omegga 1.6.0 → 1.7.0

package/dist/webserver/backend/database.js

@@ -1,176 +1,41 @@
 "use strict";
 Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: "Module" } });
-const softconfig = require("../../softconfig.js");
+const schema = require("../../db/schema.js");
 const pattern = require("../../util/pattern.js");
 const time = require("../../util/time.js");
 const bcrypt = require("bcryptjs");
 const chokidar = require("chokidar");
+const drizzleOrm = require("drizzle-orm");
 const EventEmitter = require("events");
-const Datastore = require("nedb-promises");
+const crypto = require("node:crypto");
 const path = require("path");
 const calendar = require("./calendar.js");
 const events = require("./events.js");
 const permissions = require("./permissions.js");
-let serverInstance;
 const createPunchcard = () => Array.from({ length: 7 }).map(
   () => Array.from({ length: 24 }).fill(0)
 );
 class Database extends EventEmitter {
-  constructor(options, omegga) {
+  constructor(options, omegga, sqlite, db) {
     super();
     this.defaultPermissionsCache = null;
+    this.rolesCache = null;
+    this.serverInstance = null;
     this.options = options;
     this.omegga = omegga;
+    this.sqlite = sqlite;
+    this.db = db;
     this.calendar = new calendar.default();
-    const dbOpts = {
-      autoload: true,
-      // case insensitive string comparison
-      compareStrings: (a, b) => a.localeCompare(b, "en", { ignorePunctuation: true })
-    };
-    this.stores = {
-      users: Datastore.create({
-        filename: path.join(omegga.dataPath, softconfig.default.USER_STORE),
-        ...dbOpts
-      }),
-      chat: Datastore.create({
-        filename: path.join(omegga.dataPath, softconfig.default.CHAT_STORE),
-        ...dbOpts
-      }),
-      players: Datastore.create({
-        filename: path.join(omegga.dataPath, softconfig.default.PLAYER_STORE),
-        ...dbOpts
-      }),
-      status: Datastore.create({
-        filename: path.join(omegga.dataPath, softconfig.default.STATUS_STORE),
-        ...dbOpts
-      }),
-      server: Datastore.create({
-        filename: path.join(omegga.dataPath, softconfig.default.SERVER_STORE),
-        ...dbOpts
-      })
-    };
-  }
-  // make sure all the databases have valid store versions
-  async doMigrations() {
-    const storeVersions = {
-      users: 2,
-      chat: 1,
-      players: 1,
-      status: 1,
-      server: 2,
-      // example version
-      dummy: 10
-    };
-    const migrations = {
-      users: [
-        {
-          version: 1,
-          upgrade: async (store) => {
-            const users = await store.find({
-              type: "user"
-            });
-            for (const user of users) {
-              const p = user.permissions ?? permissions.EMPTY_PERMISSIONS;
-              const root = p.root === "all" || p.root === "read" ? p.root : "off";
-              const domains = {};
-              for (const [k, v] of Object.entries(p.domains ?? {})) {
-                if (v !== "unset" && v !== "none") domains[k] = v;
-              }
-              const scopes = {};
-              for (const [k, v] of Object.entries(p.scopes ?? {})) {
-                if (v === "enabled" || v === true) scopes[k] = true;
-                else if (v === "disabled" || v === false) scopes[k] = false;
-              }
-              const encoded = permissions.encodePermissions({ root, domains, scopes });
-              await store.update(
-                { _id: user._id },
-                { $set: { permissions: encoded } }
-              );
-            }
-          }
-        }
-      ],
-      chat: [],
-      players: [],
-      status: [],
-      server: [
-        {
-          version: 1,
-          upgrade: async (store) => {
-            const doc = await store.findOne({
-              type: "defaultPermissions"
-            });
-            if (!doc) return;
-            const root = doc.root === "unset" ? "off" : doc.root;
-            const domains = {};
-            for (const [k, v] of Object.entries(doc.domains ?? {})) {
-              if (v !== "unset") domains[k] = v;
-            }
-            const scopes = {};
-            for (const [k, v] of Object.entries(doc.scopes ?? {})) {
-              if (v === "enabled") scopes[k] = true;
-              else if (v === "disabled") scopes[k] = false;
-            }
-            const encoded = permissions.encodePermissions({
-              root,
-              domains,
-              scopes
-            });
-            await store.update(
-              { _id: doc._id },
-              {
-                $set: {
-                  root: encoded.root,
-                  domains: encoded.domains,
-                  scopes: encoded.scopes
-                }
-              }
-            );
-          }
-        }
-      ],
-      // example migration list (all version upgrades go up by 1)
-      dummy: [
-        {
-          version: 1,
-          // target version
-          upgrade: async (_store) => {
-          }
-          // upgrade function (does not include updating version)
-        }
-      ]
-    };
-    await Promise.all(
-      Object.entries(this.stores).map(async ([name, store]) => {
-        const versionEntry = await store.findOne({
-          type: "storeVersion"
-        });
-        const expected = storeVersions[name];
-        if (!versionEntry) {
-          store.insert({ type: "storeVersion", version: expected });
-        } else if (versionEntry.version < expected) {
-          let { version } = versionEntry;
-          for (; version < expected; version++) {
-            const migration = migrations[name].find((v) => v.version === version);
-            if (!migration) break;
-            migration.upgrade(store);
-          }
-          await store.update({ _id: versionEntry._id }, { version });
-        }
-      })
-    );
   }
   // get the running instance id of this omegga
   async getInstanceId() {
-    if (serverInstance) return serverInstance._id;
-    const doc = await this.stores.server.insert({
-      type: "app:start",
-      date: Date.now()
-    });
-    serverInstance = doc;
-    const dates = (await this.stores.chat.find({ type: "chat" })).map((c) => c.created);
+    if (this.serverInstance) return this.serverInstance.id;
+    const id = crypto.randomUUID();
+    this.db.insert(schema.serverInstances).values({ id, date: Date.now() }).run();
+    this.serverInstance = { id, date: Date.now() };
+    const dates = this.db.select({ created: schema.chatLogs.created }).from(schema.chatLogs).all();
     for (const d of dates) {
-      this.calendar.addDate(d);
+      this.calendar.addDate(d.created);
     }
     const watcher = chokidar.watch(
       path.join(this.omegga.configPath, "BanList.json"),
@@ -190,18 +55,12 @@ class Database extends EventEmitter {
         const now = Date.now();
         if (now > eventExpire) return;
         if (leavingPlayer.id === kicked.id) {
-          const entry = {
-            type: "kickHistory",
+          this.upsertKickHistory({
             kicked: kicked.id,
             kickerId: kicker.id,
             created: now,
             reason
-          };
-          await this.stores.players.update(
-            entry,
-            { $set: entry },
-            { upsert: true }
-          );
+          });
         }
       });
     };
@@ -211,27 +70,29 @@ class Database extends EventEmitter {
       if (!kickedPlayer || !kickerPlayer) return;
       handleKick(kickedPlayer, kickerPlayer, reason);
     });
-    return doc._id;
+    return id;
   }
   // synchronize the ban list with the one in the database
   syncBanList() {
     const banList = this.omegga.getBanList()?.banList;
     if (!banList) return;
-    for (const banned in banList) {
-      const entry = {
-        type: "banHistory",
-        banned,
-        bannerId: banList[banned].bannerId,
-        created: time.parseBrickadiaTime(banList[banned].created),
-        expires: time.parseBrickadiaTime(banList[banned].expires),
-        reason: banList[banned].reason
-      };
-      this.stores.players.update(entry, { $set: entry }, { upsert: true });
-    }
+    const tx = this.sqlite.transaction(() => {
+      for (const banned in banList) {
+        this.upsertBanHistory({
+          banned,
+          bannerId: banList[banned].bannerId ?? "",
+          created: time.parseBrickadiaTime(banList[banned].created) ?? 0,
+          expires: time.parseBrickadiaTime(banList[banned].expires) ?? 0,
+          reason: banList[banned].reason
+        });
+      }
+    });
+    tx();
   }
   // determine if this user would be the first user (admin user)
   async isFirstUser() {
-    return await this.stores.users.count({ type: "user" }) === 0;
+    const result = this.db.select({ count: drizzleOrm.count() }).from(schema.users).get();
+    return (result?.count ?? 0) === 0;
   }
   // hash a password
   async hash(password) {
@@ -239,481 +100,590 @@ class Database extends EventEmitter {
   }
   // create an admin user account, username can be blank (no password)
   async createAdminUser(username, password) {
-    const hash = await this.hash(password);
-    const user = this.stores.users.insert({
-      // this is a user
-      type: "user",
+    const h = await this.hash(password);
+    const id = crypto.randomUUID();
+    this.db.insert(schema.users).values({
+      id,
       created: Date.now(),
       lastOnline: Date.now(),
-      // credentials
       username,
-      hash,
-      // permissions
+      hash: h,
       isOwner: true,
       roles: [],
       permissions: permissions.EMPTY_PERMISSIONS,
-      // mfa
       totpEnabled: false,
       passkeys: [],
       recoveryCodes: [],
-      // brickadia player uuid
       playerId: ""
-    });
-    return user;
+    }).run();
+    return this.findUserById(id);
   }
   // determine if a user with this name exists
   async userExists(username) {
-    return await this.stores.users.count({ type: "user", username }) > 0;
+    const result = this.db.select({ count: drizzleOrm.count() }).from(schema.users).where(drizzleOrm.eq(schema.users.username, username)).get();
+    return (result?.count ?? 0) > 0;
   }
-  // create a regular  user account
+  // create a regular user account
   async createUser(username, password) {
     if (await this.userExists(username)) throw new Error("user already exists");
-    const hash = await this.hash(password);
-    const user = this.stores.users.insert({
-      // this is a user
-      type: "user",
+    const h = await this.hash(password);
+    const id = crypto.randomUUID();
+    this.db.insert(schema.users).values({
+      id,
       created: Date.now(),
       lastOnline: 0,
-      // credentials
       username,
-      hash,
-      // permissions
+      hash: h,
       isOwner: false,
       roles: [],
       permissions: permissions.EMPTY_PERMISSIONS,
-      // mfa
       totpEnabled: false,
       passkeys: [],
       recoveryCodes: [],
-      // brickadia player uuid
       playerId: ""
-    });
-    return user;
+    }).run();
+    return this.findUserById(id);
   }
   // set a user's password
   async userPasswd(username, password) {
-    const hash = await this.hash(password);
+    const h = await this.hash(password);
     if (!await this.userExists(username))
       throw new Error("user does not exist");
-    await this.stores.users.update(
-      { type: "user", username },
-      { $set: { hash } }
-    );
+    this.db.update(schema.users).set({ hash: h }).where(drizzleOrm.eq(schema.users.username, username)).run();
   }
   async banUser(username, banned) {
-    const result = await this.stores.users.update(
-      { type: "user", username },
-      { $set: { isBanned: banned } }
-    );
+    this.db.update(schema.users).set({ isBanned: banned }).where(drizzleOrm.eq(schema.users.username, username)).run();
     if (banned) events.serverEvents.emit("userInvalidated", username);
-    return result;
+    return 1;
   }
   async deleteUser(username) {
-    const result = await this.stores.users.remove(
-      { type: "user", username },
-      {}
-    );
+    this.db.delete(schema.users).where(drizzleOrm.eq(schema.users.username, username)).run();
     events.serverEvents.emit("userInvalidated", username);
-    return result;
+    return 1;
   }
-  async setUserPermissions(username, permissions$1) {
-    return await this.stores.users.update(
-      { type: "user", username },
-      { $set: { permissions: permissions.encodePermissions(permissions$1) } }
-    );
+  async setUserPermissions(username, permissions2) {
+    this.db.update(schema.users).set({ permissions: permissions2 }).where(drizzleOrm.eq(schema.users.username, username)).run();
   }
   async getDefaultPermissions() {
     if (this.defaultPermissionsCache) return this.defaultPermissionsCache;
-    let doc = await this.stores.server.findOne({
-      type: "defaultPermissions"
-    });
-    if (!doc) {
-      doc = await this.stores.server.insert({
+    const row = this.db.select().from(schema.serverConfig).where(drizzleOrm.eq(schema.serverConfig.key, "defaultPermissions")).get();
+    if (!row) {
+      const defaults = {
         type: "defaultPermissions",
         root: permissions.RootLevel.Read,
         domains: {},
         scopes: {}
-      });
+      };
+      this.db.insert(schema.serverConfig).values({ key: "defaultPermissions", value: defaults }).run();
+      this.defaultPermissionsCache = defaults;
+      return defaults;
     }
-    const decoded = permissions.decodePermissions(doc);
-    const result = { ...doc, ...decoded };
+    const val = row.value;
+    const result = {
+      type: "defaultPermissions",
+      root: val.root ?? permissions.RootLevel.Off,
+      domains: val.domains ?? {},
+      scopes: val.scopes ?? {}
+    };
     this.defaultPermissionsCache = result;
     return result;
   }
-  async setDefaultPermissions(permissions$1) {
-    const encoded = permissions.encodePermissions(permissions$1);
-    await this.stores.server.update(
-      { type: "defaultPermissions" },
-      {
-        $set: {
-          root: encoded.root,
-          domains: encoded.domains,
-          scopes: encoded.scopes
-        }
-      },
-      { upsert: true }
-    );
+  async setDefaultPermissions(permissions2) {
+    const value = {
+      root: permissions2.root,
+      domains: permissions2.domains,
+      scopes: permissions2.scopes
+    };
+    this.db.insert(schema.serverConfig).values({ key: "defaultPermissions", value }).onConflictDoUpdate({
+      target: schema.serverConfig.key,
+      set: { value }
+    }).run();
     this.defaultPermissionsCache = null;
   }
   // get a user from credentials
   async authUser(username, password) {
-    const user = await this.stores.users.findOne({ username });
-    if (!user || user.isBanned) return null;
-    if (await bcrypt.compare(password, user.hash)) {
-      await this.stores.users.update(
-        { _id: user._id },
-        { $set: { lastOnline: Date.now() } }
-      );
-      return user;
+    const row = this.db.select().from(schema.users).where(drizzleOrm.eq(schema.users.username, username)).get();
+    if (!row || row.isBanned) return null;
+    if (await bcrypt.compare(password, row.hash)) {
+      this.db.update(schema.users).set({ lastOnline: Date.now() }).where(drizzleOrm.eq(schema.users.id, row.id)).run();
+      return this._toStoreUser(row);
     }
     return null;
   }
   // find a user by object id
   async findUserById(id) {
-    const user = await this.stores.users.findOne({
-      $or: [
+    const row = this.db.select().from(schema.users).where(
+      drizzleOrm.or(
         // the owner has no username, so everyone is the owner
-        { type: "user", username: "", isOwner: true },
+        drizzleOrm.and(drizzleOrm.eq(schema.users.username, ""), drizzleOrm.eq(schema.users.isOwner, true)),
         // the user exists and has an id
-        { type: "user", _id: id }
-      ]
-    });
-    if (user) {
-      user.permissions = permissions.decodePermissions(user.permissions);
-      if (!user.totpEnabled) user.totpEnabled = false;
-      if (!user.passkeys) user.passkeys = [];
+        drizzleOrm.eq(schema.users.id, id)
+      )
+    ).get();
+    if (!row) return null;
+    return this._toStoreUser(row);
+  }
+  async findUserByUsername(username) {
+    const row = this.db.select().from(schema.users).where(drizzleOrm.eq(schema.users.username, username)).get();
+    if (!row) return null;
+    return this._toStoreUser(row);
+  }
+  async findUserByPasskeyId(credentialId) {
+    const rows = this.db.select().from(schema.users).where(
+      drizzleOrm.sql`${schema.users.passkeys} LIKE ${'%"id":"' + credentialId + '"%'}`
+    ).all();
+    for (const row of rows) {
+      const passkeys = row.passkeys ?? [];
+      if (passkeys.some((p) => p.id === credentialId)) {
+        return this._toStoreUser(row);
+      }
     }
-    return user;
+    return null;
+  }
+  updateUserLastOnline(id) {
+    this.db.update(schema.users).set({ lastOnline: Date.now() }).where(drizzleOrm.eq(schema.users.id, id)).run();
+  }
+  updateOwnerCredentials(id, username, hash) {
+    this.db.update(schema.users).set({ username, hash }).where(drizzleOrm.eq(schema.users.id, id)).run();
+  }
+  addUserRole(userId, roleId) {
+    const row = this.db.select({ roles: schema.users.roles }).from(schema.users).where(drizzleOrm.eq(schema.users.id, userId)).get();
+    if (!row) return;
+    const roles = row.roles ?? [];
+    if (!roles.includes(roleId)) {
+      roles.push(roleId);
+      this.db.update(schema.users).set({ roles }).where(drizzleOrm.eq(schema.users.id, userId)).run();
+    }
+  }
+  removeUserRole(userId, roleId) {
+    const row = this.db.select({ roles: schema.users.roles }).from(schema.users).where(drizzleOrm.eq(schema.users.id, userId)).get();
+    if (!row) return;
+    const roles = (row.roles ?? []).filter((r) => r !== roleId);
+    this.db.update(schema.users).set({ roles }).where(drizzleOrm.eq(schema.users.id, userId)).run();
   }
   async setUserTotp(username, secret, enabled) {
-    await this.stores.users.update(
-      { type: "user", username },
-      { $set: { totpSecret: secret, totpEnabled: enabled } }
-    );
+    this.db.update(schema.users).set({ totpSecret: secret, totpEnabled: enabled }).where(drizzleOrm.eq(schema.users.username, username)).run();
   }
   async disableUserTotp(username) {
-    await this.stores.users.update(
-      { type: "user", username },
-      { $set: { totpEnabled: false }, $unset: { totpSecret: true } }
-    );
+    this.db.update(schema.users).set({ totpEnabled: false, totpSecret: null }).where(drizzleOrm.eq(schema.users.username, username)).run();
   }
   async addPasskey(username, credential) {
-    await this.stores.users.update(
-      { type: "user", username },
-      { $push: { passkeys: credential } }
-    );
+    const row = this.db.select({ id: schema.users.id, passkeys: schema.users.passkeys }).from(schema.users).where(drizzleOrm.eq(schema.users.username, username)).get();
+    if (!row) return;
+    const passkeys = [
+      ...row.passkeys ?? [],
+      credential
+    ];
+    this.db.update(schema.users).set({ passkeys }).where(drizzleOrm.eq(schema.users.id, row.id)).run();
   }
   async removePasskey(username, credentialId) {
-    const user = await this.stores.users.findOne({
-      type: "user",
-      username
-    });
-    if (!user) return;
-    const passkeys = (user.passkeys ?? []).filter((p) => p.id !== credentialId);
-    await this.stores.users.update({ _id: user._id }, { $set: { passkeys } });
+    const row = this.db.select({ id: schema.users.id, passkeys: schema.users.passkeys }).from(schema.users).where(drizzleOrm.eq(schema.users.username, username)).get();
+    if (!row) return;
+    const passkeys = (row.passkeys ?? []).filter(
+      (p) => p.id !== credentialId
+    );
+    this.db.update(schema.users).set({ passkeys }).where(drizzleOrm.eq(schema.users.id, row.id)).run();
   }
   async updatePasskeyCounter(username, credentialId, counter) {
-    const user = await this.stores.users.findOne({
-      type: "user",
-      username
-    });
-    if (!user) return;
-    const passkeys = (user.passkeys ?? []).map(
+    const row = this.db.select({ id: schema.users.id, passkeys: schema.users.passkeys }).from(schema.users).where(drizzleOrm.eq(schema.users.username, username)).get();
+    if (!row) return;
+    const passkeys = (row.passkeys ?? []).map(
       (p) => p.id === credentialId ? { ...p, counter, lastUsed: Date.now() } : p
     );
-    await this.stores.users.update({ _id: user._id }, { $set: { passkeys } });
+    this.db.update(schema.users).set({ passkeys }).where(drizzleOrm.eq(schema.users.id, row.id)).run();
   }
   async setRecoveryCodes(username, hashedCodes) {
-    await this.stores.users.update(
-      { type: "user", username },
-      { $set: { recoveryCodes: hashedCodes } }
-    );
+    this.db.update(schema.users).set({ recoveryCodes: hashedCodes }).where(drizzleOrm.eq(schema.users.username, username)).run();
   }
   async removeRecoveryCode(username, hashedCode) {
-    const user = await this.stores.users.findOne({
-      type: "user",
-      username
-    });
-    if (!user) return;
-    const codes = (user.recoveryCodes ?? []).filter((c) => c !== hashedCode);
-    await this.stores.users.update(
-      { _id: user._id },
-      { $set: { recoveryCodes: codes } }
+    const row = this.db.select({
+      id: schema.users.id,
+      recoveryCodes: schema.users.recoveryCodes
+    }).from(schema.users).where(drizzleOrm.eq(schema.users.username, username)).get();
+    if (!row) return;
+    const codes = (row.recoveryCodes ?? []).filter(
+      (c) => c !== hashedCode
     );
+    this.db.update(schema.users).set({ recoveryCodes: codes }).where(drizzleOrm.eq(schema.users.id, row.id)).run();
   }
   async resetUserMfa(username) {
-    await this.stores.users.update(
-      { type: "user", username },
-      {
-        $set: {
-          totpEnabled: false,
-          passkeys: [],
-          recoveryCodes: []
-        },
-        $unset: { totpSecret: true }
-      }
-    );
+    this.db.update(schema.users).set({
+      totpEnabled: false,
+      totpSecret: null,
+      passkeys: [],
+      recoveryCodes: []
+    }).where(drizzleOrm.eq(schema.users.username, username)).run();
+  }
+  async getAllRoles() {
+    if (this.rolesCache) return this.rolesCache;
+    const rows = this.db.select().from(schema.webRoles).orderBy(drizzleOrm.desc(schema.webRoles.order)).all();
+    const roles = rows.map((r) => ({
+      type: "webRole",
+      id: r.id,
+      name: r.name,
+      description: r.description,
+      order: r.order,
+      permissions: r.permissions
+    }));
+    this.rolesCache = roles;
+    return roles;
+  }
+  invalidateRolesCache() {
+    this.rolesCache = null;
+    this.defaultPermissionsCache = null;
   }
-  async findUserByPasskeyId(credentialId) {
-    return await this.stores.users.findOne({
-      type: "user",
-      "passkeys.id": credentialId
+  async getRole(id) {
+    const row = this.db.select().from(schema.webRoles).where(drizzleOrm.eq(schema.webRoles.id, id)).get();
+    if (!row) return null;
+    return {
+      type: "webRole",
+      id: row.id,
+      name: row.name,
+      description: row.description,
+      order: row.order,
+      permissions: row.permissions
+    };
+  }
+  async createRole(name, description, permissions2) {
+    const id = crypto.randomUUID();
+    const tx = this.sqlite.transaction(() => {
+      this.db.update(schema.webRoles).set({ order: drizzleOrm.sql`${schema.webRoles.order} + 1` }).run();
+      this.db.insert(schema.webRoles).values({
+        id,
+        name,
+        description,
+        order: 1,
+        permissions: permissions2
+      }).run();
+    });
+    tx();
+    this.invalidateRolesCache();
+    return {
+      type: "webRole",
+      id,
+      name,
+      description,
+      order: 1,
+      permissions: permissions2
+    };
+  }
+  async updateRole(id, updates) {
+    const $set = {};
+    if (updates.name !== void 0) $set.name = updates.name;
+    if (updates.description !== void 0)
+      $set.description = updates.description;
+    if (updates.order !== void 0) $set.order = updates.order;
+    if (updates.permissions !== void 0)
+      $set.permissions = updates.permissions;
+    if (Object.keys($set).length > 0) {
+      this.db.update(schema.webRoles).set($set).where(drizzleOrm.eq(schema.webRoles.id, id)).run();
+    }
+    this.invalidateRolesCache();
+  }
+  async deleteRole(id) {
+    const role = await this.getRole(id);
+    if (!role) return "role not found";
+    const tx = this.sqlite.transaction(() => {
+      this.db.delete(schema.webRoles).where(drizzleOrm.eq(schema.webRoles.id, id)).run();
+      const usersWithRole = this.db.select({ id: schema.users.id, roles: schema.users.roles }).from(schema.users).all();
+      for (const u of usersWithRole) {
+        const roles = (u.roles ?? []).filter((r) => r !== id);
+        if (roles.length !== (u.roles ?? []).length) {
+          this.db.update(schema.users).set({ roles }).where(drizzleOrm.eq(schema.users.id, u.id)).run();
+        }
+      }
+    });
+    tx();
+    this.invalidateRolesCache();
+    return "";
+  }
+  async reorderRoles(entries) {
+    const tx = this.sqlite.transaction(() => {
+      for (const { id, order } of entries) {
+        this.db.update(schema.webRoles).set({ order }).where(drizzleOrm.eq(schema.webRoles.id, id)).run();
+      }
     });
+    tx();
+    this.invalidateRolesCache();
+  }
+  async getUserRolePermissions(user) {
+    const defaults = await this.getDefaultPermissions();
+    const defaultPerms = {
+      root: defaults.root,
+      domains: defaults.domains,
+      scopes: defaults.scopes
+    };
+    const allRoles = await this.getAllRoles();
+    const userRoles = allRoles.filter((r) => user.roles.includes(r.id));
+    return [defaultPerms, ...userRoles.map((r) => r.permissions)];
   }
-  // get a list of roles
-  // TODO: actually implement roles
-  getRoles() {
-    return this.stores.server.find({ type: "role" });
+  async getUserAssignedRoles(user) {
+    const allRoles = await this.getAllRoles();
+    return allRoles.filter((r) => user.roles.includes(r.id));
   }
   // add a chat message to the chat log store
   async addChatLog(action, user, message) {
     this.calendar.addDate(Date.now());
-    return await this.stores.chat.insert({
-      type: "chat",
+    const row = this.db.insert(schema.chatLogs).values({
       created: Date.now(),
       instanceId: await this.getInstanceId(),
       action,
       user,
       ...message ? { message } : {}
-    });
+    }).returning().get();
+    return {
+      type: "chat",
+      _id: String(row.id),
+      id: row.id,
+      created: row.created,
+      instanceId: row.instanceId,
+      action: row.action,
+      user: row.user,
+      message: row.message
+    };
   }
   // get recent chat activity
   async getChats({
-    count = 50,
+    count: limit = 50,
     sameServer,
     before,
     after
   } = {}) {
-    return await this.stores.chat.find({
+    const conditions = [];
+    if (sameServer) {
+      conditions.push(
+        drizzleOrm.eq(schema.chatLogs.instanceId, await this.getInstanceId())
+      );
+    }
+    if (before) {
+      conditions.push(drizzleOrm.lt(schema.chatLogs.created, before));
+    } else if (after) {
+      conditions.push(drizzleOrm.gt(schema.chatLogs.created, after));
+    } else {
+      conditions.push(drizzleOrm.lt(schema.chatLogs.created, Date.now()));
+    }
+    const orderDir = !before && after ? drizzleOrm.asc : drizzleOrm.desc;
+    const rows = this.db.select().from(schema.chatLogs).where(conditions.length > 1 ? drizzleOrm.and(...conditions) : conditions[0]).orderBy(orderDir(schema.chatLogs.created)).limit(limit).all();
+    return rows.map((r) => ({
       type: "chat",
-      ...sameServer ? { instanceId: await this.getInstanceId() } : {},
-      created: before ? { $lt: before } : after ? { $gt: after } : { $lt: Date.now() }
-    }).sort({ created: !before && after ? 1 : -1 }).limit(count).exec();
+      _id: String(r.id),
+      created: r.created,
+      instanceId: r.instanceId,
+      action: r.action,
+      user: r.user,
+      message: r.message
+    }));
   }
   // get paginated players
   async getPlayers({
-    count = 50,
+    count: limit = 50,
     search = "",
     page = 0,
     sort = "name",
     direction = 1,
     limitId = void 0
   } = {}) {
-    const pattern$1 = pattern.explode(search);
-    const query = {
-      type: "userHistory",
-      // only filter if there's a query
-      $and: [
-        // if a limitId is passed in, the id must be in it
-        ...limitId ? [{ id: { $in: limitId } }] : [],
-        // if there's a search, the search matches...
-        ...search.length > 0 ? [
-          {
-            $or: [
-              // id was pasted in
-              { id: search },
-              // user's current name
-              { name: { $regex: pattern$1 } },
-              { displayName: { $regex: pattern$1 } },
-              // user's past name
-              {
-                nameHistory: { $elemMatch: { name: { $regex: pattern$1 } } }
-              },
-              {
-                nameHistory: {
-                  $elemMatch: { displayName: { $regex: pattern$1 } }
-                }
-              }
-            ]
-          }
-        ] : []
-      ]
-    };
-    const exactQuery = {
-      type: "userHistory",
-      // only filter if there's a query
-      $or: [
-        // id was pasted in
-        { id: search },
-        // user's current name
-        { name: search },
-        // user's current display name
-        { displayName: search }
-      ]
-    };
-    const [total, players, exactResult] = await Promise.all([
-      this.stores.players.count(query),
-      this.stores.players.find(query).sort({ [sort]: direction }).skip(count * page).limit(count).exec(),
-      // exact match detection
-      search.length > 0 && page === 0 ? this.stores.players.find(exactQuery) : []
-    ]);
-    if (exactResult.length > 0) {
-      for (const res of exactResult) {
-        const index = players.findIndex((p) => p._id === res._id);
-        players.splice(index, 1);
+    const pattern$1 = search.length > 0 ? pattern.explode(search) : null;
+    const patternSource = pattern$1?.source;
+    if (limitId && limitId.length === 0)
+      return { pages: 0, total: 0, players: [] };
+    const conditions = [];
+    if (limitId) {
+      conditions.push(drizzleOrm.inArray(schema.playerHistory.id, limitId));
+    }
+    if (patternSource) {
+      conditions.push(drizzleOrm.sql`(
+        ${schema.playerHistory.id} = ${search}
+        OR ${schema.playerHistory.name} REGEXP ${patternSource}
+        OR ${schema.playerHistory.displayName} REGEXP ${patternSource}
+        OR EXISTS (
+          SELECT 1 FROM json_each(${schema.playerHistory.nameHistory})
+          WHERE json_each.type = 'object'
+            AND (json_extract(json_each.value, '$.name') REGEXP ${patternSource}
+              OR json_extract(json_each.value, '$.displayName') REGEXP ${patternSource})
+        )
+      )`);
+    }
+    const baseWhere = conditions.length > 0 ? drizzleOrm.and(...conditions) : void 0;
+    const sortCol = sort === "lastSeen" ? schema.playerHistory.lastSeen : sort === "created" ? schema.playerHistory.created : sort === "heartbeats" ? schema.playerHistory.heartbeats : sort === "sessions" ? schema.playerHistory.sessions : drizzleOrm.sql`${schema.playerHistory.name} COLLATE NOCASE`;
+    const orderDir = direction === 1 ? drizzleOrm.asc : drizzleOrm.desc;
+    const totalResult = this.db.select({ count: drizzleOrm.count() }).from(schema.playerHistory).where(baseWhere).get();
+    const players = this.db.select().from(schema.playerHistory).where(baseWhere).orderBy(orderDir(sortCol)).limit(limit).offset(limit * page).all();
+    const total = totalResult?.count ?? 0;
+    const result = players.map((p) => this._toUserHistory(p));
+    if (search.length > 0 && page === 0) {
+      const exactRows = this.db.select().from(schema.playerHistory).where(
+        drizzleOrm.or(
+          drizzleOrm.eq(schema.playerHistory.id, search),
+          drizzleOrm.eq(schema.playerHistory.name, search),
+          drizzleOrm.eq(schema.playerHistory.displayName, search)
+        )
+      ).all();
+      if (exactRows.length > 0) {
+        for (const res of exactRows) {
+          const idx = result.findIndex((p) => p.id === res.id);
+          if (idx >= 0) result.splice(idx, 1);
+        }
+        result.splice(0, 0, ...exactRows.map((r) => this._toUserHistory(r)));
       }
-      players.splice(0, 0, ...exactResult);
     }
-    return {
-      pages: Math.ceil(total / count),
-      total,
-      players
-    };
+    return { pages: Math.ceil(total / limit), total, players: result };
   }
   // get paginated users
   async getUsers({
-    count = 50,
+    count: limit = 50,
     search = "",
     page = 0,
     sort = "name",
     direction = 1
   } = {}) {
-    const pattern$1 = pattern.explode(search);
-    const query = {
-      type: "user",
-      // only filter if there's a query
-      ...search.length > 0 ? {
-        $or: [
-          // id was pasted in
-          { playerId: search },
-          // user's current name
-          { name: { $regex: pattern$1 } }
-        ]
-      } : {}
-    };
-    const [total, users] = await Promise.all([
-      this.stores.users.count(query),
-      this.stores.users.find(query).sort({ [sort]: direction }).skip(count * page).limit(count).exec()
-    ]);
+    const pattern$1 = search.length > 0 ? pattern.explode(search) : null;
+    let baseWhere = drizzleOrm.sql`1=1`;
+    if (pattern$1) {
+      baseWhere = drizzleOrm.sql`(
+        ${schema.users.playerId} = ${search}
+        OR ${schema.users.username} REGEXP ${pattern$1.source}
+      )`;
+    }
+    const sortCol = sort === "lastOnline" ? schema.users.lastOnline : sort === "created" ? schema.users.created : drizzleOrm.sql`${schema.users.username} COLLATE NOCASE`;
+    const orderDir = direction === 1 ? drizzleOrm.asc : drizzleOrm.desc;
+    const totalResult = this.db.select({ count: drizzleOrm.count() }).from(schema.users).where(baseWhere).get();
+    const users = this.db.select().from(schema.users).where(baseWhere).orderBy(orderDir(sortCol)).limit(limit).offset(limit * page).all();
     return {
-      pages: Math.ceil(total / count),
-      total,
-      users
+      pages: Math.ceil((totalResult?.count ?? 0) / limit),
+      total: totalResult?.count ?? 0,
+      users: users.map((u) => this._toStoreUser(u))
     };
   }
   // get an individual player, ban and kick history, and notes
   async getPlayer(id) {
-    const [player, banHistory, kickHistory, notes] = await Promise.all([
-      this.stores.players.findOne({ type: "userHistory", id }),
-      this.stores.players.find({ type: "banHistory", banned: id }).sort({ created: -1 }).limit(25).exec(),
-      this.stores.players.find({ type: "kickHistory", kicked: id }).sort({ created: -1 }).limit(25).exec(),
-      this.stores.players.find({ type: "note", id }).sort({ created: -1 }).limit(25).exec()
-    ]);
+    const player = this.db.select().from(schema.playerHistory).where(drizzleOrm.eq(schema.playerHistory.id, id)).get();
     if (!player) return null;
-    return { ...player, banHistory, kickHistory, notes };
+    const banHist = this.db.select().from(schema.banHistory).where(drizzleOrm.eq(schema.banHistory.banned, id)).orderBy(drizzleOrm.desc(schema.banHistory.created)).limit(25).all();
+    const kickHist = this.db.select().from(schema.kickHistory).where(drizzleOrm.eq(schema.kickHistory.kicked, id)).orderBy(drizzleOrm.desc(schema.kickHistory.created)).limit(25).all();
+    const noteRows = this.db.select().from(schema.playerNotes).where(drizzleOrm.eq(schema.playerNotes.playerId, id)).limit(25).all();
+    return {
+      ...this._toUserHistory(player),
+      banHistory: banHist.map((b) => ({
+        type: "banHistory",
+        _id: String(b.id),
+        banned: b.banned,
+        bannerId: b.bannerId,
+        created: b.created,
+        expires: b.expires,
+        reason: b.reason
+      })),
+      kickHistory: kickHist.map((k) => ({
+        type: "kickHistory",
+        _id: String(k.id),
+        kicked: k.kicked,
+        kickerId: k.kickerId,
+        created: k.created,
+        reason: k.reason
+      })),
+      notes: noteRows.map((n) => ({
+        type: "note",
+        _id: String(n.id),
+        id: n.playerId,
+        note: n.note
+      }))
+    };
   }
   // add a user to the visit history, returns true if this is a first visit
   async addVisit(user) {
-    const existing = await this.stores.players.findOne({
-      type: "userHistory",
-      id: user.id
-    });
     const now = Date.now();
     const instanceId = await this.getInstanceId();
-    if (!existing) {
-      await this.stores.players.insert({
-        type: "userHistory",
-        // base brickadia user info
-        id: user.id,
+    const visit = this.sqlite.transaction(() => {
+      const existing = this.db.select().from(schema.playerHistory).where(drizzleOrm.eq(schema.playerHistory.id, user.id)).get();
+      if (!existing) {
+        this.db.insert(schema.playerHistory).values({
+          id: user.id,
+          name: user.name,
+          displayName: user.displayName,
+          nameHistory: [
+            { name: user.name, displayName: user.displayName, date: now }
+          ],
+          ips: [],
+          created: now,
+          lastSeen: now,
+          lastInstanceId: instanceId,
+          heartbeats: 0,
+          sessions: 1,
+          instances: 1
+        }).run();
+        return true;
+      }
+      const nameHistory = existing.nameHistory ?? [];
+      const hasName = nameHistory.some(
+        (h) => h.name === user.name && h.displayName === user.displayName
+      );
+      if (!hasName) {
+        nameHistory.push({
+          name: user.name,
+          displayName: user.displayName,
+          date: now
+        });
+      }
+      this.db.update(schema.playerHistory).set({
+        lastSeen: now,
         name: user.name,
         displayName: user.displayName,
-        // list of names and when they were first used
-        nameHistory: [
-          { name: user.name, displayName: user.displayName, date: now }
-        ],
-        // list of ips this player has been on
-        ips: [],
-        // first time player was seen
-        created: now,
-        // last time player was seen
-        lastSeen: now,
-        // last server this player has been on
         lastInstanceId: instanceId,
-        // number of status checks this player has observed
-        heartbeats: 0,
-        // number of sessions (at least an hour apart) this player has had
-        sessions: 1,
-        // number of instances (times omegga was started) this player has joined
-        instances: 1
-      });
-      return true;
-    } else {
-      await this.stores.players.update(
-        { _id: existing._id },
-        {
-          $inc: {
-            // increment number of sessions if the player hasn't been seen for an hour
-            sessions: existing.lastSeen < now - 60 * 60 * 1e3 ? 1 : 0,
-            // increment the number of instances this player has joined
-            instances: existing.lastInstanceId === instanceId ? 1 : 0
-          },
-          $set: {
-            // update last seen time and user name
-            lastSeen: now,
-            name: user.name,
-            displayName: user.displayName,
-            // set the last joined instance
-            lastInstanceId: instanceId
-          },
-          // add the name to the history if it was not already in it
-          ...existing.nameHistory.some(
-            (h) => h.name === user.name && h.displayName === user.displayName
-          ) ? {} : {
-            $addToSet: {
-              nameHistory: {
-                name: user.name,
-                displayName: user.displayName,
-                date: now
-              }
-            }
-          }
-        }
-      );
+        nameHistory,
+        sessions: drizzleOrm.sql`${schema.playerHistory.sessions} + ${existing.lastSeen < now - 60 * 60 * 1e3 ? 1 : 0}`,
+        instances: drizzleOrm.sql`${schema.playerHistory.instances} + ${existing.lastInstanceId !== instanceId ? 1 : 0}`
+      }).where(drizzleOrm.eq(schema.playerHistory.id, existing.id)).run();
       return false;
-    }
+    });
+    return visit();
   }
   // use data from minutely heartbeats to fuel metrics
   async addHeartbeat(data) {
     const now = Date.now();
-    await this.stores.status.insert({
-      type: "heartbeat",
-      created: now,
-      bricks: data.bricks,
-      players: data.players
-    });
-    await this.stores.players.update(
-      {
-        // all players in the status update
-        id: { $in: data.players }
-      },
-      {
-        // update last seen
-        $set: { lastSeen: now },
-        // increment heartbeats
-        $inc: { heartbeats: 1 }
-      },
-      { multi: true }
-    );
-    const players = await this.stores.players.find({
-      id: { $in: data.players }
-    });
-    await Promise.all(
-      players.filter((p) => !(p.ips || []).includes(data.ips[p.id])).map(
-        (p) => this.stores.players.update(
-          { _id: p._id },
-          {
-            $addToSet: { ips: data.ips[p.id] }
+    const tx = this.sqlite.transaction(() => {
+      this.db.insert(schema.heartbeats).values({
+        created: now,
+        bricks: data.bricks,
+        players: data.players
+      }).run();
+      if (data.players.length > 0) {
+        this.db.update(schema.playerHistory).set({
+          lastSeen: now,
+          heartbeats: drizzleOrm.sql`${schema.playerHistory.heartbeats} + 1`
+        }).where(drizzleOrm.inArray(schema.playerHistory.id, data.players)).run();
+        const players = this.db.select().from(schema.playerHistory).where(drizzleOrm.inArray(schema.playerHistory.id, data.players)).all();
+        for (const p of players) {
+          const ip = data.ips[p.id];
+          if (ip && !(p.ips ?? []).includes(ip)) {
+            const ips = [...p.ips ?? [], ip];
+            this.db.update(schema.playerHistory).set({ ips }).where(drizzleOrm.eq(schema.playerHistory.id, p.id)).run();
           }
-        )
-      )
-    );
+        }
+      }
+    });
+    tx();
+  }
+  upsertBanHistory(entry) {
+    this.db.insert(schema.banHistory).values({
+      banned: entry.banned,
+      bannerId: entry.bannerId ?? "",
+      created: typeof entry.created === "number" ? entry.created : 0,
+      expires: typeof entry.expires === "number" ? entry.expires : 0,
+      reason: entry.reason ?? ""
+    }).onConflictDoNothing().run();
+  }
+  upsertKickHistory(entry) {
+    this.db.insert(schema.kickHistory).values({
+      kicked: entry.kicked,
+      kickerId: entry.kickerId ?? "",
+      created: entry.created ?? 0,
+      reason: entry.reason ?? ""
+    }).onConflictDoNothing().run();
   }
   async getAutoRestartConfig() {
-    let config = await this.stores.server.findOne({
-      type: "autoRestartConfig"
-    });
-    if (!config) {
-      config = await this.stores.server.insert({
+    const row = this.db.select().from(schema.serverConfig).where(drizzleOrm.eq(schema.serverConfig.key, "autoRestartConfig")).get();
+    if (!row) {
+      const config2 = {
         type: "autoRestartConfig",
         maxUptime: 48,
         maxUptimeEnabled: false,
@@ -727,8 +697,12 @@ class Database extends EventEmitter {
         playersEnabled: true,
         saveWorld: true,
         crashRestartEnabled: true
-      });
+      };
+      this.db.insert(schema.serverConfig).values({ key: "autoRestartConfig", value: config2 }).run();
+      return config2;
     }
+    const config = row.value;
+    config.type = "autoRestartConfig";
     config.autoUpdateEnabled ??= true;
     config.autoUpdateIntervalMins ??= 60;
     config.saveWorld ??= true;
@@ -745,15 +719,10 @@ class Database extends EventEmitter {
       Math.max(10, Math.min(config.autoUpdateIntervalMins ?? 60, Infinity))
     );
     config.autoUpdateEnabled ??= true;
-    await this.stores.server.update(
-      { type: "autoRestartConfig" },
-      {
-        $set: {
-          ...config
-        }
-      },
-      { upsert: false }
-    );
+    this.db.insert(schema.serverConfig).values({ key: "autoRestartConfig", value: config }).onConflictDoUpdate({
+      target: schema.serverConfig.key,
+      set: { value: config }
+    }).run();
   }
   // update player online-time punchcard
   async updatePlayerPunchcard(numNewPlayers) {
@@ -763,37 +732,68 @@ class Database extends EventEmitter {
     const day = now.getUTCDay();
     const month = now.getUTCMonth();
     const year = now.getUTCFullYear();
-    const card = await this.stores.status.findOne({
-      type: "punchcard",
-      kind: "playerCount",
-      month,
-      year
-    });
+    const card = this.db.select().from(schema.punchcards).where(
+      drizzleOrm.and(
+        drizzleOrm.eq(schema.punchcards.kind, "playerCount"),
+        drizzleOrm.eq(schema.punchcards.month, month),
+        drizzleOrm.eq(schema.punchcards.year, year)
+      )
+    ).get();
     if (!card) {
       const punchcard = createPunchcard();
       punchcard[day][hour] = numNewPlayers;
-      await this.stores.status.insert({
-        type: "punchcard",
+      this.db.insert(schema.punchcards).values({
         kind: "playerCount",
         created: time2,
         updated: time2,
         month,
         year,
         punchcard
-      });
+      }).run();
     } else {
-      card.punchcard[day][hour] += numNewPlayers;
-      await this.stores.status.update(
-        { _id: card._id },
-        {
-          $set: {
-            punchcard: card.punchcard,
-            updated: time2
-          }
-        }
-      );
+      const punchcard = card.punchcard;
+      punchcard[day][hour] += numNewPlayers;
+      this.db.update(schema.punchcards).set({ punchcard, updated: time2 }).where(drizzleOrm.eq(schema.punchcards.id, card.id)).run();
     }
   }
+  _toStoreUser(row) {
+    const user = {
+      type: "user",
+      id: row.id,
+      _id: row.id,
+      created: row.created,
+      lastOnline: row.lastOnline,
+      username: row.username,
+      hash: row.hash,
+      isOwner: row.isOwner,
+      roles: row.roles ?? [],
+      playerId: row.playerId,
+      isBanned: row.isBanned,
+      permissions: row.permissions ?? permissions.EMPTY_PERMISSIONS,
+      totpSecret: row.totpSecret ?? void 0,
+      totpEnabled: row.totpEnabled,
+      passkeys: row.passkeys ?? [],
+      recoveryCodes: row.recoveryCodes ?? []
+    };
+    return user;
+  }
+  _toUserHistory(row) {
+    return {
+      type: "userHistory",
+      _id: row.id,
+      id: row.id,
+      name: row.name,
+      displayName: row.displayName,
+      nameHistory: row.nameHistory ?? [],
+      ips: row.ips ?? [],
+      created: row.created,
+      lastSeen: row.lastSeen,
+      lastInstanceId: row.lastInstanceId,
+      heartbeats: row.heartbeats,
+      sessions: row.sessions,
+      instances: row.instances
+    };
+  }
 }
 exports.default = Database;
 //# sourceMappingURL=database.js.map