autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260827230346_apply_rental_route_plan_v4.sql

@@ -0,0 +1,366 @@
+-- Optimizer rerun handling: apply_rental_route_plan v4. Same 7-arg
+-- signature as v3 (create or replace, no drop — deployed callers keep
+-- working mid-migration); the ONLY change is step 4c's task-stop
+-- predicate. Unchecking a driver on a re-run means "out of service":
+-- their Open tasks are re-pooled onto the run's drivers, so their old
+-- task stops delete via the schedule-id match — but an out-of-service
+-- driver's In Progress/On My Way task stop (not re-plannable, warned
+-- about by the engine) now SURVIVES as that driver's display record
+-- instead of silently vanishing from their Driver Mode day list. Their
+-- pending implied stops still delete (the redistributed work regenerates
+-- equivalent legs on the new driver's route). Everything else is
+-- byte-identical to v3.
+
+create or replace function "public"."apply_rental_route_plan"(
+    "p_company_id" uuid,
+    -- Plan metadata + optimistic concurrency: date, structural_fingerprint,
+    -- created_by, total_miles, total_minutes, driver_options, warnings,
+    -- unroutable, distance_stats, and expected_run (integer; absent/null =
+    -- the optimizer saw no plan). expected_run rides inside the jsonb
+    -- because generated RPC arg types are non-nullable — a bare integer
+    -- arg couldn't carry null.
+    "p_plan" jsonb,
+    "p_expected" jsonb,
+    "p_expected_stops" jsonb,
+    "p_task_updates" jsonb,
+    "p_assignments" jsonb,
+    "p_stops" jsonb
+) returns void
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+    v_item jsonb;
+    v_sched "public"."job_schedule"%rowtype;
+    v_expected_ids uuid[] := '{}';
+    v_schedule_id uuid;
+    v_current_users uuid[];
+    v_expected_users uuid[];
+    v_plan_id uuid;
+    v_existing_run integer;
+    v_new_run integer;
+    v_expected_run integer;
+    v_date date;
+    v_current_stop_states text[];
+    v_expected_stop_states text[];
+begin
+    if p_company_id is null then
+        raise exception 'company id is required'
+            using errcode = 'P0011';
+    end if;
+
+    v_date := (p_plan->>'date')::date;
+    if v_date is null then
+        raise exception 'plan date is required'
+            using errcode = 'P0011';
+    end if;
+    v_expected_run := (p_plan->>'expected_run')::integer;
+
+    -- 1a. Serialize ALL applies for this company-day, including the very
+    --     first (no plan row exists yet, so there is nothing to
+    --     row-lock): without this, two overlapping first approvals both
+    --     see no plan, both pass the null-run check, and the loser dies
+    --     on the (company_id, date) unique key with a raw error instead
+    --     of the intended stale-plan P0010. Transaction-scoped, so it
+    --     releases on commit/rollback; a cross-day hash collision only
+    --     costs extra serialization, never correctness.
+    perform pg_advisory_xact_lock(
+        hashtextextended(p_company_id::text || ':' || v_date::text, 0)
+    );
+
+    -- 1b. Lock the plan row (if any): the second apply re-reads AFTER the
+    --     winner committed, so its run check resolves the race as P0010.
+    select "id", "run" into v_plan_id, v_existing_run
+    from "public"."route_plan"
+    where "company_id" = p_company_id and "date" = v_date
+    for update;
+
+    if found then
+        if v_expected_run is distinct from v_existing_run then
+            raise exception 'route plan is stale'
+                using errcode = 'P0010';
+        end if;
+    elsif v_expected_run is not null then
+        raise exception 'route plan is stale'
+            using errcode = 'P0010';
+    end if;
+
+    -- 1c. The plan's current stop set (id + status) must match what the
+    --     optimizer saw — a stop completed or failed since the preview
+    --     invalidates the plan. Covers every run's rows, pending or not.
+    if v_plan_id is not null then
+        select coalesce(
+            array_agg(("id"::text || ':' || coalesce("status", ''))
+                order by "id"), '{}')
+        into v_current_stop_states
+        from "public"."route_plan_stop"
+        where "route_plan_id" = v_plan_id;
+    else
+        v_current_stop_states := '{}';
+    end if;
+
+    select coalesce(
+        array_agg(((e->>'id') || ':' || coalesce(e->>'status', ''))
+            order by (e->>'id')), '{}')
+    into v_expected_stop_states
+    from jsonb_array_elements(coalesce(p_expected_stops, '[]'::jsonb)) e;
+
+    if v_current_stop_states is distinct from v_expected_stop_states then
+        raise exception 'route plan is stale'
+            using errcode = 'P0010';
+    end if;
+
+    -- 1d. Lock every planned schedule row; verify tenancy and that its
+    --     optimized state — status, assets, size, ordering, assignees —
+    --     is unchanged since the plan was computed.
+    for v_item in
+        select * from jsonb_array_elements(coalesce(p_expected, '[]'::jsonb))
+    loop
+        v_schedule_id := (v_item->>'schedule_id')::uuid;
+
+        select * into v_sched
+        from "public"."job_schedule"
+        where "id" = v_schedule_id
+        for update;
+
+        if not found or v_sched."company_id" is distinct from p_company_id then
+            raise exception 'route plan references an unknown schedule row'
+                using errcode = 'P0011';
+        end if;
+
+        select coalesce(array_agg("user_id" order by "user_id"), '{}')
+        into v_current_users
+        from "public"."job_user"
+        where "job_schedule_id" = v_schedule_id;
+
+        select coalesce(array_agg(u.value::uuid order by u.value::uuid), '{}')
+        into v_expected_users
+        from jsonb_array_elements_text(
+            coalesce(v_item->'user_ids', '[]'::jsonb)) u;
+
+        if v_sched."status"::text is distinct from (v_item->>'status')
+            or v_sched."asset_id" is distinct from
+                (v_item->>'asset_id')::uuid
+            or v_sched."secondary_asset_id" is distinct from
+                (v_item->>'secondary_asset_id')::uuid
+            or v_sched."list_sort_key" is distinct from
+                (v_item->>'list_sort_key')::numeric
+            or v_sched."size" is distinct from
+                (v_item->>'size')::numeric
+            or v_current_users is distinct from v_expected_users
+        then
+            raise exception 'route plan is stale'
+                using errcode = 'P0010';
+        end if;
+
+        v_expected_ids := v_expected_ids || v_schedule_id;
+    end loop;
+
+    -- 2. Ordering updates (any-time task rows only in practice; the
+    --    engine emits an update only when the key actually changes).
+    for v_item in
+        select * from jsonb_array_elements(coalesce(p_task_updates, '[]'::jsonb))
+    loop
+        v_schedule_id := (v_item->>'schedule_id')::uuid;
+
+        if not (v_schedule_id = any (v_expected_ids)) then
+            raise exception 'task update outside the locked plan rows'
+                using errcode = 'P0011';
+        end if;
+
+        update "public"."job_schedule"
+        set "list_sort_key" = (v_item->>'list_sort_key')::numeric
+        where "id" = v_schedule_id;
+    end loop;
+
+    -- 3. Full replacement of each planned row's assignments. job_id is read
+    --    from the schedule row itself, never from the payload, and every
+    --    assignee must belong to the company — user and company foreign
+    --    keys on job_user are enforced independently, so without this
+    --    check a crafted payload could create a cross-tenant assignment.
+    for v_item in
+        select * from jsonb_array_elements(coalesce(p_assignments, '[]'::jsonb))
+    loop
+        v_schedule_id := (v_item->>'schedule_id')::uuid;
+
+        if not (v_schedule_id = any (v_expected_ids)) then
+            raise exception 'assignment outside the locked plan rows'
+                using errcode = 'P0011';
+        end if;
+
+        perform 1
+        from jsonb_array_elements_text(
+            coalesce(v_item->'user_ids', '[]'::jsonb)) u
+        where not exists (
+            select 1 from "public"."user_role" ur
+            where ur."user_id" = u.value::uuid
+              and ur."company_id" = p_company_id
+        );
+        if found then
+            raise exception 'assignee outside the company'
+                using errcode = 'P0011';
+        end if;
+
+        delete from "public"."job_user"
+        where "job_schedule_id" = v_schedule_id;
+
+        insert into "public"."job_user"
+            ("company_id", "job_id", "job_schedule_id", "user_id")
+        select p_company_id, js."job_id", v_schedule_id, u.value::uuid
+        from "public"."job_schedule" js
+        cross join jsonb_array_elements_text(
+            coalesce(v_item->'user_ids', '[]'::jsonb)) u
+        where js."id" = v_schedule_id;
+    end loop;
+
+    -- 4a. Every stop's driver must belong to the company, and every task
+    --     stop must reference a row locked and verified above.
+    perform 1
+    from jsonb_array_elements(coalesce(p_stops, '[]'::jsonb)) s
+    where not exists (
+        select 1 from "public"."user_role" ur
+        where ur."user_id" = (s->>'driver_user_id')::uuid
+          and ur."company_id" = p_company_id
+    );
+    if found then
+        raise exception 'stop driver outside the company'
+            using errcode = 'P0011';
+    end if;
+
+    perform 1
+    from jsonb_array_elements(coalesce(p_stops, '[]'::jsonb)) s
+    where s->>'kind' = 'task'
+      and not ((s->>'job_schedule_id')::uuid = any (v_expected_ids));
+    if found then
+        raise exception 'task stop outside the locked plan rows'
+            using errcode = 'P0011';
+    end if;
+
+    -- 4b. Upsert the plan.
+    if v_plan_id is null then
+        v_plan_id := "gen_random_uuid"();
+        v_new_run := 1;
+        insert into "public"."route_plan" (
+            "id", "company_id", "date", "run", "structural_fingerprint",
+            "created_by", "total_miles", "total_minutes", "driver_options",
+            "warnings", "unroutable", "distance_stats"
+        ) values (
+            v_plan_id, p_company_id, v_date, v_new_run,
+            coalesce(p_plan->>'structural_fingerprint', ''),
+            (p_plan->>'created_by')::uuid,
+            coalesce((p_plan->>'total_miles')::numeric, 0),
+            coalesce((p_plan->>'total_minutes')::numeric, 0),
+            coalesce(p_plan->'driver_options', '{}'::jsonb),
+            coalesce(p_plan->'warnings', '[]'::jsonb),
+            coalesce(p_plan->'unroutable', '[]'::jsonb),
+            coalesce(p_plan->'distance_stats', '{}'::jsonb)
+        );
+    else
+        v_new_run := v_existing_run + 1;
+        update "public"."route_plan"
+        set "run" = v_new_run,
+            "structural_fingerprint" =
+                coalesce(p_plan->>'structural_fingerprint', ''),
+            "created_by" = (p_plan->>'created_by')::uuid,
+            "total_miles" = coalesce((p_plan->>'total_miles')::numeric, 0),
+            "total_minutes" =
+                coalesce((p_plan->>'total_minutes')::numeric, 0),
+            "driver_options" =
+                coalesce(p_plan->'driver_options', '{}'::jsonb),
+            "warnings" = coalesce(p_plan->'warnings', '[]'::jsonb),
+            "unroutable" = coalesce(p_plan->'unroutable', '[]'::jsonb),
+            "distance_stats" = coalesce(p_plan->'distance_stats', '{}'::jsonb),
+            "updated_at" = "now"()
+        where "id" = v_plan_id;
+    end if;
+
+    -- 4c. Delete the re-plannable stops; terminal ones stay as history,
+    --     and a non-terminal task stop belonging to a driver OUTSIDE this
+    --     run (out of service) survives as that driver's display record
+    --     unless the task itself was re-planned. A task re-planned to any
+    --     driver deletes its old stop via the schedule-id match; any stop
+    --     of a driver in the new run deletes via the driver match (their
+    --     whole route is being replaced).
+    delete from "public"."route_plan_stop" s
+    where s."route_plan_id" = v_plan_id
+      and (
+        (s."kind" = 'implied' and s."status" = 'pending')
+        or (s."kind" = 'task'
+            and exists (
+                select 1 from "public"."job_schedule" js
+                where js."id" = s."job_schedule_id"
+                  and js."status" not in ('Completed', 'Failed')
+            )
+            and (
+                s."job_schedule_id" in (
+                    select (t->>'job_schedule_id')::uuid
+                    from jsonb_array_elements(
+                        coalesce(p_stops, '[]'::jsonb)) t
+                    where t->>'kind' = 'task'
+                )
+                or s."driver_user_id" in (
+                    select distinct (t->>'driver_user_id')::uuid
+                    from jsonb_array_elements(
+                        coalesce(p_stops, '[]'::jsonb)) t
+                )
+            )
+        )
+      );
+
+    -- 4d. Insert the new run's stops. status is server-stamped: implied
+    --     stops start 'pending', task stops carry none (it lives on the
+    --     schedule row).
+    insert into "public"."route_plan_stop" (
+        "id", "company_id", "route_plan_id", "run", "sort_key",
+        "driver_user_id", "kind", "job_schedule_id", "implied_kind",
+        "status", "suggested_asset_id", "size", "saved_location_id",
+        "label", "address", "latitude", "longitude",
+        "source_job_schedule_id", "leg_miles_from_prev",
+        "leg_minutes_from_prev"
+    )
+    select
+        (s->>'id')::uuid,
+        p_company_id,
+        v_plan_id,
+        v_new_run,
+        (s->>'sort_key')::numeric,
+        (s->>'driver_user_id')::uuid,
+        s->>'kind',
+        (s->>'job_schedule_id')::uuid,
+        s->>'implied_kind',
+        case when s->>'kind' = 'implied' then 'pending' end,
+        (s->>'suggested_asset_id')::uuid,
+        (s->>'size')::numeric,
+        (s->>'saved_location_id')::uuid,
+        coalesce(s->>'label', ''),
+        coalesce(s->>'address', ''),
+        (s->>'latitude')::numeric,
+        (s->>'longitude')::numeric,
+        (s->>'source_job_schedule_id')::uuid,
+        coalesce((s->>'leg_miles_from_prev')::numeric, 0),
+        coalesce((s->>'leg_minutes_from_prev')::numeric, 0)
+    from jsonb_array_elements(coalesce(p_stops, '[]'::jsonb)) s
+    on conflict ("id") do nothing;
+end;
+$$;
+
+alter function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb, jsonb, jsonb
+) owner to "postgres";
+
+-- security definer + service_role-only: /api/rental-routes/apply is the
+-- sole caller; no authenticated/anon path exists. Re-asserted verbatim
+-- (create or replace preserves grants; this keeps the intent explicit).
+revoke all on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb, jsonb, jsonb
+) from public;
+revoke all on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb, jsonb, jsonb
+) from "anon";
+revoke all on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb, jsonb, jsonb
+) from "authenticated";
+grant execute on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb, jsonb, jsonb
+) to "service_role";