@crombolo/data 0.10.0 → 0.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crombolo/data",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "SQLite and Postgres storage for crombolo: schema, migrations and repositories.",
   "license": "MIT",
   "author": "Crombolo",
@@ -28,6 +28,6 @@
     "access": "public"
   },
   "dependencies": {
-    "@crombolo/core": "0.10.0"
+    "@crombolo/core": "0.11.0"
   }
 }

package/src/audit.ts

@@ -0,0 +1,291 @@
+/**
+ * The audit log: who did what, when and from where. Entries are only ever
+ * added, read and aged out; nothing edits one. docs/audit-log.md.
+ */
+import { normaliseUuid } from '@crombolo/core'
+import type { Db } from './database.ts'
+import { DbDate } from './dialect.ts'
+import { STATE_AUDIT_LOG } from './schema/audit-log.ts'
+
+export type AuditCategory =
+  | 'content'
+  | 'media'
+  | 'member'
+  | 'schema'
+  | 'settings'
+  | 'user'
+  | 'permission'
+  | 'sign-in'
+  | 'system'
+
+export const AUDIT_CATEGORIES: readonly AuditCategory[] = [
+  'content',
+  'media',
+  'member',
+  'schema',
+  'settings',
+  'user',
+  'permission',
+  'sign-in',
+  'system',
+]
+
+/** Where an entry came from: a request (with its address), the command line, or a background job. */
+export type AuditSource = 'request' | 'cli' | 'job'
+
+export interface AuditEntryInput {
+  category: AuditCategory
+  action: string
+  source: AuditSource
+  userKey?: string | null
+  /** The user's name when the entry was written; for a failed sign-in, the login tried. */
+  userName?: string | null
+  entityType?: string | null
+  entityKey?: string | null
+  entityName?: string | null
+  ipAddress?: string | null
+  forwardedFor?: string | null
+  detail?: string | null
+  occurredAt?: Date
+}
+
+export interface AuditEntry {
+  id: number
+  occurredAt: Date
+  category: AuditCategory
+  action: string
+  source: AuditSource
+  userKey: string | null
+  userName: string | null
+  entityType: string | null
+  entityKey: string | null
+  entityName: string | null
+  ipAddress: string | null
+  forwardedFor: string | null
+  detail: string | null
+}
+
+export interface AuditFilter {
+  userKey?: string
+  entityKey?: string
+  category?: AuditCategory
+  action?: string
+  since?: Date
+  until?: Date
+  /** Matched anywhere in the item's name or key, or the user's name. */
+  text?: string
+  ascending?: boolean
+}
+
+/** What a key names, for an entry to carry once the thing itself has gone. */
+export interface AuditSubject {
+  entityType: string
+  entityKey: string
+  entityName: string | null
+}
+
+const UUID = /^\{?[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\}?$/i
+
+const LIMITS = {
+  action: 64,
+  userName: 255,
+  entityType: 64,
+  entityKey: 255,
+  entityName: 255,
+  ipAddress: 64,
+  forwardedFor: 255,
+  detail: 4000,
+} as const
+
+function clip(value: string | null | undefined, limit: number): string | null {
+  if (value === null || value === undefined || value === '') return null
+  return value.length > limit ? value.slice(0, limit) : value
+}
+
+function text(value: unknown): string | null {
+  return value === null || value === undefined ? null : String(value)
+}
+
+function toEntry(row: Record<string, unknown>): AuditEntry {
+  return {
+    id: Number(row.id),
+    occurredAt: DbDate.fromDb(row.occurred_at) ?? new Date(0),
+    category: String(row.category) as AuditCategory,
+    action: String(row.action),
+    source: String(row.source) as AuditSource,
+    userKey: row.user_key ? normaliseUuid(String(row.user_key)) : null,
+    userName: text(row.user_name),
+    entityType: text(row.entity_type),
+    entityKey: text(row.entity_key),
+    entityName: text(row.entity_name),
+    ipAddress: text(row.ip_address),
+    forwardedFor: text(row.forwarded_for),
+    detail: text(row.detail),
+  }
+}
+
+export class AuditLog {
+  #db: Db
+
+  constructor(db: Db) {
+    this.#db = db
+  }
+
+  async record(entries: AuditEntryInput | readonly AuditEntryInput[]): Promise<void> {
+    const list = Array.isArray(entries) ? entries : [entries as AuditEntryInput]
+    for (const entry of list) {
+      const userKey =
+        entry.userKey && UUID.test(entry.userKey) ? normaliseUuid(entry.userKey) : null
+      const entityKey =
+        entry.entityKey && UUID.test(entry.entityKey)
+          ? normaliseUuid(entry.entityKey)
+          : entry.entityKey
+      await this.#db.exec(
+        `INSERT INTO audit_entry (occurred_at, category, action, user_key, user_name, entity_type,
+           entity_key, entity_name, source, ip_address, forwarded_for, detail)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        [
+          DbDate.toDb(entry.occurredAt ?? new Date()),
+          entry.category,
+          clip(entry.action, LIMITS.action),
+          userKey,
+          clip(entry.userName, LIMITS.userName),
+          clip(entry.entityType, LIMITS.entityType),
+          clip(entityKey, LIMITS.entityKey),
+          clip(entry.entityName, LIMITS.entityName),
+          entry.source,
+          clip(entry.ipAddress, LIMITS.ipAddress),
+          clip(entry.forwardedFor, LIMITS.forwardedFor),
+          clip(entry.detail, LIMITS.detail),
+        ],
+      )
+    }
+  }
+
+  async query(
+    filter: AuditFilter = {},
+    page: { skip: number; take: number } = { skip: 0, take: 100 },
+  ): Promise<{ total: number; items: AuditEntry[] }> {
+    const where: string[] = []
+    const params: unknown[] = []
+    if (filter.userKey !== undefined) {
+      if (!UUID.test(filter.userKey)) return { total: 0, items: [] }
+      where.push('user_key = ?')
+      params.push(normaliseUuid(filter.userKey))
+    }
+    if (filter.entityKey !== undefined) {
+      where.push('entity_key = ?')
+      params.push(UUID.test(filter.entityKey) ? normaliseUuid(filter.entityKey) : filter.entityKey)
+    }
+    if (filter.category !== undefined) {
+      where.push('category = ?')
+      params.push(filter.category)
+    }
+    if (filter.action !== undefined) {
+      where.push('action = ?')
+      params.push(filter.action)
+    }
+    if (filter.since !== undefined) {
+      where.push('occurred_at >= ?')
+      params.push(DbDate.toDb(filter.since))
+    }
+    if (filter.until !== undefined) {
+      where.push('occurred_at < ?')
+      params.push(DbDate.toDb(filter.until))
+    }
+    const needle = filter.text?.trim().toLowerCase()
+    if (needle) {
+      const like = `%${needle.replace(/[\\%_]/g, (c) => `\\${c}`)}%`
+      where.push(
+        `(LOWER(entity_name) LIKE ? ESCAPE '\\' OR LOWER(entity_key) LIKE ? ESCAPE '\\' OR LOWER(user_name) LIKE ? ESCAPE '\\')`,
+      )
+      params.push(like, like, like)
+    }
+    const clause = where.length > 0 ? `WHERE ${where.join(' AND ')}` : ''
+    const counted = await this.#db.query<{ total: number }>(
+      `SELECT COUNT(*) AS total FROM audit_entry ${clause}`,
+      params,
+    )
+    const order = filter.ascending ? 'ASC' : 'DESC'
+    const rows = await this.#db.query(
+      `SELECT * FROM audit_entry ${clause} ORDER BY occurred_at ${order}, id ${order} LIMIT ? OFFSET ?`,
+      [...params, page.take, page.skip],
+    )
+    return { total: Number(counted[0]?.total ?? 0), items: rows.map(toEntry) }
+  }
+
+  /** Everyone the log names, by the name they had most recently. */
+  async users(): Promise<Array<{ key: string; name: string }>> {
+    const rows = await this.#db.query<{ user_key: string; user_name: string | null }>(
+      `SELECT e.user_key, e.user_name FROM audit_entry e
+       JOIN (SELECT user_key, MAX(id) AS id FROM audit_entry WHERE user_key IS NOT NULL GROUP BY user_key) latest
+         ON latest.id = e.id
+       ORDER BY e.user_name`,
+    )
+    return rows.map((row) => ({
+      key: normaliseUuid(String(row.user_key)),
+      name: row.user_name ? String(row.user_name) : '',
+    }))
+  }
+
+  /** Deletes entries older than `before`, and returns how many went. */
+  async prune(before: Date): Promise<number> {
+    const counted = await this.#db.query<{ total: number }>(
+      'SELECT COUNT(*) AS total FROM audit_entry WHERE occurred_at < ?',
+      [DbDate.toDb(before)],
+    )
+    const total = Number(counted[0]?.total ?? 0)
+    if (total > 0)
+      await this.#db.exec('DELETE FROM audit_entry WHERE occurred_at < ?', [DbDate.toDb(before)])
+    return total
+  }
+
+  /** When this database began keeping the log; history before it is in the content versions. */
+  async startedAt(): Promise<Date | undefined> {
+    const rows = await this.#db.query<{ applied_at: unknown }>(
+      'SELECT MIN(applied_at) AS applied_at FROM migration_history WHERE to_state = ?',
+      [STATE_AUDIT_LOG],
+    )
+    return DbDate.fromDb(rows[0]?.applied_at)
+  }
+
+  /**
+   * What a key names. A version answers for the item it belongs to, so a
+   * rollback is filed under the page it rolled back.
+   */
+  async describe(entityType: string, key: string): Promise<AuditSubject> {
+    const named = (entityName: unknown, type = entityType, entityKey = key): AuditSubject => ({
+      entityType: type,
+      entityKey,
+      entityName: entityName === null || entityName === undefined ? null : String(entityName),
+    })
+    if (entityType.endsWith('Version') && /^\d+$/.test(key)) {
+      const rows = await this.#db.query<{ unique_id: string; text: string | null }>(
+        'SELECT n.unique_id, n.text FROM content_version cv JOIN node n ON n.id = cv.node_id WHERE cv.id = ?',
+        [Number(key)],
+      )
+      const row = rows[0]
+      const owner = entityType.slice(0, -'Version'.length)
+      return row ? named(row.text, owner, normaliseUuid(String(row.unique_id))) : named(null)
+    }
+    if (entityType === 'Language') {
+      const rows = await this.#db.query<{ culture_name: string }>(
+        'SELECT culture_name FROM language WHERE iso_code = ?',
+        [key],
+      )
+      return named(rows[0]?.culture_name ?? null)
+    }
+    if (!UUID.test(key)) return named(null)
+    const uuid = normaliseUuid(key)
+    const sql =
+      entityType === 'User'
+        ? 'SELECT user_name AS name FROM user_account WHERE key = ?'
+        : entityType === 'UserGroup'
+          ? 'SELECT name FROM user_group WHERE key = ?'
+          : entityType === 'DictionaryItem'
+            ? 'SELECT item_key AS name FROM dictionary_item WHERE key = ?'
+            : 'SELECT text AS name FROM node WHERE unique_id = ?'
+    const rows = await this.#db.query<{ name: string | null }>(sql, [uuid])
+    return named(rows[0]?.name ?? null, entityType, uuid)
+  }
+}

package/src/database.ts

@@ -1,5 +1,7 @@
 /** Driver-agnostic database handle. */
+
 import { Database as BunSqlite } from 'bun:sqlite'
+import { AsyncLocalStorage } from 'node:async_hooks'
 import { type Dialect, type DialectName, dialectFor } from './dialect.ts'
 import { createLockManager, type LockManager } from './locks.ts'
 
@@ -22,16 +24,32 @@ export interface ConnectOptions {
   url?: string
 }
 
+/** The connection the current async chain holds a transaction on. */
+const transacting = new AsyncLocalStorage<BunSqlite>()
+
+/**
+ * One connection has one transaction at a time, but async chains interleave:
+ * a background job's BEGIN between a request's BEGIN and COMMIT would fail, or
+ * worse, land its statements in the request's transaction. So top-level
+ * transactions queue here, and a chain already inside one joins it.
+ */
 class SqliteDb implements Db {
   readonly dialect = dialectFor('sqlite')
   readonly locks: LockManager
   #db: BunSqlite
   #inTransaction: boolean
-
-  constructor(db: BunSqlite, locks?: LockManager, inTransaction = false) {
+  #gate: { tail: Promise<void> }
+
+  constructor(
+    db: BunSqlite,
+    locks?: LockManager,
+    inTransaction = false,
+    gate: { tail: Promise<void> } = { tail: Promise.resolve() },
+  ) {
     this.#db = db
     this.locks = locks ?? createLockManager(this)
     this.#inTransaction = inTransaction
+    this.#gate = gate
   }
 
   async query<T = Record<string, unknown>>(sql: string, params: unknown[] = []): Promise<T[]> {
@@ -44,14 +62,26 @@ class SqliteDb implements Db {
 
   async transaction<T>(fn: (tx: Db) => Promise<T>): Promise<T> {
     if (this.#inTransaction) return fn(this)
-    this.#db.exec('BEGIN')
+    const tx = new SqliteDb(this.#db, this.locks, true, this.#gate)
+    if (transacting.getStore() === this.#db) return fn(tx)
+    const previous = this.#gate.tail
+    let release!: () => void
+    this.#gate.tail = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    await previous
     try {
-      const result = await fn(new SqliteDb(this.#db, this.locks, true))
-      this.#db.exec('COMMIT')
-      return result
-    } catch (error) {
-      this.#db.exec('ROLLBACK')
-      throw error
+      this.#db.exec('BEGIN')
+      try {
+        const result = await transacting.run(this.#db, () => fn(tx))
+        this.#db.exec('COMMIT')
+        return result
+      } catch (error) {
+        this.#db.exec('ROLLBACK')
+        throw error
+      }
+    } finally {
+      release()
     }
   }
 

package/src/dialect.ts

@@ -36,6 +36,16 @@ export interface Dialect {
   /** Appended to a SELECT that must block a concurrent state change; empty where the engine is single-writer. */
   readonly forShare: string
   readonly forUpdate: string
+  /** Appended to a SELECT that claims rows, passing over any another connection holds. */
+  readonly forUpdateSkipLocked: string
+  /**
+   * The full-text match over `search_document`: a subquery of `node_id` and
+   * `score`, higher being better, for each item holding every term as a word
+   * prefix. Its one parameter is `fullTextQuery(terms)`. docs/search.md.
+   */
+  readonly fullTextHits: string
+  /** Terms are already folded words: letters and digits only. */
+  fullTextQuery(terms: readonly string[]): string
   /**
    * SQL that moves a table's identity past rows inserted with explicit ids, or
    * undefined where the engine does that itself.
@@ -71,6 +81,15 @@ export const sqliteDialect: Dialect = {
   boolValue: (value) => (value ? 1 : 0),
   forShare: '',
   forUpdate: '',
+  forUpdateSkipLocked: '',
+  // Name hits weigh ten times body hits; bm25 is lower-is-better, so negated.
+  // bm25 cannot be called under an aggregate, and `LIMIT -1` (no limit) keeps
+  // SQLite from flattening the inner query into the outer one, which would.
+  fullTextHits: `SELECT sd.node_id AS node_id, MAX(f.score) AS score
+    FROM (SELECT rowid AS id, -bm25(search_document_fts, 10.0, 1.0) AS score
+          FROM search_document_fts WHERE search_document_fts MATCH ? LIMIT -1) f
+    JOIN search_document sd ON sd.id = f.id GROUP BY sd.node_id`,
+  fullTextQuery: (terms) => terms.map((term) => `"${term}"*`).join(' AND '),
   syncIdentity: () => undefined,
 }
 
@@ -102,6 +121,11 @@ export const postgresDialect: Dialect = {
   boolValue: (value) => value,
   forShare: 'FOR SHARE',
   forUpdate: 'FOR UPDATE',
+  forUpdateSkipLocked: 'FOR UPDATE SKIP LOCKED',
+  fullTextHits: `SELECT sd.node_id AS node_id, MAX(ts_rank(sd.terms, q)) AS score
+    FROM search_document sd, to_tsquery('simple', ?) q
+    WHERE sd.terms @@ q GROUP BY sd.node_id`,
+  fullTextQuery: (terms) => terms.map((term) => `${term}:*`).join(' & '),
   syncIdentity: (table) =>
     `SELECT setval(pg_get_serial_sequence('${table}', 'id'), (SELECT COALESCE(MAX(id), 1) FROM ${table}))`,
 }

package/src/index.ts

@@ -1,3 +1,4 @@
+export * from './audit.ts'
 export * from './bundle-tables/index.ts'
 export * from './change-report.ts'
 export * from './cluster.ts'
@@ -31,6 +32,7 @@ export * from './repositories/transfer-runs.ts'
 export * from './repositories/user-data.ts'
 export * from './repositories/users.ts'
 export * from './schema/assistant.ts'
+export * from './schema/audit-log.ts'
 export * from './schema/built-in-content-types.ts'
 export * from './schema/built-in-media-types.ts'
 export * from './schema/built-in-member-types.ts'
@@ -49,9 +51,11 @@ export * from './schema/log-viewer.ts'
 export * from './schema/member-property-type.ts'
 export * from './schema/members.ts'
 export * from './schema/plan.ts'
+export * from './schema/property-searchable.ts'
 export * from './schema/public-access.ts'
 export * from './schema/recycle-bin.ts'
 export * from './schema/rich-text-ui.ts'
+export * from './schema/search-index.ts'
 export * from './schema/seed.ts'
 export * from './schema/since-version.ts'
 export * from './schema/transfer-run-package.ts'
@@ -61,3 +65,5 @@ export * from './schema/users-localisation.ts'
 export * from './schema/values.ts'
 export * from './schema-ops.ts'
 export * from './schema-state.ts'
+export * from './search.ts'
+export * from './search-text.ts'

package/src/repositories/content-types.ts

@@ -27,10 +27,26 @@ import type { Db } from '../database.ts'
 import { DbDate, fromDbBool } from '../dialect.ts'
 import { pendingUntil } from '../pending.ts'
 import type { NodeSchemaState } from '../schema-state.ts'
+import { queueContentTypesForSearch, queueEverythingForSearch } from '../search.ts'
 import { NodeRepository } from './nodes.ts'
 
 const GROUP_TYPE_NAMES = ['Group', 'Tab'] as const
 
+/** The live properties of a type, by alias, variation and storage: what its items are indexed by. */
+async function propertySignature(db: Db, contentTypeNodeId: number): Promise<string> {
+  const rows = await db.query<Record<string, unknown>>(
+    `SELECT p.id, p.alias, p.variations, p.data_type_id, p.searchable FROM property_type p
+     WHERE p.content_type_id = ? AND p.retired_at IS NULL ORDER BY p.id`,
+    [contentTypeNodeId],
+  )
+  return rows
+    .map(
+      (row) =>
+        `${row.id}:${row.alias}:${row.variations}:${row.data_type_id}:${fromDbBool(row.searchable)}`,
+    )
+    .join('|')
+}
+
 export interface SaveContentTypeOptions {
   userId?: number
   /** The schema state that introduced anything created by this save. */
@@ -228,6 +244,9 @@ export class ContentTypeRepository {
         ? ((await repo.nodes.byKey(aggregate.parentKey))?.id ?? SystemNodes.Root)
         : SystemNodes.Root
 
+      // What the search index holds depends on which properties are live and what
+      // they are called, so a change to either has the type's items re-indexed.
+      const propertiesBefore = existing ? await propertySignature(tx, existing.id) : ''
       let nodeId: number
       if (existing) {
         nodeId = existing.id
@@ -361,13 +380,25 @@ export class ContentTypeRepository {
              WHERE id = ?`,
             [...columns, Number(found[0].id)],
           )
+          // Only a schema sync says; a backoffice save leaves it as it was.
+          if (property.searchable !== undefined)
+            await tx.exec('UPDATE property_type SET searchable = ? WHERE id = ?', [
+              bool(property.searchable),
+              Number(found[0].id),
+            ])
         } else {
           await tx.exec(
             `INSERT INTO property_type
                (unique_id, content_type_id, data_type_id, property_type_group_id, alias, name, description, sort_order,
-                mandatory, mandatory_message, validation_reg_exp, validation_reg_exp_message, label_on_top, variations, since_version, since_state_id)
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-            [key, nodeId, ...columns, options.sinceStateId ?? null],
+                mandatory, mandatory_message, validation_reg_exp, validation_reg_exp_message, label_on_top, variations, since_version, since_state_id, searchable)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+            [
+              key,
+              nodeId,
+              ...columns,
+              options.sinceStateId ?? null,
+              bool(property.searchable !== false),
+            ],
           )
         }
       }
@@ -451,6 +482,11 @@ export class ContentTypeRepository {
           )
       }
 
+      if (existing && propertiesBefore !== (await propertySignature(tx, nodeId))) {
+        if (aggregate.isElement) await queueEverythingForSearch(tx)
+        else await queueContentTypesForSearch(tx, [nodeId])
+      }
+
       const saved = await repo.byKey(aggregate.key)
       if (!saved) throw new Error('Content type could not be read back after saving.')
       return saved
@@ -739,7 +775,7 @@ export class ContentTypeRepository {
               p.validation_reg_exp, p.validation_reg_exp_message, p.label_on_top, p.variations,
               dtn.unique_id AS data_type_key, g.unique_id AS container_key,
               p.since_version, ss.version AS since_v, ss.revision AS since_r,
-              m.member_can_edit, m.member_can_view, m.is_sensitive
+              m.member_can_edit, m.member_can_view, m.is_sensitive, p.searchable
        FROM property_type p
        JOIN node dtn ON dtn.id = p.data_type_id
        LEFT JOIN property_type_group g ON g.id = p.property_type_group_id
@@ -766,6 +802,7 @@ export class ContentTypeRepository {
       labelOnTop: fromDbBool(row.label_on_top),
       sinceVersion: (row.since_version as string | null) ?? null,
       pending: this.#pending(row),
+      ...(fromDbBool(row.searchable) ? {} : { searchable: false }),
       ...(this.#kind === 'member'
         ? {
             memberCanEdit: fromDbBool(row.member_can_edit),

package/src/repositories/documents.ts

@@ -36,6 +36,7 @@ import {
   type SchemaStateRow,
   visibleStateIdFor,
 } from '../schema-state.ts'
+import { queueForSearch } from '../search.ts'
 import { NodeRepository, type NodeRow } from './nodes.ts'
 
 export type EventKind = 'save' | 'publish' | 'rollback' | 'migrate'
@@ -334,7 +335,11 @@ export class DocumentRepository {
       ? (await this.#nodes.byKey(options.parentKey))?.id
       : undefined
     if (options.parentKey && parentId === undefined) return { total: 0, items: [] }
-    return this.#nodes.search(this.objectType, query, { ...options, parentId })
+    return this.#nodes.search(this.objectType, query, {
+      ...options,
+      parentId,
+      fullText: this.kind === 'document' || this.kind === 'media',
+    })
   }
 
   async versions(key: string): Promise<DocumentVersionSummary[]> {
@@ -594,7 +599,10 @@ export class DocumentRepository {
         )
         written = true
       }
-      if (written) await repo.#recomputeEdited(node.id)
+      if (written) {
+        await repo.#recomputeEdited(node.id)
+        await queueForSearch(tx, [node.id])
+      }
       return written
     })
   }
@@ -2053,6 +2061,8 @@ export class DocumentRepository {
       'INSERT INTO document_version (id, template_id, published) VALUES (?, ?, ?)',
       [eventId, templateId, this.#db.dialect.boolValue(published)],
     )
+    // Every change to what an item says is an event, so this is where the search index hears of it.
+    await queueForSearch(this.#db, [nodeId])
     return eventId
   }
 

package/src/repositories/members.ts

@@ -14,6 +14,8 @@
 import { normaliseUuid, ObjectTypes } from '@crombolo/core'
 import type { Db } from '../database.ts'
 import { DbDate, fromDbBool } from '../dialect.ts'
+import { queueForSearch } from '../search.ts'
+import { searchTerms } from '../search-text.ts'
 import {
   DocumentRepository,
   type DocumentRepositoryOptions,
@@ -242,6 +244,8 @@ export class MemberRepository {
       ],
     )
     await this.#writeGroups(node.id, identity.groupKeys ?? [])
+    // Again, now the e-mail and username it is found by are written.
+    await queueForSearch(this.#db, [node.id])
     const member = await this.byKey(created.key)
     if (!member) throw new Error(`the member ${created.key} could not be read back`)
     return member
@@ -290,6 +294,7 @@ export class MemberRepository {
       ...values,
       node.id,
     ])
+    await queueForSearch(this.#db, [node.id])
     if (identity.groupKeys) await this.#writeGroups(node.id, identity.groupKeys)
     return this.byKey(key)
   }
@@ -365,9 +370,18 @@ export class MemberRepository {
     }
     const text = criteria.filter?.trim()
     if (text) {
-      wheres.push('(LOWER(m.email) LIKE ? OR LOWER(m.login_name) LIKE ? OR LOWER(n.text) LIKE ?)')
       const like = `%${text.toLowerCase()}%`
+      const terms = searchTerms(text)
+      // The index adds what a member's properties say to the name, username and e-mail.
+      const indexed =
+        terms.length > 0
+          ? ` OR m.node_id IN (SELECT node_id FROM (${this.#db.dialect.fullTextHits}) h)`
+          : ''
+      wheres.push(
+        `(LOWER(m.email) LIKE ? OR LOWER(m.login_name) LIKE ? OR LOWER(n.text) LIKE ?${indexed})`,
+      )
       values.push(like, like, like)
+      if (indexed) values.push(this.#db.dialect.fullTextQuery(terms))
     }
     const where = wheres.length > 0 ? `WHERE ${wheres.join(' AND ')}` : ''
     const order = ORDER_COLUMNS[(criteria.orderBy ?? '').toLowerCase()] ?? ORDER_COLUMNS.username