@intx/db 0.1.2 → 0.3.0

package/src/credential-resolution.ts

@@ -1,378 +0,0 @@
-import { eq, and, isNull } from "drizzle-orm";
-import { type } from "arktype";
-
-import { getLogger } from "@intx/log";
-import { CredentialRequirement as CredentialRequirementType } from "@intx/types";
-import type { InferenceSource } from "@intx/types/runtime";
-
-import type { DB } from "./client";
-import { agent } from "./schema/agents";
-import { agentSession } from "./schema/sessions";
-import { credential } from "./schema/credentials";
-import { oauthClient } from "./schema/oauth-clients";
-import { provider } from "./schema/providers";
-import { getAncestorChain } from "./tenant-hierarchy";
-
-const log = getLogger(["db", "credentials"]);
-
-const CredentialRequirements = CredentialRequirementType.array();
-
-export const ProviderMetadata = type({ baseURL: "string" });
-
-const AgentModelConfig = type({ defaultModel: "string" });
-
-/**
- * Resolves a provider by name, walking up the tenant hierarchy.
- * Returns the first match (child shadows parent).
- */
-export async function resolveProviderByName(
-  db: DB["db"],
-  tenantId: string,
-  name: string,
-) {
-  const chain = await getAncestorChain(db, tenantId);
-
-  for (const tid of chain) {
-    const row = await db.query.provider.findFirst({
-      where: and(eq(provider.tenantId, tid), eq(provider.name, name)),
-    });
-    if (row) return row;
-  }
-
-  return null;
-}
-
-/**
- * Resolves an OAuth client for a provider, walking up the tenant hierarchy.
- * Returns the first match (child shadows parent).
- */
-export async function resolveOAuthClient(
-  db: DB["db"],
-  tenantId: string,
-  providerId: string,
-) {
-  const chain = await getAncestorChain(db, tenantId);
-
-  for (const tid of chain) {
-    const row = await db.query.oauthClient.findFirst({
-      where: and(
-        eq(oauthClient.tenantId, tid),
-        eq(oauthClient.providerId, providerId),
-      ),
-    });
-    if (row) return row;
-  }
-
-  return null;
-}
-
-/**
- * Resolves a credential by name, walking up the tenant hierarchy.
- * Returns the first match (child shadows parent).
- */
-export async function resolveCredentialByName(
-  db: DB["db"],
-  tenantId: string,
-  name: string,
-) {
-  const chain = await getAncestorChain(db, tenantId);
-
-  for (const tid of chain) {
-    const row = await db.query.credential.findFirst({
-      where: and(eq(credential.tenantId, tid), eq(credential.name, name)),
-    });
-    if (row) return row;
-  }
-
-  return null;
-}
-
-/**
- * Resolves a credential by ID, validating that it belongs to the
- * given tenant or one of its ancestors.
- */
-export async function resolveCredentialById(
-  db: DB["db"],
-  tenantId: string,
-  credentialId: string,
-) {
-  const row = await db.query.credential.findFirst({
-    where: eq(credential.id, credentialId),
-  });
-
-  if (!row) return null;
-
-  const chain = await getAncestorChain(db, tenantId);
-  if (!chain.includes(row.tenantId)) return null;
-
-  return row;
-}
-
-type CredentialRequirement = {
-  providerName: string;
-  scopes?: string[];
-  source: "tenant" | "creator" | "invoker";
-  name?: string;
-};
-
-/**
- * Resolves a credential matching an agent definition requirement.
- * Used at agent launch time by the control plane.
- */
-export async function resolveCredentialRequirement(
-  db: DB["db"],
-  tenantId: string,
-  requirement: CredentialRequirement,
-  creatorPrincipalId: string | null,
-  invokerPrincipalId: string | null,
-) {
-  const resolvedProvider = await resolveProviderByName(
-    db,
-    tenantId,
-    requirement.providerName,
-  );
-  if (!resolvedProvider) return null;
-
-  const chain = await getAncestorChain(db, tenantId);
-
-  const principalFilter =
-    requirement.source === "tenant"
-      ? null
-      : requirement.source === "creator"
-        ? creatorPrincipalId
-        : invokerPrincipalId;
-
-  for (const tid of chain) {
-    const conditions = [
-      eq(credential.tenantId, tid),
-      eq(credential.providerId, resolvedProvider.id),
-      eq(credential.status, "active"),
-    ];
-
-    if (principalFilter === null) {
-      conditions.push(isNull(credential.principalId));
-    } else if (principalFilter) {
-      conditions.push(eq(credential.principalId, principalFilter));
-    }
-
-    if (requirement.name) {
-      conditions.push(eq(credential.name, requirement.name));
-    }
-
-    const rows = await db.query.credential.findMany({
-      where: and(...conditions),
-    });
-
-    const matching = rows.filter((row) => {
-      if (!requirement.scopes || requirement.scopes.length === 0) return true;
-      const rowScopes = row.scopes ?? [];
-      return requirement.scopes.every((s) => rowScopes.includes(s));
-    });
-
-    const [sole] = matching;
-    if (matching.length === 1 && sole) return sole;
-    if (matching.length > 1) {
-      throw new Error(
-        `Ambiguous credential match: ${matching.length} credentials match ` +
-          `provider=${requirement.providerName} source=${requirement.source} ` +
-          `in tenant ${tid}. Specify a name to disambiguate.`,
-      );
-    }
-  }
-
-  return null;
-}
-
-/**
- * Outcome of resolving one credential requirement to an
- * `InferenceSource`. Callers map `failed` variants to their own
- * error-handling convention (the API route surfaces 409s; the
- * background credential pushers log and continue).
- */
-export type CredentialOutcome =
-  | { ok: true; source: InferenceSource }
-  | {
-      ok: false;
-      reason: "credential_error";
-      requirement: CredentialRequirement;
-      message: string;
-    }
-  | {
-      ok: false;
-      reason: "credential_missing";
-      requirement: CredentialRequirement;
-    }
-  | {
-      ok: false;
-      reason: "skipped";
-      requirement: CredentialRequirement;
-    }
-  | {
-      ok: false;
-      reason: "provider_missing";
-      credentialId: string;
-    }
-  | {
-      ok: false;
-      reason: "provider_misconfigured";
-      providerName: string;
-      summary: string;
-    };
-
-/**
- * Resolve one credential requirement to an `InferenceSource`, stamping
- * `defaultModel` as the model identity. Skips silently (`reason:
- * "skipped"`) when the requirement targets a principal that does not
- * exist (creator without a creator id, invoker without a session
- * principal); all other failure modes are surfaced with structured
- * reasons.
- */
-export async function resolveOneCredential(
-  db: DB["db"],
-  tenantId: string,
-  req: CredentialRequirement,
-  creatorPrincipalId: string | null,
-  invokerPrincipalId: string | null,
-  defaultModel: string,
-): Promise<CredentialOutcome> {
-  // Reject requirements whose targeted principal does not exist. Without
-  // these guards a null creator or invoker would fall through to
-  // `resolveCredentialRequirement`, where the principal filter becomes
-  // `isNull(credential.principalId)` — the tenant-credential lookup — and
-  // a tenant credential would be returned as if it satisfied the
-  // creator- or invoker-source requirement.
-  if (req.source === "creator" && !creatorPrincipalId) {
-    return { ok: false, reason: "skipped", requirement: req };
-  }
-  if (req.source === "invoker" && !invokerPrincipalId) {
-    return { ok: false, reason: "skipped", requirement: req };
-  }
-
-  let resolved;
-  try {
-    resolved = await resolveCredentialRequirement(
-      db,
-      tenantId,
-      req,
-      creatorPrincipalId,
-      invokerPrincipalId,
-    );
-  } catch (err: unknown) {
-    return {
-      ok: false,
-      reason: "credential_error",
-      requirement: req,
-      message: err instanceof Error ? err.message : String(err),
-    };
-  }
-  if (!resolved) {
-    return { ok: false, reason: "credential_missing", requirement: req };
-  }
-
-  const providerRow = await db.query.provider.findFirst({
-    where: eq(provider.id, resolved.providerId),
-  });
-  if (!providerRow) {
-    return { ok: false, reason: "provider_missing", credentialId: resolved.id };
-  }
-
-  const metadata = ProviderMetadata(providerRow.metadata ?? {});
-  if (metadata instanceof type.errors) {
-    return {
-      ok: false,
-      reason: "provider_misconfigured",
-      providerName: providerRow.name,
-      summary: metadata.summary,
-    };
-  }
-
-  return {
-    ok: true,
-    source: {
-      id: `${providerRow.plugin}:${defaultModel}`,
-      provider: providerRow.plugin,
-      baseURL: metadata.baseURL,
-      apiKey: resolved.secret,
-      model: defaultModel,
-    },
-  };
-}
-
-/**
- * Resolve the full `InferenceSource[]` for a single running instance by
- * re-resolving each credential requirement from the agent definition.
- *
- * Failure modes (invalid agent definition, malformed `modelConfig`, any
- * per-credential resolution failure) collapse to an empty array with
- * structured `db.credentials` log lines. Callers that need to surface
- * per-credential outcomes to operators should call `resolveOneCredential`
- * directly — see `packages/hub-api/src/routes/instances.ts` for the
- * 409-mapping pattern.
- */
-export async function resolveInstanceSources(
-  db: DB["db"],
-  tenantId: string,
-  instance: { agentId: string; sessionId: string | null },
-): Promise<InferenceSource[]> {
-  const agentRow = await db.query.agent.findFirst({
-    where: eq(agent.id, instance.agentId),
-  });
-  if (!agentRow) return [];
-
-  const requirements = CredentialRequirements(
-    agentRow.credentialRequirements ?? [],
-  );
-  if (requirements instanceof type.errors) {
-    log.warn`Invalid credential requirements for agent ${agentRow.id}: ${requirements.summary}`;
-    return [];
-  }
-
-  const modelConfig = AgentModelConfig(agentRow.modelConfig ?? {});
-  if (modelConfig instanceof type.errors) {
-    log.warn`Invalid modelConfig for agent ${agentRow.id}: ${modelConfig.summary}`;
-    return [];
-  }
-  const defaultModel = modelConfig.defaultModel;
-
-  let invokerPrincipalId: string | null = null;
-  if (instance.sessionId) {
-    const session = await db.query.agentSession.findFirst({
-      where: eq(agentSession.id, instance.sessionId),
-    });
-    if (session) {
-      invokerPrincipalId = session.principalId;
-    }
-  }
-
-  const sources: InferenceSource[] = [];
-  for (const req of requirements) {
-    const outcome = await resolveOneCredential(
-      db,
-      tenantId,
-      req,
-      agentRow.creatorPrincipalId,
-      invokerPrincipalId,
-      defaultModel,
-    );
-    if (outcome.ok) {
-      sources.push(outcome.source);
-      continue;
-    }
-    switch (outcome.reason) {
-      case "skipped":
-        break;
-      case "credential_error":
-        log.warn`Failed to resolve credential for provider ${outcome.requirement.providerName}: ${outcome.message}`;
-        break;
-      case "credential_missing":
-        break;
-      case "provider_missing":
-        break;
-      case "provider_misconfigured":
-        log.warn`Invalid provider metadata for provider ${outcome.providerName}: ${outcome.summary}`;
-        break;
-    }
-  }
-
-  return sources;
-}

package/src/grant-store.ts

@@ -1,51 +0,0 @@
-import { eq, and, or, isNull, gt, inArray } from "drizzle-orm";
-
-import type { GrantRule, GrantStore } from "@intx/types/authz";
-
-import type { DB } from "./client";
-import { grant } from "./schema/grants";
-import { principalRole } from "./schema/roles";
-import { parseGrantRow } from "./parse-row";
-
-function toGrantRule(row: typeof grant.$inferSelect): GrantRule {
-  const parsed = parseGrantRow(row);
-  return {
-    id: parsed.id,
-    resource: parsed.resource,
-    action: parsed.action,
-    effect: parsed.effect,
-    origin: parsed.origin,
-    conditions: parsed.conditions,
-    expiresAt: parsed.expiresAt,
-    roleId: parsed.roleId,
-    principalId: parsed.principalId,
-  };
-}
-
-export function createGrantStore(db: DB["db"]): GrantStore {
-  return {
-    async collectGrants(principalId, tenantId) {
-      const roleAssignments = await db.query.principalRole.findMany({
-        where: eq(principalRole.principalId, principalId),
-      });
-      const roleIds = roleAssignments.map((a) => a.roleId);
-
-      const now = new Date();
-
-      const ownership = [eq(grant.principalId, principalId)];
-      if (roleIds.length > 0) {
-        ownership.push(inArray(grant.roleId, roleIds));
-      }
-
-      const rows = await db.query.grant.findMany({
-        where: and(
-          eq(grant.tenantId, tenantId),
-          or(...ownership),
-          or(isNull(grant.expiresAt), gt(grant.expiresAt, now)),
-        ),
-      });
-
-      return rows.map(toGrantRule);
-    },
-  };
-}

package/src/index.ts

@@ -1,32 +0,0 @@
-export { createDB, type DB } from "./client";
-export type { DBConfig } from "./config";
-export { runMigrations, dropSchema } from "./migrate";
-export { createGrantStore } from "./grant-store";
-export { getAncestorChain } from "./tenant-hierarchy";
-export {
-  resolveProviderByName,
-  resolveOAuthClient,
-  resolveCredentialByName,
-  resolveCredentialById,
-  resolveCredentialRequirement,
-  resolveOneCredential,
-  resolveInstanceSources,
-  type CredentialOutcome,
-  ProviderMetadata,
-} from "./credential-resolution";
-export {
-  parseAgentRow,
-  parseAgentVersionRow,
-  parseGrantRow,
-  parseOfferingRow,
-  parseCredentialRow,
-  parseProviderRow,
-  parseTenantRow,
-  parseWalletRow,
-  parseTransactionRow,
-  parseOAuthClientRow,
-  parseGitTokenRow,
-  parseSidecarStatus,
-  parseTurnPartType,
-} from "./parse-row";
-export * as schema from "./schema";

package/src/migrate.test.ts

@@ -1,35 +0,0 @@
-import { describe, test, expect } from "bun:test";
-
-import { rewriteSchemaQualifiedReferences } from "./migrate";
-
-describe('migration "public" substitution', () => {
-  test("rewrites schema-qualified references", () => {
-    const sql =
-      'ALTER TABLE "x" ADD CONSTRAINT "fk" FOREIGN KEY ("u") REFERENCES "public"."user"("id");';
-    expect(rewriteSchemaQualifiedReferences(sql, '"test_schema"')).toBe(
-      'ALTER TABLE "x" ADD CONSTRAINT "fk" FOREIGN KEY ("u") REFERENCES "test_schema"."user"("id");',
-    );
-  });
-
-  test("leaves bare quoted public in string literals alone", () => {
-    const sql = `INSERT INTO "x" VALUES ('"public"');`;
-    expect(rewriteSchemaQualifiedReferences(sql, '"t"')).toBe(sql);
-  });
-
-  test("substitutes multiple occurrences on a single line", () => {
-    const sql = 'REFERENCES "public"."a"("id"), "public"."b"("id")';
-    expect(rewriteSchemaQualifiedReferences(sql, '"s"')).toBe(
-      'REFERENCES "s"."a"("id"), "s"."b"("id")',
-    );
-  });
-
-  test("no-op when target schema is public", () => {
-    const sql = 'REFERENCES "public"."user"("id")';
-    expect(rewriteSchemaQualifiedReferences(sql, '"public"')).toBe(sql);
-  });
-
-  test("does not match a trailing apostrophe (bare reference)", () => {
-    const sql = `SELECT '"public"' AS literal;`;
-    expect(rewriteSchemaQualifiedReferences(sql, '"s"')).toBe(sql);
-  });
-});

package/src/migrate.ts

@@ -1,168 +0,0 @@
-import { readdir, readFile } from "node:fs/promises";
-import path from "node:path";
-
-import { type } from "arktype";
-import postgres from "postgres";
-
-import { DBConfig } from "./config";
-
-// Resolution of the migrations directory: the package layout pins
-// the drizzle-generated SQL at `<pkgRoot>/migrations`. This file
-// lives at `<pkgRoot>/src/migrate.ts`, so the directory is one level
-// up from `__dirname`. Resolving via `import.meta` keeps the runtime
-// honest about where it is reading SQL from instead of relying on a
-// cwd-relative path that breaks under callers that change `cwd`.
-const MIGRATIONS_DIR = path.resolve(
-  path.dirname(new URL(import.meta.url).pathname),
-  "..",
-  "migrations",
-);
-
-function quoteIdentifier(name: string): string {
-  return `"${name.replace(/"/g, '""')}"`;
-}
-
-/**
- * Rewrite drizzle-generated schema-qualified references like
- * `REFERENCES "public"."<table>"` so they point at the target
- * schema. The pattern matches `"public".` only when followed by
- * another quoted identifier, leaving bare `"public"` inside string
- * literals alone.
- */
-export function rewriteSchemaQualifiedReferences(
-  sql: string,
-  schemaIdent: string,
-): string {
-  return sql.replace(/"public"\.(?=")/g, `${schemaIdent}.`);
-}
-
-/**
- * Construct the single-connection postgres client used by the
- * migration and teardown entry points. Both paths share the same SSL
- * passthrough and suppress NOTICE-level diagnostics (cascade reports,
- * "schema already exists") that postgres.js logs by default but are
- * informational only in this harness context. The optional `searchPath`
- * pins `search_path` on connection-open so unqualified `CREATE TABLE`
- * statements land in the caller's schema.
- */
-function createMigrationClient(
-  config: DBConfig,
-  searchPath?: string,
-): ReturnType<typeof postgres> {
-  return postgres({
-    host: config.host,
-    port: config.port,
-    user: config.user,
-    password: config.password,
-    database: config.database,
-    max: 1,
-    onnotice: () => undefined,
-    ...(config.ssl !== undefined && { ssl: config.ssl }),
-    ...(searchPath !== undefined && {
-      connection: { search_path: searchPath },
-    }),
-  });
-}
-
-/**
- * Apply the drizzle-generated migration SQL into the given postgres
- * schema. The schema is created if absent; nothing else is dropped.
- *
- * The migration source files reference the destination schema
- * literally (e.g. `"public"."user"` in FK constraints). To make the
- * same source apply cleanly into an arbitrary schema, we substitute
- * the literal token `"public"` with the quoted target schema before
- * executing each file. This is a textual substitution rather than a
- * postgres-side `search_path` trick because the FK references are
- * fully qualified; `search_path` would not redirect them.
- *
- * The substitution is bounded: the migration source is
- * machine-generated and never contains the string `"public"` other
- * than in schema-qualified identifiers, so there is no ambiguity to
- * worry about. The substitution is a no-op when the target schema is
- * literally `public`, which is the common case.
- */
-export async function runMigrations(
-  configRaw: unknown,
-  options: { schema: string },
-): Promise<void> {
-  const config = DBConfig(configRaw);
-  if (config instanceof type.errors) {
-    throw new Error(`Invalid database config: ${config.summary}`);
-  }
-
-  const { schema } = options;
-  if (schema.length === 0) {
-    throw new Error("runMigrations: schema name must not be empty");
-  }
-
-  const schemaIdent = quoteIdentifier(schema);
-
-  // Pin search_path on the migration connection so unqualified
-  // `CREATE TABLE "name"` statements land in the target schema.
-  // The FK references in the source SQL are already schema-qualified
-  // (`"public"."user"`); we rewrite those to the target schema
-  // below. Together these two mechanisms route every object the
-  // migration touches into the caller's schema.
-  const sql = createMigrationClient(config, schemaIdent);
-
-  try {
-    // The CREATE SCHEMA must run on a connection that does not
-    // require the schema to already exist for search_path to be
-    // applied. postgres.js sets the GUC after connection-open, so
-    // CREATE SCHEMA IF NOT EXISTS here is the first statement and
-    // creates the schema before search_path matters.
-    await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS ${schemaIdent}`);
-
-    const files = (await readdir(MIGRATIONS_DIR))
-      .filter((f) => f.endsWith(".sql"))
-      .sort();
-
-    if (files.length === 0) {
-      throw new Error(
-        `runMigrations: no .sql files found in ${MIGRATIONS_DIR}`,
-      );
-    }
-
-    for (const file of files) {
-      const raw = await readFile(path.join(MIGRATIONS_DIR, file), "utf-8");
-      const rendered = rewriteSchemaQualifiedReferences(raw, schemaIdent);
-      // drizzle emits multi-statement files separated by its own
-      // statement-breakpoint marker. Split on it and execute each
-      // statement individually so a syntax error in one statement
-      // surfaces with the right context.
-      const statements = rendered
-        .split("--> statement-breakpoint")
-        .map((s) => s.trim())
-        .filter((s) => s.length > 0);
-      for (const stmt of statements) {
-        await sql.unsafe(stmt);
-      }
-    }
-  } finally {
-    await sql.end();
-  }
-}
-
-/**
- * Drop the given schema along with everything in it. Used by the
- * integration-test harness to tear down per-test schemas.
- */
-export async function dropSchema(
-  configRaw: unknown,
-  options: { schema: string },
-): Promise<void> {
-  const config = DBConfig(configRaw);
-  if (config instanceof type.errors) {
-    throw new Error(`Invalid database config: ${config.summary}`);
-  }
-
-  const sql = createMigrationClient(config);
-
-  try {
-    const schemaIdent = quoteIdentifier(options.schema);
-    await sql.unsafe(`DROP SCHEMA IF EXISTS ${schemaIdent} CASCADE`);
-  } finally {
-    await sql.end();
-  }
-}