insforge 0.3.3 → 1.3.0

package/backend/src/services/realtime/realtime-message.service.ts

@@ -0,0 +1,260 @@
+import { Pool } from 'pg';
+import { DatabaseManager } from '@/infra/database/database.manager.js';
+import logger from '@/utils/logger.js';
+import type { RealtimeMessage, RoleSchema } from '@insforge/shared-schemas';
+import { RealtimeChannelService } from './realtime-channel.service.js';
+import { RealtimeAuthService } from './realtime-auth.service.js';
+
+export class RealtimeMessageService {
+  private static instance: RealtimeMessageService;
+  private pool: Pool | null = null;
+
+  private constructor() {}
+
+  static getInstance(): RealtimeMessageService {
+    if (!RealtimeMessageService.instance) {
+      RealtimeMessageService.instance = new RealtimeMessageService();
+    }
+    return RealtimeMessageService.instance;
+  }
+
+  private getPool(): Pool {
+    if (!this.pool) {
+      this.pool = DatabaseManager.getInstance().getPool();
+    }
+    return this.pool;
+  }
+
+  /**
+   * Insert a message into the channel (client-initiated send).
+   * RLS INSERT policy controls who can send to which channels.
+   * pg_notify is automatically triggered by database trigger on insert.
+   *
+   * @returns The inserted message data for broadcasting, or null if RLS denied the insert
+   */
+  async insertMessage(
+    channelName: string,
+    eventName: string,
+    payload: Record<string, unknown>,
+    userId: string | undefined,
+    userRole: RoleSchema
+  ): Promise<{
+    channelId: string;
+    channelName: string;
+    eventName: string;
+    payload: Record<string, unknown>;
+    senderId: string | null;
+  } | null> {
+    // Get channel info
+    const channelService = RealtimeChannelService.getInstance();
+    const channel = await channelService.getByName(channelName);
+
+    if (!channel) {
+      logger.debug('Channel not found for message insert', { channelName });
+      return null;
+    }
+
+    const client = await this.getPool().connect();
+
+    try {
+      // Begin transaction to ensure settings persist across queries
+      await client.query('BEGIN');
+
+      // Switch to specified role to enforce RLS policies
+      await client.query(`SET LOCAL ROLE ${userRole}`);
+
+      // Set user context for RLS policy evaluation
+      const authService = RealtimeAuthService.getInstance();
+      await authService.setUserContext(client, userId, channelName);
+
+      // Attempt INSERT with sender info - RLS will allow/deny based on policies
+      // No RETURNING clause needed - trigger handles pg_notify
+      await client.query(
+        `INSERT INTO realtime.messages (event_name, channel_id, channel_name, payload, sender_type, sender_id)
+         VALUES ($1, $2, $3, $4, 'user', $5)`,
+        [eventName, channel.id, channelName, JSON.stringify(payload), userId || null]
+      );
+
+      // Commit transaction - insert succeeded
+      await client.query('COMMIT');
+
+      logger.debug('Client message inserted', {
+        channelName,
+        eventName,
+        userId,
+      });
+
+      return {
+        channelId: channel.id,
+        channelName,
+        eventName,
+        payload,
+        senderId: userId || null,
+      };
+    } catch (error) {
+      // Rollback transaction on error
+      await client.query('ROLLBACK').catch(() => {});
+
+      // RLS policy denied the INSERT or other error
+      logger.debug('Message insert denied or failed', { channelName, eventName, userId, error });
+      return null;
+    } finally {
+      // Reset role back to default before releasing connection
+      await client.query('RESET ROLE');
+      client.release();
+    }
+  }
+
+  /**
+   * Get a message by ID (used by RealtimeManager after pg_notify)
+   */
+  async getById(id: string): Promise<RealtimeMessage | null> {
+    const result = await this.getPool().query(
+      `SELECT
+        id,
+        event_name as "eventName",
+        channel_id as "channelId",
+        channel_name as "channelName",
+        payload,
+        sender_type as "senderType",
+        sender_id as "senderId",
+        ws_audience_count as "wsAudienceCount",
+        wh_audience_count as "whAudienceCount",
+        wh_delivered_count as "whDeliveredCount",
+        created_at as "createdAt"
+      FROM realtime.messages
+      WHERE id = $1`,
+      [id]
+    );
+    return result.rows[0] || null;
+  }
+
+  async list(
+    options: {
+      channelId?: string;
+      eventName?: string;
+      limit?: number;
+      offset?: number;
+    } = {}
+  ): Promise<RealtimeMessage[]> {
+    const { channelId, eventName, limit = 100, offset = 0 } = options;
+
+    let query = `
+      SELECT
+        id,
+        event_name as "eventName",
+        channel_id as "channelId",
+        channel_name as "channelName",
+        payload,
+        sender_type as "senderType",
+        sender_id as "senderId",
+        ws_audience_count as "wsAudienceCount",
+        wh_audience_count as "whAudienceCount",
+        wh_delivered_count as "whDeliveredCount",
+        created_at as "createdAt"
+      FROM realtime.messages
+      WHERE 1=1
+    `;
+
+    const params: (string | number)[] = [];
+    let paramIndex = 1;
+
+    if (channelId) {
+      query += ` AND channel_id = $${paramIndex++}`;
+      params.push(channelId);
+    }
+
+    if (eventName) {
+      query += ` AND event_name = $${paramIndex++}`;
+      params.push(eventName);
+    }
+
+    query += ` ORDER BY created_at DESC LIMIT $${paramIndex++} OFFSET $${paramIndex++}`;
+    params.push(limit, offset);
+
+    const result = await this.getPool().query(query, params);
+    return result.rows;
+  }
+
+  /**
+   * Update message record with delivery statistics
+   */
+  async updateDeliveryStats(
+    messageId: string,
+    stats: {
+      wsAudienceCount: number;
+      whAudienceCount: number;
+      whDeliveredCount: number;
+    }
+  ): Promise<void> {
+    await this.getPool().query(
+      `UPDATE realtime.messages
+       SET
+         ws_audience_count = $2,
+         wh_audience_count = $3,
+         wh_delivered_count = $4
+       WHERE id = $1`,
+      [messageId, stats.wsAudienceCount, stats.whAudienceCount, stats.whDeliveredCount]
+    );
+  }
+
+  async getStats(
+    options: {
+      channelId?: string;
+      since?: Date;
+    } = {}
+  ): Promise<{
+    totalMessages: number;
+    whDeliveryRate: number;
+    topEvents: { eventName: string; count: number }[];
+  }> {
+    const { channelId, since } = options;
+
+    let whereClause = '1=1';
+    const params: (string | Date)[] = [];
+    let paramIndex = 1;
+
+    if (channelId) {
+      whereClause += ` AND channel_id = $${paramIndex++}`;
+      params.push(channelId);
+    }
+
+    if (since) {
+      whereClause += ` AND created_at >= $${paramIndex++}`;
+      params.push(since);
+    }
+
+    const statsResult = await this.getPool().query(
+      `SELECT
+        COUNT(*) as total_messages,
+        SUM(wh_audience_count) as wh_audience_total,
+        SUM(wh_delivered_count) as wh_delivered_total
+      FROM realtime.messages
+      WHERE ${whereClause}`,
+      params
+    );
+
+    const topEventsResult = await this.getPool().query(
+      `SELECT event_name, COUNT(*) as count
+       FROM realtime.messages
+       WHERE ${whereClause}
+       GROUP BY event_name
+       ORDER BY count DESC
+       LIMIT 10`,
+      params
+    );
+
+    const stats = statsResult.rows[0];
+    const whAudienceTotal = parseInt(stats.wh_audience_total) || 0;
+    const whDeliveredTotal = parseInt(stats.wh_delivered_total) || 0;
+
+    return {
+      totalMessages: parseInt(stats.total_messages) || 0,
+      whDeliveryRate: whAudienceTotal > 0 ? whDeliveredTotal / whAudienceTotal : 0,
+      topEvents: topEventsResult.rows.map((row) => ({
+        eventName: row.event_name,
+        count: parseInt(row.count),
+      })),
+    };
+  }
+}

package/backend/src/{core/secrets/secrets.ts → services/secrets/secret.service.ts}

@@ -1,8 +1,8 @@
 import { Pool } from 'pg';
 import crypto from 'crypto';
-import { DatabaseManager } from '@/core/database/manager.js';
+import { DatabaseManager } from '@/infra/database/database.manager.js';
 import logger from '@/utils/logger.js';
-import { EncryptionUtils } from './encryption.js';
+import { EncryptionManager } from '@/infra/security/encryption.manager.js';
 
 export interface SecretSchema {
   id: string;
@@ -29,11 +29,19 @@ export interface UpdateSecretInput {
   expiresAt?: Date | null;
 }
 
-export class SecretsService {
+export class SecretService {
+  private static instance: SecretService;
   private pool: Pool | null = null;
 
-  constructor() {
-    // Encryption is now handled by the shared EncryptionUtils
+  private constructor() {
+    // Encryption is now handled by the shared EncryptionManager
+  }
+
+  public static getInstance(): SecretService {
+    if (!SecretService.instance) {
+      SecretService.instance = new SecretService();
+    }
+    return SecretService.instance;
   }
 
   private getPool(): Pool {
@@ -47,11 +55,10 @@ export class SecretsService {
    * Create a new secret
    */
   async createSecret(input: CreateSecretInput): Promise<{ id: string }> {
-    const client = await this.getPool().connect();
     try {
-      const encryptedValue = EncryptionUtils.encrypt(input.value);
+      const encryptedValue = EncryptionManager.encrypt(input.value);
 
-      const result = await client.query(
+      const result = await this.getPool().query(
         `INSERT INTO _secrets (key, value_ciphertext, is_reserved, expires_at)
          VALUES ($1, $2, $3, $4)
          RETURNING id`,
@@ -63,8 +70,6 @@ export class SecretsService {
     } catch (error) {
       logger.error('Failed to create secret', { error, key: input.key });
       throw new Error('Failed to create secret');
-    } finally {
-      client.release();
     }
   }
 
@@ -72,9 +77,8 @@ export class SecretsService {
    * Get a decrypted secret by ID
    */
   async getSecretById(id: string): Promise<string | null> {
-    const client = await this.getPool().connect();
     try {
-      const result = await client.query(
+      const result = await this.getPool().query(
         `UPDATE _secrets
          SET last_used_at = NOW()
          WHERE id = $1 AND is_active = true
@@ -83,18 +87,16 @@ export class SecretsService {
         [id]
       );
 
-      if (result.rows.length === 0) {
+      if (!result.rows.length) {
         return null;
       }
 
-      const decryptedValue = EncryptionUtils.decrypt(result.rows[0].value_ciphertext);
+      const decryptedValue = EncryptionManager.decrypt(result.rows[0].value_ciphertext);
       logger.info('Secret retrieved', { id });
       return decryptedValue;
     } catch (error) {
       logger.error('Failed to get secret', { error, id });
       throw new Error('Failed to get secret');
-    } finally {
-      client.release();
     }
   }
 
@@ -102,9 +104,8 @@ export class SecretsService {
    * Get a decrypted secret by key
    */
   async getSecretByKey(key: string): Promise<string | null> {
-    const client = await this.getPool().connect();
     try {
-      const result = await client.query(
+      const result = await this.getPool().query(
         `UPDATE _secrets
          SET last_used_at = NOW()
          WHERE key = $1 AND is_active = true
@@ -113,18 +114,16 @@ export class SecretsService {
         [key]
       );
 
-      if (result.rows.length === 0) {
+      if (!result.rows.length) {
         return null;
       }
 
-      const decryptedValue = EncryptionUtils.decrypt(result.rows[0].value_ciphertext);
+      const decryptedValue = EncryptionManager.decrypt(result.rows[0].value_ciphertext);
       logger.info('Secret retrieved by key', { key });
       return decryptedValue;
     } catch (error) {
       logger.error('Failed to get secret by key', { error, key });
       throw new Error('Failed to get secret');
-    } finally {
-      client.release();
     }
   }
 
@@ -132,9 +131,8 @@ export class SecretsService {
    * List all secrets (without decrypting values)
    */
   async listSecrets(): Promise<SecretSchema[]> {
-    const client = await this.getPool().connect();
     try {
-      const result = await client.query(
+      const result = await this.getPool().query(
         `SELECT
           id,
           key,
@@ -152,8 +150,6 @@ export class SecretsService {
     } catch (error) {
       logger.error('Failed to list secrets', { error });
       throw new Error('Failed to list secrets');
-    } finally {
-      client.release();
     }
   }
 
@@ -161,14 +157,13 @@ export class SecretsService {
    * Update a secret
    */
   async updateSecret(id: string, input: UpdateSecretInput): Promise<boolean> {
-    const client = await this.getPool().connect();
     try {
       const updates: string[] = [];
       const values: (string | boolean | Date | null)[] = [];
       let paramCount = 1;
 
       if (input.value !== undefined) {
-        const encryptedValue = EncryptionUtils.encrypt(input.value);
+        const encryptedValue = EncryptionManager.encrypt(input.value);
         updates.push(`value_ciphertext = $${paramCount++}`);
         values.push(encryptedValue);
       }
@@ -190,7 +185,7 @@ export class SecretsService {
 
       values.push(id);
 
-      const result = await client.query(
+      const result = await this.getPool().query(
         `UPDATE _secrets
          SET ${updates.join(', ')}
          WHERE id = $${paramCount}`,
@@ -205,8 +200,6 @@ export class SecretsService {
     } catch (error) {
       logger.error('Failed to update secret', { error, id });
       throw new Error('Failed to update secret');
-    } finally {
-      client.release();
     }
   }
 
@@ -214,34 +207,27 @@ export class SecretsService {
    * Check if a secret value matches the stored value
    */
   async checkSecretByKey(key: string, value: string): Promise<boolean> {
-    const client = await this.getPool().connect();
     try {
-      const result = await client.query(
-        `SELECT value_ciphertext FROM _secrets
+      // Optimized: Single query that retrieves and updates in one operation
+      const result = await this.getPool().query(
+        `UPDATE _secrets
+         SET last_used_at = NOW()
          WHERE key = $1
          AND is_active = true
          AND (expires_at IS NULL OR expires_at > NOW())
-         LIMIT 1`,
+         RETURNING value_ciphertext`,
         [key]
       );
 
-      if (result.rows.length === 0) {
+      if (!result.rows.length) {
         logger.warn('Secret not found for verification', { key });
         return false;
       }
 
-      const decryptedValue = EncryptionUtils.decrypt(result.rows[0].value_ciphertext);
+      const decryptedValue = EncryptionManager.decrypt(result.rows[0].value_ciphertext);
       const matches = decryptedValue === value;
 
-      // Update last_used_at if the check was successful
       if (matches) {
-        await client.query(
-          `UPDATE _secrets
-           SET last_used_at = NOW()
-           WHERE key = $1
-           AND is_active = true`,
-          [key]
-        );
         logger.info('Secret check successful', { key });
       } else {
         logger.warn('Secret check failed - value mismatch', { key });
@@ -251,8 +237,6 @@ export class SecretsService {
     } catch (error) {
       logger.error('Failed to check secret', { error, key });
       return false;
-    } finally {
-      client.release();
     }
   }
 
@@ -260,29 +244,30 @@ export class SecretsService {
    * Delete a secret
    */
   async deleteSecret(id: string): Promise<boolean> {
-    const client = await this.getPool().connect();
     try {
-      // Check if secret is reserved first
-      const checkResult = await client.query('SELECT is_reserved FROM _secrets WHERE id = $1', [
-        id,
-      ]);
-
-      if (checkResult.rows.length > 0 && checkResult.rows[0].is_reserved) {
-        throw new Error('Cannot delete reserved secret');
-      }
-
-      const result = await client.query('DELETE FROM _secrets WHERE id = $1', [id]);
+      // Optimized: Single query with WHERE clause to prevent deleting reserved secrets
+      const result = await this.getPool().query(
+        'DELETE FROM _secrets WHERE id = $1 AND is_reserved = false',
+        [id]
+      );
 
       const success = (result.rowCount ?? 0) > 0;
       if (success) {
         logger.info('Secret deleted', { id });
+      } else {
+        // Check if it exists but is reserved
+        const checkResult = await this.getPool().query(
+          'SELECT is_reserved FROM _secrets WHERE id = $1',
+          [id]
+        );
+        if (checkResult.rows.length && checkResult.rows[0].is_reserved) {
+          throw new Error('Cannot delete reserved secret');
+        }
       }
       return success;
     } catch (error) {
       logger.error('Failed to delete secret', { error, id });
       throw new Error('Failed to delete secret');
-    } finally {
-      client.release();
     }
   }
 
@@ -296,7 +281,7 @@ export class SecretsService {
 
       const oldSecretResult = await client.query(`SELECT key FROM _secrets WHERE id = $1`, [id]);
 
-      if (oldSecretResult.rows.length === 0) {
+      if (!oldSecretResult.rows.length) {
         throw new Error('Secret not found');
       }
 
@@ -310,7 +295,7 @@ export class SecretsService {
         [id]
       );
 
-      const encryptedValue = EncryptionUtils.encrypt(newValue);
+      const encryptedValue = EncryptionManager.encrypt(newValue);
       const newSecretResult = await client.query(
         `INSERT INTO _secrets (key, value_ciphertext)
          VALUES ($1, $2)
@@ -340,9 +325,8 @@ export class SecretsService {
    * Clean up expired secrets
    */
   async cleanupExpiredSecrets(): Promise<number> {
-    const client = await this.getPool().connect();
     try {
-      const result = await client.query(
+      const result = await this.getPool().query(
         `DELETE FROM _secrets
          WHERE expires_at IS NOT NULL
          AND expires_at < NOW()
@@ -357,8 +341,6 @@ export class SecretsService {
     } catch (error) {
       logger.error('Failed to cleanup expired secrets', { error });
       throw new Error('Failed to cleanup expired secrets');
-    } finally {
-      client.release();
     }
   }