284313f908
Some checks are pending
Bidi Control Character Guard / bidi-control-guard (push) Waiting to run
Circular Dependency Check / Check for new circular dependencies (push) Waiting to run
Citus Migration Smoke / Combined migrations on single-node Citus (push) Waiting to run
E2E Fresh Install Tests / fresh-install-e2e (push) Waiting to run
ext-v2 guardrails / Run ext-v2 guard and ESLint (push) Waiting to run
Integration Tests / Check for relevant changes (push) Waiting to run
Integration Tests / ${{ (github.event_name == 'schedule' || github.event.inputs.suite == 'full') && 'Full integration suite' || 'Tier-1 integration subset' }} (push) Blocked by required conditions
Mobile checks / Mobile lint + typecheck (push) Waiting to run
Mobile checks / Mobile unit tests (push) Waiting to run
Mobile checks / Mobile dependency audit (report) (push) Waiting to run
Mobile checks / Mobile reproducibility checks (push) Waiting to run
Secrets guard (env backups) / Ensure no tracked env backup files (push) Waiting to run
Temporal Readiness / fast-readiness (push) Waiting to run
Temporal Readiness / docker-parity (push) Waiting to run
TypeScript Type Check / Nx affected typecheck (push) Waiting to run
Unit Tests / Skipped-test budget (push) Waiting to run
Unit Tests / Nx affected unit tests (push) Waiting to run
Unit Tests / Server unit coverage (informational) (push) Waiting to run
Validate Tenant Management Schema / Check for relevant changes (push) Waiting to run
Validate Tenant Management Schema / Validate Tenant Management Schema (push) Blocked by required conditions
EE Workflows Build Guard / ee-workflows-build-guard (push) Waiting to run
Excluded: .git, node_modules, secrets/, compose.env, assemblyscript tgz Source: /opt/alga-psa on psa.joliet.tech
33 lines
1.2 KiB
JavaScript
33 lines
1.2 KiB
JavaScript
/**
|
|
* MCP agent action audit (Phase 2 F032/F033): one row per agent tool invocation,
|
|
* attributable + exportable. Tenant-RLS'd.
|
|
*
|
|
* @param { import("knex").Knex } knex
|
|
* @returns { Promise<void> }
|
|
*/
|
|
exports.up = async function up(knex) {
|
|
if (await knex.schema.hasTable('mcp_agent_audit')) return;
|
|
await knex.schema.createTable('mcp_agent_audit', (t) => {
|
|
t.uuid('id').primary().defaultTo(knex.raw('gen_random_uuid()'));
|
|
t.string('tenant').notNullable();
|
|
t.uuid('agent_id').notNullable();
|
|
t.string('tool').notNullable();
|
|
t.jsonb('arguments').nullable();
|
|
t.boolean('ok').notNullable().defaultTo(true);
|
|
t.integer('status_code').nullable();
|
|
t.string('decision').nullable(); // 'allow' | 'deny' | 'error'
|
|
t.text('result_summary').nullable();
|
|
t.timestamp('created_at', { useTz: true }).notNullable().defaultTo(knex.fn.now());
|
|
t.index(['tenant', 'agent_id', 'created_at']);
|
|
});
|
|
// Tenant isolation is enforced in application code (WHERE tenant = ...), not RLS.
|
|
};
|
|
|
|
/**
|
|
* @param { import("knex").Knex } knex
|
|
* @returns { Promise<void> }
|
|
*/
|
|
exports.down = async function down(knex) {
|
|
await knex.schema.dropTableIfExists('mcp_agent_audit');
|
|
};
|