cartethyia 2.5.1 → 2.5.3

package/src/console/backup/service.ts

@@ -19,6 +19,7 @@
  * re-authentication.
  */
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
+import type { Table } from "drizzle-orm";
 import {
   models,
   providerAccounts,
@@ -29,7 +30,12 @@ import {
 } from "../../persistence/schema";
 import { ConsoleDomainError } from "../shared/errors";
 import { tablesForSection, tableName } from "./contracts";
-import type { BackupSection, RestoreWarning, ValidatedRestore } from "./contracts";
+import type {
+  BackupSection,
+  RestoreWarning,
+  ValidatedRestore,
+  ValidatedTable,
+} from "./contracts";
 import {
   applyRestore,
   decompressBackup,
@@ -90,6 +96,53 @@ export interface ImportResult {
   readonly format: "native" | "nine_router";
 }
 
+/**
+ * Which parts of a backup file a restore should actually write.
+ *
+ * Absent or empty means "everything", which is the historical behavior and
+ * what the dashboard's checklist defaults to. A table named here but absent
+ * from the file is simply not restored — it is not an error, because the
+ * checklist is built from an inspection of *this* file and a selection never
+ * invents a table.
+ */
+export interface BackupRestoreSelection {
+  /** Table names to restore; absent or empty restores every table present. */
+  readonly tables?: readonly string[];
+}
+
+/**
+ * Narrows a validated backup to the tables the operator selected.
+ *
+ * The tenant row is the one thing that is not independently selectable: it is
+ * not a table in either section (`BACKUP_SECTIONS` are config and telemetry),
+ * so it never appears on the checklist, and every tenant-scoped table
+ * cascades from it. Dropping it because it was not named would make a partial
+ * restore fail on a foreign key for a table the operator *did* ask for. So it
+ * rides along with any config selection and is written only when one is made.
+ *
+ * A table named in the selection but missing from the file is a no-op rather
+ * than an error: the checklist is built from an inspection of this file, but
+ * the selection is validated as names only, and refusing to restore anything
+ * over one stale name would be worse than ignoring it.
+ */
+function restrictToSelection(
+  validation: ValidatedRestore,
+  selection: BackupRestoreSelection | undefined,
+): ValidatedRestore {
+  const wanted = selection?.tables;
+  if (wanted === undefined || wanted.length === 0) return validation;
+  const selected = new Set(wanted);
+  const tables = new Map<Table, ValidatedTable>();
+  for (const [table, entry] of validation.tables) {
+    if (selected.has(tableName(table))) tables.set(table, entry);
+  }
+  return {
+    ...validation,
+    tables,
+    tenantRows: tables.size > 0 ? validation.tenantRows : [],
+  };
+}
+
 function sectionsOrDefault(sections: readonly BackupSection[] | undefined): readonly BackupSection[] {
   if (sections === undefined || sections.length === 0) return ["config"];
   for (const section of sections) {
@@ -246,6 +299,7 @@ export class BackupService {
     password: unknown,
     payload: unknown,
     tenantId: string,
+    selection?: BackupRestoreSelection,
   ): Promise<ImportResult> {
     if (typeof password !== "string" || !(await this.options.verifyPassword(password))) {
       throw new ConsoleDomainError("unauthorized", 401, "password is incorrect");
@@ -258,11 +312,11 @@ export class BackupService {
 
     if (detected.kind === "nine_router") {
       const { payload: converted, report } = convert9RouterBackup(detected.payload, tenantId);
-      const result = await this.apply(converted, tenantId);
+      const result = await this.apply(converted, tenantId, selection);
       return { ...result, report, format: "nine_router" };
     }
 
-    const result = await this.apply(detected.payload, tenantId);
+    const result = await this.apply(detected.payload, tenantId, selection);
     return { ...result, format: "native" };
   }
 
@@ -348,13 +402,15 @@ export class BackupService {
   private async apply(
     payload: unknown,
     tenantId: string,
+    selection?: BackupRestoreSelection,
   ): Promise<{ restored: Record<string, number>; skipped: Record<string, number>; warnings: readonly RestoreWarning[] }> {
     const validation = validateRestorePayload(payload, tenantId);
     if (!validation.ok) {
       throw new ConsoleDomainError("invalid_request", 400, validation.error);
     }
     try {
-      const compatible = await omitRowsForUnavailableProviders(this.options.db, validation.value, tenantId);
+      const scoped = restrictToSelection(validation.value, selection);
+      const compatible = await omitRowsForUnavailableProviders(this.options.db, scoped, tenantId);
       const applied = await applyRestore(this.options.db, compatible, restoreOrder(), tenantId);
       return { ...applied, warnings: compatible.warnings };
     } catch (error) {

package/src/console/observability/contracts.ts

@@ -45,7 +45,17 @@ export interface SystemHealthResponse {
    * gateway itself grew.
    */
   database_in_process: boolean;
-  cpu_percent: number;
+  /**
+   * `null` when the platform does not report it — there is no `loadavg` on
+   * Windows and Node hands back a zeroed tuple rather than failing, so on
+   * Windows this is always `null` rather than a confident-looking `0`.
+   *
+   * Nullable rather than `NaN`: `NaN` is not a JSON value and serializes to
+   * `null` anyway, which means a client validating the field as a number
+   * rejects the *whole* health payload. One unavailable metric then reads as
+   * every metric being unavailable.
+   */
+  cpu_percent: number | null;
   cpu_cores: number;
   pid: number;
   platform: string;

package/src/console/observability/store.ts

@@ -330,12 +330,15 @@ export class DrizzleObservabilityStore implements ObservabilityStore {
     // syscall and Node reports a zeroed tuple rather than failing. Divided by
     // cores that is a confident-looking 0.0% on a busy gateway, which is worse
     // than saying nothing: an operator reads it as "idle" and stops looking.
-    // Reported as unavailable instead of as a measurement.
-    const load = loadavg()[0] ?? 0;
-    const cpuPercent =
-      process.platform === "win32" || load === 0
-        ? Number.NaN
-        : Math.round((load / Math.max(cpus().length, 1)) * 10000) / 100;
+    // Reported as null instead of as a measurement.
+    //
+    // A real zero load is *not* the same thing and is reported as zero: an
+    // idle machine genuinely has nothing queued, and collapsing that into
+    // "unavailable" would hide a number the platform did supply.
+    const cpuPercent: number | null =
+      process.platform === "win32"
+        ? null
+        : Math.round(((loadavg()[0] ?? 0) / Math.max(cpus().length, 1)) * 10000) / 100;
 
     let databaseHealthy = true;
     let total = 0;

package/src/console/share/share-router.ts

@@ -23,7 +23,6 @@ import type { ShareFamilyStats, ShareStatsPort } from "./share-stats";
 import { consoleSseResponse, createConsoleSseStream } from "../observability/sse";
 import { GatewayError, publicGatewayErrorBody } from "../../protocol/gateway-error";
 import {
-  hashShareToken,
   type ShareLinkPolicy,
   type ShareLinkRefusal,
   type ShareLinkStore,
@@ -224,7 +223,7 @@ async function resolveFamilyStats(
   stats: ShareStatsPort,
   token: string,
 ): Promise<ShareFamilyStats | null> {
-  const resolved = await shareStore.resolveShareLink(hashShareToken(token));
+  const resolved = await shareStore.resolveShareLink(token);
   if (resolved === null) return null;
   const templateId = resolved.key.id;
   const tenantId = resolved.key.tenantId;
@@ -267,8 +266,7 @@ export function createShareRouter(options: ShareRouterOptions): Elysia {
       if (typeof params.token !== "string") return notFound();
       const token = params.token;
       if (token.length < MIN_TOKEN_LENGTH) return notFound();
-      const tokenHash = hashShareToken(token);
-      const outcome = await shareStore.resolveShareLinkOutcome(tokenHash);
+      const outcome = await shareStore.resolveShareLinkOutcome(token);
       if (!outcome.ok) return notFound(outcome.refusal);
       const resolved = outcome.resolution;
       const row = resolved.key;
@@ -276,7 +274,7 @@ export function createShareRouter(options: ShareRouterOptions): Elysia {
       const clientIpKey = clientIp === null ? undefined : canonicalClientIpKey(clientIp);
       const models = await modelsForShare(db, row);
       const modelInfo = await modelInfoForShare(db, row, models);
-      void shareStore.touchView(tokenHash).catch(() => undefined);
+      void shareStore.touchView(token).catch(() => undefined);
       const policy = {
         name: row.name,
         keyPrefix: row.keyPrefix,
@@ -330,7 +328,7 @@ export function createShareRouter(options: ShareRouterOptions): Elysia {
       if (typeof params.token !== "string") return notFound();
       const token = params.token;
       if (token.length < MIN_TOKEN_LENGTH) return notFound();
-      const resolved = await shareStore.resolveShareLink(hashShareToken(token));
+      const resolved = await shareStore.resolveShareLink(token);
       const image = resolved?.key.sharePopupImage;
       const mime = resolved?.key.sharePopupImageMime;
       if (!image || !mime) return notFound();
@@ -355,8 +353,7 @@ export function createShareRouter(options: ShareRouterOptions): Elysia {
       if (clientIpKey === undefined)
         return json({ error: { code: "client_ip_invalid", message: "Client IP could not be normalized" } }, 400);
 
-      const tokenHash = hashShareToken(token);
-      const outcome = await shareStore.resolveShareLinkOutcome(tokenHash);
+      const outcome = await shareStore.resolveShareLinkOutcome(token);
       // A handoff link reveals an existing key; it never mints one.
       if (!outcome.ok) return notFound(outcome.refusal);
       const resolved = outcome.resolution;
@@ -374,7 +371,7 @@ export function createShareRouter(options: ShareRouterOptions): Elysia {
       }
       const template = resolved.key;
       const generated = generateApiKeySecret(resolveShareKeyPrefix(template.keyPrefix ?? undefined));
-      const issued = await shareStore.issueSharedApiKey(tokenHash, {
+      const issued = await shareStore.issueSharedApiKey(token, {
         keyHash: generated.hash,
         keyPrefix: generated.prefix,
         clientIp,