autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260825233005_apply_rental_route_plan_v2.sql

@@ -0,0 +1,351 @@
+-- Rentals rework R2: apply_rental_route_plan v2 — the persisted-plan
+-- applier. Replaces the R1 interim function WHOLESALE (different
+-- signature; the old 5-arg version is dropped — destructive, flagged in
+-- the PR). A stale deployed web bundle still calling the old signature
+-- fails loudly with "function does not exist" instead of writing anything.
+--
+-- What it does, atomically:
+--   1. Locks the company's route_plan row for the date (serializes
+--      concurrent applies), then locks + verifies every planned
+--      job_schedule row against its optimize-time state (status, assets,
+--      size, ordering, assignees) — P0010 on any drift.
+--   2. Verifies plan optimistic concurrency: the plan's `run` must equal
+--      p_expected_run (null = the optimizer saw no plan), and the plan's
+--      current stop set (id + status) must equal p_expected_stops — a
+--      driver completing/failing a stop between preview and approve makes
+--      the plan stale (P0010).
+--   3. Writes list_sort_key ordering updates and job_user replacements
+--      (unchanged from v1; asset writes are GONE in v2 — the optimizer's
+--      choice is a suggestion that lives on the stop row).
+--   4. Upserts the plan (insert run=1, or bump run and refresh metadata),
+--      deletes the re-plannable stops (pending implied stops, and task
+--      stops whose schedule isn't Completed/Failed — terminal stops stay
+--      as history), and inserts the new run's stops (client-generated ids,
+--      on conflict do nothing).
+
+drop function if exists "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb
+);
+
+create function "public"."apply_rental_route_plan"(
+    "p_company_id" uuid,
+    -- Plan metadata + optimistic concurrency: date, structural_fingerprint,
+    -- created_by, total_miles, warnings, unroutable, distance_stats, and
+    -- expected_run (integer; absent/null = the optimizer saw no plan).
+    -- expected_run rides inside the jsonb because generated RPC arg types
+    -- are non-nullable — a bare integer arg couldn't carry null.
+    "p_plan" jsonb,
+    "p_expected" jsonb,
+    "p_expected_stops" jsonb,
+    "p_task_updates" jsonb,
+    "p_assignments" jsonb,
+    "p_stops" jsonb
+) returns void
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+    v_item jsonb;
+    v_sched "public"."job_schedule"%rowtype;
+    v_expected_ids uuid[] := '{}';
+    v_schedule_id uuid;
+    v_current_users uuid[];
+    v_expected_users uuid[];
+    v_plan_id uuid;
+    v_existing_run integer;
+    v_new_run integer;
+    v_expected_run integer;
+    v_date date;
+    v_current_stop_states text[];
+    v_expected_stop_states text[];
+begin
+    if p_company_id is null then
+        raise exception 'company id is required'
+            using errcode = 'P0011';
+    end if;
+
+    v_date := (p_plan->>'date')::date;
+    if v_date is null then
+        raise exception 'plan date is required'
+            using errcode = 'P0011';
+    end if;
+    v_expected_run := (p_plan->>'expected_run')::integer;
+
+    -- 1a. Serialize ALL applies for this company-day, including the very
+    --     first (no plan row exists yet, so there is nothing to
+    --     row-lock): without this, two overlapping first approvals both
+    --     see no plan, both pass the null-run check, and the loser dies
+    --     on the (company_id, date) unique key with a raw error instead
+    --     of the intended stale-plan P0010. Transaction-scoped, so it
+    --     releases on commit/rollback; a cross-day hash collision only
+    --     costs extra serialization, never correctness.
+    perform pg_advisory_xact_lock(
+        hashtextextended(p_company_id::text || ':' || v_date::text, 0)
+    );
+
+    -- 1b. Lock the plan row (if any): the second apply re-reads AFTER the
+    --     winner committed, so its run check resolves the race as P0010.
+    select "id", "run" into v_plan_id, v_existing_run
+    from "public"."route_plan"
+    where "company_id" = p_company_id and "date" = v_date
+    for update;
+
+    if found then
+        if v_expected_run is distinct from v_existing_run then
+            raise exception 'route plan is stale'
+                using errcode = 'P0010';
+        end if;
+    elsif v_expected_run is not null then
+        raise exception 'route plan is stale'
+            using errcode = 'P0010';
+    end if;
+
+    -- 1c. The plan's current stop set (id + status) must match what the
+    --     optimizer saw — a stop completed or failed since the preview
+    --     invalidates the plan. Covers every run's rows, pending or not.
+    if v_plan_id is not null then
+        select coalesce(
+            array_agg(("id"::text || ':' || coalesce("status", ''))
+                order by "id"), '{}')
+        into v_current_stop_states
+        from "public"."route_plan_stop"
+        where "route_plan_id" = v_plan_id;
+    else
+        v_current_stop_states := '{}';
+    end if;
+
+    select coalesce(
+        array_agg(((e->>'id') || ':' || coalesce(e->>'status', ''))
+            order by (e->>'id')), '{}')
+    into v_expected_stop_states
+    from jsonb_array_elements(coalesce(p_expected_stops, '[]'::jsonb)) e;
+
+    if v_current_stop_states is distinct from v_expected_stop_states then
+        raise exception 'route plan is stale'
+            using errcode = 'P0010';
+    end if;
+
+    -- 1d. Lock every planned schedule row; verify tenancy and that its
+    --     optimized state — status, assets, size, ordering, assignees —
+    --     is unchanged since the plan was computed.
+    for v_item in
+        select * from jsonb_array_elements(coalesce(p_expected, '[]'::jsonb))
+    loop
+        v_schedule_id := (v_item->>'schedule_id')::uuid;
+
+        select * into v_sched
+        from "public"."job_schedule"
+        where "id" = v_schedule_id
+        for update;
+
+        if not found or v_sched."company_id" is distinct from p_company_id then
+            raise exception 'route plan references an unknown schedule row'
+                using errcode = 'P0011';
+        end if;
+
+        select coalesce(array_agg("user_id" order by "user_id"), '{}')
+        into v_current_users
+        from "public"."job_user"
+        where "job_schedule_id" = v_schedule_id;
+
+        select coalesce(array_agg(u.value::uuid order by u.value::uuid), '{}')
+        into v_expected_users
+        from jsonb_array_elements_text(
+            coalesce(v_item->'user_ids', '[]'::jsonb)) u;
+
+        if v_sched."status"::text is distinct from (v_item->>'status')
+            or v_sched."asset_id" is distinct from
+                (v_item->>'asset_id')::uuid
+            or v_sched."secondary_asset_id" is distinct from
+                (v_item->>'secondary_asset_id')::uuid
+            or v_sched."list_sort_key" is distinct from
+                (v_item->>'list_sort_key')::numeric
+            or v_sched."size" is distinct from
+                (v_item->>'size')::numeric
+            or v_current_users is distinct from v_expected_users
+        then
+            raise exception 'route plan is stale'
+                using errcode = 'P0010';
+        end if;
+
+        v_expected_ids := v_expected_ids || v_schedule_id;
+    end loop;
+
+    -- 2. Ordering updates (any-time task rows only in practice; the
+    --    engine emits an update only when the key actually changes).
+    for v_item in
+        select * from jsonb_array_elements(coalesce(p_task_updates, '[]'::jsonb))
+    loop
+        v_schedule_id := (v_item->>'schedule_id')::uuid;
+
+        if not (v_schedule_id = any (v_expected_ids)) then
+            raise exception 'task update outside the locked plan rows'
+                using errcode = 'P0011';
+        end if;
+
+        update "public"."job_schedule"
+        set "list_sort_key" = (v_item->>'list_sort_key')::numeric
+        where "id" = v_schedule_id;
+    end loop;
+
+    -- 3. Full replacement of each planned row's assignments. job_id is read
+    --    from the schedule row itself, never from the payload, and every
+    --    assignee must belong to the company — user and company foreign
+    --    keys on job_user are enforced independently, so without this
+    --    check a crafted payload could create a cross-tenant assignment.
+    for v_item in
+        select * from jsonb_array_elements(coalesce(p_assignments, '[]'::jsonb))
+    loop
+        v_schedule_id := (v_item->>'schedule_id')::uuid;
+
+        if not (v_schedule_id = any (v_expected_ids)) then
+            raise exception 'assignment outside the locked plan rows'
+                using errcode = 'P0011';
+        end if;
+
+        perform 1
+        from jsonb_array_elements_text(
+            coalesce(v_item->'user_ids', '[]'::jsonb)) u
+        where not exists (
+            select 1 from "public"."user_role" ur
+            where ur."user_id" = u.value::uuid
+              and ur."company_id" = p_company_id
+        );
+        if found then
+            raise exception 'assignee outside the company'
+                using errcode = 'P0011';
+        end if;
+
+        delete from "public"."job_user"
+        where "job_schedule_id" = v_schedule_id;
+
+        insert into "public"."job_user"
+            ("company_id", "job_id", "job_schedule_id", "user_id")
+        select p_company_id, js."job_id", v_schedule_id, u.value::uuid
+        from "public"."job_schedule" js
+        cross join jsonb_array_elements_text(
+            coalesce(v_item->'user_ids', '[]'::jsonb)) u
+        where js."id" = v_schedule_id;
+    end loop;
+
+    -- 4a. Every stop's driver must belong to the company, and every task
+    --     stop must reference a row locked and verified above.
+    perform 1
+    from jsonb_array_elements(coalesce(p_stops, '[]'::jsonb)) s
+    where not exists (
+        select 1 from "public"."user_role" ur
+        where ur."user_id" = (s->>'driver_user_id')::uuid
+          and ur."company_id" = p_company_id
+    );
+    if found then
+        raise exception 'stop driver outside the company'
+            using errcode = 'P0011';
+    end if;
+
+    perform 1
+    from jsonb_array_elements(coalesce(p_stops, '[]'::jsonb)) s
+    where s->>'kind' = 'task'
+      and not ((s->>'job_schedule_id')::uuid = any (v_expected_ids));
+    if found then
+        raise exception 'task stop outside the locked plan rows'
+            using errcode = 'P0011';
+    end if;
+
+    -- 4b. Upsert the plan.
+    if v_plan_id is null then
+        v_plan_id := "gen_random_uuid"();
+        v_new_run := 1;
+        insert into "public"."route_plan" (
+            "id", "company_id", "date", "run", "structural_fingerprint",
+            "created_by", "total_miles", "warnings", "unroutable",
+            "distance_stats"
+        ) values (
+            v_plan_id, p_company_id, v_date, v_new_run,
+            coalesce(p_plan->>'structural_fingerprint', ''),
+            (p_plan->>'created_by')::uuid,
+            coalesce((p_plan->>'total_miles')::numeric, 0),
+            coalesce(p_plan->'warnings', '[]'::jsonb),
+            coalesce(p_plan->'unroutable', '[]'::jsonb),
+            coalesce(p_plan->'distance_stats', '{}'::jsonb)
+        );
+    else
+        v_new_run := v_existing_run + 1;
+        update "public"."route_plan"
+        set "run" = v_new_run,
+            "structural_fingerprint" =
+                coalesce(p_plan->>'structural_fingerprint', ''),
+            "created_by" = (p_plan->>'created_by')::uuid,
+            "total_miles" = coalesce((p_plan->>'total_miles')::numeric, 0),
+            "warnings" = coalesce(p_plan->'warnings', '[]'::jsonb),
+            "unroutable" = coalesce(p_plan->'unroutable', '[]'::jsonb),
+            "distance_stats" = coalesce(p_plan->'distance_stats', '{}'::jsonb),
+            "updated_at" = "now"()
+        where "id" = v_plan_id;
+    end if;
+
+    -- 4c. Delete the re-plannable stops; terminal ones stay as history.
+    delete from "public"."route_plan_stop" s
+    where s."route_plan_id" = v_plan_id
+      and (
+        (s."kind" = 'implied' and s."status" = 'pending')
+        or (s."kind" = 'task' and exists (
+            select 1 from "public"."job_schedule" js
+            where js."id" = s."job_schedule_id"
+              and js."status" not in ('Completed', 'Failed')
+        ))
+      );
+
+    -- 4d. Insert the new run's stops. status is server-stamped: implied
+    --     stops start 'pending', task stops carry none (it lives on the
+    --     schedule row).
+    insert into "public"."route_plan_stop" (
+        "id", "company_id", "route_plan_id", "run", "sort_key",
+        "driver_user_id", "kind", "job_schedule_id", "implied_kind",
+        "status", "suggested_asset_id", "size", "saved_location_id",
+        "label", "address", "latitude", "longitude",
+        "source_job_schedule_id", "leg_miles_from_prev"
+    )
+    select
+        (s->>'id')::uuid,
+        p_company_id,
+        v_plan_id,
+        v_new_run,
+        (s->>'sort_key')::numeric,
+        (s->>'driver_user_id')::uuid,
+        s->>'kind',
+        (s->>'job_schedule_id')::uuid,
+        s->>'implied_kind',
+        case when s->>'kind' = 'implied' then 'pending' end,
+        (s->>'suggested_asset_id')::uuid,
+        (s->>'size')::numeric,
+        (s->>'saved_location_id')::uuid,
+        coalesce(s->>'label', ''),
+        coalesce(s->>'address', ''),
+        (s->>'latitude')::numeric,
+        (s->>'longitude')::numeric,
+        (s->>'source_job_schedule_id')::uuid,
+        coalesce((s->>'leg_miles_from_prev')::numeric, 0)
+    from jsonb_array_elements(coalesce(p_stops, '[]'::jsonb)) s
+    on conflict ("id") do nothing;
+end;
+$$;
+
+alter function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb, jsonb, jsonb
+) owner to "postgres";
+
+-- security definer + service_role-only: /api/rental-routes/apply is the
+-- sole caller; no authenticated/anon path exists.
+revoke all on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb, jsonb, jsonb
+) from public;
+revoke all on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb, jsonb, jsonb
+) from "anon";
+revoke all on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb, jsonb, jsonb
+) from "authenticated";
+grant execute on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb, jsonb, jsonb
+) to "service_role";