@aprovan/chat-backend 0.1.0-dev.4d82df8 → 0.1.0-dev.67fbce2

package/src/routes/vfs.ts

@@ -0,0 +1,369 @@
+import { ConditionalCheckFailedException, DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import {
+  DynamoDBDocumentClient,
+  DeleteCommand,
+  GetCommand,
+  QueryCommand,
+  UpdateCommand,
+} from "@aws-sdk/lib-dynamodb";
+import {
+  DeleteObjectCommand,
+  GetObjectCommand,
+  PutObjectCommand,
+  S3Client,
+} from "@aws-sdk/client-s3";
+import { Hono } from "hono";
+import type { AppVariables } from "../types.js";
+
+export interface VfsChangeEntry {
+  path: string;
+  mtime: string;
+  version: number;
+  size: number;
+}
+
+interface VfsDdbItem {
+  PK: string;
+  SK: string;
+  s3Key: string;
+  size: number;
+  mtime: string;
+  etag?: string;
+  contentHash?: string;
+  version: number;
+}
+
+let ddbClient: DynamoDBDocumentClient | null = null;
+let s3Client: S3Client | null = null;
+
+function getDdb() {
+  if (!ddbClient) {
+    ddbClient = DynamoDBDocumentClient.from(
+      new DynamoDBClient({ region: process.env["AWS_REGION"] }),
+    );
+  }
+  return ddbClient;
+}
+
+function getS3() {
+  if (!s3Client) {
+    s3Client = new S3Client({ region: process.env["AWS_REGION"] });
+  }
+  return s3Client;
+}
+
+function vfsTableName(): string | undefined {
+  return process.env["VFS_TABLE_NAME"];
+}
+
+function vfsBucketName(): string | undefined {
+  return process.env["VFS_BUCKET_NAME"];
+}
+
+function pk(wsId: string) {
+  return `workspace#${wsId}`;
+}
+
+function sk(filePath: string) {
+  return `file#${filePath}`;
+}
+
+function s3Key(wsId: string, filePath: string) {
+  return `${wsId}/${filePath}`;
+}
+
+export const vfsRoute = new Hono<{ Variables: AppVariables }>();
+
+/** GET /vfs/config — parity endpoint; tells the client to use path-based addressing. */
+vfsRoute.get("/config", (c) => {
+  return c.json({ usePaths: true });
+});
+
+/**
+ * GET /vfs?since=<RFC3339>
+ *
+ * Returns a list of workspace files whose mtime is strictly after :since.
+ * The workspace is resolved from the caller's session — the URL carries no wsId.
+ *
+ * If VFS_TABLE_NAME is not set (infra not yet deployed) returns [] so the
+ * polling client degrades gracefully.
+ */
+vfsRoute.get("/", async (c) => {
+  const since = c.req.query("since");
+  if (!since) {
+    return c.json({ error: "since query parameter is required" }, 400);
+  }
+
+  const sinceDate = new Date(since);
+  if (isNaN(sinceDate.getTime())) {
+    return c.json({ error: "since must be a valid RFC3339 timestamp" }, 400);
+  }
+
+  const tableName = vfsTableName();
+  if (!tableName) {
+    return c.json([] as VfsChangeEntry[]);
+  }
+
+  const workspaceId = c.get("workspaceId");
+
+  const result = await getDdb().send(
+    new QueryCommand({
+      TableName: tableName,
+      KeyConditionExpression: "PK = :pk",
+      FilterExpression: "#mtime > :since",
+      ExpressionAttributeNames: { "#mtime": "mtime" },
+      ExpressionAttributeValues: {
+        ":pk": pk(workspaceId),
+        ":since": sinceDate.toISOString(),
+      },
+    }),
+  );
+
+  const items = (result.Items ?? []) as VfsDdbItem[];
+  const changes: VfsChangeEntry[] = items.map((item) => ({
+    path: item.SK.replace(/^file#/, ""),
+    mtime: item.mtime,
+    version: item.version ?? 0,
+    size: item.size ?? 0,
+  }));
+
+  return c.json(changes);
+});
+
+/**
+ * HEAD /vfs/:path — check existence. 200 if exists, 404 if not.
+ * GET  /vfs/:path — read file, stat, or readdir (query param selects behaviour).
+ *
+ * HEAD is merged into GET because Hono auto-routes HEAD to the matching GET
+ * handler before checking explicit HEAD registrations.
+ */
+vfsRoute.on(["GET", "HEAD"], "/:path{.+}", async (c) => {
+  const isHead = c.req.method === "HEAD";
+  const filePath = c.req.param("path");
+  const workspaceId = c.get("workspaceId");
+  const tableName = vfsTableName();
+  const bucketName = vfsBucketName();
+
+  // --- HEAD: existence check ---
+  if (isHead) {
+    if (!tableName) return c.body(null, 404);
+    const result = await getDdb().send(
+      new GetCommand({
+        TableName: tableName,
+        Key: { PK: pk(workspaceId), SK: sk(filePath) },
+        ProjectionExpression: "SK",
+      }),
+    );
+    return result.Item ? c.body(null, 200) : c.body(null, 404);
+  }
+
+  if (!tableName) {
+    return c.json({ error: "VFS not configured" }, 503);
+  }
+
+  // --- stat ---
+  if (c.req.query("stat") === "true") {
+    const result = await getDdb().send(
+      new GetCommand({
+        TableName: tableName,
+        Key: { PK: pk(workspaceId), SK: sk(filePath) },
+        ProjectionExpression: "#sz, #mt, version",
+        ExpressionAttributeNames: { "#sz": "size", "#mt": "mtime" },
+      }),
+    );
+    if (!result.Item) return c.json({ error: "ENOENT" }, 404);
+    const item = result.Item as Pick<VfsDdbItem, "size" | "mtime" | "version">;
+    return c.json({
+      size: item.size,
+      mtime: item.mtime,
+      isFile: true,
+      isDirectory: false,
+    });
+  }
+
+  // --- readdir ---
+  if (c.req.query("readdir") === "true") {
+    const prefix = filePath ? `file#${filePath}/` : "file#";
+    const result = await getDdb().send(
+      new QueryCommand({
+        TableName: tableName,
+        KeyConditionExpression: "PK = :pk AND begins_with(SK, :prefix)",
+        ExpressionAttributeValues: {
+          ":pk": pk(workspaceId),
+          ":prefix": prefix,
+        },
+        ProjectionExpression: "SK",
+      }),
+    );
+
+    const items = (result.Items ?? []) as Array<{ SK: string }>;
+    const seen = new Map<string, boolean>();
+
+    for (const item of items) {
+      const relativePath = item.SK.slice(prefix.length);
+      const slashIdx = relativePath.indexOf("/");
+      if (slashIdx === -1) {
+        seen.set(relativePath, false);
+      } else {
+        const dirName = relativePath.slice(0, slashIdx);
+        if (!seen.has(dirName)) {
+          seen.set(dirName, true);
+        }
+      }
+    }
+
+    const entries = Array.from(seen.entries()).map(([name, isDirectory]) => ({
+      name,
+      isDirectory,
+    }));
+
+    return c.json(entries);
+  }
+
+  // --- read file ---
+  if (!bucketName) {
+    return c.json({ error: "VFS storage not configured" }, 503);
+  }
+
+  const fileKey = s3Key(workspaceId, filePath);
+  try {
+    const obj = await getS3().send(
+      new GetObjectCommand({ Bucket: bucketName, Key: fileKey }),
+    );
+    const body = await obj.Body?.transformToString("utf-8");
+    if (body === undefined) return c.json({ error: "ENOENT" }, 404);
+    return c.text(body, 200);
+  } catch (err: unknown) {
+    const code = (err as { name?: string }).name;
+    if (code === "NoSuchKey" || code === "NotFound") {
+      return c.json({ error: "ENOENT" }, 404);
+    }
+    throw err;
+  }
+});
+
+/**
+ * PUT /vfs/:path — write file.
+ *
+ * Optionally accepts `X-Vfs-Expected-Version` header for optimistic concurrency.
+ * Returns {ok: true, version: <new>} or {ok: false, conflict: {serverVersion, serverEtag}}.
+ */
+vfsRoute.put("/:path{.+}", async (c) => {
+  const tableName = vfsTableName();
+  const bucketName = vfsBucketName();
+  if (!tableName || !bucketName) {
+    return c.json({ error: "VFS not configured" }, 503);
+  }
+
+  const filePath = c.req.param("path");
+  const workspaceId = c.get("workspaceId");
+  const content = await c.req.text();
+  const expectedVersionHeader = c.req.header("X-Vfs-Expected-Version");
+  const expectedVersion = expectedVersionHeader !== undefined
+    ? parseInt(expectedVersionHeader, 10)
+    : undefined;
+
+  const fileKey = s3Key(workspaceId, filePath);
+  const now = new Date().toISOString();
+  const byteSize = new TextEncoder().encode(content).length;
+
+  await getS3().send(
+    new PutObjectCommand({
+      Bucket: bucketName,
+      Key: fileKey,
+      Body: content,
+      ContentType: "text/plain; charset=utf-8",
+    }),
+  );
+
+  try {
+    const condExpr =
+      expectedVersion !== undefined
+        ? "attribute_not_exists(PK) OR version = :expected"
+        : undefined;
+
+    const exprAttrValues: Record<string, unknown> = {
+      ":mtime": now,
+      ":sz": byteSize,
+      ":s3Key": fileKey,
+      ":inc": 1,
+      ":zero": 0,
+    };
+    if (expectedVersion !== undefined) {
+      exprAttrValues[":expected"] = expectedVersion;
+    }
+
+    const result = await getDdb().send(
+      new UpdateCommand({
+        TableName: tableName,
+        Key: { PK: pk(workspaceId), SK: sk(filePath) },
+        UpdateExpression:
+          "SET #mt = :mtime, #sz = :sz, s3Key = :s3Key, version = if_not_exists(version, :zero) + :inc",
+        ExpressionAttributeNames: { "#mt": "mtime", "#sz": "size" },
+        ExpressionAttributeValues: exprAttrValues,
+        ...(condExpr ? { ConditionExpression: condExpr } : {}),
+        ReturnValues: "ALL_NEW",
+      }),
+    );
+
+    const newVersion = (result.Attributes as VfsDdbItem | undefined)?.version ?? 1;
+    return c.json({ ok: true, version: newVersion });
+  } catch (err: unknown) {
+    if (err instanceof ConditionalCheckFailedException) {
+      const metaResult = await getDdb().send(
+        new GetCommand({
+          TableName: tableName,
+          Key: { PK: pk(workspaceId), SK: sk(filePath) },
+          ProjectionExpression: "version, etag",
+        }),
+      );
+      const item = metaResult.Item as Pick<VfsDdbItem, "version" | "etag"> | undefined;
+      return c.json(
+        {
+          ok: false,
+          conflict: {
+            serverVersion: item?.version ?? 0,
+            serverEtag: item?.etag,
+          },
+        },
+        409,
+      );
+    }
+    throw err;
+  }
+});
+
+/** DELETE /vfs/:path — remove from S3 + DDB. */
+vfsRoute.delete("/:path{.+}", async (c) => {
+  const tableName = vfsTableName();
+  const bucketName = vfsBucketName();
+  if (!tableName || !bucketName) {
+    return c.json({ error: "VFS not configured" }, 503);
+  }
+
+  const filePath = c.req.param("path");
+  const workspaceId = c.get("workspaceId");
+  const fileKey = s3Key(workspaceId, filePath);
+
+  await Promise.all([
+    getDdb().send(
+      new DeleteCommand({
+        TableName: tableName,
+        Key: { PK: pk(workspaceId), SK: sk(filePath) },
+      }),
+    ),
+    getS3().send(
+      new DeleteObjectCommand({ Bucket: bucketName, Key: fileKey }),
+    ),
+  ]);
+
+  return c.body(null, 204);
+});
+
+/** POST /vfs/:path?mkdir=true — no-op (S3 is keyless). */
+vfsRoute.post("/:path{.+}", (c) => {
+  if (c.req.query("mkdir") === "true") {
+    return c.body(null, 204);
+  }
+  return c.json({ error: "unsupported operation" }, 400);
+});

package/src/routes/workspace.ts

@@ -0,0 +1,41 @@
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient, UpdateCommand } from "@aws-sdk/lib-dynamodb";
+import { Hono } from "hono";
+import { evictWorkspaceCache } from "../middleware/workspace.js";
+import type { AppVariables } from "../types.js";
+
+let ddbClient: DynamoDBDocumentClient | null = null;
+
+function getDdb() {
+  if (!ddbClient) {
+    ddbClient = DynamoDBDocumentClient.from(
+      new DynamoDBClient({ region: process.env["AWS_REGION"] }),
+    );
+  }
+  return ddbClient;
+}
+
+export const workspaceRoute = new Hono<{ Variables: AppVariables }>();
+
+/** POST /api/workspace — switch the caller's active workspace. */
+workspaceRoute.post("/", async (c) => {
+  const claims = c.get("claims");
+  const body = await c.req.json<{ workspaceId?: string }>();
+  const workspaceId = body?.workspaceId;
+  if (!workspaceId || typeof workspaceId !== "string") {
+    return c.json({ error: "workspaceId is required" }, 400);
+  }
+
+  await getDdb().send(
+    new UpdateCommand({
+      TableName: process.env["USERS_TABLE_NAME"]!,
+      Key: { sub: claims.sub },
+      UpdateExpression: "SET activeWorkspaceId = :ws",
+      ExpressionAttributeValues: { ":ws": workspaceId },
+    }),
+  );
+
+  evictWorkspaceCache(claims.sub);
+
+  return c.json({ activeWorkspaceId: workspaceId });
+});

package/test/app.test.ts

@@ -20,8 +20,7 @@ vi.mock("@aws-sdk/lib-dynamodb", () => ({
   },
   QueryCommand: vi.fn((input) => input),
   GetCommand: vi.fn((input) => input),
-  PutCommand: vi.fn((input) => input),
-  BatchGetCommand: vi.fn((input) => input),
+  UpdateCommand: vi.fn((input) => input),
 }));
 
 beforeAll(() => {
@@ -30,7 +29,7 @@ beforeAll(() => {
   process.env["AWS_REGION"] = "us-east-1";
   process.env["WORKSPACE_TABLE_NAME"] = "test-workspaces";
   process.env["MEMBERSHIPS_TABLE_NAME"] = "test-memberships";
-  process.env["USER_SESSIONS_TABLE_NAME"] = "test-user-sessions";
+  process.env["USERS_TABLE_NAME"] = "test-users";
 });
 
 describe("chat app", () => {

package/test/middleware/workspace.test.ts

@@ -3,6 +3,7 @@ import { Hono } from "hono";
 import type { AppVariables } from "../../src/types";
 import type { CognitoAccessTokenPayload } from "aws-jwt-verify/jwt-model";
 
+// Mock the DDB client before importing the middleware
 vi.mock("@aws-sdk/client-dynamodb", () => ({
   DynamoDBClient: vi.fn(() => ({})),
 }));
@@ -14,109 +15,158 @@ vi.mock("@aws-sdk/lib-dynamodb", () => ({
   },
   QueryCommand: vi.fn((input) => input),
   GetCommand: vi.fn((input) => input),
-  PutCommand: vi.fn((input) => input),
 }));
 
-const {
-  workspaceMiddleware,
-  listWorkspaceMemberships,
-  resetMembershipCache,
-} = await import("../../src/middleware/workspace");
-const { resetSessionCache } = await import("../../src/session");
+const { workspaceMiddleware, resolveWorkspaceId, evictWorkspaceCache } = await import(
+  "../../src/middleware/workspace"
+);
 
-const MEMBERSHIPS_TABLE = "gateway-prd-use1-memberships";
-const SESSIONS_TABLE = "test-user-sessions";
+const fakeClaims = {
+  sub: "user-sub-123",
+} as unknown as CognitoAccessTokenPayload;
 
-type MockCommand = { TableName?: string };
-
-function buildApp(userSub: string) {
-  const fakeClaims = { sub: userSub } as unknown as CognitoAccessTokenPayload;
+function buildApp() {
   const app = new Hono<{ Variables: AppVariables }>();
   app.use("/protected", async (c, next) => {
     c.set("claims", fakeClaims);
     await next();
   });
   app.use("/protected", workspaceMiddleware);
-  app.get("/protected", (c) => c.json({ workspaceId: c.get("workspaceId") }));
+  app.get("/protected", (c) =>
+    c.json({ workspaceId: c.get("workspaceId") }),
+  );
   return app;
 }
 
 describe("workspaceMiddleware", () => {
   beforeEach(() => {
     vi.clearAllMocks();
-    resetMembershipCache();
-    resetSessionCache();
-    process.env["MEMBERSHIPS_TABLE_NAME"] = MEMBERSHIPS_TABLE;
-    process.env["USER_SESSIONS_TABLE_NAME"] = SESSIONS_TABLE;
+    process.env["MEMBERSHIPS_TABLE_NAME"] = "gateway-prd-use1-memberships";
+    process.env["USERS_TABLE_NAME"] = "gateway-prd-use1-users";
     process.env["AWS_REGION"] = "us-east-1";
+    // Clear module-level cache between tests
+    evictWorkspaceCache("user-sub-123");
+    evictWorkspaceCache("user-sub-456");
+    evictWorkspaceCache("user-no-ws");
+    evictWorkspaceCache("user-cached");
+    evictWorkspaceCache("user-users-table");
+    evictWorkspaceCache("user-fallback");
   });
 
-  it("uses session activeWorkspaceId when membership is valid", async () => {
-    mockSend.mockImplementation((cmd: MockCommand) => {
-      if (cmd.TableName === SESSIONS_TABLE) {
-        return Promise.resolve({ Item: { activeWorkspaceId: "ws-b" } });
-      }
-      return Promise.resolve({ Items: [{ workspaceId: "ws-a" }, { workspaceId: "ws-b" }] });
+  it("uses activeWorkspaceId from Users table when present", async () => {
+    // Users table returns activeWorkspaceId — no Memberships query needed
+    mockSend.mockResolvedValueOnce({
+      Item: { sub: "user-users-table", activeWorkspaceId: "ws-from-users" },
+    });
+
+    const app = new Hono<{ Variables: AppVariables }>();
+    const localClaims = { sub: "user-users-table" } as unknown as CognitoAccessTokenPayload;
+    app.use("/protected", async (c, next) => {
+      c.set("claims", localClaims);
+      await next();
     });
+    app.use("/protected", workspaceMiddleware);
+    app.get("/protected", (c) => c.json({ workspaceId: c.get("workspaceId") }));
 
-    const app = buildApp("user-session");
     const res = await app.request("/protected");
     expect(res.status).toBe(200);
     const body = await res.json();
-    expect(body.workspaceId).toBe("ws-b");
+    expect(body).toEqual({ workspaceId: "ws-from-users" });
+    // Only one DDB call (Users Get), no Memberships query
+    expect(mockSend).toHaveBeenCalledTimes(1);
   });
 
-  it("falls back to first membership when no session preference exists", async () => {
-    mockSend.mockImplementation((cmd: MockCommand) => {
-      if (cmd.TableName === SESSIONS_TABLE) {
-        return Promise.resolve({ Item: undefined });
-      }
-      return Promise.resolve({ Items: [{ workspaceId: "ws-first" }] });
+  it("falls back to Memberships when Users table has no activeWorkspaceId", async () => {
+    // Users Get returns no item; Memberships query returns ws-from-memberships
+    mockSend
+      .mockResolvedValueOnce({}) // Users GetCommand → no item
+      .mockResolvedValueOnce({
+        Items: [{ workspaceId: "ws-from-memberships", userSub: "user-fallback" }],
+      }); // Memberships QueryCommand
+
+    const app = new Hono<{ Variables: AppVariables }>();
+    const localClaims = { sub: "user-fallback" } as unknown as CognitoAccessTokenPayload;
+    app.use("/protected", async (c, next) => {
+      c.set("claims", localClaims);
+      await next();
     });
+    app.use("/protected", workspaceMiddleware);
+    app.get("/protected", (c) => c.json({ workspaceId: c.get("workspaceId") }));
 
-    const app = buildApp("user-no-session");
     const res = await app.request("/protected");
     expect(res.status).toBe(200);
     const body = await res.json();
-    expect(body.workspaceId).toBe("ws-first");
+    expect(body).toEqual({ workspaceId: "ws-from-memberships" });
+    expect(mockSend).toHaveBeenCalledTimes(2);
   });
 
-  it("falls back to first membership when session workspace is not in memberships", async () => {
-    mockSend.mockImplementation((cmd: MockCommand) => {
-      if (cmd.TableName === SESSIONS_TABLE) {
-        return Promise.resolve({ Item: { activeWorkspaceId: "ws-stale" } });
-      }
-      return Promise.resolve({ Items: [{ workspaceId: "ws-a" }] });
+  it("resolves workspaceId from DDB and sets it on context", async () => {
+    mockSend
+      .mockResolvedValueOnce({}) // Users GetCommand → no item
+      .mockResolvedValueOnce({
+        Items: [{ workspaceId: "ws-abc", userSub: "user-sub-456" }],
+      });
+
+    const app = new Hono<{ Variables: AppVariables }>();
+    const localClaims = { sub: "user-sub-456" } as unknown as CognitoAccessTokenPayload;
+    app.use("/protected", async (c, next) => {
+      c.set("claims", localClaims);
+      await next();
     });
+    app.use("/protected", workspaceMiddleware);
+    app.get("/protected", (c) => c.json({ workspaceId: c.get("workspaceId") }));
 
-    const app = buildApp("user-stale");
     const res = await app.request("/protected");
     expect(res.status).toBe(200);
     const body = await res.json();
-    expect(body.workspaceId).toBe("ws-a");
+    expect(body).toEqual({ workspaceId: "ws-abc" });
   });
 
-  it("returns 403 when user has no workspace memberships", async () => {
-    mockSend.mockImplementation((cmd: MockCommand) => {
-      if (cmd.TableName === SESSIONS_TABLE) {
-        return Promise.resolve({ Item: undefined });
-      }
-      return Promise.resolve({ Items: [] });
+  it("returns 403 when no membership exists and Users table has no activeWorkspaceId", async () => {
+    mockSend
+      .mockResolvedValueOnce({}) // Users GetCommand → no item
+      .mockResolvedValueOnce({ Items: [] }); // Memberships QueryCommand → empty
+
+    const app = new Hono<{ Variables: AppVariables }>();
+    const localClaims = {
+      sub: "user-no-ws",
+    } as unknown as CognitoAccessTokenPayload;
+    app.use("/protected", async (c, next) => {
+      c.set("claims", localClaims);
+      await next();
     });
+    app.use("/protected", workspaceMiddleware);
+    app.get("/protected", (c) => c.json({ workspaceId: c.get("workspaceId") }));
 
-    const app = buildApp("user-no-ws");
     const res = await app.request("/protected");
     expect(res.status).toBe(403);
     const body = await res.json();
     expect(body).toMatchObject({ error: "No workspace membership" });
   });
 
-  it("uses membership cache on subsequent calls for the same sub", async () => {
-    mockSend.mockResolvedValue({ Items: [{ workspaceId: "ws-cached" }] });
+  it("uses cache on subsequent calls for the same sub", async () => {
+    mockSend.mockResolvedValueOnce({
+      Item: { activeWorkspaceId: "ws-cached" },
+    });
+
+    // First call — hits DDB
+    await resolveWorkspaceId("user-cached");
+    // Second call — should use cache
+    await resolveWorkspaceId("user-cached");
 
-    await listWorkspaceMemberships("user-cached-q");
-    await listWorkspaceMemberships("user-cached-q");
-    // Only one DDB send for memberships (cache hit on second call)
     expect(mockSend).toHaveBeenCalledTimes(1);
   });
+
+  it("evictWorkspaceCache clears the cache so next call re-fetches", async () => {
+    mockSend
+      .mockResolvedValueOnce({ Item: { activeWorkspaceId: "ws-v1" } })
+      .mockResolvedValueOnce({ Item: { activeWorkspaceId: "ws-v2" } });
+
+    await resolveWorkspaceId("user-cached");
+    evictWorkspaceCache("user-cached");
+    const result = await resolveWorkspaceId("user-cached");
+
+    expect(mockSend).toHaveBeenCalledTimes(2);
+    expect(result).toBe("ws-v2");
+  });
 });