autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260826234723_facebook_messenger_ingestion_rls.sql

@@ -0,0 +1,80 @@
+-- Facebook Messenger RLS: the webhook receipt queue is server-only (raw Meta
+-- payloads, worker/idempotency state). Conversations are readable by the
+-- company's members — the unified inbox joins thread names, ad attribution,
+-- and the 24-hour reply window from this table — but only the server writes
+-- them. Message content lives in public.message under its existing policies.
+--
+-- Affected tables:
+--   facebook_messenger_conversation
+--   facebook_messenger_event
+
+alter table "public"."facebook_messenger_conversation"
+    enable row level security;
+alter table "public"."facebook_messenger_event" enable row level security;
+
+revoke all on table "public"."facebook_messenger_conversation" from public;
+revoke all on table "public"."facebook_messenger_conversation" from "anon";
+revoke all on table "public"."facebook_messenger_conversation"
+from "authenticated";
+grant select on table "public"."facebook_messenger_conversation"
+to "authenticated";
+grant all on table "public"."facebook_messenger_conversation"
+to "service_role";
+
+create policy "Company members can view Messenger conversations"
+on "public"."facebook_messenger_conversation"
+for select
+to "authenticated"
+using (
+    (
+        nullif(
+            trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"),
+            ''::"text"
+        )
+    )::"uuid" = "company_id"
+);
+
+revoke all on table "public"."facebook_messenger_event" from public;
+revoke all on table "public"."facebook_messenger_event" from "anon";
+revoke all on table "public"."facebook_messenger_event" from "authenticated";
+grant all on table "public"."facebook_messenger_event" to "service_role";
+
+-- ============================================================
+-- Function permissions
+-- ============================================================
+
+revoke all on function "public"."set_facebook_messenger_settings"(jsonb)
+from public;
+revoke all on function "public"."set_facebook_messenger_settings"(jsonb)
+from "anon";
+revoke all on function "public"."set_facebook_messenger_settings"(jsonb)
+from "authenticated";
+grant execute on function "public"."set_facebook_messenger_settings"(jsonb)
+to "service_role";
+
+revoke all on function "public"."enqueue_facebook_messenger_event"(jsonb)
+from public;
+revoke all on function "public"."enqueue_facebook_messenger_event"(jsonb)
+from "anon";
+revoke all on function "public"."enqueue_facebook_messenger_event"(jsonb)
+from "authenticated";
+grant execute on function "public"."enqueue_facebook_messenger_event"(jsonb)
+to "service_role";
+
+revoke all on function "public"."claim_facebook_messenger_events"(integer)
+from public;
+revoke all on function "public"."claim_facebook_messenger_events"(integer)
+from "anon";
+revoke all on function "public"."claim_facebook_messenger_events"(integer)
+from "authenticated";
+grant execute on function "public"."claim_facebook_messenger_events"(integer)
+to "service_role";
+
+revoke all on function "public"."finalize_facebook_messenger_event"(jsonb)
+from public;
+revoke all on function "public"."finalize_facebook_messenger_event"(jsonb)
+from "anon";
+revoke all on function "public"."finalize_facebook_messenger_event"(jsonb)
+from "authenticated";
+grant execute on function "public"."finalize_facebook_messenger_event"(jsonb)
+to "service_role";

package/dist/dist/migrations/20260826234724_widen_automations_messenger.sql

@@ -0,0 +1,46 @@
+-- Facebook Messenger automations: one new trigger type
+-- (messenger_conversation_started), one new captured event type (same name,
+-- emitted by finalize_facebook_messenger_event when an ad-referral
+-- conversation creates its lead), and one new action type (messenger_client,
+-- which replies in the conversation through the Send API). Mirrors
+-- AUTOMATION_TRIGGER_TYPES / AUTOMATION_EVENT_TYPES / AUTOMATION_ACTION_TYPES
+-- in src/server-safe/automations.ts; the lists must stay in sync.
+--
+-- Safe to apply in any order relative to the web deploy: the engine's
+-- fan-out only fetches event types it knows, so rows with types from a
+-- newer schema wait unprocessed instead of being swallowed.
+
+alter table "public"."automation_rule"
+    drop constraint "automation_rule_trigger_type_check";
+alter table "public"."automation_rule"
+    add constraint "automation_rule_trigger_type_check"
+    check ("trigger_type" in (
+        'job_created', 'job_status_changed', 'job_rescheduled',
+        'schedule_time_relative',
+        'rental_date_relative', 'rental_task_completed',
+        'estimate_sent', 'estimate_approved', 'estimate_declined',
+        'estimate_pending',
+        'invoice_due_relative',
+        'lead_created', 'lead_converted',
+        'booking_request_received', 'booking_confirmed', 'booking_declined',
+        'messenger_conversation_started'));
+
+alter table "public"."automation_rule"
+    drop constraint "automation_rule_action_type_check";
+alter table "public"."automation_rule"
+    add constraint "automation_rule_action_type_check"
+    check ("action_type" in (
+        'sms_client', 'email_client', 'notify_team', 'apply_tag', 'webhook',
+        'messenger_client'));
+
+alter table "public"."automation_event"
+    drop constraint "automation_event_event_type_check";
+alter table "public"."automation_event"
+    add constraint "automation_event_event_type_check"
+    check ("event_type" in (
+        'job_created', 'job_deleted', 'job_status_changed', 'job_rescheduled',
+        'rental_task_completed',
+        'booking_request_received', 'booking_confirmed', 'booking_declined',
+        'estimate_sent', 'estimate_approved', 'estimate_declined',
+        'lead_created', 'lead_converted',
+        'messenger_conversation_started'));

package/dist/dist/migrations/20260827100001_add_route_plan_minutes.sql

@@ -0,0 +1,10 @@
+-- Multi-driver optimizer: the hours model. total_minutes mirrors
+-- total_miles (drive + per-stop service time for the current run);
+-- driver_options persists the dialog's per-driver inputs
+-- ({userId: {maxHours, startLotId}}) so a panel re-run pre-fills them.
+-- Apply-safe before any deploy: both defaulted, and the live v2 RPC's
+-- inserts list their columns explicitly.
+
+alter table "public"."route_plan"
+    add column "total_minutes" numeric default 0 not null,
+    add column "driver_options" jsonb default '{}'::jsonb not null;

package/dist/dist/migrations/20260827100002_add_route_plan_stop_leg_minutes.sql

@@ -0,0 +1,9 @@
+-- Multi-driver optimizer: per-leg drive minutes, mirroring
+-- leg_miles_from_prev (cached Google duration when available, else miles
+-- at the assumed road speed). Out-of-truck service time is NOT stored —
+-- clients recompute it from the shared serviceMinutesForStop constants,
+-- so tuning a constant never needs a data migration. Rows persisted
+-- before this migration keep 0 and read as drive-time-unknown.
+
+alter table "public"."route_plan_stop"
+    add column "leg_minutes_from_prev" numeric default 0 not null;

package/dist/dist/migrations/20260827100003_apply_rental_route_plan_v3.sql

@@ -0,0 +1,341 @@
+-- Multi-driver optimizer: apply_rental_route_plan v3. Same 7-arg
+-- signature as v2 (create or replace, no drop — deployed callers keep
+-- working mid-migration); the ONLY changes are the three new columns:
+--   - route_plan.total_minutes / driver_options on insert and update,
+--   - route_plan_stop.leg_minutes_from_prev on the stop insert,
+-- all coalesced so a plan JSON computed by an older bundle (stale web,
+-- old mobile posting the preview verbatim) still applies with 0/'{}'.
+-- Everything else is byte-identical to v2.
+
+create or replace function "public"."apply_rental_route_plan"(
+    "p_company_id" uuid,
+    -- Plan metadata + optimistic concurrency: date, structural_fingerprint,
+    -- created_by, total_miles, total_minutes, driver_options, warnings,
+    -- unroutable, distance_stats, and expected_run (integer; absent/null =
+    -- the optimizer saw no plan). expected_run rides inside the jsonb
+    -- because generated RPC arg types are non-nullable — a bare integer
+    -- arg couldn't carry null.
+    "p_plan" jsonb,
+    "p_expected" jsonb,
+    "p_expected_stops" jsonb,
+    "p_task_updates" jsonb,
+    "p_assignments" jsonb,
+    "p_stops" jsonb
+) returns void
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+    v_item jsonb;
+    v_sched "public"."job_schedule"%rowtype;
+    v_expected_ids uuid[] := '{}';
+    v_schedule_id uuid;
+    v_current_users uuid[];
+    v_expected_users uuid[];
+    v_plan_id uuid;
+    v_existing_run integer;
+    v_new_run integer;
+    v_expected_run integer;
+    v_date date;
+    v_current_stop_states text[];
+    v_expected_stop_states text[];
+begin
+    if p_company_id is null then
+        raise exception 'company id is required'
+            using errcode = 'P0011';
+    end if;
+
+    v_date := (p_plan->>'date')::date;
+    if v_date is null then
+        raise exception 'plan date is required'
+            using errcode = 'P0011';
+    end if;
+    v_expected_run := (p_plan->>'expected_run')::integer;
+
+    -- 1a. Serialize ALL applies for this company-day, including the very
+    --     first (no plan row exists yet, so there is nothing to
+    --     row-lock): without this, two overlapping first approvals both
+    --     see no plan, both pass the null-run check, and the loser dies
+    --     on the (company_id, date) unique key with a raw error instead
+    --     of the intended stale-plan P0010. Transaction-scoped, so it
+    --     releases on commit/rollback; a cross-day hash collision only
+    --     costs extra serialization, never correctness.
+    perform pg_advisory_xact_lock(
+        hashtextextended(p_company_id::text || ':' || v_date::text, 0)
+    );
+
+    -- 1b. Lock the plan row (if any): the second apply re-reads AFTER the
+    --     winner committed, so its run check resolves the race as P0010.
+    select "id", "run" into v_plan_id, v_existing_run
+    from "public"."route_plan"
+    where "company_id" = p_company_id and "date" = v_date
+    for update;
+
+    if found then
+        if v_expected_run is distinct from v_existing_run then
+            raise exception 'route plan is stale'
+                using errcode = 'P0010';
+        end if;
+    elsif v_expected_run is not null then
+        raise exception 'route plan is stale'
+            using errcode = 'P0010';
+    end if;
+
+    -- 1c. The plan's current stop set (id + status) must match what the
+    --     optimizer saw — a stop completed or failed since the preview
+    --     invalidates the plan. Covers every run's rows, pending or not.
+    if v_plan_id is not null then
+        select coalesce(
+            array_agg(("id"::text || ':' || coalesce("status", ''))
+                order by "id"), '{}')
+        into v_current_stop_states
+        from "public"."route_plan_stop"
+        where "route_plan_id" = v_plan_id;
+    else
+        v_current_stop_states := '{}';
+    end if;
+
+    select coalesce(
+        array_agg(((e->>'id') || ':' || coalesce(e->>'status', ''))
+            order by (e->>'id')), '{}')
+    into v_expected_stop_states
+    from jsonb_array_elements(coalesce(p_expected_stops, '[]'::jsonb)) e;
+
+    if v_current_stop_states is distinct from v_expected_stop_states then
+        raise exception 'route plan is stale'
+            using errcode = 'P0010';
+    end if;
+
+    -- 1d. Lock every planned schedule row; verify tenancy and that its
+    --     optimized state — status, assets, size, ordering, assignees —
+    --     is unchanged since the plan was computed.
+    for v_item in
+        select * from jsonb_array_elements(coalesce(p_expected, '[]'::jsonb))
+    loop
+        v_schedule_id := (v_item->>'schedule_id')::uuid;
+
+        select * into v_sched
+        from "public"."job_schedule"
+        where "id" = v_schedule_id
+        for update;
+
+        if not found or v_sched."company_id" is distinct from p_company_id then
+            raise exception 'route plan references an unknown schedule row'
+                using errcode = 'P0011';
+        end if;
+
+        select coalesce(array_agg("user_id" order by "user_id"), '{}')
+        into v_current_users
+        from "public"."job_user"
+        where "job_schedule_id" = v_schedule_id;
+
+        select coalesce(array_agg(u.value::uuid order by u.value::uuid), '{}')
+        into v_expected_users
+        from jsonb_array_elements_text(
+            coalesce(v_item->'user_ids', '[]'::jsonb)) u;
+
+        if v_sched."status"::text is distinct from (v_item->>'status')
+            or v_sched."asset_id" is distinct from
+                (v_item->>'asset_id')::uuid
+            or v_sched."secondary_asset_id" is distinct from
+                (v_item->>'secondary_asset_id')::uuid
+            or v_sched."list_sort_key" is distinct from
+                (v_item->>'list_sort_key')::numeric
+            or v_sched."size" is distinct from
+                (v_item->>'size')::numeric
+            or v_current_users is distinct from v_expected_users
+        then
+            raise exception 'route plan is stale'
+                using errcode = 'P0010';
+        end if;
+
+        v_expected_ids := v_expected_ids || v_schedule_id;
+    end loop;
+
+    -- 2. Ordering updates (any-time task rows only in practice; the
+    --    engine emits an update only when the key actually changes).
+    for v_item in
+        select * from jsonb_array_elements(coalesce(p_task_updates, '[]'::jsonb))
+    loop
+        v_schedule_id := (v_item->>'schedule_id')::uuid;
+
+        if not (v_schedule_id = any (v_expected_ids)) then
+            raise exception 'task update outside the locked plan rows'
+                using errcode = 'P0011';
+        end if;
+
+        update "public"."job_schedule"
+        set "list_sort_key" = (v_item->>'list_sort_key')::numeric
+        where "id" = v_schedule_id;
+    end loop;
+
+    -- 3. Full replacement of each planned row's assignments. job_id is read
+    --    from the schedule row itself, never from the payload, and every
+    --    assignee must belong to the company — user and company foreign
+    --    keys on job_user are enforced independently, so without this
+    --    check a crafted payload could create a cross-tenant assignment.
+    for v_item in
+        select * from jsonb_array_elements(coalesce(p_assignments, '[]'::jsonb))
+    loop
+        v_schedule_id := (v_item->>'schedule_id')::uuid;
+
+        if not (v_schedule_id = any (v_expected_ids)) then
+            raise exception 'assignment outside the locked plan rows'
+                using errcode = 'P0011';
+        end if;
+
+        perform 1
+        from jsonb_array_elements_text(
+            coalesce(v_item->'user_ids', '[]'::jsonb)) u
+        where not exists (
+            select 1 from "public"."user_role" ur
+            where ur."user_id" = u.value::uuid
+              and ur."company_id" = p_company_id
+        );
+        if found then
+            raise exception 'assignee outside the company'
+                using errcode = 'P0011';
+        end if;
+
+        delete from "public"."job_user"
+        where "job_schedule_id" = v_schedule_id;
+
+        insert into "public"."job_user"
+            ("company_id", "job_id", "job_schedule_id", "user_id")
+        select p_company_id, js."job_id", v_schedule_id, u.value::uuid
+        from "public"."job_schedule" js
+        cross join jsonb_array_elements_text(
+            coalesce(v_item->'user_ids', '[]'::jsonb)) u
+        where js."id" = v_schedule_id;
+    end loop;
+
+    -- 4a. Every stop's driver must belong to the company, and every task
+    --     stop must reference a row locked and verified above.
+    perform 1
+    from jsonb_array_elements(coalesce(p_stops, '[]'::jsonb)) s
+    where not exists (
+        select 1 from "public"."user_role" ur
+        where ur."user_id" = (s->>'driver_user_id')::uuid
+          and ur."company_id" = p_company_id
+    );
+    if found then
+        raise exception 'stop driver outside the company'
+            using errcode = 'P0011';
+    end if;
+
+    perform 1
+    from jsonb_array_elements(coalesce(p_stops, '[]'::jsonb)) s
+    where s->>'kind' = 'task'
+      and not ((s->>'job_schedule_id')::uuid = any (v_expected_ids));
+    if found then
+        raise exception 'task stop outside the locked plan rows'
+            using errcode = 'P0011';
+    end if;
+
+    -- 4b. Upsert the plan.
+    if v_plan_id is null then
+        v_plan_id := "gen_random_uuid"();
+        v_new_run := 1;
+        insert into "public"."route_plan" (
+            "id", "company_id", "date", "run", "structural_fingerprint",
+            "created_by", "total_miles", "total_minutes", "driver_options",
+            "warnings", "unroutable", "distance_stats"
+        ) values (
+            v_plan_id, p_company_id, v_date, v_new_run,
+            coalesce(p_plan->>'structural_fingerprint', ''),
+            (p_plan->>'created_by')::uuid,
+            coalesce((p_plan->>'total_miles')::numeric, 0),
+            coalesce((p_plan->>'total_minutes')::numeric, 0),
+            coalesce(p_plan->'driver_options', '{}'::jsonb),
+            coalesce(p_plan->'warnings', '[]'::jsonb),
+            coalesce(p_plan->'unroutable', '[]'::jsonb),
+            coalesce(p_plan->'distance_stats', '{}'::jsonb)
+        );
+    else
+        v_new_run := v_existing_run + 1;
+        update "public"."route_plan"
+        set "run" = v_new_run,
+            "structural_fingerprint" =
+                coalesce(p_plan->>'structural_fingerprint', ''),
+            "created_by" = (p_plan->>'created_by')::uuid,
+            "total_miles" = coalesce((p_plan->>'total_miles')::numeric, 0),
+            "total_minutes" =
+                coalesce((p_plan->>'total_minutes')::numeric, 0),
+            "driver_options" =
+                coalesce(p_plan->'driver_options', '{}'::jsonb),
+            "warnings" = coalesce(p_plan->'warnings', '[]'::jsonb),
+            "unroutable" = coalesce(p_plan->'unroutable', '[]'::jsonb),
+            "distance_stats" = coalesce(p_plan->'distance_stats', '{}'::jsonb),
+            "updated_at" = "now"()
+        where "id" = v_plan_id;
+    end if;
+
+    -- 4c. Delete the re-plannable stops; terminal ones stay as history.
+    delete from "public"."route_plan_stop" s
+    where s."route_plan_id" = v_plan_id
+      and (
+        (s."kind" = 'implied' and s."status" = 'pending')
+        or (s."kind" = 'task' and exists (
+            select 1 from "public"."job_schedule" js
+            where js."id" = s."job_schedule_id"
+              and js."status" not in ('Completed', 'Failed')
+        ))
+      );
+
+    -- 4d. Insert the new run's stops. status is server-stamped: implied
+    --     stops start 'pending', task stops carry none (it lives on the
+    --     schedule row).
+    insert into "public"."route_plan_stop" (
+        "id", "company_id", "route_plan_id", "run", "sort_key",
+        "driver_user_id", "kind", "job_schedule_id", "implied_kind",
+        "status", "suggested_asset_id", "size", "saved_location_id",
+        "label", "address", "latitude", "longitude",
+        "source_job_schedule_id", "leg_miles_from_prev",
+        "leg_minutes_from_prev"
+    )
+    select
+        (s->>'id')::uuid,
+        p_company_id,
+        v_plan_id,
+        v_new_run,
+        (s->>'sort_key')::numeric,
+        (s->>'driver_user_id')::uuid,
+        s->>'kind',
+        (s->>'job_schedule_id')::uuid,
+        s->>'implied_kind',
+        case when s->>'kind' = 'implied' then 'pending' end,
+        (s->>'suggested_asset_id')::uuid,
+        (s->>'size')::numeric,
+        (s->>'saved_location_id')::uuid,
+        coalesce(s->>'label', ''),
+        coalesce(s->>'address', ''),
+        (s->>'latitude')::numeric,
+        (s->>'longitude')::numeric,
+        (s->>'source_job_schedule_id')::uuid,
+        coalesce((s->>'leg_miles_from_prev')::numeric, 0),
+        coalesce((s->>'leg_minutes_from_prev')::numeric, 0)
+    from jsonb_array_elements(coalesce(p_stops, '[]'::jsonb)) s
+    on conflict ("id") do nothing;
+end;
+$$;
+
+alter function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb, jsonb, jsonb
+) owner to "postgres";
+
+-- security definer + service_role-only: /api/rental-routes/apply is the
+-- sole caller; no authenticated/anon path exists. Re-asserted verbatim
+-- (create or replace preserves grants; this keeps the intent explicit).
+revoke all on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb, jsonb, jsonb
+) from public;
+revoke all on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb, jsonb, jsonb
+) from "anon";
+revoke all on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb, jsonb, jsonb
+) from "authenticated";
+grant execute on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb, jsonb, jsonb
+) to "service_role";