libre-webui 0.21.3 → 0.22.0

package/backend/dist/persistence/postgresPersistence.js

@@ -0,0 +1,332 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ */
+import { createPostgresDatabase, } from './postgresDatabase.js';
+import { POSTGRES_MIGRATIONS } from './postgresMigrationRegistry.js';
+import { runPostgresMigrationCoordinator } from './postgresMigrations.js';
+import { inspectPostgresSchema } from './postgresSchemaInspector.js';
+import { inspectSQLiteImportCompletion } from './postgresImportState.js';
+import { createPostgresResourceRepositories, createPostgresTransactionalResourceRepositories, } from './postgresResourceRepositories.js';
+import { createPostgresExtensionRepositories, createPostgresTransactionalExtensionRepositories, } from './postgresExtensionRepositories.js';
+const plausibleEmail = (value) => value.length <= 320 && /^[^\s@]+@[^\s@]+$/.test(value);
+const encryptedEnvelopeShape = (value) => {
+    const parts = value.split(':');
+    return (parts.length === 3 &&
+        (parts[0]?.length === 32 ||
+            parts[1]?.length === 32 ||
+            parts.every(part => /^[a-fA-F0-9]*$/.test(part))));
+};
+const encodeEmail = (codec, value) => {
+    if (value === null)
+        return null;
+    if (!plausibleEmail(value))
+        throw new Error('Invalid identity email');
+    const encrypted = codec.encrypt(value);
+    if (!codec.isEncrypted(encrypted)) {
+        throw new Error('Identity email encryption did not produce an envelope');
+    }
+    return encrypted;
+};
+const decodeEmail = (codec, value) => {
+    if (value === null)
+        return null;
+    if (!codec.isEncrypted(value)) {
+        if (encryptedEnvelopeShape(value)) {
+            throw new Error('Invalid encrypted identity email');
+        }
+        // PostgreSQL has no legacy plaintext adoption path. Accepting plaintext
+        // here would silently weaken the storage boundary.
+        throw new Error('PostgreSQL identity email is not encrypted');
+    }
+    const plaintext = codec.decryptAuthenticated(value);
+    if (!plausibleEmail(plaintext))
+        throw new Error('Invalid identity email');
+    return plaintext;
+};
+const lookupEmail = (codec, value) => (value === null ? null : codec.lookupToken(value));
+const safeInteger = (value, field) => {
+    const parsed = typeof value === 'number' ? value : Number(value);
+    if (!Number.isSafeInteger(parsed)) {
+        throw new Error(`PostgreSQL returned an invalid ${field}`);
+    }
+    return parsed;
+};
+const decodeUser = (codec, row, includePassword) => {
+    const common = {
+        id: row.id,
+        username: row.username,
+        email: decodeEmail(codec, row.email),
+        role: row.role,
+        account_status: row.account_status,
+        approved_at: row.approved_at === null
+            ? null
+            : safeInteger(row.approved_at, 'approved_at'),
+        approved_by: row.approved_by,
+        avatar: row.avatar,
+        created_at: safeInteger(row.created_at, 'created_at'),
+        updated_at: safeInteger(row.updated_at, 'updated_at'),
+    };
+    if (!includePassword)
+        return common;
+    if (typeof row.password_hash !== 'string') {
+        throw new Error('PostgreSQL identity password hash is missing');
+    }
+    return { ...common, password_hash: row.password_hash };
+};
+class PostgresIdentityRepository {
+    constructor(executor, emailCodec, database, transactionClient) {
+        this.executor = executor;
+        this.emailCodec = emailCodec;
+        this.database = database;
+        this.transactionClient = transactionClient;
+    }
+    async list() {
+        const result = await this.executor.query(`SELECT id, username, email, role, account_status, approved_at,
+              approved_by, avatar, created_at, updated_at
+         FROM users
+        WHERE id <> 'default'
+        ORDER BY created_at DESC`);
+        return result.rows.map(row => decodeUser(this.emailCodec, row, false));
+    }
+    async findPublicById(id) {
+        const result = await this.executor.query(`SELECT id, username, email, role, account_status, approved_at,
+              approved_by, avatar, created_at, updated_at
+         FROM users WHERE id = $1`, [id]);
+        return result.rows[0]
+            ? decodeUser(this.emailCodec, result.rows[0], false)
+            : null;
+    }
+    async findAccountStatusById(id) {
+        const result = await this.executor.query('SELECT account_status FROM users WHERE id = $1', [id]);
+        return result.rows[0]?.account_status ?? null;
+    }
+    async findByUsername(username) {
+        const result = await this.executor.query(`SELECT id, username, email, password_hash, role, account_status,
+              approved_at, approved_by, avatar, created_at, updated_at
+         FROM users WHERE username = $1`, [username]);
+        return result.rows[0]
+            ? decodeUser(this.emailCodec, result.rows[0], true)
+            : null;
+    }
+    async insert(user) {
+        await this.executor.query(`INSERT INTO users
+         (id, username, email, email_lookup, password_hash, role,
+          account_status, approved_at, approved_by, avatar, created_at,
+          updated_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)`, [
+            user.id,
+            user.username,
+            encodeEmail(this.emailCodec, user.email),
+            lookupEmail(this.emailCodec, user.email),
+            user.password_hash,
+            user.role,
+            user.account_status,
+            user.approved_at,
+            user.approved_by,
+            user.avatar,
+            user.created_at,
+            user.updated_at,
+        ]);
+    }
+    async approve(id, approvedBy, approvedAt) {
+        const result = await this.executor.query(`UPDATE users
+          SET account_status = 'active', approved_at = $1,
+              approved_by = $2, updated_at = $1
+        WHERE id = $3 AND id <> 'default' AND account_status = 'pending'`, [approvedAt, approvedBy, id]);
+        return result.rowCount === 1;
+    }
+    async getPendingApprovalSummary() {
+        const result = await this.executor.query(`SELECT COUNT(*)::text AS count,
+              MAX(created_at)::text AS latest_created_at
+         FROM users
+        WHERE id <> 'default' AND account_status = 'pending'`);
+        return {
+            count: safeInteger(result.rows[0]?.count || '0', 'pending count'),
+            latest_created_at: result.rows[0]?.latest_created_at
+                ? safeInteger(result.rows[0].latest_created_at, 'latest created_at')
+                : null,
+        };
+    }
+    async beginRetirement(id, updatedAt) {
+        const changed = await this.executor.query(`UPDATE users SET account_status = 'retiring', updated_at = $1
+        WHERE id = $2 AND id <> 'default'
+          AND account_status IN ('pending', 'active')`, [updatedAt, id]);
+        if (changed.rowCount === 1)
+            return true;
+        const existing = await this.executor.query(`SELECT 1 FROM users
+        WHERE id = $1 AND id <> 'default' AND account_status = 'retiring'`, [id]);
+        return existing.rowCount === 1;
+    }
+    async update(id, update) {
+        const assignments = [];
+        const values = [];
+        const add = (column, value) => {
+            values.push(value);
+            assignments.push(`${column} = $${values.length}`);
+        };
+        if (update.username !== undefined)
+            add('username', update.username);
+        if (update.email !== undefined) {
+            add('email', encodeEmail(this.emailCodec, update.email));
+            add('email_lookup', lookupEmail(this.emailCodec, update.email));
+        }
+        if (update.passwordHash !== undefined) {
+            add('password_hash', update.passwordHash);
+        }
+        if (update.role !== undefined)
+            add('role', update.role);
+        if (update.avatar !== undefined)
+            add('avatar', update.avatar);
+        add('updated_at', update.updatedAt);
+        values.push(id);
+        const result = await this.executor.query(`UPDATE users SET ${assignments.join(', ')} WHERE id = $${values.length}`, values);
+        return result.rowCount === 1;
+    }
+    async delete(id) {
+        const result = await this.executor.query('DELETE FROM users WHERE id = $1', [id]);
+        return result.rowCount === 1;
+    }
+    async deleteAndEnqueue(id, actorUserId, enqueuer) {
+        const remove = async (executor) => {
+            const actor = await executor.query('SELECT account_status FROM users WHERE id = $1 FOR UPDATE', [actorUserId]);
+            if (actor.rows[0]?.account_status !== 'active') {
+                throw new Error('Identity deletion requires an active actor');
+            }
+            const result = await executor.query("DELETE FROM users WHERE id = $1 AND account_status = 'retiring'", [id]);
+            if (result.rowCount !== 1)
+                return false;
+            await enqueuer.enqueuePostgres(executor, {
+                targetUserId: id,
+                actorUserId,
+            });
+            return true;
+        };
+        if (this.transactionClient)
+            return remove(this.transactionClient);
+        return this.database.transaction(remove, {
+            isolationLevel: 'serializable',
+        });
+    }
+    async usernameExists(username) {
+        const result = await this.executor.query('SELECT 1 FROM users WHERE username = $1', [username]);
+        return result.rowCount === 1;
+    }
+    async emailExists(email) {
+        if (!plausibleEmail(email))
+            throw new Error('Invalid identity email');
+        const result = await this.executor.query('SELECT 1 FROM users WHERE email_lookup = $1', [this.emailCodec.lookupToken(email)]);
+        return result.rowCount === 1;
+    }
+    async countRealUsers() {
+        const result = await this.executor.query("SELECT COUNT(*)::text AS count FROM users WHERE id <> 'default'");
+        return safeInteger(result.rows[0]?.count || '0', 'user count');
+    }
+}
+const repositoriesFor = (database, executor, emailCodec, client) => ({
+    identity: new PostgresIdentityRepository(executor, emailCodec, database, client),
+    resources: client
+        ? createPostgresTransactionalResourceRepositories(database, client)
+        : createPostgresResourceRepositories(database),
+    extensions: client
+        ? createPostgresTransactionalExtensionRepositories(client)
+        : createPostgresExtensionRepositories(database),
+});
+export class PostgresPersistence {
+    constructor(database, emailCodec, schemaCompatibility) {
+        this.database = database;
+        this.emailCodec = emailCodec;
+        this.schemaCompatibility = schemaCompatibility;
+        this.dialect = 'postgres';
+        this.repositories = repositoriesFor(database, database, emailCodec);
+    }
+    transaction(operation) {
+        return this.database.transaction(async (client) => operation(repositoriesFor(this.database, client, this.emailCodec, client)), { isolationLevel: 'serializable' });
+    }
+    async health() {
+        const startedAt = performance.now();
+        const poolHealth = await this.database.health();
+        if (!poolHealth.ready)
+            return poolHealth;
+        try {
+            const state = await this.database.query(`SELECT status, current_version, target_version, schema_fingerprint
+           FROM libre_schema_compatibility
+          WHERE singleton = 1`);
+            const expectedVersion = POSTGRES_MIGRATIONS.length;
+            const row = state.rows[0];
+            if (state.rowCount !== 1 ||
+                row?.status !== 'compatible' ||
+                Number(row.current_version) !== expectedVersion ||
+                Number(row.target_version) !== expectedVersion ||
+                !row.schema_fingerprint) {
+                return {
+                    ...poolHealth,
+                    ready: false,
+                    latencyMs: performance.now() - startedAt,
+                    message: 'PostgreSQL schema is not ready',
+                };
+            }
+            const importStatus = await inspectSQLiteImportCompletion(this.database);
+            if (importStatus === 'running' || importStatus === 'failed') {
+                return {
+                    ...poolHealth,
+                    ready: false,
+                    latencyMs: performance.now() - startedAt,
+                    message: 'PostgreSQL SQLite import is incomplete',
+                };
+            }
+            const ledger = await this.database.query(`SELECT version, name, checksum
+           FROM libre_schema_migrations
+          ORDER BY version ASC`);
+            const validLedger = POSTGRES_MIGRATIONS.every((migration, index) => Number(ledger.rows[index]?.version) === migration.version &&
+                ledger.rows[index]?.name === migration.name &&
+                ledger.rows[index]?.checksum === migration.checksum);
+            if (ledger.rows.length !== expectedVersion || !validLedger) {
+                return {
+                    ...poolHealth,
+                    ready: false,
+                    latencyMs: performance.now() - startedAt,
+                    message: 'PostgreSQL migration ledger is incompatible',
+                };
+            }
+            const structure = await inspectPostgresSchema(this.database, POSTGRES_MIGRATIONS);
+            if (!structure.compatible ||
+                structure.fingerprint !== row.schema_fingerprint) {
+                return {
+                    ...poolHealth,
+                    ready: false,
+                    latencyMs: performance.now() - startedAt,
+                    message: 'PostgreSQL schema structure is incompatible',
+                };
+            }
+            return {
+                ...poolHealth,
+                latencyMs: performance.now() - startedAt,
+            };
+        }
+        catch {
+            return {
+                ...poolHealth,
+                ready: false,
+                latencyMs: performance.now() - startedAt,
+                message: 'PostgreSQL schema readiness query failed',
+            };
+        }
+    }
+    close() {
+        return this.database.close();
+    }
+}
+export const initializePostgresPersistence = async (config, emailCodec, migrations = POSTGRES_MIGRATIONS) => {
+    const database = createPostgresDatabase(config);
+    try {
+        const compatibility = await runPostgresMigrationCoordinator(database, config, migrations);
+        return new PostgresPersistence(database, emailCodec, compatibility);
+    }
+    catch (error) {
+        await database.close().catch(() => undefined);
+        throw error;
+    }
+};
+//# sourceMappingURL=postgresPersistence.js.map

package/backend/dist/persistence/postgresPersistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresPersistence.js","sourceRoot":"","sources":["../../src/persistence/postgresPersistence.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,sBAAsB,GAGvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EACL,kCAAkC,EAClC,+CAA+C,GAChD,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,mCAAmC,EACnC,gDAAgD,GACjD,MAAM,oCAAoC,CAAC;AAkC5C,MAAM,cAAc,GAAG,CAAC,KAAa,EAAW,EAAE,CAChD,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAEzD,MAAM,sBAAsB,GAAG,CAAC,KAAa,EAAW,EAAE;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,EAAE;YACtB,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,EAAE;YACvB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CACpD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,KAAyB,EACzB,KAAoB,EACL,EAAE;IACjB,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,KAAyB,EACzB,KAAoB,EACL,EAAE;IACjB,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,wEAAwE;QACxE,mDAAmD;QACnD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC1E,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,KAAyB,EACzB,KAAoB,EACL,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AAEvE,MAAM,WAAW,GAAG,CAAC,KAAsB,EAAE,KAAa,EAAU,EAAE;IACpE,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CACjB,KAAyB,EACzB,GAAyB,EACzB,eAAwB,EACuB,EAAE;IACjD,MAAM,MAAM,GAAG;QACb,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC;QACpC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,WAAW,EACT,GAAG,CAAC,WAAW,KAAK,IAAI;YACtB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC;QACjD,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC;QACrD,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC;KACtD,CAAC;IACF,IAAI,CAAC,eAAe;QAAE,OAAO,MAAM,CAAC;IACpC,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;AACzD,CAAC,CAAC;AAEF,MAAM,0BAA0B;IAC9B,YACmB,QAA+B,EAC/B,UAA8B,EAC9B,QAA0B,EAC1B,iBAA8B;wBAH9B,QAAQ;0BACR,UAAU;wBACV,QAAQ;iCACR,iBAAiB;IACjC,CAAC;IAEJ,KAAK,CAAC,IAAI;QACR,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CACtC;;;;iCAI2B,CAC5B,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC3B,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CACV,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CACtC;;kCAE4B,EAC5B,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACnB,CAAC,CAAE,UAAU,CACT,IAAI,CAAC,UAAU,EACf,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EACd,KAAK,CACuB;YAChC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,EAAU;QAEV,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAErC,gDAAgD,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,IAAI,IAAI,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CACtC;;wCAEkC,EAClC,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACnB,CAAC,CAAE,UAAU,CACT,IAAI,CAAC,UAAU,EACf,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EACd,IAAI,CACkB;YAC1B,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAwB;QACnC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CACvB;;;;kEAI4D,EAC5D;YACE,IAAI,CAAC,EAAE;YACP,IAAI,CAAC,QAAQ;YACb,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC;YACxC,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC;YACxC,IAAI,CAAC,aAAa;YAClB,IAAI,CAAC,IAAI;YACT,IAAI,CAAC,cAAc;YACnB,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,UAAU;YACf,IAAI,CAAC,UAAU;SAChB,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CACX,EAAU,EACV,UAAkB,EAClB,UAAkB;QAElB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CACtC;;;yEAGmE,EACnE,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,CAC7B,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,yBAAyB;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAItC;;;6DAGuD,CACxD,CAAC;QACF,OAAO;YACL,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,GAAG,EAAE,eAAe,CAAC;YACjE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB;gBAClD,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;gBACpE,CAAC,CAAC,IAAI;SACT,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAU,EAAE,SAAiB;QACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CACvC;;sDAEgD,EAChD,CAAC,SAAS,EAAE,EAAE,CAAC,CAChB,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CACxC;0EACoE,EACpE,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,QAAQ,CAAC,QAAQ,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAA0B;QACjD,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,KAAc,EAAQ,EAAE;YACnD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC;QACF,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;YAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACzD,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9D,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CACtC,oBAAoB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,MAAM,EAAE,EACzE,MAAM,CACP,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CACtC,iCAAiC,EACjC,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,EAAU,EACV,WAAmB,EACnB,QAAkC;QAElC,MAAM,MAAM,GAAG,KAAK,EAClB,QAA+B,EACb,EAAE;YACpB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,KAAK,CAChC,2DAA2D,EAC3D,CAAC,WAAW,CAAC,CACd,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,KAAK,QAAQ,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CACjC,iEAAiE,EACjE,CAAC,EAAE,CAAC,CACL,CAAC;YACF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACxC,MAAM,QAAQ,CAAC,eAAe,CAAC,QAAQ,EAAE;gBACvC,YAAY,EAAE,EAAE;gBAChB,WAAW;aACZ,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE;YACvC,cAAc,EAAE,cAAc;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CACtC,yCAAyC,EACzC,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CACtC,6CAA6C,EAC7C,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CACtC,iEAAiE,CAClE,CAAC;QACF,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,GAAG,EAAE,YAAY,CAAC,CAAC;IACjE,CAAC;CACF;AAED,MAAM,eAAe,GAAG,CACtB,QAA0B,EAC1B,QAA+B,EAC/B,UAA8B,EAC9B,MAAmB,EACM,EAAE,CAAC,CAAC;IAC7B,QAAQ,EAAE,IAAI,0BAA0B,CACtC,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,MAAM,CACP;IACD,SAAS,EAAE,MAAM;QACf,CAAC,CAAC,+CAA+C,CAAC,QAAQ,EAAE,MAAM,CAAC;QACnE,CAAC,CAAC,kCAAkC,CAAC,QAAQ,CAAC;IAChD,UAAU,EAAE,MAAM;QAChB,CAAC,CAAC,gDAAgD,CAAC,MAAM,CAAC;QAC1D,CAAC,CAAC,mCAAmC,CAAC,QAAQ,CAAC;CAClD,CAAC,CAAC;AAEH,MAAM,OAAO,mBAAmB;IAI9B,YACW,QAA0B,EAClB,UAA8B,EACtC,mBAAgD;QAFhD,aAAQ,GAAR,QAAQ,CAAkB;QAClB,eAAU,GAAV,UAAU,CAAoB;QACtC,wBAAmB,GAAnB,mBAAmB,CAA6B;QANlD,YAAO,GAAG,UAAmB,CAAC;QAQrC,IAAI,CAAC,YAAY,GAAG,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtE,CAAC;IAED,WAAW,CACT,SAA4D;QAE5D,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAC9B,KAAK,EAAC,MAAM,EAAC,EAAE,CACb,SAAS,CACP,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAChE,EACH,EAAE,cAAc,EAAE,cAAc,EAAE,CACnC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,KAAK;YAAE,OAAO,UAAU,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAMrC;;8BAEsB,CACvB,CAAC;YACF,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,CAAC;YACnD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,IACE,KAAK,CAAC,QAAQ,KAAK,CAAC;gBACpB,GAAG,EAAE,MAAM,KAAK,YAAY;gBAC5B,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,eAAe;gBAC/C,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,eAAe;gBAC9C,CAAC,GAAG,CAAC,kBAAkB,EACvB,CAAC;gBACD,OAAO;oBACL,GAAG,UAAU;oBACb,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;oBACxC,OAAO,EAAE,gCAAgC;iBAC1C,CAAC;YACJ,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxE,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;gBAC5D,OAAO;oBACL,GAAG,UAAU;oBACb,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;oBACxC,OAAO,EAAE,wCAAwC;iBAClD,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAKtC;;+BAEuB,CACxB,CAAC;YACF,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAC3C,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CACnB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK,SAAS,CAAC,OAAO;gBACzD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,SAAS,CAAC,IAAI;gBAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,KAAK,SAAS,CAAC,QAAQ,CACtD,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC3D,OAAO;oBACL,GAAG,UAAU;oBACb,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;oBACxC,OAAO,EAAE,6CAA6C;iBACvD,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAC3C,IAAI,CAAC,QAAQ,EACb,mBAAmB,CACpB,CAAC;YACF,IACE,CAAC,SAAS,CAAC,UAAU;gBACrB,SAAS,CAAC,WAAW,KAAK,GAAG,CAAC,kBAAkB,EAChD,CAAC;gBACD,OAAO;oBACL,GAAG,UAAU;oBACb,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;oBACxC,OAAO,EAAE,6CAA6C;iBACvD,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,GAAG,UAAU;gBACb,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;aACzC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,GAAG,UAAU;gBACb,KAAK,EAAE,KAAK;gBACZ,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;gBACxC,OAAO,EAAE,0CAA0C;aACpD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,EAChD,MAA6B,EAC7B,UAA8B,EAC9B,UAAU,GAAiC,mBAAmB,EAChC,EAAE;IAChC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,+BAA+B,CACzD,QAAQ,EACR,MAAM,EACN,UAAU,CACX,CAAC;QACF,OAAO,IAAI,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC"}

package/backend/dist/persistence/postgresPluginDefinitionMigration.d.ts

@@ -0,0 +1,4 @@
+import type { PostgresMigration } from './postgresMigrationTypes.js';
+export declare const POSTGRES_PLUGIN_DEFINITION_SQL = "\nCREATE TABLE plugin_definitions (\n  plugin_id text PRIMARY KEY\n    CHECK (plugin_id ~ '^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$'),\n  definition_json text NOT NULL,\n  definition_fingerprint char(64) NOT NULL\n    CHECK (definition_fingerprint ~ '^[0-9a-f]{64}$'),\n  approved_by_user_id text,\n  approved_at bigint,\n  created_at bigint NOT NULL,\n  updated_at bigint NOT NULL,\n  CHECK (\n    (approved_by_user_id IS NULL AND approved_at IS NULL)\n    OR\n    (approved_by_user_id IS NOT NULL AND approved_at IS NOT NULL)\n  )\n);\n\nCREATE INDEX idx_plugin_definitions_updated\n  ON plugin_definitions(updated_at DESC, plugin_id);\n";
+export declare const POSTGRES_PLUGIN_DEFINITION_MIGRATION: PostgresMigration;
+//# sourceMappingURL=postgresPluginDefinitionMigration.d.ts.map

package/backend/dist/persistence/postgresPluginDefinitionMigration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresPluginDefinitionMigration.d.ts","sourceRoot":"","sources":["../../src/persistence/postgresPluginDefinitionMigration.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErE,eAAO,MAAM,8BAA8B,8nBAoB1C,CAAC;AAKF,eAAO,MAAM,oCAAoC,EAAE,iBAW/C,CAAC"}

package/backend/dist/persistence/postgresPluginDefinitionMigration.js

@@ -0,0 +1,40 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ */
+import { createHash } from 'node:crypto';
+export const POSTGRES_PLUGIN_DEFINITION_SQL = `
+CREATE TABLE plugin_definitions (
+  plugin_id text PRIMARY KEY
+    CHECK (plugin_id ~ '^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$'),
+  definition_json text NOT NULL,
+  definition_fingerprint char(64) NOT NULL
+    CHECK (definition_fingerprint ~ '^[0-9a-f]{64}$'),
+  approved_by_user_id text,
+  approved_at bigint,
+  created_at bigint NOT NULL,
+  updated_at bigint NOT NULL,
+  CHECK (
+    (approved_by_user_id IS NULL AND approved_at IS NULL)
+    OR
+    (approved_by_user_id IS NOT NULL AND approved_at IS NOT NULL)
+  )
+);
+
+CREATE INDEX idx_plugin_definitions_updated
+  ON plugin_definitions(updated_at DESC, plugin_id);
+`;
+const version = 7;
+const name = 'shared-plugin-definitions';
+export const POSTGRES_PLUGIN_DEFINITION_MIGRATION = Object.freeze({
+    version,
+    name,
+    checksum: createHash('sha256')
+        .update(`${version}\n${name}\n${POSTGRES_PLUGIN_DEFINITION_SQL}`)
+        .digest('hex'),
+    sql: POSTGRES_PLUGIN_DEFINITION_SQL,
+    rollbackPlan: 'Stop all replicas, export plugin definitions and their approval fingerprints, remove custom provider use, then drop plugin_definitions. Bundled read-only definitions remain available after application downgrade.',
+    minimumCompatibleVersion: 7,
+});
+//# sourceMappingURL=postgresPluginDefinitionMigration.js.map

package/backend/dist/persistence/postgresPluginDefinitionMigration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresPluginDefinitionMigration.js","sourceRoot":"","sources":["../../src/persistence/postgresPluginDefinitionMigration.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,CAAC,MAAM,8BAA8B,GAAG;;;;;;;;;;;;;;;;;;;;CAoB7C,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,IAAI,GAAG,2BAA2B,CAAC;AAEzC,MAAM,CAAC,MAAM,oCAAoC,GAC/C,MAAM,CAAC,MAAM,CAAC;IACZ,OAAO;IACP,IAAI;IACJ,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC;SAC3B,MAAM,CAAC,GAAG,OAAO,KAAK,IAAI,KAAK,8BAA8B,EAAE,CAAC;SAChE,MAAM,CAAC,KAAK,CAAC;IAChB,GAAG,EAAE,8BAA8B;IACnC,YAAY,EACV,qNAAqN;IACvN,wBAAwB,EAAE,CAAC;CAC5B,CAAC,CAAC"}

package/backend/dist/persistence/postgresResourceRepositories.d.ts

@@ -0,0 +1,7 @@
+import type { PoolClient } from 'pg';
+import type { ApplicationResourceRepositories } from './resourceTypes.js';
+import type { PostgresDatabase } from './postgresDatabase.js';
+export declare const createPostgresResourceRepositories: (database: PostgresDatabase) => ApplicationResourceRepositories;
+/** Create transaction-scoped repositories over one pinned pooled client. */
+export declare const createPostgresTransactionalResourceRepositories: (database: PostgresDatabase, client: PoolClient) => ApplicationResourceRepositories;
+//# sourceMappingURL=postgresResourceRepositories.d.ts.map

package/backend/dist/persistence/postgresResourceRepositories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresResourceRepositories.d.ts","sourceRoot":"","sources":["../../src/persistence/postgresResourceRepositories.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,IAAI,CAAC;AAErD,OAAO,KAAK,EACV,+BAA+B,EAiBhC,MAAM,oBAAoB,CAAC;AAM5B,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,uBAAuB,CAAC;AA6mC/B,eAAO,MAAM,kCAAkC,aACnC,gBAAgB,KACzB,+BAQD,CAAC;AAEH,4EAA4E;AAC5E,eAAO,MAAM,+CAA+C,aAChD,gBAAgB,UAClB,UAAU,KACjB,+BAOF,CAAC"}