hungry-ghost-hive 0.48.0 → 0.49.0

package/src/db/postgres-provider.ts

@@ -0,0 +1,364 @@
+// Licensed under the Hungry Ghost Hive License. See LICENSE.
+
+import { existsSync, readFileSync } from 'fs';
+import { dirname, join } from 'path';
+import pg from 'pg';
+import { fileURLToPath } from 'url';
+import type { WritableDatabaseProvider } from './provider.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+/**
+ * Tables that require workspace_id scoping.
+ * The migrations table is intentionally excluded — it is shared across workspaces.
+ */
+const WORKSPACE_SCOPED_TABLES = new Set([
+  'teams',
+  'agents',
+  'requirements',
+  'stories',
+  'story_dependencies',
+  'agent_logs',
+  'escalations',
+  'pull_requests',
+  'messages',
+  'integration_sync',
+]);
+
+/**
+ * Convert SQLite-style positional parameters (?) to Postgres-style ($1, $2, ...).
+ * Handles quoted strings and avoids replacing ? inside string literals.
+ */
+export function convertParams(sql: string): string {
+  let paramIndex = 0;
+  let result = '';
+  let inSingleQuote = false;
+  let inDoubleQuote = false;
+
+  for (let i = 0; i < sql.length; i++) {
+    const char = sql[i];
+    const prevChar = i > 0 ? sql[i - 1] : '';
+
+    if (char === "'" && !inDoubleQuote && prevChar !== '\\') {
+      inSingleQuote = !inSingleQuote;
+      result += char;
+    } else if (char === '"' && !inSingleQuote && prevChar !== '\\') {
+      inDoubleQuote = !inDoubleQuote;
+      result += char;
+    } else if (char === '?' && !inSingleQuote && !inDoubleQuote) {
+      paramIndex++;
+      result += `$${paramIndex}`;
+    } else {
+      result += char;
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Detect the target table from SQL statements.
+ * Supports INSERT INTO, UPDATE, DELETE FROM, and SELECT ... FROM patterns.
+ */
+function detectTable(sql: string): string | null {
+  const normalized = sql.replace(/\s+/g, ' ').trim().toUpperCase();
+
+  // INSERT INTO table
+  let match = normalized.match(/INSERT\s+INTO\s+(\w+)/);
+  if (match) return match[1].toLowerCase();
+
+  // UPDATE table
+  match = normalized.match(/UPDATE\s+(\w+)/);
+  if (match) return match[1].toLowerCase();
+
+  // DELETE FROM table
+  match = normalized.match(/DELETE\s+FROM\s+(\w+)/);
+  if (match) return match[1].toLowerCase();
+
+  // SELECT ... FROM table (first table in FROM clause)
+  match = normalized.match(/FROM\s+(\w+)/);
+  if (match) return match[1].toLowerCase();
+
+  return null;
+}
+
+/**
+ * Check if a SQL statement needs workspace_id injection.
+ */
+function needsWorkspaceScope(sql: string): boolean {
+  const table = detectTable(sql);
+  return table !== null && WORKSPACE_SCOPED_TABLES.has(table);
+}
+
+/**
+ * Inject workspace_id into INSERT statements.
+ * Transforms: INSERT INTO table (col1, col2) VALUES (?, ?)
+ * Into:       INSERT INTO table (col1, col2, workspace_id) VALUES ($1, $2, $3)
+ */
+function injectInsertWorkspaceId(
+  sql: string,
+  workspaceId: string,
+  params: unknown[]
+): { sql: string; params: unknown[] } {
+  const insertMatch = sql.match(/INSERT\s+INTO\s+(\w+)\s*\(([^)]+)\)\s*VALUES\s*\(([^)]+)\)/i);
+  if (!insertMatch) return { sql, params };
+
+  const columns = insertMatch[2];
+  const values = insertMatch[3];
+
+  // Don't inject if workspace_id is already present
+  if (columns.toLowerCase().includes('workspace_id')) {
+    return { sql, params };
+  }
+
+  const newSql = sql.replace(
+    /\(([^)]+)\)\s*VALUES\s*\(([^)]+)\)/i,
+    `(${columns}, workspace_id) VALUES (${values}, ?)`
+  );
+
+  return { sql: newSql, params: [...params, workspaceId] };
+}
+
+/**
+ * Inject workspace_id into SELECT/UPDATE/DELETE WHERE clauses.
+ * Adds `AND workspace_id = ?` to existing WHERE, or `WHERE workspace_id = ?` if none.
+ */
+function injectWhereWorkspaceId(
+  sql: string,
+  workspaceId: string,
+  params: unknown[]
+): { sql: string; params: unknown[] } {
+  const normalized = sql.replace(/\s+/g, ' ').trim();
+
+  // Don't inject if workspace_id is already in the query
+  if (normalized.toLowerCase().includes('workspace_id')) {
+    return { sql, params };
+  }
+
+  const upperSql = normalized.toUpperCase();
+
+  // Find WHERE clause position
+  const whereIndex = upperSql.indexOf(' WHERE ');
+
+  if (whereIndex !== -1) {
+    // Insert workspace_id condition right after WHERE
+    const before = normalized.substring(0, whereIndex + 7); // includes " WHERE "
+    const after = normalized.substring(whereIndex + 7);
+    return {
+      sql: `${before}workspace_id = ? AND ${after}`,
+      params: [workspaceId, ...params],
+    };
+  }
+
+  // No WHERE clause — find insertion point (before ORDER BY, GROUP BY, LIMIT, etc.)
+  const clausePatterns = [' ORDER BY', ' GROUP BY', ' HAVING', ' LIMIT', ' OFFSET', ' FOR UPDATE'];
+  let insertPos = normalized.length;
+  for (const pattern of clausePatterns) {
+    const idx = upperSql.indexOf(pattern);
+    if (idx !== -1 && idx < insertPos) {
+      insertPos = idx;
+    }
+  }
+
+  const before = normalized.substring(0, insertPos);
+  const after = normalized.substring(insertPos);
+  return {
+    sql: `${before} WHERE workspace_id = ?${after}`,
+    params: [workspaceId, ...params],
+  };
+}
+
+/**
+ * Load a Postgres migration SQL file.
+ */
+function loadPgMigration(migrationName: string): string {
+  const candidatePaths = [
+    join(__dirname, 'pg-migrations', migrationName),
+    join(__dirname, '..', '..', 'src', 'db', 'pg-migrations', migrationName),
+  ];
+
+  for (const migrationPath of candidatePaths) {
+    if (existsSync(migrationPath)) {
+      return readFileSync(migrationPath, 'utf-8');
+    }
+  }
+
+  throw new Error(
+    `Postgres migration file not found: ${migrationName}. Checked: ${candidatePaths.join(', ')}`
+  );
+}
+
+const PG_MIGRATIONS = [{ name: '001-full-schema.sql' }];
+
+/**
+ * Postgres implementation of DatabaseProvider using node-postgres (pg).
+ * All queries are automatically scoped by workspace_id for multi-tenant isolation.
+ */
+export class PostgresProvider implements WritableDatabaseProvider {
+  private pool: pg.Pool;
+  private workspaceId: string;
+
+  constructor(connectionString: string, workspaceId: string) {
+    this.pool = new pg.Pool({ connectionString });
+    this.workspaceId = workspaceId;
+  }
+
+  /**
+   * Run Postgres migrations. Idempotent — safe to call multiple times.
+   */
+  async runMigrations(): Promise<void> {
+    const client = await this.pool.connect();
+    try {
+      // Ensure migrations table exists (shared, no workspace_id)
+      await client.query(`
+        CREATE TABLE IF NOT EXISTS migrations (
+          id SERIAL PRIMARY KEY,
+          name TEXT NOT NULL UNIQUE,
+          applied_at TIMESTAMPTZ DEFAULT NOW()
+        )
+      `);
+
+      const { rows: applied } = await client.query('SELECT name FROM migrations');
+      const appliedSet = new Set(applied.map((r: { name: string }) => r.name));
+
+      for (const migration of PG_MIGRATIONS) {
+        if (appliedSet.has(migration.name)) continue;
+
+        const sql = loadPgMigration(migration.name);
+        await client.query('BEGIN');
+        try {
+          await client.query(sql);
+          await client.query('INSERT INTO migrations (name) VALUES ($1)', [migration.name]);
+          await client.query('COMMIT');
+        } catch (error) {
+          await client.query('ROLLBACK');
+          throw error;
+        }
+      }
+    } finally {
+      client.release();
+    }
+  }
+
+  async queryAll<T>(sql: string, params: unknown[] = []): Promise<T[]> {
+    let finalSql = sql;
+    let finalParams = params;
+
+    if (needsWorkspaceScope(sql)) {
+      const normalized = sql.replace(/\s+/g, ' ').trim().toUpperCase();
+      if (!normalized.startsWith('INSERT')) {
+        const result = injectWhereWorkspaceId(finalSql, this.workspaceId, finalParams);
+        finalSql = result.sql;
+        finalParams = result.params;
+      }
+    }
+
+    finalSql = convertParams(finalSql);
+    const { rows } = await this.pool.query(finalSql, finalParams);
+    return rows as T[];
+  }
+
+  async queryOne<T>(sql: string, params: unknown[] = []): Promise<T | undefined> {
+    const results = await this.queryAll<T>(sql, params);
+    return results[0];
+  }
+
+  async run(sql: string, params: unknown[] = []): Promise<void> {
+    let finalSql = sql;
+    let finalParams = params;
+
+    if (needsWorkspaceScope(sql)) {
+      const normalized = sql.replace(/\s+/g, ' ').trim().toUpperCase();
+      if (normalized.startsWith('INSERT')) {
+        const result = injectInsertWorkspaceId(finalSql, this.workspaceId, finalParams);
+        finalSql = result.sql;
+        finalParams = result.params;
+      } else {
+        const result = injectWhereWorkspaceId(finalSql, this.workspaceId, finalParams);
+        finalSql = result.sql;
+        finalParams = result.params;
+      }
+    }
+
+    finalSql = convertParams(finalSql);
+    await this.pool.query(finalSql, finalParams);
+  }
+
+  async withTransaction<T>(fn: () => Promise<T> | T): Promise<T> {
+    const client = await this.pool.connect();
+    try {
+      await client.query('BEGIN');
+      const result = await fn();
+      await client.query('COMMIT');
+      return result;
+    } catch (error) {
+      try {
+        await client.query('ROLLBACK');
+      } catch (_error) {
+        // Ignore rollback errors
+      }
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+
+  /**
+   * No-op for Postgres — data is persisted on every query.
+   */
+  save(): void {
+    // Postgres persists automatically; no explicit save needed
+  }
+
+  async close(): Promise<void> {
+    await this.pool.end();
+  }
+
+  /**
+   * Test the database connection.
+   * @throws if the connection fails
+   */
+  async testConnection(): Promise<void> {
+    const client = await this.pool.connect();
+    try {
+      await client.query('SELECT 1');
+    } finally {
+      client.release();
+    }
+  }
+
+  /**
+   * Get the workspace_id this provider is scoped to.
+   */
+  getWorkspaceId(): string {
+    return this.workspaceId;
+  }
+}
+
+/**
+ * Create a PostgresProvider from the HIVE_DATABASE_URL environment variable.
+ * Loads .env file via dotenv if available.
+ */
+export async function createPostgresProvider(workspaceId: string): Promise<PostgresProvider> {
+  // Load .env file if dotenv is available
+  try {
+    const dotenv = await import('dotenv');
+    dotenv.config();
+  } catch {
+    // dotenv not available, rely on environment variables
+  }
+
+  const connectionString = process.env.HIVE_DATABASE_URL;
+  if (!connectionString) {
+    throw new Error(
+      'HIVE_DATABASE_URL environment variable is not set. ' +
+        'Set it in your environment or in a .env file.'
+    );
+  }
+
+  const provider = new PostgresProvider(connectionString, workspaceId);
+  await provider.testConnection();
+  await provider.runMigrations();
+  return provider;
+}

package/src/db/provider.test.ts

@@ -0,0 +1,283 @@
+// Licensed under the Hungry Ghost Hive License. See LICENSE.
+
+import initSqlJs, { type Database as SqlJsDatabase } from 'sql.js';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { ReadOnlySqliteProvider, SqliteProvider } from './provider.js';
+
+describe('SqliteProvider', () => {
+  let db: SqlJsDatabase;
+  let saveFn: ReturnType<typeof vi.fn>;
+  let provider: SqliteProvider;
+
+  beforeEach(async () => {
+    const SQL = await initSqlJs();
+    db = new SQL.Database();
+    db.run('PRAGMA foreign_keys = ON');
+    db.run(`
+      CREATE TABLE IF NOT EXISTS test_items (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        value INTEGER
+      )
+    `);
+    saveFn = vi.fn();
+    provider = new SqliteProvider(db, saveFn);
+  });
+
+  describe('queryAll', () => {
+    it('should return all matching rows', async () => {
+      await provider.run('INSERT INTO test_items (id, name, value) VALUES (?, ?, ?)', [
+        '1',
+        'a',
+        10,
+      ]);
+      await provider.run('INSERT INTO test_items (id, name, value) VALUES (?, ?, ?)', [
+        '2',
+        'b',
+        20,
+      ]);
+
+      const results = await provider.queryAll<{ id: string; name: string; value: number }>(
+        'SELECT * FROM test_items ORDER BY id'
+      );
+
+      expect(results).toHaveLength(2);
+      expect(results[0]).toEqual({ id: '1', name: 'a', value: 10 });
+      expect(results[1]).toEqual({ id: '2', name: 'b', value: 20 });
+    });
+
+    it('should return empty array when no matches', async () => {
+      const results = await provider.queryAll('SELECT * FROM test_items');
+      expect(results).toEqual([]);
+    });
+
+    it('should support parameterized queries', async () => {
+      await provider.run('INSERT INTO test_items (id, name, value) VALUES (?, ?, ?)', [
+        '1',
+        'a',
+        10,
+      ]);
+      await provider.run('INSERT INTO test_items (id, name, value) VALUES (?, ?, ?)', [
+        '2',
+        'b',
+        20,
+      ]);
+
+      const results = await provider.queryAll<{ id: string; name: string; value: number }>(
+        'SELECT * FROM test_items WHERE value > ?',
+        [15]
+      );
+
+      expect(results).toHaveLength(1);
+      expect(results[0].id).toBe('2');
+    });
+  });
+
+  describe('queryOne', () => {
+    it('should return the first matching row', async () => {
+      await provider.run('INSERT INTO test_items (id, name, value) VALUES (?, ?, ?)', [
+        '1',
+        'a',
+        10,
+      ]);
+
+      const result = await provider.queryOne<{ id: string; name: string; value: number }>(
+        'SELECT * FROM test_items WHERE id = ?',
+        ['1']
+      );
+
+      expect(result).toEqual({ id: '1', name: 'a', value: 10 });
+    });
+
+    it('should return undefined when no match', async () => {
+      const result = await provider.queryOne('SELECT * FROM test_items WHERE id = ?', [
+        'nonexistent',
+      ]);
+      expect(result).toBeUndefined();
+    });
+  });
+
+  describe('run', () => {
+    it('should execute INSERT statements', async () => {
+      await provider.run('INSERT INTO test_items (id, name, value) VALUES (?, ?, ?)', [
+        '1',
+        'test',
+        42,
+      ]);
+
+      const result = await provider.queryOne<{ id: string; name: string; value: number }>(
+        'SELECT * FROM test_items WHERE id = ?',
+        ['1']
+      );
+      expect(result).toEqual({ id: '1', name: 'test', value: 42 });
+    });
+
+    it('should execute UPDATE statements', async () => {
+      await provider.run('INSERT INTO test_items (id, name, value) VALUES (?, ?, ?)', [
+        '1',
+        'test',
+        42,
+      ]);
+      await provider.run('UPDATE test_items SET value = ? WHERE id = ?', [99, '1']);
+
+      const result = await provider.queryOne<{ value: number }>(
+        'SELECT value FROM test_items WHERE id = ?',
+        ['1']
+      );
+      expect(result?.value).toBe(99);
+    });
+
+    it('should execute DELETE statements', async () => {
+      await provider.run('INSERT INTO test_items (id, name, value) VALUES (?, ?, ?)', [
+        '1',
+        'test',
+        42,
+      ]);
+      await provider.run('DELETE FROM test_items WHERE id = ?', ['1']);
+
+      const result = await provider.queryOne('SELECT * FROM test_items WHERE id = ?', ['1']);
+      expect(result).toBeUndefined();
+    });
+  });
+
+  describe('withTransaction', () => {
+    it('should commit on success and call save', async () => {
+      await provider.withTransaction(async () => {
+        await provider.run('INSERT INTO test_items (id, name, value) VALUES (?, ?, ?)', [
+          '1',
+          'a',
+          10,
+        ]);
+        await provider.run('INSERT INTO test_items (id, name, value) VALUES (?, ?, ?)', [
+          '2',
+          'b',
+          20,
+        ]);
+      });
+
+      const results = await provider.queryAll('SELECT * FROM test_items');
+      expect(results).toHaveLength(2);
+      expect(saveFn).toHaveBeenCalledOnce();
+    });
+
+    it('should rollback on error and not call save', async () => {
+      await expect(
+        provider.withTransaction(async () => {
+          await provider.run('INSERT INTO test_items (id, name, value) VALUES (?, ?, ?)', [
+            '1',
+            'a',
+            10,
+          ]);
+          throw new Error('test error');
+        })
+      ).rejects.toThrow('test error');
+
+      const results = await provider.queryAll('SELECT * FROM test_items');
+      expect(results).toHaveLength(0);
+      expect(saveFn).not.toHaveBeenCalled();
+    });
+
+    it('should support async functions', async () => {
+      await provider.withTransaction(async () => {
+        await provider.run('INSERT INTO test_items (id, name, value) VALUES (?, ?, ?)', [
+          '1',
+          'a',
+          10,
+        ]);
+        await Promise.resolve();
+        await provider.run('INSERT INTO test_items (id, name, value) VALUES (?, ?, ?)', [
+          '2',
+          'b',
+          20,
+        ]);
+      });
+
+      const results = await provider.queryAll('SELECT * FROM test_items');
+      expect(results).toHaveLength(2);
+    });
+  });
+
+  describe('save', () => {
+    it('should call the save function', () => {
+      provider.save();
+      expect(saveFn).toHaveBeenCalledOnce();
+    });
+
+    it('should be a no-op when no save function provided', () => {
+      const providerNoSave = new SqliteProvider(db);
+      expect(() => providerNoSave.save()).not.toThrow();
+    });
+  });
+
+  describe('close', () => {
+    it('should close the underlying database', async () => {
+      await provider.close();
+      await expect(provider.queryAll('SELECT 1')).rejects.toThrow();
+    });
+  });
+
+  describe('db property', () => {
+    it('should expose the underlying sql.js database', () => {
+      expect(provider.db).toBe(db);
+    });
+  });
+});
+
+describe('ReadOnlySqliteProvider', () => {
+  let db: SqlJsDatabase;
+  let provider: ReadOnlySqliteProvider;
+
+  beforeEach(async () => {
+    const SQL = await initSqlJs();
+    db = new SQL.Database();
+    db.run('PRAGMA foreign_keys = ON');
+    db.run(`
+      CREATE TABLE IF NOT EXISTS test_items (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        value INTEGER
+      )
+    `);
+    // Pre-populate some data
+    db.run("INSERT INTO test_items (id, name, value) VALUES ('1', 'a', 10)");
+    db.run("INSERT INTO test_items (id, name, value) VALUES ('2', 'b', 20)");
+    provider = new ReadOnlySqliteProvider(db);
+  });
+
+  describe('queryAll', () => {
+    it('should return all matching rows', async () => {
+      const results = await provider.queryAll<{ id: string; name: string; value: number }>(
+        'SELECT * FROM test_items ORDER BY id'
+      );
+      expect(results).toHaveLength(2);
+      expect(results[0].name).toBe('a');
+    });
+  });
+
+  describe('queryOne', () => {
+    it('should return the first matching row', async () => {
+      const result = await provider.queryOne<{ name: string }>(
+        'SELECT name FROM test_items WHERE id = ?',
+        ['1']
+      );
+      expect(result?.name).toBe('a');
+    });
+  });
+
+  describe('withTransaction', () => {
+    it('should commit on success without saving', async () => {
+      await provider.withTransaction(async () => {
+        await provider.run("INSERT INTO test_items (id, name, value) VALUES ('3', 'c', 30)");
+      });
+
+      const results = await provider.queryAll('SELECT * FROM test_items');
+      expect(results).toHaveLength(3);
+    });
+  });
+
+  describe('db property', () => {
+    it('should expose the underlying sql.js database', () => {
+      expect(provider.db).toBe(db);
+    });
+  });
+});