orchestrator-core 4.6.5__tar.gz → 4.7.0__tar.gz

{orchestrator_core-4.6.5 → orchestrator_core-4.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: orchestrator-core
-Version: 4.6.5
+Version: 4.7.0
 Summary: This is the orchestrator workflow engine.
 Author-email: SURF <automation-beheer@surf.nl>
 Requires-Python: >=3.11,<3.15
@@ -37,14 +37,14 @@ Requires-Dist: apscheduler>=3.11.0
 Requires-Dist: click==8.*
 Requires-Dist: deepmerge==2.0
 Requires-Dist: deprecated>=1.2.18
-Requires-Dist: fastapi~=0.121.1
+Requires-Dist: fastapi~=0.124.0
 Requires-Dist: fastapi-etag==0.4.0
 Requires-Dist: itsdangerous>=2.2.0
 Requires-Dist: jinja2==3.1.6
 Requires-Dist: more-itertools~=10.8.0
 Requires-Dist: nwa-stdlib~=1.11.0
 Requires-Dist: oauth2-lib>=2.5.0
-Requires-Dist: orjson==3.11.4
+Requires-Dist: orjson==3.11.5
 Requires-Dist: pgvector>=0.4.1
 Requires-Dist: prometheus-client==0.23.1
 Requires-Dist: psycopg2-binary==2.9.11
@@ -52,23 +52,23 @@ Requires-Dist: pydantic-forms>=1.4.0
 Requires-Dist: pydantic-settings~=2.12.0
 Requires-Dist: pydantic[email]~=2.12.4
 Requires-Dist: python-dateutil==2.9.0.post0
-Requires-Dist: python-rapidjson>=1.22,<1.23
+Requires-Dist: python-rapidjson>=1.23,<1.24
 Requires-Dist: pytz==2025.2
-Requires-Dist: redis==5.3.1
+Requires-Dist: redis==7.1.0
 Requires-Dist: semver==3.0.4
 Requires-Dist: sentry-sdk[fastapi]>=2.29.1
-Requires-Dist: sqlalchemy==2.0.44
-Requires-Dist: sqlalchemy-utils==0.42.0
+Requires-Dist: sqlalchemy==2.0.45
+Requires-Dist: sqlalchemy-utils==0.42.1
 Requires-Dist: strawberry-graphql>=0.281.0,<0.285.0
 Requires-Dist: structlog>=25.4.0
 Requires-Dist: tabulate==0.9.0
 Requires-Dist: typer==0.20.0
 Requires-Dist: uvicorn[standard]~=0.38.0
-Requires-Dist: pydantic-ai-slim >=1.9.0 ; extra == "agent"
-Requires-Dist: ag-ui-protocol>=0.1.8 ; extra == "agent"
+Requires-Dist: pydantic-ai-slim >=1.27.0 ; extra == "agent"
+Requires-Dist: ag-ui-protocol>=0.1.10 ; extra == "agent"
 Requires-Dist: litellm>=1.75.7 ; extra == "agent"
-Requires-Dist: celery~=5.5.1 ; extra == "celery"
-Requires-Dist: litellm>=1.75.7 ; extra == "search"
+Requires-Dist: celery~=5.6.0 ; extra == "celery"
+Requires-Dist: litellm>=1.80.0 ; extra == "search"
 Project-URL: Documentation, https://workfloworchestrator.org/orchestrator-core
 Project-URL: Homepage, https://workfloworchestrator.org/orchestrator-core
 Project-URL: Source, https://github.com/workfloworchestrator/orchestrator-core

{orchestrator_core-4.6.5 → orchestrator_core-4.7.0}/orchestrator/__init__.py

@@ -13,7 +13,7 @@
 
 """This is the orchestrator workflow engine."""
 
-__version__ = "4.6.5"
+__version__ = "4.7.0"
 
 
 from structlog import get_logger

{orchestrator_core-4.6.5 → orchestrator_core-4.7.0}/orchestrator/api/api_v1/api.py

@@ -22,6 +22,7 @@ from orchestrator.api.api_v1.endpoints import (
     product_blocks,
     products,
     resource_types,
+    schedules,
     settings,
     subscription_customer_descriptions,
     subscriptions,
@@ -88,6 +89,9 @@ api_router.include_router(
 api_router.include_router(
     ws.router, prefix="/ws", tags=["Core", "Events"]
 )  # Auth on the websocket is handled in the Websocket Manager
+api_router.include_router(
+    schedules.router, prefix="/schedules", tags=["Core", "Schedules"], dependencies=[Depends(authorize)]
+)
 
 if llm_settings.SEARCH_ENABLED:
     from orchestrator.api.api_v1.endpoints import search

{orchestrator_core-4.6.5 → orchestrator_core-4.7.0}/orchestrator/api/api_v1/endpoints/processes.py

@@ -13,6 +13,7 @@
 
 """Module that implements process related API endpoints."""
 
+import asyncio
 import struct
 import zlib
 from http import HTTPStatus
@@ -62,10 +63,12 @@ from orchestrator.utils.enrich_process import enrich_process
 from orchestrator.websocket import (
     WS_CHANNELS,
     broadcast_invalidate_status_counts,
+    broadcast_invalidate_status_counts_async,
     broadcast_process_update_to_websocket,
     websocket_manager,
 )
 from orchestrator.workflow import ProcessStat, ProcessStatus, StepList, Workflow
+from orchestrator.workflows import get_workflow
 from pydantic_forms.types import JSON, State
 
 router = APIRouter()
@@ -175,7 +178,7 @@ def delete(process_id: UUID) -> None:
     status_code=HTTPStatus.CREATED,
     dependencies=[Depends(check_global_lock, use_cache=False)],
 )
-def new_process(
+async def new_process(
     workflow_key: str,
     request: Request,
     json_data: list[dict[str, Any]] | None = Body(...),
@@ -183,8 +186,21 @@ def new_process(
     user_model: OIDCUserModel | None = Depends(authenticate),
 ) -> dict[str, UUID]:
     broadcast_func = api_broadcast_process_data(request)
-    process_id = start_process(
-        workflow_key, user_inputs=json_data, user_model=user_model, user=user, broadcast_func=broadcast_func
+
+    workflow = get_workflow(workflow_key)
+    if not workflow:
+        raise_status(HTTPStatus.NOT_FOUND, "Workflow does not exist")
+
+    if not await workflow.authorize_callback(user_model):
+        raise_status(HTTPStatus.FORBIDDEN, f"User is not authorized to execute '{workflow_key}' workflow")
+
+    process_id = await asyncio.to_thread(
+        start_process,
+        workflow_key,
+        user_inputs=json_data,
+        user_model=user_model,
+        user=user,
+        broadcast_func=broadcast_func,
     )
 
     return {"id": process_id}
@@ -196,14 +212,14 @@ def new_process(
     status_code=HTTPStatus.NO_CONTENT,
     dependencies=[Depends(check_global_lock, use_cache=False)],
 )
-def resume_process_endpoint(
+async def resume_process_endpoint(
     process_id: UUID,
     request: Request,
     json_data: JSON = Body(...),
     user: str = Depends(user_name),
     user_model: OIDCUserModel | None = Depends(authenticate),
 ) -> None:
-    process = _get_process(process_id)
+    process = await asyncio.to_thread(_get_process, process_id)
 
     if not can_be_resumed(process.last_status):
         raise_status(HTTPStatus.CONFLICT, f"Resuming a {process.last_status.lower()} workflow is not possible")
@@ -211,16 +227,16 @@ def resume_process_endpoint(
     pstat = load_process(process)
     auth_resume, auth_retry = get_auth_callbacks(get_steps_to_evaluate_for_rbac(pstat), pstat.workflow)
     if process.last_status == ProcessStatus.SUSPENDED:
-        if auth_resume is not None and not auth_resume(user_model):
+        if auth_resume is not None and not (await auth_resume(user_model)):
             raise_status(HTTPStatus.FORBIDDEN, "User is not authorized to resume step")
     elif process.last_status in (ProcessStatus.FAILED, ProcessStatus.WAITING):
-        if auth_retry is not None and not auth_retry(user_model):
+        if auth_retry is not None and not (await auth_retry(user_model)):
             raise_status(HTTPStatus.FORBIDDEN, "User is not authorized to retry step")
 
-    broadcast_invalidate_status_counts()
+    await broadcast_invalidate_status_counts_async()
     broadcast_func = api_broadcast_process_data(request)
 
-    resume_process(process, user=user, user_inputs=json_data, broadcast_func=broadcast_func)
+    await asyncio.to_thread(resume_process, process, user=user, user_inputs=json_data, broadcast_func=broadcast_func)
 
 
 @router.post(

orchestrator_core-4.7.0/orchestrator/api/api_v1/endpoints/schedules.py

@@ -0,0 +1,44 @@
+# Copyright 2019-2025 SURF.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+from http import HTTPStatus
+
+import structlog
+from fastapi.routing import APIRouter
+
+from orchestrator.schedules.service import add_scheduled_task_to_queue
+from orchestrator.schemas.schedules import APSchedulerJobCreate, APSchedulerJobDelete, APSchedulerJobUpdate
+
+logger = structlog.get_logger(__name__)
+
+router: APIRouter = APIRouter()
+
+
+@router.post("/", status_code=HTTPStatus.CREATED)
+def create_scheduled_task(payload: APSchedulerJobCreate) -> dict[str, str]:
+    """Create a scheduled task."""
+    add_scheduled_task_to_queue(payload)
+    return {"message": "Added to Create Queue", "status": "CREATED"}
+
+
+@router.put("/", status_code=HTTPStatus.OK)
+async def update_scheduled_task(payload: APSchedulerJobUpdate) -> dict[str, str]:
+    """Update a scheduled task."""
+    add_scheduled_task_to_queue(payload)
+    return {"message": "Added to Update Queue", "status": "UPDATED"}
+
+
+@router.delete("/", status_code=HTTPStatus.OK)
+async def delete_scheduled_task(payload: APSchedulerJobDelete) -> dict[str, str]:
+    """Delete a scheduled task."""
+    add_scheduled_task_to_queue(payload)
+    return {"message": "Added to Delete Queue", "status": "DELETED"}

{orchestrator_core-4.6.5 → orchestrator_core-4.7.0}/orchestrator/app.py

@@ -57,7 +57,8 @@ from orchestrator.graphql.types import ScalarOverrideType, StrawberryModelType
 from orchestrator.log_config import LOGGER_OVERRIDES
 from orchestrator.metrics import ORCHESTRATOR_METRICS_REGISTRY, initialize_default_metrics
 from orchestrator.services.process_broadcast_thread import ProcessDataBroadcastThread
-from orchestrator.settings import AppSettings, ExecutorType, app_settings
+from orchestrator.settings import AppSettings, ExecutorType, app_settings, get_authorizers
+from orchestrator.utils.auth import Authorizer
 from orchestrator.version import GIT_COMMIT_HASH
 from orchestrator.websocket import init_websocket_manager
 from pydantic_forms.exception_handlers.fastapi import form_error_handler
@@ -311,6 +312,38 @@ class OrchestratorCore(FastAPI):
         """
         self.auth_manager.graphql_authorization = graphql_authorization_instance
 
+    def register_internal_authorize_callback(self, callback: Authorizer) -> None:
+        """Registers the authorize_callback for WFO's internal workflows and tasks.
+
+        Since RBAC policies are applied to workflows via decorator, this enables registration of callbacks
+        for workflows defined in orchestrator-core itself.
+        However, this assignment MUST be made before any workflows are run.
+
+        Args:
+            callback (Authorizer): The async Authorizer to run for the `authorize_callback` argument of internal workflows.
+
+        Returns:
+            None
+        """
+        authorizers = get_authorizers()
+        authorizers.internal_authorize_callback = callback
+
+    def register_internal_retry_auth_callback(self, callback: Authorizer) -> None:
+        """Registers the retry_auth_callback for WFO's internal workflows and tasks.
+
+        Since RBAC policies are applied to workflows via decorator, this enables registration of callbacks
+        for workflows defined in orchestrator-core itself.
+        However, this assignment MUST be made before any workflows are run.
+
+        Args:
+            callback (Authorizer): The async Authorizer to run for the `retry_auth_callback` argument of internal workflows.
+
+        Returns:
+            None
+        """
+        authorizers = get_authorizers()
+        authorizers.internal_retry_auth_callback = callback
+
 
 main_typer_app = typer.Typer()
 main_typer_app.add_typer(cli_app, name="orchestrator", help="The orchestrator CLI commands")

orchestrator_core-4.7.0/orchestrator/cli/scheduler.py

@@ -0,0 +1,176 @@
+# Copyright 2019-2020 SURF.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+import time
+from typing import cast
+
+import typer
+from redis import Redis
+
+from orchestrator.schedules.scheduler import (
+    get_all_scheduler_tasks,
+    get_scheduler,
+    get_scheduler_task,
+)
+from orchestrator.schedules.service import (
+    SCHEDULER_QUEUE,
+    add_scheduled_task_to_queue,
+    workflow_scheduler_queue,
+)
+from orchestrator.schemas.schedules import APSchedulerJobCreate
+from orchestrator.services.workflows import get_workflow_by_name
+from orchestrator.settings import app_settings
+from orchestrator.utils.redis_client import create_redis_client
+
+app: typer.Typer = typer.Typer()
+
+
+@app.command()
+def run() -> None:
+    """Starts the scheduler in the foreground.
+
+    While running, this process will:
+
+      * Periodically wake up when the next schedule is due for execution, and run it
+      * Process schedule changes made through the schedule API
+    """
+
+    def _get_scheduled_task_item_from_queue(redis_conn: Redis) -> tuple[str, bytes] | None:
+        """Get an item from the Redis Queue for scheduler tasks."""
+        try:
+            return redis_conn.brpop(SCHEDULER_QUEUE, timeout=1)
+        except ConnectionError as e:
+            typer.echo(f"There was a connection error with Redis. Retrying in 3 seconds... {e}")
+            time.sleep(3)
+        except Exception as e:
+            typer.echo(f"There was an unexpected error with Redis. Retrying in 1 second... {e}")
+            time.sleep(1)
+
+        return None
+
+    with get_scheduler() as scheduler_connection:
+        redis_connection = create_redis_client(app_settings.CACHE_URI)
+        while True:
+            item = _get_scheduled_task_item_from_queue(redis_connection)
+            if not item:
+                continue
+
+            workflow_scheduler_queue(item, scheduler_connection)
+
+
+@app.command()
+def show_schedule() -> None:
+    """The `show-schedule` command shows an overview of the scheduled jobs."""
+    from rich.console import Console
+    from rich.table import Table
+
+    from orchestrator.schedules.service import get_linker_entries_by_schedule_ids
+
+    console = Console()
+
+    table = Table(title="Scheduled Tasks")
+    table.add_column("id", no_wrap=True)
+    table.add_column("name")
+    table.add_column("source")
+    table.add_column("next run time")
+    table.add_column("trigger")
+
+    scheduled_tasks = get_all_scheduler_tasks()
+    _schedule_ids = [task.id for task in scheduled_tasks]
+    api_managed = {str(i.schedule_id) for i in get_linker_entries_by_schedule_ids(_schedule_ids)}
+
+    for task in scheduled_tasks:
+        source = "API" if task.id in api_managed else "decorator"
+        run_time = str(task.next_run_time.replace(microsecond=0))
+        table.add_row(task.id, task.name, source, str(run_time), str(task.trigger))
+
+    console.print(table)
+
+
+@app.command()
+def force(task_id: str) -> None:
+    """Force the execution of (a) scheduler(s) based on a schedule ID.
+
+    Use the `show-schedule` command to determine the ID of the schedule to execute.
+
+    CLI Arguments:
+        ```sh
+        Arguments:
+            SCHEDULE_ID  ID of the schedule to execute
+        ```
+    """
+    task = get_scheduler_task(task_id)
+
+    if not task:
+        typer.echo(f"Task '{task_id}' not found.")
+        raise typer.Exit(code=1)
+
+    typer.echo(f"Running Task [{task.id}] now...")
+    try:
+        task.func(*task.args or (), **task.kwargs or {})
+        typer.echo("Task executed successfully.")
+    except Exception as e:
+        typer.echo(f"Task execution failed: {e}")
+        raise typer.Exit(code=1)
+
+
+@app.command()
+def load_initial_schedule() -> None:
+    """The `load-initial-schedule` command loads the initial schedule using the scheduler API.
+
+    The initial schedules are:
+      - Task Resume Workflows
+      - Task Clean Up Tasks
+      - Task Validate Subscriptions
+
+    !!! Warning
+        This command is not idempotent.
+
+        Please run `show-schedule` first to determine if the schedules already exist.
+    """
+    initial_schedules = [
+        {
+            "name": "Task Resume Workflows",
+            "workflow_name": "task_resume_workflows",
+            "workflow_id": "",
+            "trigger": "interval",
+            "trigger_kwargs": {"hours": 1},
+        },
+        {
+            "name": "Task Clean Up Tasks",
+            "workflow_name": "task_clean_up_tasks",
+            "workflow_id": "",
+            "trigger": "interval",
+            "trigger_kwargs": {"hours": 6},
+        },
+        {
+            "name": "Task Validate Subscriptions",
+            "workflow_name": "task_validate_subscriptions",
+            "workflow_id": "",
+            "trigger": "cron",
+            "trigger_kwargs": {"hour": 0, "minute": 10},
+        },
+    ]
+
+    for schedule in initial_schedules:
+        # enrich with workflow id
+        workflow_name = cast(str, schedule.get("workflow_name"))
+        workflow = get_workflow_by_name(workflow_name)
+
+        if not workflow:
+            typer.echo(f"Workflow '{schedule['workflow_name']}' not found. Skipping schedule.")
+            continue
+
+        schedule["workflow_id"] = workflow.workflow_id
+
+        typer.echo(f"Initial Schedule: {schedule}")
+        add_scheduled_task_to_queue(APSchedulerJobCreate(**schedule))  # type: ignore

{orchestrator_core-4.6.5 → orchestrator_core-4.7.0}/orchestrator/cli/search/resize_embedding.py

@@ -75,6 +75,9 @@ def alter_embedding_column_dimension(new_dimension: int) -> None:
         db.session.execute(text(f"ALTER TABLE search_queries ADD COLUMN query_embedding vector({new_dimension})"))
 
         db.session.commit()
+
+        db.session.close()
+
         logger.info(f"Altered embedding columns to dimension {new_dimension} in ai_search_index and search_queries")
 
     except SQLAlchemyError as e:

{orchestrator_core-4.6.5 → orchestrator_core-4.7.0}/orchestrator/db/models.py

@@ -29,9 +29,11 @@ from sqlalchemy import (
     CheckConstraint,
     Column,
     Enum,
+    Float,
     ForeignKey,
     Index,
     Integer,
+    LargeBinary,
     PrimaryKeyConstraint,
     Select,
     String,
@@ -796,3 +798,27 @@ class AiSearchIndex(BaseModel):
     content_hash = mapped_column(String(64), nullable=False, index=True)
 
     __table_args__ = (PrimaryKeyConstraint("entity_id", "path", name="pk_ai_search_index"),)
+
+
+class APSchedulerJobStoreModel(BaseModel):
+    __tablename__ = "apscheduler_jobs"
+
+    id = mapped_column(String(191), primary_key=True)
+    next_run_time = mapped_column(Float, nullable=True)
+    job_state = mapped_column(LargeBinary, nullable=False)
+
+
+class WorkflowApschedulerJob(BaseModel):
+    __tablename__ = "workflows_apscheduler_jobs"
+
+    workflow_id = mapped_column(
+        UUIDType, ForeignKey("workflows.workflow_id", ondelete="CASCADE"), primary_key=True, nullable=False
+    )
+
+    # Notice the VARCHAR(512) for schedule_id to accommodate longer IDs so
+    # that if APScheduler changes its ID format in the future, we are covered.
+    schedule_id = mapped_column(
+        String(512), ForeignKey("apscheduler_jobs.id", ondelete="CASCADE"), primary_key=True, nullable=False
+    )
+
+    __table_args__ = (UniqueConstraint("workflow_id", "schedule_id", name="uq_workflow_schedule"),)

{orchestrator_core-4.6.5 → orchestrator_core-4.7.0}/orchestrator/graphql/schemas/process.py

@@ -89,8 +89,8 @@ class ProcessType:
         auth_resume, auth_retry = get_auth_callbacks(get_steps_to_evaluate_for_rbac(process), workflow)
 
         return FormUserPermissionsType(
-            retryAllowed=bool(auth_retry and auth_retry(oidc_user)),
-            resumeAllowed=bool(auth_resume and auth_resume(oidc_user)),
+            retryAllowed=bool(auth_retry and await auth_retry(oidc_user)),
+            resumeAllowed=bool(auth_resume and await auth_resume(oidc_user)),
         )
 
     @authenticated_field(description="Returns list of subscriptions of the process")  # type: ignore

{orchestrator_core-4.6.5 → orchestrator_core-4.7.0}/orchestrator/graphql/schemas/workflow.py

@@ -38,4 +38,4 @@ class Workflow:
         workflow_table = get_original_model(self, WorkflowTable)
         workflow = get_workflow(workflow_table.name)
 
-        return workflow.authorize_callback(oidc_user)  # type: ignore
+        return await workflow.authorize_callback(oidc_user)  # type: ignore

{orchestrator_core-4.6.5 → orchestrator_core-4.7.0}/orchestrator/llm_settings.py

@@ -34,7 +34,6 @@ EMBEDDING_DIMENSION_FIELD = Annotated[
 
 
 class LLMSettings(BaseSettings):
-
     # Feature flags for LLM functionality
     SEARCH_ENABLED: bool = False  # Enable search/indexing with embeddings
     AGENT_ENABLED: bool = False  # Enable agentic functionality

{orchestrator_core-4.6.5 → orchestrator_core-4.7.0}/orchestrator/migrations/versions/schema/2020-10-19_a76b9185b334_add_generic_workflows_to_core.py

@@ -17,6 +17,7 @@ down_revision = "c112305b07d3"
 branch_labels = None
 depends_on = None
 
+# NOTE: this migration forgot to insert these workflows with is_task=true. Make sure to correct that if you copy this.
 workflows = [
     {"name": "modify_note", "description": "Modify Note", "workflow_id": uuid4(), "target": "MODIFY"},
     {"name": "task_clean_up_tasks", "description": "Clean up old tasks", "workflow_id": uuid4(), "target": "SYSTEM"},

{orchestrator_core-4.6.5 → orchestrator_core-4.7.0}/orchestrator/migrations/versions/schema/2021-04-06_3c8b9185c221_add_validate_products_task.py

@@ -17,6 +17,7 @@ down_revision = "3323bcb934e7"
 branch_labels = None
 depends_on = None
 
+# NOTE: this migration forgot to insert these workflows with is_task=true. Make sure to correct that if you copy this.
 workflows = [
     {"name": "task_validate_products", "description": "Validate products", "workflow_id": uuid4(), "target": "SYSTEM"},
 ]

orchestrator_core-4.7.0/orchestrator/migrations/versions/schema/2025-11-18_961eddbd4c13_create_linker_table_workflow_apscheduler.py

@@ -0,0 +1,106 @@
+"""Create linker table workflow_apscheduler.
+
+Revision ID: 961eddbd4c13
+Revises: 850dccac3b02
+Create Date: 2025-11-18 10:38:57.211087
+
+"""
+
+from uuid import uuid4
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "961eddbd4c13"
+down_revision = "850dccac3b02"
+branch_labels = None
+depends_on = None
+
+# NOTE: this migration forgot to insert these workflows with is_task=true. Make sure to correct that if you copy this.
+workflows = [
+    {
+        "name": "task_validate_subscriptions",
+        "description": "Validate subscriptions",
+        "workflow_id": uuid4(),
+        "target": "SYSTEM",
+    },
+]
+
+
+def _create_workflows() -> None:
+    conn = op.get_bind()
+    for workflow in workflows:
+        conn.execute(
+            sa.text(
+                "INSERT INTO workflows VALUES (:workflow_id, :name, :target, :description, now()) ON CONFLICT DO NOTHING"
+            ),
+            workflow,
+        )
+
+
+def _downgrade_create_workflows() -> None:
+    conn = op.get_bind()
+    for workflow in workflows:
+        conn.execute(sa.text("DELETE FROM workflows WHERE name = :name"), {"name": workflow["name"]})
+
+
+def _create_apscheduler_jobs_table_if_not_exists() -> None:
+    # Check if the apscheduler_jobs table exists and create it if it does not exist.
+    conn = op.get_bind()
+    inspector = sa.inspect(conn)
+    if "apscheduler_jobs" not in inspector.get_table_names():
+        op.execute(
+            sa.text(
+                """
+                CREATE TABLE apscheduler_jobs
+                (
+                    id            VARCHAR(191) NOT NULL PRIMARY KEY,
+                    next_run_time DOUBLE PRECISION,
+                    job_state     bytea NOT NULL
+                );
+                """
+            )
+        )
+
+
+def _create_workflows_table_if_not_exists() -> None:
+    # Notice the VARCHAR(512) for schedule_id to accommodate longer IDs
+    # This so that if APScheduler changes its ID format in the future, we are covered.
+    op.execute(
+        sa.text(
+            """
+                CREATE TABLE workflows_apscheduler_jobs (
+                    workflow_id UUID NOT NULL,
+                    schedule_id VARCHAR(512) NOT NULL,
+                    PRIMARY KEY (workflow_id, schedule_id),
+                    CONSTRAINT fk_workflow
+                        FOREIGN KEY (workflow_id) REFERENCES public.workflows (workflow_id)
+                            ON DELETE CASCADE,
+                    CONSTRAINT fk_schedule
+                        FOREIGN KEY (schedule_id) REFERENCES public.apscheduler_jobs (id)
+                            ON DELETE CASCADE,
+                    CONSTRAINT uq_workflow_schedule UNIQUE (workflow_id, schedule_id)
+                );
+            """
+        )
+    )
+
+    op.create_index("ix_workflows_apscheduler_jobs_schedule_id", "workflows_apscheduler_jobs", ["schedule_id"])
+
+
+def upgrade() -> None:
+    _create_apscheduler_jobs_table_if_not_exists()
+    _create_workflows_table_if_not_exists()
+    _create_workflows()
+
+
+def downgrade() -> None:
+    op.execute(
+        sa.text(
+            """
+            DROP TABLE IF EXISTS workflows_apscheduler_jobs;
+            """
+        )
+    )
+    _downgrade_create_workflows()