@igstack/app-catalog-backend-core 0.15.0 → 0.16.0

package/src/db/client.ts

@@ -6,6 +6,120 @@ import { buildPgSslConfig } from './sslConfig'
 let prismaClient: PrismaClient | null = null
 let pool: pg.Pool | null = null
 
+type PrismaLogOption = NonNullable<
+  ConstructorParameters<typeof PrismaClient>[0]
+>['log']
+
+/**
+ * The schema a deployment should be reading and writing.
+ *
+ * DB_SCHEMA is set per deployment, so it outranks a schema baked into the app
+ * config - otherwise a config that names `public` would pin a preview env back
+ * to the shared tables it was meant to be isolated from.
+ */
+export function resolveDbSchema(configuredSchema?: string): string | undefined {
+  return process.env.DB_SCHEMA || configuredSchema || undefined
+}
+
+/**
+ * `search_path` startup options for a schema-isolated deployment.
+ *
+ * node-postgres ignores Prisma's `?schema=` URL parameter, so a preview env's
+ * schema has to be injected as a connection option instead. This half covers
+ * raw SQL and the migrations; Prisma's own queries need the adapter half too,
+ * which is why every core connection goes through createCorePrismaClient.
+ */
+export function buildPgSchemaOptions(configuredSchema?: string): {
+  options?: string
+} {
+  const schema = resolveDbSchema(configuredSchema)
+  return schema ? { options: `-c search_path=${schema}` } : {}
+}
+
+/**
+ * The one way to open a connection to the core database.
+ *
+ * Schema isolation takes two halves and both live here:
+ * - the pool's `search_path`, which raw SQL and the migrations follow;
+ * - the adapter's `schema`, which is what Prisma qualifies its table names
+ *   with. A client built without it emits `"public"."DbResource"` however
+ *   correct the pool's `current_schema()` is, so a preview env silently reads
+ *   and overwrites the shared canonical tables.
+ *
+ * A pool built outside this factory gets neither half, so don't build one.
+ */
+export function createCorePrismaClient(params: {
+  connectionString: string
+  configuredSchema?: string
+  log?: PrismaLogOption
+}): { client: PrismaClient; pool: pg.Pool; schema: string | undefined } {
+  const schema = resolveDbSchema(params.configuredSchema)
+  // SSL comes from PGSSLMODE/PGSSLROOTCERT via our helper (node-postgres
+  // doesn't honor those correctly for a connection-string pool - see
+  // buildPgSslConfig).
+  const ssl = buildPgSslConfig()
+  const newPool = new pg.Pool({
+    connectionString: params.connectionString,
+    ...(ssl === undefined ? {} : { ssl }),
+    ...buildPgSchemaOptions(params.configuredSchema),
+  })
+  const adapter = new PrismaPg(newPool, { schema })
+  const client = new PrismaClient({
+    adapter,
+    ...(params.log === undefined ? {} : { log: params.log }),
+  })
+  return { client, pool: newPool, schema }
+}
+
+/** Postgres NAMEDATALEN - 1: identifiers are truncated to this many bytes. */
+const PG_MAX_IDENTIFIER_BYTES = 63
+
+/**
+ * How Postgres will have stored an identifier this long.
+ *
+ * A schema name over the limit is truncated identically wherever it appears - at
+ * CREATE SCHEMA and in `search_path` alike - so the isolation still holds and
+ * current_schema() merely reports the shortened name. Comparing raw strings would
+ * fail a correctly isolated deployment, so compare what Postgres kept.
+ */
+function truncateIdentifier(name: string): string {
+  const bytes = Buffer.from(name, 'utf8')
+  if (bytes.length <= PG_MAX_IDENTIFIER_BYTES) return name
+  return bytes.subarray(0, PG_MAX_IDENTIFIER_BYTES).toString('utf8')
+}
+
+/**
+ * Fails a deployment that believes it is schema-isolated but is not.
+ *
+ * Speaks up whenever a schema was resolved at all - the same resolution feeds the
+ * pool's `search_path`, so the expectation and the connection can never disagree
+ * by construction, and a deployment that configures isolation without setting
+ * DB_SCHEMA is checked too. The case worth catching is a missing schema: Postgres
+ * silently skips a `search_path` entry that does not exist and falls through to
+ * `public`, which is the shared-catalog corruption this is here to prevent.
+ */
+export async function verifyDbSchema(
+  poolToCheck: pg.Pool,
+  configuredSchema?: string,
+): Promise<void> {
+  const resolved = resolveDbSchema(configuredSchema)
+  const result = await poolToCheck.query<{ schema: string | null }>(
+    'SELECT current_schema() AS schema',
+  )
+  const actual = result.rows[0]?.schema ?? null
+  console.log(
+    `[db] core schema: resolved=${resolved ?? '(none)'} current_schema=${actual ?? '(none)'}`,
+  )
+  if (!resolved) return
+  if (actual !== truncateIdentifier(resolved)) {
+    throw new Error(
+      `The configured schema is "${resolved}" but the database resolved current_schema() to ` +
+        `"${actual}". The schema is most likely missing, so every query would fall through to ` +
+        `the shared catalog tables. Migrate this schema before starting the app.`,
+    )
+  }
+}
+
 /**
  * Gets the internal Prisma client instance.
  * Creates one if it doesn't exist.
@@ -20,18 +134,9 @@ export function getDbClient(): PrismaClient {
       )
     }
 
-    // Prisma 7 with adapter: Create pg pool and wrap with adapter.
-    // SSL comes from PGSSLMODE/PGSSLROOTCERT via our helper (node-postgres
-    // doesn't honor those correctly for a connection-string pool — see
-    // buildPgSslConfig).
-    const ssl = buildPgSslConfig()
-    pool = new pg.Pool({
-      connectionString: databaseUrl,
-      ...(ssl === undefined ? {} : { ssl }),
-    })
-    const adapter = new PrismaPg(pool)
-
-    prismaClient = new PrismaClient({ adapter })
+    const created = createCorePrismaClient({ connectionString: databaseUrl })
+    pool = created.pool
+    prismaClient = created.client
   }
   return prismaClient
 }
@@ -51,6 +156,7 @@ export function setDbClient(client: PrismaClient): void {
 export async function connectDb(): Promise<void> {
   const client = getDbClient()
   await client.$connect()
+  if (pool) await verifyDbSchema(pool)
 }
 
 /**

package/src/db/index.ts

@@ -1,5 +1,14 @@
 // Database connection
-export { connectDb, disconnectDb, getDbClient, setDbClient } from './client'
+export {
+  buildPgSchemaOptions,
+  connectDb,
+  createCorePrismaClient,
+  disconnectDb,
+  getDbClient,
+  resolveDbSchema,
+  setDbClient,
+  verifyDbSchema,
+} from './client'
 export { buildPgSslConfig } from './sslConfig'
 
 // Table sync utilities

package/src/index.ts

@@ -59,14 +59,18 @@ export {
 
 // Database utilities
 export {
+  buildPgSchemaOptions,
   buildPgSslConfig,
   connectDb,
+  createCorePrismaClient,
   disconnectDb,
   getDbClient,
+  resolveDbSchema,
   setDbClient,
   syncAppCatalog,
   TABLE_SYNC_MAGAZINE,
   tableSyncPrisma,
+  verifyDbSchema,
   type MakeTFromPrismaModel,
   type ObjectKeys,
   type ScalarFilter,

package/src/middleware/database.ts

@@ -1,9 +1,11 @@
-import { PrismaClient } from '../generated/prisma/client'
-import { PrismaPg } from '@prisma/adapter-pg'
-import pg from 'pg'
+import type { PrismaClient } from '../generated/prisma/client'
+import type pg from 'pg'
 import type { AcDatabaseConfig } from './types'
-import { setDbClient } from '../db/client'
-import { buildPgSslConfig } from '../db/sslConfig'
+import {
+  createCorePrismaClient,
+  setDbClient,
+  verifyDbSchema,
+} from '../db/client'
 
 /**
  * Formats a database connection URL from structured config.
@@ -36,25 +38,19 @@ export class AcDatabaseManager {
    */
   getClient(): PrismaClient {
     if (!this.client) {
-      const datasourceUrl = formatConnectionUrl(this.config)
-
-      // Prisma 7 with adapter: Create pg pool and wrap with adapter.
-      // SSL from PGSSLMODE/PGSSLROOTCERT via buildPgSslConfig (node-postgres
-      // doesn't apply those correctly to a connection-string pool).
-      const ssl = buildPgSslConfig()
-      this.pool = new pg.Pool({
-        connectionString: datasourceUrl,
-        ...(ssl === undefined ? {} : { ssl }),
-      })
-      const adapter = new PrismaPg(this.pool)
-
-      this.client = new PrismaClient({
-        adapter,
+      // This client - not getDbClient()'s - is the one the app ends up using.
+      // The `?schema=` in the url is inert (node-postgres drops unknown URL
+      // params), so the schema has to travel via createCorePrismaClient.
+      const created = createCorePrismaClient({
+        connectionString: formatConnectionUrl(this.config),
+        configuredSchema: this.configuredSchema(),
         log:
           process.env.NODE_ENV === 'development'
             ? ['warn', 'error']
             : ['warn', 'error'],
       })
+      this.pool = created.pool
+      this.client = created.client
 
       // Bridge with existing backend-core getDbClient() usage
       setDbClient(this.client)
@@ -65,6 +61,7 @@ export class AcDatabaseManager {
   async connect(): Promise<void> {
     const client = this.getClient()
     await client.$connect()
+    if (this.pool) await verifyDbSchema(this.pool, this.configuredSchema())
   }
 
   async disconnect(): Promise<void> {
@@ -77,4 +74,8 @@ export class AcDatabaseManager {
       this.pool = null
     }
   }
+
+  private configuredSchema(): string | undefined {
+    return 'url' in this.config ? undefined : this.config.schema
+  }
 }

package/src/modules/admin/chat/createDatabaseTools.ts

@@ -37,7 +37,11 @@ export function createPrismaDatabaseClient(prisma: {
     },
     getTables: async () => {
       const tables = await prisma.$queryRawUnsafe<{ tablename: string }[]>(
-        `SELECT tablename FROM pg_tables WHERE schemaname = 'public'`,
+        // current_schema() - not a hardcoded 'public' - because the DML these
+        // tools go on to run is unqualified and therefore resolves through
+        // search_path. A schema-isolated deployment would otherwise be told
+        // about tables it cannot see.
+        `SELECT tablename FROM pg_tables WHERE schemaname = current_schema()`,
       )
       return tables.map((t) => t.tablename)
     },
@@ -51,7 +55,7 @@ export function createPrismaDatabaseClient(prisma: {
       >(
         `SELECT column_name, data_type, is_nullable
          FROM information_schema.columns
-         WHERE table_name = '${tableName}' AND table_schema = 'public'`,
+         WHERE table_name = '${tableName}' AND table_schema = current_schema()`,
       )
       return columns.map((c) => ({
         name: c.column_name,

package/src/modules/assets/assetCache.ts

@@ -0,0 +1,30 @@
+import type { Request, Response } from 'express'
+
+/**
+ * Asset URLs are keyed by row id or by icon name, and `upsertAsset` replaces
+ * content in place rather than inserting a new row — so the bytes behind a
+ * given URL can change. A long `max-age` would then serve the old artwork for
+ * the whole window (an icon replacement stayed invisible for a day). Revalidate
+ * against the stored checksum instead: unchanged content still costs only a
+ * conditional request answered with 304, and a replacement shows up at once.
+ *
+ * `variant` distinguishes derived renditions of the same row (a resize width,
+ * for example) so they do not share one entity tag.
+ */
+export function setRevalidatingCacheHeaders(
+  res: Response,
+  checksum: string,
+  variant?: string | number,
+): string {
+  const etag =
+    variant === undefined ? `"${checksum}"` : `"${checksum}-${variant}"`
+
+  res.setHeader('ETag', etag)
+  res.setHeader('Cache-Control', 'public, max-age=0, must-revalidate')
+
+  return etag
+}
+
+export function isNotModified(req: Request, etag: string): boolean {
+  return req.headers['if-none-match'] === etag
+}

package/src/modules/assets/assetRestController.ts

@@ -4,6 +4,7 @@ import sharp from 'sharp'
 import { getDbClient } from '../../db'
 import { getImageFormat, isRasterImage, resizeImage } from './assetUtils'
 import { upsertAsset } from './upsertAsset'
+import { isNotModified, setRevalidatingCacheHeaders } from './assetCache'
 
 // Configure multer for memory storage
 const upload = multer({
@@ -106,6 +107,7 @@ export function registerAssetRestController(
           name: true,
           width: true,
           height: true,
+          checksum: true,
         },
       })
 
@@ -129,6 +131,17 @@ export function registerAssetRestController(
         Number.isFinite(width) &&
         width > 0
 
+      // Answered before resizing, so an unchanged asset costs no image work.
+      const etag = setRevalidatingCacheHeaders(
+        res,
+        asset.checksum,
+        shouldResize ? `w${width}` : undefined,
+      )
+      if (isNotModified(req, etag)) {
+        res.status(304).end()
+        return
+      }
+
       if (shouldResize) {
         const fmt = getImageFormat(asset.mimeType) || 'jpeg'
         const buf = await resizeImage(
@@ -144,7 +157,6 @@ export function registerAssetRestController(
       // Set appropriate headers
       res.setHeader('Content-Type', outMime)
       res.setHeader('Content-Disposition', `inline; filename="${asset.name}"`)
-      res.setHeader('Cache-Control', 'public, max-age=86400') // Cache for 1 day
 
       // Send binary content (resized if requested)
       res.send(outBuffer)
@@ -204,6 +216,7 @@ export function registerAssetRestController(
             name: true,
             width: true,
             height: true,
+            checksum: true,
           },
         })
 
@@ -229,6 +242,17 @@ export function registerAssetRestController(
           Number.isFinite(width) &&
           width > 0
 
+        // Answered before resizing, so an unchanged asset costs no image work.
+        const etag = setRevalidatingCacheHeaders(
+          res,
+          asset.checksum,
+          shouldResize ? `w${width}` : undefined,
+        )
+        if (isNotModified(req, etag)) {
+          res.status(304).end()
+          return
+        }
+
         if (shouldResize) {
           const fmt = asset.mimeType.includes('png')
             ? 'png'
@@ -258,7 +282,6 @@ export function registerAssetRestController(
         // Set appropriate headers
         res.setHeader('Content-Type', outMime)
         res.setHeader('Content-Disposition', `inline; filename="${asset.name}"`)
-        res.setHeader('Cache-Control', 'public, max-age=86400') // Cache for 1 day
 
         // Send binary content (resized if requested)
         res.send(outBuffer)

package/src/modules/assets/assetUtils.ts

@@ -99,6 +99,7 @@ export async function parseAssetMeta(
     tiff: 'image/tiff',
     gif: 'image/gif',
     heif: 'image/heif',
+    svg: 'image/svg+xml',
     raw: 'application/octet-stream',
   }
 

package/src/modules/assets/screenshotRestController.ts

@@ -1,6 +1,7 @@
 import type { Request, Response, Router } from 'express'
 import sharp from 'sharp'
 import { getDbClient } from '../../db'
+import { isNotModified, setRevalidatingCacheHeaders } from './assetCache'
 
 export interface ScreenshotRestControllerConfig {
   /**
@@ -133,6 +134,7 @@ export function registerScreenshotRestController(
           content: true,
           mimeType: true,
           name: true,
+          checksum: true,
         },
       })
 
@@ -141,6 +143,17 @@ export function registerScreenshotRestController(
         return
       }
 
+      // Answered before resizing, so an unchanged screenshot costs no image work.
+      const etag = setRevalidatingCacheHeaders(
+        res,
+        screenshot.checksum,
+        targetSize && targetSize > 0 ? `s${targetSize}` : undefined,
+      )
+      if (isNotModified(req, etag)) {
+        res.status(304).end()
+        return
+      }
+
       let content: Uint8Array | Buffer = screenshot.content
 
       // Resize if size parameter provided
@@ -164,7 +177,6 @@ export function registerScreenshotRestController(
         'Content-Disposition',
         `inline; filename="${screenshot.name}"`,
       )
-      res.setHeader('Cache-Control', 'public, max-age=86400') // Cache for 1 day
 
       // Send binary content
       res.send(content)

package/src/modules/assets/upsertAsset.ts

@@ -27,6 +27,14 @@ export async function upsertAsset({
   })
 
   if (existing) {
+    // Reusing the stored binary must not keep a mimeType we no longer derive:
+    // rows written by an older, wrong derivation would never be corrected.
+    if (existing.mimeType !== mimeType) {
+      await prisma.dbAsset.update({
+        where: { id: existing.id },
+        data: { mimeType },
+      })
+    }
     return existing.id
   }
 

package/src/modules/icons/iconRestController.ts

@@ -3,6 +3,10 @@ import multer from 'multer'
 import { createHash } from 'node:crypto'
 import { getDbClient } from '../../db'
 import { getExtensionFromFilename, getExtensionFromMimeType } from './iconUtils'
+import {
+  isNotModified,
+  setRevalidatingCacheHeaders,
+} from '../assets/assetCache'
 
 // Configure multer for memory storage
 const upload = multer({
@@ -112,6 +116,7 @@ export function registerIconRestController(
           content: true,
           mimeType: true,
           name: true,
+          checksum: true,
         },
       })
 
@@ -120,10 +125,15 @@ export function registerIconRestController(
         return
       }
 
+      const etag = setRevalidatingCacheHeaders(res, icon.checksum)
+      if (isNotModified(req, etag)) {
+        res.status(304).end()
+        return
+      }
+
       // Set appropriate headers
       res.setHeader('Content-Type', icon.mimeType)
       res.setHeader('Content-Disposition', `inline; filename="${icon.name}"`)
-      res.setHeader('Cache-Control', 'public, max-age=86400') // Cache for 1 day
 
       // Send binary content
       res.send(icon.content)

package/src/modules/lighthouseKeeper/tools.ts

@@ -1,8 +1,6 @@
 import type { Tool } from 'ai'
 import { z } from 'zod'
-import { PrismaClient } from '../../generated/prisma/client'
-import { PrismaPg } from '@prisma/adapter-pg'
-import pg from 'pg'
+import { createCorePrismaClient } from '../../db/client'
 import type { AcDatabaseConfig } from '../../middleware/types.js'
 
 // ============================================================================
@@ -27,10 +25,11 @@ function getDatabaseUrl(config: AcDatabaseConfig): string {
 export function createAppCatalogAITools(
   databaseConfig: AcDatabaseConfig,
 ): Record<string, Tool> {
-  const databaseUrl = getDatabaseUrl(databaseConfig)
-  const pool = new pg.Pool({ connectionString: databaseUrl })
-  const adapter = new PrismaPg(pool)
-  const prisma = new PrismaClient({ adapter })
+  const { client: prisma } = createCorePrismaClient({
+    connectionString: getDatabaseUrl(databaseConfig),
+    configuredSchema:
+      'url' in databaseConfig ? undefined : databaseConfig.schema,
+  })
 
   const getAppCardSchema = z.object({
     slug: z.string().describe('The app slug to fetch'),