letopis 0.21.0 → 1.0.1

package/dist/tables.js

@@ -1,248 +0,0 @@
-import { reservedNamesOf } from './types.js';
-const T = (ctx, name) => `"${ctx.pgSchema.replace(/"/g, '""')}"."${name}"`;
-// START_CONTRACT: where
-//   PURPOSE: Собрать SQL WHERE из простых equality-условий, добавляя значения в params.
-//   INPUTS: { conds: Cond[] - условия с генераторами текста; params: unknown[] - аккумулятор значений }
-//   OUTPUTS: { string - " WHERE ..." или пустая строка }
-//   SIDE_EFFECTS: пушит значения в params (мутация массива)
-//   LINKS: M-TABLES, V-M-TABLES
-// END_CONTRACT: where
-/** WHERE из простых equality-условий (+спец-обработчики). */
-function where(conds, params) {
-    if (!conds.length)
-        return '';
-    const parts = conds.map((c) => {
-        params.push(c.value);
-        return c.text(params.length);
-    });
-    return ' WHERE ' + parts.join(' AND ');
-}
-const eq = (col) => (n) => `"${col}" = $${n}`;
-// ---------------------------------------------------------------------------
-// START_CONTRACT: makeTables
-//   PURPOSE: Построить фасад Tables (accounts/credentials/resources/rules) поверх Ctx.
-//   INPUTS: { ctx: Ctx - runtime-контекст с sql и pgSchema }
-//   OUTPUTS: { Tables - четыре API с find/get/set/delete }
-//   SIDE_EFFECTS: каждый метод выполняет SELECT/INSERT/UPDATE/DELETE через ctx.sql
-//   LINKS: M-TABLES, V-M-TABLES, M-DDL
-// END_CONTRACT: makeTables
-export function makeTables(ctx) {
-    const run = (text, params) => ctx.sql.unsafe(text, params);
-    // START_BLOCK_ACCOUNTS_API
-    const accounts = {
-        async find(f = {}) {
-            const conds = [];
-            if (f.id !== undefined)
-                conds.push({ text: eq('id'), value: f.id });
-            if (f.enabled !== undefined)
-                conds.push({ text: eq('enabled'), value: f.enabled });
-            if (f.category !== undefined)
-                conds.push({ text: (n) => `$${n} = ANY(categories)`, value: f.category });
-            const params = [];
-            return run(`SELECT * FROM ${T(ctx, 'Account')}${where(conds, params)} ORDER BY created`, params);
-        },
-        async get(id) {
-            return (await run(`SELECT * FROM ${T(ctx, 'Account')} WHERE id = $1`, [id]))[0] ?? null;
-        },
-        // START_CONTRACT: accounts.set
-        //   PURPOSE: INSERT (без id) либо UPDATE по id аккаунта; вернуть строку Account.
-        //   INPUTS: { a: Partial<Account> - поля categories/data/meta/avatar/enabled (+id для update) }
-        //   OUTPUTS: { Promise<Account> - созданная/обновлённая строка }
-        //   SIDE_EFFECTS: INSERT или UPDATE в таблице Account
-        //   ERRORS: account "<id>" not found (UPDATE не нашёл строку)
-        //   LINKS: M-TABLES, V-M-TABLES
-        // END_CONTRACT: accounts.set
-        async set(a) {
-            if (a.id) {
-                const sets = ['updated = now()'];
-                const params = [];
-                for (const col of ['categories', 'data', 'meta', 'avatar', 'enabled']) {
-                    if (a[col] !== undefined) {
-                        params.push(a[col]);
-                        sets.push(`"${col}" = $${params.length}`);
-                    }
-                }
-                params.push(a.id);
-                const rows = await run(`UPDATE ${T(ctx, 'Account')} SET ${sets.join(', ')} WHERE id = $${params.length} RETURNING *`, params);
-                if (!rows[0])
-                    throw new Error(`letopis: account "${a.id}" not found`);
-                return rows[0];
-            }
-            const cols = [];
-            const params = [];
-            for (const col of ['categories', 'data', 'meta', 'avatar', 'enabled']) {
-                if (a[col] !== undefined) {
-                    params.push(a[col]);
-                    cols.push(`"${col}"`);
-                }
-            }
-            const ph = params.map((_, i) => `$${i + 1}`).join(', ');
-            const rows = await run(cols.length
-                ? `INSERT INTO ${T(ctx, 'Account')} (${cols.join(', ')}) VALUES (${ph}) RETURNING *`
-                : `INSERT INTO ${T(ctx, 'Account')} DEFAULT VALUES RETURNING *`, params);
-            return rows[0];
-        },
-        async delete(id) {
-            const rows = await run(`DELETE FROM ${T(ctx, 'Account')} WHERE id = $1 RETURNING id`, [id]);
-            return rows.length > 0;
-        },
-        // START_CONTRACT: accounts.purge
-        //   PURPOSE: Физический офбординг тенанта через purge_account(); гарды Owner/System, последний Owner, не-себя — до сноса, в одной tx.
-        //   INPUTS: { id: string - целевой аккаунт }
-        //   OUTPUTS: { Promise<boolean> - true если Account физически снесён }
-        //   SIDE_EFFECTS: физ. DELETE всех Entity аккаунта + Account (Credential FK-каскад) через SQL purge_account()
-        //   ERRORS: нет caller/ACL; вызов не Owner/System; снос последнего Owner; снос своего аккаунта
-        //   LINKS: M-TABLES, V-M-TABLES, M-DDL
-        // END_CONTRACT: accounts.purge
-        async purge(id) {
-            if (!ctx.account) {
-                throw new Error('letopis: accounts.purge requires an authenticated caller — call it from a scoped handle: ' +
-                    '(await db.as(caller)).accounts.purge(id)');
-            }
-            if (id === ctx.account) {
-                throw new Error('letopis: accounts.purge cannot purge the calling account itself');
-            }
-            const schema = `"${ctx.pgSchema.replace(/"/g, '""')}"`;
-            return ctx.sql.begin(async (tsql) => {
-                const q = (t, p) => tsql.unsafe(t, p);
-                // вызывающий обязан быть Owner/System
-                const caller = await q(`SELECT categories FROM ${T(ctx, 'Account')} WHERE id = $1`, [ctx.account]);
-                const cats = caller[0]?.categories ?? [];
-                if (!cats.includes('Owner') && !cats.includes('System')) {
-                    throw new Error('letopis: accounts.purge is restricted to Owner/System accounts');
-                }
-                const tgt = await q(`SELECT categories FROM ${T(ctx, 'Account')} WHERE id = $1`, [id]);
-                if (!tgt.length)
-                    return false;
-                // нельзя снести последний enabled Owner → тенант без владельца (лок-аут)
-                if ((tgt[0].categories ?? []).includes('Owner')) {
-                    const cnt = await q(`SELECT count(*)::text AS n FROM ${T(ctx, 'Account')} WHERE 'Owner' = ANY(categories) AND enabled`, []);
-                    if (Number(cnt[0]?.n ?? 0) <= 1) {
-                        throw new Error('letopis: refusing to purge the last enabled Owner (tenant lock-out)');
-                    }
-                }
-                const res = await q(`SELECT ${schema}.purge_account($1::uuid) AS id`, [id]);
-                return res[0]?.id != null;
-            });
-        },
-    };
-    // END_BLOCK_ACCOUNTS_API
-    // START_BLOCK_CREDENTIALS_API
-    const credentials = {
-        async find(f = {}) {
-            const conds = [];
-            if (f.id !== undefined)
-                conds.push({ text: eq('id'), value: f.id });
-            if (f.account !== undefined)
-                conds.push({ text: eq('account'), value: f.account });
-            if (f.category !== undefined)
-                conds.push({ text: eq('category'), value: f.category });
-            if (f.identifier !== undefined)
-                conds.push({ text: eq('identifier'), value: f.identifier });
-            if (f.confirmed !== undefined)
-                conds.push({ text: eq('confirmed'), value: f.confirmed });
-            const params = [];
-            let sql = `SELECT * FROM ${T(ctx, 'Credential')}${where(conds, params)}`;
-            if (!f.withDeleted)
-                sql += conds.length ? ' AND deleted IS NULL' : ' WHERE deleted IS NULL';
-            return run(sql + ' ORDER BY created', params);
-        },
-        // START_CONTRACT: credentials.set
-        //   PURPOSE: upsert креденшела по UNIQUE (account, category, identifier); повторный set воскрешает (deleted → NULL).
-        //   INPUTS: { c: { account, category, identifier, meta?, confirmed? } }
-        //   OUTPUTS: { Promise<Credential> - upsert-нутая строка }
-        //   SIDE_EFFECTS: INSERT ... ON CONFLICT DO UPDATE в таблице Credential
-        //   LINKS: M-TABLES, V-M-TABLES
-        // END_CONTRACT: credentials.set
-        async set(c) {
-            const rows = await run(`INSERT INTO ${T(ctx, 'Credential')} (account, category, identifier, meta, confirmed)
-         VALUES ($1, $2, $3, $4, $5)
-         ON CONFLICT (account, category, identifier) DO UPDATE
-           SET meta = EXCLUDED.meta, confirmed = EXCLUDED.confirmed, updated = now(), deleted = NULL
-         RETURNING *`, [c.account, c.category, c.identifier, c.meta ?? {}, c.confirmed ?? true]);
-            return rows[0];
-        },
-        async delete(id) {
-            const rows = await run(`UPDATE ${T(ctx, 'Credential')} SET deleted = now(), updated = now() WHERE id = $1 AND deleted IS NULL RETURNING id`, [id]);
-            return rows.length > 0;
-        },
-    };
-    // END_BLOCK_CREDENTIALS_API
-    // START_BLOCK_RESOURCES_API
-    const resources = {
-        async find(f = {}) {
-            const conds = [];
-            if (f.category !== undefined)
-                conds.push({ text: eq('category'), value: f.category });
-            const params = [];
-            return run(`SELECT * FROM ${T(ctx, 'Resource')}${where(conds, params)} ORDER BY alias`, params);
-        },
-        async get(alias) {
-            return (await run(`SELECT * FROM ${T(ctx, 'Resource')} WHERE alias = $1`, [alias]))[0] ?? null;
-        },
-        async set(r) {
-            const rows = await run(`INSERT INTO ${T(ctx, 'Resource')} (alias, category, pattern, meta) VALUES ($1, $2, $3, $4)
-         ON CONFLICT (alias) DO UPDATE SET category = EXCLUDED.category, pattern = EXCLUDED.pattern, meta = EXCLUDED.meta
-         RETURNING *`, [r.alias, r.category, r.pattern ?? null, r.meta ?? null]);
-            return rows[0];
-        },
-        async delete(alias) {
-            const rows = await run(`DELETE FROM ${T(ctx, 'Resource')} WHERE alias = $1 RETURNING alias`, [alias]);
-            return rows.length > 0;
-        },
-    };
-    // END_BLOCK_RESOURCES_API
-    // START_BLOCK_RULES_API
-    const rules = {
-        async find(f = {}) {
-            const conds = [];
-            if (f.account !== undefined)
-                conds.push({ text: eq('account'), value: f.account });
-            if (f.resource !== undefined)
-                conds.push({ text: eq('resource'), value: f.resource });
-            if (f.permission !== undefined)
-                conds.push({ text: eq('permission'), value: f.permission });
-            if (f.enabled !== undefined)
-                conds.push({ text: eq('enabled'), value: f.enabled });
-            const params = [];
-            return run(`SELECT * FROM ${T(ctx, 'Rule')}${where(conds, params)} ORDER BY weight DESC NULLS LAST`, params);
-        },
-        async set(r) {
-            const rows = await run(`INSERT INTO ${T(ctx, 'Rule')} (account, resource, permission, weight, meta, enabled)
-         VALUES ($1, $2, $3, $4, $5, $6)
-         ON CONFLICT (account, resource) DO UPDATE
-           SET permission = EXCLUDED.permission, weight = EXCLUDED.weight, meta = EXCLUDED.meta, enabled = EXCLUDED.enabled
-         RETURNING *`, [r.account, r.resource, r.permission, r.weight ?? null, r.meta ?? null, r.enabled ?? true]);
-            return rows[0];
-        },
-        async delete(account, resource) {
-            const rows = await run(`DELETE FROM ${T(ctx, 'Rule')} WHERE account = $1 AND resource = $2 RETURNING account`, [account, resource]);
-            return rows.length > 0;
-        },
-    };
-    // END_BLOCK_RULES_API
-    // START_BLOCK_SCHEMA_API
-    const schema = {
-        async define(def) {
-            // класс с именем, которое Proxy разбирает до резолва класса, был бы недостижим как шаг
-            const clash = reservedNamesOf(def);
-            if (clash.length) {
-                throw new Error(`letopis: class name ${clash.map((n) => `"${n}"`).join(' / ')} is reserved by the chain API ` +
-                    `(a step under that name resolves to the method, not the class) — rename the ${clash.includes(def.id) ? 'id' : 'alias'}`);
-            }
-            // jsonb-значения через sql.json() — postgres.js кладёт как jsonb (не PG-массив/строку)
-            const j = (v) => ctx.sql.json(v);
-            await run(`INSERT INTO ${T(ctx, 'Schema')} (partition, id, alias, category, ancestor, attributes, meta, links, "order")
-         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
-         ON CONFLICT (partition, id) DO UPDATE SET
-           alias = EXCLUDED.alias, category = EXCLUDED.category, ancestor = EXCLUDED.ancestor,
-           attributes = EXCLUDED.attributes, meta = EXCLUDED.meta, links = EXCLUDED.links, "order" = EXCLUDED."order"`, [
-                ctx.partition, def.id, def.alias, def.category, def.ancestor ?? null,
-                j(def.attributes ?? {}), j(def.meta ?? {}), j(def.links ?? []), def.order ?? 0,
-            ]);
-            await ctx.reload?.(); // подхватить новое определение сразу (registry + enforcer)
-        },
-    };
-    // END_BLOCK_SCHEMA_API
-    return { accounts, credentials, resources, rules, schema };
-}

package/docker/Dockerfile

@@ -1,40 +0,0 @@
-# Dev-контейнер letopis: TimescaleDB + Redis в одном контейнере (решение проекта).
-# Обычный путь — letopis.up() собирает и запускает сам. Руками:
-#   docker build -t letopis-db lib/docker
-#   docker run -d --name letopis-timescale -p 15432:5432 -p 16379:6379 \
-#     -v letopis-pgdata:/var/lib/postgresql/data \
-#     -e POSTGRES_PASSWORD=test -e POSTGRES_DB=letopis letopis-db
-# FILE: lib/docker/Dockerfile
-# VERSION: 1.0.0
-# START_MODULE_CONTRACT
-#   PURPOSE: Dev-образ БД — TimescaleDB pg17 + Redis в одном контейнере (для letopis.up()).
-#   SCOPE: базовый образ, установка redis, копирование start.sh, EXPOSE 5432/6379, entrypoint.
-#   DEPENDS: none
-#   LINKS: M-DOCKER, V-M-DOCKER
-#   ROLE: CONFIG
-#   MAP_MODE: SUMMARY
-# END_MODULE_CONTRACT
-#
-# START_MODULE_MAP
-#   FROM timescale/timescaledb:latest-pg17 - база (PostgreSQL 17 + TimescaleDB)
-#   apk add redis - Redis в тот же образ
-#   ENTRYPOINT start-letopis.sh - запуск redis + postgres
-# END_MODULE_MAP
-#
-# START_CHANGE_SUMMARY
-#   LAST_CHANGE: [v1.0.0 - Documented existing module: reverse-engineered contract + markup]
-# END_CHANGE_SUMMARY
-
-# START_BLOCK_IMAGE_BUILD
-FROM timescale/timescaledb:latest-pg17
-
-RUN apk add --no-cache redis
-
-COPY start.sh /usr/local/bin/start-letopis.sh
-RUN chmod +x /usr/local/bin/start-letopis.sh
-
-EXPOSE 5432 6379
-
-ENTRYPOINT ["/usr/local/bin/start-letopis.sh"]
-CMD ["postgres"]
-# END_BLOCK_IMAGE_BUILD

package/docker/start.sh

@@ -1,18 +0,0 @@
-#!/bin/sh
-# FILE: lib/docker/start.sh
-# VERSION: 1.0.0
-# START_MODULE_CONTRACT
-#   PURPOSE: Entrypoint dev-контейнера — поднять Redis фоном, затем штатный postgres docker-entrypoint.
-#   SCOPE: redis-server (daemonize) + exec docker-entrypoint.sh.
-#   DEPENDS: none
-#   LINKS: M-DOCKER, V-M-DOCKER
-#   ROLE: SCRIPT
-#   MAP_MODE: NONE
-# END_MODULE_CONTRACT
-#
-# START_CHANGE_SUMMARY
-#   LAST_CHANGE: [v1.0.0 - Documented existing module: reverse-engineered contract + markup]
-# END_CHANGE_SUMMARY
-# Redis фоном (dev: без пароля и персиста — сессии эфемерны), затем штатный entrypoint postgres.
-redis-server --port 6379 --bind 0.0.0.0 --protected-mode no --save '' --appendonly no --daemonize yes
-exec docker-entrypoint.sh "$@"