Expire stale approval requests

crates/crank-community-mcp/src/app.rs

@@ -19,7 +19,8 @@ use crank_core::{
 };
 use crank_registry::{
     ApprovalRequestRecord, CreateApprovalRequest, CreateInvocationLogRequest,
-    DecideApprovalRequest, FinishApprovalRequest, PostgresRegistry, PublishedAgentTool,
+    DecideApprovalRequest, ExpireApprovalRequest, FinishApprovalRequest, PostgresRegistry,
+    PublishedAgentTool,
 };
 use crank_runtime::{
     RequestRateLimiter, ResolvedAuth, RuntimeError, RuntimeExecutionRequest, RuntimeExecutor,
@@ -242,15 +243,7 @@ async fn get_approval_request(
     };
     let approval_id = ApprovalRequestId::new(path.approval_id);
 
-    match state
-        .registry
-        .get_approval_request_for_agent(&key.api_key.workspace_id, agent_id, &approval_id)
-        .await
-    {
-        Ok(Some(record)) => Json(json!(record)).into_response(),
-        Ok(None) => StatusCode::NOT_FOUND.into_response(),
-        Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
-    }
+    approval_record_response(&state, &key.api_key.workspace_id, agent_id, &approval_id).await
 }
 
 async fn deny_request(
@@ -327,14 +320,14 @@ async fn decide_approval_request(
         }
         Ok(Some(record)) => Json(json!(record)).into_response(),
         Ok(None) => {
-            existing_decision_response(&state, &key.api_key.workspace_id, agent_id, &approval_id)
+            terminal_decision_response(&state, &key.api_key.workspace_id, agent_id, &approval_id)
                 .await
         }
         Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
     }
 }
 
-async fn existing_decision_response(
+async fn approval_record_response(
     state: &Arc<AppState>,
     workspace_id: &crank_core::WorkspaceId,
     agent_id: &crank_core::AgentId,
@@ -345,6 +338,35 @@ async fn existing_decision_response(
         .get_approval_request_for_agent(workspace_id, agent_id, approval_id)
         .await
     {
+        Ok(Some(record))
+            if record.approval.status == ApprovalRequestStatus::Pending
+                && record.approval.expires_at <= OffsetDateTime::now_utc() =>
+        {
+            expire_approval_response(state, workspace_id, agent_id, approval_id).await
+        }
+        Ok(Some(record)) => Json(json!(record)).into_response(),
+        Ok(None) => StatusCode::NOT_FOUND.into_response(),
+        Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+    }
+}
+
+async fn terminal_decision_response(
+    state: &Arc<AppState>,
+    workspace_id: &crank_core::WorkspaceId,
+    agent_id: &crank_core::AgentId,
+    approval_id: &ApprovalRequestId,
+) -> Response {
+    match state
+        .registry
+        .get_approval_request_for_agent(workspace_id, agent_id, approval_id)
+        .await
+    {
+        Ok(Some(record))
+            if record.approval.status == ApprovalRequestStatus::Pending
+                && record.approval.expires_at <= OffsetDateTime::now_utc() =>
+        {
+            expire_approval_response(state, workspace_id, agent_id, approval_id).await
+        }
         Ok(Some(record))
             if matches!(
                 record.approval.status,
@@ -362,6 +384,28 @@ async fn existing_decision_response(
     }
 }
 
+async fn expire_approval_response(
+    state: &Arc<AppState>,
+    workspace_id: &crank_core::WorkspaceId,
+    agent_id: &crank_core::AgentId,
+    approval_id: &ApprovalRequestId,
+) -> Response {
+    match state
+        .registry
+        .expire_approval_request(ExpireApprovalRequest {
+            workspace_id,
+            agent_id,
+            approval_id,
+            expired_at: OffsetDateTime::now_utc(),
+        })
+        .await
+    {
+        Ok(Some(record)) => Json(json!(record)).into_response(),
+        Ok(None) => StatusCode::CONFLICT.into_response(),
+        Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+    }
+}
+
 async fn execute_approved_request(
     state: &Arc<AppState>,
     path: &AgentRoutePath,