@glwhappen/web-code 1.32.1 → 1.32.3

package/server/modules/database/repositories/queued-messages.db.ts

@@ -0,0 +1,154 @@
+import { randomUUID } from 'node:crypto';
+
+import { getConnection } from '@/modules/database/connection.js';
+
+export type QueuedMessageRow = {
+  id: string;
+  user_id: number;
+  session_id: string;
+  provider: string;
+  content: string;
+  permission_mode: string | null;
+  model: string | null;
+  metadata_json: string | null;
+  created_at: string;
+  updated_at: string;
+};
+
+export type QueuedMessage = {
+  id: string;
+  userId: number;
+  sessionId: string;
+  provider: string;
+  content: string;
+  permissionMode: string | null;
+  model: string | null;
+  metadata: unknown;
+  createdAt: string;
+  updatedAt: string;
+};
+
+type CreateQueuedMessageInput = {
+  provider: string;
+  content: string;
+  permissionMode?: string | null;
+  model?: string | null;
+  metadata?: unknown;
+};
+
+type UpdateQueuedMessageInput = Partial<Pick<CreateQueuedMessageInput, 'content' | 'permissionMode' | 'model' | 'metadata'>>;
+
+function serializeMetadata(metadata: unknown): string | null {
+  if (metadata === undefined || metadata === null) {
+    return null;
+  }
+  return JSON.stringify(metadata);
+}
+
+function parseMetadata(metadataJson: string | null): unknown {
+  if (!metadataJson) {
+    return null;
+  }
+
+  try {
+    return JSON.parse(metadataJson);
+  } catch {
+    return null;
+  }
+}
+
+function mapQueuedMessage(row: QueuedMessageRow): QueuedMessage {
+  return {
+    id: row.id,
+    userId: row.user_id,
+    sessionId: row.session_id,
+    provider: row.provider,
+    content: row.content,
+    permissionMode: row.permission_mode,
+    model: row.model,
+    metadata: parseMetadata(row.metadata_json),
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+  };
+}
+
+export const queuedMessagesDb = {
+  listBySession(userId: number, sessionId: string): QueuedMessage[] {
+    const db = getConnection();
+    const rows = db
+      .prepare(
+        `SELECT id, user_id, session_id, provider, content, permission_mode, model, metadata_json, created_at, updated_at
+         FROM queued_messages
+         WHERE user_id = ? AND session_id = ?
+         ORDER BY rowid ASC`
+      )
+      .all(userId, sessionId) as QueuedMessageRow[];
+
+    return rows.map(mapQueuedMessage);
+  },
+
+  create(userId: number, sessionId: string, input: CreateQueuedMessageInput): QueuedMessage {
+    const db = getConnection();
+    const id = randomUUID();
+    db.prepare(
+      `INSERT INTO queued_messages (id, user_id, session_id, provider, content, permission_mode, model, metadata_json)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+    ).run(
+      id,
+      userId,
+      sessionId,
+      input.provider,
+      input.content,
+      input.permissionMode ?? null,
+      input.model ?? null,
+      serializeMetadata(input.metadata),
+    );
+
+    return this.getById(userId, sessionId, id)!;
+  },
+
+  getById(userId: number, sessionId: string, id: string): QueuedMessage | null {
+    const db = getConnection();
+    const row = db
+      .prepare(
+        `SELECT id, user_id, session_id, provider, content, permission_mode, model, metadata_json, created_at, updated_at
+         FROM queued_messages
+         WHERE user_id = ? AND session_id = ? AND id = ?
+         LIMIT 1`
+      )
+      .get(userId, sessionId, id) as QueuedMessageRow | undefined;
+
+    return row ? mapQueuedMessage(row) : null;
+  },
+
+  update(userId: number, sessionId: string, id: string, input: UpdateQueuedMessageInput): QueuedMessage | null {
+    const existing = this.getById(userId, sessionId, id);
+    if (!existing) {
+      return null;
+    }
+
+    const db = getConnection();
+    db.prepare(
+      `UPDATE queued_messages
+       SET content = ?, permission_mode = ?, model = ?, metadata_json = ?, updated_at = CURRENT_TIMESTAMP
+       WHERE user_id = ? AND session_id = ? AND id = ?`
+    ).run(
+      input.content ?? existing.content,
+      input.permissionMode ?? existing.permissionMode,
+      input.model ?? existing.model,
+      input.metadata === undefined ? serializeMetadata(existing.metadata) : serializeMetadata(input.metadata),
+      userId,
+      sessionId,
+      id,
+    );
+
+    return this.getById(userId, sessionId, id);
+  },
+
+  delete(userId: number, sessionId: string, id: string): boolean {
+    const db = getConnection();
+    return db
+      .prepare('DELETE FROM queued_messages WHERE user_id = ? AND session_id = ? AND id = ?')
+      .run(userId, sessionId, id).changes > 0;
+  },
+};

package/server/modules/database/schema.ts

@@ -102,6 +102,22 @@ CREATE TABLE IF NOT EXISTS sessions (
 );
 `;
 
+export const QUEUED_MESSAGES_TABLE_SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS queued_messages (
+    id TEXT PRIMARY KEY NOT NULL,
+    user_id INTEGER NOT NULL,
+    session_id TEXT NOT NULL,
+    provider TEXT NOT NULL,
+    content TEXT NOT NULL,
+    permission_mode TEXT,
+    model TEXT,
+    metadata_json TEXT,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+`;
+
 export const LAST_SCANNED_AT_SQL = `
 CREATE TABLE IF NOT EXISTS scan_state (
   id INTEGER PRIMARY KEY CHECK (id = 1),
@@ -153,6 +169,9 @@ CREATE INDEX IF NOT EXISTS idx_session_ids_lookup ON sessions(session_id);
 -- NOTE: This index is created in migrations after sessions is rebuilt to include project_path.
 -- Creating it here can fail on upgraded installs where the legacy sessions table has no project_path.
 
+${QUEUED_MESSAGES_TABLE_SCHEMA_SQL}
+CREATE INDEX IF NOT EXISTS idx_queued_messages_session ON queued_messages(user_id, session_id, created_at);
+
 ${LAST_SCANNED_AT_SQL}
 
 ${APP_CONFIG_TABLE_SCHEMA_SQL}

package/server/modules/projects/index.ts

@@ -1,3 +1,6 @@
+export {
+  assertUserOwnsProjectPath,
+} from './services/project-authorization.service.js';
 export {
   generateDisplayName,
   getProjectsWithSessions,

package/server/modules/providers/provider.routes.ts

@@ -1,5 +1,6 @@
 import express, { type Request, type Response } from 'express';
 
+import { queuedMessagesDb } from '@/modules/database/index.js';
 import { providerAuthService } from '@/modules/providers/services/provider-auth.service.js';
 import { providerMcpService } from '@/modules/providers/services/mcp.service.js';
 import { providerSkillsService } from '@/modules/providers/services/skills.service.js';
@@ -52,6 +53,8 @@ const normalizeProviderParam = (value: unknown): string =>
   readPathParam(value, 'provider').trim().toLowerCase();
 
 const SESSION_ID_PATTERN = /^[a-zA-Z0-9._-]{1,120}$/;
+const QUEUED_MESSAGE_ID_PATTERN = /^[a-zA-Z0-9._-]{1,120}$/;
+const MAX_QUEUED_MESSAGE_LENGTH = 100_000;
 
 const parseSessionId = (value: unknown): string => {
   const sessionId = readPathParam(value, 'sessionId').trim();
@@ -65,6 +68,18 @@ const parseSessionId = (value: unknown): string => {
   return sessionId;
 };
 
+const parseQueuedMessageId = (value: unknown): string => {
+  const queueId = readPathParam(value, 'queueId').trim();
+  if (!QUEUED_MESSAGE_ID_PATTERN.test(queueId)) {
+    throw new AppError('Invalid queueId.', {
+      code: 'INVALID_QUEUE_ID',
+      statusCode: 400,
+    });
+  }
+
+  return queueId;
+};
+
 const readOptionalQueryString = (value: unknown): string | undefined => {
   if (typeof value !== 'string') {
     return undefined;
@@ -206,6 +221,46 @@ const parseProvider = (value: unknown): LLMProvider => {
   });
 };
 
+const parseQueuedMessagePayload = (payload: unknown) => {
+  if (!payload || typeof payload !== 'object') {
+    throw new AppError('Request body must be an object.', {
+      code: 'INVALID_REQUEST_BODY',
+      statusCode: 400,
+    });
+  }
+
+  const body = payload as Record<string, unknown>;
+  const content = typeof body.content === 'string' ? body.content.trim() : '';
+  if (!content) {
+    throw new AppError('content is required.', {
+      code: 'QUEUED_MESSAGE_CONTENT_REQUIRED',
+      statusCode: 400,
+    });
+  }
+  if (content.length > MAX_QUEUED_MESSAGE_LENGTH) {
+    throw new AppError('content is too long.', {
+      code: 'QUEUED_MESSAGE_CONTENT_TOO_LONG',
+      statusCode: 400,
+    });
+  }
+
+  const provider = typeof body.provider === 'string' ? body.provider.trim().toLowerCase() : '';
+  if (provider !== 'claude' && provider !== 'codex' && provider !== 'cursor' && provider !== 'gemini') {
+    throw new AppError('provider is invalid.', {
+      code: 'INVALID_PROVIDER',
+      statusCode: 400,
+    });
+  }
+
+  return {
+    content,
+    provider,
+    permissionMode: typeof body.permissionMode === 'string' ? body.permissionMode : null,
+    model: typeof body.model === 'string' ? body.model : null,
+    metadata: body.metadata,
+  };
+};
+
 const parseSessionRenameSummary = (payload: unknown): string => {
   if (!payload || typeof payload !== 'object') {
     throw new AppError('Request body must be an object.', {
@@ -391,6 +446,60 @@ router.put(
   }),
 );
 
+router.get(
+  '/sessions/:sessionId/queued-messages',
+  asyncHandler(async (req: Request, res: Response) => {
+    const userId = getAuthenticatedUserId(req);
+    const sessionId = parseSessionId(req.params.sessionId);
+    const messages = queuedMessagesDb.listBySession(userId, sessionId);
+    res.json(createApiSuccessResponse({ messages }));
+  }),
+);
+
+router.post(
+  '/sessions/:sessionId/queued-messages',
+  asyncHandler(async (req: Request, res: Response) => {
+    const userId = getAuthenticatedUserId(req);
+    const sessionId = parseSessionId(req.params.sessionId);
+    const message = queuedMessagesDb.create(userId, sessionId, parseQueuedMessagePayload(req.body));
+    res.status(201).json(createApiSuccessResponse({ message }));
+  }),
+);
+
+router.put(
+  '/sessions/:sessionId/queued-messages/:queueId',
+  asyncHandler(async (req: Request, res: Response) => {
+    const userId = getAuthenticatedUserId(req);
+    const sessionId = parseSessionId(req.params.sessionId);
+    const queueId = parseQueuedMessageId(req.params.queueId);
+    const message = queuedMessagesDb.update(userId, sessionId, queueId, parseQueuedMessagePayload(req.body));
+    if (!message) {
+      throw new AppError('Queued message not found.', {
+        code: 'QUEUED_MESSAGE_NOT_FOUND',
+        statusCode: 404,
+      });
+    }
+    res.json(createApiSuccessResponse({ message }));
+  }),
+);
+
+router.delete(
+  '/sessions/:sessionId/queued-messages/:queueId',
+  asyncHandler(async (req: Request, res: Response) => {
+    const userId = getAuthenticatedUserId(req);
+    const sessionId = parseSessionId(req.params.sessionId);
+    const queueId = parseQueuedMessageId(req.params.queueId);
+    const deleted = queuedMessagesDb.delete(userId, sessionId, queueId);
+    if (!deleted) {
+      throw new AppError('Queued message not found.', {
+        code: 'QUEUED_MESSAGE_NOT_FOUND',
+        statusCode: 404,
+      });
+    }
+    res.json(createApiSuccessResponse({ deleted: true }));
+  }),
+);
+
 router.get(
   '/sessions/:sessionId/messages',
   asyncHandler(async (req: Request, res: Response) => {

package/server/modules/websocket/services/chat-websocket.service.ts

@@ -1,6 +1,6 @@
 import type { WebSocket } from 'ws';
 
-import { assertUserOwnsProjectPath } from '@/modules/projects/services/project-authorization.service.js';
+import { assertUserOwnsProjectPath } from '@/modules/projects/index.js';
 import { connectedClients } from '@/modules/websocket/services/websocket-state.service.js';
 import { WebSocketWriter } from '@/modules/websocket/services/websocket-writer.service.js';
 import type {