makersclaw 0.6.0 → 0.7.0

package/templates/next/files/lib/db.js

@@ -1,3 +1,4 @@
+import { headers } from "next/headers";
 import { Pool, types } from "pg";
 
 // A `date` column is a day on a wall calendar, not an instant, so it is
@@ -26,18 +27,84 @@ globalThis._pgPool = pool;
 
 export const query = (text, params) => pool.query(text, params);
 
+/**
+ * Who is asking: the member the platform's proxy named on this request
+ * (`x-claw-user-id`, `x-claw-user-email`; the proxy drops a browser's own
+ * copies first, so they are only ever its word). `''` for each one it did
+ * not name: a local run, a render outside a request, a job.
+ *   → { id, email }
+ */
+export async function requestMember() {
+  try {
+    const asked = await headers();
+    return { id: asked.get("x-claw-user-id") || "", email: asked.get("x-claw-user-email") || "" };
+  } catch {
+    return { id: "", email: "" };
+  }
+}
+
+// The member, told to the database inside the write's own transaction. The
+// third argument, true, makes each setting local: the COMMIT ends it, so the
+// next statement on this pooled connection never runs as this member. Never
+// false (the platform's rule since the Neon probe; test/data.test.mjs greps
+// the template for it). Values are bound, never written into the text.
+const MEMBER_SETTINGS =
+  "SELECT set_config('claw.member_id', $1, true), set_config('claw.member_email', $2, true)";
+
+/**
+ * Run `work(query)` in one transaction on one connection, after telling
+ * the database who is asking. A default, a trigger or an action function
+ * reads it the same way in a server app and a browser one (where the
+ * platform's data door sets the same two):
+ *
+ *   nullif(current_setting('claw.member_email', true), '')
+ *
+ * It is a label, not a permission: nothing in the platform trusts it, and
+ * a column the page must not choose (`created_by`) is set by a trigger
+ * that reads it. Every lib/actions.js write runs here. `work` gets a
+ * `query(text, params)` bound to the transaction's connection; use only
+ * that inside it. → whatever `work` returns. A failure rolls back and
+ * throws on.
+ */
+export async function transaction(work) {
+  const member = await requestMember();
+  const client = await pool.connect();
+  let broken;
+  try {
+    await client.query("BEGIN");
+    await client.query(MEMBER_SETTINGS, [member.id, member.email]);
+    const result = await work((text, params) => client.query(text, params));
+    await client.query("COMMIT");
+    return result;
+  } catch (error) {
+    try {
+      await client.query("ROLLBACK");
+    } catch (lost) {
+      // The connection itself failed: the pool must not lend it again.
+      broken = lost;
+    }
+    throw error;
+  } finally {
+    client.release(broken);
+  }
+}
+
 /** The artifact this app belongs to. product_run sets it from the folder
- *  the app runs in; every activity row keys on it, and so does the
- *  Activity tab the OS draws on the app window. */
+ *  the app runs in; app/layout.jsx reads it to turn examples off, and an
+ *  app may use it to name itself. The activity lines no longer need it:
+ *  claw_app.activity fills in the app itself (logActivity, below). */
 export function artifactId() {
   return process.env.CLAW_ARTIFACT_ID || null;
 }
 
 const IDENT = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 
-/** Quote a table or column name for SQL: "investors" → "investors",
- *  "public.investors" → "public"."investors". Anything else throws, so a
- *  typo in a surface config can never reach the database as SQL. */
+/** Quote a table or column name for SQL: "investors" → "investors".
+ *  An app names its tables bare: its own schema is first on its role's
+ *  search_path. Two parts still pass ("public.investors" →
+ *  "public"."investors"), for an app from before 0.7.0 whose tables are
+ *  in public and whose code says so. Anything else throws, so a typo in a
+ *  surface config can never reach the database as SQL. */
 export function ident(name) {
   const parts = String(name ?? "").split(".");
   if (!parts.length || parts.length > 2 || !parts.every((p) => IDENT.test(p))) {
@@ -46,13 +113,26 @@ export function ident(name) {
   return parts.map((p) => `"${p}"`).join(".");
 }
 
+// Postgres's "relation does not exist": no claw_app.activity to write to.
+const NO_SUCH_RELATION = "42P01";
+
 /**
  * Record what happened, for the Activity tab the OS draws on the app
- * window (and any surface that reads the table with loadActivity). Every
- * lib/actions.js write calls this; the artifact's agent writes the same
- * table with the sql verb.
+ * window (and any surface that reads the lines with loadActivity). Every
+ * lib/actions.js write calls this; the app's agent writes the same lines
+ * with the sql verb.
  * Never throws — an activity line must not fail the write it describes.
  *
+ * The line goes into claw_app.activity: the platform's view of the
+ * workspace's activity table, holding only this app's lines. The view
+ * fills in `artifact_id` (the app whose role the connection runs as) and
+ * `id`, so this names neither: the app needs no CLAW_ARTIFACT_ID, and it
+ * cannot write a line as another app. Up to 0.6.x it inserted into
+ * public.artifact_activity with CLAW_ARTIFACT_ID; an app on its own schema
+ * can reach nothing in public. Outside Makersclaw, or on a platform from
+ * before the view, there is no claw_app.activity: the line is not
+ * recorded, and this returns false, as on any other failure.
+ *
  *   action   found, drafted, sent, replied, skipped, edited, moved, added…
  *   surface  the surface key the row belongs to (the OS tab shows its
  *            label; a link into the app is /s/<surface>?row=<row_ref>)
@@ -62,17 +142,11 @@ export function ident(name) {
  *   by       'agent' | 'user:<email>' | 'run:<id>'
  */
 export async function logActivity({ action, surface, row_ref, detail, data, by }) {
-  const id = artifactId();
-  if (!id) {
-    console.warn(`[activity] not recorded (no CLAW_ARTIFACT_ID): ${action} ${detail ?? ""}`);
-    return false;
-  }
   try {
     await query(
-      `INSERT INTO public.artifact_activity (artifact_id, action, surface, row_ref, detail, data, by)
-       VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7)`,
+      `INSERT INTO claw_app.activity (action, surface, row_ref, detail, data, by)
+       VALUES ($1, $2, $3, $4, $5::jsonb, $6)`,
       [
-        id,
         String(action || "edited"),
         surface ?? null,
         row_ref == null ? null : String(row_ref),
@@ -83,7 +157,13 @@ export async function logActivity({ action, surface, row_ref, detail, data, by }
     );
     return true;
   } catch (error) {
-    console.error(`[activity] not recorded: ${String(error)}`);
+    // No view is where the app runs, not a fault in it: a warning, as the
+    // missing CLAW_ARTIFACT_ID was up to 0.6.x. Anything else is an error.
+    if (error?.code === NO_SUCH_RELATION) {
+      console.warn(`[activity] not recorded (no claw_app.activity here): ${action} ${detail ?? ""}`);
+    } else {
+      console.error(`[activity] not recorded: ${String(error)}`);
+    }
     return false;
   }
 }