pipework 0.257.0 → 0.258.1

package/src/core/validation/queue-tables.ts

@@ -200,6 +200,7 @@ export async function queueTableProblems(url: string, timeoutMs: number | null =
   const { default: postgres } = await import('postgres')
   const sql = postgres(url, {
     max: 1,
+    fetch_types: false,
     idle_timeout: 1,
     ...probeConnectTimeout(timeoutMs),
     onnotice: () => {},
@@ -208,7 +209,7 @@ export async function queueTableProblems(url: string, timeoutMs: number | null =
   try {
     const presence = await sql<{ name: string; present: boolean }[]>`
       SELECT t.name, to_regclass('public.' || quote_ident(t.name)) IS NOT NULL AS present
-      FROM unnest(${tables}::text[]) AS t(name)
+      FROM jsonb_array_elements_text(${sql.json(tables)}) AS t(name)
     `
     const present = new Set(presence.filter(r => r.present).map(r => r.name))
 
@@ -240,12 +241,12 @@ export async function queueTableProblems(url: string, timeoutMs: number | null =
             FROM pg_attribute a
             JOIN pg_class c ON c.oid = a.attrelid
             JOIN pg_namespace n ON n.oid = c.relnamespace
-            WHERE n.nspname = 'public' AND c.relname = ANY(${[...present]}::text[])
+            WHERE n.nspname = 'public' AND c.relname IN (SELECT jsonb_array_elements_text(${sql.json([...present])}))
               AND a.attnum > 0 AND NOT a.attisdropped
           ) AS columns,
           (
             SELECT coalesce(json_agg(json_build_object('name', t, 'oid', to_regtype(t)::oid::int)), '[]'::json)
-            FROM unnest(${typeNames}::text[]) AS t
+            FROM jsonb_array_elements_text(${sql.json(typeNames)}) AS t
           ) AS types
       `
       for (const column of row?.columns ?? []) {

package/src/core/validation/rls-role.ts

@@ -39,6 +39,7 @@ export async function probeRlsRole(url: string, timeoutMs: number | null = 5000)
   const { default: postgres } = await import('postgres')
   const sql = postgres(url, {
     max: 1,
+    fetch_types: false,
     idle_timeout: 1,
     ...probeConnectTimeout(timeoutMs),
     onnotice: () => {},

package/src/data/db/query-watch.ts

@@ -49,7 +49,7 @@ export function createStatementWatch(options: StatementWatchOptions): StatementW
   function sampleBackend(sqlText: string, startedMs: number): Promise<BackendSample> {
     if (sampling || closed) return Promise.resolve(UNKNOWN_BACKEND)
     sampling = true
-    sampler ??= postgres(url, { max: 1, idle_timeout: 3, onnotice: () => {}, connect_timeout: 5 })
+    sampler ??= postgres(url, { max: 1, idle_timeout: 3, onnotice: () => {}, connect_timeout: 5, fetch_types: false })
     const client = sampler
     const run = client.unsafe<Array<{ pid: number; state: string | null; wait_event_type: string | null; wait_event: string | null }>>(
       `SELECT pid, state, wait_event_type, wait_event FROM pg_stat_activity

package/src/data/db/reservation.ts

@@ -51,6 +51,7 @@ export function createReservationPublisher(): ReservationPublisher {
         if (!entry.client) {
           entry.client = postgres(entry.url, {
             max: 1,
+            fetch_types: false,
             idle_timeout: 0,
             onnotice: () => {},
             connection: { application_name: value },

package/src/infra/email/inbound.ts

@@ -96,6 +96,8 @@ export interface ReceivedEmail {
    * and `from.address` is non-empty; a PASS on a message with an ambiguous From says nothing about any one author.
    */
   readonly verdicts: EmailVerdicts | null
+  /** Which inbound source recorded the message; only the folder stand-in has no verdicts. */
+  readonly source: 'ses' | 'folder'
   /** The envelope recipients SES accepted the message for; for the stand-in, the To and Cc addresses. */
   readonly recipients: readonly string[]
 }
@@ -493,6 +495,7 @@ export function createInbound(config: InboundConfig): Inbound {
         contentId: a.contentId, inline: a.inline, file: null,
       })),
       verdicts, recipients,
+      source: row['source'] as 'ses' | 'folder',
     }
 
     let tenantId = (row['tenant_id'] as string | null) ?? null

package/src/infra/support/handle.ts

@@ -65,7 +65,7 @@ export interface SupportConfig {
   /**
    * Decides what `receiveEmail` does with a message. Default: virus verdict `FAIL` drops it; DMARC `FAIL`, or SPF and
    * DKIM both `FAIL`, separates it (the From address is probably forged, so it must not add text to a ticket an agent
-   * is reading: it always opens a new ticket); anything else, including no verdicts (the folder stand-in), is accepted. A message it
+   * is reading: it always opens a new ticket); anything else, including no verdicts, is accepted (that is not trust: it only decides drop or separate). A message it
    * separates never names a user: `resolveContact` is not called for it.
    */
   readonly screen?: (email: ReceivedEmail) => ScreenVerdict
@@ -95,7 +95,7 @@ export interface SupportConfig {
   /**
    * With `joinThread: 'conversation'` (setting it with `'contact'` throws at create): whether a message from a sender
    * other than the ticket's contact joins the ticket found. The contact's own message always joins. `'authentic'`
-   * (default): an email joins only when its DMARC verdict is `PASS`, or when it has no verdicts (the folder stand-in);
+   * (default): an email joins only when its DMARC verdict is `PASS`; null verdicts count as authentic only from the folder source (an SES mail without verdicts does not join);
    * `receive` (chat/api) joins, since the app vouched for the caller. `'any'`: joins. A function decides itself, with
    * `email: null` for `receive`. A refused message is handled like one `screen` separates: it opens its own ticket,
    * names no user, and its `receive` audit has `separated: true` and `reason: 'not-authentic'`. It never touches the
@@ -535,8 +535,9 @@ export function createSupport(config: SupportConfig): Support {
     const mayJoin = (t: Ticket): boolean => {
       if (t.contactEmail === m.contactEmail || joinOthers === 'any') return true
       if (typeof joinOthers === 'function') return joinOthers({ email: m.email ?? null, ticket: t })
-      const v = m.email?.verdicts
-      return m.email == null || v == null || v.dmarc === 'PASS'
+      if (m.email == null) return true
+      const v = m.email.verdicts
+      return v == null ? m.email.source === 'folder' : v.dmarc === 'PASS'
     }
     let ticket: Ticket | null = null
     if (m.ticketId !== null) {

package/src/test/reap.ts

@@ -247,7 +247,7 @@ export async function reapConfiguredTestDatabases(instance: Manifold, options: R
   const droppedDatabases: string[] = []
   const skippedDatabases: string[] = []
   for (const adminUrl of adminUrls) {
-    const client = postgres(adminUrl, { max: 1, onnotice: () => {} })
+    const client = postgres(adminUrl, { max: 1, fetch_types: false, onnotice: () => {} })
     try {
       const result = await reapOrphanTestDatabases(client, new Set(), options)
       droppedDatabases.push(...result.droppedDatabases)

package/src/test/reset.ts

@@ -110,7 +110,7 @@ async function rlsAccess(q: Query, wanted: ReadonlySet<string>): Promise<{ lift:
 }
 
 function connect(url: string): postgres.Sql {
-  return postgres(url, { max: 1, onnotice: () => {}, idle_timeout: 0, max_lifetime: 0 })
+  return postgres(url, { max: 1, fetch_types: false, onnotice: () => {}, idle_timeout: 0, max_lifetime: 0 })
 }
 
 async function readCopy(sql: Query, table: string): Promise<Buffer> {

package/src/test/setup.ts

@@ -238,10 +238,10 @@ async function runSetup(instance: Manifold, tracker: PhaseTracker): Promise<Map<
 async function prepareRun(adminUrl: string, liveTemplates: ReadonlySet<string>, tracker: PhaseTracker): Promise<void> {
   runAdminUrl = adminUrl
   if (adminClient === null) {
-    adminClient = postgres(adminUrl, { max: 1, onnotice: () => {} })
+    adminClient = postgres(adminUrl, { max: 1, fetch_types: false, onnotice: () => {} })
   }
   if (lockClient === null) {
-    lockClient = postgres(adminUrl, { max: 1, idle_timeout: 0, max_lifetime: 0, onnotice: () => {} })
+    lockClient = postgres(adminUrl, { max: 1, fetch_types: false, idle_timeout: 0, max_lifetime: 0, onnotice: () => {} })
     await lockClient`SELECT pg_advisory_lock(${runLockKey(runNonce).toString()}::bigint)`
   }
   armWorkerShutdown()
@@ -416,6 +416,7 @@ async function templateIsReady(plan: TemplatePlan): Promise<boolean> {
 async function readTemplateMarker(plan: TemplatePlan): Promise<boolean> {
   const client = postgres(siblingUrl(plan.dbConfig, plan.templateDb), {
     max: 1,
+    fetch_types: false,
     onnotice: () => {},
   })
   try {
@@ -782,7 +783,7 @@ async function provisionTestSystemPolicy(
   beat: (detail: string) => void,
 ): Promise<void> {
   for (const url of migrateUrl === undefined ? [templateUrl] : [templateUrl, migrateUrl]) {
-    const client = postgres(url, { max: 1, onnotice: () => {} })
+    const client = postgres(url, { max: 1, fetch_types: false, onnotice: () => {} })
     try {
       const tables = await client<{ ident: string; name: string }[]>`
         SELECT c.oid::regclass::text AS ident, c.relname AS name
@@ -1060,7 +1061,7 @@ async function provisionTemplateRole(
     `END $$`,
   )))
 
-  const templateClient = postgres(templateUrl, { max: 1, onnotice: () => {} })
+  const templateClient = postgres(templateUrl, { max: 1, fetch_types: false, onnotice: () => {} })
   const templateDb = drizzle(templateClient)
 
   await templateDb.execute(sql.raw(`GRANT USAGE ON SCHEMA public TO ${roleIdent}`))
@@ -1089,7 +1090,7 @@ async function provisionTemplateRole(
   // grantor grants what it owns and nothing else.
   await grantOwnedObjects(templateClient, roleIdent, APP_ROLE_GRANTS, beat)
 
-  const migrateClient = postgres(migrateUrl, { max: 1, onnotice: () => {} })
+  const migrateClient = postgres(migrateUrl, { max: 1, fetch_types: false, onnotice: () => {} })
   try {
     await grantOwnedObjects(migrateClient, roleIdent, APP_ROLE_GRANTS, beat)
     // The test login is the role tests connect as, and it no longer owns what

package/src/test/watch.ts

@@ -74,7 +74,8 @@ async function sampleLine(target: TestWatchTarget): Promise<string> {
 }
 
 async function backends(adminUrl: string, databases: string[]): Promise<string[]> {
-  const client = postgres(adminUrl, { max: 1, onnotice: () => {}, connect_timeout: 5 })
+  // A probe ended with a destroy timeout must not have an un-awaited type fetch in flight.
+  const client = postgres(adminUrl, { max: 1, onnotice: () => {}, connect_timeout: 5, fetch_types: false })
   try {
     const rows = await Promise.race([
       client<BackendRow[]>`
@@ -82,7 +83,7 @@ async function backends(adminUrl: string, databases: string[]): Promise<string[]
                round(extract(epoch FROM (now() - state_change))::numeric, 1)::text AS state_s,
                pg_blocking_pids(pid)::text AS blocked_by, query
           FROM pg_stat_activity
-         WHERE datname = ANY(${databases}) AND pid <> pg_backend_pid()
+         WHERE datname IN (SELECT jsonb_array_elements_text(${client.json(databases)})) AND pid <> pg_backend_pid()
          ORDER BY datname, pid`,
       new Promise<never>((_, reject) => {
         setTimeout(() => reject(new Error('pg_stat_activity query timed out')), WATCH_QUERY_TIMEOUT_MS).unref()