add: TOML stores for group, nameserver, permission, session (#47)

Author: msimerson

.github/copilot-instructions.md

@@ -0,0 +1,42 @@
+# NicTool API Copilot Instructions
+
+## Commands
+
+- Install dependencies: `npm install`
+- Start the API in production mode: `npm run start`
+- Start the API in watch mode: `npm run develop`
+- Run the full test suite: `npm test`
+- Run one test file with fixture setup/teardown: `npm test -- routes/session.test.js`
+- Run one library test file with fixture setup/teardown: `npm test -- lib/config.test.js`
+- Run tests in watch mode: `npm run watch`
+- Run lint: `npm run lint`
+- Run formatting check: `npm run prettier`
+- Run coverage: `npm run test:coverage`
+
+Local tests expect MySQL plus the NicTool schema. CI initializes it with `sh sql/init-mysql.sh`, and `test.sh` recreates fixtures before each run.
+
+## Architecture
+
+- `server.js` only starts the Hapi server from `routes/index.js`.
+- `routes/index.js` is the composition root: it loads TOML config via `lib/config.js`, registers Hapi plugins, configures JWT auth as the default auth strategy, enables Swagger docs, and mounts each resource route module.
+- `routes/*.js` own HTTP concerns only. They validate requests and responses with `@nictool/validate`, coerce route/query params, call the corresponding `lib/` module, and return NicTool’s standard JSON envelope with resource data plus `meta.api.version`.
+- `lib/<resource>/index.js` is usually a backend selector. The active implementation comes from `NICTOOL_DATA_STORE` and defaults to MySQL; some resources also support TOML, MongoDB, or Elasticsearch backends.
+- The real persistence logic lives under `lib/<resource>/store/*.js`. These stores translate between API-friendly field names and the legacy NicTool schema (`nt_*` columns), using helpers like `mapToDbColumn`, `objectToDb`, and `dbToObject`.
+- `lib/mysql.js` is the shared query builder/executor. Repositories rely on it for SQL generation rather than embedding ad hoc parameter handling in route files.
+- Auth is session-backed but bearer-token based: `POST /session` authenticates through the session repo, creates an `nt_user_session` row via `lib/session/index.js`, and returns a JWT. Almost every other route runs under the default JWT auth strategy.
+- Group, user, and permission behavior is coupled. Group creation also creates a group-level permission row, user reads attach effective permissions, and permission resolution falls back from explicit user permissions to group permissions.
+- DNS data has an extra translation layer. `lib/zone_record/store/mysql.js` validates records with `@nictool/dns-resource-record` and maps NicTool’s legacy zone-record columns to RFC-style record fields.
+- Config comes from `conf.d/*.toml`, with runtime overrides from `NICTOOL_DB_*` and `NICTOOL_HTTP_*`. `lib/config.js` also auto-loads TLS material from any `.pem` file in `conf.d/`.
+
+## Conventions
+
+- Preserve the route/lib split: request parsing, auth, and response shaping stay in `routes/`; DB and domain logic stay in `lib/`.
+- Keep request and response schemas in sync with `@nictool/validate`. Route handlers consistently declare both `validate` and `response.schema`.
+- Return the existing response envelope shape instead of raw rows. Resource payloads use keys like `user`, `group`, `zone`, `zone_record`, or `nameserver`, and responses include `meta: { api, msg }`.
+- Default auth is global. New public routes must opt out explicitly with route-level auth config, like `auth: { mode: 'try' }` on `POST /session`.
+- Soft delete is the default behavior across repositories. `delete()` usually sets `deleted = 1`, reads hide deleted rows unless `deleted: true` or `?deleted=true` is passed, and `destroy()` is reserved for hard-delete cleanup in tests or fixtures.
+- Reuse the legacy-schema mapping helpers instead of hand-rolling field conversions. Most repos convert booleans, nested permission/export objects, and short API names into the older DB layout before writing and normalize them again on read.
+- When changing group or user behavior, check permission side effects too. Group creation/update touches permission rows, and user reads/write paths may change `inherit_group_permissions` handling.
+- Route tests use `init()` plus `server.inject()` instead of booting a live server. They usually establish auth by calling `POST /session` and then pass `Authorization: Bearer <token>` to protected routes.
+- The test entrypoint is `test.sh`, not raw `node --test`, when you need DB-backed behavior. It tears fixtures down, recreates them, and then runs the requested test target.
+- Zone-record changes must preserve the existing record-field translation logic. Special cases like zero `weight`/`priority` retention for `SRV`, `URI`, `HTTPS`, and `SVCB` are intentional.

lib/group/store/toml.js

@@ -0,0 +1,182 @@
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { parse, stringify } from 'smol-toml'
+
+import GroupBase from './base.js'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+
+const defaultPermissions = {
+  inherit: false,
+  self_write: false,
+  group: { create: false, write: false, delete: false },
+  nameserver: { usable: [], create: false, write: false, delete: false },
+  zone: { create: false, write: false, delete: false, delegate: false },
+  zonerecord: { create: false, write: false, delete: false, delegate: false },
+  user: { create: false, write: false, delete: false },
+}
+
+function resolveStorePath(filename) {
+  const base = process.env.NICTOOL_DATA_STORE_PATH
+  if (base) return path.join(base, filename)
+  return path.resolve(__dirname, '../../../conf.d', filename)
+}
+
+class GroupRepoTOML extends GroupBase {
+  constructor(args = {}) {
+    super(args)
+    this._filePath = resolveStorePath('group.toml')
+  }
+
+  async _load() {
+    try {
+      const str = await fs.readFile(this._filePath, 'utf8')
+      const data = parse(str)
+      return Array.isArray(data.group) ? data.group : []
+    } catch (err) {
+      if (err.code === 'ENOENT') return []
+      throw err
+    }
+  }
+
+  async _save(groups) {
+    await fs.mkdir(path.dirname(this._filePath), { recursive: true })
+    await fs.writeFile(this._filePath, stringify({ group: groups }))
+  }
+
+  _postProcess(row, deletedArg) {
+    const r = JSON.parse(JSON.stringify(row))
+    r.deleted = Boolean(r.deleted)
+    if (r.permissions?.nameserver && !Array.isArray(r.permissions.nameserver.usable)) {
+      r.permissions.nameserver.usable = []
+    }
+    if (deletedArg === false) delete r.deleted
+    return r
+  }
+
+  // BFS over parent_gid relationships to collect all descendant group ids.
+  _collectSubgroupIds(groups, gid) {
+    const ids = []
+    const queue = [gid]
+    while (queue.length) {
+      const cur = queue.shift()
+      for (const g of groups) {
+        if (g.parent_gid === cur && !ids.includes(g.id)) {
+          ids.push(g.id)
+          queue.push(g.id)
+        }
+      }
+    }
+    return ids
+  }
+
+  async create(args) {
+    args = JSON.parse(JSON.stringify(args))
+
+    if (args.id) {
+      const existing = await this.get({ id: args.id })
+      if (existing.length === 1) return existing[0].id
+    }
+
+    const usable_ns = args.usable_ns ?? []
+    delete args.usable_ns
+
+    const gid = args.id
+    args.permissions = {
+      ...JSON.parse(JSON.stringify(defaultPermissions)),
+      id: gid,
+      name: `Group ${args.name} perms`,
+      user: { id: gid, create: false, write: false, delete: false },
+      group: { id: gid, create: false, write: false, delete: false },
+      nameserver: {
+        usable: Array.isArray(usable_ns) ? usable_ns : [],
+        create: false,
+        write: false,
+        delete: false,
+      },
+    }
+
+    const groups = await this._load()
+    groups.push(args)
+    await this._save(groups)
+    return gid
+  }
+
+  async get(args_orig) {
+    const args = JSON.parse(JSON.stringify(args_orig))
+    const deletedArg = args.deleted ?? false
+    const include_subgroups = args.include_subgroups === true
+
+    let groups = await this._load()
+
+    if (args.id !== undefined) {
+      if (include_subgroups) {
+        const subIds = this._collectSubgroupIds(groups, args.id)
+        const allIds = [args.id, ...subIds]
+        groups = groups.filter((g) => allIds.includes(g.id))
+      } else {
+        groups = groups.filter((g) => g.id === args.id)
+      }
+    }
+
+    if (args.parent_gid !== undefined) groups = groups.filter((g) => g.parent_gid === args.parent_gid)
+    if (args.name !== undefined) groups = groups.filter((g) => g.name === args.name)
+
+    if (deletedArg === false) groups = groups.filter((g) => !g.deleted)
+    else if (deletedArg !== undefined)
+      groups = groups.filter((g) => Boolean(g.deleted) === Boolean(deletedArg))
+
+    return groups.map((g) => this._postProcess(g, deletedArg))
+  }
+
+  async put(args) {
+    if (!args.id) return false
+    args = JSON.parse(JSON.stringify(args))
+    const id = args.id
+    delete args.id
+
+    const usable_ns = args.usable_ns
+    delete args.usable_ns
+
+    const groups = await this._load()
+    const idx = groups.findIndex((g) => g.id === id)
+    if (idx === -1) return false
+
+    if (usable_ns !== undefined && groups[idx].permissions) {
+      groups[idx].permissions.nameserver = {
+        ...groups[idx].permissions.nameserver,
+        usable: Array.isArray(usable_ns) ? usable_ns : [],
+      }
+    }
+
+    if (Object.keys(args).length > 0) {
+      groups[idx] = { ...groups[idx], ...args }
+    }
+
+    await this._save(groups)
+    return true
+  }
+
+  async delete(args) {
+    const groups = await this._load()
+    const idx = groups.findIndex((g) => g.id === args.id)
+    if (idx === -1) return false
+
+    groups[idx].deleted = args.deleted ?? true
+    await this._save(groups)
+    return true
+  }
+
+  async destroy(args) {
+    const groups = await this._load()
+    const before = groups.length
+    const filtered = groups.filter((g) => g.id !== args.id)
+    if (filtered.length === before) return false
+    await this._save(filtered)
+    return true
+  }
+}
+
+export default GroupRepoTOML

lib/nameserver/store/toml.js

@@ -0,0 +1,124 @@
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { parse, stringify } from 'smol-toml'
+
+import NameserverBase from './base.js'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+
+const boolFields = ['deleted']
+
+// Fields that default to empty string when absent or null
+const emptyStringFields = ['description', 'address6', 'remote_login', 'logdir', 'datadir']
+
+function resolveStorePath(filename) {
+  const base = process.env.NICTOOL_DATA_STORE_PATH
+  if (base) return path.join(base, filename)
+  return path.resolve(__dirname, '../../../conf.d', filename)
+}
+
+class NameserverRepoTOML extends NameserverBase {
+  constructor(args = {}) {
+    super(args)
+    this._filePath = resolveStorePath('nameserver.toml')
+  }
+
+  async _load() {
+    try {
+      const str = await fs.readFile(this._filePath, 'utf8')
+      const data = parse(str)
+      return Array.isArray(data.nameserver) ? data.nameserver : []
+    } catch (err) {
+      if (err.code === 'ENOENT') return []
+      throw err
+    }
+  }
+
+  async _save(nameservers) {
+    await fs.mkdir(path.dirname(this._filePath), { recursive: true })
+    await fs.writeFile(this._filePath, stringify({ nameserver: nameservers }))
+  }
+
+  _postProcess(row, deletedArg) {
+    const r = JSON.parse(JSON.stringify(row))
+
+    for (const b of boolFields) r[b] = Boolean(r[b])
+    for (const f of emptyStringFields) {
+      if ([null, undefined].includes(r[f])) r[f] = ''
+    }
+
+    // Ensure the nested export object is always present and well-formed.
+    // Unlike MySQL (which joins nt_nameserver_export_type), TOML stores the
+    // type name inline, so no translation is needed.
+    if (!r.export || typeof r.export !== 'object') r.export = {}
+    if ([null, undefined].includes(r.export.type)) r.export.type = ''
+    if ([null, undefined].includes(r.export.interval)) r.export.interval = 0
+    if ([null, undefined].includes(r.export.status)) r.export.status = ''
+    r.export.serials = Boolean(r.export.serials)
+
+    if (deletedArg === false) delete r.deleted
+    return r
+  }
+
+  async create(args) {
+    if (args.id) {
+      const existing = await this.get({ id: args.id })
+      if (existing.length === 1) return existing[0].id
+    }
+
+    const nameservers = await this._load()
+    nameservers.push(JSON.parse(JSON.stringify(args)))
+    await this._save(nameservers)
+    return args.id
+  }
+
+  async get(args) {
+    args = JSON.parse(JSON.stringify(args))
+    const deletedArg = args.deleted ?? false
+
+    let nameservers = await this._load()
+
+    if (args.id !== undefined) nameservers = nameservers.filter((n) => n.id === args.id)
+    if (args.gid !== undefined) nameservers = nameservers.filter((n) => n.gid === args.gid)
+    if (args.name !== undefined) nameservers = nameservers.filter((n) => n.name === args.name)
+    if (deletedArg === false) nameservers = nameservers.filter((n) => !n.deleted)
+    else if (deletedArg !== undefined)
+      nameservers = nameservers.filter((n) => Boolean(n.deleted) === Boolean(deletedArg))
+
+    return nameservers.map((n) => this._postProcess(n, deletedArg))
+  }
+
+  async put(args) {
+    if (!args.id) return false
+    const nameservers = await this._load()
+    const idx = nameservers.findIndex((n) => n.id === args.id)
+    if (idx === -1) return false
+
+    nameservers[idx] = { ...nameservers[idx], ...JSON.parse(JSON.stringify(args)) }
+    await this._save(nameservers)
+    return true
+  }
+
+  async delete(args) {
+    const nameservers = await this._load()
+    const idx = nameservers.findIndex((n) => n.id === args.id)
+    if (idx === -1) return false
+
+    nameservers[idx].deleted = args.deleted ?? true
+    await this._save(nameservers)
+    return true
+  }
+
+  async destroy(args) {
+    const nameservers = await this._load()
+    const before = nameservers.length
+    const filtered = nameservers.filter((n) => n.id !== args.id)
+    if (filtered.length === before) return false
+    await this._save(filtered)
+    return true
+  }
+}
+
+export default NameserverRepoTOML