@manablox/db 0.1.0 → 0.2.0

package/src/repositories/workflow.ts

@@ -0,0 +1,306 @@
+import {
+  type Loose,
+  ManabloxError,
+  type WorkflowCursor,
+  type WorkflowRunContext,
+  type WorkflowRunStatus,
+  type WorkflowSelection,
+  type WorkflowStep,
+  type WorkflowStepLog,
+  type WorkflowTrigger,
+} from '@manablox/core';
+import { and, desc, eq, gte, inArray, isNull, lt, lte, or, sql } from 'drizzle-orm';
+import type { Database } from '../client.js';
+import {
+  type ContentRow,
+  contents,
+  type PushSubscriptionRow,
+  pushSubscriptions,
+  type WorkflowRow,
+  type WorkflowRunRow,
+  workflowRuns,
+  workflows,
+} from '../schema/index.js';
+
+export interface WorkflowWriteData {
+  id?: string | undefined;
+  spaceId: string;
+  name: string;
+  description?: string | null | undefined;
+  enabled?: boolean | undefined;
+  trigger: WorkflowTrigger;
+  steps: WorkflowStep[];
+}
+
+export interface WorkflowRunCreateData {
+  workflowId: string;
+  spaceId: string;
+  trigger: string;
+  context: WorkflowRunContext;
+}
+
+/** How many runs a workflow keeps; older ones are pruned as new ones are written. */
+export const RUNS_KEPT_PER_WORKFLOW = 200;
+
+export class WorkflowRepository {
+  constructor(private readonly db: Database) {}
+
+  // --- workflows -------------------------------------------------------------
+
+  async listBySpace(spaceId: string): Promise<WorkflowRow[]> {
+    return this.db
+      .select()
+      .from(workflows)
+      .where(eq(workflows.spaceId, spaceId))
+      .orderBy(workflows.name);
+  }
+
+  /** Every enabled workflow of a space, for the dispatcher; every enabled one at all for the scheduler. */
+  async listEnabled(spaceId?: string): Promise<WorkflowRow[]> {
+    return this.db
+      .select()
+      .from(workflows)
+      .where(
+        spaceId
+          ? and(eq(workflows.enabled, true), eq(workflows.spaceId, spaceId))
+          : eq(workflows.enabled, true),
+      );
+  }
+
+  async findById(id: string): Promise<WorkflowRow | null> {
+    const rows = await this.db.select().from(workflows).where(eq(workflows.id, id)).limit(1);
+    return rows[0] ?? null;
+  }
+
+  async create(data: WorkflowWriteData): Promise<WorkflowRow> {
+    const [row] = await this.db
+      .insert(workflows)
+      .values({
+        ...(data.id ? { id: data.id } : {}),
+        spaceId: data.spaceId,
+        name: data.name,
+        description: data.description ?? null,
+        enabled: data.enabled ?? false,
+        trigger: data.trigger,
+        steps: data.steps,
+      })
+      .returning();
+    if (!row) throw new ManabloxError('workflow.create.failed');
+    return row;
+  }
+
+  async update(id: string, data: Loose<Omit<WorkflowWriteData, 'spaceId'>>): Promise<WorkflowRow> {
+    const [row] = await this.db
+      .update(workflows)
+      .set({
+        ...(data.name !== undefined ? { name: data.name } : {}),
+        ...(data.description !== undefined ? { description: data.description } : {}),
+        ...(data.enabled !== undefined ? { enabled: data.enabled } : {}),
+        ...(data.trigger !== undefined ? { trigger: data.trigger } : {}),
+        ...(data.steps !== undefined ? { steps: data.steps } : {}),
+        updatedAt: new Date(),
+      })
+      .where(eq(workflows.id, id))
+      .returning();
+    if (!row) throw ManabloxError.notFound('workflow.notFound', { id });
+    return row;
+  }
+
+  async delete(id: string): Promise<void> {
+    await this.db.delete(workflows).where(eq(workflows.id, id));
+  }
+
+  /**
+   * Claims a scheduled workflow for one minute. Returns false when another process got
+   * there first — the update matches nothing once `lastScheduledAt` is already `minute`.
+   */
+  async claimSchedule(id: string, minute: Date): Promise<boolean> {
+    const rows = await this.db
+      .update(workflows)
+      .set({ lastScheduledAt: minute })
+      .where(
+        and(
+          eq(workflows.id, id),
+          or(isNull(workflows.lastScheduledAt), lt(workflows.lastScheduledAt, minute)),
+        ),
+      )
+      .returning({ id: workflows.id });
+    return rows.length > 0;
+  }
+
+  async touchRun(id: string, at: Date): Promise<void> {
+    await this.db.update(workflows).set({ lastRunAt: at }).where(eq(workflows.id, id));
+  }
+
+  // --- runs ------------------------------------------------------------------
+
+  async createRun(data: WorkflowRunCreateData): Promise<WorkflowRunRow> {
+    const [row] = await this.db
+      .insert(workflowRuns)
+      .values({
+        workflowId: data.workflowId,
+        spaceId: data.spaceId,
+        trigger: data.trigger,
+        context: data.context,
+        status: 'queued',
+      })
+      .returning();
+    if (!row) throw new ManabloxError('workflow.create.failed');
+    await this.pruneRuns(data.workflowId);
+    return row;
+  }
+
+  async findRun(id: string): Promise<WorkflowRunRow | null> {
+    const rows = await this.db.select().from(workflowRuns).where(eq(workflowRuns.id, id)).limit(1);
+    return rows[0] ?? null;
+  }
+
+  async listRuns(workflowId: string, limit = 50): Promise<WorkflowRunRow[]> {
+    return this.db
+      .select()
+      .from(workflowRuns)
+      .where(eq(workflowRuns.workflowId, workflowId))
+      .orderBy(desc(workflowRuns.createdAt))
+      .limit(limit);
+  }
+
+  /**
+   * Moves a run from `queued` or `waiting` to `running`, or reports that it is not
+   * there to be moved. The status check in the predicate is what keeps two workers off
+   * the same run.
+   */
+  async claimRun(id: string): Promise<WorkflowRunRow | null> {
+    const rows = await this.db
+      .update(workflowRuns)
+      .set({ status: 'running', startedAt: sql`coalesce(${workflowRuns.startedAt}, now())` })
+      .where(and(eq(workflowRuns.id, id), inArray(workflowRuns.status, ['queued', 'waiting'])))
+      .returning();
+    return rows[0] ?? null;
+  }
+
+  /** Runs paused by a delay step whose time has come. */
+  async dueRuns(now: Date, limit = 100): Promise<WorkflowRunRow[]> {
+    return this.db
+      .select()
+      .from(workflowRuns)
+      .where(and(eq(workflowRuns.status, 'waiting'), lte(workflowRuns.resumeAt, now)))
+      .orderBy(workflowRuns.resumeAt)
+      .limit(limit);
+  }
+
+  async saveRunProgress(
+    id: string,
+    data: {
+      status: WorkflowRunStatus;
+      cursor: WorkflowCursor;
+      log: WorkflowStepLog[];
+      error?: string | null | undefined;
+      resumeAt?: Date | null | undefined;
+      finished?: boolean | undefined;
+    },
+  ): Promise<void> {
+    await this.db
+      .update(workflowRuns)
+      .set({
+        status: data.status,
+        cursor: data.cursor,
+        log: data.log,
+        error: data.error ?? null,
+        resumeAt: data.resumeAt ?? null,
+        ...(data.finished ? { finishedAt: new Date() } : {}),
+      })
+      .where(eq(workflowRuns.id, id));
+  }
+
+  private async pruneRuns(workflowId: string): Promise<void> {
+    await this.db.execute(sql`
+      delete from ${workflowRuns}
+      where ${workflowRuns.workflowId} = ${workflowId}
+        and ${workflowRuns.id} in (
+          select id from ${workflowRuns}
+          where ${workflowRuns.workflowId} = ${workflowId}
+          order by ${workflowRuns.createdAt} desc
+          offset ${RUNS_KEPT_PER_WORKFLOW}
+        )
+    `);
+  }
+
+  // --- documents for scheduled runs -----------------------------------------
+
+  /** The documents a scheduled workflow's selection names, newest change first. */
+  async selectDocuments(
+    spaceId: string,
+    selection: WorkflowSelection,
+    limit = 500,
+  ): Promise<ContentRow[]> {
+    const predicates = [eq(contents.spaceId, spaceId)];
+    if (selection.typeIds.length) predicates.push(inArray(contents.typeId, selection.typeIds));
+    if (selection.status !== 'any') predicates.push(eq(contents.status, selection.status));
+    if (selection.locale) predicates.push(eq(contents.locale, selection.locale));
+    if (selection.changedWithinHours) {
+      const since = new Date(Date.now() - selection.changedWithinHours * 3_600_000);
+      predicates.push(gte(contents.updatedAt, since));
+    }
+    return this.db
+      .select()
+      .from(contents)
+      .where(and(...predicates))
+      .orderBy(desc(contents.updatedAt))
+      .limit(limit);
+  }
+
+  // --- push subscriptions ----------------------------------------------------
+
+  async subscriptionsFor(userIds: string[]): Promise<PushSubscriptionRow[]> {
+    if (userIds.length === 0) return [];
+    return this.db
+      .select()
+      .from(pushSubscriptions)
+      .where(inArray(pushSubscriptions.userId, userIds));
+  }
+
+  async subscriptionsOf(userId: string): Promise<PushSubscriptionRow[]> {
+    return this.db
+      .select()
+      .from(pushSubscriptions)
+      .where(eq(pushSubscriptions.userId, userId))
+      .orderBy(desc(pushSubscriptions.createdAt));
+  }
+
+  /** Upserts on the endpoint: a browser re-subscribing keeps one row, not two. */
+  async subscribe(data: {
+    userId: string;
+    endpoint: string;
+    keys: { p256dh: string; auth: string };
+    userAgent: string | null;
+  }): Promise<PushSubscriptionRow> {
+    const [row] = await this.db
+      .insert(pushSubscriptions)
+      .values(data)
+      .onConflictDoUpdate({
+        target: pushSubscriptions.endpoint,
+        set: { userId: data.userId, keys: data.keys, userAgent: data.userAgent },
+      })
+      .returning();
+    if (!row) throw new ManabloxError('workflow.create.failed');
+    return row;
+  }
+
+  async unsubscribe(userId: string, endpoint: string): Promise<void> {
+    await this.db
+      .delete(pushSubscriptions)
+      .where(and(eq(pushSubscriptions.userId, userId), eq(pushSubscriptions.endpoint, endpoint)));
+  }
+
+  /** A push service answered 404/410: the browser is gone, and so is the row. */
+  async dropSubscription(id: string): Promise<void> {
+    await this.db.delete(pushSubscriptions).where(eq(pushSubscriptions.id, id));
+  }
+
+  async markSubscriptionUsed(id: string): Promise<void> {
+    await this.db
+      .update(pushSubscriptions)
+      .set({ lastUsedAt: new Date() })
+      .where(eq(pushSubscriptions.id, id));
+  }
+}

package/src/schema/assets.ts

@@ -0,0 +1,108 @@
+import { sql } from 'drizzle-orm';
+import {
+  boolean,
+  index,
+  integer,
+  jsonb,
+  pgTable,
+  primaryKey,
+  text,
+  timestamp,
+  uniqueIndex,
+  uuid,
+} from 'drizzle-orm/pg-core';
+import { contents } from './content.js';
+import { spaces } from './spaces.js';
+
+export const assets = pgTable(
+  'assets',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    spaceId: uuid()
+      .notNull()
+      .references(() => spaces.id, { onDelete: 'cascade' }),
+    driver: text().notNull().default('local'),
+    /** Storage-relative key, e.g. `<space>/2026/09/photo.jpg`. */
+    key: text().notNull(),
+    filename: text().notNull(),
+    name: text().notNull(),
+    mimeType: text().notNull(),
+    size: integer().notNull(),
+    width: integer(),
+    height: integer(),
+    /** Seconds, for audio/video. */
+    duration: integer(),
+    /** SHA-256 of the bytes, for dedupe. */
+    checksum: text(),
+    alt: text(),
+    title: text(),
+    meta: jsonb().$type<Record<string, unknown>>().notNull().default(sql`'{}'::jsonb`),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    createdBy: uuid(),
+  },
+  (table) => [
+    uniqueIndex('assets_driver_key_key').on(table.driver, table.key),
+    index('assets_space_idx').on(table.spaceId, table.createdAt),
+    index('assets_checksum_idx').on(table.spaceId, table.checksum),
+    index('assets_mime_idx').on(table.spaceId, table.mimeType),
+  ],
+);
+
+export const assetVariants = pgTable(
+  'asset_variants',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    assetId: uuid()
+      .notNull()
+      .references(() => assets.id, { onDelete: 'cascade' }),
+    preset: text().notNull(),
+    format: text().notNull(),
+    key: text().notNull(),
+    width: integer(),
+    height: integer(),
+    size: integer().notNull(),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('asset_variants_asset_preset_format_key').on(
+      table.assetId,
+      table.preset,
+      table.format,
+    ),
+  ],
+);
+
+/**
+ * Which documents reference which assets, and whether any of them is published.
+ *
+ * Assets have no draft/published distinction of their own, so before this table an
+ * asset id resolved on the public API whether or not anything published pointed at it —
+ * including a file uploaded for a draft that never shipped. Maintained from the same
+ * publish/unpublish/delete hooks that purge the cache, out of the references each field
+ * type already declares.
+ */
+export const assetUsages = pgTable(
+  'asset_usages',
+  {
+    assetId: uuid()
+      .notNull()
+      .references(() => assets.id, { onDelete: 'cascade' }),
+    contentId: uuid()
+      .notNull()
+      .references(() => contents.id, { onDelete: 'cascade' }),
+    spaceId: uuid()
+      .notNull()
+      .references(() => spaces.id, { onDelete: 'cascade' }),
+    /** True when the *published* projection of `contentId` references the asset. */
+    published: boolean().notNull().default(false),
+    updatedAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [
+    primaryKey({ columns: [table.assetId, table.contentId] }),
+    // The public asset check is `asset_id = any($1) and published`; this index serves it
+    // without touching the heap.
+    index('asset_usages_published_idx').on(table.assetId, table.published),
+    index('asset_usages_content_idx').on(table.contentId),
+  ],
+);

package/src/schema/auth.ts

@@ -0,0 +1,166 @@
+import { sql } from 'drizzle-orm';
+import {
+  boolean,
+  index,
+  jsonb,
+  pgTable,
+  primaryKey,
+  text,
+  timestamp,
+  uniqueIndex,
+  uuid,
+} from 'drizzle-orm/pg-core';
+import { spaces } from './spaces.js';
+
+// better-auth owns the user, session, account and verification tables; they are declared
+// here so Drizzle can join and migrate them.
+
+export const users = pgTable(
+  'users',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    name: text().notNull().default(''),
+    email: text().notNull(),
+    emailVerified: boolean().notNull().default(false),
+    image: text(),
+    /** Instance-wide role. Space-scoped roles live on `memberships`. */
+    role: text().notNull().default('editor'),
+    banned: boolean().notNull().default(false),
+    banReason: text(),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [uniqueIndex('users_email_key').on(table.email)],
+);
+
+/** One row per active session, so multiple devices can be signed in at once. */
+export const sessions = pgTable(
+  'sessions',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    userId: uuid()
+      .notNull()
+      .references(() => users.id, { onDelete: 'cascade' }),
+    token: text().notNull(),
+    expiresAt: timestamp({ withTimezone: true }).notNull(),
+    ipAddress: text(),
+    userAgent: text(),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('sessions_token_key').on(table.token),
+    index('sessions_user_idx').on(table.userId),
+    index('sessions_expires_idx').on(table.expiresAt),
+  ],
+);
+
+export const accounts = pgTable(
+  'accounts',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    userId: uuid()
+      .notNull()
+      .references(() => users.id, { onDelete: 'cascade' }),
+    accountId: text().notNull(),
+    providerId: text().notNull(),
+    /** Required by better-auth 1.7 for OIDC issuer disambiguation. */
+    issuer: text().notNull().default(''),
+    accessToken: text(),
+    refreshToken: text(),
+    accessTokenExpiresAt: timestamp({ withTimezone: true }),
+    refreshTokenExpiresAt: timestamp({ withTimezone: true }),
+    scope: text(),
+    idToken: text(),
+    password: text(),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [uniqueIndex('accounts_provider_account_key').on(table.providerId, table.accountId)],
+);
+
+export const verifications = pgTable(
+  'verifications',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    identifier: text().notNull(),
+    value: text().notNull(),
+    expiresAt: timestamp({ withTimezone: true }).notNull(),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [index('verifications_identifier_idx').on(table.identifier)],
+);
+
+export const apikeys = pgTable(
+  'apikeys',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    name: text(),
+    start: text(),
+    prefix: text(),
+    key: text().notNull(),
+    userId: uuid()
+      .notNull()
+      .references(() => users.id, { onDelete: 'cascade' }),
+    enabled: boolean().notNull().default(true),
+    expiresAt: timestamp({ withTimezone: true }),
+    lastRequest: timestamp({ withTimezone: true }),
+    /**
+     * Grants this key is confined to, in the roles' vocabulary; `null` means whatever
+     * the owner's role allows. Like `spaceIds`, a restriction only ever narrows.
+     */
+    permissions: jsonb().$type<string[] | null>(),
+    /**
+     * Space ids this key may act in; `null` means every space the owner belongs to.
+     * A restriction only ever narrows the owner's own access, never widens it.
+     */
+    spaceIds: jsonb().$type<string[] | null>(),
+    metadata: text(),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [index('apikeys_user_idx').on(table.userId)],
+);
+
+/** Space-scoped role assignment. */
+export const memberships = pgTable(
+  'memberships',
+  {
+    userId: uuid()
+      .notNull()
+      .references(() => users.id, { onDelete: 'cascade' }),
+    spaceId: uuid()
+      .notNull()
+      .references(() => spaces.id, { onDelete: 'cascade' }),
+    /** The machine name of a built-in role or of a row in `roles` for the same space. */
+    role: text().notNull().default('editor'),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [
+    primaryKey({ columns: [table.userId, table.spaceId] }),
+    index('memberships_space_idx').on(table.spaceId),
+  ],
+);
+
+/**
+ * A role someone created for a space, beside the built-in five. `permissions` holds the
+ * grants: `space:write`, `content:read` for every type, or `content:read:<typeId>` for
+ * one. Memberships name it by `machineName`, so a custom role is one row and one name.
+ */
+export const roles = pgTable(
+  'roles',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    spaceId: uuid()
+      .notNull()
+      .references(() => spaces.id, { onDelete: 'cascade' }),
+    name: text().notNull(),
+    machineName: text().notNull(),
+    description: text(),
+    permissions: jsonb().$type<string[]>().notNull().default(sql`'[]'::jsonb`),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [uniqueIndex('roles_space_machine_name_key').on(table.spaceId, table.machineName)],
+);

package/src/schema/content-types.ts

@@ -0,0 +1,31 @@
+import type { FieldDefinition } from '@manablox/core';
+import { sql } from 'drizzle-orm';
+import { boolean, index, jsonb, pgTable, text, timestamp, unique, uuid } from 'drizzle-orm/pg-core';
+import { spaces } from './spaces.js';
+
+/** Runtime-defined content types only; code-defined ones live in the registry. */
+export const contentTypes = pgTable(
+  'content_types',
+  {
+    id: uuid().primaryKey().defaultRandom(),
+    spaceId: uuid().references(() => spaces.id, { onDelete: 'cascade' }),
+    name: text().notNull(),
+    label: text().notNull(),
+    description: text(),
+    icon: text(),
+    kind: text().$type<'content' | 'block'>().notNull().default('content'),
+    hasSlug: boolean().notNull().default(true),
+    isPublishable: boolean().notNull().default(true),
+    isVisibleInTree: boolean().notNull().default(true),
+    canBeVisibleInMenu: boolean().notNull().default(true),
+    fields: jsonb().$type<FieldDefinition[]>().notNull().default(sql`'[]'::jsonb`),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => [
+    // NULLS NOT DISTINCT so two global types cannot share a name — plain UNIQUE would
+    // treat every NULL space_id as distinct and let duplicates through.
+    unique('content_types_space_name_key').on(table.spaceId, table.name).nullsNotDistinct(),
+    index('content_types_space_idx').on(table.spaceId),
+  ],
+);