@malloy-publisher/server 0.0.235 → 0.0.236

package/src/controller/package.controller.ts

@@ -1,306 +0,0 @@
-import { components } from "../api";
-import { normalizeModelPath } from "../constants";
-import { BadRequestError, FrozenConfigError } from "../errors";
-import { EnvironmentStore } from "../service/environment_store";
-
-type ApiPackage = components["schemas"]["Package"];
-
-/**
- * Which path a reload took. `in-place` recompiles the tree already on disk and
- * leaves it alone; `reinstalled` re-fetches from the package's install location,
- * which overwrites on-disk edits.
- */
-export type PackageReloadMode = "in-place" | "reinstalled";
-
-/**
- * Everything that is strict-at-publish, joined into one 400 message (or
- * undefined when the package is publishable): invalid explores entries plus
- * the Malloy Persistence policy gate (scope is package-level; a
- * `materialization.schedule` is package-root-only + version-scope-only and
- * mutually exclusive with freshness; per-source `sharing`/`schedule` are
- * retired — see Package.persistencePolicyWarnings), plus persist-target
- * collisions ONLY when `PERSIST_COLLISION_ENFORCE` is set (otherwise those are
- * surfaced warn-only so a pre-existing latent collision doesn't block a routine
- * re-publish — see Package.formatPersistenceCollisionRejections). At
- * startup/reload all are warn-only instead (fail-safe; see Package.loadViaWorker).
- */
-function formatPublishRejections(
-   pkg: {
-      formatInvalidExplores(exploresOverride?: string[]): string;
-      formatInvalidPersistencePolicy(): string;
-      formatPersistenceCollisionRejections(): string;
-   },
-   exploresOverride?: string[],
-): string | undefined {
-   const message = [
-      pkg.formatInvalidExplores(exploresOverride),
-      pkg.formatInvalidPersistencePolicy(),
-      pkg.formatPersistenceCollisionRejections(),
-   ]
-      .filter(Boolean)
-      .join("\n");
-   return message || undefined;
-}
-
-export class PackageController {
-   private environmentStore: EnvironmentStore;
-
-   constructor(environmentStore: EnvironmentStore) {
-      this.environmentStore = environmentStore;
-   }
-
-   public async listPackages(environmentName: string): Promise<ApiPackage[]> {
-      const environment = await this.environmentStore.getEnvironment(
-         environmentName,
-         false,
-      );
-      return environment.listPackages();
-   }
-
-   public async getPackage(
-      environmentName: string,
-      packageName: string,
-      reload: boolean,
-   ): Promise<ApiPackage> {
-      if (reload) {
-         return (await this.reloadPackage(environmentName, packageName))
-            .metadata;
-      }
-
-      const environment = await this.environmentStore.getEnvironment(
-         environmentName,
-         false,
-      );
-      const _package = await environment.getPackage(packageName, false);
-      return _package.getPackageMetadata();
-   }
-
-   /**
-    * Reload a package and report WHICH path ran. The two are not equivalent to
-    * anyone holding on-disk edits: an in-place reload recompiles the tree that
-    * is already there, while a reinstall re-fetches from the package's install
-    * location and overwrites it. A caller that surfaces the reload to a user
-    * needs to be able to say which happened, so it is returned rather than
-    * inferred. `getPackage` keeps returning bare metadata, so the REST contract
-    * is unchanged.
-    */
-   public async reloadPackage(
-      environmentName: string,
-      packageName: string,
-   ): Promise<{ metadata: ApiPackage; mode: PackageReloadMode }> {
-      const environment = await this.environmentStore.getEnvironment(
-         environmentName,
-         false,
-      );
-
-      // Resolve the package's source location from the currently-cached
-      // metadata WITHOUT triggering a stale-state reload. If a `location`
-      // is set, route the reload through `installPackage` so that
-      // download-then-load happens atomically; otherwise fall back to an
-      // in-place reload of the existing on-disk content.
-      let location: string | undefined;
-      try {
-         const cached = await environment.getPackage(packageName, false);
-         location = cached.getPackageMetadata().location;
-      } catch {
-         // Not previously loaded, so there is nothing to reinstall from.
-      }
-      if (location) {
-         const reinstalled = await environment.installPackage(
-            packageName,
-            (stagingPath) =>
-               this.downloadInto(
-                  environmentName,
-                  packageName,
-                  location,
-                  stagingPath,
-               ),
-         );
-         return {
-            metadata: reinstalled.getPackageMetadata(),
-            mode: "reinstalled",
-         };
-      }
-      const _package = await environment.getPackage(packageName, true);
-      return { metadata: _package.getPackageMetadata(), mode: "in-place" };
-   }
-
-   async addPackage(environmentName: string, body: ApiPackage) {
-      if (this.environmentStore.publisherConfigIsFrozen) {
-         throw new FrozenConfigError();
-      }
-      if (!body.name) {
-         throw new BadRequestError("Package name is required");
-      }
-      const packageName = body.name;
-      const environment = await this.environmentStore.getEnvironment(
-         environmentName,
-         false,
-      );
-      // Strict at publish: the author is in the loop here, so reject a bad
-      // explores with an actionable 400 instead of silently serving a hidden
-      // surface. (At startup/reload we fail safe and only warn — see
-      // Package.loadViaWorker.) The rollback differs by path so a rejected
-      // publish never destroys user content:
-      //   - location: the tree was just downloaded into a fresh canonical, so
-      //     validation runs inside installPackage's swap window and a failure
-      //     wipes that download (the existing rollback) — nothing pre-existing
-      //     to lose.
-      //   - no-location: addPackage registered a *pre-existing* user directory,
-      //     so we validate after the fact and `unloadPackage` (evict from
-      //     memory, keep the files) rather than delete it.
-      let result;
-      if (body.location) {
-         const bodyLocation = body.location;
-         result = await environment.installPackage(
-            packageName,
-            (stagingPath) =>
-               this.downloadInto(
-                  environmentName,
-                  packageName,
-                  bodyLocation,
-                  stagingPath,
-               ),
-            (pkg) => formatPublishRejections(pkg),
-         );
-      } else {
-         result = await environment.addPackage(packageName);
-      }
-
-      // `addPackage`/`installPackage` are typed `Package | undefined`; a missing
-      // result here is a should-never-happen internal fault. Fail loudly rather
-      // than letting optional chaining silently skip the validation below.
-      if (!result) {
-         throw new Error(`Failed to create package ${packageName}`);
-      }
-
-      if (!body.location) {
-         const invalidMsg = formatPublishRejections(result);
-         if (invalidMsg) {
-            await environment.unloadPackage(packageName).catch(() => {
-               /* best-effort; the package is not persisted below */
-            });
-            throw new BadRequestError(invalidMsg);
-         }
-      }
-
-      await this.environmentStore.addPackageToDatabase(
-         environmentName,
-         packageName,
-      );
-
-      return result;
-   }
-
-   public async deletePackage(environmentName: string, packageName: string) {
-      if (this.environmentStore.publisherConfigIsFrozen) {
-         throw new FrozenConfigError();
-      }
-      const environment = await this.environmentStore.getEnvironment(
-         environmentName,
-         false,
-      );
-      const result = await environment.deletePackage(packageName);
-      await this.environmentStore.deletePackageFromDatabase(
-         environmentName,
-         packageName,
-      );
-
-      return result;
-   }
-
-   public async updatePackage(
-      environmentName: string,
-      packageName: string,
-      body: ApiPackage,
-   ) {
-      if (this.environmentStore.publisherConfigIsFrozen) {
-         throw new FrozenConfigError();
-      }
-      const environment = await this.environmentStore.getEnvironment(
-         environmentName,
-         false,
-      );
-      if (body.location) {
-         // Re-install: stream the new content into a staging dir (no lock)
-         // and atomically swap it in (under the lock). Validate the effective
-         // explores (the body override, else the new tree's own manifest)
-         // INSIDE the swap window, so a rejected update rolls back to the
-         // previous tree instead of swapping the bad one in and 400-ing after.
-         const bodyLocation = body.location;
-         await environment.installPackage(
-            packageName,
-            (stagingPath) =>
-               this.downloadInto(
-                  environmentName,
-                  packageName,
-                  bodyLocation,
-                  stagingPath,
-               ),
-            (pkg) =>
-               formatPublishRejections(
-                  pkg,
-                  body.explores?.map(normalizeModelPath),
-               ),
-         );
-      }
-      // Apply metadata changes (publisher.json) under the same per-package
-      // mutex via `Environment.updatePackage`.
-      const result = await environment.updatePackage(packageName, body);
-      await this.environmentStore.addPackageToDatabase(
-         environmentName,
-         packageName,
-      );
-
-      return result;
-   }
-
-   /**
-    * Run the right downloader for the given location into `targetPath`.
-    * Callers pass a sibling staging dir (not the canonical package
-    * directory) so the long-running download doesn't hold the per-package
-    * mutex.
-    */
-   private async downloadInto(
-      environmentName: string,
-      packageName: string,
-      packageLocation: string,
-      targetPath: string,
-   ) {
-      const isCompressedFile = packageLocation.endsWith(".zip");
-      if (
-         packageLocation.startsWith("https://") ||
-         packageLocation.startsWith("git@")
-      ) {
-         await this.environmentStore.downloadGitHubDirectory(
-            packageLocation,
-            targetPath,
-         );
-      } else if (packageLocation.startsWith("gs://")) {
-         await this.environmentStore.downloadGcsDirectory(
-            packageLocation,
-            environmentName,
-            targetPath,
-            isCompressedFile,
-         );
-      } else if (packageLocation.startsWith("s3://")) {
-         await this.environmentStore.downloadS3Directory(
-            packageLocation,
-            environmentName,
-            targetPath,
-            isCompressedFile,
-         );
-      }
-
-      if (packageLocation.startsWith("/")) {
-         // Absolute paths from the publisher.config could be placed outside of /etc/publisher,
-         // so we need to mount them on the right place.
-         await this.environmentStore.mountLocalDirectory(
-            packageLocation,
-            targetPath,
-            environmentName,
-            packageName,
-         );
-      }
-   }
-}

package/src/controller/query.controller.ts

@@ -1,152 +0,0 @@
-import { validateRenderTags } from "@malloydata/render-validator";
-import { components } from "../api";
-import { getQueryTimeoutMs } from "../config";
-import { API_PREFIX } from "../constants";
-import { BadRequestError, ModelNotFoundError } from "../errors";
-import { bigIntReplacer } from "../json_utils";
-import { logger } from "../logger";
-import {
-   mintCorrelationId,
-   parseQueryClass,
-   parseSuppliedQueryMetadata,
-   type QueryClass,
-   type QueryMetadata,
-} from "../service/query_metadata";
-import { runWithQueryTimeout } from "../query_timeout";
-import { EnvironmentStore } from "../service/environment_store";
-import type { FilterParams } from "../service/filter";
-import type { GivenValue } from "@malloydata/malloy";
-
-type ApiQuery = components["schemas"]["QueryResult"];
-
-export class QueryController {
-   private environmentStore: EnvironmentStore;
-
-   constructor(environmentStore: EnvironmentStore) {
-      this.environmentStore = environmentStore;
-   }
-
-   public async getQuery(
-      environmentName: string,
-      packageName: string,
-      modelPath: string,
-      sourceName: string,
-      queryName: string,
-      query: string,
-      compactJson: boolean = false,
-      filterParams?: FilterParams,
-      bypassFilters?: boolean,
-      givens?: Record<string, GivenValue>,
-      /**
-       * The request's per-query metadata fields, unvalidated — this controller is
-       * the boundary that turns a bad bag into a 400 rather than letting the
-       * connector refuse the statement at dispatch.
-       */
-      metadata?: {
-         queryMetadata?: unknown;
-         queryClass?: unknown;
-         versionId?: string;
-      },
-   ): Promise<ApiQuery> {
-      let requestMetadata: QueryMetadata | undefined;
-      let queryClass: QueryClass | undefined;
-      try {
-         requestMetadata = parseSuppliedQueryMetadata(metadata?.queryMetadata);
-         queryClass = parseQueryClass(metadata?.queryClass);
-      } catch (error) {
-         throw new BadRequestError((error as Error).message);
-      }
-
-      const environment = await this.environmentStore.getEnvironment(
-         environmentName,
-         false,
-      );
-      // Shed load before any disk / DB work so the publisher returns 503
-      // immediately under memory pressure instead of starting a query and
-      // crashing partway through. Already-loaded packages bypass the
-      // package-load admission gate, so this is the only thing protecting
-      // query traffic on a hot pod.
-      environment.assertCanAdmitQuery();
-      const p = await environment.getPackage(packageName, false);
-      const model = p.getModel(modelPath);
-
-      if (!model) {
-         throw new ModelNotFoundError(`${modelPath} does not exist`);
-      } else {
-         const {
-            result,
-            compactResult,
-            rowLimit,
-            rowLimitSource,
-            queryCorrelationId,
-         } = await runWithQueryTimeout(
-            (abortSignal) =>
-               model.getQueryResults(
-                  sourceName,
-                  queryName,
-                  query,
-                  filterParams,
-                  bypassFilters,
-                  givens,
-                  abortSignal,
-                  {
-                     request: requestMetadata,
-                     queryClass,
-                     environment: environmentName,
-                     // Always undefined today: the route 501s any versionId
-                     // before this runs. Wired so that lifting that rejection
-                     // is the whole change.
-                     version: metadata?.versionId,
-                     // Minted here because this is the boundary that returns
-                     // it; a path with nowhere to put it does not mint one.
-                     correlationId: mintCorrelationId(),
-                     // The environment owns the connection configs, so the
-                     // default and enforced layers are read here rather than
-                     // from the model.
-                     connectionMetadata: (connectionName) => {
-                        try {
-                           const connection =
-                              environment.getApiConnection(connectionName);
-                           return {
-                              default: connection.queryMetadata,
-                              enforced: connection.queryMetadataEnforced,
-                           };
-                        } catch (error) {
-                           // Failing open is right — a tag must not fail a
-                           // query — but this is the one drop with no metric
-                           // behind it, and what it costs is the ENFORCED
-                           // layer. Log it so it is diagnosable.
-                           logger.debug(
-                              "No query-metadata layers for connection",
-                              { connectionName, error },
-                           );
-                           return null;
-                        }
-                     },
-                  },
-               ),
-            getQueryTimeoutMs(),
-         );
-         const renderLogs = validateRenderTags(result);
-         return {
-            result: compactJson
-               ? JSON.stringify(compactResult, bigIntReplacer)
-               : JSON.stringify(result),
-            resource: `${API_PREFIX}/environments/${environmentName}/packages/${packageName}/models/${modelPath}/query`,
-            renderLogs: renderLogs.length > 0 ? renderLogs : undefined,
-            // The cap the database applied. A caller counting the rows it got
-            // back cannot otherwise tell a complete result from one the limit
-            // cut off: a query with no LIMIT of its own silently gets the
-            // server default, which is well under the hard ceiling, so nothing
-            // raises. Deriving it client-side is not possible, since it depends
-            // on server config and on the query's own LIMIT.
-            queryRowLimit: rowLimit,
-            // Which of the two that cap was. Without it a caller cannot tell a
-            // deliberate `limit:`/`top:` from the silently-applied default, and
-            // so cannot reproduce the MCP envelope's _limit_hit.
-            queryRowLimitSource: rowLimitSource,
-            queryCorrelationId,
-         } as ApiQuery;
-      }
-   }
-}

package/src/controller/theme.controller.ts

@@ -1,83 +0,0 @@
-import { components } from "../api";
-import { sanitizeTheme, Theme } from "../config";
-import { BadRequestError, FrozenConfigError } from "../errors";
-import { isPublisherConfigFrozen } from "../config";
-import { ThemeStore } from "../service/theme_store";
-
-type ApiTheme = components["schemas"]["Theme"];
-
-/**
- * Handlers for the in-app Theme Editor.
- *
- *   GET  /api/v0/theme  → current saved theme (or built-in default)
- *   PUT  /api/v0/theme  → save the supplied theme
- *   DELETE /api/v0/theme → reset to boot seed / built-in default
- */
-export class ThemeController {
-   constructor(
-      private themeStore: ThemeStore,
-      private serverRoot: string,
-   ) {}
-
-   getTheme = async (): Promise<ApiTheme> => {
-      const theme = await this.themeStore.get();
-      // Always return an object so the client never has to deal with the
-      // null/undefined ambiguity. An empty object means "no overrides yet,
-      // use SDK defaults."
-      return theme ?? {};
-   };
-
-   /**
-    * PUT persists the supplied theme verbatim, including a literal `{}`.
-    * An empty `{}` is an intentional "clear all overrides" save: it writes
-    * an (empty) row so the boot seed from publisher.config.json's `theme`
-    * block is suppressed on subsequent loads. This deliberately differs
-    * from DELETE (resetTheme), which drops the row and lets that config
-    * seed re-apply. Note the persisted `"{}"` sanitizes back to `undefined`
-    * on reload (sanitizeTheme returns undefined for `{}`), but the row
-    * still exists, so the seed stays suppressed. This PUT-`{}` path is not
-    * reachable from the Theme Editor UI today (its clear affordance is the
-    * Reset button, which calls DELETE); it exists only via the API.
-    */
-   putTheme = async (body: unknown): Promise<ApiTheme> => {
-      if (isPublisherConfigFrozen(this.serverRoot)) {
-         throw new FrozenConfigError(
-            'Cannot edit theme: publisher.config.json has "frozenConfig": true.',
-         );
-      }
-      // Treat a literal `{}` as an intentional "clear all overrides" PUT
-      // (the only other clear path is DELETE, which re-seeds from the
-      // config file). sanitizeTheme returns undefined for both `{}` and
-      // garbage, so we have to disambiguate here.
-      const isEmptyObject =
-         typeof body === "object" &&
-         body !== null &&
-         !Array.isArray(body) &&
-         Object.keys(body as Record<string, unknown>).length === 0;
-      const sanitized = sanitizeTheme(body, "PUT /api/v0/theme");
-      if (!sanitized && !isEmptyObject) {
-         throw new BadRequestError(
-            "Theme payload was malformed (expected an object).",
-         );
-      }
-      const saved: Theme = await this.themeStore.set(sanitized ?? {});
-      return saved;
-   };
-
-   /**
-    * DELETE drops the persisted row so the next load re-seeds from
-    * publisher.config.json's `theme` block (or ends up unthemed if the
-    * config defines none). Contrast with PUT `{}`, which persists an empty
-    * row and thereby suppresses that seed instead of restoring it. See
-    * putTheme for the full divergence.
-    */
-   resetTheme = async (): Promise<ApiTheme> => {
-      if (isPublisherConfigFrozen(this.serverRoot)) {
-         throw new FrozenConfigError(
-            'Cannot reset theme: publisher.config.json has "frozenConfig": true.',
-         );
-      }
-      const reseeded = await this.themeStore.reset();
-      return reseeded ?? {};
-   };
-}