@undefineds.co/xpod 0.1.0-local.202602081751

package/dist/identity/drizzle/AccountRoleRepository.d.ts

@@ -0,0 +1,23 @@
+import type { IdentityDatabase } from './db';
+export interface AccountRoleContext {
+    accountId: string;
+    webId?: string;
+    roles: string[];
+}
+export declare class AccountRoleRepository {
+    private readonly db;
+    private readonly ready;
+    private readonly logger;
+    constructor(db: IdentityDatabase);
+    findByAccountId(accountId: string): Promise<AccountRoleContext | undefined>;
+    findByWebId(webId: string): Promise<AccountRoleContext | undefined>;
+    findByWebIdLoose(webId: string): Promise<AccountRoleContext | undefined>;
+    addRoles(accountId: string, roles: string[]): Promise<void>;
+    private ensureSchema;
+    private fetchRoles;
+    private getAccountPayloadById;
+    private loadAllAccounts;
+    private loadFileAccountMap;
+    private isTableMissing;
+    private isDuplicateDefinitionError;
+}

package/dist/identity/drizzle/AccountRoleRepository.js

@@ -0,0 +1,233 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccountRoleRepository = void 0;
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const drizzle_orm_1 = require("drizzle-orm");
+const global_logger_factory_1 = require("global-logger-factory");
+const db_1 = require("./db");
+const ACCOUNT_DATA_DIR = node_path_1.default.resolve('.internal', 'accounts', 'data');
+function resolveWebIds(payload) {
+    const candidates = new Set();
+    const possibleKeys = ['webId', 'webid', 'primaryWebId', 'primary_webid'];
+    for (const key of possibleKeys) {
+        const value = payload[key];
+        if (typeof value === 'string' && value.trim().length > 0) {
+            candidates.add(value.trim());
+        }
+    }
+    const settings = payload.settings;
+    if (settings && typeof settings === 'object') {
+        const webId = settings.webId;
+        if (typeof webId === 'string' && webId.trim().length > 0) {
+            candidates.add(webId.trim());
+        }
+    }
+    const pods = payload.pods;
+    if (Array.isArray(pods)) {
+        for (const entry of pods) {
+            if (!entry || typeof entry !== 'object') {
+                continue;
+            }
+            const webId = entry.webId;
+            if (typeof webId === 'string' && webId.trim().length > 0) {
+                candidates.add(webId.trim());
+            }
+        }
+    }
+    return [...candidates];
+}
+class AccountRoleRepository {
+    constructor(db) {
+        this.db = db;
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.ready = this.ensureSchema();
+    }
+    async findByAccountId(accountId) {
+        await this.ready;
+        const payload = await this.getAccountPayloadById(accountId);
+        if (!payload) {
+            const rolesFallback = await this.fetchRoles(accountId);
+            if (rolesFallback.length === 0) {
+                return undefined;
+            }
+            return { accountId, roles: rolesFallback };
+        }
+        const [webId] = resolveWebIds(payload);
+        const roles = await this.fetchRoles(accountId);
+        return { accountId, webId, roles };
+    }
+    async findByWebId(webId) {
+        await this.ready;
+        const accounts = await this.loadAllAccounts();
+        for (const { id, payload } of accounts) {
+            const knownWebIds = resolveWebIds(payload);
+            if (knownWebIds.includes(webId)) {
+                const roles = await this.fetchRoles(id);
+                return {
+                    accountId: id,
+                    webId,
+                    roles,
+                };
+            }
+        }
+        return undefined;
+    }
+    async findByWebIdLoose(webId) {
+        return this.findByWebId(webId);
+    }
+    async addRoles(accountId, roles) {
+        await this.ready;
+        const unique = Array.from(new Set(roles.map((role) => role.trim()).filter((role) => role.length > 0)));
+        if (unique.length === 0) {
+            return;
+        }
+        for (const role of unique) {
+            await (0, db_1.executeStatement)(this.db, (0, drizzle_orm_1.sql) `
+        INSERT INTO identity_account_role (account_id, role)
+        VALUES (${accountId}, ${role})
+        ON CONFLICT (account_id, role) DO NOTHING
+      `);
+        }
+    }
+    async ensureSchema() {
+        try {
+            if ((0, db_1.isDatabaseSqlite)(this.db)) {
+                // SQLite syntax
+                await (0, db_1.executeStatement)(this.db, (0, drizzle_orm_1.sql) `
+          CREATE TABLE IF NOT EXISTS identity_account_role (
+            account_id TEXT NOT NULL,
+            role TEXT NOT NULL,
+            created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
+            PRIMARY KEY (account_id, role)
+          )
+        `);
+            }
+            else {
+                // PostgreSQL syntax
+                await (0, db_1.executeStatement)(this.db, (0, drizzle_orm_1.sql) `
+          CREATE TABLE IF NOT EXISTS identity_account_role (
+            account_id TEXT NOT NULL,
+            role TEXT NOT NULL,
+            created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+            PRIMARY KEY (account_id, role)
+          )
+        `);
+            }
+        }
+        catch (error) {
+            if (!this.isDuplicateDefinitionError(error)) {
+                throw error;
+            }
+            this.logger.debug('identity_account_role schema already present, skipping creation.');
+        }
+    }
+    async fetchRoles(accountId) {
+        const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `
+      SELECT role
+      FROM identity_account_role
+      WHERE account_id = ${accountId}
+    `);
+        return result.rows.map((row) => {
+            const value = typeof row.role === 'string' ? row.role.trim() : '';
+            return value;
+        }).filter((value) => value.length > 0);
+    }
+    async getAccountPayloadById(accountId) {
+        try {
+            const accountResult = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `
+        SELECT payload
+        FROM identity_account
+        WHERE id = ${accountId}
+        LIMIT 1
+      `);
+            if (accountResult.rows.length > 0) {
+                const payload = accountResult.rows[0]?.payload;
+                if (payload && typeof payload === 'object') {
+                    return payload;
+                }
+            }
+        }
+        catch (error) {
+            if (!this.isTableMissing(error)) {
+                throw error;
+            }
+        }
+        const files = await this.loadFileAccountMap();
+        return files.get(accountId);
+    }
+    async loadAllAccounts() {
+        try {
+            const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `SELECT id, payload FROM identity_account`);
+            return result.rows.map((row) => ({
+                id: row.id,
+                payload: (row.payload ?? {}),
+            }));
+        }
+        catch (error) {
+            if (!this.isTableMissing(error)) {
+                throw error;
+            }
+        }
+        const files = await this.loadFileAccountMap();
+        return Array.from(files.entries()).map(([id, payload]) => ({ id, payload }));
+    }
+    async loadFileAccountMap() {
+        const map = new Map();
+        try {
+            const files = await node_fs_1.promises.readdir(ACCOUNT_DATA_DIR);
+            for (const file of files) {
+                if (!file.endsWith('.json')) {
+                    continue;
+                }
+                const fullPath = node_path_1.default.join(ACCOUNT_DATA_DIR, file);
+                try {
+                    const raw = await node_fs_1.promises.readFile(fullPath, 'utf8');
+                    const parsed = JSON.parse(raw);
+                    const payload = parsed?.payload;
+                    if (!payload || typeof payload !== 'object') {
+                        continue;
+                    }
+                    const accountId = payload.id;
+                    if (typeof accountId === 'string' && accountId.trim().length > 0) {
+                        map.set(accountId, payload);
+                    }
+                }
+                catch (error) {
+                    this.logger.debug(`Skipping account file ${fullPath}: ${error.message}`);
+                }
+            }
+        }
+        catch (error) {
+            this.logger.debug(`Account data directory unavailable (${ACCOUNT_DATA_DIR}): ${error.message}`);
+        }
+        return map;
+    }
+    isTableMissing(error) {
+        if (!error || typeof error !== 'object') {
+            return false;
+        }
+        const code = error.code;
+        if (code === '42P01') {
+            return true;
+        }
+        const message = error.message ?? '';
+        return /does not exist/u.test(message);
+    }
+    isDuplicateDefinitionError(error) {
+        if (!error || typeof error !== 'object') {
+            return false;
+        }
+        const code = error.code;
+        if (code && ['23505', '42P07', '42710'].includes(code)) {
+            return true;
+        }
+        const message = error.message ?? '';
+        return /already exists/u.test(message);
+    }
+}
+exports.AccountRoleRepository = AccountRoleRepository;
+//# sourceMappingURL=AccountRoleRepository.js.map

package/dist/identity/drizzle/AccountRoleRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountRoleRepository.js","sourceRoot":"","sources":["../../../src/identity/drizzle/AccountRoleRepository.ts"],"names":[],"mappings":";;;;;;AAAA,qCAAyC;AACzC,0DAA6B;AAC7B,6CAAkC;AAClC,iEAAqD;AAErD,6BAAwE;AAExE,MAAM,gBAAgB,GAAG,mBAAI,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAQvE,SAAS,aAAa,CAAC,OAAgC;IACrD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,YAAY,GAAG,CAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,CAAE,CAAC;IAC3E,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAI,QAAoC,CAAC,KAAK,CAAC;QAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxC,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAI,KAAiC,CAAC,KAAK,CAAC;YACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAE,GAAG,UAAU,CAAE,CAAC;AAC3B,CAAC;AAED,MAAa,qBAAqB;IAIhC,YAAoC,EAAoB;QAApB,OAAE,GAAF,EAAE,CAAkB;QAFvC,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAG3C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACnC,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,SAAiB;QAC5C,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,CAAE,KAAK,CAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC/C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,KAAa;QACpC,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9C,KAAK,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBACxC,OAAO;oBACL,SAAS,EAAE,EAAE;oBACb,KAAK;oBACL,KAAK;iBACN,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,KAAa;QACzC,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,KAAe;QACtD,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAC/B,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CACnE,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAA,qBAAgB,EAAC,IAAI,CAAC,EAAE,EAAE,IAAA,iBAAG,EAAA;;kBAEvB,SAAS,KAAK,IAAI;;OAE7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC;YACH,IAAI,IAAA,qBAAgB,EAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9B,gBAAgB;gBAChB,MAAM,IAAA,qBAAgB,EAAC,IAAI,CAAC,EAAE,EAAE,IAAA,iBAAG,EAAA;;;;;;;SAOlC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,oBAAoB;gBACpB,MAAM,IAAA,qBAAgB,EAAC,IAAI,CAAC,EAAE,EAAE,IAAA,iBAAG,EAAA;;;;;;;SAOlC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,SAAiB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAY,EAAqB,IAAI,CAAC,EAAE,EAAE,IAAA,iBAAG,EAAA;;;2BAG3C,SAAS;KAC/B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,SAAiB;QACnD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,IAAA,iBAAY,EAAwB,IAAI,CAAC,EAAE,EAAE,IAAA,iBAAG,EAAA;;;qBAG7D,SAAS;;OAEvB,CAAC,CAAC;YACH,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;gBAC/C,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAC3C,OAAO,OAAkC,CAAC;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAY,EAAmC,IAAI,CAAC,EAAE,EAAE,IAAA,iBAAG,EAAA,0CAA0C,CAAC,CAAC;YAC5H,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/B,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAA4B;aACxD,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,OAAO,CAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,kBAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YACjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5B,SAAS;gBACX,CAAC;gBACD,MAAM,QAAQ,GAAG,mBAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;oBAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;oBACxD,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,CAAC;oBAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;wBAC5C,SAAS;oBACX,CAAC;oBACD,MAAM,SAAS,GAAI,OAAmC,CAAC,EAAE,CAAC;oBAC1D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACjE,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,OAAkC,CAAC,CAAC;oBACzD,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,QAAQ,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;gBACtF,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,gBAAgB,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,cAAc,CAAC,KAAc;QACnC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAI,KAA8B,CAAC,OAAO,IAAI,EAAE,CAAC;QAC9D,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAEO,0BAA0B,CAAC,KAAc;QAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,IAAI,CAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAI,KAA8B,CAAC,OAAO,IAAI,EAAE,CAAC;QAC9D,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;CACF;AApMD,sDAoMC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport path from 'node:path';\nimport { sql } from 'drizzle-orm';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { IdentityDatabase } from './db';\nimport { executeQuery, executeStatement, isDatabaseSqlite } from './db';\n\nconst ACCOUNT_DATA_DIR = path.resolve('.internal', 'accounts', 'data');\n\nexport interface AccountRoleContext {\n  accountId: string;\n  webId?: string;\n  roles: string[];\n}\n\nfunction resolveWebIds(payload: Record<string, unknown>): string[] {\n  const candidates = new Set<string>();\n  const possibleKeys = [ 'webId', 'webid', 'primaryWebId', 'primary_webid' ];\n  for (const key of possibleKeys) {\n    const value = payload[key];\n    if (typeof value === 'string' && value.trim().length > 0) {\n      candidates.add(value.trim());\n    }\n  }\n  const settings = payload.settings;\n  if (settings && typeof settings === 'object') {\n    const webId = (settings as Record<string, unknown>).webId;\n    if (typeof webId === 'string' && webId.trim().length > 0) {\n      candidates.add(webId.trim());\n    }\n  }\n  const pods = payload.pods;\n  if (Array.isArray(pods)) {\n    for (const entry of pods) {\n      if (!entry || typeof entry !== 'object') {\n        continue;\n      }\n      const webId = (entry as Record<string, unknown>).webId;\n      if (typeof webId === 'string' && webId.trim().length > 0) {\n        candidates.add(webId.trim());\n      }\n    }\n  }\n  return [ ...candidates ];\n}\n\nexport class AccountRoleRepository {\n  private readonly ready: Promise<void>;\n  private readonly logger = getLoggerFor(this);\n\n  public constructor(private readonly db: IdentityDatabase) {\n    this.ready = this.ensureSchema();\n  }\n\n  public async findByAccountId(accountId: string): Promise<AccountRoleContext | undefined> {\n    await this.ready;\n    const payload = await this.getAccountPayloadById(accountId);\n    if (!payload) {\n      const rolesFallback = await this.fetchRoles(accountId);\n      if (rolesFallback.length === 0) {\n        return undefined;\n      }\n      return { accountId, roles: rolesFallback };\n    }\n    const [ webId ] = resolveWebIds(payload);\n    const roles = await this.fetchRoles(accountId);\n    return { accountId, webId, roles };\n  }\n\n  public async findByWebId(webId: string): Promise<AccountRoleContext | undefined> {\n    await this.ready;\n    const accounts = await this.loadAllAccounts();\n    for (const { id, payload } of accounts) {\n      const knownWebIds = resolveWebIds(payload);\n      if (knownWebIds.includes(webId)) {\n        const roles = await this.fetchRoles(id);\n        return {\n          accountId: id,\n          webId,\n          roles,\n        };\n      }\n    }\n    return undefined;\n  }\n\n  public async findByWebIdLoose(webId: string): Promise<AccountRoleContext | undefined> {\n    return this.findByWebId(webId);\n  }\n\n  public async addRoles(accountId: string, roles: string[]): Promise<void> {\n    await this.ready;\n    const unique = Array.from(new Set(\n      roles.map((role) => role.trim()).filter((role) => role.length > 0),\n    ));\n    if (unique.length === 0) {\n      return;\n    }\n    for (const role of unique) {\n      await executeStatement(this.db, sql`\n        INSERT INTO identity_account_role (account_id, role)\n        VALUES (${accountId}, ${role})\n        ON CONFLICT (account_id, role) DO NOTHING\n      `);\n    }\n  }\n\n  private async ensureSchema(): Promise<void> {\n    try {\n      if (isDatabaseSqlite(this.db)) {\n        // SQLite syntax\n        await executeStatement(this.db, sql`\n          CREATE TABLE IF NOT EXISTS identity_account_role (\n            account_id TEXT NOT NULL,\n            role TEXT NOT NULL,\n            created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),\n            PRIMARY KEY (account_id, role)\n          )\n        `);\n      } else {\n        // PostgreSQL syntax\n        await executeStatement(this.db, sql`\n          CREATE TABLE IF NOT EXISTS identity_account_role (\n            account_id TEXT NOT NULL,\n            role TEXT NOT NULL,\n            created_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n            PRIMARY KEY (account_id, role)\n          )\n        `);\n      }\n    } catch (error: unknown) {\n      if (!this.isDuplicateDefinitionError(error)) {\n        throw error;\n      }\n      this.logger.debug('identity_account_role schema already present, skipping creation.');\n    }\n  }\n\n  private async fetchRoles(accountId: string): Promise<string[]> {\n    const result = await executeQuery<{ role?: unknown }>(this.db, sql`\n      SELECT role\n      FROM identity_account_role\n      WHERE account_id = ${accountId}\n    `);\n    return result.rows.map((row) => {\n      const value = typeof row.role === 'string' ? row.role.trim() : '';\n      return value;\n    }).filter((value) => value.length > 0);\n  }\n\n  private async getAccountPayloadById(accountId: string): Promise<Record<string, unknown> | undefined> {\n    try {\n      const accountResult = await executeQuery<{ payload?: unknown }>(this.db, sql`\n        SELECT payload\n        FROM identity_account\n        WHERE id = ${accountId}\n        LIMIT 1\n      `);\n      if (accountResult.rows.length > 0) {\n        const payload = accountResult.rows[0]?.payload;\n        if (payload && typeof payload === 'object') {\n          return payload as Record<string, unknown>;\n        }\n      }\n    } catch (error: unknown) {\n      if (!this.isTableMissing(error)) {\n        throw error;\n      }\n    }\n    const files = await this.loadFileAccountMap();\n    return files.get(accountId);\n  }\n\n  private async loadAllAccounts(): Promise<Array<{ id: string; payload: Record<string, unknown> }>> {\n    try {\n      const result = await executeQuery<{ id: string; payload: unknown }>(this.db, sql`SELECT id, payload FROM identity_account`);\n      return result.rows.map((row) => ({\n        id: row.id,\n        payload: (row.payload ?? {}) as Record<string, unknown>,\n      }));\n    } catch (error: unknown) {\n      if (!this.isTableMissing(error)) {\n        throw error;\n      }\n    }\n    const files = await this.loadFileAccountMap();\n    return Array.from(files.entries()).map(([ id, payload ]) => ({ id, payload }));\n  }\n\n  private async loadFileAccountMap(): Promise<Map<string, Record<string, unknown>>> {\n    const map = new Map<string, Record<string, unknown>>();\n    try {\n      const files = await fs.readdir(ACCOUNT_DATA_DIR);\n      for (const file of files) {\n        if (!file.endsWith('.json')) {\n          continue;\n        }\n        const fullPath = path.join(ACCOUNT_DATA_DIR, file);\n        try {\n          const raw = await fs.readFile(fullPath, 'utf8');\n          const parsed = JSON.parse(raw) as { payload?: unknown };\n          const payload = parsed?.payload;\n          if (!payload || typeof payload !== 'object') {\n            continue;\n          }\n          const accountId = (payload as Record<string, unknown>).id;\n          if (typeof accountId === 'string' && accountId.trim().length > 0) {\n            map.set(accountId, payload as Record<string, unknown>);\n          }\n        } catch (error: unknown) {\n          this.logger.debug(`Skipping account file ${fullPath}: ${(error as Error).message}`);\n        }\n      }\n    } catch (error: unknown) {\n      this.logger.debug(`Account data directory unavailable (${ACCOUNT_DATA_DIR}): ${(error as Error).message}`);\n    }\n    return map;\n  }\n\n  private isTableMissing(error: unknown): boolean {\n    if (!error || typeof error !== 'object') {\n      return false;\n    }\n    const code = (error as { code?: string }).code;\n    if (code === '42P01') {\n      return true;\n    }\n    const message = (error as { message?: string }).message ?? '';\n    return /does not exist/u.test(message);\n  }\n\n  private isDuplicateDefinitionError(error: unknown): boolean {\n    if (!error || typeof error !== 'object') {\n      return false;\n    }\n    const code = (error as { code?: string }).code;\n    if (code && [ '23505', '42P07', '42710' ].includes(code)) {\n      return true;\n    }\n    const message = (error as { message?: string }).message ?? '';\n    return /already exists/u.test(message);\n  }\n}\n"]}

package/dist/identity/drizzle/DdnsRepository.d.ts

@@ -0,0 +1,87 @@
+/**
+ * DDNS Repository
+ *
+ * 管理 DDNS 域名池和记录
+ */
+import type { IdentityDatabase } from './db';
+export interface DdnsDomain {
+    domain: string;
+    status: 'active' | 'suspended';
+    provider?: string;
+    zoneId?: string;
+    createdAt: Date;
+}
+export interface DdnsRecord {
+    subdomain: string;
+    domain: string;
+    ipAddress?: string;
+    ipv6Address?: string;
+    recordType: 'A' | 'AAAA';
+    nodeId?: string;
+    username?: string;
+    status: 'active' | 'banned';
+    bannedReason?: string;
+    ttl: number;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface CreateDdnsRecordInput {
+    subdomain: string;
+    domain: string;
+    ipAddress?: string;
+    ipv6Address?: string;
+    nodeId?: string;
+    username?: string;
+}
+export interface UpdateDdnsRecordInput {
+    ipAddress?: string;
+    ipv6Address?: string;
+}
+export declare class DdnsRepository {
+    private readonly db;
+    constructor(db: IdentityDatabase);
+    /**
+     * 添加域名到池中
+     */
+    addDomain(domain: string, provider?: string, zoneId?: string): Promise<DdnsDomain>;
+    /**
+     * 获取所有活跃的域名
+     */
+    getActiveDomains(): Promise<DdnsDomain[]>;
+    /**
+     * 暂停域名
+     */
+    suspendDomain(domain: string): Promise<void>;
+    /**
+     * 分配子域名
+     */
+    allocateSubdomain(input: CreateDdnsRecordInput): Promise<DdnsRecord>;
+    /**
+     * 获取 DDNS 记录
+     */
+    getRecord(subdomain: string): Promise<DdnsRecord | null>;
+    /**
+     * 更新 DDNS 记录的 IP 地址
+     */
+    updateRecordIp(subdomain: string, input: UpdateDdnsRecordInput): Promise<DdnsRecord | null>;
+    /**
+     * 封禁子域名
+     */
+    banSubdomain(subdomain: string, reason: string): Promise<void>;
+    /**
+     * 解封子域名
+     */
+    unbanSubdomain(subdomain: string): Promise<void>;
+    /**
+     * 释放子域名
+     */
+    releaseSubdomain(subdomain: string): Promise<boolean>;
+    /**
+     * 获取用户的所有子域名
+     */
+    getRecordsByUsername(username: string): Promise<DdnsRecord[]>;
+    /**
+     * 获取节点的子域名
+     */
+    getRecordByNodeId(nodeId: string): Promise<DdnsRecord | null>;
+}

package/dist/identity/drizzle/DdnsRepository.js

@@ -0,0 +1,284 @@
+"use strict";
+/**
+ * DDNS Repository
+ *
+ * 管理 DDNS 域名池和记录
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DdnsRepository = void 0;
+const drizzle_orm_1 = require("drizzle-orm");
+const global_logger_factory_1 = require("global-logger-factory");
+const pgSchema = __importStar(require("./schema.pg"));
+const logger = (0, global_logger_factory_1.getLoggerFor)('DdnsRepository');
+class DdnsRepository {
+    constructor(db) {
+        this.db = db;
+    }
+    // ==================== Domain Pool ====================
+    /**
+     * 添加域名到池中
+     */
+    async addDomain(domain, provider, zoneId) {
+        const now = new Date();
+        await this.db.insert(pgSchema.ddnsDomains).values({
+            domain,
+            status: 'active',
+            provider,
+            zoneId,
+            createdAt: now,
+        });
+        logger.info(`Added domain to pool: ${domain}`);
+        return {
+            domain,
+            status: 'active',
+            provider,
+            zoneId,
+            createdAt: now,
+        };
+    }
+    /**
+     * 获取所有活跃的域名
+     */
+    async getActiveDomains() {
+        const results = await this.db
+            .select()
+            .from(pgSchema.ddnsDomains)
+            .where((0, drizzle_orm_1.eq)(pgSchema.ddnsDomains.status, 'active'));
+        return results.map((row) => ({
+            domain: row.domain,
+            status: row.status,
+            provider: row.provider ?? undefined,
+            zoneId: row.zoneId ?? undefined,
+            createdAt: row.createdAt,
+        }));
+    }
+    /**
+     * 暂停域名
+     */
+    async suspendDomain(domain) {
+        await this.db
+            .update(pgSchema.ddnsDomains)
+            .set({ status: 'suspended' })
+            .where((0, drizzle_orm_1.eq)(pgSchema.ddnsDomains.domain, domain));
+        logger.info(`Suspended domain: ${domain}`);
+    }
+    // ==================== DDNS Records ====================
+    /**
+     * 分配子域名
+     */
+    async allocateSubdomain(input) {
+        const { subdomain, domain, ipAddress, ipv6Address, nodeId, username } = input;
+        // 检查是否已存在
+        const existing = await this.getRecord(subdomain);
+        if (existing) {
+            throw new Error(`Subdomain ${subdomain} already allocated`);
+        }
+        const now = new Date();
+        const recordType = ipv6Address ? 'AAAA' : 'A';
+        await this.db.insert(pgSchema.ddnsRecords).values({
+            subdomain,
+            domain,
+            ipAddress,
+            ipv6Address,
+            recordType,
+            nodeId,
+            username,
+            status: 'active',
+            ttl: 60,
+            createdAt: now,
+            updatedAt: now,
+        });
+        logger.info(`Allocated subdomain: ${subdomain}.${domain}`);
+        return {
+            subdomain,
+            domain,
+            ipAddress,
+            ipv6Address,
+            recordType,
+            nodeId,
+            username,
+            status: 'active',
+            ttl: 60,
+            createdAt: now,
+            updatedAt: now,
+        };
+    }
+    /**
+     * 获取 DDNS 记录
+     */
+    async getRecord(subdomain) {
+        const results = await this.db
+            .select()
+            .from(pgSchema.ddnsRecords)
+            .where((0, drizzle_orm_1.eq)(pgSchema.ddnsRecords.subdomain, subdomain))
+            .limit(1);
+        if (results.length === 0) {
+            return null;
+        }
+        const row = results[0];
+        return {
+            subdomain: row.subdomain,
+            domain: row.domain,
+            ipAddress: row.ipAddress ?? undefined,
+            ipv6Address: row.ipv6Address ?? undefined,
+            recordType: row.recordType ?? 'A',
+            nodeId: row.nodeId ?? undefined,
+            username: row.username ?? undefined,
+            status: row.status ?? 'active',
+            bannedReason: row.bannedReason ?? undefined,
+            ttl: row.ttl ?? 60,
+            createdAt: row.createdAt,
+            updatedAt: row.updatedAt,
+        };
+    }
+    /**
+     * 更新 DDNS 记录的 IP 地址
+     */
+    async updateRecordIp(subdomain, input) {
+        const existing = await this.getRecord(subdomain);
+        if (!existing) {
+            return null;
+        }
+        if (existing.status === 'banned') {
+            throw new Error(`Subdomain ${subdomain} is banned: ${existing.bannedReason}`);
+        }
+        const now = new Date();
+        const updates = { updatedAt: now };
+        if (input.ipAddress !== undefined) {
+            updates.ipAddress = input.ipAddress;
+            updates.recordType = 'A';
+        }
+        if (input.ipv6Address !== undefined) {
+            updates.ipv6Address = input.ipv6Address;
+            if (!input.ipAddress) {
+                updates.recordType = 'AAAA';
+            }
+        }
+        await this.db
+            .update(pgSchema.ddnsRecords)
+            .set(updates)
+            .where((0, drizzle_orm_1.eq)(pgSchema.ddnsRecords.subdomain, subdomain));
+        logger.info(`Updated DDNS record: ${subdomain} -> ${input.ipAddress ?? input.ipv6Address}`);
+        return {
+            ...existing,
+            ipAddress: input.ipAddress ?? existing.ipAddress,
+            ipv6Address: input.ipv6Address ?? existing.ipv6Address,
+            recordType: updates.recordType ?? existing.recordType,
+            updatedAt: now,
+        };
+    }
+    /**
+     * 封禁子域名
+     */
+    async banSubdomain(subdomain, reason) {
+        await this.db
+            .update(pgSchema.ddnsRecords)
+            .set({
+            status: 'banned',
+            bannedReason: reason,
+            updatedAt: new Date(),
+        })
+            .where((0, drizzle_orm_1.eq)(pgSchema.ddnsRecords.subdomain, subdomain));
+        logger.warn(`Banned subdomain: ${subdomain}, reason: ${reason}`);
+    }
+    /**
+     * 解封子域名
+     */
+    async unbanSubdomain(subdomain) {
+        await this.db
+            .update(pgSchema.ddnsRecords)
+            .set({
+            status: 'active',
+            bannedReason: null,
+            updatedAt: new Date(),
+        })
+            .where((0, drizzle_orm_1.eq)(pgSchema.ddnsRecords.subdomain, subdomain));
+        logger.info(`Unbanned subdomain: ${subdomain}`);
+    }
+    /**
+     * 释放子域名
+     */
+    async releaseSubdomain(subdomain) {
+        await this.db
+            .delete(pgSchema.ddnsRecords)
+            .where((0, drizzle_orm_1.eq)(pgSchema.ddnsRecords.subdomain, subdomain));
+        logger.info(`Released subdomain: ${subdomain}`);
+        return true;
+    }
+    /**
+     * 获取用户的所有子域名
+     */
+    async getRecordsByUsername(username) {
+        const results = await this.db
+            .select()
+            .from(pgSchema.ddnsRecords)
+            .where((0, drizzle_orm_1.eq)(pgSchema.ddnsRecords.username, username));
+        return results.map((row) => ({
+            subdomain: row.subdomain,
+            domain: row.domain,
+            ipAddress: row.ipAddress ?? undefined,
+            ipv6Address: row.ipv6Address ?? undefined,
+            recordType: row.recordType ?? 'A',
+            nodeId: row.nodeId ?? undefined,
+            username: row.username ?? undefined,
+            status: row.status ?? 'active',
+            bannedReason: row.bannedReason ?? undefined,
+            ttl: row.ttl ?? 60,
+            createdAt: row.createdAt,
+            updatedAt: row.updatedAt,
+        }));
+    }
+    /**
+     * 获取节点的子域名
+     */
+    async getRecordByNodeId(nodeId) {
+        const results = await this.db
+            .select()
+            .from(pgSchema.ddnsRecords)
+            .where((0, drizzle_orm_1.eq)(pgSchema.ddnsRecords.nodeId, nodeId))
+            .limit(1);
+        if (results.length === 0) {
+            return null;
+        }
+        const row = results[0];
+        return {
+            subdomain: row.subdomain,
+            domain: row.domain,
+            ipAddress: row.ipAddress ?? undefined,
+            ipv6Address: row.ipv6Address ?? undefined,
+            recordType: row.recordType ?? 'A',
+            nodeId: row.nodeId ?? undefined,
+            username: row.username ?? undefined,
+            status: row.status ?? 'active',
+            bannedReason: row.bannedReason ?? undefined,
+            ttl: row.ttl ?? 60,
+            createdAt: row.createdAt,
+            updatedAt: row.updatedAt,
+        };
+    }
+}
+exports.DdnsRepository = DdnsRepository;
+//# sourceMappingURL=DdnsRepository.js.map