@kromatv/sdk 0.1.40-canary.0

package/rust/kroma-db/src/accounts.rs

@@ -0,0 +1,244 @@
+//! The user row: creating an account, finding one, and naming it.
+//!
+//! Re-exported flat here so the public `db::<item>` paths resolve unchanged:
+//! [`invites`] holds the token an account is created against, [`preferences`]
+//! what the user chose, [`credentials`] the password and PIN hashes,
+//! [`sessions`] a signed-in session and [`access_tokens`] the device credential
+//! behind it.
+
+use super::*;
+
+use rusqlite::OptionalExtension;
+
+use kroma_domain::PublicUser;
+
+mod access_tokens;
+mod credentials;
+mod invites;
+mod preferences;
+mod resets;
+mod sessions;
+mod verifications;
+
+#[cfg(test)]
+mod test_support;
+
+pub use access_tokens::*;
+pub use credentials::*;
+pub use invites::*;
+pub use preferences::*;
+pub use resets::*;
+pub use sessions::*;
+pub use verifications::*;
+
+/// The id is random rather than derived from the email, so it isn't guessable.
+/// The caller should pre-check the email to surface a clean 409; the `UNIQUE`
+/// constraint is the hard guard.
+pub fn create_user(
+    pool: &Pool,
+    email: &str,
+    username: &str,
+    password_hash: &str,
+    permissions: &[Permission],
+) -> Result<User> {
+    let conn = pool.get()?;
+    let permissions = permissions.to_vec();
+    let perms_json =
+        serde_json::to_string(&permissions).unwrap_or_else(|_| "[\"playback\"]".into());
+    let id = kroma_primitives::short_hash(&format!(
+        "user|{email}|{}",
+        kroma_primitives::random_token()
+    ));
+    let created_at = now_or_blank();
+    conn.execute(
+        "INSERT INTO users (id,email,username,password_hash,avatar_url,permissions,created_at) \
+         VALUES (?1,?2,?3,?4,NULL,?5,?6)",
+        params![id, email, username, password_hash, perms_json, created_at],
+    )?;
+    Ok(User {
+        id,
+        email: email.to_string(),
+        username: username.to_string(),
+        avatar_url: None,
+        language: None,
+        permissions,
+        created_at,
+        has_pin: false,
+        audio_language: None,
+        subtitle_language: None,
+    })
+}
+
+pub fn user_count(pool: &Pool) -> Result<i64> {
+    let conn = pool.get()?;
+    Ok(conn.query_row("SELECT COUNT(*) FROM users", [], |r| r.get(0))?)
+}
+
+/// Matches the email case-insensitively; the second tuple field is the stored
+/// password hash.
+pub fn find_user_by_email(pool: &Pool, email: &str) -> Result<Option<(User, String)>> {
+    let conn = pool.get()?;
+    let mut stmt = conn.prepare(
+        "SELECT id,email,username,avatar_url,created_at,permissions,language,(pin_hash IS NOT NULL),audio_language,subtitle_language,password_hash FROM users WHERE email = ?1",
+    )?;
+    let mut rows = stmt.query_map(params![email], |r| {
+        Ok((row_to_user(r)?, r.get::<_, String>(10)?))
+    })?;
+    match rows.next() {
+        Some(v) => Ok(Some(v?)),
+        None => Ok(None),
+    }
+}
+
+/// `identifier` is either an email (case-insensitive) or a username, so the
+/// profile picker — which only knows usernames — can log in. The second tuple
+/// field is the stored password hash.
+pub fn find_user_by_login(pool: &Pool, identifier: &str) -> Result<Option<(User, String)>> {
+    let conn = pool.get()?;
+    let mut stmt = conn.prepare(
+        "SELECT id,email,username,avatar_url,created_at,permissions,language,(pin_hash IS NOT NULL),audio_language,subtitle_language,password_hash FROM users \
+         WHERE email = ?1 COLLATE NOCASE OR username = ?1 LIMIT 1",
+    )?;
+    let mut rows = stmt.query_map(params![identifier], |r| {
+        Ok((row_to_user(r)?, r.get::<_, String>(10)?))
+    })?;
+    match rows.next() {
+        Some(v) => Ok(Some(v?)),
+        None => Ok(None),
+    }
+}
+
+pub fn user_by_id(pool: &Pool, id: &str) -> Result<Option<User>> {
+    let conn = pool.get()?;
+    let user = conn
+        .query_row(
+            "SELECT id,email,username,avatar_url,created_at,permissions,language,(pin_hash IS NOT NULL),audio_language,subtitle_language FROM users WHERE id = ?1",
+            params![id],
+            row_to_user,
+        )
+        .optional()?;
+    Ok(user)
+}
+
+pub fn list_users(pool: &Pool) -> Result<Vec<PublicUser>> {
+    let conn = pool.get()?;
+    let mut stmt = conn.prepare(
+        "SELECT id,username,avatar_url,(pin_hash IS NOT NULL) FROM users ORDER BY created_at",
+    )?;
+    let rows = stmt.query_map([], |r| {
+        Ok(PublicUser {
+            id: r.get(0)?,
+            username: r.get(1)?,
+            avatar_url: r.get(2)?,
+            has_pin: r.get(3)?,
+        })
+    })?;
+    Ok(rows.collect::<rusqlite::Result<Vec<_>>>()?)
+}
+
+/// Checks the username column (case-sensitive, as username login resolves) AND
+/// the email column (case-insensitive): a username equal to someone's email
+/// would otherwise shadow that victim's email login through the
+/// `email = ?1 OR username = ?1` in `find_user_by_login`. `exclude_id` skips the
+/// caller's own row.
+pub fn username_taken(pool: &Pool, username: &str, exclude_id: Option<&str>) -> Result<bool> {
+    let conn = pool.get()?;
+    let taken: i64 = match exclude_id {
+        Some(id) => conn.query_row(
+            "SELECT EXISTS(SELECT 1 FROM users WHERE (username = ?1 OR email = ?1 COLLATE NOCASE) AND id <> ?2)",
+            params![username, id],
+            |r| r.get(0),
+        )?,
+        None => conn.query_row(
+            "SELECT EXISTS(SELECT 1 FROM users WHERE username = ?1 OR email = ?1 COLLATE NOCASE)",
+            params![username],
+            |r| r.get(0),
+        )?,
+    };
+    Ok(taken != 0)
+}
+
+/// The caller must pre-check for a duplicate to surface a clean 409; the
+/// `UNIQUE COLLATE NOCASE` constraint is the atomic backstop, so a `rusqlite`
+/// error here is that collision. Changing the address clears its verified
+/// state: the proof belongs to the mailbox, not the account (ADMIN-87).
+pub fn set_user_email(pool: &Pool, user_id: &str, email: &str) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "UPDATE users SET email = ?2, email_verified_at = NULL WHERE id = ?1",
+        params![user_id, email],
+    )?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::accounts::test_support::*;
+
+    #[test]
+    fn create_user_count_and_lookups() {
+        let p = pool();
+        assert_eq!(user_count(&p).unwrap(), 0);
+        let u = create_user(
+            &p,
+            "Alice@Example.com",
+            "alice",
+            "pw-hash",
+            &[Permission::Playback, Permission::UsersManage],
+        )
+        .unwrap();
+        assert_eq!(user_count(&p).unwrap(), 1);
+        assert!(!u.id.is_empty());
+        assert_eq!(
+            u.permissions,
+            vec![Permission::Playback, Permission::UsersManage]
+        );
+        assert!(!u.has_pin);
+
+        let (found, hash) = find_user_by_email(&p, "alice@example.com")
+            .unwrap()
+            .unwrap();
+        assert_eq!(found.id, u.id);
+        assert_eq!(hash, "pw-hash");
+        assert!(find_user_by_email(&p, "nobody@x.com").unwrap().is_none());
+
+        assert_eq!(
+            find_user_by_login(&p, "ALICE@example.com")
+                .unwrap()
+                .unwrap()
+                .0
+                .id,
+            u.id
+        );
+        assert_eq!(find_user_by_login(&p, "alice").unwrap().unwrap().0.id, u.id);
+        assert!(find_user_by_login(&p, "ghost").unwrap().is_none());
+
+        assert_eq!(user_by_id(&p, &u.id).unwrap().unwrap().username, "alice");
+        assert!(user_by_id(&p, "missing").unwrap().is_none());
+        let list = list_users(&p).unwrap();
+        assert_eq!(list.len(), 1);
+        assert_eq!(list[0].username, "alice");
+        assert!(!list[0].has_pin);
+    }
+
+    #[test]
+    fn username_taken_checks_username_and_email() {
+        let p = pool();
+        let u = mk_user(&p, "a@b.c", "alice");
+        assert!(username_taken(&p, "alice", None).unwrap());
+        assert!(username_taken(&p, "a@b.c", None).unwrap());
+        assert!(!username_taken(&p, "bob", None).unwrap());
+        assert!(!username_taken(&p, "alice", Some(&u.id)).unwrap());
+        assert!(username_taken(&p, "alice", Some("other-id")).unwrap());
+    }
+
+    #[test]
+    fn a_name_check_that_cannot_read_the_table_refuses_rather_than_reporting_free() {
+        let p = pool();
+        p.get().unwrap().execute_batch("DROP TABLE users").unwrap();
+
+        assert!(username_taken(&p, "alice", None).is_err());
+        assert!(username_taken(&p, "alice", Some("u1")).is_err());
+    }
+}

package/rust/kroma-db/src/admin/metrics.rs

@@ -0,0 +1,201 @@
+use anyhow::Result;
+use rusqlite::params;
+
+use crate::Pool;
+
+const COLS: &str =
+    "at,step_secs,cpu_kroma,cpu_system,cpu_media,ram_kroma,ram_system,bw_local,bw_remote";
+
+/// One stored window of the resource series: `at` is the unix second it opens
+/// on, `step_secs` how wide it is. A row carries its own width because the
+/// retention ladder folds older rows coarser, so one read spans several.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct MetricSample {
+    pub at: i64,
+    pub step_secs: i64,
+    pub cpu_kroma: f32,
+    pub cpu_system: f32,
+    pub cpu_media: f32,
+    pub ram_kroma: f32,
+    pub ram_system: f32,
+    pub bw_local: f64,
+    pub bw_remote: f64,
+}
+
+/// Append one rolled-up window, replacing whatever sat at the same `(step, at)`.
+pub fn record_metric_sample(pool: &Pool, sample: &MetricSample) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        &format!(
+            "INSERT OR REPLACE INTO metric_samples ({COLS}) VALUES (?1,?2,?3,?4,?5,?6,?7,?8,?9)"
+        ),
+        params![
+            sample.at,
+            sample.step_secs,
+            sample.cpu_kroma,
+            sample.cpu_system,
+            sample.cpu_media,
+            sample.ram_kroma,
+            sample.ram_system,
+            sample.bw_local,
+            sample.bw_remote,
+        ],
+    )?;
+    Ok(())
+}
+
+/// Every stored window opening in `[from, to)`, oldest first.
+pub fn metric_samples(pool: &Pool, from: i64, to: i64) -> Result<Vec<MetricSample>> {
+    let conn = pool.get()?;
+    let mut stmt = conn.prepare(&format!(
+        "SELECT {COLS} FROM metric_samples WHERE at >= ?1 AND at < ?2 ORDER BY at"
+    ))?;
+    let rows = stmt.query_map(params![from, to], |r| {
+        Ok(MetricSample {
+            at: r.get(0)?,
+            step_secs: r.get(1)?,
+            cpu_kroma: r.get(2)?,
+            cpu_system: r.get(3)?,
+            cpu_media: r.get(4)?,
+            ram_kroma: r.get(5)?,
+            ram_system: r.get(6)?,
+            bw_local: r.get(7)?,
+            bw_remote: r.get(8)?,
+        })
+    })?;
+    Ok(rows.collect::<rusqlite::Result<Vec<_>>>()?)
+}
+
+/// The unix second of the oldest stored window, or `None` on an empty record.
+pub fn earliest_metric_sample(pool: &Pool) -> Result<Option<i64>> {
+    let conn = pool.get()?;
+    Ok(conn.query_row("SELECT MIN(at) FROM metric_samples", [], |r| r.get(0))?)
+}
+
+/// Fold every window finer than `step` that closes before `before` into whole
+/// `step`-wide windows, each the width-weighted mean of what it replaces, and
+/// drop the rows it folded.
+///
+/// Only whole windows are folded: `before` is rounded down to a `step`
+/// boundary, so a window is never averaged twice as the threshold advances.
+/// Returns how many rows were folded away.
+pub fn fold_metric_samples(pool: &Pool, before: i64, step: i64) -> Result<usize> {
+    let aligned = before.div_euclid(step) * step;
+    let conn = pool.get()?;
+    conn.execute(
+        &format!(
+            "INSERT OR REPLACE INTO metric_samples ({COLS}) \
+             SELECT (at / ?2) * ?2, ?2, \
+                SUM(cpu_kroma * step_secs) / SUM(step_secs), \
+                SUM(cpu_system * step_secs) / SUM(step_secs), \
+                SUM(cpu_media * step_secs) / SUM(step_secs), \
+                SUM(ram_kroma * step_secs) / SUM(step_secs), \
+                SUM(ram_system * step_secs) / SUM(step_secs), \
+                SUM(bw_local * step_secs) / SUM(step_secs), \
+                SUM(bw_remote * step_secs) / SUM(step_secs) \
+             FROM metric_samples WHERE at < ?1 AND step_secs < ?2 GROUP BY at / ?2"
+        ),
+        params![aligned, step],
+    )?;
+    let folded = conn.execute(
+        "DELETE FROM metric_samples WHERE at < ?1 AND step_secs < ?2",
+        params![aligned, step],
+    )?;
+    Ok(folded)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::admin::test_support::*;
+
+    fn sample(at: i64, step_secs: i64, level: f32) -> MetricSample {
+        MetricSample {
+            at,
+            step_secs,
+            cpu_kroma: level,
+            cpu_system: level * 2.0,
+            cpu_media: level / 2.0,
+            ram_kroma: level,
+            ram_system: level,
+            bw_local: level as f64,
+            bw_remote: level as f64 * 3.0,
+        }
+    }
+
+    #[test]
+    fn reads_back_the_windows_opening_inside_the_asked_span() {
+        let p = pool();
+
+        record_metric_sample(&p, &sample(100, 60, 1.0)).unwrap();
+        record_metric_sample(&p, &sample(160, 60, 2.0)).unwrap();
+        record_metric_sample(&p, &sample(220, 60, 3.0)).unwrap();
+
+        let got = metric_samples(&p, 160, 220).unwrap();
+        assert_eq!(got, vec![sample(160, 60, 2.0)]);
+        assert_eq!(earliest_metric_sample(&p).unwrap(), Some(100));
+    }
+
+    #[test]
+    fn an_empty_record_has_no_earliest_window() {
+        let p = pool();
+
+        assert_eq!(earliest_metric_sample(&p).unwrap(), None);
+    }
+
+    #[test]
+    fn folding_replaces_the_fine_windows_with_one_weighted_mean() {
+        let p = pool();
+        for (i, level) in [10.0, 20.0, 30.0, 40.0, 50.0].iter().enumerate() {
+            record_metric_sample(&p, &sample(i as i64 * 60, 60, *level)).unwrap();
+        }
+
+        let folded = fold_metric_samples(&p, 300, 300).unwrap();
+
+        assert_eq!(folded, 5);
+        let rows = metric_samples(&p, 0, 300).unwrap();
+        assert_eq!(rows, vec![sample(0, 300, 30.0)]);
+    }
+
+    #[test]
+    fn folding_weights_a_window_by_the_width_it_covers() {
+        let p = pool();
+        record_metric_sample(&p, &sample(0, 240, 10.0)).unwrap();
+        record_metric_sample(&p, &sample(240, 60, 60.0)).unwrap();
+
+        fold_metric_samples(&p, 300, 300).unwrap();
+
+        let rows = metric_samples(&p, 0, 300).unwrap();
+        assert_eq!(rows.len(), 1);
+        assert_eq!(rows[0].cpu_kroma, 20.0);
+    }
+
+    #[test]
+    fn folding_leaves_a_window_the_threshold_does_not_close_alone() {
+        let p = pool();
+        record_metric_sample(&p, &sample(0, 60, 10.0)).unwrap();
+        record_metric_sample(&p, &sample(300, 60, 20.0)).unwrap();
+        record_metric_sample(&p, &sample(360, 60, 30.0)).unwrap();
+
+        let folded = fold_metric_samples(&p, 420, 300).unwrap();
+
+        assert_eq!(folded, 1);
+        let rows = metric_samples(&p, 0, 600).unwrap();
+        assert_eq!(
+            rows.iter().map(|r| (r.at, r.step_secs)).collect::<Vec<_>>(),
+            vec![(0, 300), (300, 60), (360, 60)]
+        );
+    }
+
+    #[test]
+    fn folding_an_already_coarse_window_a_second_time_changes_nothing() {
+        let p = pool();
+        record_metric_sample(&p, &sample(0, 300, 42.0)).unwrap();
+
+        assert_eq!(fold_metric_samples(&p, 900, 300).unwrap(), 0);
+        assert_eq!(
+            metric_samples(&p, 0, 900).unwrap(),
+            vec![sample(0, 300, 42.0)]
+        );
+    }
+}