Expire stale approval requests

crates/crank-registry/src/lib.rs

@@ -27,10 +27,11 @@ pub mod requests {
         CreateImportJobRequest, CreateInvitationRequest, CreateInvocationLogRequest,
         CreatePlatformApiKeyRequest, CreateSecretRequest, CreateVersionRequest,
         CreateWorkspaceRequest, CreateYamlImportJobRequest, DecideApprovalRequest,
-        FinishApprovalRequest, FinishImportJobRequest, ListInvocationLogsQuery,
-        PublishAgentRequest, PublishRequest, RotateSecretRequest, SaveAgentBindingsRequest,
-        SaveAuthProfileRequest, SaveDescriptorMetadataRequest, SaveSampleMetadataRequest,
-        SaveWorkspaceUpstreamRequest, UpdateWorkspaceRequest, UsageQuery,
+        ExpireApprovalRequest, FinishApprovalRequest, FinishImportJobRequest,
+        ListInvocationLogsQuery, PublishAgentRequest, PublishRequest, RotateSecretRequest,
+        SaveAgentBindingsRequest, SaveAuthProfileRequest, SaveDescriptorMetadataRequest,
+        SaveSampleMetadataRequest, SaveWorkspaceUpstreamRequest, UpdateWorkspaceRequest,
+        UsageQuery,
     };
 }
 
@@ -45,8 +46,8 @@ pub use model::{
     CreateImportJobRequest, CreateInvitationRequest, CreateInvocationLogRequest,
     CreatePlatformApiKeyRequest, CreateSecretRequest, CreateVersionRequest, CreateWorkspaceRequest,
     CreateYamlImportJobRequest, DecideApprovalRequest, DescriptorKind, DescriptorMetadata,
-    FinishApprovalRequest, FinishImportJobRequest, ImportJob, ImportJobId, ImportJobKind,
-    ImportJobStatus, InvitationRecord, InvocationLogRecord, ListInvocationLogsQuery,
+    ExpireApprovalRequest, FinishApprovalRequest, FinishImportJobRequest, ImportJob, ImportJobId,
+    ImportJobKind, ImportJobStatus, InvitationRecord, InvocationLogRecord, ListInvocationLogsQuery,
     MembershipRecord, OperationAgentRef, OperationSampleMetadata, OperationSummary,
     OperationUsageSummary, OperationVersionRecord, Page, PlatformApiKeyRecord, PublishAgentRequest,
     PublishRequest, PublishedAgentTool, RegistryOperation, RotateSecretRequest, SampleKind,

crates/crank-registry/src/model.rs

@@ -546,6 +546,14 @@ pub struct FinishApprovalRequest<'a> {
     pub decision_note: Option<&'a str>,
 }
 
+#[derive(Clone, Debug)]
+pub struct ExpireApprovalRequest<'a> {
+    pub workspace_id: &'a WorkspaceId,
+    pub agent_id: &'a AgentId,
+    pub approval_id: &'a ApprovalRequestId,
+    pub expired_at: OffsetDateTime,
+}
+
 #[derive(Clone, Debug, PartialEq)]
 pub struct CreateSecretRequest<'a> {
     pub secret: &'a Secret,

crates/crank-registry/src/postgres/approval.rs

@@ -230,6 +230,46 @@ impl PostgresRegistry {
 
         row.map(map_approval_request_row).transpose()
     }
+
+    pub async fn expire_approval_request(
+        &self,
+        request: ExpireApprovalRequest<'_>,
+    ) -> Result<Option<ApprovalRequestRecord>, RegistryError> {
+        let row = sqlx::query(
+            "update approval_requests
+                set status = 'expired'
+              where workspace_id = $1
+                and agent_id = $2
+                and id = $3
+                and status = 'pending'
+                and expires_at <= $4::timestamptz
+              returning
+                id,
+                workspace_id,
+                agent_id,
+                operation_id,
+                operation_version,
+                status,
+                risk_level,
+                confirmation_title,
+                confirmation_body,
+                request_payload_json,
+                response_payload_json,
+                created_at,
+                expires_at,
+                decided_at,
+                decided_by_key_id,
+                decision_note",
+        )
+        .bind(request.workspace_id.as_str())
+        .bind(request.agent_id.as_str())
+        .bind(request.approval_id.as_str())
+        .bind(request.expired_at)
+        .fetch_optional(&self.pool)
+        .await?;
+
+        row.map(map_approval_request_row).transpose()
+    }
 }
 
 fn map_approval_request_row(row: PgRow) -> Result<ApprovalRequestRecord, RegistryError> {

crates/crank-registry/src/postgres/mod.rs

@@ -35,15 +35,15 @@ use crate::{
         CreateImportJobRequest, CreateInvitationRequest, CreateInvocationLogRequest,
         CreatePlatformApiKeyRequest, CreateSecretRequest, CreateVersionRequest,
         CreateWorkspaceRequest, CreateYamlImportJobRequest, DecideApprovalRequest,
-        DescriptorMetadata, FinishApprovalRequest, FinishImportJobRequest, ImportJob, ImportJobId,
-        InvitationRecord, InvocationLogRecord, ListInvocationLogsQuery, MembershipRecord,
-        OperationAgentRef, OperationSampleMetadata, OperationSummary, OperationUsageSummary,
-        OperationVersionRecord, PlatformApiKeyRecord, PublishAgentRequest, PublishRequest,
-        PublishedAgentTool, RegistryOperation, RotateSecretRequest, SaveAgentBindingsRequest,
-        SaveAuthProfileRequest, SaveDescriptorMetadataRequest, SaveSampleMetadataRequest,
-        SaveWorkspaceUpstreamRequest, SecretRecord, SecretVersionRecord, SessionRecord,
-        UpdateWorkspaceRequest, UsageAgentBreakdown, UsageOperationBreakdown, UsageQuery,
-        UsageRollupRecord, UsageSummary, UsageTimelinePoint, WorkspaceMembershipRecord,
+        DescriptorMetadata, ExpireApprovalRequest, FinishApprovalRequest, FinishImportJobRequest,
+        ImportJob, ImportJobId, InvitationRecord, InvocationLogRecord, ListInvocationLogsQuery,
+        MembershipRecord, OperationAgentRef, OperationSampleMetadata, OperationSummary,
+        OperationUsageSummary, OperationVersionRecord, PlatformApiKeyRecord, PublishAgentRequest,
+        PublishRequest, PublishedAgentTool, RegistryOperation, RotateSecretRequest,
+        SaveAgentBindingsRequest, SaveAuthProfileRequest, SaveDescriptorMetadataRequest,
+        SaveSampleMetadataRequest, SaveWorkspaceUpstreamRequest, SecretRecord, SecretVersionRecord,
+        SessionRecord, UpdateWorkspaceRequest, UsageAgentBreakdown, UsageOperationBreakdown,
+        UsageQuery, UsageRollupRecord, UsageSummary, UsageTimelinePoint, WorkspaceMembershipRecord,
         WorkspaceRecord, WorkspaceUpstream, YamlImportJob, YamlImportJobCompletion,
         YamlImportJobId, YamlImportJobStatus,
     },