fix: team-scope workflow trigger uniqueness (#164)

Trigger registration surfaced a latent multi-tenant bug: the uniqueness
indexes on workflow_triggers were global, not team-scoped.

- Migration 022 rebuilds the cron uniqueness index as
  (team_id, workflow_name, schedule). Workflow names are team-scoped, so
  two teams may legitimately share a name + schedule; the global index
  made the second team's apply fail with a unique-constraint violation.
- Webhook paths stay a global routing key (an inbound POST /hooks/<path>
  carries no team identity, so the path must be globally unique).
  LookupWebhookTrigger no longer filters by the request's team; it
  resolves by path and returns the owning team from the matched row, and
  the webhook handler runs the workflow under that team. This also fixes
  non-default-team webhooks, which previously never routed because the
  lookup was scoped to the default team.
- Email triggers have no uniqueness index and are unaffected.

Tests: two teams registering the same workflow name + cron schedule; a
non-default-team webhook resolved by a team-agnostic path lookup.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WnKgCRfMvFcZAkoVbr8k79

Author: claude

.changeset/team-scoped-trigger-uniqueness.md

@@ -0,0 +1,5 @@
+---
+"@mantle/engine": patch
+---
+
+Make workflow trigger uniqueness multi-tenant-safe. The cron trigger uniqueness index is now scoped by team (`team_id, workflow_name, schedule`), so two teams can each register a workflow with the same name and schedule instead of the second team's apply failing with a unique-constraint violation. Webhook paths remain a global routing key (an inbound `POST /hooks/<path>` carries no team identity), and the webhook lookup is no longer team-scoped: it resolves by path and runs the workflow under the owning team from the matched trigger row, so webhooks registered by non-default teams now route correctly. Fixes #164.

packages/engine/internal/db/migrations/022_team_scoped_trigger_uniqueness.sql

@@ -0,0 +1,23 @@
+-- +goose Up
+-- 022_team_scoped_trigger_uniqueness: cron trigger uniqueness must be per-team.
+--
+-- Workflow names are team-scoped (workflow_definitions is UNIQUE(team_id, name,
+-- version)), so two teams may legitimately own a workflow of the same name on
+-- the same schedule. The original index on (workflow_name, schedule) was global,
+-- so the second team's apply failed with a unique-constraint violation once
+-- trigger registration went live. Scope the uniqueness by team.
+--
+-- The webhook path index is intentionally left global: an inbound
+-- POST /hooks/<path> request carries no team identity, so the path is the global
+-- routing key and must be unique across all teams. Email triggers have no
+-- uniqueness index and are unaffected.
+DROP INDEX IF EXISTS idx_workflow_triggers_cron;
+CREATE UNIQUE INDEX idx_workflow_triggers_cron
+    ON workflow_triggers (team_id, workflow_name, schedule)
+    WHERE type = 'cron';
+
+-- +goose Down
+DROP INDEX IF EXISTS idx_workflow_triggers_cron;
+CREATE UNIQUE INDEX idx_workflow_triggers_cron
+    ON workflow_triggers (workflow_name, schedule)
+    WHERE type = 'cron';

packages/engine/internal/server/trigger.go

@@ -3,8 +3,6 @@ package server
 import (
 	"context"
 	"database/sql"
-
-	"github.com/dvflw/mantle/internal/auth"
 )
 
 // TriggerRecord represents a registered trigger in the database.
@@ -43,14 +41,17 @@ func ListCronTriggers(ctx context.Context, db *sql.DB) ([]TriggerRecord, error)
 	return scanTriggers(rows)
 }
 
-// LookupWebhookTrigger finds the trigger matching a webhook path, scoped to the team.
+// LookupWebhookTrigger finds the enabled webhook trigger for a path. Webhook
+// paths are a global routing key — an inbound POST /hooks/<path> carries no team
+// identity — so the lookup is not team-scoped and the path index is unique
+// across all teams. The owning team is read from the matched row so the caller
+// can run the workflow under the correct tenant.
 func LookupWebhookTrigger(ctx context.Context, db *sql.DB, path string) (*TriggerRecord, error) {
-	teamID := auth.TeamIDFromContext(ctx)
 	var t TriggerRecord
 	err := db.QueryRowContext(ctx,
-		`SELECT id, workflow_name, workflow_version, type, COALESCE(schedule, ''), COALESCE(path, ''), COALESCE(secret, ''), enabled
-		 FROM workflow_triggers WHERE type = 'webhook' AND path = $1 AND enabled = true AND team_id = $2`, path, teamID,
-	).Scan(&t.ID, &t.WorkflowName, &t.WorkflowVersion, &t.Type, &t.Schedule, &t.Path, &t.Secret, &t.Enabled)
+		`SELECT id, workflow_name, workflow_version, type, COALESCE(schedule, ''), COALESCE(path, ''), COALESCE(secret, ''), enabled, team_id
+		 FROM workflow_triggers WHERE type = 'webhook' AND path = $1 AND enabled = true`, path,
+	).Scan(&t.ID, &t.WorkflowName, &t.WorkflowVersion, &t.Type, &t.Schedule, &t.Path, &t.Secret, &t.Enabled, &t.TeamID)
 	if err == sql.ErrNoRows {
 		return nil, nil
 	}

packages/engine/internal/server/trigger_test.go

@@ -0,0 +1,56 @@
+package server
+
+import (
+	"context"
+	"testing"
+
+	"github.com/dvflw/mantle/internal/auth"
+)
+
+// TestLookupWebhookTrigger_GlobalPathReturnsOwningTeam verifies that a webhook
+// registered by a non-default team is found by an unauthenticated inbound
+// lookup (which carries no team identity) and reports the owning team, so the
+// handler can run the workflow under the correct tenant. Previously the lookup
+// was team-scoped to the default team, so non-default-team webhooks never
+// routed.
+func TestLookupWebhookTrigger_GlobalPathReturnsOwningTeam(t *testing.T) {
+	db, _ := setupWebhookTest(t)
+	ctx := context.Background()
+
+	teamB := "00000000-0000-0000-0000-0000000000b2"
+	if _, err := db.ExecContext(ctx,
+		`INSERT INTO teams (id, name) VALUES ($1, 'team-b')`, teamB); err != nil {
+		t.Fatalf("creating team-b: %v", err)
+	}
+	if _, err := db.ExecContext(ctx,
+		`INSERT INTO workflow_triggers (workflow_name, workflow_version, type, path, team_id)
+		 VALUES ('wf', 1, 'webhook', '/hooks/tb', $1)`, teamB); err != nil {
+		t.Fatalf("seeding webhook trigger: %v", err)
+	}
+
+	// No team in context, as an inbound webhook request would be.
+	tr, err := LookupWebhookTrigger(ctx, db, "/hooks/tb")
+	if err != nil {
+		t.Fatalf("LookupWebhookTrigger: %v", err)
+	}
+	if tr == nil {
+		t.Fatal("expected trigger, got nil")
+	}
+	if tr.TeamID != teamB {
+		t.Errorf("TeamID = %q, want %q", tr.TeamID, teamB)
+	}
+	if tr.WorkflowName != "wf" {
+		t.Errorf("WorkflowName = %q, want wf", tr.WorkflowName)
+	}
+
+	// A default-team context must not change the result — the path is a global
+	// routing key, not team-scoped.
+	ctxDefault := auth.WithUser(ctx, &auth.User{TeamID: auth.DefaultTeamID})
+	tr2, err := LookupWebhookTrigger(ctxDefault, db, "/hooks/tb")
+	if err != nil {
+		t.Fatalf("LookupWebhookTrigger (default ctx): %v", err)
+	}
+	if tr2 == nil || tr2.TeamID != teamB {
+		t.Errorf("global lookup should be team-agnostic; got %+v", tr2)
+	}
+}

packages/engine/internal/server/webhook.go

@@ -9,6 +9,8 @@ import (
 	"io"
 	"net/http"
 	"strings"
+
+	"github.com/dvflw/mantle/internal/auth"
 )
 
 // WebhookHandler handles incoming webhook requests and triggers workflow executions.
@@ -84,9 +86,14 @@ func (h *WebhookHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	h.server.Logger.Info("webhook: triggering workflow",
 		"path", path,
 		"workflow", trigger.WorkflowName,
-		"version", trigger.WorkflowVersion)
-
-	execID, err := h.server.executeWorkflow(r.Context(), trigger.WorkflowName, trigger.WorkflowVersion, inputs)
+		"version", trigger.WorkflowVersion,
+		"team_id", trigger.TeamID)
+
+	// Webhook requests are unauthenticated, so the tenant comes from the matched
+	// trigger row rather than the request context. Run under that team so
+	// workflow/credential resolution is correctly scoped.
+	execCtx := auth.WithUser(r.Context(), &auth.User{TeamID: trigger.TeamID})
+	execID, err := h.server.executeWorkflow(execCtx, trigger.WorkflowName, trigger.WorkflowVersion, inputs)
 	if err != nil {
 		h.server.Logger.Error("webhook: execution failed",
 			"workflow", trigger.WorkflowName,

packages/engine/internal/workflow/triggers_test.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"database/sql"
 	"testing"
+
+	"github.com/dvflw/mantle/internal/auth"
 )
 
 // countTriggers returns the number of workflow_triggers rows for a workflow,
@@ -190,6 +192,63 @@ func TestSave_BackfillsTriggersOnUnchangedApply(t *testing.T) {
 	}
 }
 
+// TestSave_CronTriggersUniquePerTeam verifies that two teams can each register
+// a workflow with the same name and cron schedule. Before the uniqueness index
+// was team-scoped, the second team's apply failed with a unique-constraint
+// violation on (workflow_name, schedule).
+func TestSave_CronTriggersUniquePerTeam(t *testing.T) {
+	database := setupTestDB(t)
+	ctx := context.Background()
+
+	// A second team — both workflow_definitions.team_id and
+	// workflow_triggers.team_id are foreign keys to teams(id).
+	teamB := "00000000-0000-0000-0000-0000000000b2"
+	if _, err := database.ExecContext(ctx,
+		`INSERT INTO teams (id, name) VALUES ($1, 'team-b')`, teamB); err != nil {
+		t.Fatalf("creating team-b: %v", err)
+	}
+
+	yaml := []byte(`name: shared-name
+triggers:
+  - type: cron
+    schedule: "*/5 * * * *"
+steps:
+  - name: s
+    action: http/request
+    params:
+      method: GET
+      url: "https://example.com"
+`)
+	result, err := ParseBytes(yaml)
+	if err != nil {
+		t.Fatalf("ParseBytes: %v", err)
+	}
+
+	// Default team.
+	if _, err := Save(ctx, database, result, yaml); err != nil {
+		t.Fatalf("Save (default team): %v", err)
+	}
+	// team-b — same workflow name and schedule.
+	ctxB := auth.WithUser(ctx, &auth.User{TeamID: teamB})
+	if _, err := Save(ctxB, database, result, yaml); err != nil {
+		t.Fatalf("Save (team-b): %v", err)
+	}
+
+	// Each team owns exactly one cron trigger for the workflow.
+	for _, tid := range []string{auth.DefaultTeamID, teamB} {
+		var n int
+		if err := database.QueryRowContext(ctx,
+			`SELECT COUNT(*) FROM workflow_triggers
+			 WHERE workflow_name = 'shared-name' AND type = 'cron' AND team_id = $1`, tid,
+		).Scan(&n); err != nil {
+			t.Fatalf("counting triggers for %s: %v", tid, err)
+		}
+		if n != 1 {
+			t.Errorf("team %s cron triggers = %d, want 1", tid, n)
+		}
+	}
+}
+
 // TestSave_BackfillPreservesDisabledState verifies that backfilling triggers
 // for a currently-disabled workflow inserts them disabled, so a pruned
 // workflow does not start firing on a re-apply.