clawmates/crates/cm-safety/src/grants.rs

use sqlx::PgPool;
use uuid::Uuid;

use crate::SafetyError;

/// Consumes the single-use execution grant for an approval. The
/// compare-and-swap guarantees a gated action can execute at most once,
/// even against a compromised or racing caller (§15 defense in depth).
pub async fn consume(pool: &PgPool, approval_id: Uuid) -> Result<(), SafetyError> {
    let row = sqlx::query!(
        "UPDATE execution_grants
         SET consumed = true, consumed_at = now()
         WHERE approval_id = $1 AND consumed = false
         RETURNING id",
        approval_id,
    )
    .fetch_optional(pool)
    .await?;
    if row.is_none() {
        return Err(SafetyError::GrantUnavailable);
    }
    Ok(())
}