mirror of
https://gh-proxy.org/https://github.com/klinsmaya/multica.git
synced 2026-11-09 01:46:46 +08:00
Bohan JiangandRAVN
fa797d0063
Collapses the project-context resolution that had been copied across the issue, chat and quick-create claim paths (and would have been copied a fourth time) into one workspace-scoped, fail-closed resolver, and hydrates run_only autopilot project context on top of it. - Project and resource reads are both workspace-scoped, so a dangling or cross-tenant project reference can no longer lift another workspace's repository URL, local directory path, title or description into a claim. - A failed read is no longer treated as "there is no project". Transient failures reject the claim and preserve the task for the stale-dispatched reclaim rather than silently falling back to workspace repos. - Source rows (issue, chat session, autopilot run, autopilot) fail closed the same way. Previously a read error skipped the branch entirely and, because taskToResponse seeds the runtime workspace, sailed through the backstop isolation check — dispatching an agent with no issue context or, for chat, no input at all, bypassing the empty-input guard. - Workspace isolation is resolved authoritatively per branch and checked before any context is hydrated. For run_only autopilots that check had been a tautology, comparing the runtime workspace against itself. - run_only autopilots now receive their configured project's repositories and local_directory, the same contract issue-bound and quick-create tasks already had. Absorbs #7396. Its inline implementation is replaced by the shared resolver; the author's regression test is carried over unchanged. Co-authored-by: RAVN <[email protected]>
53 lines
1.6 KiB
SQL
53 lines
1.6 KiB
SQL
-- name: ListProjectResources :many
|
|
SELECT * FROM project_resource
|
|
WHERE project_id = $1
|
|
ORDER BY position ASC, created_at ASC;
|
|
|
|
-- name: ListProjectResourcesInWorkspace :many
|
|
-- Workspace-scoped read for the daemon claim path. project_resource carries its
|
|
-- own workspace_id, so a corrupt project reference cannot pull another tenant's
|
|
-- repository URLs or local paths into a claim response.
|
|
SELECT * FROM project_resource
|
|
WHERE project_id = $1 AND workspace_id = $2
|
|
ORDER BY position ASC, created_at ASC;
|
|
|
|
-- name: ListProjectResourcesForProjects :many
|
|
SELECT * FROM project_resource
|
|
WHERE project_id = ANY(sqlc.arg('project_ids')::uuid[])
|
|
ORDER BY project_id, position ASC, created_at ASC;
|
|
|
|
-- name: GetProjectResource :one
|
|
SELECT * FROM project_resource
|
|
WHERE id = $1;
|
|
|
|
-- name: GetProjectResourceInWorkspace :one
|
|
SELECT * FROM project_resource
|
|
WHERE id = $1 AND workspace_id = $2;
|
|
|
|
-- name: CreateProjectResource :one
|
|
INSERT INTO project_resource (
|
|
project_id, workspace_id, resource_type, resource_ref, label, position, created_by
|
|
) VALUES (
|
|
$1, $2, $3, $4, $5, $6, $7
|
|
) RETURNING *;
|
|
|
|
-- name: UpdateProjectResource :one
|
|
UPDATE project_resource
|
|
SET resource_ref = $2,
|
|
label = $3,
|
|
position = $4
|
|
WHERE id = $1
|
|
RETURNING *;
|
|
|
|
-- name: DeleteProjectResource :exec
|
|
DELETE FROM project_resource WHERE id = $1;
|
|
|
|
-- name: CountProjectResources :one
|
|
SELECT count(*) FROM project_resource WHERE project_id = $1;
|
|
|
|
-- name: GetProjectResourceCounts :many
|
|
SELECT project_id, count(*)::bigint AS resource_count
|
|
FROM project_resource
|
|
WHERE project_id = ANY(sqlc.arg('project_ids')::uuid[])
|
|
GROUP BY project_id;
|