@manablox/db 0.2.0 → 0.3.0

package/src/repositories/user.ts

@@ -1,280 +0,0 @@
-import { ManabloxError } from '@manablox/core';
-import { and, desc, eq, inArray, sql } from 'drizzle-orm';
-import type { Database } from '../client.js';
-import { type Paginated, paginate } from '../pagination.js';
-import type { Pagination } from '../query.js';
-import {
-  accounts,
-  type MembershipRow,
-  memberships,
-  roles,
-  type SpaceRow,
-  sessions,
-  spaces,
-  type UserRow,
-  users,
-} from '../schema/index.js';
-
-/** The name of a role in a space: one of the built-in five, or a row in `roles`. */
-export type SpaceRole = string;
-
-/** What it takes to create an account that can sign in with a password. */
-export interface UserCreateData {
-  name: string;
-  email: string;
-  role: string;
-  /** Already hashed; the repository never sees a plaintext password. */
-  passwordHash: string;
-}
-
-export interface UserUpdateData {
-  name?: string;
-  email?: string;
-}
-
-/**
- * How better-auth 1.7 identifies an email + password credential: sign-in looks for an
- * account with this provider *and* this issuer, so a row missing either is invisible to
- * it and the account can never sign in.
- */
-const CREDENTIAL_PROVIDER = 'credential';
-const CREDENTIAL_ISSUER = 'local:credential';
-
-export class UserRepository {
-  constructor(private readonly db: Database) {}
-
-  async findById(id: string): Promise<UserRow | null> {
-    const rows = await this.db.select().from(users).where(eq(users.id, id)).limit(1);
-    return rows[0] ?? null;
-  }
-
-  async findManyByIds(ids: string[]): Promise<UserRow[]> {
-    if (ids.length === 0) return [];
-    return this.db.select().from(users).where(inArray(users.id, ids));
-  }
-
-  async findByEmail(email: string): Promise<UserRow | null> {
-    const rows = await this.db.select().from(users).where(eq(users.email, email)).limit(1);
-    return rows[0] ?? null;
-  }
-
-  async list(pagination: Pagination, search?: string): Promise<Paginated<UserRow>> {
-    const where = search
-      ? sql`${users.email} ilike ${`%${search}%`} or ${users.name} ilike ${`%${search}%`}`
-      : undefined;
-
-    return paginate(this.db, users, { where, orderBy: desc(users.createdAt), pagination });
-  }
-
-  /**
-   * Users who are not members of a space, matching a search, newest first: the
-   * add-member picker's candidates, decided in SQL rather than by loading a page of
-   * users and filtering it here.
-   */
-  async candidates(spaceId: string, search: string | undefined, limit: number): Promise<UserRow[]> {
-    const notMember = sql`not exists (select 1 from ${memberships} where ${memberships.userId} = ${users.id} and ${memberships.spaceId} = ${spaceId})`;
-    const where = search
-      ? and(
-          notMember,
-          sql`(${users.email} ilike ${`%${search}%`} or ${users.name} ilike ${`%${search}%`})`,
-        )
-      : notMember;
-    return this.db.select().from(users).where(where).orderBy(desc(users.createdAt)).limit(limit);
-  }
-
-  async count(): Promise<number> {
-    const rows = await this.db.select({ count: sql<number>`count(*)::int` }).from(users);
-    return rows[0]?.count ?? 0;
-  }
-
-  /**
-   * Inserts the user and its password credential together, so a failure on the second
-   * row cannot leave an account nobody can sign in to. The account row is shaped the way
-   * better-auth writes it on sign-up, so a sign-in later finds it as its own.
-   */
-  async create(data: UserCreateData): Promise<UserRow> {
-    return this.db.transaction(async (tx) => {
-      const [user] = await tx
-        .insert(users)
-        .values({ name: data.name, email: data.email, role: data.role })
-        .returning();
-      if (!user) throw new ManabloxError('user.create.failed');
-      await tx.insert(accounts).values({
-        userId: user.id,
-        accountId: user.id,
-        providerId: CREDENTIAL_PROVIDER,
-        issuer: CREDENTIAL_ISSUER,
-        password: data.passwordHash,
-      });
-      return user;
-    });
-  }
-
-  async update(id: string, data: UserUpdateData): Promise<UserRow> {
-    const [row] = await this.db
-      .update(users)
-      .set({ ...data, updatedAt: new Date() })
-      .where(eq(users.id, id))
-      .returning();
-    if (!row) throw ManabloxError.notFound('user.notFound', { id });
-    return row;
-  }
-
-  async delete(id: string): Promise<void> {
-    // Sessions, accounts, api keys and memberships cascade in the schema.
-    await this.db.delete(users).where(eq(users.id, id));
-  }
-
-  async setBanned(id: string, banned: boolean, reason: string | null): Promise<UserRow> {
-    const [row] = await this.db
-      .update(users)
-      .set({ banned, banReason: banned ? reason : null, updatedAt: new Date() })
-      .where(eq(users.id, id))
-      .returning();
-    if (!row) throw ManabloxError.notFound('user.notFound', { id });
-    return row;
-  }
-
-  /**
-   * Replaces the password credential, creating it for an account that only ever signed
-   * in through another provider.
-   */
-  async setPasswordHash(userId: string, passwordHash: string): Promise<void> {
-    const updated = await this.db
-      .update(accounts)
-      .set({ password: passwordHash, updatedAt: new Date() })
-      .where(
-        and(
-          eq(accounts.userId, userId),
-          eq(accounts.providerId, CREDENTIAL_PROVIDER),
-          eq(accounts.issuer, CREDENTIAL_ISSUER),
-        ),
-      )
-      .returning({ id: accounts.id });
-    if (updated.length) return;
-    await this.db.insert(accounts).values({
-      userId,
-      accountId: userId,
-      providerId: CREDENTIAL_PROVIDER,
-      issuer: CREDENTIAL_ISSUER,
-      password: passwordHash,
-    });
-  }
-
-  /** Signs the user out everywhere. */
-  async revokeSessions(userId: string): Promise<void> {
-    await this.db.delete(sessions).where(eq(sessions.userId, userId));
-  }
-
-  async countByRole(role: string): Promise<number> {
-    const rows = await this.db
-      .select({ count: sql<number>`count(*)::int` })
-      .from(users)
-      .where(eq(users.role, role));
-    return rows[0]?.count ?? 0;
-  }
-
-  async setRole(id: string, role: string): Promise<UserRow> {
-    const [row] = await this.db
-      .update(users)
-      .set({ role, updatedAt: new Date() })
-      .where(eq(users.id, id))
-      .returning();
-    if (!row) throw ManabloxError.notFound('user.notFound', { id });
-    return row;
-  }
-
-  // --- space membership -----------------------------------------------------
-
-  /**
-   * Authoritative role plus space memberships in one query.
-   *
-   * Read on every authenticated request rather than trusting the role embedded in the
-   * session: better-auth caches the session payload (five minutes by default), so a
-   * promotion or demotion would otherwise not take effect until that cache expired.
-   *
-   * A membership naming a custom role joins that role's grants; one naming a built-in
-   * role has none here, and the auth package answers those from its own table.
-   */
-  async principal(userId: string): Promise<{
-    role: string;
-    banned: boolean;
-    spaces: Record<string, SpaceRole>;
-    permissions: Record<string, string[]>;
-  } | null> {
-    const rows = await this.db
-      .select({
-        role: users.role,
-        banned: users.banned,
-        spaceId: memberships.spaceId,
-        spaceRole: memberships.role,
-        grants: roles.permissions,
-      })
-      .from(users)
-      .leftJoin(memberships, eq(memberships.userId, users.id))
-      .leftJoin(
-        roles,
-        and(eq(roles.spaceId, memberships.spaceId), eq(roles.machineName, memberships.role)),
-      )
-      .where(eq(users.id, userId));
-
-    const first = rows[0];
-    if (!first) return null;
-
-    const spaces: Record<string, SpaceRole> = {};
-    const permissions: Record<string, string[]> = {};
-    for (const row of rows) {
-      if (!row.spaceId || !row.spaceRole) continue;
-      spaces[row.spaceId] = row.spaceRole;
-      if (row.grants) permissions[row.spaceId] = row.grants;
-    }
-
-    return { role: first.role, banned: first.banned, spaces, permissions };
-  }
-
-  async memberships(userId: string): Promise<MembershipRow[]> {
-    return this.db.select().from(memberships).where(eq(memberships.userId, userId));
-  }
-
-  /** The user's memberships with the space each one is in, for a per-user view. */
-  async membershipsWithSpaces(userId: string): Promise<Array<MembershipRow & { space: SpaceRow }>> {
-    const rows = await this.db
-      .select({ membership: memberships, space: spaces })
-      .from(memberships)
-      .innerJoin(spaces, eq(spaces.id, memberships.spaceId))
-      .where(eq(memberships.userId, userId))
-      .orderBy(spaces.name);
-    return rows.map((row) => ({ ...row.membership, space: row.space }));
-  }
-
-  async membersOf(spaceId: string): Promise<Array<MembershipRow & { user: UserRow }>> {
-    const rows = await this.db
-      .select({ membership: memberships, user: users })
-      .from(memberships)
-      .innerJoin(users, eq(users.id, memberships.userId))
-      .where(eq(memberships.spaceId, spaceId));
-    return rows.map((row) => ({ ...row.membership, user: row.user }));
-  }
-
-  async roleIn(userId: string, spaceId: string): Promise<SpaceRole | null> {
-    const rows = await this.db
-      .select({ role: memberships.role })
-      .from(memberships)
-      .where(and(eq(memberships.userId, userId), eq(memberships.spaceId, spaceId)))
-      .limit(1);
-    return rows[0]?.role ?? null;
-  }
-
-  async grant(userId: string, spaceId: string, role: SpaceRole): Promise<void> {
-    await this.db
-      .insert(memberships)
-      .values({ userId, spaceId, role })
-      .onConflictDoUpdate({ target: [memberships.userId, memberships.spaceId], set: { role } });
-  }
-
-  async revoke(userId: string, spaceId: string): Promise<void> {
-    await this.db
-      .delete(memberships)
-      .where(and(eq(memberships.userId, userId), eq(memberships.spaceId, spaceId)));
-  }
-}

package/src/repositories/webhook.ts

@@ -1,46 +0,0 @@
-import { and, eq } from 'drizzle-orm';
-import type { Database } from '../client.js';
-import { webhookDeliveries, webhooks } from '../schema/index.js';
-
-export type WebhookRow = typeof webhooks.$inferSelect;
-export type WebhookDeliveryRow = typeof webhookDeliveries.$inferSelect;
-
-export interface WebhookDeliveryData {
-  webhookId: string;
-  event: string;
-  payload: Record<string, unknown>;
-  status: number | null;
-  error: string | null;
-}
-
-/** The webhooks of a space and the log of what was sent to them. */
-export class WebhookRepository {
-  constructor(private readonly db: Database) {}
-
-  async findById(id: string): Promise<WebhookRow | null> {
-    const rows = await this.db.select().from(webhooks).where(eq(webhooks.id, id)).limit(1);
-    return rows[0] ?? null;
-  }
-
-  /** The switched-on webhooks of a space, for fanning an event out. */
-  async findEnabled(spaceId: string): Promise<WebhookRow[]> {
-    return this.db
-      .select()
-      .from(webhooks)
-      .where(and(eq(webhooks.spaceId, spaceId), eq(webhooks.enabled, true)));
-  }
-
-  async recordDelivery(data: WebhookDeliveryData): Promise<WebhookDeliveryRow> {
-    const [row] = await this.db.insert(webhookDeliveries).values(data).returning();
-    return row as WebhookDeliveryRow;
-  }
-
-  async deliveries(webhookId: string, limit = 50): Promise<WebhookDeliveryRow[]> {
-    return this.db
-      .select()
-      .from(webhookDeliveries)
-      .where(eq(webhookDeliveries.webhookId, webhookId))
-      .orderBy(webhookDeliveries.createdAt)
-      .limit(limit);
-  }
-}

package/src/repositories/workflow.ts

@@ -1,306 +0,0 @@
-import {
-  type Loose,
-  ManabloxError,
-  type WorkflowCursor,
-  type WorkflowRunContext,
-  type WorkflowRunStatus,
-  type WorkflowSelection,
-  type WorkflowStep,
-  type WorkflowStepLog,
-  type WorkflowTrigger,
-} from '@manablox/core';
-import { and, desc, eq, gte, inArray, isNull, lt, lte, or, sql } from 'drizzle-orm';
-import type { Database } from '../client.js';
-import {
-  type ContentRow,
-  contents,
-  type PushSubscriptionRow,
-  pushSubscriptions,
-  type WorkflowRow,
-  type WorkflowRunRow,
-  workflowRuns,
-  workflows,
-} from '../schema/index.js';
-
-export interface WorkflowWriteData {
-  id?: string | undefined;
-  spaceId: string;
-  name: string;
-  description?: string | null | undefined;
-  enabled?: boolean | undefined;
-  trigger: WorkflowTrigger;
-  steps: WorkflowStep[];
-}
-
-export interface WorkflowRunCreateData {
-  workflowId: string;
-  spaceId: string;
-  trigger: string;
-  context: WorkflowRunContext;
-}
-
-/** How many runs a workflow keeps; older ones are pruned as new ones are written. */
-export const RUNS_KEPT_PER_WORKFLOW = 200;
-
-export class WorkflowRepository {
-  constructor(private readonly db: Database) {}
-
-  // --- workflows -------------------------------------------------------------
-
-  async listBySpace(spaceId: string): Promise<WorkflowRow[]> {
-    return this.db
-      .select()
-      .from(workflows)
-      .where(eq(workflows.spaceId, spaceId))
-      .orderBy(workflows.name);
-  }
-
-  /** Every enabled workflow of a space, for the dispatcher; every enabled one at all for the scheduler. */
-  async listEnabled(spaceId?: string): Promise<WorkflowRow[]> {
-    return this.db
-      .select()
-      .from(workflows)
-      .where(
-        spaceId
-          ? and(eq(workflows.enabled, true), eq(workflows.spaceId, spaceId))
-          : eq(workflows.enabled, true),
-      );
-  }
-
-  async findById(id: string): Promise<WorkflowRow | null> {
-    const rows = await this.db.select().from(workflows).where(eq(workflows.id, id)).limit(1);
-    return rows[0] ?? null;
-  }
-
-  async create(data: WorkflowWriteData): Promise<WorkflowRow> {
-    const [row] = await this.db
-      .insert(workflows)
-      .values({
-        ...(data.id ? { id: data.id } : {}),
-        spaceId: data.spaceId,
-        name: data.name,
-        description: data.description ?? null,
-        enabled: data.enabled ?? false,
-        trigger: data.trigger,
-        steps: data.steps,
-      })
-      .returning();
-    if (!row) throw new ManabloxError('workflow.create.failed');
-    return row;
-  }
-
-  async update(id: string, data: Loose<Omit<WorkflowWriteData, 'spaceId'>>): Promise<WorkflowRow> {
-    const [row] = await this.db
-      .update(workflows)
-      .set({
-        ...(data.name !== undefined ? { name: data.name } : {}),
-        ...(data.description !== undefined ? { description: data.description } : {}),
-        ...(data.enabled !== undefined ? { enabled: data.enabled } : {}),
-        ...(data.trigger !== undefined ? { trigger: data.trigger } : {}),
-        ...(data.steps !== undefined ? { steps: data.steps } : {}),
-        updatedAt: new Date(),
-      })
-      .where(eq(workflows.id, id))
-      .returning();
-    if (!row) throw ManabloxError.notFound('workflow.notFound', { id });
-    return row;
-  }
-
-  async delete(id: string): Promise<void> {
-    await this.db.delete(workflows).where(eq(workflows.id, id));
-  }
-
-  /**
-   * Claims a scheduled workflow for one minute. Returns false when another process got
-   * there first — the update matches nothing once `lastScheduledAt` is already `minute`.
-   */
-  async claimSchedule(id: string, minute: Date): Promise<boolean> {
-    const rows = await this.db
-      .update(workflows)
-      .set({ lastScheduledAt: minute })
-      .where(
-        and(
-          eq(workflows.id, id),
-          or(isNull(workflows.lastScheduledAt), lt(workflows.lastScheduledAt, minute)),
-        ),
-      )
-      .returning({ id: workflows.id });
-    return rows.length > 0;
-  }
-
-  async touchRun(id: string, at: Date): Promise<void> {
-    await this.db.update(workflows).set({ lastRunAt: at }).where(eq(workflows.id, id));
-  }
-
-  // --- runs ------------------------------------------------------------------
-
-  async createRun(data: WorkflowRunCreateData): Promise<WorkflowRunRow> {
-    const [row] = await this.db
-      .insert(workflowRuns)
-      .values({
-        workflowId: data.workflowId,
-        spaceId: data.spaceId,
-        trigger: data.trigger,
-        context: data.context,
-        status: 'queued',
-      })
-      .returning();
-    if (!row) throw new ManabloxError('workflow.create.failed');
-    await this.pruneRuns(data.workflowId);
-    return row;
-  }
-
-  async findRun(id: string): Promise<WorkflowRunRow | null> {
-    const rows = await this.db.select().from(workflowRuns).where(eq(workflowRuns.id, id)).limit(1);
-    return rows[0] ?? null;
-  }
-
-  async listRuns(workflowId: string, limit = 50): Promise<WorkflowRunRow[]> {
-    return this.db
-      .select()
-      .from(workflowRuns)
-      .where(eq(workflowRuns.workflowId, workflowId))
-      .orderBy(desc(workflowRuns.createdAt))
-      .limit(limit);
-  }
-
-  /**
-   * Moves a run from `queued` or `waiting` to `running`, or reports that it is not
-   * there to be moved. The status check in the predicate is what keeps two workers off
-   * the same run.
-   */
-  async claimRun(id: string): Promise<WorkflowRunRow | null> {
-    const rows = await this.db
-      .update(workflowRuns)
-      .set({ status: 'running', startedAt: sql`coalesce(${workflowRuns.startedAt}, now())` })
-      .where(and(eq(workflowRuns.id, id), inArray(workflowRuns.status, ['queued', 'waiting'])))
-      .returning();
-    return rows[0] ?? null;
-  }
-
-  /** Runs paused by a delay step whose time has come. */
-  async dueRuns(now: Date, limit = 100): Promise<WorkflowRunRow[]> {
-    return this.db
-      .select()
-      .from(workflowRuns)
-      .where(and(eq(workflowRuns.status, 'waiting'), lte(workflowRuns.resumeAt, now)))
-      .orderBy(workflowRuns.resumeAt)
-      .limit(limit);
-  }
-
-  async saveRunProgress(
-    id: string,
-    data: {
-      status: WorkflowRunStatus;
-      cursor: WorkflowCursor;
-      log: WorkflowStepLog[];
-      error?: string | null | undefined;
-      resumeAt?: Date | null | undefined;
-      finished?: boolean | undefined;
-    },
-  ): Promise<void> {
-    await this.db
-      .update(workflowRuns)
-      .set({
-        status: data.status,
-        cursor: data.cursor,
-        log: data.log,
-        error: data.error ?? null,
-        resumeAt: data.resumeAt ?? null,
-        ...(data.finished ? { finishedAt: new Date() } : {}),
-      })
-      .where(eq(workflowRuns.id, id));
-  }
-
-  private async pruneRuns(workflowId: string): Promise<void> {
-    await this.db.execute(sql`
-      delete from ${workflowRuns}
-      where ${workflowRuns.workflowId} = ${workflowId}
-        and ${workflowRuns.id} in (
-          select id from ${workflowRuns}
-          where ${workflowRuns.workflowId} = ${workflowId}
-          order by ${workflowRuns.createdAt} desc
-          offset ${RUNS_KEPT_PER_WORKFLOW}
-        )
-    `);
-  }
-
-  // --- documents for scheduled runs -----------------------------------------
-
-  /** The documents a scheduled workflow's selection names, newest change first. */
-  async selectDocuments(
-    spaceId: string,
-    selection: WorkflowSelection,
-    limit = 500,
-  ): Promise<ContentRow[]> {
-    const predicates = [eq(contents.spaceId, spaceId)];
-    if (selection.typeIds.length) predicates.push(inArray(contents.typeId, selection.typeIds));
-    if (selection.status !== 'any') predicates.push(eq(contents.status, selection.status));
-    if (selection.locale) predicates.push(eq(contents.locale, selection.locale));
-    if (selection.changedWithinHours) {
-      const since = new Date(Date.now() - selection.changedWithinHours * 3_600_000);
-      predicates.push(gte(contents.updatedAt, since));
-    }
-    return this.db
-      .select()
-      .from(contents)
-      .where(and(...predicates))
-      .orderBy(desc(contents.updatedAt))
-      .limit(limit);
-  }
-
-  // --- push subscriptions ----------------------------------------------------
-
-  async subscriptionsFor(userIds: string[]): Promise<PushSubscriptionRow[]> {
-    if (userIds.length === 0) return [];
-    return this.db
-      .select()
-      .from(pushSubscriptions)
-      .where(inArray(pushSubscriptions.userId, userIds));
-  }
-
-  async subscriptionsOf(userId: string): Promise<PushSubscriptionRow[]> {
-    return this.db
-      .select()
-      .from(pushSubscriptions)
-      .where(eq(pushSubscriptions.userId, userId))
-      .orderBy(desc(pushSubscriptions.createdAt));
-  }
-
-  /** Upserts on the endpoint: a browser re-subscribing keeps one row, not two. */
-  async subscribe(data: {
-    userId: string;
-    endpoint: string;
-    keys: { p256dh: string; auth: string };
-    userAgent: string | null;
-  }): Promise<PushSubscriptionRow> {
-    const [row] = await this.db
-      .insert(pushSubscriptions)
-      .values(data)
-      .onConflictDoUpdate({
-        target: pushSubscriptions.endpoint,
-        set: { userId: data.userId, keys: data.keys, userAgent: data.userAgent },
-      })
-      .returning();
-    if (!row) throw new ManabloxError('workflow.create.failed');
-    return row;
-  }
-
-  async unsubscribe(userId: string, endpoint: string): Promise<void> {
-    await this.db
-      .delete(pushSubscriptions)
-      .where(and(eq(pushSubscriptions.userId, userId), eq(pushSubscriptions.endpoint, endpoint)));
-  }
-
-  /** A push service answered 404/410: the browser is gone, and so is the row. */
-  async dropSubscription(id: string): Promise<void> {
-    await this.db.delete(pushSubscriptions).where(eq(pushSubscriptions.id, id));
-  }
-
-  async markSubscriptionUsed(id: string): Promise<void> {
-    await this.db
-      .update(pushSubscriptions)
-      .set({ lastUsedAt: new Date() })
-      .where(eq(pushSubscriptions.id, id));
-  }
-}