makersclaw 0.6.0 → 0.8.0

package/templates/next/files/lib/data.js

@@ -1,5 +1,5 @@
 import { headers } from "next/headers";
-import { artifactId, ident, query } from "./db";
+import { ident, query } from "./db";
 import { markSample } from "./sample";
 
 // SERVER reads. Import from server components and server actions only —
@@ -38,21 +38,111 @@ export function plain(row) {
   return out;
 }
 
-// { column: value } → "WHERE ..." text; params is filled in place.
-// null → IS NULL, an array → = ANY, anything else → equality.
-function whereClause(filter, params) {
-  const where = [];
-  for (const [col, val] of Object.entries(filter ?? {})) {
-    if (val === null) {
-      where.push(`${ident(col)} IS NULL`);
-    } else if (Array.isArray(val)) {
-      params.push(val);
-      where.push(`${ident(col)} = ANY($${params.length})`);
-    } else {
-      params.push(val);
-      where.push(`${ident(col)} = $${params.length}`);
+// A filter is the platform data door's grammar (claw's STATIC-SPEC §1,
+// "The routes"), so a surface's filter means the same in a server app,
+// read here, and in a browser one, read by the door. Up to 0.6.x it knew
+// equals, lists and null, and any other object went to pg as a value.
+const WHERE_MAX = 20;
+const LIST_MAX = 1000;
+const BOUNDS = [
+  ["gt", ">"],
+  ["gte", ">="],
+  ["lt", "<"],
+  ["lte", "<="],
+];
+const GRAMMAR = "takes a value, [values], null, or one of {not}, {gt|gte|lt|lte}, {has}, {prefix}";
+
+/** A value a condition compares with: text, a finite number, true or
+ *  false, or a Date (JSON sends it as its ISO time). */
+function isValue(v) {
+  if (typeof v === "string" || typeof v === "boolean") return true;
+  if (typeof v === "number") return Number.isFinite(v);
+  return v instanceof Date && !Number.isNaN(v.getTime());
+}
+
+/** A prefix for LIKE: lower-cased, LIKE's own marks escaped (Postgres's
+ *  default escape is a backslash), then "%". */
+function likePrefix(text) {
+  return `${text.toLowerCase().replace(/[\\%_]/g, (m) => `\\${m}`)}%`;
+}
+
+/** One `column: condition` as SQL; `bind` adds a value and names it. */
+function condition(name, cond, bind) {
+  const refuse = (what) => {
+    throw new Error(`filter: ${name} ${what}`);
+  };
+  if (name.includes(".")) refuse("is not a column: name the column alone");
+  const col = ident(name);
+  if (cond === null) return `${col} IS NULL`;
+  if (isValue(cond)) return `${col} = ${bind(cond)}`;
+  if (Array.isArray(cond)) {
+    if (cond.length > LIST_MAX) refuse(`takes at most ${LIST_MAX.toLocaleString("en-US")} values in a list`);
+    if (!cond.every(isValue)) refuse("takes a list of values (text, numbers, true or false): filter empty ones with null");
+    return `${col} = ANY(${bind(cond)})`;
+  }
+  if (typeof cond !== "object" || cond instanceof Date) refuse(GRAMMAR);
+  // A key left undefined is not there, as JSON leaves it out on its way
+  // to the door: { gte: from, lte: to } with no `to` is one bound.
+  const keys = Object.keys(cond).filter((k) => cond[k] !== undefined);
+  if (keys.length === 1 && keys[0] === "not") {
+    if (cond.not === null) return `${col} IS NOT NULL`;
+    if (!isValue(cond.not)) refuse("takes {not: value} or {not: null}");
+    // Distinct, not <>: a row with no value is not the value either.
+    return `${col} IS DISTINCT FROM ${bind(cond.not)}`;
+  }
+  if (keys.length === 1 && keys[0] === "has") {
+    if (!isValue(cond.has)) refuse("takes {has: value}");
+    // An array column holds it. (The door also reads a jsonb column's
+    // `?`; it knows the column's type, which a filter here does not.)
+    return `${bind(cond.has)} = ANY(${col})`;
+  }
+  if (keys.length === 1 && keys[0] === "prefix") {
+    if (typeof cond.prefix !== "string" || !cond.prefix) refuse('wants {prefix: "some text"}');
+    return `lower(${col}) LIKE ${bind(likePrefix(cond.prefix))}`;
+  }
+  const bounds = BOUNDS.map(([k]) => k);
+  if (keys.length && keys.every((k) => bounds.includes(k))) {
+    const lower = keys.filter((k) => k === "gt" || k === "gte");
+    const upper = keys.filter((k) => k === "lt" || k === "lte");
+    if (lower.length > 1 || upper.length > 1) refuse("takes one lower bound (gt or gte) and one upper (lt or lte)");
+    const parts = [];
+    for (const [k, op] of BOUNDS) {
+      if (!keys.includes(k)) continue;
+      if (!isValue(cond[k])) refuse(`takes {${k}: value}: a number, a day or a time`);
+      parts.push(`${col} ${op} ${bind(cond[k])}`);
     }
+    return parts.join(" AND ");
+  }
+  return refuse(GRAMMAR);
+}
+
+/**
+ * `filter` → " WHERE …" text, "" for none; `params` is filled in place and
+ * every value is bound. An AND of `{ column: condition }`, at most 20:
+ *
+ *   value                        equals
+ *   [value, …]                   one of (at most 1,000)
+ *   null                         empty (IS NULL)
+ *   { not: value | null }        anything else (IS DISTINCT FROM), or not empty
+ *   { gt | gte | lt | lte: v }   a bound; one lower and one upper may combine
+ *   { has: value }               an array column holds it
+ *   { prefix: "text" }           starts with, case ignored
+ *
+ * A column whose condition is undefined is left out, as JSON leaves it
+ * out. Anything else throws, and the read returns it as its error.
+ */
+export function whereClause(filter, params) {
+  if (filter === undefined || filter === null) return "";
+  if (typeof filter !== "object" || Array.isArray(filter)) {
+    throw new Error('filter is an object of column names to conditions, like { stage: "won" }');
   }
+  const entries = Object.entries(filter).filter(([, cond]) => cond !== undefined);
+  if (entries.length > WHERE_MAX) throw new Error(`filter holds at most ${WHERE_MAX} conditions`);
+  const bind = (value) => {
+    params.push(value);
+    return `$${params.length}`;
+  };
+  const where = entries.map(([name, cond]) => condition(name, cond, bind));
   return where.length ? ` WHERE ${where.join(" AND ")}` : "";
 }
 
@@ -63,7 +153,8 @@ function failed(what, error) {
 }
 
 /**
- * Rows of a source table. `filter` is { column: value }; `orderBy` is
+ * Rows of a source table. `filter` is whereClause's grammar (above:
+ * { column: condition }, the data door's); `orderBy` is
  * "updated_at desc" (default: idColumn desc); `limit` caps at 5000.
  *   → { rows, error }
  */
@@ -121,37 +212,36 @@ export async function countBy({ source, column, filter }) {
 }
 
 /**
- * What happened, newest first: public.artifact_activity for this artifact
+ * What happened, newest first: this app's lines in claw_app.activity
  * (every lib/actions.js write and everything the agent recorded with the
- * sql verb). `surface` narrows to one surface key; `since` (ISO or Date)
- * to rows after that time. Rows: { id, at, action, surface, row_ref,
- * detail, data, by }. → { rows, error }
+ * sql verb). The view holds only this app's lines, so nothing here names
+ * the app. `surface` narrows to one surface key; `since` (ISO or Date) to
+ * rows after that time. Rows: { id, at, action, surface, row_ref, detail,
+ * data, by }. Outside Makersclaw there is no such view: `error` says so.
+ * → { rows, error }
  */
 export async function loadActivity({ limit = 100, surface, since } = {}) {
-  const id = artifactId();
-  if (!id) {
-    return { rows: [], error: failed("public.artifact_activity", "no CLAW_ARTIFACT_ID; product_run sets it") };
-  }
   try {
-    const params = [id];
-    let where = `WHERE artifact_id = $1`;
+    const params = [];
+    const where = [];
     if (surface) {
       params.push(String(surface));
-      where += ` AND surface = $${params.length}`;
+      where.push(`surface = $${params.length}`);
     }
     if (since) {
       params.push(since instanceof Date ? since.toISOString() : String(since));
-      where += ` AND at > $${params.length}::timestamptz`;
+      where.push(`at > $${params.length}::timestamptz`);
     }
     params.push(Math.max(1, Math.min(1000, Number(limit) || 100)));
+    const filter = where.length ? ` WHERE ${where.join(" AND ")}` : "";
     const { rows } = await query(
       `SELECT id, at, action, surface, row_ref, detail, data, by
-       FROM public.artifact_activity ${where} ORDER BY at DESC, id DESC LIMIT $${params.length}`,
+       FROM claw_app.activity${filter} ORDER BY at DESC, id DESC LIMIT $${params.length}`,
       params,
     );
     return { rows: rows.map(plain), error: null };
   } catch (error) {
-    return { rows: [], error: failed("public.artifact_activity", error) };
+    return { rows: [], error: failed("claw_app.activity", error) };
   }
 }
 

package/templates/next/files/lib/db.js

@@ -1,3 +1,4 @@
+import { headers } from "next/headers";
 import { Pool, types } from "pg";
 
 // A `date` column is a day on a wall calendar, not an instant, so it is
@@ -26,18 +27,84 @@ globalThis._pgPool = pool;
 
 export const query = (text, params) => pool.query(text, params);
 
+/**
+ * Who is asking: the member the platform's proxy named on this request
+ * (`x-claw-user-id`, `x-claw-user-email`; the proxy drops a browser's own
+ * copies first, so they are only ever its word). `''` for each one it did
+ * not name: a local run, a render outside a request, a job.
+ *   → { id, email }
+ */
+export async function requestMember() {
+  try {
+    const asked = await headers();
+    return { id: asked.get("x-claw-user-id") || "", email: asked.get("x-claw-user-email") || "" };
+  } catch {
+    return { id: "", email: "" };
+  }
+}
+
+// The member, told to the database inside the write's own transaction. The
+// third argument, true, makes each setting local: the COMMIT ends it, so the
+// next statement on this pooled connection never runs as this member. Never
+// false (the platform's rule since the Neon probe; test/data.test.mjs greps
+// the template for it). Values are bound, never written into the text.
+const MEMBER_SETTINGS =
+  "SELECT set_config('claw.member_id', $1, true), set_config('claw.member_email', $2, true)";
+
+/**
+ * Run `work(query)` in one transaction on one connection, after telling
+ * the database who is asking. A default, a trigger or an action function
+ * reads it the same way in a server app and a browser one (where the
+ * platform's data door sets the same two):
+ *
+ *   nullif(current_setting('claw.member_email', true), '')
+ *
+ * It is a label, not a permission: nothing in the platform trusts it, and
+ * a column the page must not choose (`created_by`) is set by a trigger
+ * that reads it. Every lib/actions.js write runs here. `work` gets a
+ * `query(text, params)` bound to the transaction's connection; use only
+ * that inside it. → whatever `work` returns. A failure rolls back and
+ * throws on.
+ */
+export async function transaction(work) {
+  const member = await requestMember();
+  const client = await pool.connect();
+  let broken;
+  try {
+    await client.query("BEGIN");
+    await client.query(MEMBER_SETTINGS, [member.id, member.email]);
+    const result = await work((text, params) => client.query(text, params));
+    await client.query("COMMIT");
+    return result;
+  } catch (error) {
+    try {
+      await client.query("ROLLBACK");
+    } catch (lost) {
+      // The connection itself failed: the pool must not lend it again.
+      broken = lost;
+    }
+    throw error;
+  } finally {
+    client.release(broken);
+  }
+}
+
 /** The artifact this app belongs to. product_run sets it from the folder
- *  the app runs in; every activity row keys on it, and so does the
- *  Activity tab the OS draws on the app window. */
+ *  the app runs in; app/layout.jsx reads it to turn examples off, and an
+ *  app may use it to name itself. The activity lines no longer need it:
+ *  claw_app.activity fills in the app itself (logActivity, below). */
 export function artifactId() {
   return process.env.CLAW_ARTIFACT_ID || null;
 }
 
 const IDENT = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 
-/** Quote a table or column name for SQL: "investors" → "investors",
- *  "public.investors" → "public"."investors". Anything else throws, so a
- *  typo in a surface config can never reach the database as SQL. */
+/** Quote a table or column name for SQL: "investors" → "investors".
+ *  An app names its tables bare: its own schema is first on its role's
+ *  search_path. Two parts still pass ("public.investors" →
+ *  "public"."investors"), for an app from before 0.7.0 whose tables are
+ *  in public and whose code says so. Anything else throws, so a typo in a
+ *  surface config can never reach the database as SQL. */
 export function ident(name) {
   const parts = String(name ?? "").split(".");
   if (!parts.length || parts.length > 2 || !parts.every((p) => IDENT.test(p))) {
@@ -46,13 +113,26 @@ export function ident(name) {
   return parts.map((p) => `"${p}"`).join(".");
 }
 
+// Postgres's "relation does not exist": no claw_app.activity to write to.
+const NO_SUCH_RELATION = "42P01";
+
 /**
  * Record what happened, for the Activity tab the OS draws on the app
- * window (and any surface that reads the table with loadActivity). Every
- * lib/actions.js write calls this; the artifact's agent writes the same
- * table with the sql verb.
+ * window (and any surface that reads the lines with loadActivity). Every
+ * lib/actions.js write calls this; the app's agent writes the same lines
+ * with the sql verb.
  * Never throws — an activity line must not fail the write it describes.
  *
+ * The line goes into claw_app.activity: the platform's view of the
+ * workspace's activity table, holding only this app's lines. The view
+ * fills in `artifact_id` (the app whose role the connection runs as) and
+ * `id`, so this names neither: the app needs no CLAW_ARTIFACT_ID, and it
+ * cannot write a line as another app. Up to 0.6.x it inserted into
+ * public.artifact_activity with CLAW_ARTIFACT_ID; an app on its own schema
+ * can reach nothing in public. Outside Makersclaw, or on a platform from
+ * before the view, there is no claw_app.activity: the line is not
+ * recorded, and this returns false, as on any other failure.
+ *
  *   action   found, drafted, sent, replied, skipped, edited, moved, added…
  *   surface  the surface key the row belongs to (the OS tab shows its
  *            label; a link into the app is /s/<surface>?row=<row_ref>)
@@ -62,17 +142,11 @@ export function ident(name) {
  *   by       'agent' | 'user:<email>' | 'run:<id>'
  */
 export async function logActivity({ action, surface, row_ref, detail, data, by }) {
-  const id = artifactId();
-  if (!id) {
-    console.warn(`[activity] not recorded (no CLAW_ARTIFACT_ID): ${action} ${detail ?? ""}`);
-    return false;
-  }
   try {
     await query(
-      `INSERT INTO public.artifact_activity (artifact_id, action, surface, row_ref, detail, data, by)
-       VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7)`,
+      `INSERT INTO claw_app.activity (action, surface, row_ref, detail, data, by)
+       VALUES ($1, $2, $3, $4, $5::jsonb, $6)`,
       [
-        id,
         String(action || "edited"),
         surface ?? null,
         row_ref == null ? null : String(row_ref),
@@ -83,7 +157,13 @@ export async function logActivity({ action, surface, row_ref, detail, data, by }
     );
     return true;
   } catch (error) {
-    console.error(`[activity] not recorded: ${String(error)}`);
+    // No view is where the app runs, not a fault in it: a warning, as the
+    // missing CLAW_ARTIFACT_ID was up to 0.6.x. Anything else is an error.
+    if (error?.code === NO_SUCH_RELATION) {
+      console.warn(`[activity] not recorded (no claw_app.activity here): ${action} ${detail ?? ""}`);
+    } else {
+      console.error(`[activity] not recorded: ${String(error)}`);
+    }
     return false;
   }
 }