Add atomic durable job admission

crates/remora-credentials/src/registry.rs

@@ -497,6 +497,64 @@ impl CredentialRegistry {
             })
     }
 
+    pub async fn authorize_and_pin_current_version_in_tx(
+        tx: &mut PgTx<'_>,
+        caller: &CredentialCaller,
+        credential_id: &OpaqueId,
+    ) -> Result<(CredentialGrantVersion, SourceCredentialKind), CredentialError> {
+        lock_credential(tx, credential_id).await?;
+        let row = sqlx::query_as::<_, (String, String)>(
+            "SELECT owner_id, kind FROM source_credentials WHERE credential_id = $1",
+        )
+        .bind(credential_id.as_str())
+        .fetch_optional(tx.as_mut())
+        .await
+        .map_err(DurableError::from)?
+        .ok_or(CredentialError::NotFound)?;
+        let owner = OpaqueId::parse(row.0)?;
+        if !crate::authz::may_manage(caller, &owner) {
+            return Err(CredentialError::NotFound);
+        }
+        let kind = SourceCredentialKind::parse(&row.1)?;
+        let pin = Self::pin_current_version_in_tx(tx, credential_id).await?;
+        Ok((pin, kind))
+    }
+
+    pub async fn bind_execution_grant_in_tx(
+        tx: &mut PgTx<'_>,
+        grant_id: &OpaqueId,
+        pin: &CredentialGrantVersion,
+        now: OffsetDateTime,
+    ) -> Result<(), CredentialError> {
+        let resolvable: bool = sqlx::query_scalar(
+            "SELECT EXISTS (
+                SELECT 1 FROM source_credential_versions
+                WHERE credential_id = $1 AND version_id = $2 AND destroyed_at IS NULL
+             )",
+        )
+        .bind(pin.credential_id.as_str())
+        .bind(pin.version_id.as_str())
+        .fetch_one(tx.as_mut())
+        .await
+        .map_err(DurableError::from)?;
+        if !resolvable {
+            return Err(CredentialError::Unresolvable);
+        }
+        sqlx::query(
+            "INSERT INTO execution_grant_credential_pins (
+                grant_id, credential_id, version_id, status, created_at, revoked_at
+             ) VALUES ($1, $2, $3, 'active', $4, NULL)",
+        )
+        .bind(grant_id.as_str())
+        .bind(pin.credential_id.as_str())
+        .bind(pin.version_id.as_str())
+        .bind(now)
+        .execute(tx.as_mut())
+        .await
+        .map_err(DurableError::from)?;
+        Ok(())
+    }
+
     /// Bind a pin to an execution grant for worker resolution.
     ///
     /// WP-14 calls this when accepting a job. Resolution always re-reads this