@100xprompt/brain 0.0.0-stage → 0.1.1

package/src/org/db.ts

@@ -0,0 +1,435 @@
+// brain org: the organisation's tables (SQLite). One database file holds BOTH these `org_*` tables and Chitta's own tables
+// (nodes, edges, chunks, ...): the server opens Chitta on the file and runs these queries on Chitta's connection, so there is one
+// connection, one file to back up, and the two always agree. `initOrg` (used by `brain org admin init`, before any server runs)
+// opens its own connection.
+//
+// Every statement is parameterised: no value from a request is ever concatenated into SQL. The only dynamic SQL is the list of
+// `?` placeholders for an IN (...) of a known length.
+//
+// Tokens: only SHA-256 hashes are stored (see auth.ts). The audit log never holds item text or token material.
+import { Database } from "bun:sqlite"
+import { chmodSync, closeSync, existsSync, openSync } from "node:fs"
+import { randomBytes } from "node:crypto"
+import type { MemoryKind } from "../memory/types.ts"
+import { generateToken } from "./auth.ts"
+import { ensureTransactions, openSqlite } from "./crypto.ts"
+import { DEFAULT_POLICY, type AuditEvent, type OrgUser, type Policy, type Role, type Scope } from "./types.ts"
+
+/** User, team and organisation ids: short, no ':' (Chitta principals are `u:<id>`, `team:<id>`, `proj:<hash>`). */
+export const ID_RE = /^[A-Za-z0-9][A-Za-z0-9._@-]{0,63}$/
+export const isId = (s: unknown): s is string => typeof s === "string" && ID_RE.test(s)
+
+export interface UserRow {
+  id: string
+  name: string
+  role: Role
+  disabled: boolean
+  created_at: number
+}
+export interface TokenRow {
+  id: string
+  user_id: string
+  hash: string
+  created_at: number
+  expires_at: number | null
+  last_used_at: number | null
+  revoked_at: number | null
+}
+export interface ItemRow {
+  rid: string
+  item_id: string
+  project: string
+  label: string
+  scope: Scope
+  owner: string
+  team: string | null
+  source: string
+  kind: MemoryKind
+  name: string
+  text: string
+  occurred_at: string | null
+  stored_at: number
+}
+
+const SCHEMA = `
+CREATE TABLE IF NOT EXISTS org_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+CREATE TABLE IF NOT EXISTS org_users (
+  id TEXT PRIMARY KEY, name TEXT NOT NULL,
+  role TEXT NOT NULL CHECK (role IN ('viewer','editor','admin')),
+  disabled INTEGER NOT NULL DEFAULT 0, created_at INTEGER NOT NULL);
+CREATE TABLE IF NOT EXISTS org_tokens (
+  id TEXT PRIMARY KEY, user_id TEXT NOT NULL, hash TEXT NOT NULL,
+  created_at INTEGER NOT NULL, expires_at INTEGER, last_used_at INTEGER, revoked_at INTEGER);
+CREATE TABLE IF NOT EXISTS org_teams (id TEXT PRIMARY KEY, name TEXT NOT NULL);
+CREATE TABLE IF NOT EXISTS org_team_members (team TEXT NOT NULL, user TEXT NOT NULL, PRIMARY KEY (team, user));
+CREATE INDEX IF NOT EXISTS org_team_members_user ON org_team_members(user);
+CREATE TABLE IF NOT EXISTS org_project_members (
+  project TEXT NOT NULL, kind TEXT NOT NULL CHECK (kind IN ('user','team')), member TEXT NOT NULL,
+  PRIMARY KEY (project, kind, member));
+CREATE TABLE IF NOT EXISTS org_items (
+  rid TEXT PRIMARY KEY, item_id TEXT NOT NULL, project TEXT NOT NULL, label TEXT NOT NULL,
+  scope TEXT NOT NULL CHECK (scope IN ('private','project','team','org')),
+  owner TEXT NOT NULL, team TEXT, source TEXT NOT NULL, kind TEXT NOT NULL, name TEXT NOT NULL, text TEXT NOT NULL,
+  occurred_at TEXT, stored_at INTEGER NOT NULL);
+CREATE INDEX IF NOT EXISTS org_items_owner ON org_items(owner);
+CREATE INDEX IF NOT EXISTS org_items_project ON org_items(project, scope);
+CREATE INDEX IF NOT EXISTS org_items_item ON org_items(item_id);
+CREATE INDEX IF NOT EXISTS org_items_stored ON org_items(stored_at);
+CREATE TABLE IF NOT EXISTS org_audit (
+  id INTEGER PRIMARY KEY AUTOINCREMENT, at TEXT NOT NULL, actor TEXT NOT NULL, action TEXT NOT NULL,
+  project TEXT, scope TEXT, count INTEGER, detail TEXT);
+CREATE INDEX IF NOT EXISTS org_audit_at ON org_audit(at);
+CREATE TABLE IF NOT EXISTS org_item_entities (
+  rid TEXT NOT NULL, ekey TEXT NOT NULL, name TEXT NOT NULL, type TEXT, PRIMARY KEY (rid, ekey));
+CREATE INDEX IF NOT EXISTS org_item_entities_key ON org_item_entities(ekey, rid);
+CREATE TABLE IF NOT EXISTS org_item_relations (
+  rid TEXT NOT NULL, from_key TEXT NOT NULL, from_name TEXT NOT NULL, to_key TEXT NOT NULL, to_name TEXT NOT NULL, type TEXT NOT NULL,
+  PRIMARY KEY (rid, from_key, type, to_key));
+CREATE INDEX IF NOT EXISTS org_item_relations_from ON org_item_relations(from_key, rid);
+CREATE INDEX IF NOT EXISTS org_item_relations_to ON org_item_relations(to_key, rid);
+CREATE TRIGGER IF NOT EXISTS org_items_graph_cascade AFTER DELETE ON org_items BEGIN
+  DELETE FROM org_item_entities WHERE rid = old.rid;
+  DELETE FROM org_item_relations WHERE rid = old.rid;
+END;
+`
+
+/** What a user may see, as one SQL predicate over `org_items` (named parameter `$u`): the owner's own items, org-wide items,
+ *  project items of projects the user is a member of (directly or through a team), team items of teams the user belongs to.
+ *  The same predicate answers recall's final check and the project counts. Chitta's own ACL is a second, independent gate. */
+export const VISIBLE_SQL = `(
+  org_items.owner = $u
+  OR org_items.scope = 'org'
+  OR (org_items.scope = 'project' AND EXISTS (
+        SELECT 1 FROM org_project_members pm WHERE pm.project = org_items.project AND (
+          (pm.kind = 'user' AND pm.member = $u)
+          OR (pm.kind = 'team' AND pm.member IN (SELECT team FROM org_team_members WHERE user = $u)))))
+  OR (org_items.scope = 'team' AND org_items.team IN (SELECT team FROM org_team_members WHERE user = $u)))`
+
+const marks = (n: number): string => Array.from({ length: n }, () => "?").join(",")
+
+export class OrgDb {
+  readonly db: Database
+  constructor(
+    db: Database,
+    private readonly now: () => number = Date.now,
+  ) {
+    this.db = ensureTransactions(db) // an encrypted (libSQL) handle gets bun:sqlite's `transaction` and named-parameter behaviour (crypto.ts)
+  }
+
+  /** Opens (creating it, mode 0600) the database file with its own connection. `key` opens an encrypted database (see crypto.ts). */
+  static open(path: string, now?: () => number, key?: string): OrgDb {
+    if (!existsSync(path)) closeSync(openSync(path, "a", 0o600))
+    try {
+      chmodSync(path, 0o600)
+    } catch {}
+    const db = openSqlite(path, key)
+    for (const p of ["PRAGMA journal_mode = WAL", "PRAGMA busy_timeout = 5000", "PRAGMA synchronous = NORMAL"]) {
+      try {
+        db.exec(p)
+      } catch {}
+    }
+    const o = new OrgDb(db, now)
+    o.migrate()
+    return o
+  }
+
+  migrate(): void {
+    this.db.exec(SCHEMA)
+    // org_tokens.label (e.g. "sso") was added after the first release: add it to databases created before.
+    if (!this.all<{ name: string }>("PRAGMA table_info(org_tokens)").some((c) => c.name === "label")) this.db.exec("ALTER TABLE org_tokens ADD COLUMN label TEXT")
+  }
+  close(): void {
+    this.db.close()
+  }
+
+  private all<T>(sql: string, ...p: unknown[]): T[] {
+    return this.db.query(sql).all(...(p as never[])) as T[]
+  }
+  private get<T>(sql: string, ...p: unknown[]): T | undefined {
+    return (this.db.query(sql).get(...(p as never[])) as T | null) ?? undefined
+  }
+  private run(sql: string, ...p: unknown[]): void {
+    this.db.query(sql).run(...(p as never[]))
+  }
+  tx<T>(fn: () => T): T {
+    return this.db.transaction(fn)()
+  }
+
+  // ---- meta, policy ----
+  private meta(key: string): string | undefined {
+    return this.get<{ value: string }>("SELECT value FROM org_meta WHERE key = ?", key)?.value
+  }
+  private setMeta(key: string, value: string): void {
+    this.run("INSERT INTO org_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value", key, value)
+  }
+  org(): { id: string; name: string } | undefined {
+    const id = this.meta("org_id")
+    const name = this.meta("org_name")
+    return id && name !== undefined ? { id, name } : undefined
+  }
+  policy(): Policy {
+    const raw = this.meta("policy")
+    if (!raw) return { ...DEFAULT_POLICY, denyPaths: [], denyTerms: [] }
+    return JSON.parse(raw) as Policy
+  }
+  setPolicy(p: Policy): void {
+    this.setMeta("policy", JSON.stringify(p))
+  }
+  /** Secret used to hash queries and private project ids in the audit log (so an admin cannot confirm a guessed query). */
+  auditKey(): string {
+    let k = this.meta("audit_key")
+    if (!k) {
+      k = randomBytes(32).toString("hex")
+      this.setMeta("audit_key", k)
+    }
+    return k
+  }
+
+  // ---- single sign-on configuration (sso.ts owns the shape; the secret is its own row and is never read back by the API) ----
+  ssoRaw(): string | undefined {
+    return this.meta("sso")
+  }
+  setSsoRaw(json: string): void {
+    this.setMeta("sso", json)
+  }
+  ssoSecret(): string | undefined {
+    return this.meta("sso_secret")
+  }
+  setSsoSecret(secret: string): void {
+    this.setMeta("sso_secret", secret)
+  }
+
+  // ---- users ----
+  user(id: string): UserRow | undefined {
+    const r = this.get<{ id: string; name: string; role: Role; disabled: number; created_at: number }>("SELECT * FROM org_users WHERE id = ?", id)
+    return r ? { ...r, disabled: !!r.disabled } : undefined
+  }
+  users(): UserRow[] {
+    return this.all<{ id: string; name: string; role: Role; disabled: number; created_at: number }>("SELECT * FROM org_users ORDER BY id").map((r) => ({ ...r, disabled: !!r.disabled }))
+  }
+  addUser(id: string, name: string, role: Role): void {
+    this.run("INSERT INTO org_users (id, name, role, disabled, created_at) VALUES (?,?,?,0,?)", id, name, role, this.now())
+  }
+  setDisabled(id: string, disabled: boolean): void {
+    this.run("UPDATE org_users SET disabled = ? WHERE id = ?", disabled ? 1 : 0, id)
+  }
+  activeAdmins(): number {
+    return this.get<{ c: number }>("SELECT count(*) c FROM org_users WHERE role = 'admin' AND disabled = 0")!.c
+  }
+  teamsOf(userId: string): string[] {
+    return this.all<{ team: string }>("SELECT team FROM org_team_members WHERE user = ? ORDER BY team", userId).map((r) => r.team)
+  }
+  orgUser(row: UserRow): OrgUser {
+    return { id: row.id, name: row.name, role: row.role, teams: this.teamsOf(row.id), ...(row.disabled ? { disabled: true } : {}) }
+  }
+
+  // ---- tokens ----
+  createToken(userId: string, expiresInDays?: number, label?: string): { id: string; token: string } {
+    const t = generateToken()
+    const at = this.now()
+    const exp = expiresInDays ? at + expiresInDays * 86_400_000 : null
+    this.run("INSERT INTO org_tokens (id, user_id, hash, created_at, expires_at, label) VALUES (?,?,?,?,?,?)", t.id, userId, t.hash, at, exp, label ?? null)
+    return { id: t.id, token: t.token }
+  }
+  token(id: string): TokenRow | undefined {
+    return this.get<TokenRow>("SELECT * FROM org_tokens WHERE id = ?", id)
+  }
+  touchToken(id: string, at: number): void {
+    this.run("UPDATE org_tokens SET last_used_at = ? WHERE id = ?", at, id)
+  }
+  /** Token metadata for admins: never the token and never its hash. */
+  tokens(): Array<{ id: string; user: string; created: string; expires?: string; lastUsed?: string; revoked: boolean; label?: string }> {
+    const iso = (n: number) => new Date(n).toISOString()
+    return this.all<TokenRow & { label: string | null }>("SELECT id, user_id, created_at, expires_at, last_used_at, revoked_at, label FROM org_tokens ORDER BY created_at, id").map((r) => ({
+      id: r.id,
+      user: r.user_id,
+      created: iso(r.created_at),
+      ...(r.expires_at != null ? { expires: iso(r.expires_at) } : {}),
+      ...(r.last_used_at != null ? { lastUsed: iso(r.last_used_at) } : {}),
+      revoked: r.revoked_at != null,
+      ...(r.label ? { label: r.label } : {}),
+    }))
+  }
+  revokeToken(id: string): boolean {
+    const t = this.token(id)
+    if (!t) return false
+    if (t.revoked_at == null) this.run("UPDATE org_tokens SET revoked_at = ? WHERE id = ?", this.now(), id)
+    return true
+  }
+
+  // ---- teams and membership ----
+  team(id: string): { id: string; name: string } | undefined {
+    return this.get("SELECT id, name FROM org_teams WHERE id = ?", id)
+  }
+  teams(): Array<{ id: string; name: string }> {
+    return this.all("SELECT id, name FROM org_teams ORDER BY id")
+  }
+  teamMembers(team: string): string[] {
+    return this.all<{ user: string }>("SELECT user FROM org_team_members WHERE team = ? ORDER BY user", team).map((r) => r.user)
+  }
+  /** Creates or renames the team and REPLACES its member list. */
+  setTeam(id: string, name: string, members: string[]): void {
+    this.tx(() => {
+      this.run("INSERT INTO org_teams (id, name) VALUES (?,?) ON CONFLICT(id) DO UPDATE SET name = excluded.name", id, name)
+      this.run("DELETE FROM org_team_members WHERE team = ?", id)
+      for (const m of new Set(members)) this.run("INSERT INTO org_team_members (team, user) VALUES (?,?)", id, m)
+    })
+  }
+  addTeamMember(team: string, user: string): void {
+    this.run("INSERT OR IGNORE INTO org_team_members (team, user) VALUES (?,?)", team, user)
+  }
+  projectMembers(project: string): { users: string[]; teams: string[] } {
+    const rows = this.all<{ kind: "user" | "team"; member: string }>("SELECT kind, member FROM org_project_members WHERE project = ? ORDER BY member", project)
+    return { users: rows.filter((r) => r.kind === "user").map((r) => r.member), teams: rows.filter((r) => r.kind === "team").map((r) => r.member) }
+  }
+  addProjectMember(project: string, kind: "user" | "team", member: string): void {
+    this.run("INSERT OR IGNORE INTO org_project_members (project, kind, member) VALUES (?,?,?)", project, kind, member)
+  }
+  removeProjectMember(project: string, kind: "user" | "team", member: string): void {
+    this.run("DELETE FROM org_project_members WHERE project = ? AND kind = ? AND member = ?", project, kind, member)
+  }
+  /** Direct member, or member of a team that is a member. */
+  isProjectMember(user: string, project: string): boolean {
+    return !!this.get(
+      `SELECT 1 FROM org_project_members pm WHERE pm.project = $p AND (
+         (pm.kind = 'user' AND pm.member = $u) OR (pm.kind = 'team' AND pm.member IN (SELECT team FROM org_team_members WHERE user = $u))) LIMIT 1`,
+      { $p: project, $u: user },
+    )
+  }
+  isTeamMember(user: string, team: string): boolean {
+    return !!this.get("SELECT 1 FROM org_team_members WHERE team = ? AND user = ?", team, user)
+  }
+  /** Every project that has members, with its effective (direct + through teams) user ids: for syncing Chitta's groups. */
+  effectiveProjectMembers(): Map<string, string[]> {
+    const rows = this.all<{ project: string; user: string }>(
+      `SELECT project, member AS user FROM org_project_members WHERE kind = 'user'
+       UNION SELECT pm.project, tm.user FROM org_project_members pm JOIN org_team_members tm ON tm.team = pm.member WHERE pm.kind = 'team'`,
+    )
+    const out = new Map<string, string[]>()
+    for (const r of rows) (out.get(r.project) ?? out.set(r.project, []).get(r.project)!).push(r.user)
+    return out
+  }
+  projectsOfMember(user: string): string[] {
+    return this.all<{ project: string }>(
+      `SELECT DISTINCT project FROM org_project_members WHERE (kind = 'user' AND member = $u)
+         OR (kind = 'team' AND member IN (SELECT team FROM org_team_members WHERE user = $u))`,
+      { $u: user },
+    ).map((r) => r.project)
+  }
+
+  // ---- items ----
+  item(rid: string): ItemRow | undefined {
+    return this.get<ItemRow>("SELECT * FROM org_items WHERE rid = ?", rid)
+  }
+  insertItem(r: ItemRow): void {
+    this.run(
+      "INSERT INTO org_items (rid, item_id, project, label, scope, owner, team, source, kind, name, text, occurred_at, stored_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",
+      r.rid, r.item_id, r.project, r.label, r.scope, r.owner, r.team, r.source, r.kind, r.name, r.text, r.occurred_at, r.stored_at,
+    )
+  }
+  updateItemContent(rid: string, c: { label: string; kind: MemoryKind; name: string; text: string; occurred_at: string | null; stored_at: number }): void {
+    this.run("UPDATE org_items SET label = ?, kind = ?, name = ?, text = ?, occurred_at = ?, stored_at = ? WHERE rid = ?", c.label, c.kind, c.name, c.text, c.occurred_at, c.stored_at, rid)
+  }
+  setItemScope(rid: string, scope: Scope, team: string | null): void {
+    this.run("UPDATE org_items SET scope = ?, team = ? WHERE rid = ?", scope, team, rid)
+  }
+  deleteItem(rid: string): void {
+    this.run("DELETE FROM org_items WHERE rid = ?", rid)
+  }
+  countOwned(owner: string): number {
+    return this.get<{ c: number }>("SELECT count(*) c FROM org_items WHERE owner = ?", owner)!.c
+  }
+  /** The caller's OWN rows with these item ids (any project). */
+  ownedByItemIds(owner: string, ids: string[]): ItemRow[] {
+    if (!ids.length) return []
+    return this.all<ItemRow>(`SELECT * FROM org_items WHERE owner = ? AND item_id IN (${marks(ids.length)})`, owner, ...ids)
+  }
+  /** Rows matching every given filter (an unset filter does not restrict). `owner` limits to one owner. */
+  itemsWhere(f: { owner?: string; project?: string; source?: string; ids?: string[] }): ItemRow[] {
+    const where: string[] = []
+    const p: unknown[] = []
+    if (f.owner !== undefined) (where.push("owner = ?"), p.push(f.owner))
+    if (f.project !== undefined) (where.push("project = ?"), p.push(f.project))
+    if (f.source !== undefined) (where.push("source = ?"), p.push(f.source))
+    if (f.ids) {
+      if (!f.ids.length) return []
+      where.push(`item_id IN (${marks(f.ids.length)})`)
+      p.push(...f.ids)
+    }
+    if (!where.length) return []
+    return this.all<ItemRow>(`SELECT * FROM org_items WHERE ${where.join(" AND ")}`, ...p)
+  }
+  /** Of these row ids, the ones `user` may see. */
+  visibleRows(user: string, rids: string[]): Map<string, ItemRow> {
+    const out = new Map<string, ItemRow>()
+    if (!rids.length) return out
+    const sql = `SELECT * FROM org_items WHERE rid IN (${rids.map((_, i) => `$r${i}`).join(",")}) AND ${VISIBLE_SQL}`
+    const params: Record<string, string> = { $u: user }
+    rids.forEach((r, i) => (params[`$r${i}`] = r))
+    for (const row of this.all<ItemRow>(sql, params)) out.set(row.rid, row)
+    return out
+  }
+  /** Projects `user` may see: those with at least one visible item, plus those they are a member of. */
+  visibleProjects(user: string): Array<{ id: string; label: string; items: number }> {
+    const rows = this.all<{ id: string; label: string; items: number }>(
+      `SELECT project AS id, max(label) AS label, count(*) AS items FROM org_items WHERE ${VISIBLE_SQL} GROUP BY project ORDER BY items DESC, project`,
+      { $u: user },
+    )
+    const have = new Set(rows.map((r) => r.id))
+    for (const id of this.projectsOfMember(user)) if (!have.has(id)) rows.push({ id, label: id, items: 0 })
+    return rows
+  }
+  expiredItems(before: number): ItemRow[] {
+    return this.all<ItemRow>("SELECT * FROM org_items WHERE stored_at < ?", before)
+  }
+
+  // ---- audit ----
+  audit(e: { actor: string; action: string; project?: string; scope?: Scope; count?: number; detail?: string }): void {
+    this.run(
+      "INSERT INTO org_audit (at, actor, action, project, scope, count, detail) VALUES (?,?,?,?,?,?,?)",
+      new Date(this.now()).toISOString(), e.actor, e.action, e.project ?? null, e.scope ?? null, e.count ?? null, e.detail ?? null,
+    )
+  }
+  /** The newest `limit` events at or after `sinceIso`, oldest first. */
+  auditEvents(sinceIso: string | undefined, limit: number): AuditEvent[] {
+    const rows = this.all<{ at: string; actor: string; action: string; project: string | null; scope: Scope | null; count: number | null; detail: string | null }>(
+      "SELECT at, actor, action, project, scope, count, detail FROM org_audit WHERE at >= ? ORDER BY id DESC LIMIT ?",
+      sinceIso ?? "",
+      limit,
+    )
+    return rows.reverse().map((r) => ({
+      at: r.at,
+      actor: r.actor,
+      action: r.action,
+      ...(r.project != null ? { project: r.project } : {}),
+      ...(r.scope != null ? { scope: r.scope } : {}),
+      ...(r.count != null ? { count: r.count } : {}),
+      ...(r.detail != null ? { detail: r.detail } : {}),
+    }))
+  }
+}
+
+export const openOrgDb = (path: string, now?: () => number, key?: string): OrgDb => OrgDb.open(path, now, key)
+
+/** Creates the organisation database (mode 0600), the organisation, its first admin and the admin's first token. The token is returned
+ *  ONCE: only its hash is stored. Refuses to run on a database that already holds an organisation. */
+export function initOrg(dbPath: string, org: { id: string; name: string }, admin: { id: string; name: string }, opts: { key?: string } = {}): { token: string } {
+  if (!isId(org.id)) throw new Error("organisation id must be 1-64 characters: letters, digits, . _ @ - (starting with a letter or digit)")
+  if (!isId(admin.id)) throw new Error("admin id must be 1-64 characters: letters, digits, . _ @ - (starting with a letter or digit)")
+  if (!org.name.trim() || org.name.length > 200) throw new Error("organisation name must be 1-200 characters")
+  if (!admin.name.trim() || admin.name.length > 200) throw new Error("admin name must be 1-200 characters")
+  const o = OrgDb.open(dbPath, undefined, opts.key) // with a key the new database is created encrypted
+  try {
+    if (o.org()) throw new Error(`${dbPath} already holds an organisation (${o.org()!.id}); refusing to overwrite it`)
+    return o.tx(() => {
+      o.db.query("INSERT INTO org_meta (key, value) VALUES ('org_id', ?), ('org_name', ?), ('schema', '1'), ('policy', ?)").run(org.id, org.name.trim(), JSON.stringify(DEFAULT_POLICY))
+      o.auditKey()
+      o.addUser(admin.id, admin.name.trim(), "admin")
+      const t = o.createToken(admin.id)
+      o.audit({ actor: "-", action: "org.init", detail: `admin=${admin.id}` })
+      return { token: t.token }
+    })
+  } finally {
+    o.close()
+  }
+}