_facebook_exclusivity_attach.sql

@@ -0,0 +1,104 @@
+-- Follow-up to 20260723150640 (review finding): that migration attached the
+-- Facebook side of the lead-source exclusivity invariant from a one-shot
+-- conditional DO block, so the trigger was created only on databases that
+-- already had settings_facebook_ads. In the order dev and production will
+-- actually see -- this branch first, facebook-ads-integration later -- the
+-- block skipped silently and nothing ever refused a Facebook assignment of a
+-- source LSA already owned, leaving the same leads and sales attributable to
+-- both integrations with no second chance to install the guard.
+--
+-- The attach is now an idempotent function rather than a one-shot block. It
+-- runs here, and again from statement triggers on the two LSA write paths, so
+-- the guard installs itself as soon as settings_facebook_ads exists no matter
+-- which branch applies first.
+
+create or replace function "public"."ensure_facebook_ads_lsa_exclusivity_trigger"()
+returns boolean
+language plpgsql
+security definer
+set search_path = ''
+-- Bounds the wait for the CREATE TRIGGER lock: this runs inside ordinary LSA
+-- writes, which must not stall behind a busy settings_facebook_ads.
+set lock_timeout = '2s'
+as $$
+declare
+    "v_facebook_settings" "regclass" := to_regclass('public.settings_facebook_ads');
+begin
+    if "v_facebook_settings" is null then
+        return false;
+    end if;
+
+    if exists (
+        select 1
+        from "pg_catalog"."pg_trigger"
+        where "tgrelid" = "v_facebook_settings"
+          and "tgname" = 'prevent_facebook_ads_source_conflicts_with_lsa_trigger'
+          and not "tgisinternal"
+    ) then
+        return true;
+    end if;
+
+    -- One session performs the DDL; concurrent callers skip and pick the
+    -- result up on a later call instead of queueing behind it.
+    if not pg_try_advisory_xact_lock(
+        hashtextextended('google-lsa:attach-facebook-exclusivity-trigger', 0)
+    ) then
+        return false;
+    end if;
+
+    begin
+        execute 'create or replace trigger "prevent_facebook_ads_source_conflicts_with_lsa_trigger" '
+            || 'before insert or update of "source_id" on "public"."settings_facebook_ads" '
+            || 'for each row '
+            || 'execute function "public"."prevent_facebook_ads_source_conflicts_with_lsa"()';
+    exception
+        when others then
+            -- A failed self-heal must not take the caller's write down with
+            -- it; the next call retries.
+            raise warning 'could not attach prevent_facebook_ads_source_conflicts_with_lsa_trigger: %',
+                sqlerrm;
+            return false;
+    end;
+
+    return true;
+end;
+$$;
+
+alter function "public"."ensure_facebook_ads_lsa_exclusivity_trigger"()
+owner to "postgres";
+
+create or replace function "public"."run_facebook_ads_lsa_exclusivity_attach"()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+    perform "public"."ensure_facebook_ads_lsa_exclusivity_trigger"();
+    return null;
+end;
+$$;
+
+alter function "public"."run_facebook_ads_lsa_exclusivity_attach"()
+owner to "postgres";
+
+-- Selecting a lead source is the moment a Facebook conflict first becomes
+-- possible for a company, and the spend upsert runs on every LSA sync, so a
+-- database that gains settings_facebook_ads after this branch picks the guard
+-- up within a sync cycle. The attach is global, so the first of these to fire
+-- anywhere protects every company. Statement-level: one catalog probe per
+-- write, not per row.
+create or replace trigger "ensure_facebook_ads_lsa_exclusivity_on_settings_trigger"
+after insert or update of "source_id" on "public"."settings_google_lsa"
+for each statement
+execute function "public"."run_facebook_ads_lsa_exclusivity_attach"();
+
+create or replace trigger "ensure_facebook_ads_lsa_exclusivity_on_spend_trigger"
+after insert on "public"."google_lsa_daily_spend"
+for each statement
+execute function "public"."run_facebook_ads_lsa_exclusivity_attach"();
+
+-- Attaches now on databases that already have settings_facebook_ads (Wally
+-- dev, and production if facebook-ads-integration ships first); a no-op
+-- everywhere else until one of the triggers above fires.
+select "public"."ensure_facebook_ads_lsa_exclusivity_trigger"();

package/dist/dist/migrations/20260724230722_google_lsa_facebook_exclusivity_attach_rls.sql

@@ -0,0 +1,20 @@
+-- Both functions run from migrations and from the LSA statement triggers only;
+-- no client role executes them directly. CREATE TRIGGER checks EXECUTE at
+-- attach time, not at fire time, so revoking here leaves the triggers working.
+revoke all on function "public"."ensure_facebook_ads_lsa_exclusivity_trigger"()
+from public;
+revoke all on function "public"."ensure_facebook_ads_lsa_exclusivity_trigger"()
+from "anon";
+revoke all on function "public"."ensure_facebook_ads_lsa_exclusivity_trigger"()
+from "authenticated";
+revoke all on function "public"."ensure_facebook_ads_lsa_exclusivity_trigger"()
+from "service_role";
+
+revoke all on function "public"."run_facebook_ads_lsa_exclusivity_attach"()
+from public;
+revoke all on function "public"."run_facebook_ads_lsa_exclusivity_attach"()
+from "anon";
+revoke all on function "public"."run_facebook_ads_lsa_exclusivity_attach"()
+from "authenticated";
+revoke all on function "public"."run_facebook_ads_lsa_exclusivity_attach"()
+from "service_role";