@wtfalch/foundry 0.1.0

package/dist/store/postgres.js

@@ -0,0 +1,267 @@
+import { eq, sql } from 'drizzle-orm';
+import { validateBuyerIdentity } from '../org.js';
+import { validateSlug } from '../slug.js';
+import { declaredOrgs, foundryAppliedState, } from './schema.js';
+const UNIQUE_VIOLATION = '23505';
+/** #27: a bigint-safe decimal string of a non-negative integer -- no sign, no decimal point, no leading zeros (so "010" never diffs against a live "10"). */
+const NON_NEGATIVE_INTEGER = /^(0|[1-9]\d*)$/;
+/**
+ * True for a Postgres unique-violation, however the driver hands it back --
+ * directly (PGlite in this package's own tests) or wrapped in drizzle-orm's
+ * own `DrizzleQueryError`, whose `cause` carries the raw driver error
+ * (postgres-js in a host). Checked by Postgres error code, never by message
+ * text, since message text is not a contract. Same pattern as
+ * `../runner/runner.ts`'s own `isUniqueViolation` -- kept as a local copy
+ * here rather than shared, since neither module depends on the other.
+ */
+function isUniqueViolation(error) {
+    const code = error?.code;
+    if (code === UNIQUE_VIOLATION)
+        return true;
+    const cause = error?.cause;
+    return cause?.code === UNIQUE_VIOLATION;
+}
+/**
+ * Thrown by `create` and `update` when the store refuses a write: an id
+ * that already exists, an id that does not, a slug that fails
+ * `../slug.ts`'s `validateSlug` (#28: invalid DNS label, reserved, or an
+ * environment-suffix shape), a slug already taken by another org (#28:
+ * checked by the unique index `0004_slug_unique.sql` adds, whether caught
+ * ahead of time by a pre-check or by a race this store maps back to the
+ * same error) or — the one impossible combination #18 implements — a slug
+ * change once the org has mail. `store.ts`'s `update` doc requires a caller
+ * to be "ready for this to throw rather than silently drop a field"; this
+ * is that throw.
+ */
+export class DeclaredOrgError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'DeclaredOrgError';
+    }
+}
+function rowToOrg(row) {
+    return {
+        id: row.id,
+        slug: row.slug,
+        displayName: row.displayName,
+        domain: row.domain,
+        mail: { mode: row.mailMode, usesDomain: row.mailUsesDomain },
+        chat: { usesDomain: row.chatUsesDomain },
+        calls: { usesDomain: row.callsUsesDomain },
+        issuer: { usesDomain: row.issuerUsesDomain },
+        site: { enabled: row.siteEnabled, usesDomain: row.siteUsesDomain },
+        sso: { enabled: row.ssoEnabled },
+        guests: { enabled: row.guestsEnabled },
+        solo: { enabled: row.soloEnabled },
+        storage: { limitBytes: row.storageLimitBytes, limitMicros: row.storageLimitMicros },
+        ai: { limitMicros: row.aiLimitMicros },
+        buyer: rowToBuyer(row),
+        bespokeAppRepo: row.bespokeAppRepo,
+        adoptedApp: row.adoptedAppForm
+            ? { form: row.adoptedAppForm }
+            : null,
+    };
+}
+function orgToRow(org) {
+    return {
+        id: org.id,
+        slug: org.slug,
+        displayName: org.displayName,
+        domain: org.domain,
+        mailMode: org.mail.mode,
+        mailUsesDomain: org.mail.usesDomain,
+        chatUsesDomain: org.chat.usesDomain,
+        callsUsesDomain: org.calls.usesDomain,
+        issuerUsesDomain: org.issuer.usesDomain,
+        siteEnabled: org.site.enabled,
+        siteUsesDomain: org.site.usesDomain,
+        ssoEnabled: org.sso.enabled,
+        guestsEnabled: org.guests.enabled,
+        soloEnabled: org.solo.enabled,
+        storageLimitBytes: org.storage.limitBytes,
+        storageLimitMicros: org.storage.limitMicros,
+        aiLimitMicros: org.ai.limitMicros,
+        legalName: org.buyer.legalName,
+        orgNumber: org.buyer.orgNumber,
+        addressStreet: org.buyer.address?.street ?? null,
+        addressPostalCode: org.buyer.address?.postalCode ?? null,
+        addressCity: org.buyer.address?.city ?? null,
+        addressCountry: org.buyer.address?.country ?? null,
+        vatRegistered: org.buyer.vatRegistered,
+        bespokeAppRepo: org.bespokeAppRepo,
+        adoptedAppForm: org.adoptedApp?.form ?? null,
+    };
+}
+/**
+ * #67: reassembles `BuyerIdentity.address` from the row's four separate
+ * nullable columns -- present only when all four are, matching
+ * `validateBuyerIdentity`'s "all four parts or none".
+ */
+function rowToBuyer(row) {
+    const { addressStreet, addressPostalCode, addressCity, addressCountry } = row;
+    const address = addressStreet !== null &&
+        addressPostalCode !== null &&
+        addressCity !== null &&
+        addressCountry !== null
+        ? {
+            street: addressStreet,
+            postalCode: addressPostalCode,
+            city: addressCity,
+            country: addressCountry,
+        }
+        : null;
+    return {
+        legalName: row.legalName,
+        orgNumber: row.orgNumber,
+        address,
+        vatRegistered: row.vatRegistered,
+    };
+}
+/**
+ * `DeclaredOrgStore` (`../store.ts`) on Postgres, for #18: create, read and
+ * edit a {@link DeclaredOrg}, and read and write the {@link AppliedState}
+ * next to it, both in foundry's own database per #10 (resolved) — never git.
+ *
+ * Validation here is deliberately narrow. #18's "Done when" list names one
+ * impossible combination in full — the slug freezes once the org has mail
+ * (#7 corrections 3) — and #28 adds one more, in full: the slug is a
+ * validated (`../slug.ts`), globally unique, non-reserved DNS label, checked
+ * on both `create` and `update`. #27 adds a third, narrower rule: storage and
+ * AI spend limits are bigint-safe decimal strings of non-negative integers
+ * (or `null` for uncapped), checked the same way on both `create` and the
+ * merged result of `update`. The broader "combinations foundry knows are
+ * impossible are rejected with a reason" line needs a ruleset (domain
+ * requirements per service, `adoptedApp.form`, mail-level transitions…)
+ * that later tickets, not #18, #27 or #28, decide; `update` still merges and
+ * stores any other patch as given.
+ */
+export function createPostgresDeclaredOrgStore(db) {
+    async function requireRow(id) {
+        const [row] = await db.select().from(declaredOrgs).where(eq(declaredOrgs.id, id)).limit(1);
+        if (!row)
+            throw new DeclaredOrgError(`no declared org ${id}`);
+        return row;
+    }
+    function requireValidSlug(slug) {
+        const rejection = validateSlug(slug);
+        if (rejection)
+            throw new DeclaredOrgError(rejection.message);
+    }
+    function requireValidLimit(fieldName, value) {
+        if (value !== null && !NON_NEGATIVE_INTEGER.test(value)) {
+            throw new DeclaredOrgError(`${fieldName} '${value}' must be a bigint-safe decimal string of a non-negative integer, or null for uncapped (#27)`);
+        }
+    }
+    // #27: storage and AI limits are bigint-safe decimal strings of
+    // non-negative integers, or `null` for uncapped -- never converted to a
+    // number, since a limit can exceed Number.MAX_SAFE_INTEGER. Checked here,
+    // the same place `requireValidSlug` checks the slug (#28), on both
+    // `create` and the merged result of `update`.
+    function requireValidLimits(org) {
+        requireValidLimit('storage.limitBytes', org.storage.limitBytes);
+        requireValidLimit('storage.limitMicros', org.storage.limitMicros);
+        requireValidLimit('ai.limitMicros', org.ai.limitMicros);
+    }
+    // #67: same place `requireValidLimits` checks the spend limits (#27), on
+    // both `create` and the merged result of `update`.
+    function requireValidBuyer(org) {
+        const reason = validateBuyerIdentity(org.buyer);
+        if (reason)
+            throw new DeclaredOrgError(`buyer identity invalid: ${reason} (#67)`);
+    }
+    return {
+        async create(org) {
+            requireValidSlug(org.slug);
+            requireValidLimits(org);
+            requireValidBuyer(org);
+            try {
+                await db.insert(declaredOrgs).values(orgToRow(org));
+            }
+            catch (error) {
+                // The pre-check above already refuses a slug this process knows is
+                // taken (nothing does, on a fresh insert) -- this catches the race
+                // the pre-check cannot: two concurrent creates for the same slug,
+                // caught by `0004_slug_unique.sql`'s unique index and reported
+                // through the same error a pre-check would have thrown (#28).
+                if (isUniqueViolation(error))
+                    throw new DeclaredOrgError(`slug '${org.slug}' is already taken by another org`);
+                throw error;
+            }
+        },
+        async get(id) {
+            const [row] = await db.select().from(declaredOrgs).where(eq(declaredOrgs.id, id)).limit(1);
+            return row ? rowToOrg(row) : null;
+        },
+        async update(id, patch) {
+            const current = rowToOrg(await requireRow(id));
+            // The slug freeze (#7 corrections 3): once mail exists, the mail
+            // subdomain already reads the slug, so the slug this update would
+            // leave in place — not the one it started from — is what decides.
+            // Turning mail on and changing the slug in the same patch is treated
+            // as "now has mail", not as a window that slips the change through.
+            const effectiveMailMode = patch.mail?.mode ?? current.mail.mode;
+            if (patch.slug !== undefined && patch.slug !== current.slug && effectiveMailMode !== 'off') {
+                throw new DeclaredOrgError(`org ${id}: slug is frozen once the org has mail (mode '${effectiveMailMode}')`);
+            }
+            // #28: a changed slug is validated the same way `create` validates
+            // one -- unchanged, it was already valid when it was created (or
+            // grandfathered before #28 existed), so re-checking it here would
+            // just be re-litigating a write this update isn't making.
+            if (patch.slug !== undefined && patch.slug !== current.slug)
+                requireValidSlug(patch.slug);
+            const next = { ...current, ...patch, id: current.id };
+            requireValidLimits(next);
+            requireValidBuyer(next);
+            try {
+                await db
+                    .update(declaredOrgs)
+                    .set({ ...orgToRow(next), updatedAt: sql `now()` })
+                    .where(eq(declaredOrgs.id, id));
+            }
+            catch (error) {
+                // Same race as `create`: another org's concurrent write took this
+                // slug between the pre-check above and this statement (#28).
+                if (isUniqueViolation(error))
+                    throw new DeclaredOrgError(`slug '${next.slug}' is already taken by another org`);
+                throw error;
+            }
+            return next;
+        },
+        async getAppliedState(id) {
+            const [row] = await db
+                .select()
+                .from(foundryAppliedState)
+                .where(eq(foundryAppliedState.orgId, id))
+                .limit(1);
+            if (!row)
+                return null;
+            const state = {
+                orgId: row.orgId,
+                serviceIds: row.serviceIds,
+                checkpoints: row.checkpoints,
+                failedFields: row.failedFields,
+                lastApplied: row.lastAppliedAt && row.lastAppliedDeclaredOrgVersion
+                    ? {
+                        at: row.lastAppliedAt.toISOString(),
+                        declaredOrgVersion: row.lastAppliedDeclaredOrgVersion,
+                    }
+                    : null,
+            };
+            return state;
+        },
+        async putAppliedState(state) {
+            const values = {
+                orgId: state.orgId,
+                serviceIds: state.serviceIds,
+                checkpoints: state.checkpoints,
+                failedFields: state.failedFields,
+                lastAppliedAt: state.lastApplied ? new Date(state.lastApplied.at) : null,
+                lastAppliedDeclaredOrgVersion: state.lastApplied?.declaredOrgVersion ?? null,
+            };
+            await db
+                .insert(foundryAppliedState)
+                .values(values)
+                .onConflictDoUpdate({ target: foundryAppliedState.orgId, set: values });
+        },
+    };
+}