threadforge 0.1.1 → 0.2.1

package/src/plugins/ScopedPostgres.js

@@ -1,192 +0,0 @@
-/**
- * Scoped PostgreSQL Plugin
- *
- * Wraps the standard postgres() plugin to provide per-project
- * schema isolation. Each project gets its own Postgres schema
- * (project_{projectId}), and every connection checkout runs
- * SET search_path to route queries to the correct schema.
- *
- * If ctx._projectId is null (shared services like auth),
- * returns the raw pool unscoped.
- */
-
-import { postgres } from "./index.js";
-
-const SCHEMA_RE = /^[a-z_][a-z0-9_]{0,62}$/;
-
-/** C-PLUGIN-3: Validate schema name at every usage point */
-function validateSchemaName(schemaName) {
-  if (!SCHEMA_RE.test(schemaName)) {
-    throw new Error(`Invalid schema name: "${schemaName}". Must match /^[a-z_][a-z0-9_]{0,62}$/`);
-  }
-  if (Buffer.byteLength(schemaName, 'utf8') > 63) {
-    throw new Error(`Invalid schema name: "${schemaName}". Exceeds 63 byte limit`);
-  }
-}
-
-/** C-PLUGIN-3: Quote identifier with proper double-quote escaping */
-function quoteIdent(schemaName) {
-  return `"${schemaName.replace(/"/g, '""')}"`;
-}
-
-/**
- * Create a ScopedPool that wraps a pg.Pool and sets the search_path
- * on every connection checkout.
- */
-class ScopedPool {
-  constructor(pool, schemaName) {
-    validateSchemaName(schemaName);
-    this._pool = pool;
-    this._schemaName = schemaName;
-    this._schemaCreated = false;
-
-    // Set search_path once when a new connection is created in the pool
-    const quoted = quoteIdent(this._schemaName);
-    this._pool.on('connect', (client) => {
-      client.query(`SET search_path TO ${quoted}, public`).catch((err) => {
-        console.error(`[ScopedPostgres] Failed to set search_path for ${this._schemaName}:`, err.message);
-      });
-    });
-  }
-
-  /**
-   * Ensure the project schema exists (idempotent).
-   */
-  async _ensureSchema() {
-    if (this._schemaCreated) return;
-    // C-PLUGIN-3: Re-validate at every usage point
-    validateSchemaName(this._schemaName);
-    const client = await this._pool.connect();
-    try {
-      // Advisory lock prevents race when multiple workers create the same schema
-      const hash = Buffer.from(this._schemaName).reduce((h, b) => ((h << 5) - h + b) | 0, 5381);
-      const lockId = Math.abs(hash) * 65536 + this._schemaName.length;
-      await client.query("SELECT pg_advisory_lock($1)", [lockId]);
-      try {
-        const quoted = quoteIdent(this._schemaName);
-        await client.query(`CREATE SCHEMA IF NOT EXISTS ${quoted}`);
-        this._schemaCreated = true;
-      } finally {
-        await client.query("SELECT pg_advisory_unlock($1)", [lockId]);
-      }
-    } finally {
-      client.release();
-    }
-  }
-
-  /**
-   * Get a scoped connection from the pool.
-   * Sets search_path before returning the client.
-   */
-  async connect() {
-    // C-PLUGIN-3: Re-validate at every usage point
-    validateSchemaName(this._schemaName);
-    const client = await this._pool.connect();
-    try {
-      const quoted = quoteIdent(this._schemaName);
-      await client.query(`SET search_path TO ${quoted}, public`);
-    } catch (err) {
-      client.release(err);
-      throw err;
-    }
-    const originalRelease = client.release.bind(client);
-    client.release = (err) => {
-      if (!err) {
-        client.query("SET search_path TO public").then(
-          () => originalRelease(),
-          (queryErr) => {
-            // Log the failure but release cleanly to avoid destroying the pooled client
-            console.warn(`[ScopedPostgres] Failed to reset search_path on release: ${queryErr.message}`);
-            originalRelease();
-          }
-        );
-      } else {
-        originalRelease(err);
-      }
-    };
-    return client;
-  }
-
-  /**
-   * Run a query with the scoped search_path.
-   * search_path is set automatically on connection creation via pool 'connect' event.
-   */
-  async query(text, params) {
-    return this._pool.query(text, params);
-  }
-
-  get totalCount() { return this._pool.totalCount; }
-  get idleCount() { return this._pool.idleCount; }
-  get waitingCount() { return this._pool.waitingCount; }
-
-  async end() { return this._pool.end(); }
-}
-
-/**
- * Create a scoped Postgres plugin.
- *
- * @param {Object} [options] - Same options as postgres() plugin
- * @returns {Object} Plugin descriptor
- */
-export function scopedPostgres(options = {}) {
-  const basePlugin = postgres(options);
-
-  return {
-    name: "postgres",
-    version: "1.0.0",
-    inject: "pg",
-
-    validate: basePlugin.validate,
-    env: basePlugin.env,
-
-    async connect(ctx) {
-      // Get the raw pool from the base plugin
-      const pool = await basePlugin.connect(ctx);
-
-      // If no project ID, return unscoped pool (shared services)
-      const projectId = ctx._projectId;
-      if (!projectId) return pool;
-
-      const rawSchema = ctx._projectSchema ?? (projectId ? `project_${projectId}` : null);
-      if (!rawSchema) return pool;
-      if (!/^[a-z_][a-z0-9_]{0,62}$/.test(rawSchema)) {
-        throw new Error(`Invalid schema name: "${rawSchema}"`);
-      }
-      const schemaName = rawSchema;
-      const scoped = new ScopedPool(pool, schemaName);
-
-      // Create schema on first connect
-      await scoped._ensureSchema();
-
-      ctx.logger.info("PostgreSQL scoped", { schema: schemaName, project: projectId });
-      return scoped;
-    },
-
-    async healthCheck(pool) {
-      // ScopedPool or raw pool — both support query()
-      if (pool.query) {
-        try {
-          await pool.query("SELECT 1");
-          return { status: "ok", total: pool.totalCount, idle: pool.idleCount };
-        } catch (e) {
-          return { status: "error", error: e.message };
-        }
-      }
-      return basePlugin.healthCheck(pool);
-    },
-
-    async disconnect(pool) {
-      await pool.end();
-    },
-
-    metrics(pool) {
-      return {
-        pool_total: pool.totalCount ?? 0,
-        pool_idle: pool.idleCount ?? 0,
-        pool_waiting: pool.waitingCount ?? 0,
-      };
-    },
-
-    nginx: basePlugin.nginx,
-  };
-}

package/src/plugins/ScopedRedis.js

@@ -1,142 +0,0 @@
-/**
- * Scoped Redis Plugin
- *
- * Wraps the standard redis() plugin to provide per-project
- * key isolation. Each project's keys are prefixed with {projectId}:
- * so project A can't see project B's data.
- *
- * If ioredis is available, uses its built-in keyPrefix option.
- * Otherwise, wraps the built-in RESP client with a PrefixedRedisClient.
- *
- * If ctx._projectId is null (shared services like auth),
- * returns the unprefixed client.
- */
-
-import { redis } from "./index.js";
-
-/**
- * Wraps the built-in RESP client to prefix all key operations.
- */
-class PrefixedRedisClient {
-  constructor(client, prefix) {
-    this._client = client;
-    this._prefix = prefix;
-  }
-
-  _pk(key) {
-    return `${this._prefix}${key}`;
-  }
-
-  get status() {
-    return this._client.status;
-  }
-
-  get(k) { return this._client.get(this._pk(k)); }
-  set(...a) { a[0] = this._pk(a[0]); return this._client.set(...a); }
-  del(...keys) { return this._client.del(...keys.map((k) => this._pk(k))); }
-  incr(k) { return this._client.incr(this._pk(k)); }
-  decr(k) { return this._client.decr(this._pk(k)); }
-  expire(k, s) { return this._client.expire(this._pk(k), s); }
-  ttl(k) { return this._client.ttl(this._pk(k)); }
-
-  hget(k, f) { return this._client.hget(this._pk(k), f); }
-  hset(k, f, v) { return this._client.hset(this._pk(k), f, v); }
-  hgetall(k) { return this._client.hgetall(this._pk(k)); }
-
-  lpush(k, ...v) { return this._client.lpush(this._pk(k), ...v); }
-  rpush(k, ...v) { return this._client.rpush(this._pk(k), ...v); }
-  lrange(k, s, e) { return this._client.lrange(this._pk(k), s, e); }
-
-  sadd(k, ...m) { return this._client.sadd(this._pk(k), ...m); }
-  smembers(k) { return this._client.smembers(this._pk(k)); }
-
-  keys(p) { return this._client.keys(this._pk(p)); }
-  publish(ch, m) { return this._client.publish(this._pk(ch), m); }
-
-  ping() { return this._client.ping(); }
-  quit() { return this._client.quit(); }
-  disconnect() { return this._client.disconnect?.(); }
-}
-
-/**
- * Build the Redis URL from options, falling back to localhost defaults.
- */
-function buildRedisUrl(options) {
-  return options.url ?? `redis://${options.host ?? "127.0.0.1"}:${options.port ?? 6379}/${options.db ?? 0}`;
-}
-
-/**
- * Create a scoped Redis plugin.
- *
- * @param {Object} [options] - Same options as redis() plugin
- * @returns {Object} Plugin descriptor
- */
-export function scopedRedis(options = {}) {
-  return {
-    name: "redis",
-    version: "1.0.0",
-    inject: "redis",
-
-    validate() {
-      const url = buildRedisUrl(options);
-      try {
-        new URL(url);
-      } catch {
-        throw new Error(`Invalid Redis URL: ${url}`);
-      }
-    },
-
-    env() {
-      return { FORGE_REDIS_URL: buildRedisUrl(options) };
-    },
-
-    async connect(ctx) {
-      const projectId = ctx._projectId;
-      const prefix = projectId ? `${projectId}:` : "";
-      const url = buildRedisUrl(options);
-
-      // Try ioredis first — it has built-in keyPrefix support
-      try {
-        const R = (await import("ioredis")).default;
-        const c = new R(url, {
-          keyPrefix: prefix,
-          maxRetriesPerRequest: 3,
-          lazyConnect: true,
-        });
-        await c.connect();
-        if (prefix) {
-          ctx.logger.info("Redis scoped (ioredis)", { prefix, project: projectId });
-        }
-        return c;
-      } catch {
-        // Fall through to built-in RESP client
-      }
-
-      // Built-in RESP client — need manual prefix wrapping
-      const { _mkRedis } = await import("./index.js");
-      const client = await _mkRedis(url, ctx);
-
-      if (!prefix) return client;
-
-      ctx.logger.info("Redis scoped (built-in)", { prefix, project: projectId });
-      return new PrefixedRedisClient(client, prefix);
-    },
-
-    async healthCheck(c) {
-      const inner = c._client ?? c;
-      try {
-        return { status: (await inner.ping()) === "PONG" ? "ok" : "degraded" };
-      } catch (e) {
-        return { status: "error", error: e.message };
-      }
-    },
-
-    async disconnect(c) {
-      await (c._client ?? c).quit?.();
-    },
-
-    metrics(c) {
-      return { connected: (c._client ?? c).status === "ready" ? 1 : 0 };
-    },
-  };
-}