@kubun/store-graph 0.17.1 → 0.18.0

package/lib/access-default-records.d.ts

@@ -0,0 +1,18 @@
+import type { MethodRegistry } from '@kokuin/token';
+import type { StoreProvider } from '@kubun/db';
+import { type Adapter } from '@kubun/db-adapter';
+import { type RecordStoreAdapter } from '@kubun/records';
+import { type Kysely } from 'kysely';
+import type { GraphTables } from './tables.js';
+export declare class GraphAccessDefaultRecordTypeError extends Error {
+    constructor(type: string);
+}
+export declare class GraphAccessDefaultRecordError extends Error {
+    constructor(message: string);
+}
+export type GraphAccessDefaultRecordMethods = {
+    accessDefaultRecords(methods?: MethodRegistry, ownerDID?: string): RecordStoreAdapter;
+};
+export declare function createGraphAccessDefaultRecordMethods(db: Kysely<GraphTables>, adapter: Adapter): GraphAccessDefaultRecordMethods;
+export declare function accessDefaultRecordProvider(adapter: RecordStoreAdapter): StoreProvider;
+export declare function graphAccessDefaultRecordAdapter(provider: StoreProvider, methods?: MethodRegistry, ownerDID?: string): Promise<RecordStoreAdapter>;

package/lib/access-default-records.js

@@ -0,0 +1,167 @@
+import { AbstractPostgresAdapter, chunked } from '@kubun/db-adapter';
+import { compareRecordDecisionHLC, recordDecisionFromVerifiedCopies, recordKeyText, recordPayloadMatches, verifySignedRecord } from '@kubun/records';
+import { sql } from 'kysely';
+export class GraphAccessDefaultRecordTypeError extends Error {
+    constructor(type){
+        super(`Unsupported access default record type: ${type}`);
+        this.name = 'GraphAccessDefaultRecordTypeError';
+    }
+}
+export class GraphAccessDefaultRecordError extends Error {
+    constructor(message){
+        super(message);
+        this.name = 'GraphAccessDefaultRecordError';
+    }
+}
+function requireType(type) {
+    if (type !== 'access.default') throw new GraphAccessDefaultRecordTypeError(type);
+}
+async function decisionFromRow(row, methods) {
+    const copy = {
+        type: row.type,
+        owner: row.owner,
+        id: row.id,
+        hlc: row.hlc,
+        opHash: row.op_hash,
+        opJWT: row.op_jwt,
+        payload: row.payload === null ? null : Uint8Array.from(row.payload)
+    };
+    const op = await verifySignedRecord(copy, methods);
+    if (op == null || !recordPayloadMatches(copy, op.claim)) return null;
+    return recordDecisionFromVerifiedCopies({
+        type: row.type,
+        owner: row.owner,
+        id: row.id
+    }, [
+        {
+            copy,
+            op
+        }
+    ], 'hlc');
+}
+export function createGraphAccessDefaultRecordMethods(db, adapter) {
+    return {
+        accessDefaultRecords (methods, ownerDID) {
+            const records = {
+                isTransaction: db.isTransaction,
+                async transaction (fn) {
+                    if (db.isTransaction) return await fn(records);
+                    return await db.transaction().execute(async (tx)=>fn(createGraphAccessDefaultRecordMethods(tx, adapter).accessDefaultRecords(methods, ownerDID)));
+                },
+                async get (key) {
+                    requireType(key.type);
+                    const row = await db.selectFrom('kubun_graph_access_default_records').selectAll().where('type', '=', key.type).where('owner', '=', key.owner).where('id', '=', key.id).executeTakeFirst();
+                    return row == null ? null : await decisionFromRow(row, methods);
+                },
+                async getMany (keys) {
+                    for (const key of keys)requireType(key.type);
+                    const wanted = new Set(keys.map(recordKeyText));
+                    const decisions = new Map();
+                    for (const chunk of chunked(keys.map((key)=>key.id))){
+                        const rows = await db.selectFrom('kubun_graph_access_default_records').selectAll().where('type', '=', 'access.default').where('id', 'in', chunk).execute();
+                        for (const row of rows){
+                            const text = recordKeyText(row);
+                            if (!wanted.has(text)) continue;
+                            const decision = await decisionFromRow(row, methods);
+                            if (decision !== null) decisions.set(text, decision);
+                        }
+                    }
+                    return decisions;
+                },
+                async list (types) {
+                    types.forEach(requireType);
+                    if (types.length === 0) return [];
+                    let query = db.selectFrom('kubun_graph_access_default_records').select([
+                        'owner',
+                        'id'
+                    ]).where('type', '=', 'access.default');
+                    if (ownerDID != null) query = query.where('owner', '=', ownerDID);
+                    const rows = await query.orderBy('owner').orderBy('id').execute();
+                    const decisions = await Promise.all(rows.map(async (row)=>records.get({
+                            type: 'access.default',
+                            ...row
+                        })));
+                    return decisions.filter((decision)=>decision !== null);
+                },
+                async putCopy (record) {
+                    requireType(record.type);
+                    const op = await verifySignedRecord(record, methods);
+                    if (op === null || !recordPayloadMatches(record, op.claim)) throw new GraphAccessDefaultRecordError('Invalid signed access default record');
+                    if (!db.isTransaction) return await records.transaction(async (tx)=>tx.putCopy(record));
+                    await records.lock?.([
+                        {
+                            type: record.type,
+                            key: JSON.stringify([
+                                record.owner,
+                                record.id
+                            ])
+                        }
+                    ]);
+                    const stored = await records.get(record);
+                    const incoming = recordDecisionFromVerifiedCopies({
+                        type: record.type,
+                        owner: record.owner,
+                        id: record.id
+                    }, [
+                        {
+                            copy: record,
+                            op
+                        }
+                    ], 'hlc');
+                    if (incoming === null) throw new GraphAccessDefaultRecordError('Invalid access default decision');
+                    const order = stored === null ? 1 : compareRecordDecisionHLC(incoming.decisionHLC, stored.decisionHLC);
+                    if (stored !== null && (order < 0 || order === 0 && (incoming.contentDigest < stored.contentDigest || incoming.contentDigest === stored.contentDigest && record.opHash >= (stored.copies[0]?.opHash ?? record.opHash)))) return;
+                    await db.insertInto('kubun_graph_access_default_records').values({
+                        type: record.type,
+                        owner: record.owner,
+                        id: record.id,
+                        hlc: record.hlc,
+                        op_hash: record.opHash,
+                        op_jwt: record.opJWT,
+                        payload: record.payload === null ? null : adapter.encodeBinary(record.payload)
+                    }).onConflict((oc)=>oc.columns([
+                            'type',
+                            'owner',
+                            'id'
+                        ]).doUpdateSet({
+                            hlc: record.hlc,
+                            op_hash: record.opHash,
+                            op_jwt: record.opJWT,
+                            payload: record.payload === null ? null : adapter.encodeBinary(record.payload)
+                        })).execute();
+                },
+                async pruneCopy (key, signerDID) {
+                    requireType(key.type);
+                    // One authenticated signer owns each slot; never prune its sole durable decision.
+                    void signerDID;
+                },
+                async lock (keys) {
+                    for (const { type } of keys)requireType(type);
+                    if (!db.isTransaction) throw new GraphAccessDefaultRecordError('Access default locks require a transaction');
+                    if (!(adapter instanceof AbstractPostgresAdapter)) return;
+                    for (const key of [
+                        ...new Set(keys.map(({ key })=>key))
+                    ].sort())await sql`select pg_advisory_xact_lock(hashtextextended(${`access.default:${key}`}, 0))`.execute(db);
+                }
+            };
+            return records;
+        }
+    };
+}
+const providers = new WeakMap();
+export function accessDefaultRecordProvider(adapter) {
+    const provider = providers.get(adapter.adapterForType?.('access.default') ?? adapter);
+    if (provider == null) throw new GraphAccessDefaultRecordError('Access default requires its graph record adapter');
+    return provider;
+}
+export async function graphAccessDefaultRecordAdapter(provider, methods, ownerDID) {
+    const graph = await provider.getStore('graph');
+    const base = graph.accessDefaultRecords(methods, ownerDID);
+    const records = {
+        ...base,
+        isTransaction: provider.isTransactionBound,
+        transaction: async (fn)=>provider.withTransaction(async (tx)=>fn(await graphAccessDefaultRecordAdapter(tx, methods, ownerDID)))
+    };
+    providers.set(records, provider);
+    return records;
+}