@rsktash/beads-ui 0.1.50 → 0.10.3

package/server/db.js

@@ -1,154 +1,111 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
+// Database adapter for the web server. Pool-per-schema design so a single
+// bd-web instance can serve every project on a shared postgres without
+// SET-search-path races between concurrent requests.
+//
+// Workflow:
+//   const root = await openRoot(dsn);                 // for `/api/projects` etc.
+//   const project = await root.forProject('yuklar');  // for project-scoped queries
 
-/**
- * Resolve the SQLite DB path used by beads according to precedence:
- * 1) explicit --db flag (provided via options.explicit_db)
- * 2) BEADS_DB environment variable
- * 3) nearest ".beads/*.db" by walking up from cwd (excluding
- *    "~/.beads/default.db", which is reserved for fallback)
- * 4) "~/.beads/default.db" fallback
- *
- * Returns a normalized absolute path and a `source` indicator. Existence is
- * returned via the `exists` boolean.
- *
- * @param {{ cwd?: string, env?: Record<string, string | undefined>, explicit_db?: string }} [options]
- * @returns {{ path: string, source: 'flag'|'env'|'nearest'|'home-default', exists: boolean }}
- */
-export function resolveDbPath(options = {}) {
-  const cwd = options.cwd ? path.resolve(options.cwd) : process.cwd();
-  const env = options.env || process.env;
-  const home_default = path.join(os.homedir(), '.beads', 'default.db');
+import Database from 'better-sqlite3';
+import pg from 'pg';
+import { URL } from 'node:url';
+import { detectDriver, sqlitePath } from './dsn.js';
 
-  // 1) explicit flag
-  if (options.explicit_db && options.explicit_db.length > 0) {
-    const p = absFrom(options.explicit_db, cwd);
-    return { path: p, source: 'flag', exists: fileExists(p) };
-  }
+const { Pool } = pg;
 
-  // 2) BEADS_DB env
-  if (env.BEADS_DB && String(env.BEADS_DB).length > 0) {
-    const p = absFrom(String(env.BEADS_DB), cwd);
-    return { path: p, source: 'env', exists: fileExists(p) };
-  }
+export async function openRoot(dsn) {
+  const driver = detectDriver(dsn);
+  if (driver === 'sqlite') return new SqliteAdapter(dsn);
+  if (driver === 'postgres') return await PgRoot.create(dsn);
+  throw new Error(`unsupported driver: ${driver}`);
+}
 
-  // 3) nearest .beads/*.db walking up
-  const nearest = findNearestBeadsDb(cwd);
-  if (nearest && path.normalize(nearest) !== path.normalize(home_default)) {
-    return { path: nearest, source: 'nearest', exists: fileExists(nearest) };
+// SqliteAdapter has only one schema by definition. forProject() returns the
+// same adapter regardless of name — projects don't apply.
+class SqliteAdapter {
+  constructor(dsn) {
+    this.driver = 'sqlite';
+    this.db = new Database(sqlitePath(dsn), { readonly: false, fileMustExist: true });
+    this.db.pragma('foreign_keys = ON');
   }
-
-  // 4) ~/.beads/default.db
-  return {
-    path: home_default,
-    source: 'home-default',
-    exists: fileExists(home_default)
-  };
+  all(sql, params = [])  { return this.db.prepare(sql).all(...params); }
+  one(sql, params = [])  { return this.db.prepare(sql).get(...params); }
+  exec(sql, params = []) { return this.db.prepare(sql).run(...params); }
+  async close() { this.db.close(); }
+  async forProject(_prefix) { return this; } // single-project file
+  async listProjectNames() { return [];      } // no schemas to enumerate
 }
 
-/**
- * Resolve the workspace database location used by the UI/server.
- *
- * For non-SQLite backends (for example Dolt), this returns the nearest
- * workspace `.beads` directory when metadata exists. This avoids collapsing
- * all such workspaces onto the `~/.beads/default.db` fallback.
- *
- * @param {{ cwd?: string, env?: Record<string, string | undefined>, explicit_db?: string }} [options]
- * @returns {{ path: string, source: 'flag'|'env'|'nearest'|'metadata'|'home-default', exists: boolean }}
- */
-export function resolveWorkspaceDatabase(options = {}) {
-  const sqlite_db = resolveDbPath(options);
-  if (sqlite_db.source !== 'home-default') {
-    return sqlite_db;
+// PgRoot owns one Pool with no search_path (queries against
+// information_schema.schemata) and a Map<prefix, PgProject> of schema-bound
+// pools created lazily.
+class PgRoot {
+  static async create(dsn) {
+    const a = new PgRoot();
+    a.driver = 'postgres';
+    a.dsn = dsn;
+    // Strip any leftover search_path from the boot DSN — we manage it
+    // per-project below.
+    const u = new URL(dsn);
+    u.searchParams.delete('search_path');
+    a.rootPool = new Pool({ connectionString: u.toString() });
+    a.projects = new Map();
+    return a;
   }
 
-  const cwd = options.cwd ? path.resolve(options.cwd) : process.cwd();
-  const metadata_path = findNearestBeadsMetadata(cwd);
-  if (metadata_path) {
-    return {
-      path: path.dirname(metadata_path),
-      source: 'metadata',
-      exists: true
-    };
+  // root pool queries — used by listProjectNames + auth/config endpoints.
+  async all(sql, params = []) { return (await this.rootPool.query(rebind(sql), params)).rows; }
+  async one(sql, params = []) { return (await this.rootPool.query(rebind(sql), params)).rows[0]; }
+  async exec(sql, params = []) { return await this.rootPool.query(rebind(sql), params); }
+  async close() {
+    await this.rootPool.end();
+    for (const p of this.projects.values()) await p.pool.end();
   }
 
-  return sqlite_db;
-}
-
-/**
- * Find nearest `.beads/metadata.json` by walking up from start.
- *
- * @param {string} start
- * @returns {string | null}
- */
-export function findNearestBeadsMetadata(start) {
-  let dir = path.resolve(start);
-  for (let i = 0; i < 100; i++) {
-    const metadata_path = path.join(dir, '.beads', 'metadata.json');
-    if (fileExists(metadata_path)) {
-      return metadata_path;
-    }
-    const parent = path.dirname(dir);
-    if (parent === dir) {
-      break;
+  async forProject(prefix) {
+    if (!prefix || !/^[a-z0-9_-]+$/.test(prefix)) {
+      throw new Error(`invalid project prefix: ${prefix}`);
     }
-    dir = parent;
+    if (this.projects.has(prefix)) return this.projects.get(prefix);
+
+    const u = new URL(this.dsn);
+    u.searchParams.delete('search_path');
+    const existing = u.searchParams.get('options') || '';
+    const suffix = `-c search_path=${prefix}`;
+    u.searchParams.set('options', existing ? `${existing} ${suffix}` : suffix);
+    const pool = new Pool({ connectionString: u.toString() });
+    const proj = new PgProject(pool);
+    this.projects.set(prefix, proj);
+    return proj;
   }
-  return null;
-}
 
-/**
- * Find nearest .beads/*.db by walking up from start.
- * First alphabetical .db.
- *
- * @param {string} start
- * @returns {string | null}
- */
-export function findNearestBeadsDb(start) {
-  let dir = path.resolve(start);
-  // Cap iterations to avoid infinite loop in degenerate cases
-  for (let i = 0; i < 100; i++) {
-    const beads_dir = path.join(dir, '.beads');
-    try {
-      const entries = fs.readdirSync(beads_dir, { withFileTypes: true });
-      const dbs = entries
-        .filter((e) => e.isFile() && e.name.endsWith('.db'))
-        .map((e) => e.name)
-        .sort();
-      if (dbs.length > 0) {
-        return path.join(beads_dir, dbs[0]);
-      }
-    } catch {
-      // ignore and walk up
-    }
-    const parent = path.dirname(dir);
-    if (parent === dir) {
-      break;
-    }
-    dir = parent;
+  async listProjectNames() {
+    const rows = await this.all(`
+      SELECT s.schema_name FROM information_schema.schemata s
+      WHERE s.schema_name NOT IN ('pg_catalog','information_schema','pg_toast','public')
+        AND s.schema_name NOT LIKE 'pg_%'
+        AND EXISTS (
+          SELECT 1 FROM information_schema.tables t
+          WHERE t.table_schema = s.schema_name AND t.table_name = 'config'
+        )
+      ORDER BY s.schema_name`);
+    return rows.map((r) => r.schema_name);
   }
-  return null;
 }
 
-/**
- * Resolve possibly relative `p` against `cwd` to an absolute filesystem path.
- *
- * @param {string} p
- * @param {string} cwd
- */
-function absFrom(p, cwd) {
-  return path.isAbsolute(p) ? path.normalize(p) : path.join(cwd, p);
+// PgProject is the schema-bound view a route handler queries.
+class PgProject {
+  constructor(pool) {
+    this.driver = 'postgres';
+    this.pool = pool;
+  }
+  async all(sql, params = []) { return (await this.pool.query(rebind(sql), params)).rows; }
+  async one(sql, params = []) { return (await this.pool.query(rebind(sql), params)).rows[0]; }
+  async exec(sql, params = []) { return await this.pool.query(rebind(sql), params); }
+  async forProject(_p) { return this; }
 }
 
-/**
- * @param {string} p
- */
-function fileExists(p) {
-  try {
-    fs.accessSync(p, fs.constants.F_OK);
-    return true;
-  } catch {
-    return false;
-  }
+function rebind(sql) {
+  let n = 0;
+  return sql.replace(/\?/g, () => `$${++n}`);
 }

package/server/dsn.js

@@ -0,0 +1,130 @@
+// DSN resolution for the web server. Mirrors internal/config/config.go in the
+// Go CLI: read .bd/config (or $BD_DB), inject password from $BD_DB_PASSWORD or
+// a .env file. Sqlite paths and postgres URIs are both supported.
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const DIR_NAME = '.bd';
+export const CONFIG_NAME = 'config';
+export const ENV_FILE_NAME = '.env';
+export const ENV_DSN = 'BD_DB';
+export const ENV_DIR = 'BD_DIR';
+export const ENV_DB_PASSWORD = 'BD_DB_PASSWORD';
+
+export function resolve({ cwd = process.cwd(), env = process.env } = {}) {
+  let dsn = '';
+  let beadDir = '';
+
+  if (env[ENV_DSN]) dsn = env[ENV_DSN];
+
+  beadDir = findBeadDir(cwd, env);
+  if (!dsn && beadDir) dsn = readDSNFromFile(beadDir);
+  if (!dsn) {
+    if (!beadDir) {
+      throw new Error('no .bd directory found — run `bd init` first');
+    }
+    dsn = path.join(beadDir, 'bd.db');
+  }
+
+  const pw = lookupDBPassword(beadDir, env);
+  dsn = injectPassword(dsn, pw);
+  return { dsn, beadDir };
+}
+
+function findBeadDir(cwd, env) {
+  if (env[ENV_DIR]) return env[ENV_DIR];
+  let cur = path.resolve(cwd);
+  for (;;) {
+    const candidate = path.join(cur, DIR_NAME);
+    try {
+      if (fs.statSync(candidate).isDirectory()) return candidate;
+    } catch {}
+    const parent = path.dirname(cur);
+    if (parent === cur) break;
+    cur = parent;
+  }
+  return '';
+}
+
+function readDSNFromFile(dir) {
+  try {
+    const text = fs.readFileSync(path.join(dir, CONFIG_NAME), 'utf8');
+    for (const line of text.split('\n')) {
+      const t = line.trim();
+      if (!t || t.startsWith('#')) continue;
+      const eq = t.indexOf('=');
+      if (eq < 0) continue;
+      const k = t.slice(0, eq).trim();
+      const v = t.slice(eq + 1).trim();
+      if (k === 'db') return v;
+    }
+  } catch {}
+  return '';
+}
+
+function lookupDBPassword(beadDir, env) {
+  if (env[ENV_DB_PASSWORD]) return env[ENV_DB_PASSWORD];
+  const candidates = [path.join(process.cwd(), ENV_FILE_NAME)];
+  if (beadDir) candidates.push(path.join(beadDir, ENV_FILE_NAME));
+  for (const p of candidates) {
+    const v = readEnvKey(p, ENV_DB_PASSWORD);
+    if (v) return v;
+  }
+  return '';
+}
+
+function readEnvKey(file, key) {
+  try {
+    const text = fs.readFileSync(file, 'utf8');
+    const prefix = `${key}=`;
+    const exportPrefix = `export ${prefix}`;
+    for (const raw of text.split('\n')) {
+      let line = raw.trim();
+      if (!line || line.startsWith('#')) continue;
+      if (line.startsWith(exportPrefix)) line = line.slice('export '.length);
+      if (!line.startsWith(prefix)) continue;
+      let v = line.slice(prefix.length).trim();
+      if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) {
+        v = v.slice(1, -1);
+      }
+      return v;
+    }
+  } catch {}
+  return '';
+}
+
+export function injectPassword(dsn, pw) {
+  if (!pw) return dsn;
+  if (dsn.startsWith('postgres://') || dsn.startsWith('postgresql://')) {
+    return injectURIPassword(dsn, pw);
+  }
+  return dsn;
+}
+
+function injectURIPassword(dsn, pw) {
+  const idx = dsn.indexOf('://');
+  if (idx < 0) return dsn;
+  const scheme = dsn.slice(0, idx);
+  const rest = dsn.slice(idx + 3);
+  const at = rest.indexOf('@');
+  if (at <= 0) return dsn;
+  const cred = rest.slice(0, at);
+  const hostPath = rest.slice(at);
+  if (cred.includes(':')) return dsn;
+  return `${scheme}://${cred}:${encodeURIComponent(pw)}${hostPath}`;
+}
+
+export function detectDriver(dsn) {
+  if (dsn.startsWith('postgres://') || dsn.startsWith('postgresql://')) return 'postgres';
+  if (dsn.startsWith('sqlite://')) return 'sqlite';
+  if (dsn.startsWith('sqlite:')) return 'sqlite';
+  if (dsn.endsWith('.db') || dsn.endsWith('.sqlite') || dsn.endsWith('.sqlite3')) return 'sqlite';
+  throw new Error(`cannot determine driver from DSN ${dsn}`);
+}
+
+export function sqlitePath(dsn) {
+  if (dsn.startsWith('sqlite://')) return dsn.slice('sqlite://'.length);
+  if (dsn.startsWith('sqlite:')) return dsn.slice('sqlite:'.length);
+  return dsn;
+}

package/server/index.js

@@ -1,97 +1,161 @@
-import { createServer } from 'node:http';
-import { createApp } from './app.js';
-import { printServerUrl } from './cli/daemon.js';
-import { getConfig } from './config.js';
-import { resolveWorkspaceDatabase } from './db.js';
-import { startDoltServer, stopDoltServer } from './dolt-pool.js';
-import { debug, enableAllDebug } from './logging.js';
-import { registerWorkspace, watchRegistry } from './registry-watcher.js';
-import { watchDb } from './watcher.js';
-import { attachWsServer } from './ws.js';
-
-if (process.argv.includes('--debug') || process.argv.includes('-d')) {
-  enableAllDebug();
-}
+// Entry point for `bd-web`. Multi-project capable: a single instance routes
+// project-scoped requests to per-schema connection pools (see db.js). URLs
+// look like /api/p/<prefix>/issues, /api/p/<prefix>/issues/:id, etc.
+// `/api/me` and `/api/projects` are project-agnostic.
 
-// Parse --host and --port from argv and set env vars before getConfig()
-for (let i = 0; i < process.argv.length; i++) {
-  if (process.argv[i] === '--host' && process.argv[i + 1]) {
-    process.env.HOST = process.argv[++i];
-  }
-  if (process.argv[i] === '--port' && process.argv[i + 1]) {
-    process.env.PORT = process.argv[++i];
-  }
-}
+import { serve } from '@hono/node-server';
+import { serveStatic } from '@hono/node-server/serve-static';
+import { Hono } from 'hono';
+import { existsSync } from 'node:fs';
+import { dirname, resolve as resolvePath } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { openRoot } from './db.js';
+import { resolve as resolveDSN } from './dsn.js';
+import { getConfigValue } from './queries.js';
+import { authMiddleware, fingerprint, loadAuth } from './auth.js';
+import { authRouter } from './routes/auth.js';
+import { issuesRouter } from './routes/issues.js';
+import { streamHandler } from './routes/stream.js';
+
+const HOST = process.env.HOST || '127.0.0.1';
+const PORT = Number(process.env.PORT || 3333);
+
+const PKG_DIR = resolvePath(dirname(fileURLToPath(import.meta.url)), '..');
+const DIST_DIR = resolvePath(PKG_DIR, 'dist');
+
+async function main() {
+  const { dsn, beadDir } = resolveDSN();
+  const root = await openRoot(dsn);
+  const auth = loadAuth();
 
-const config = getConfig();
-const app = createApp(config);
-const server = createServer(app);
-const log = debug('server');
-
-// Register the initial workspace (from cwd) so it appears in the workspace picker
-// even without the beads daemon running
-const workspace_database = resolveWorkspaceDatabase({ cwd: config.root_dir });
-if (workspace_database.source !== 'home-default' && workspace_database.exists) {
-  registerWorkspace({
-    path: config.root_dir,
-    database: workspace_database.path
+  const app = new Hono();
+
+  app.use('*', async (c, next) => {
+    const t = Date.now();
+    await next();
+    if (process.env.DEBUG) {
+      console.log(`${c.req.method} ${c.req.path} ${c.res.status} ${Date.now() - t}ms`);
+    }
   });
-}
 
-// Start Dolt SQL server BEFORE accepting connections.
-// The SQL server holds an exclusive lock on the embedded DB, so bd CLI
-// can't run as fallback while it's up. We must wait for the pool.
-const doltPool = await startDoltServer(config.root_dir);
-if (doltPool) {
-  log('Dolt SQL server started — fast query mode enabled (sub-ms queries)');
-} else {
-  log('Dolt SQL server not available — using bd CLI fallback (~600ms/query)');
-}
+  app.get('/api/healthz', (c) => c.json({ ok: true }));
+  app.use('/api/*', authMiddleware(auth));
+  app.route('/api/auth', authRouter(auth));
 
-// Watch the active beads DB and schedule subscription refresh for active lists
-const db_watcher = watchDb(config.root_dir, () => {
-  // Schedule subscription list refresh run for active subscriptions
-  log('db change detected → schedule refresh');
-  scheduleListRefresh();
-  // v2: all updates flow via subscription push envelopes only
-});
+  // /api/me — returns auth + the active set of projects.
+  app.get('/api/me', async (c) => {
+    const user = c.get('user') || { username: 'anon', role: 'Anonymous' };
+    let projects = [];
+    try {
+      const names = await root.listProjectNames();
+      projects = await Promise.all(names.map(async (prefix) => {
+        try {
+          const p = await root.forProject(prefix);
+          const idMode = (await getConfigValue(p, 'issue_id_mode')) || 'hash';
+          return { prefix, id_mode: idMode };
+        } catch {
+          return { prefix, id_mode: 'hash' };
+        }
+      }));
+    } catch (err) {
+      // sqlite or unreachable — return empty list, the client falls back to
+      // the project-less single-DB UI.
+      if (process.env.DEBUG) console.error('listProjectNames failed:', err.message);
+    }
+    return c.json({
+      user,
+      driver: root.driver,
+      projects,
+      auth_enabled: auth.enabled,
+      auth_fingerprint: fingerprint(auth),
+      bead_dir: beadDir,
+      version: process.env.npm_package_version || '0.0.0',
+      file_attachment_base_url: (process.env.FILE_ATTACHMENT_BASE_URL || '').replace(/\/$/, ''),
+    });
+  });
 
-const { scheduleListRefresh } = attachWsServer(server, {
-  path: '/ws',
-  heartbeat_ms: 30000,
-  // Coalesce DB change bursts into one refresh run
-  refresh_debounce_ms: 75,
-  root_dir: config.root_dir,
-  watcher: db_watcher
-});
+  // /api/projects — same as /api/me's projects field, kept as a separate
+  // endpoint for the (now path-prefixed) project picker page.
+  app.get('/api/projects', async (c) => {
+    const names = await root.listProjectNames();
+    return c.json({ projects: names.map((prefix) => ({ prefix })) });
+  });
 
-// Watch the global registry for workspace changes (e.g., when user starts
-// bd daemon in a different project). This enables automatic workspace switching.
-watchRegistry(
-  (entries) => {
-    log('registry changed: %d entries', entries.length);
-    // Find if there's a newer workspace that matches our initial root
-    // For now, we just log the change - users can switch via set-workspace
-    // Future: could auto-switch if a workspace was started in a parent/child dir
-  },
-  { debounce_ms: 500 }
-);
-
-// Graceful shutdown: stop Dolt server
-process.on('SIGTERM', async () => {
-  await stopDoltServer();
-  process.exit(0);
-});
-process.on('SIGINT', async () => {
-  await stopDoltServer();
-  process.exit(0);
-});
+  // Project-scoped middleware: validates the prefix and attaches the pool.
+  const projectScope = async (c, next) => {
+    const prefix = c.req.param('prefix');
+    if (!prefix || !/^[a-z0-9_-]+$/.test(prefix)) {
+      return c.json({ error: 'invalid project prefix' }, 400);
+    }
+    let p;
+    try {
+      p = await root.forProject(prefix);
+      // sanity-check: schema has a config table
+      await p.one('SELECT 1 FROM config LIMIT 1');
+    } catch (err) {
+      return c.json({ error: `project not found: ${prefix}` }, 404);
+    }
+    c.set('db', p);
+    c.set('project', prefix);
+    await next();
+  };
 
-server.listen(config.port, config.host, () => {
-  printServerUrl();
-});
+  // Per-project endpoints. Sub-routers read the db from context.
+  app.use('/api/p/:prefix/*', projectScope);
+
+  app.get('/api/p/:prefix/me', async (c) => {
+    const db = c.get('db');
+    const prefix = c.get('project');
+    const idMode = (await getConfigValue(db, 'issue_id_mode')) || 'hash';
+    return c.json({ project: { prefix, id_mode: idMode } });
+  });
+
+  app.route('/api/p/:prefix/issues', issuesRouter());
+  app.get('/api/p/:prefix/stream', streamHandler);
+
+  app.notFound((c) => c.json({ error: 'not found' }, 404));
+  app.onError((err, c) => {
+    console.error('error:', err);
+    return c.json({ error: err.message || 'internal error' }, 500);
+  });
+
+  if (existsSync(DIST_DIR)) {
+    app.use('/*', serveStatic({ root: DIST_DIR }));
+    app.get('/*', serveStatic({ path: resolvePath(DIST_DIR, 'index.html') }));
+  } else {
+    app.get('/', (c) => c.json({
+      hint: `client build not found at ${DIST_DIR}; run \`npm run build\` or use vite dev (5173).`,
+    }));
+  }
+
+  serve({ fetch: app.fetch, hostname: HOST, port: PORT }, (info) => {
+    console.log(`bd-web ${PORT}/${info.port} listening on http://${HOST}:${info.port}`);
+    console.log(`  driver: ${root.driver}`);
+    console.log(`  auth:   ${auth.enabled ? 'enabled' : 'disabled (BD_WEB_AUTH_FILE unset)'}`);
+    if (process.env.BD_WEB_OPEN === '1') {
+      tryOpen(`http://${HOST === '0.0.0.0' ? '127.0.0.1' : HOST}:${info.port}`);
+    }
+  });
+
+  const stop = async () => {
+    try { await root.close(); } catch {}
+    process.exit(0);
+  };
+  process.on('SIGINT', stop);
+  process.on('SIGTERM', stop);
+}
+
+function tryOpen(url) {
+  const cmd = process.platform === 'darwin' ? 'open'
+    : process.platform === 'win32' ? 'start'
+    : 'xdg-open';
+  import('node:child_process').then(({ spawn }) => {
+    spawn(cmd, [url], { detached: true, stdio: 'ignore' }).unref();
+  }).catch(() => {});
+}
 
-server.on('error', (err) => {
-  log('server error %o', err);
-  process.exitCode = 1;
+main().catch((err) => {
+  console.error('fatal:', err.message);
+  process.exit(1);
 });