codeframe-ai 0.9.0__py3-none-any.whl

codeframe/platform_store/database.py

@@ -0,0 +1,277 @@
+"""Control-plane database management for CodeFRAME.
+
+The global database is a **control-plane store** only: auth (users/accounts/
+sessions/verification), API keys, audit logs, interactive sessions, and token
+usage. All v2 domain data (tasks/blockers/PRD/...) lives in the per-workspace
+``.codeframe/state.db`` via ``codeframe.core.workspace`` — not here.
+
+The class acts as a thin facade, delegating to the surviving control-plane
+repositories. Supports both synchronous (sqlite3) and asynchronous (aiosqlite)
+operations.
+"""
+
+import contextlib
+import os
+import sqlite3
+import threading
+from pathlib import Path
+from typing import Optional
+import logging
+
+import asyncio
+import aiosqlite
+
+from codeframe.platform_store.schema_manager import SchemaManager
+from codeframe.platform_store.repositories import (
+    TokenRepository,
+    AuditRepository,
+    APIKeyRepository,
+    WorkspaceRegistryRepository,
+)
+from codeframe.platform_store.repositories.interactive_sessions import InteractiveSessionRepository
+
+logger = logging.getLogger(__name__)
+
+# Audit verbosity configuration
+AUDIT_VERBOSITY = os.getenv("AUDIT_VERBOSITY", "low").lower()
+if AUDIT_VERBOSITY not in ("low", "high"):
+    logger.warning(f"Invalid AUDIT_VERBOSITY='{AUDIT_VERBOSITY}', defaulting to 'low'")
+    AUDIT_VERBOSITY = "low"
+
+
+class Database:
+    """SQLite manager for the global control-plane store.
+
+    Repositories:
+        - api_keys: API key issuance and lookup
+        - audit_logs: Audit logging
+        - interactive_sessions: Interactive agent session records
+        - token_usage: LLM token usage tracking (also used per-workspace)
+    """
+
+    def __init__(self, db_path: Path | str):
+        """Initialize database manager.
+
+        Args:
+            db_path: Path to SQLite database file or ":memory:"
+        """
+        self.db_path = Path(db_path) if db_path != ":memory:" else db_path
+        self.conn: Optional[sqlite3.Connection] = None
+        self._async_conn: Optional[aiosqlite.Connection] = None
+        self._async_lock = asyncio.Lock()
+        self._sync_lock = threading.RLock()  # Reentrant lock for thread-safe access
+
+        # Control-plane repositories (set after connections are created)
+        self.token_usage: Optional[TokenRepository] = None
+        self.audit_logs: Optional[AuditRepository] = None
+        self.api_keys: Optional[APIKeyRepository] = None
+        self.interactive_sessions: Optional[InteractiveSessionRepository] = None
+        self.workspace_registry: Optional[WorkspaceRegistryRepository] = None
+
+    def initialize(self) -> None:
+        """Initialize database schema and repositories."""
+        # Create parent directories if needed
+        if self.db_path != ":memory:":
+            Path(self.db_path).parent.mkdir(parents=True, exist_ok=True)
+
+        # Create sync connection
+        self.conn = sqlite3.connect(str(self.db_path), check_same_thread=False)
+        self.conn.row_factory = sqlite3.Row
+        self.conn.execute("PRAGMA foreign_keys = ON")
+        # Enable WAL mode for better concurrent access (allows reads during writes)
+        self.conn.execute("PRAGMA journal_mode = WAL")
+        # Set busy timeout to handle concurrent access contention
+        self.conn.execute("PRAGMA busy_timeout = 5000")
+
+        # Create schema using SchemaManager
+        schema_mgr = SchemaManager(self.conn)
+        schema_mgr.create_schema()
+
+        # Initialize all repositories with sync connection
+        self._initialize_repositories()
+
+    def _initialize_repositories(self) -> None:
+        """Initialize all repository instances."""
+        # Pass both sync and async connections to support mixed operations.
+        # Also pass self (Database instance) for cross-repository operations,
+        # and sync_lock for thread-safe access to the shared connection.
+        self.token_usage = TokenRepository(sync_conn=self.conn, async_conn=self._async_conn, database=self, sync_lock=self._sync_lock)
+        self.audit_logs = AuditRepository(sync_conn=self.conn, async_conn=self._async_conn, database=self, sync_lock=self._sync_lock)
+        self.api_keys = APIKeyRepository(sync_conn=self.conn, async_conn=self._async_conn, database=self, sync_lock=self._sync_lock)
+        self.interactive_sessions = InteractiveSessionRepository(sync_conn=self.conn, async_conn=self._async_conn, database=self, sync_lock=self._sync_lock)
+        self.workspace_registry = WorkspaceRegistryRepository(sync_conn=self.conn, async_conn=self._async_conn, database=self, sync_lock=self._sync_lock)
+
+    # Connection management methods
+    def close(self) -> None:
+        """Close database connection (sync only)."""
+        if self.conn:
+            self.conn.close()
+            self.conn = None
+
+    async def close_async(self) -> None:
+        """Close async database connection."""
+        if self._async_conn:
+            await self._async_conn.close()
+            self._async_conn = None
+
+    async def close_all(self) -> None:
+        """Close both sync and async database connections."""
+        self.close()
+        await self.close_async()
+
+    def __del__(self) -> None:
+        """Destructor with warning for unclosed connections."""
+        if self._async_conn is not None:
+            logger.warning(
+                f"Database async connection for {self.db_path} was not explicitly closed. "
+                "Use 'async with db:' or call close_async() to properly close async connections."
+            )
+        if self.conn is not None:
+            self.close()
+
+    async def initialize_async(self) -> None:
+        """Explicitly initialize the async database connection."""
+        async with self._async_lock:
+            if self._async_conn is None:
+                self._async_conn = await aiosqlite.connect(str(self.db_path))
+                self._async_conn.row_factory = aiosqlite.Row
+                # Match sync connection pragmas for consistency
+                await self._async_conn.execute("PRAGMA foreign_keys = ON")
+                await self._async_conn.execute("PRAGMA journal_mode = WAL")
+                await self._async_conn.execute("PRAGMA busy_timeout = 5000")
+                logger.debug(f"Async connection initialized for {self.db_path}")
+                # Update repository async connections
+                if self.token_usage:
+                    self._update_repository_async_connections()
+
+    def _update_repository_async_connections(self) -> None:
+        """Update async connections in all repositories."""
+        for repo in [self.token_usage, self.audit_logs, self.api_keys, self.interactive_sessions, self.workspace_registry]:
+            if repo:
+                repo._async_conn = self._async_conn
+
+    async def _get_async_conn(self) -> aiosqlite.Connection:
+        """Get async connection with health check and automatic reconnection."""
+        async with self._async_lock:
+            if self._async_conn is None:
+                self._async_conn = await aiosqlite.connect(str(self.db_path))
+                self._async_conn.row_factory = aiosqlite.Row
+                # Match sync connection pragmas for consistency
+                await self._async_conn.execute("PRAGMA foreign_keys = ON")
+                await self._async_conn.execute("PRAGMA journal_mode = WAL")
+                await self._async_conn.execute("PRAGMA busy_timeout = 5000")
+                logger.debug(f"Async connection created (lazy init) for {self.db_path}")
+                self._update_repository_async_connections()
+                return self._async_conn
+
+            try:
+                await self._async_conn.execute("SELECT 1")
+                return self._async_conn
+            except Exception as e:
+                logger.warning(f"Async connection health check failed: {e}, reconnecting...")
+                try:
+                    await self._async_conn.close()
+                except Exception:
+                    pass
+
+                self._async_conn = await aiosqlite.connect(str(self.db_path))
+                self._async_conn.row_factory = aiosqlite.Row
+                # Match sync connection pragmas for consistency
+                await self._async_conn.execute("PRAGMA foreign_keys = ON")
+                await self._async_conn.execute("PRAGMA journal_mode = WAL")
+                await self._async_conn.execute("PRAGMA busy_timeout = 5000")
+                logger.info(f"Async connection reconnected for {self.db_path}")
+                self._update_repository_async_connections()
+                return self._async_conn
+
+    # Context managers
+    def __enter__(self) -> "Database":
+        """Context manager entry."""
+        if not self.conn:
+            self.initialize()
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb) -> None:
+        """Context manager exit."""
+        self.close()
+
+    async def __aenter__(self) -> "Database":
+        """Async context manager entry."""
+        if not self.conn:
+            self.initialize()
+        await self.initialize_async()
+        return self
+
+    async def __aexit__(self, exc_type, exc_val, exc_tb) -> None:
+        """Async context manager exit."""
+        await self.close_async()
+
+    @contextlib.contextmanager
+    def transaction(self):
+        """Context manager for explicit transaction control.
+
+        Yields:
+            self: The database instance for chaining operations
+
+        Raises:
+            RuntimeError: If called while already inside a transaction
+        """
+        if not self.conn:
+            self.initialize()
+
+        # Acquire reentrant lock to ensure thread-safe access to connection state
+        with self._sync_lock:
+            # Guard against nested transactions
+            if self.conn.in_transaction:
+                raise RuntimeError(
+                    "Cannot start a nested transaction. "
+                    "Complete the current transaction first."
+                )
+
+            # SQLite uses autocommit by default; disable it for this transaction
+            old_isolation = self.conn.isolation_level
+            self.conn.isolation_level = None  # Manual transaction mode
+            cursor = self.conn.cursor()
+
+            try:
+                cursor.execute("BEGIN")
+                yield self
+                self.conn.commit()
+            except Exception:
+                # Only rollback if a transaction was actually started
+                if self.conn.in_transaction:
+                    self.conn.rollback()
+                raise
+            finally:
+                self.conn.isolation_level = old_isolation
+
+    # ----- Token usage (dual-use facade) -----
+    # Note: ``token_usage`` is the one repository whose backing table is NOT in
+    # ``SchemaManager`` (control-plane). It is also created by the per-workspace
+    # schema in ``core/workspace.py``, and ``react_agent``/``stats_commands``
+    # instantiate ``Database(workspace.db_path)`` to record token usage via
+    # ``MetricsTracker``. Keep the delegations alongside the control-plane ones.
+    def save_token_usage(self, *args, **kwargs):
+        """Delegate to token_usage.save_token_usage()."""
+        return self.token_usage.save_token_usage(*args, **kwargs)
+
+    def get_token_usage(self, *args, **kwargs):
+        """Delegate to token_usage.get_token_usage()."""
+        return self.token_usage.get_token_usage(*args, **kwargs)
+
+    def get_task_token_summary(self, *args, **kwargs):
+        """Delegate to token_usage.get_task_token_summary()."""
+        return self.token_usage.get_task_token_summary(*args, **kwargs)
+
+    def get_batch_token_usage(self, *args, **kwargs):
+        """Delegate to token_usage.get_batch_token_usage()."""
+        return self.token_usage.get_batch_token_usage(*args, **kwargs)
+
+    def get_workspace_token_usage(self, *args, **kwargs):
+        """Delegate to token_usage.get_workspace_token_usage()."""
+        return self.token_usage.get_workspace_token_usage(*args, **kwargs)
+
+    # ----- Audit log -----
+    def create_audit_log(self, *args, **kwargs):
+        """Delegate to audit_logs.create_audit_log()."""
+        return self.audit_logs.create_audit_log(*args, **kwargs)

codeframe/platform_store/repositories/__init__.py

@@ -0,0 +1,24 @@
+"""Control-plane repository exports.
+
+Only the repositories backing the global control-plane store survive: API keys,
+audit logs, and token usage (plus the shared base). The v1 domain repositories
+(projects/issues/tasks/agents/...) were removed with the v2 cleanup — that data
+now lives per-workspace via ``codeframe.core.workspace``. The interactive-session
+repository is imported directly from its module by ``database.py``.
+"""
+
+from codeframe.platform_store.repositories.base import BaseRepository
+from codeframe.platform_store.repositories.token_repository import TokenRepository
+from codeframe.platform_store.repositories.audit_repository import AuditRepository
+from codeframe.platform_store.repositories.api_key_repository import APIKeyRepository
+from codeframe.platform_store.repositories.workspace_registry_repository import (
+    WorkspaceRegistryRepository,
+)
+
+__all__ = [
+    "BaseRepository",
+    "TokenRepository",
+    "AuditRepository",
+    "APIKeyRepository",
+    "WorkspaceRegistryRepository",
+]

codeframe/platform_store/repositories/api_key_repository.py

@@ -0,0 +1,245 @@
+"""Repository for API key database operations.
+
+Handles CRUD operations for API keys used for programmatic server access.
+"""
+
+import json
+import uuid
+from datetime import datetime, timezone
+from typing import Optional, Dict, Any, List
+import logging
+
+from codeframe.platform_store.repositories.base import BaseRepository
+
+logger = logging.getLogger(__name__)
+
+
+class APIKeyRepository(BaseRepository):
+    """Repository for API key operations."""
+
+    def create(
+        self,
+        user_id: int,
+        name: str,
+        key_hash: str,
+        prefix: str,
+        scopes: List[str],
+        expires_at: Optional[datetime] = None,
+    ) -> str:
+        """Create a new API key record.
+
+        Args:
+            user_id: Owner user ID
+            name: Human-readable name for the key
+            key_hash: SHA256 or bcrypt hash of the full key
+            prefix: First 12 chars for efficient lookup
+            scopes: List of permission scopes
+            expires_at: Optional expiration timestamp
+
+        Returns:
+            Generated key ID (UUID)
+        """
+        key_id = str(uuid.uuid4())
+        now = datetime.now(timezone.utc).isoformat()
+
+        # Normalize expires_at to UTC for consistent string comparison
+        expires_at_utc = None
+        if expires_at:
+            if expires_at.tzinfo is None:
+                # Treat naive datetime as UTC
+                expires_at = expires_at.replace(tzinfo=timezone.utc)
+            expires_at_utc = expires_at.astimezone(timezone.utc).isoformat()
+
+        self._execute(
+            """
+            INSERT INTO api_keys (
+                id, user_id, name, key_hash, prefix, scopes,
+                created_at, expires_at, is_active
+            )
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1)
+            """,
+            (
+                key_id,
+                user_id,
+                name,
+                key_hash,
+                prefix,
+                json.dumps(scopes),
+                now,
+                expires_at_utc,
+            ),
+        )
+        self._commit()
+
+        logger.debug(f"Created API key {key_id} for user {user_id}")
+        return key_id
+
+    def get_by_id(self, key_id: str) -> Optional[Dict[str, Any]]:
+        """Get an API key by its ID.
+
+        Args:
+            key_id: The key's UUID
+
+        Returns:
+            Key record dict or None if not found
+        """
+        row = self._fetchone(
+            """
+            SELECT id, user_id, name, key_hash, prefix, scopes,
+                   created_at, last_used_at, expires_at, is_active
+            FROM api_keys
+            WHERE id = ?
+            """,
+            (key_id,),
+        )
+
+        if row is None:
+            return None
+
+        return self._row_to_api_key(row)
+
+    def get_by_prefix(self, prefix: str) -> Optional[Dict[str, Any]]:
+        """Get an active API key by its prefix.
+
+        Only returns active, non-expired keys for authentication.
+
+        Args:
+            prefix: The key prefix (first 12 characters)
+
+        Returns:
+            Key record dict or None if not found/inactive
+        """
+        now = datetime.now(timezone.utc).isoformat()
+
+        row = self._fetchone(
+            """
+            SELECT id, user_id, name, key_hash, prefix, scopes,
+                   created_at, last_used_at, expires_at, is_active
+            FROM api_keys
+            WHERE prefix = ?
+              AND is_active = 1
+              AND (expires_at IS NULL OR expires_at > ?)
+            """,
+            (prefix, now),
+        )
+
+        if row is None:
+            return None
+
+        return self._row_to_api_key(row)
+
+    def list_user_keys(self, user_id: int) -> List[Dict[str, Any]]:
+        """List all API keys for a user (active and inactive).
+
+        Does NOT include key_hash for security.
+
+        Args:
+            user_id: The user's ID
+
+        Returns:
+            List of key records (without key_hash)
+        """
+        rows = self._fetchall(
+            """
+            SELECT id, user_id, name, prefix, scopes,
+                   created_at, last_used_at, expires_at, is_active
+            FROM api_keys
+            WHERE user_id = ?
+            ORDER BY created_at DESC
+            """,
+            (user_id,),
+        )
+
+        return [self._row_to_api_key_safe(row) for row in rows]
+
+    def update_last_used(self, key_id: str) -> None:
+        """Update the last_used_at timestamp.
+
+        Called after successful authentication.
+
+        Args:
+            key_id: The key's UUID
+        """
+        now = datetime.now(timezone.utc).isoformat()
+
+        self._execute(
+            """
+            UPDATE api_keys
+            SET last_used_at = ?
+            WHERE id = ?
+            """,
+            (now, key_id),
+        )
+        self._commit()
+
+    def revoke(self, key_id: str, user_id: int) -> bool:
+        """Revoke an API key (soft delete).
+
+        Args:
+            key_id: The key's UUID
+            user_id: The user attempting to revoke (must be owner)
+
+        Returns:
+            True if revoked, False if not found or not owned
+        """
+        cursor = self._execute(
+            """
+            UPDATE api_keys
+            SET is_active = 0
+            WHERE id = ? AND user_id = ?
+            """,
+            (key_id, user_id),
+        )
+        self._commit()
+
+        return cursor.rowcount > 0
+
+    def delete(self, key_id: str, user_id: int) -> bool:
+        """Hard delete an API key.
+
+        Args:
+            key_id: The key's UUID
+            user_id: The user attempting to delete (must be owner)
+
+        Returns:
+            True if deleted, False if not found or not owned
+        """
+        cursor = self._execute(
+            """
+            DELETE FROM api_keys
+            WHERE id = ? AND user_id = ?
+            """,
+            (key_id, user_id),
+        )
+        self._commit()
+
+        return cursor.rowcount > 0
+
+    def _row_to_api_key(self, row) -> Dict[str, Any]:
+        """Convert database row to API key dict (includes hash)."""
+        return {
+            "id": row["id"],
+            "user_id": row["user_id"],
+            "name": row["name"],
+            "key_hash": row["key_hash"],
+            "prefix": row["prefix"],
+            "scopes": json.loads(row["scopes"]),
+            "created_at": self._ensure_rfc3339(row["created_at"]),
+            "last_used_at": self._ensure_rfc3339(row["last_used_at"]) if row["last_used_at"] else None,
+            "expires_at": self._ensure_rfc3339(row["expires_at"]) if row["expires_at"] else None,
+            "is_active": bool(row["is_active"]),
+        }
+
+    def _row_to_api_key_safe(self, row) -> Dict[str, Any]:
+        """Convert database row to API key dict (excludes hash for listing)."""
+        return {
+            "id": row["id"],
+            "user_id": row["user_id"],
+            "name": row["name"],
+            "prefix": row["prefix"],
+            "scopes": json.loads(row["scopes"]),
+            "created_at": self._ensure_rfc3339(row["created_at"]),
+            "last_used_at": self._ensure_rfc3339(row["last_used_at"]) if row["last_used_at"] else None,
+            "expires_at": self._ensure_rfc3339(row["expires_at"]) if row["expires_at"] else None,
+            "is_active": bool(row["is_active"]),
+        }

codeframe/platform_store/repositories/audit_repository.py

@@ -0,0 +1,67 @@
+"""Repository for Audit Repository operations.
+
+Extracted from monolithic Database class for better maintainability.
+"""
+
+import json
+from datetime import datetime
+from typing import Optional, Dict, Any
+import logging
+
+
+from codeframe.platform_store.repositories.base import BaseRepository
+
+logger = logging.getLogger(__name__)
+
+
+class AuditRepository(BaseRepository):
+    """Repository for audit repository operations."""
+
+
+    def create_audit_log(
+        self,
+        event_type: str,
+        user_id: Optional[int],
+        resource_type: str,
+        resource_id: Optional[int],
+        ip_address: Optional[str],
+        metadata: Optional[Dict[str, Any]],
+        timestamp: datetime,
+    ) -> int:
+        """Create an audit log entry (Issue #132).
+
+        Args:
+            event_type: Type of event (e.g., "auth.login.success")
+            user_id: User ID (if authenticated)
+            resource_type: Type of resource (e.g., "project", "task")
+            resource_id: ID of the resource
+            ip_address: Client IP address
+            metadata: Additional event metadata (stored as JSON)
+            timestamp: Event timestamp
+
+        Returns:
+            ID of the created audit log entry
+        """
+
+        cursor = self.conn.cursor()
+        cursor.execute(
+            """
+            INSERT INTO audit_logs (
+                event_type, user_id, resource_type, resource_id,
+                ip_address, metadata, timestamp
+            )
+            VALUES (?, ?, ?, ?, ?, ?, ?)
+            """,
+            (
+                event_type,
+                user_id,
+                resource_type,
+                resource_id,
+                ip_address,
+                json.dumps(metadata) if metadata else None,
+                timestamp.isoformat(),
+            ),
+        )
+        self.conn.commit()
+        return cursor.lastrowid
+