zevairouter 1.1.33 → 1.1.34

package/cli/app/src/lib/db/adapters/sqljsAdapter.js

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import fs from "node:fs";
 import initSqlJs from "sql.js";
 import { PRAGMA_SQL } from "../schema.js";
@@ -10,26 +11,92 @@ async function loadSql() {
   return SQL;
 }
 
-export async function createSqlJsAdapter(filePath, options = {}) {
-  const lockPath = `${filePath}.sqljs.lock`;
-  let lockFd;
+// Lock paths held by this process. Shared through globalThis so separately
+// bundled copies of this module still see one another's locks.
+const HELD_LOCKS_KEY = Symbol.for("zevairouter.sqljs.heldLocks");
+const heldLocks = (globalThis[HELD_LOCKS_KEY] ||= new Set());
+
+function ownedError(ownerPid) {
+  return new Error(`sql.js database is already owned by process ${ownerPid}`);
+}
+
+// The lock is linked into place from a fully written temp file, so it never
+// exists empty or partially written.
+function tryCreateLock(lockPath) {
+  const tempPath = `${lockPath}.${process.pid}.${randomUUID()}.tmp`;
+  fs.writeFileSync(tempPath, String(process.pid), { mode: 0o600 });
+  try {
+    fs.linkSync(tempPath, lockPath);
+    return true;
+  } catch (error) {
+    if (error.code === "EEXIST") return false;
+    throw error;
+  } finally {
+    fs.rmSync(tempPath, { force: true });
+  }
+}
+
+function readLockOwner(lockPath) {
+  try {
+    return fs.readFileSync(lockPath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+// A lock is stale when it names no valid PID (empty or torn file from an older
+// build), names this PID without this process holding it (restart reused the
+// PID, e.g. PID 1 in Docker), or names a process that no longer exists. EPERM
+// means a live process of another user has that PID, so it stays owned.
+function isStaleLock(content, lockPath) {
+  const ownerPid = /^\d+$/.test(content.trim()) ? Number(content.trim()) : 0;
+  if (!Number.isSafeInteger(ownerPid) || ownerPid <= 0) return true;
+  if (ownerPid === process.pid) {
+    if (heldLocks.has(lockPath)) throw ownedError(ownerPid);
+    return true;
+  }
   try {
-    lockFd = fs.openSync(lockPath, "wx");
+    process.kill(ownerPid, 0);
   } catch (error) {
-    if (error.code !== "EEXIST") throw error;
-    const ownerPid = Number.parseInt(fs.readFileSync(lockPath, "utf8"), 10);
+    if (error.code === "ESRCH") return true;
+    if (error.code !== "EPERM") throw error;
+  }
+  throw ownedError(ownerPid);
+}
+
+function acquireLock(lockPath) {
+  for (let attempt = 0; attempt < 5; attempt += 1) {
+    if (tryCreateLock(lockPath)) return;
+    const content = readLockOwner(lockPath);
+    if (content === null || !isStaleLock(content, lockPath)) continue;
+    // Move the stale lock aside instead of deleting it so a concurrent
+    // reclaimer can never remove a lock another process just created.
+    const stalePath = `${lockPath}.${process.pid}.${randomUUID()}.stale`;
     try {
-      if (Number.isInteger(ownerPid) && ownerPid > 0) process.kill(ownerPid, 0);
-      throw new Error(`sql.js database is already owned by process ${ownerPid || "unknown"}`);
-    } catch (ownerError) {
-      if (ownerError.code !== "ESRCH") throw ownerError;
-      fs.rmSync(lockPath, { force: true });
-      lockFd = fs.openSync(lockPath, "wx");
+      fs.renameSync(lockPath, stalePath);
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      throw error;
     }
+    const moved = fs.readFileSync(stalePath, "utf8");
+    if (moved !== content) {
+      // Another process replaced the stale lock first: put its lock back.
+      try { fs.linkSync(stalePath, lockPath); } catch {}
+      fs.rmSync(stalePath, { force: true });
+      throw ownedError(moved.trim() || "unknown");
+    }
+    fs.rmSync(stalePath, { force: true });
   }
-  fs.writeFileSync(lockFd, String(process.pid));
-  fs.closeSync(lockFd);
+  throw new Error(`Could not acquire sql.js database lock ${lockPath}`);
+}
+
+export async function createSqlJsAdapter(filePath, options = {}) {
+  const lockPath = `${filePath}.sqljs.lock`;
+  acquireLock(lockPath);
+  heldLocks.add(lockPath);
   const releaseLock = () => {
+    heldLocks.delete(lockPath);
     try {
       if (fs.readFileSync(lockPath, "utf8") === String(process.pid)) fs.rmSync(lockPath, { force: true });
     } catch {}
@@ -77,7 +144,7 @@ export async function createSqlJsAdapter(filePath, options = {}) {
     dirty = true;
     try {
       options.beforePersist?.({ filePath, tempPath });
-      fs.writeFileSync(tempPath, Buffer.from(data));
+      fs.writeFileSync(tempPath, Buffer.from(data), { mode: 0o600 });
       fs.renameSync(tempPath, filePath);
       dirty = false;
     } catch (error) {

package/cli/app/src/lib/db/migrate.js

@@ -38,10 +38,14 @@ function importWithAssertion(adapter, tableName, rows, insertFn, rowMeta) {
   }
 }
 
+// Returns null only when the file is absent. A file that exists but does not
+// parse is reported, because treating it as "missing" would import nothing
+// and then mark the one-time migration as done.
 function readJsonSafe(file) {
   if (!fs.existsSync(file)) return null;
-  try { return JSON.parse(fs.readFileSync(file, "utf-8")); } catch { return null; }
+  try { return JSON.parse(fs.readFileSync(file, "utf-8")); } catch { return CORRUPT_JSON; }
 }
+const CORRUPT_JSON = Symbol("corrupt-json");
 
 function isFreshDb(adapter) {
   // Table _meta may not exist yet on truly fresh DB
@@ -254,9 +258,27 @@ export async function runMigrationOnce(adapter) {
   const legacyUsage = readJsonSafe(LEGACY_FILES.usage);
   const legacyDisabled = readJsonSafe(LEGACY_FILES.disabled);
   const legacyDetails = readJsonSafe(LEGACY_FILES.details);
-  const hasLegacy = !!(legacyMain || legacyUsage || legacyDisabled || legacyDetails);
+  const legacy = [legacyMain, legacyUsage, legacyDisabled, legacyDetails];
+  const hasLegacy = legacy.some(Boolean);
+
+  // `fresh` is false on every boot after the first, because the versioned
+  // migrations above stamp schemaVersion. A skipped or aborted import records
+  // this flag so the retry promised to the user actually happens.
+  const importPending = getMetaSync(adapter, "legacyImportPending", null) === "1";
+  const importEligible = (fresh || importPending) && !alreadyImported;
+
+  if (importEligible && legacy.includes(CORRUPT_JSON)) {
+    const unreadable = Object.entries(LEGACY_FILES)
+      .filter(([, file]) => readJsonSafe(file) === CORRUPT_JSON)
+      .map(([, file]) => file);
+    // Leave the marker unwritten so a repaired file is imported on the next
+    // start instead of being skipped forever.
+    setMetaSync(adapter, "legacyImportPending", "1");
+    console.error(`[DB][migrate] legacy JSON import skipped: cannot parse ${unreadable.join(", ")} | fix or remove the file and restart`);
+    return;
+  }
 
-  if (fresh && hasLegacy && !alreadyImported) {
+  if (importEligible && hasLegacy) {
     const t0 = Date.now();
     const backupDir = makeBackupDir("migrate-from-json");
     for (const f of Object.values(LEGACY_FILES)) backupFile(f, backupDir);
@@ -269,9 +291,11 @@ export async function runMigrationOnce(adapter) {
         importLegacyDetails(adapter, legacyDetails);
         setMetaSync(adapter, "appVersion", getAppVersion());
         setMetaSync(adapter, "migratedAt", new Date().toISOString());
+        setMetaSync(adapter, "legacyImportPending", "0");
       });
     } catch (err) {
       if (err instanceof MigrationAborted) {
+        setMetaSync(adapter, "legacyImportPending", "1");
         console.error(`[DB][migrate] aborted: ${err.message} | legacy JSON kept | backup: ${backupDir}`);
         return;
       }