spaps 0.7.2 → 0.7.4

package/assets/local-runtime/alembic/versions/000000000002_fix_column_types_to_match_prod.py

@@ -0,0 +1,83 @@
+"""fix column types to match production
+
+Revision ID: 000000000002
+Revises: 000000000001
+Create Date: 2026-02-09
+
+Fix column types that diverged from the production Supabase schema:
+- dayrate_config.slots: JSONB → TEXT[] (was always a text array in prod)
+- endpoint_documentation.authentication: JSONB → TEXT (was always plain text in prod)
+- endpoint_documentation.error_codes: JSONB → JSONB[] (was always a jsonb array in prod)
+
+Idempotent: skips columns that already have the correct type (e.g. fresh installs
+where the baseline was fixed).
+"""
+
+from alembic import op
+
+revision = "000000000002"
+down_revision = "000000000001"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Each block checks current type and only alters if wrong.
+    # On fresh installs the baseline already has the correct types.
+
+    op.execute("""
+        DO $$ BEGIN
+            IF (SELECT udt_name FROM information_schema.columns
+                WHERE table_schema = 'public'
+                  AND table_name = 'dayrate_config'
+                  AND column_name = 'slots') = 'jsonb' THEN
+                ALTER TABLE dayrate_config
+                    ALTER COLUMN slots TYPE TEXT[] USING '{}';
+            END IF;
+        END $$
+    """)
+
+    op.execute("""
+        DO $$ BEGIN
+            IF (SELECT udt_name FROM information_schema.columns
+                WHERE table_schema = 'public'
+                  AND table_name = 'endpoint_documentation'
+                  AND column_name = 'authentication') = 'jsonb' THEN
+                ALTER TABLE endpoint_documentation
+                    ALTER COLUMN authentication TYPE TEXT
+                    USING authentication::TEXT;
+            END IF;
+        END $$
+    """)
+
+    op.execute("""
+        DO $$ BEGIN
+            IF (SELECT udt_name FROM information_schema.columns
+                WHERE table_schema = 'public'
+                  AND table_name = 'endpoint_documentation'
+                  AND column_name = 'error_codes') = 'jsonb' THEN
+                ALTER TABLE endpoint_documentation
+                    ALTER COLUMN error_codes TYPE JSONB[]
+                    USING ARRAY[]::JSONB[];
+            END IF;
+        END $$
+    """)
+
+
+def downgrade() -> None:
+    op.execute("""
+        ALTER TABLE dayrate_config
+        ALTER COLUMN slots TYPE JSONB USING to_jsonb(slots)
+    """)
+
+    op.execute("""
+        ALTER TABLE endpoint_documentation
+        ALTER COLUMN authentication TYPE JSONB
+        USING to_jsonb(authentication)
+    """)
+
+    op.execute("""
+        ALTER TABLE endpoint_documentation
+        ALTER COLUMN error_codes TYPE JSONB
+        USING to_jsonb(error_codes)
+    """)

package/assets/local-runtime/alembic/versions/000000000003_fix_email_template_key_uniqueness.py

@@ -0,0 +1,49 @@
+"""fix email template_key uniqueness to composite (application_id, template_key)
+
+Revision ID: 000000000003
+Revises: 000000000002
+Create Date: 2026-02-09
+
+The template_key column had a global unique constraint, preventing
+multi-tenant use (e.g. two different applications both creating
+"auth_magic_link"). This migration replaces the single-column unique
+constraint with a composite unique index on (application_id, template_key).
+"""
+
+from alembic import op
+
+revision = "000000000003"
+down_revision = "000000000002"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Drop the single-column unique constraint if it exists
+    op.execute("""
+        ALTER TABLE email_templates
+        DROP CONSTRAINT IF EXISTS email_templates_template_key_key;
+    """)
+
+    # Also drop the index-based form if present
+    op.execute("""
+        DROP INDEX IF EXISTS ix_email_templates_template_key;
+    """)
+
+    # Create composite unique index
+    op.execute("""
+        CREATE UNIQUE INDEX IF NOT EXISTS uq_email_templates_app_key
+        ON email_templates (application_id, template_key);
+    """)
+
+
+def downgrade() -> None:
+    op.execute("""
+        DROP INDEX IF EXISTS uq_email_templates_app_key;
+    """)
+
+    # Restore original single-column unique constraint
+    op.execute("""
+        ALTER TABLE email_templates
+        ADD CONSTRAINT email_templates_template_key_key UNIQUE (template_key);
+    """)

package/assets/local-runtime/alembic/versions/000000000004_add_hold_duration_minutes_to_dayrate_config.py

@@ -0,0 +1,30 @@
+"""add hold_duration_minutes to dayrate_config
+
+Revision ID: 000000000004
+Revises: 000000000003
+Create Date: 2026-02-11
+
+Adds a configurable hold duration (in minutes) for pending dayrate bookings.
+Previously hardcoded to 30 minutes. Defaults to 30 for backwards compatibility.
+"""
+
+from alembic import op
+
+revision = "000000000004"
+down_revision = "000000000003"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("""
+        ALTER TABLE dayrate_config
+        ADD COLUMN IF NOT EXISTS hold_duration_minutes INTEGER NOT NULL DEFAULT 30;
+    """)
+
+
+def downgrade() -> None:
+    op.execute("""
+        ALTER TABLE dayrate_config
+        DROP COLUMN IF EXISTS hold_duration_minutes;
+    """)

package/assets/local-runtime/alembic/versions/000000000005_resource_scoped_entitlements.py

@@ -0,0 +1,77 @@
+"""resource scoped entitlements
+
+Revision ID: 000000000005
+Revises: 000000000004
+Create Date: 2026-02-11
+
+Adds resource_type and resource_id columns to the entitlements table
+to support company, org, and system-scoped entitlements in addition
+to user-scoped ones.
+"""
+
+from alembic import op
+
+revision = "000000000005"
+down_revision = "000000000004"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Add resource_type column with default 'user'
+    op.execute("""
+        ALTER TABLE entitlements
+        ADD COLUMN IF NOT EXISTS resource_type VARCHAR NOT NULL DEFAULT 'user';
+    """)
+
+    # Add CHECK constraint for allowed resource_type values
+    op.execute("""
+        ALTER TABLE entitlements
+        ADD CONSTRAINT ck_entitlements_resource_type
+        CHECK (resource_type IN ('user', 'company', 'system', 'org'));
+    """)
+
+    # Add resource_id column (nullable UUID)
+    op.execute("""
+        ALTER TABLE entitlements
+        ADD COLUMN IF NOT EXISTS resource_id UUID;
+    """)
+
+    # Add CHECK constraint: resource_id required for company and org types
+    op.execute("""
+        ALTER TABLE entitlements
+        ADD CONSTRAINT ck_entitlements_resource_id_required
+        CHECK (
+            resource_type NOT IN ('company', 'org')
+            OR resource_id IS NOT NULL
+        );
+    """)
+
+    # Add partial index for resource lookups
+    op.execute("""
+        CREATE INDEX IF NOT EXISTS idx_entitlements_resource
+        ON entitlements (resource_type, resource_id)
+        WHERE resource_id IS NOT NULL;
+    """)
+
+    # Add partial unique index for non-user resource scoping
+    op.execute("""
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_entitlements_resource_unique
+        ON entitlements (application_id, entitlement_key, resource_type, resource_id, source)
+        WHERE resource_type != 'user';
+    """)
+
+
+def downgrade() -> None:
+    op.execute("DROP INDEX IF EXISTS idx_entitlements_resource_unique;")
+    op.execute("DROP INDEX IF EXISTS idx_entitlements_resource;")
+    op.execute("""
+        ALTER TABLE entitlements
+        DROP CONSTRAINT IF EXISTS ck_entitlements_resource_id_required;
+    """)
+    op.execute("""
+        ALTER TABLE entitlements
+        DROP CONSTRAINT IF EXISTS ck_entitlements_resource_type;
+    """)
+    op.execute("ALTER TABLE entitlements DROP COLUMN IF EXISTS resource_id;")
+    op.execute("ALTER TABLE entitlements DROP COLUMN IF EXISTS resource_type;")

package/assets/local-runtime/alembic/versions/000000000006_cfo_rbac_add_is_admin.py

@@ -0,0 +1,37 @@
+"""CFO RBAC: add is_admin to users table
+
+Revision ID: 000000000006
+Revises: 000000000005
+Create Date: 2026-02-11
+
+Adds is_admin column to users table (formerly user_profiles in the legacy
+Node.js stack, merged into users in the Python rewrite). This provides
+a fast-path admin check for CFO-specific routes without joining
+user_applications.
+"""
+
+from alembic import op
+
+revision = "000000000006"
+down_revision = "000000000005"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("""
+        ALTER TABLE users
+        ADD COLUMN IF NOT EXISTS is_admin BOOLEAN NOT NULL DEFAULT false;
+    """)
+
+    # Index for quick admin lookups
+    op.execute("""
+        CREATE INDEX IF NOT EXISTS idx_users_is_admin
+        ON users (is_admin)
+        WHERE is_admin = true;
+    """)
+
+
+def downgrade() -> None:
+    op.execute("DROP INDEX IF EXISTS idx_users_is_admin;")
+    op.execute("ALTER TABLE users DROP COLUMN IF EXISTS is_admin;")

package/assets/local-runtime/alembic/versions/000000000007_agent_approvals.py

@@ -0,0 +1,158 @@
+"""agent approvals
+
+Revision ID: 000000000007
+Revises: 000000000006
+Create Date: 2026-02-11
+
+Creates agents, agent_approvers, and agent_approvals tables for the
+agent consent gateway feature.
+"""
+
+from alembic import op
+
+revision = "000000000007"
+down_revision = "000000000006"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # -----------------------------------------------------------------------
+    # agents table
+    # -----------------------------------------------------------------------
+    op.execute("""
+        CREATE TABLE IF NOT EXISTS agents (
+            id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+            application_id UUID NOT NULL REFERENCES applications(id) ON DELETE CASCADE,
+            owner_user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+            name VARCHAR(100) NOT NULL,
+            description VARCHAR(500),
+            agent_secret_hash VARCHAR(128) NOT NULL,
+            agent_secret_prefix VARCHAR(8) NOT NULL,
+            scopes JSONB DEFAULT '[]'::jsonb,
+            metadata JSONB DEFAULT '{}'::jsonb,
+            is_active BOOLEAN NOT NULL DEFAULT true,
+            created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+            updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+        );
+    """)
+
+    # Unique name per application (active agents only)
+    op.execute("""
+        CREATE UNIQUE INDEX IF NOT EXISTS uq_agents_app_name_active
+        ON agents (application_id, name)
+        WHERE is_active = true;
+    """)
+
+    # Lookup indexes
+    op.execute("""
+        CREATE INDEX IF NOT EXISTS ix_agents_app_owner
+        ON agents (application_id, owner_user_id);
+    """)
+    op.execute("""
+        CREATE INDEX IF NOT EXISTS ix_agents_owner
+        ON agents (owner_user_id);
+    """)
+
+    # -----------------------------------------------------------------------
+    # agent_approvers table
+    # -----------------------------------------------------------------------
+    op.execute("""
+        CREATE TABLE IF NOT EXISTS agent_approvers (
+            id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+            agent_id UUID NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+            approver_user_id UUID REFERENCES users(id) ON DELETE CASCADE,
+            approver_agent_id UUID REFERENCES agents(id) ON DELETE CASCADE,
+            approver_type VARCHAR(10) NOT NULL,
+            created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+
+            CONSTRAINT ck_agent_approvers_type
+                CHECK (approver_type IN ('user', 'agent')),
+
+            CONSTRAINT ck_agent_approvers_exactly_one_fk
+                CHECK (
+                    (approver_type = 'user' AND approver_user_id IS NOT NULL AND approver_agent_id IS NULL)
+                    OR (approver_type = 'agent' AND approver_agent_id IS NOT NULL AND approver_user_id IS NULL)
+                )
+        );
+    """)
+
+    # Unique approver per agent (user)
+    op.execute("""
+        CREATE UNIQUE INDEX IF NOT EXISTS uq_agent_approvers_user
+        ON agent_approvers (agent_id, approver_user_id)
+        WHERE approver_type = 'user';
+    """)
+
+    # Unique approver per agent (agent)
+    op.execute("""
+        CREATE UNIQUE INDEX IF NOT EXISTS uq_agent_approvers_agent
+        ON agent_approvers (agent_id, approver_agent_id)
+        WHERE approver_type = 'agent';
+    """)
+
+    # Lookup indexes
+    op.execute("""
+        CREATE INDEX IF NOT EXISTS ix_agent_approvers_agent
+        ON agent_approvers (agent_id);
+    """)
+    op.execute("""
+        CREATE INDEX IF NOT EXISTS ix_agent_approvers_user
+        ON agent_approvers (approver_user_id)
+        WHERE approver_user_id IS NOT NULL;
+    """)
+    op.execute("""
+        CREATE INDEX IF NOT EXISTS ix_agent_approvers_agent_id
+        ON agent_approvers (approver_agent_id)
+        WHERE approver_agent_id IS NOT NULL;
+    """)
+
+    # -----------------------------------------------------------------------
+    # agent_approvals table
+    # -----------------------------------------------------------------------
+    op.execute("""
+        CREATE TABLE IF NOT EXISTS agent_approvals (
+            id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+            application_id UUID NOT NULL REFERENCES applications(id) ON DELETE CASCADE,
+            agent_id UUID NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+            code VARCHAR(9) NOT NULL UNIQUE,
+            action VARCHAR(200) NOT NULL,
+            resource_type VARCHAR(100),
+            resource_id VARCHAR(500),
+            reason VARCHAR(1000),
+            metadata JSONB DEFAULT '{}'::jsonb,
+            status VARCHAR(20) NOT NULL DEFAULT 'pending',
+            callback_url VARCHAR(2048),
+            note VARCHAR(500),
+            responded_by_user_id UUID REFERENCES users(id) ON DELETE SET NULL,
+            responded_by_agent_id UUID REFERENCES agents(id) ON DELETE SET NULL,
+            responder_type VARCHAR(10),
+            responded_at TIMESTAMPTZ,
+            approval_token TEXT,
+            token_expires_at TIMESTAMPTZ,
+            expires_at TIMESTAMPTZ NOT NULL,
+            created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+
+            CONSTRAINT ck_agent_approvals_status
+                CHECK (status IN ('pending', 'approved', 'denied', 'expired'))
+        );
+    """)
+
+    # Composite index for agent polling
+    op.execute("""
+        CREATE INDEX IF NOT EXISTS ix_agent_approvals_app_agent_status
+        ON agent_approvals (application_id, agent_id, status);
+    """)
+
+    # Partial index for expiration cleanup
+    op.execute("""
+        CREATE INDEX IF NOT EXISTS ix_agent_approvals_pending_expiry
+        ON agent_approvals (status, expires_at)
+        WHERE status = 'pending';
+    """)
+
+
+def downgrade() -> None:
+    op.execute("DROP TABLE IF EXISTS agent_approvals CASCADE;")
+    op.execute("DROP TABLE IF EXISTS agent_approvers CASCADE;")
+    op.execute("DROP TABLE IF EXISTS agents CASCADE;")

package/assets/local-runtime/alembic/versions/000000000008_add_company_id_to_cfo_connections.py

@@ -0,0 +1,35 @@
+"""add company_id to cfo_connections
+
+Revision ID: 000000000008
+Revises: 000000000007
+Create Date: 2026-02-12
+
+Adds a nullable company_id UUID column to the cfo_connections table.
+This is a soft reference to cfo_companies.id in the CFO database.
+No foreign key constraint — the reference is cross-database.
+"""
+
+from alembic import op
+
+revision = "000000000008"
+down_revision = "000000000007"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.execute("""
+        ALTER TABLE cfo_connections
+        ADD COLUMN IF NOT EXISTS company_id UUID NULL;
+    """)
+    op.execute("""
+        COMMENT ON COLUMN cfo_connections.company_id
+        IS 'Soft reference to cfo_companies.id in CFO DB (no FK constraint)';
+    """)
+
+
+def downgrade() -> None:
+    op.execute("""
+        ALTER TABLE cfo_connections
+        DROP COLUMN IF EXISTS company_id;
+    """)

package/assets/local-runtime/alembic/versions/000000000009_tx_signing.py

@@ -0,0 +1,62 @@
+"""Add transaction signing fields to agent_approvals
+
+Revision ID: 000000000009
+Revises: 000000000008
+Create Date: 2026-02-13
+
+Add 4 nullable columns to agent_approvals to support transaction intent
+and wallet signing (tx_signing):
+- transaction_intent: JSONB storing EVM/Solana transaction intent
+- signed_transaction: TEXT storing hex/base64 signed transaction bytes
+- signer_address: TEXT storing wallet address that signed
+- edited_intent: JSONB storing modified intent if approver edited
+
+All columns are nullable for backward compatibility.
+"""
+
+from alembic import op
+
+revision = "000000000009"
+down_revision = "000000000008"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    """Add transaction signing fields to agent_approvals."""
+    op.execute("""
+        ALTER TABLE agent_approvals
+        ADD COLUMN transaction_intent JSONB;
+    """)
+    op.execute("""
+        ALTER TABLE agent_approvals
+        ADD COLUMN signed_transaction TEXT;
+    """)
+    op.execute("""
+        ALTER TABLE agent_approvals
+        ADD COLUMN signer_address VARCHAR(500);
+    """)
+    op.execute("""
+        ALTER TABLE agent_approvals
+        ADD COLUMN edited_intent JSONB;
+    """)
+
+
+def downgrade() -> None:
+    """Remove transaction signing fields from agent_approvals."""
+    op.execute("""
+        ALTER TABLE agent_approvals
+        DROP COLUMN IF EXISTS transaction_intent;
+    """)
+    op.execute("""
+        ALTER TABLE agent_approvals
+        DROP COLUMN IF EXISTS signed_transaction;
+    """)
+    op.execute("""
+        ALTER TABLE agent_approvals
+        DROP COLUMN IF EXISTS signer_address;
+    """)
+    op.execute("""
+        ALTER TABLE agent_approvals
+        DROP COLUMN IF EXISTS edited_intent;
+    """)