@axiom-lattice/pg-stores 3.1.8 → 3.1.10

package/src/stores/PostgreSQLOpenAuditStore.ts

@@ -0,0 +1,143 @@
+import { Pool } from "pg";
+import type { PoolConfig } from "pg";
+import type {
+  OpenAuditStore,
+  OpenAuditAppendInput,
+  OpenAuditQuery,
+  OpenAuditRecord,
+} from "@axiom-lattice/protocols";
+import { MigrationManager } from "../migrations/migration";
+import { createOpenAuditTable } from "../migrations/create_open_audit_table";
+
+export interface PostgreSQLOpenAuditStoreOptions {
+  pool?: Pool;
+  poolConfig?: string | PoolConfig;
+  autoMigrate?: boolean;
+}
+
+/** Append-only PostgreSQL audit store for the Open API surface. */
+export class PostgreSQLOpenAuditStore implements OpenAuditStore {
+  private pool: Pool;
+  private migrationManager!: MigrationManager;
+  private initialized = false;
+  private ownsPool = true;
+  private initPromise: Promise<void> | null = null;
+
+  constructor(options: PostgreSQLOpenAuditStoreOptions) {
+    if (options.pool) {
+      this.pool = options.pool;
+      this.ownsPool = false;
+      this.initialized = true;
+      return;
+    }
+    this.pool =
+      typeof options.poolConfig === "string"
+        ? new Pool({ connectionString: options.poolConfig })
+        : options.poolConfig
+          ? new Pool(options.poolConfig as PoolConfig)
+          : (() => {
+              throw new Error("Either pool or poolConfig must be provided");
+            })();
+    this.migrationManager = new MigrationManager(this.pool);
+    this.migrationManager.register(createOpenAuditTable);
+    if (options.autoMigrate !== false) {
+      this.initialize().catch((error) => {
+        console.error("Failed to initialize PostgreSQLOpenAuditStore:", error);
+        throw error;
+      });
+    }
+  }
+
+  async initialize(): Promise<void> {
+    if (this.initialized) return;
+    if (this.initPromise) return this.initPromise;
+    this.initPromise = (async () => {
+      try {
+        await this.migrationManager.migrate();
+        this.initialized = true;
+      } finally {
+        this.initPromise = null;
+      }
+    })();
+    return this.initPromise;
+  }
+
+  async dispose(): Promise<void> {
+    if (this.ownsPool && this.pool) await this.pool.end();
+  }
+
+  private async ensureInitialized(): Promise<void> {
+    if (!this.initialized) await this.initialize();
+  }
+
+  async query(params: OpenAuditQuery): Promise<OpenAuditRecord[]> {
+    await this.ensureInitialized();
+    const clauses = ["tenant_id = $1"];
+    const values: unknown[] = [params.tenantId];
+    if (params.credentialId) {
+      values.push(params.credentialId);
+      clauses.push(`credential_id = $${values.length}`);
+    }
+    if (params.domain) {
+      values.push(params.domain);
+      clauses.push(`domain = $${values.length}`);
+    }
+    if (params.status) {
+      values.push(params.status);
+      clauses.push(`status = $${values.length}`);
+    }
+    if (params.from) {
+      values.push(params.from);
+      clauses.push(`created_at >= $${values.length}`);
+    }
+    if (params.to) {
+      values.push(params.to);
+      clauses.push(`created_at < $${values.length}`);
+    }
+    const limit = params.limit ?? 100;
+    const offset = params.offset ?? 0;
+    values.push(limit, offset);
+    const { rows } = await this.pool.query(
+      `SELECT * FROM lattice_open_audit
+       WHERE ${clauses.join(" AND ")}
+       ORDER BY created_at DESC
+       LIMIT $${values.length - 1} OFFSET $${values.length}`,
+      values,
+    );
+    return rows.map((row) => ({
+      id: row.id,
+      tenantId: row.tenant_id,
+      credentialId: row.credential_id,
+      credentialKind: row.credential_kind,
+      projectId: row.project_id,
+      domain: row.domain,
+      action: row.action,
+      args: row.args,
+      status: row.status,
+      errorCode: row.error_code ?? undefined,
+      durationMs: row.duration_ms,
+      createdAt: row.created_at,
+    }));
+  }
+
+  async append(record: OpenAuditAppendInput): Promise<void> {
+    await this.ensureInitialized();
+    await this.pool.query(
+      `INSERT INTO lattice_open_audit
+        (tenant_id, credential_id, credential_kind, project_id, domain, action, args, status, error_code, duration_ms)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)`,
+      [
+        record.tenantId,
+        record.credentialId,
+        record.credentialKind,
+        record.projectId,
+        record.domain,
+        record.action,
+        record.args === undefined ? null : JSON.stringify(record.args),
+        record.status,
+        record.errorCode ?? null,
+        Math.max(0, Math.round(record.durationMs)),
+      ],
+    );
+  }
+}

package/src/stores/PostgreSQLProjectRoomMessageStore.ts

@@ -83,6 +83,25 @@ function mapRow(row: MessageRow): ProjectRoomMessage {
     ...(row.idempotency_key === null ? {} : { idempotencyKey: row.idempotency_key }), createdAt: row.created_at,
   };
 }
+function mapRowsTolerant(
+  rows: MessageRow[],
+  scope: { tenantId: string; roomId: string },
+): ProjectRoomMessage[] {
+  const messages: ProjectRoomMessage[] = [];
+  for (const row of rows) {
+    try {
+      messages.push(mapRow(row));
+    } catch (error) {
+      console.warn("[ProjectRoomMessageStore] Skipping invalid message row", {
+        tenantId: scope.tenantId,
+        roomId: scope.roomId,
+        rowId: typeof row.id === "string" ? row.id : undefined,
+        reason: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+  return messages;
+}
 function isUniqueViolation(error: unknown): error is PostgreSQLError {
   return typeof error === "object" && error !== null && "code" in error
     && (error as PostgreSQLError).code === "23505";
@@ -159,7 +178,7 @@ export class PostgreSQLProjectRoomMessageStore implements ProjectRoomMessageStor
          WHERE tenant_id = $1 AND room_id = $2 ORDER BY created_at DESC, id DESC LIMIT $3`,
         [input.tenantId, input.roomId, limit],
       );
-    return result.rows.map(mapRow);
+    return mapRowsTolerant(result.rows, { tenantId: input.tenantId, roomId: input.roomId });
   }
 
   /** Finds a message by tenant-scoped ID. */

package/src/stores/PostgresSharedResourceStore.ts

@@ -25,6 +25,7 @@ type ShareRow = {
   password_hash: string | null;
   expires_at: string | null;
   max_access: number | null;
+  open_grants: unknown[] | null;
   access_count: number;
   revoked: boolean;
   created_at: string;
@@ -106,8 +107,8 @@ export class PostgresSharedResourceStore implements SharedResourceStore {
       `INSERT INTO lattice_shared_resources
        (token, address, title, created_by, tenant_id, workspace_id, project_id,
         assistant_id, vm_isolation, visibility, password_hash,
-        expires_at, max_access, revoked)
-       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14)
+        expires_at, max_access, open_grants, revoked)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)
        RETURNING *`,
       [
         record.token,
@@ -123,6 +124,7 @@ export class PostgresSharedResourceStore implements SharedResourceStore {
         record.passwordHash,
         record.expiresAt ? record.expiresAt.toISOString() : null,
         record.maxAccess,
+        record.openGrants ? JSON.stringify(record.openGrants) : null,
         record.revoked,
       ],
     );
@@ -229,6 +231,7 @@ export class PostgresSharedResourceStore implements SharedResourceStore {
       passwordHash: row.password_hash,
       expiresAt: row.expires_at ? new Date(row.expires_at) : null,
       maxAccess: row.max_access,
+      openGrants: (row.open_grants as ShareRecord["openGrants"]) ?? undefined,
       accessCount: row.access_count ?? 0,
       revoked: row.revoked ?? false,
       createdAt: new Date(row.created_at),