) {
+ const slug = c.req.param('slug')!
+ const { email, role } = await c.req.json()
- const [org,] = await db
+ const [org] = await db
.select()
- .from(schema.accounts,)
- .where(and(eq(schema.accounts.slug, slug,), eq(schema.accounts.type, 'org',),),)
- .limit(1,)
+ .from(schema.accounts)
+ .where(and(eq(schema.accounts.slug, slug), eq(schema.accounts.type, 'org')))
+ .limit(1)
- if (!org) return c.json({ error: 'Organization not found', statusCode: 404, }, 404,)
+ if (!org) return c.json({ error: 'Organization not found', statusCode: 404 }, 404)
- const [callerMembership,] = await db
+ const [callerMembership] = await db
.select()
- .from(schema.orgMemberships,)
- .where(and(eq(schema.orgMemberships.orgId, org.id,), eq(schema.orgMemberships.userId, c.get('accountId',)!,),),)
- .limit(1,)
+ .from(schema.orgMemberships)
+ .where(
+ and(
+ eq(schema.orgMemberships.orgId, org.id),
+ eq(schema.orgMemberships.userId, c.get('accountId')!),
+ ),
+ )
+ .limit(1)
if (!callerMembership || callerMembership.role === 'member') {
- return c.json({ error: 'Must be an owner or admin to invite members', statusCode: 403, }, 403,)
+ return c.json({ error: 'Must be an owner or admin to invite members', statusCode: 403 }, 403)
}
- // Check if already a member (by email)
- const [existingUser,] = await db
+ // Check if there's already a pending invitation for this email
+ const [existingInvite] = await db
.select()
- .from(schema.accounts,)
- .where(eq(schema.accounts.email, email,),)
- .limit(1,)
-
- if (existingUser) {
- const [existingMembership,] = await db
- .select()
- .from(schema.orgMemberships,)
- .where(and(eq(schema.orgMemberships.orgId, org.id,), eq(schema.orgMemberships.userId, existingUser.id,),),)
- .limit(1,)
-
- if (existingMembership) {
- return c.json({ error: 'User is already a member', statusCode: 409, }, 409,)
- }
+ .from(schema.orgInvitations)
+ .where(and(eq(schema.orgInvitations.orgId, org.id), eq(schema.orgInvitations.email, email)))
+ .limit(1)
+
+ if (existingInvite && !existingInvite.acceptedAt) {
+ return c.json(
+ { error: 'An invitation is already pending for this email', statusCode: 409 },
+ 409,
+ )
}
const token = uuidv4()
- const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000,) // 7 days
+ const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000) // 7 days
- await db.insert(schema.orgInvitations,).values({
+ await db.insert(schema.orgInvitations).values({
orgId: org.id,
email,
role,
- invitedBy: c.get('accountId',)!,
+ invitedBy: c.get('accountId')!,
token,
expiresAt,
- },)
+ })
// Send invitation email
- const origin = new URL(c.req.url,).origin
+ const origin = new URL(c.req.url).origin
const inviteUrl = `${origin}/invitations/accept?token=${token}`
await sendEmail({
to: email,
subject: `You've been invited to join ${org.displayName} on Underlay`,
- text:
- `You've been invited to join ${org.displayName} as a ${role}.\n\nAccept: ${inviteUrl}\n\nThis invitation expires in 7 days.`,
- html:
- `You've been invited to join ${org.displayName} as a ${role}.
Accept invitation
This invitation expires in 7 days.
`,
- },)
+ text: `You've been invited to join ${org.displayName} as a ${role}.\n\nAccept: ${inviteUrl}\n\nThis invitation expires in 7 days.`,
+ html: `You've been invited to join ${org.displayName} as a ${role}.
Accept invitation
This invitation expires in 7 days.
`,
+ })
- return c.json({ ok: true, }, 201,)
+ return c.json({ ok: true }, 201)
}
// List pending invitations for an org
-export async function listInvitations(c: Context,) {
- const slug = c.req.param('slug',)!
+export async function listInvitations(c: Context) {
+ const slug = c.req.param('slug')!
- const [org,] = await db
+ const [org] = await db
.select()
- .from(schema.accounts,)
- .where(and(eq(schema.accounts.slug, slug,), eq(schema.accounts.type, 'org',),),)
- .limit(1,)
+ .from(schema.accounts)
+ .where(and(eq(schema.accounts.slug, slug), eq(schema.accounts.type, 'org')))
+ .limit(1)
- if (!org) return c.json({ error: 'Organization not found', statusCode: 404, }, 404,)
+ if (!org) return c.json({ error: 'Organization not found', statusCode: 404 }, 404)
- const [membership,] = await db
+ const [membership] = await db
.select()
- .from(schema.orgMemberships,)
- .where(and(eq(schema.orgMemberships.orgId, org.id,), eq(schema.orgMemberships.userId, c.get('accountId',)!,),),)
- .limit(1,)
+ .from(schema.orgMemberships)
+ .where(
+ and(
+ eq(schema.orgMemberships.orgId, org.id),
+ eq(schema.orgMemberships.userId, c.get('accountId')!),
+ ),
+ )
+ .limit(1)
- if (!membership) return c.json({ error: 'Forbidden', statusCode: 403, }, 403,)
+ if (!membership) return c.json({ error: 'Forbidden', statusCode: 403 }, 403)
const invitations = await db
.select({
@@ -1083,120 +994,148 @@ export async function listInvitations(c: Context,) {
expiresAt: schema.orgInvitations.expiresAt,
acceptedAt: schema.orgInvitations.acceptedAt,
createdAt: schema.orgInvitations.createdAt,
- },)
- .from(schema.orgInvitations,)
- .where(eq(schema.orgInvitations.orgId, org.id,),)
+ })
+ .from(schema.orgInvitations)
+ .where(eq(schema.orgInvitations.orgId, org.id))
- return c.json(invitations,)
+ return c.json(invitations)
}
// Cancel an invitation
-export async function deleteInvitation(c: Context,) {
- const slug = c.req.param('slug',)!
- const id = c.req.param('id',)!
+export async function deleteInvitation(c: Context) {
+ const slug = c.req.param('slug')!
+ const id = c.req.param('id')!
- const [org,] = await db
+ const [org] = await db
.select()
- .from(schema.accounts,)
- .where(and(eq(schema.accounts.slug, slug,), eq(schema.accounts.type, 'org',),),)
- .limit(1,)
+ .from(schema.accounts)
+ .where(and(eq(schema.accounts.slug, slug), eq(schema.accounts.type, 'org')))
+ .limit(1)
- if (!org) return c.json({ error: 'Organization not found', statusCode: 404, }, 404,)
+ if (!org) return c.json({ error: 'Organization not found', statusCode: 404 }, 404)
- const [membership,] = await db
+ const [membership] = await db
.select()
- .from(schema.orgMemberships,)
- .where(and(eq(schema.orgMemberships.orgId, org.id,), eq(schema.orgMemberships.userId, c.get('accountId',)!,),),)
- .limit(1,)
+ .from(schema.orgMemberships)
+ .where(
+ and(
+ eq(schema.orgMemberships.orgId, org.id),
+ eq(schema.orgMemberships.userId, c.get('accountId')!),
+ ),
+ )
+ .limit(1)
if (!membership || membership.role === 'member') {
- return c.json({ error: 'Must be an owner or admin to cancel invitations', statusCode: 403, }, 403,)
+ return c.json(
+ { error: 'Must be an owner or admin to cancel invitations', statusCode: 403 },
+ 403,
+ )
}
- await db.delete(schema.orgInvitations,).where(eq(schema.orgInvitations.id, id,),)
- return c.json({ ok: true, },)
+ await db.delete(schema.orgInvitations).where(eq(schema.orgInvitations.id, id))
+ return c.json({ ok: true })
}
// Accept an invitation (public, token-based)
-export async function acceptInvitation(c: Context,) {
- const { token, } = await c.req.json()
+export async function acceptInvitation(c: Context) {
+ const { token } = await c.req.json()
- const [invitation,] = await db
+ const [invitation] = await db
.select()
- .from(schema.orgInvitations,)
- .where(eq(schema.orgInvitations.token, token,),)
- .limit(1,)
+ .from(schema.orgInvitations)
+ .where(eq(schema.orgInvitations.token, token))
+ .limit(1)
if (!invitation) {
- return c.json({ error: 'Invitation not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'Invitation not found', statusCode: 404 }, 404)
}
if (invitation.acceptedAt) {
- return c.json({ error: 'Invitation already accepted', statusCode: 409, }, 409,)
+ return c.json({ error: 'Invitation already accepted', statusCode: 409 }, 409)
}
- if (new Date(invitation.expiresAt,) < new Date()) {
- return c.json({ error: 'Invitation has expired', statusCode: 410, }, 410,)
+ if (new Date(invitation.expiresAt) < new Date()) {
+ return c.json({ error: 'Invitation has expired', statusCode: 410 }, 410)
}
- // Verify the logged-in user's email matches the invitation
- const [account,] = await db
- .select()
- .from(schema.accounts,)
- .where(eq(schema.accounts.id, c.get('accountId',)!,),)
- .limit(1,)
+ // Verify the logged-in user's email matches the invitation.
+ // Email is fetched from KF Auth since we don't store it locally.
+ const { getKfProfile } = await import('../lib/kf-profile-cache.server.js')
+ const accountId = c.get('accountId')!
+
+ // Fetch email from KF Auth internal API directly (profile cache doesn't include email)
+ const KF_AUTH_URL = process.env.KF_AUTH_URL ?? 'http://localhost:3000'
+ const KF_INTERNAL_API_KEY = process.env.KF_INTERNAL_API_KEY ?? ''
+ let userEmail: string | null = null
+ try {
+ const res = await fetch(`${KF_AUTH_URL}/api/internal/users/${accountId}`, {
+ headers: { Authorization: `Bearer ${KF_INTERNAL_API_KEY}` },
+ })
+ if (res.ok) {
+ const data = (await res.json()) as { email: string }
+ userEmail = data.email
+ }
+ } catch {}
- if (!account || account.email !== invitation.email) {
- return c.json({ error: 'This invitation was sent to a different email address', statusCode: 403, }, 403,)
+ if (!userEmail || userEmail !== invitation.email) {
+ return c.json(
+ { error: 'This invitation was sent to a different email address', statusCode: 403 },
+ 403,
+ )
}
// Add to org
- await db.insert(schema.orgMemberships,).values({
+ await db.insert(schema.orgMemberships).values({
orgId: invitation.orgId,
- userId: c.get('accountId',)!,
+ userId: c.get('accountId')!,
role: invitation.role as 'owner' | 'admin' | 'member',
- },)
+ })
// Mark invitation as accepted
await db
- .update(schema.orgInvitations,)
- .set({ acceptedAt: new Date(), },)
- .where(eq(schema.orgInvitations.id, invitation.id,),)
+ .update(schema.orgInvitations)
+ .set({ acceptedAt: new Date() })
+ .where(eq(schema.orgInvitations.id, invitation.id))
// Get org slug for redirect
- const [org,] = await db
- .select({ slug: schema.accounts.slug, },)
- .from(schema.accounts,)
- .where(eq(schema.accounts.id, invitation.orgId,),)
- .limit(1,)
+ const [org] = await db
+ .select({ slug: schema.accounts.slug })
+ .from(schema.accounts)
+ .where(eq(schema.accounts.id, invitation.orgId))
+ .limit(1)
- return c.json({ ok: true, orgSlug: org?.slug ?? '', },)
+ return c.json({ ok: true, orgSlug: org?.slug ?? '' })
}
// Delete org
-export async function deleteOrg(c: Context,) {
- const slug = c.req.param('slug',)!
+export async function deleteOrg(c: Context) {
+ const slug = c.req.param('slug')!
- const [org,] = await db
+ const [org] = await db
.select()
- .from(schema.accounts,)
- .where(and(eq(schema.accounts.slug, slug,), eq(schema.accounts.type, 'org',),),)
- .limit(1,)
+ .from(schema.accounts)
+ .where(and(eq(schema.accounts.slug, slug), eq(schema.accounts.type, 'org')))
+ .limit(1)
- if (!org) return c.json({ error: 'Organization not found', statusCode: 404, }, 404,)
+ if (!org) return c.json({ error: 'Organization not found', statusCode: 404 }, 404)
// Must be owner
- const [callerMembership,] = await db
+ const [callerMembership] = await db
.select()
- .from(schema.orgMemberships,)
- .where(and(eq(schema.orgMemberships.orgId, org.id,), eq(schema.orgMemberships.userId, c.get('accountId',)!,),),)
- .limit(1,)
+ .from(schema.orgMemberships)
+ .where(
+ and(
+ eq(schema.orgMemberships.orgId, org.id),
+ eq(schema.orgMemberships.userId, c.get('accountId')!),
+ ),
+ )
+ .limit(1)
if (!callerMembership || callerMembership.role !== 'owner') {
- return c.json({ error: 'Must be an owner to delete the organization', statusCode: 403, }, 403,)
+ return c.json({ error: 'Must be an owner to delete the organization', statusCode: 403 }, 403)
}
// Cascade will handle memberships, collections, etc.
- await db.delete(schema.accounts,).where(eq(schema.accounts.id, org.id,),)
- return c.json({ ok: true, },)
+ await db.delete(schema.accounts).where(eq(schema.accounts.id, org.id))
+ return c.json({ ok: true })
}
diff --git a/src/api/admin.ts b/src/api/admin.ts
index beefc32..0060012 100644
--- a/src/api/admin.ts
+++ b/src/api/admin.ts
@@ -1,6 +1,7 @@
-import type { Context, } from 'hono'
-import { streamSSE, } from 'hono/streaming'
-import { getMirrorConfig, } from '../lib/mirror-config.js'
+import type { Context } from 'hono'
+import { streamSSE } from 'hono/streaming'
+
+import { getMirrorConfig } from '../lib/mirror-config.js'
import {
cleanupStaleRuns,
getActiveRunId,
@@ -14,47 +15,47 @@ import {
type SyncProgressEvent,
testUpstreamConnection,
} from '../lib/mirror-sync.js'
-import { type AuthEnv, } from './auth.server.js'
+import { type AuthEnv } from './auth.server.js'
// Get mirror status
-export async function mirrorStatus(c: Context,) {
+export async function mirrorStatus(c: Context) {
const status = await getMirrorStatus()
- return c.json(status,)
+ return c.json(status)
}
// Test upstream connection
-export async function mirrorTest(c: Context,) {
+export async function mirrorTest(c: Context) {
const config = getMirrorConfig()
- const result = await testUpstreamConnection(config.upstream,)
- return c.json(result,)
+ const result = await testUpstreamConnection(config.upstream)
+ return c.json(result)
}
// Trigger a sync manually (fire-and-forget, client uses SSE for progress)
-export async function mirrorSync(c: Context,) {
+export async function mirrorSync(c: Context) {
if (isSyncRunning()) {
- return c.json({ started: false, error: 'A sync is already running', },)
+ return c.json({ started: false, error: 'A sync is already running' })
}
// Start sync in background — don't await
- runMirrorSync('manual',).catch((err,) => {
- console.error('[mirror-sync] Unhandled sync error:', err,)
- },)
- return c.json({ started: true, },)
+ runMirrorSync('manual').catch((err) => {
+ console.error('[mirror-sync] Unhandled sync error:', err)
+ })
+ return c.json({ started: true })
}
// Stop a running sync (also cleans up stale DB rows from crashed processes)
-export async function mirrorSyncStop(c: Context,) {
+export async function mirrorSyncStop(c: Context) {
const stopped = stopSync()
if (!stopped) {
// No active sync in this process — clean up stale DB rows
const cleaned = await cleanupStaleRuns()
- return c.json({ stopped: false, cleaned, },)
+ return c.json({ stopped: false, cleaned })
}
- return c.json({ stopped: true, },)
+ return c.json({ stopped: true })
}
// SSE endpoint for live sync progress (replays buffered logs on connect)
-export async function mirrorSyncProgress(c: Context,) {
- return streamSSE(c, async (stream,) => {
+export async function mirrorSyncProgress(c: Context) {
+ return streamSSE(c, async (stream) => {
// Replay buffered logs so reconnects/refreshes don't lose history
const buffered = getActiveRunLogs()
if (buffered.length > 0) {
@@ -71,7 +72,7 @@ export async function mirrorSyncProgress(c: Context,) {
errors: 0,
},
}
- await stream.writeSSE({ data: JSON.stringify(replayEvent,), },)
+ await stream.writeSSE({ data: JSON.stringify(replayEvent) })
}
}
@@ -80,40 +81,37 @@ export async function mirrorSyncProgress(c: Context,) {
return
}
- const onProgress = async (event: SyncProgressEvent,) => {
- await stream.writeSSE({ data: JSON.stringify(event,), },)
+ const onProgress = async (event: SyncProgressEvent) => {
+ await stream.writeSSE({ data: JSON.stringify(event) })
if (event.type === 'done') {
- setTimeout(() => stream.close(), 100,)
+ setTimeout(() => stream.close(), 100)
}
}
- syncEvents.on('progress', onProgress,)
+ syncEvents.on('progress', onProgress)
stream.onAbort(() => {
- syncEvents.off('progress', onProgress,)
- },)
+ syncEvents.off('progress', onProgress)
+ })
// Keep the stream open until aborted or done
- await new Promise((resolve,) => {
+ await new Promise((resolve) => {
stream.onAbort(() => resolve())
- },)
- },)
+ })
+ })
}
// Get current sync running state (for page refresh reconnection)
-export async function mirrorSyncActive(c: Context,) {
+export async function mirrorSyncActive(c: Context) {
return c.json({
running: isSyncRunning(),
runId: getActiveRunId(),
logs: getActiveRunLogs(),
- },)
+ })
}
// Sync history
-export async function mirrorHistory(c: Context,) {
- const limit = Math.min(
- Number(c.req.query('limit',),) || 20,
- 100,
- )
- return c.json(await getSyncHistory(limit,),)
+export async function mirrorHistory(c: Context) {
+ const limit = Math.min(Number(c.req.query('limit')) || 20, 100)
+ return c.json(await getSyncHistory(limit))
}
diff --git a/src/api/ark-middleware.server.ts b/src/api/ark-middleware.server.ts
index cd9da47..ade9923 100644
--- a/src/api/ark-middleware.server.ts
+++ b/src/api/ark-middleware.server.ts
@@ -1,27 +1,28 @@
-import type { MiddlewareHandler, } from 'hono'
-import { buildErc, DEFAULT_NAAN, } from '../lib/ark.js'
+import type { MiddlewareHandler } from 'hono'
+
+import { buildErc, DEFAULT_NAAN } from '../lib/ark.js'
/**
* Hono middleware that intercepts /ark:NAAN/... URLs and resolves them.
* In the new single-server architecture, we call the API route handler internally
* via a local fetch to localhost (same process).
*/
-export const arkMiddleware: MiddlewareHandler = async (c, _next,) => {
- const url = new URL(c.req.url,)
+export const arkMiddleware: MiddlewareHandler = async (c, _next) => {
+ const url = new URL(c.req.url)
const pathname = url.pathname
const search = url.search
- if (!pathname.startsWith('/ark:',)) {
+ if (!pathname.startsWith('/ark:')) {
return _next()
}
- const fullPath = pathname.slice(1,) // strip leading /
+ const fullPath = pathname.slice(1) // strip leading /
// Check if this is a root NAAN path
- const afterLabel = fullPath.slice(4,) // strip "ark:"
- const slashIdx = afterLabel.indexOf('/',)
- const naan = slashIdx === -1 ? afterLabel : afterLabel.slice(0, slashIdx,)
- const afterNaan = slashIdx === -1 ? '' : afterLabel.slice(slashIdx + 1,)
+ const afterLabel = fullPath.slice(4) // strip "ark:"
+ const slashIdx = afterLabel.indexOf('/')
+ const naan = slashIdx === -1 ? afterLabel : afterLabel.slice(0, slashIdx)
+ const afterNaan = slashIdx === -1 ? '' : afterLabel.slice(slashIdx + 1)
if (!afterNaan.trim()) {
return new Response(
@@ -37,37 +38,37 @@ export const arkMiddleware: MiddlewareHandler = async (c, _next,) => {
'4. Scope: Underlay ARKs primarily identify versioned data collections and the records within them. Collection ARKs redirect to the collection overview; version-qualified ARKs redirect to specific version pages; record ARKs redirect to the canonical URL of the identified record.',
'',
`For more information, see: https://underlay.org/ark:${naan}/`,
- ].join('\n',),
- { headers: { 'Content-Type': 'text/plain; charset=utf-8', }, },
+ ].join('\n'),
+ { headers: { 'Content-Type': 'text/plain; charset=utf-8' } },
)
}
// Resolve the ARK via internal API
- const port = Number(process.env.PORT,) || 3000
+ const port = Number(process.env.PORT) || 3000
const apiBase = `http://localhost:${port}`
- const params = new URLSearchParams({ path: fullPath, },)
+ const params = new URLSearchParams({ path: fullPath })
let resolveRes: Response
try {
- resolveRes = await fetch(`${apiBase}/api/ark/resolve?${params}`,)
+ resolveRes = await fetch(`${apiBase}/api/ark/resolve?${params}`)
} catch {
- return new Response('ARK resolver unavailable', { status: 503, },)
+ return new Response('ARK resolver unavailable', { status: 503 })
}
if (!resolveRes.ok) {
const body = await resolveRes.json().catch(() => ({}))
if (body?.type === 'not_found') {
- return new Response('ARK not found', { status: 404, },)
+ return new Response('ARK not found', { status: 404 })
}
- return new Response('ARK resolution error', { status: 502, },)
+ return new Response('ARK resolution error', { status: 502 })
}
const data = await resolveRes.json()
if (data.type === 'not_found') {
- return new Response('ARK not found', { status: 404, },)
+ return new Response('ARK not found', { status: 404 })
}
- const { metadata, } = data
+ const { metadata } = data
const resolvedNaan = metadata?.naan ?? DEFAULT_NAAN
// Handle inflections
@@ -79,23 +80,21 @@ export const arkMiddleware: MiddlewareHandler = async (c, _next,) => {
when: metadata.when ?? '(:unkn)',
where: metadata.where ?? metadata.arkUrl ?? '(:unkn)',
naan: resolvedNaan,
- },)
+ })
return new Response(erc, {
- headers: { 'Content-Type': 'text/plain; charset=utf-8', },
- },)
+ headers: { 'Content-Type': 'text/plain; charset=utf-8' },
+ })
}
if (search === '?json') {
- return new Response(JSON.stringify(metadata, null, 2,), {
- headers: { 'Content-Type': 'application/json', },
- },)
+ return new Response(JSON.stringify(metadata, null, 2), {
+ headers: { 'Content-Type': 'application/json' },
+ })
}
// Regular resolution — redirect
const targetUrl = data.url
- const redirectTarget = targetUrl.startsWith('/',)
- ? `${url.origin}${targetUrl}`
- : targetUrl
+ const redirectTarget = targetUrl.startsWith('/') ? `${url.origin}${targetUrl}` : targetUrl
- return c.redirect(redirectTarget, 302,)
+ return c.redirect(redirectTarget, 302)
}
diff --git a/src/api/ark.ts b/src/api/ark.ts
index aefa1e5..424d0e7 100644
--- a/src/api/ark.ts
+++ b/src/api/ark.ts
@@ -1,6 +1,7 @@
-import { and, desc, eq, } from 'drizzle-orm'
-import type { Context, } from 'hono'
-import { db, schema, } from '../db/client.server.js'
+import { and, desc, eq } from 'drizzle-orm'
+import type { Context } from 'hono'
+
+import { db, schema } from '../db/client.server.js'
import {
buildArkUrl,
buildErc,
@@ -10,43 +11,43 @@ import {
getOrMintShoulder,
parseArkPath,
} from '../lib/ark.js'
-import { type AuthEnv, } from './auth.server.js'
+import { type AuthEnv } from './auth.server.js'
// --- Resolution ---
-export async function resolve(c: Context,) {
- const path = c.req.query('path',)
- if (!path) return c.json({ error: 'Missing path', }, 400,)
+export async function resolve(c: Context) {
+ const path = c.req.query('path')
+ if (!path) return c.json({ error: 'Missing path' }, 400)
// path = "ark:NAAN/shoulder+collection..."
- const arkLabelIdx = path.indexOf('ark:',)
- if (arkLabelIdx === -1) return c.json({ error: 'Invalid ARK path', }, 400,)
+ const arkLabelIdx = path.indexOf('ark:')
+ if (arkLabelIdx === -1) return c.json({ error: 'Invalid ARK path' }, 400)
- const afterLabel = path.slice(arkLabelIdx + 4,) // strip "ark:"
- const slashIdx = afterLabel.indexOf('/',)
- if (slashIdx === -1) return c.json({ type: 'not_found', }, 404,)
+ const afterLabel = path.slice(arkLabelIdx + 4) // strip "ark:"
+ const slashIdx = afterLabel.indexOf('/')
+ if (slashIdx === -1) return c.json({ type: 'not_found' }, 404)
- const naan = afterLabel.slice(0, slashIdx,)
- const pathAfterNaan = afterLabel.slice(slashIdx + 1,)
+ const naan = afterLabel.slice(0, slashIdx)
+ const pathAfterNaan = afterLabel.slice(slashIdx + 1)
// Root NAAN path (no name part) — handled in middleware; shouldn't reach here
- if (!pathAfterNaan) return c.json({ type: 'not_found', }, 404,)
+ if (!pathAfterNaan) return c.json({ type: 'not_found' }, 404)
- const components = parseArkPath(pathAfterNaan,)
- if (!components) return c.json({ type: 'not_found', }, 404,)
+ const components = parseArkPath(pathAfterNaan)
+ if (!components) return c.json({ type: 'not_found' }, 404)
- const { shoulder, collectionArkId, version, recordType, recordId, } = components
+ const { shoulder, collectionArkId, version, recordType, recordId } = components
// Lookup shoulder → account
- const [shoulderRow,] = await db
- .select({ accountId: schema.arkShoulders.accountId, },)
- .from(schema.arkShoulders,)
- .where(eq(schema.arkShoulders.shoulder, shoulder,),)
- .limit(1,)
- if (!shoulderRow) return c.json({ type: 'not_found', }, 404,)
+ const [shoulderRow] = await db
+ .select({ accountId: schema.arkShoulders.accountId })
+ .from(schema.arkShoulders)
+ .where(eq(schema.arkShoulders.shoulder, shoulder))
+ .limit(1)
+ if (!shoulderRow) return c.json({ type: 'not_found' }, 404)
// Lookup collectionArkId → collection + owner
- const [collRow,] = await db
+ const [collRow] = await db
.select({
collectionId: schema.arkCollections.collectionId,
enabled: schema.arkCollections.enabled,
@@ -57,22 +58,22 @@ export async function resolve(c: Context,) {
ownerName: schema.accounts.displayName,
ownerNaan: schema.accounts.arkNaan,
collectionAccountId: schema.collections.accountId,
- },)
- .from(schema.arkCollections,)
- .innerJoin(schema.collections, eq(schema.arkCollections.collectionId, schema.collections.id,),)
- .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id,),)
- .where(eq(schema.arkCollections.arkId, collectionArkId,),)
- .limit(1,)
+ })
+ .from(schema.arkCollections)
+ .innerJoin(schema.collections, eq(schema.arkCollections.collectionId, schema.collections.id))
+ .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id))
+ .where(eq(schema.arkCollections.arkId, collectionArkId))
+ .limit(1)
- if (!collRow || !collRow.enabled) return c.json({ type: 'not_found', }, 404,)
+ if (!collRow || !collRow.enabled) return c.json({ type: 'not_found' }, 404)
// Verify the shoulder belongs to the collection's owner
if (shoulderRow.accountId !== collRow.collectionAccountId) {
- return c.json({ type: 'not_found', }, 404,)
+ return c.json({ type: 'not_found' }, 404)
}
const resolvedNaan = collRow.ownerNaan ?? naan
- const { collectionId, collectionSlug, collectionName, ownerSlug, ownerName, } = collRow
+ const { collectionId, collectionSlug, collectionName, ownerSlug, ownerName } = collRow
// --- Resolve version ---
let versionRow: {
@@ -88,7 +89,7 @@ export async function resolve(c: Context,) {
} | null = null
if (version !== undefined) {
- const [row,] = await db
+ const [row] = await db
.select({
id: schema.versions.id,
number: schema.versions.number,
@@ -99,14 +100,16 @@ export async function resolve(c: Context,) {
appId: schema.versions.appId,
actorId: schema.versions.actorId,
createdAt: schema.versions.createdAt,
- },)
- .from(schema.versions,)
- .where(and(eq(schema.versions.collectionId, collectionId,), eq(schema.versions.number, version,),),)
- .limit(1,)
- if (!row) return c.json({ type: 'not_found', }, 404,)
+ })
+ .from(schema.versions)
+ .where(
+ and(eq(schema.versions.collectionId, collectionId), eq(schema.versions.number, version)),
+ )
+ .limit(1)
+ if (!row) return c.json({ type: 'not_found' }, 404)
versionRow = row
} else {
- const [row,] = await db
+ const [row] = await db
.select({
id: schema.versions.id,
number: schema.versions.number,
@@ -117,65 +120,65 @@ export async function resolve(c: Context,) {
appId: schema.versions.appId,
actorId: schema.versions.actorId,
createdAt: schema.versions.createdAt,
- },)
- .from(schema.versions,)
- .where(eq(schema.versions.collectionId, collectionId,),)
- .orderBy(desc(schema.versions.number,),)
- .limit(1,)
+ })
+ .from(schema.versions)
+ .where(eq(schema.versions.collectionId, collectionId))
+ .orderBy(desc(schema.versions.number))
+ .limit(1)
versionRow = row ?? null
}
- const arkUrl = buildArkUrl(resolvedNaan, shoulder, collectionArkId, version, recordType, recordId,)
+ const arkUrl = buildArkUrl(resolvedNaan, shoulder, collectionArkId, version, recordType, recordId)
// --- Record resolution ---
if (recordType && recordId) {
- const [artRow,] = await db
- .select({ redirectUrlField: schema.arkRecordTypes.redirectUrlField, },)
- .from(schema.arkRecordTypes,)
+ const [artRow] = await db
+ .select({ redirectUrlField: schema.arkRecordTypes.redirectUrlField })
+ .from(schema.arkRecordTypes)
.where(
and(
- eq(schema.arkRecordTypes.collectionId, collectionId,),
- eq(schema.arkRecordTypes.recordType, recordType,),
+ eq(schema.arkRecordTypes.collectionId, collectionId),
+ eq(schema.arkRecordTypes.recordType, recordType),
),
)
- .limit(1,)
+ .limit(1)
- if (!artRow) return c.json({ type: 'not_found', }, 404,)
+ if (!artRow) return c.json({ type: 'not_found' }, 404)
- if (!versionRow) return c.json({ type: 'not_found', }, 404,)
+ if (!versionRow) return c.json({ type: 'not_found' }, 404)
- const [recordRow,] = await db
- .select({ data: schema.records.data, },)
- .from(schema.records,)
+ const [recordRow] = await db
+ .select({ data: schema.records.data })
+ .from(schema.records)
.where(
and(
- eq(schema.records.versionId, versionRow.id,),
- eq(schema.records.recordId, recordId,),
- eq(schema.records.type, recordType,),
+ eq(schema.records.versionId, versionRow.id),
+ eq(schema.records.recordId, recordId),
+ eq(schema.records.type, recordType),
),
)
- .limit(1,)
+ .limit(1)
- if (!recordRow) return c.json({ type: 'not_found', }, 404,)
+ if (!recordRow) return c.json({ type: 'not_found' }, 404)
const data = recordRow.data as Record
const redirectUrl = data[artRow.redirectUrlField]
if (typeof redirectUrl !== 'string') {
- return c.json({ type: 'not_found', error: 'No URL found for this record', }, 404,)
+ return c.json({ type: 'not_found', error: 'No URL found for this record' }, 404)
}
// Fetch the type schema for metadata
- const [vs,] = await db
- .select({ schema: schema.schemas.schema, },)
- .from(schema.versionSchemas,)
- .innerJoin(schema.schemas, eq(schema.versionSchemas.schemaId, schema.schemas.id,),)
+ const [vs] = await db
+ .select({ schema: schema.schemas.schema })
+ .from(schema.versionSchemas)
+ .innerJoin(schema.schemas, eq(schema.versionSchemas.schemaId, schema.schemas.id))
.where(
and(
- eq(schema.versionSchemas.versionId, versionRow.id,),
- eq(schema.versionSchemas.slug, recordType,),
+ eq(schema.versionSchemas.versionId, versionRow.id),
+ eq(schema.versionSchemas.slug, recordType),
),
)
- .limit(1,)
+ .limit(1)
return c.json({
type: 'redirect' as const,
@@ -184,7 +187,7 @@ export async function resolve(c: Context,) {
type: 'record',
who: ownerName,
what: `${recordType} ${recordId} in ${collectionName}`,
- when: formatErcDate(versionRow.createdAt,),
+ when: formatErcDate(versionRow.createdAt),
where: arkUrl,
naan: resolvedNaan,
collectionName,
@@ -198,17 +201,13 @@ export async function resolve(c: Context,) {
createdAt: versionRow.createdAt,
arkUrl,
},
- },)
+ })
}
// --- Collection / version resolution ---
if (collRow.customUrl) {
- const what = versionRow
- ? `${collectionName} ${versionRow.semver}`
- : collectionName
- const when = versionRow
- ? formatErcDate(versionRow.createdAt,)
- : '(:unkn)'
+ const what = versionRow ? `${collectionName} ${versionRow.semver}` : collectionName
+ const when = versionRow ? formatErcDate(versionRow.createdAt) : '(:unkn)'
return c.json({
type: 'redirect' as const,
url: collRow.customUrl,
@@ -230,7 +229,7 @@ export async function resolve(c: Context,) {
createdAt: versionRow?.createdAt,
arkUrl,
},
- },)
+ })
}
if (version !== undefined && versionRow) {
@@ -242,7 +241,7 @@ export async function resolve(c: Context,) {
type: 'version',
who: ownerName,
what: `${collectionName} ${versionRow.semver}`,
- when: formatErcDate(versionRow.createdAt,),
+ when: formatErcDate(versionRow.createdAt),
where: arkUrl,
naan: resolvedNaan,
collectionName,
@@ -256,7 +255,7 @@ export async function resolve(c: Context,) {
createdAt: versionRow.createdAt,
arkUrl,
},
- },)
+ })
}
// Default: redirect to collection overview
@@ -268,7 +267,7 @@ export async function resolve(c: Context,) {
type: 'collection',
who: ownerName,
what: collectionName,
- when: versionRow ? formatErcDate(versionRow.createdAt,) : '(:unkn)',
+ when: versionRow ? formatErcDate(versionRow.createdAt) : '(:unkn)',
where: arkUrl,
naan: resolvedNaan,
collectionName,
@@ -278,238 +277,238 @@ export async function resolve(c: Context,) {
createdAt: versionRow?.createdAt,
arkUrl,
},
- },)
+ })
}
// --- Collection ARK settings ---
-export async function getArk(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
+export async function getArk(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
- const [coll,] = await db
+ const [coll] = await db
.select({
id: schema.collections.id,
accountId: schema.collections.accountId,
ownerNaan: schema.accounts.arkNaan,
- },)
- .from(schema.collections,)
- .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id,),)
- .where(and(eq(schema.accounts.slug, owner,), eq(schema.collections.slug, slug,),),)
- .limit(1,)
- if (!coll) return c.json({ error: 'Collection not found', }, 404,)
+ })
+ .from(schema.collections)
+ .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id))
+ .where(and(eq(schema.accounts.slug, owner), eq(schema.collections.slug, slug)))
+ .limit(1)
+ if (!coll) return c.json({ error: 'Collection not found' }, 404)
// Must be owner/member
- const hasAccess = await checkCollectionAccess(coll.accountId, c.get('accountId',)!,)
- if (!hasAccess) return c.json({ error: 'Forbidden', }, 403,)
+ const hasAccess = await checkCollectionAccess(coll.accountId, c.get('accountId')!)
+ if (!hasAccess) return c.json({ error: 'Forbidden' }, 403)
const naan = coll.ownerNaan ?? DEFAULT_NAAN
- const [arkRow,] = await db
+ const [arkRow] = await db
.select({
arkId: schema.arkCollections.arkId,
enabled: schema.arkCollections.enabled,
customUrl: schema.arkCollections.customUrl,
shoulder: schema.arkShoulders.shoulder,
- },)
- .from(schema.arkCollections,)
- .innerJoin(
- schema.arkShoulders,
- eq(schema.arkShoulders.accountId, coll.accountId,),
- )
- .where(eq(schema.arkCollections.collectionId, coll.id,),)
- .limit(1,)
+ })
+ .from(schema.arkCollections)
+ .innerJoin(schema.arkShoulders, eq(schema.arkShoulders.accountId, coll.accountId))
+ .where(eq(schema.arkCollections.collectionId, coll.id))
+ .limit(1)
if (!arkRow) {
- return c.json({ enabled: false, customUrl: null, arkUrl: null, shoulder: null, arkId: null, },)
+ return c.json({ enabled: false, customUrl: null, arkUrl: null, shoulder: null, arkId: null })
}
- const arkUrl = buildArkUrl(naan, arkRow.shoulder, arkRow.arkId,)
+ const arkUrl = buildArkUrl(naan, arkRow.shoulder, arkRow.arkId)
return c.json({
enabled: arkRow.enabled,
customUrl: arkRow.customUrl,
arkUrl,
shoulder: arkRow.shoulder,
arkId: arkRow.arkId,
- },)
+ })
}
-export async function updateArk(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
- const { enabled, customUrl, } = await c.req.json()
+export async function updateArk(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
+ const { enabled, customUrl } = await c.req.json()
- const [coll,] = await db
- .select({ id: schema.collections.id, accountId: schema.collections.accountId, },)
- .from(schema.collections,)
- .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id,),)
- .where(and(eq(schema.accounts.slug, owner,), eq(schema.collections.slug, slug,),),)
- .limit(1,)
- if (!coll) return c.json({ error: 'Collection not found', }, 404,)
+ const [coll] = await db
+ .select({ id: schema.collections.id, accountId: schema.collections.accountId })
+ .from(schema.collections)
+ .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id))
+ .where(and(eq(schema.accounts.slug, owner), eq(schema.collections.slug, slug)))
+ .limit(1)
+ if (!coll) return c.json({ error: 'Collection not found' }, 404)
- const hasAccess = await checkCollectionAccess(coll.accountId, c.get('accountId',)!,)
- if (!hasAccess) return c.json({ error: 'Forbidden', }, 403,)
+ const hasAccess = await checkCollectionAccess(coll.accountId, c.get('accountId')!)
+ if (!hasAccess) return c.json({ error: 'Forbidden' }, 403)
- const [existing,] = await db
- .select({ collectionId: schema.arkCollections.collectionId, },)
- .from(schema.arkCollections,)
- .where(eq(schema.arkCollections.collectionId, coll.id,),)
- .limit(1,)
+ const [existing] = await db
+ .select({ collectionId: schema.arkCollections.collectionId })
+ .from(schema.arkCollections)
+ .where(eq(schema.arkCollections.collectionId, coll.id))
+ .limit(1)
if (!existing) {
// Collection predates ARK tables — mint now
- await getOrMintShoulder(coll.accountId,)
- const arkId = collectionToArkId(coll.id,)
- await db.insert(schema.arkCollections,).values({
+ await getOrMintShoulder(coll.accountId)
+ const arkId = collectionToArkId(coll.id)
+ await db.insert(schema.arkCollections).values({
collectionId: coll.id,
arkId,
enabled: enabled ?? true,
customUrl: customUrl ?? null,
- },)
+ })
} else {
const updates: Record = {}
if (enabled !== undefined) updates.enabled = enabled
if (customUrl !== undefined) updates.customUrl = customUrl ?? null
- if (Object.keys(updates,).length > 0) {
+ if (Object.keys(updates).length > 0) {
await db
- .update(schema.arkCollections,)
- .set(updates,)
- .where(eq(schema.arkCollections.collectionId, coll.id,),)
+ .update(schema.arkCollections)
+ .set(updates)
+ .where(eq(schema.arkCollections.collectionId, coll.id))
}
}
- return c.json({ ok: true, },)
+ return c.json({ ok: true })
}
// --- Record type ARK settings ---
-export async function getArkRecordTypes(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
+export async function getArkRecordTypes(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
- const [coll,] = await db
- .select({ id: schema.collections.id, accountId: schema.collections.accountId, },)
- .from(schema.collections,)
- .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id,),)
- .where(and(eq(schema.accounts.slug, owner,), eq(schema.collections.slug, slug,),),)
- .limit(1,)
- if (!coll) return c.json({ error: 'Collection not found', }, 404,)
+ const [coll] = await db
+ .select({ id: schema.collections.id, accountId: schema.collections.accountId })
+ .from(schema.collections)
+ .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id))
+ .where(and(eq(schema.accounts.slug, owner), eq(schema.collections.slug, slug)))
+ .limit(1)
+ if (!coll) return c.json({ error: 'Collection not found' }, 404)
- const hasAccess = await checkCollectionAccess(coll.accountId, c.get('accountId',)!,)
- if (!hasAccess) return c.json({ error: 'Forbidden', }, 403,)
+ const hasAccess = await checkCollectionAccess(coll.accountId, c.get('accountId')!)
+ if (!hasAccess) return c.json({ error: 'Forbidden' }, 403)
const rows = await db
.select({
recordType: schema.arkRecordTypes.recordType,
redirectUrlField: schema.arkRecordTypes.redirectUrlField,
- },)
- .from(schema.arkRecordTypes,)
- .where(eq(schema.arkRecordTypes.collectionId, coll.id,),)
+ })
+ .from(schema.arkRecordTypes)
+ .where(eq(schema.arkRecordTypes.collectionId, coll.id))
- return c.json(rows,)
+ return c.json(rows)
}
-export async function updateArkRecordTypes(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
- const { recordType, redirectUrlField, } = await c.req.json()
+export async function updateArkRecordTypes(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
+ const { recordType, redirectUrlField } = await c.req.json()
- if (!recordType) return c.json({ error: 'recordType required', }, 400,)
+ if (!recordType) return c.json({ error: 'recordType required' }, 400)
- const [coll,] = await db
- .select({ id: schema.collections.id, accountId: schema.collections.accountId, },)
- .from(schema.collections,)
- .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id,),)
- .where(and(eq(schema.accounts.slug, owner,), eq(schema.collections.slug, slug,),),)
- .limit(1,)
- if (!coll) return c.json({ error: 'Collection not found', }, 404,)
+ const [coll] = await db
+ .select({ id: schema.collections.id, accountId: schema.collections.accountId })
+ .from(schema.collections)
+ .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id))
+ .where(and(eq(schema.accounts.slug, owner), eq(schema.collections.slug, slug)))
+ .limit(1)
+ if (!coll) return c.json({ error: 'Collection not found' }, 404)
- const hasAccess = await checkCollectionAccess(coll.accountId, c.get('accountId',)!,)
- if (!hasAccess) return c.json({ error: 'Forbidden', }, 403,)
+ const hasAccess = await checkCollectionAccess(coll.accountId, c.get('accountId')!)
+ if (!hasAccess) return c.json({ error: 'Forbidden' }, 403)
if (redirectUrlField === null) {
await db
- .delete(schema.arkRecordTypes,)
+ .delete(schema.arkRecordTypes)
.where(
and(
- eq(schema.arkRecordTypes.collectionId, coll.id,),
- eq(schema.arkRecordTypes.recordType, recordType,),
+ eq(schema.arkRecordTypes.collectionId, coll.id),
+ eq(schema.arkRecordTypes.recordType, recordType),
),
)
} else {
await db
- .insert(schema.arkRecordTypes,)
- .values({ collectionId: coll.id, recordType, redirectUrlField, },)
+ .insert(schema.arkRecordTypes)
+ .values({ collectionId: coll.id, recordType, redirectUrlField })
.onConflictDoUpdate({
- target: [schema.arkRecordTypes.collectionId, schema.arkRecordTypes.recordType,],
- set: { redirectUrlField, },
- },)
+ target: [schema.arkRecordTypes.collectionId, schema.arkRecordTypes.recordType],
+ set: { redirectUrlField },
+ })
}
- return c.json({ ok: true, },)
+ return c.json({ ok: true })
}
// --- Org ARK NAAN ---
-export async function updateAccountArk(c: Context,) {
- const slug = c.req.param('slug',)!
- const { naan, } = await c.req.json()
+export async function updateAccountArk(c: Context) {
+ const slug = c.req.param('slug')!
+ const { naan } = await c.req.json()
- if (naan !== null && !/^\d{1,16}$/.test(naan,)) {
- return c.json({ error: 'NAAN must be numeric (up to 16 digits)', }, 400,)
+ if (naan !== null && !/^\d{1,16}$/.test(naan)) {
+ return c.json({ error: 'NAAN must be numeric (up to 16 digits)' }, 400)
}
- const [account,] = await db
- .select({ id: schema.accounts.id, type: schema.accounts.type, },)
- .from(schema.accounts,)
- .where(eq(schema.accounts.slug, slug,),)
- .limit(1,)
- if (!account) return c.json({ error: 'Account not found', }, 404,)
+ const [account] = await db
+ .select({ id: schema.accounts.id, type: schema.accounts.type })
+ .from(schema.accounts)
+ .where(eq(schema.accounts.slug, slug))
+ .limit(1)
+ if (!account) return c.json({ error: 'Account not found' }, 404)
// Must be owner/admin of the org (or the user themselves)
if (account.type === 'org') {
- const [membership,] = await db
- .select({ role: schema.orgMemberships.role, },)
- .from(schema.orgMemberships,)
+ const [membership] = await db
+ .select({ role: schema.orgMemberships.role })
+ .from(schema.orgMemberships)
.where(
and(
- eq(schema.orgMemberships.orgId, account.id,),
- eq(schema.orgMemberships.userId, c.get('accountId',)!,),
+ eq(schema.orgMemberships.orgId, account.id),
+ eq(schema.orgMemberships.userId, c.get('accountId')!),
),
)
- .limit(1,)
+ .limit(1)
if (!membership || (membership.role !== 'owner' && membership.role !== 'admin')) {
- return c.json({ error: 'Forbidden', }, 403,)
+ return c.json({ error: 'Forbidden' }, 403)
}
- } else if (account.id !== c.get('accountId',)) {
- return c.json({ error: 'Forbidden', }, 403,)
+ } else if (account.id !== c.get('accountId')) {
+ return c.json({ error: 'Forbidden' }, 403)
}
- await db.update(schema.accounts,).set({ arkNaan: naan, },).where(eq(schema.accounts.id, account.id,),)
- return c.json({ ok: true, },)
+ await db.update(schema.accounts).set({ arkNaan: naan }).where(eq(schema.accounts.id, account.id))
+ return c.json({ ok: true })
}
// --- Helpers ---
-async function checkCollectionAccess(ownerAccountId: string, requestAccountId: string,): Promise {
- const [account,] = await db
- .select({ id: schema.accounts.id, type: schema.accounts.type, },)
- .from(schema.accounts,)
- .where(eq(schema.accounts.id, ownerAccountId,),)
- .limit(1,)
+async function checkCollectionAccess(
+ ownerAccountId: string,
+ requestAccountId: string,
+): Promise {
+ const [account] = await db
+ .select({ id: schema.accounts.id, type: schema.accounts.type })
+ .from(schema.accounts)
+ .where(eq(schema.accounts.id, ownerAccountId))
+ .limit(1)
if (!account) return false
if (account.id === requestAccountId) return true
if (account.type === 'org') {
- const [membership,] = await db
- .select({ role: schema.orgMemberships.role, },)
- .from(schema.orgMemberships,)
+ const [membership] = await db
+ .select({ role: schema.orgMemberships.role })
+ .from(schema.orgMemberships)
.where(
and(
- eq(schema.orgMemberships.orgId, account.id,),
- eq(schema.orgMemberships.userId, requestAccountId,),
+ eq(schema.orgMemberships.orgId, account.id),
+ eq(schema.orgMemberships.userId, requestAccountId),
),
)
- .limit(1,)
+ .limit(1)
return !!membership
}
return false
diff --git a/src/api/auth.server.ts b/src/api/auth.server.ts
index 6de4056..2fa3a38 100644
--- a/src/api/auth.server.ts
+++ b/src/api/auth.server.ts
@@ -1,9 +1,10 @@
import bcrypt from 'bcrypt'
-import { eq, } from 'drizzle-orm'
-import type { Context, MiddlewareHandler, } from 'hono'
-import { deleteCookie, getCookie, setCookie, } from 'hono/cookie'
-import { createMiddleware, } from 'hono/factory'
-import { db, schema, } from '../db/client.server.js'
+import { eq } from 'drizzle-orm'
+import type { Context, MiddlewareHandler } from 'hono'
+import { deleteCookie, getCookie, setCookie } from 'hono/cookie'
+import { createMiddleware } from 'hono/factory'
+
+import { db, schema } from '../db/client.server.js'
export type AuthEnv = {
Variables: {
@@ -14,72 +15,72 @@ export type AuthEnv = {
}
}
-const publicPaths = new Set([
- '/api/health',
- '/api/accounts/signup',
- '/api/accounts/login',
- '/api/accounts/forgot-password',
- '/api/accounts/reset-password',
- '/api/query/generate-sql',
-],)
+const publicPaths = new Set(['/api/health', '/api/query/generate-sql'])
const internalToken = process.env.INTERNAL_API_TOKEN ?? 'internal-dev-token'
+const kfInternalApiKey = process.env.KF_INTERNAL_API_KEY ?? ''
const sessionSecret = process.env.SESSION_SECRET ?? 'dev-secret-change-me'
-export const authMiddleware = createMiddleware(async (c, next,) => {
- // Internal service calls
- const internalHeader = c.req.header('x-internal-token',)
+export const authMiddleware = createMiddleware(async (c, next) => {
+ // Internal service calls (legacy header)
+ const internalHeader = c.req.header('x-internal-token')
if (internalHeader === internalToken) {
- c.set('apiKeyScope', 'read',)
+ c.set('apiKeyScope', 'read')
+ return next()
+ }
+
+ // KF Auth internal API key (used by /api/kf/* endpoints)
+ const auth = c.req.header('authorization')
+ if (kfInternalApiKey && auth === `Bearer ${kfInternalApiKey}`) {
+ c.set('apiKeyScope', 'admin')
return next()
}
// API key auth via Bearer token
- const auth = c.req.header('authorization',)
- if (auth?.startsWith('Bearer ',)) {
- const token = auth.slice(7,)
- const keys = await db.select().from(schema.apiKeys,)
+ if (auth?.startsWith('Bearer ')) {
+ const token = auth.slice(7)
+ const keys = await db.select().from(schema.apiKeys)
let matched = false
for (const key of keys) {
- const match = await bcrypt.compare(token, key.keyHash,)
+ const match = await bcrypt.compare(token, key.keyHash)
if (match) {
- c.set('accountId', key.accountId,)
- c.set('apiKeyScope', key.scope as 'read' | 'write' | 'admin',)
- c.set('apiKeyCollectionId', key.collectionId,)
+ c.set('accountId', key.accountId)
+ c.set('apiKeyScope', key.scope as 'read' | 'write' | 'admin')
+ c.set('apiKeyCollectionId', key.collectionId)
await db
- .update(schema.apiKeys,)
- .set({ lastUsedAt: new Date(), },)
- .where(eq(schema.apiKeys.id, key.id,),)
+ .update(schema.apiKeys)
+ .set({ lastUsedAt: new Date() })
+ .where(eq(schema.apiKeys.id, key.id))
matched = true
break
}
}
if (!matched) {
- return c.json({ error: 'Invalid API key', statusCode: 401, }, 401,)
+ return c.json({ error: 'Invalid API key', statusCode: 401 }, 401)
}
return next()
}
// Session cookie auth
- const sessionCookie = getCookie(c, 'session',)
+ const sessionCookie = getCookie(c, 'session')
if (sessionCookie) {
try {
// Try to parse as signed cookie (value.signature format)
let sessionId = sessionCookie
- const dotIdx = sessionCookie.lastIndexOf('.',)
+ const dotIdx = sessionCookie.lastIndexOf('.')
if (dotIdx > 0) {
- sessionId = sessionCookie.slice(0, dotIdx,)
+ sessionId = sessionCookie.slice(0, dotIdx)
}
if (sessionId) {
- const [session,] = await db
+ const [session] = await db
.select()
- .from(schema.sessions,)
- .where(eq(schema.sessions.id, sessionId,),)
- .limit(1,)
- if (session && new Date(session.expiresAt,) > new Date()) {
- c.set('sessionUserId', session.userId,)
- c.set('accountId', session.userId,)
- c.set('apiKeyScope', 'admin',)
+ .from(schema.sessions)
+ .where(eq(schema.sessions.id, sessionId))
+ .limit(1)
+ if (session && new Date(session.expiresAt) > new Date()) {
+ c.set('sessionUserId', session.userId)
+ c.set('accountId', session.userId)
+ c.set('apiKeyScope', 'admin')
}
}
} catch {
@@ -91,41 +92,41 @@ export const authMiddleware = createMiddleware(async (c, next,) => {
if (c.req.method === 'GET') return next()
// All writes require auth, except public paths
- if (!c.get('accountId',)) {
- const path = new URL(c.req.url,).pathname
- if (publicPaths.has(path,)) return next()
- return c.json({ error: 'Authentication required', statusCode: 401, }, 401,)
+ if (!c.get('accountId')) {
+ const path = new URL(c.req.url).pathname
+ if (publicPaths.has(path)) return next()
+ return c.json({ error: 'Authentication required', statusCode: 401 }, 401)
}
return next()
-},)
+})
-export function requireAuth(scope?: 'read' | 'write' | 'admin',): MiddlewareHandler {
- return async (c, next,) => {
- if (!c.get('accountId',)) {
- return c.json({ error: 'Authentication required', statusCode: 401, }, 401,)
+export function requireAuth(scope?: 'read' | 'write' | 'admin'): MiddlewareHandler {
+ return async (c, next) => {
+ if (!c.get('accountId')) {
+ return c.json({ error: 'Authentication required', statusCode: 401 }, 401)
}
- if (scope === 'admin' && c.get('apiKeyScope',) !== 'admin') {
- return c.json({ error: 'Admin access required', statusCode: 403, }, 403,)
+ if (scope === 'admin' && c.get('apiKeyScope') !== 'admin') {
+ return c.json({ error: 'Admin access required', statusCode: 403 }, 403)
}
- if (scope === 'write' && c.get('apiKeyScope',) === 'read') {
- return c.json({ error: 'Write access required', statusCode: 403, }, 403,)
+ if (scope === 'write' && c.get('apiKeyScope') === 'read') {
+ return c.json({ error: 'Write access required', statusCode: 403 }, 403)
}
return next()
}
}
// Helper to set signed session cookie
-export function setSessionCookie(c: Context, sessionId: string,) {
+export function setSessionCookie(c: Context, sessionId: string) {
setCookie(c, 'session', sessionId, {
httpOnly: true,
secure: process.env.NODE_ENV === 'production',
sameSite: 'Lax',
path: '/',
maxAge: 30 * 24 * 60 * 60, // 30 days
- },)
+ })
}
-export function clearSessionCookie(c: Context,) {
- deleteCookie(c, 'session', { path: '/', },)
+export function clearSessionCookie(c: Context) {
+ deleteCookie(c, 'session', { path: '/' })
}
diff --git a/src/api/collections.ts b/src/api/collections.ts
index b43f6b6..80b6a2e 100644
--- a/src/api/collections.ts
+++ b/src/api/collections.ts
@@ -1,28 +1,30 @@
-import { and, eq, ilike, or, sql, } from 'drizzle-orm'
-import type { Context, } from 'hono'
-import { stream, } from 'hono/streaming'
-import { createGzip, } from 'node:zlib'
-import { pack as tarPack, } from 'tar-stream'
-import { v4 as uuidv4, } from 'uuid'
-import { db, schema, } from '../db/client.server.js'
-import { buildArkUrl, collectionToArkId, DEFAULT_NAAN, getOrMintShoulder, } from '../lib/ark.js'
-import { downloadFromS3, } from '../lib/s3.js'
-import { type AuthEnv, } from './auth.server.js'
+import { createGzip } from 'node:zlib'
+
+import { and, eq, ilike, or, sql } from 'drizzle-orm'
+import type { Context } from 'hono'
+import { stream } from 'hono/streaming'
+import { pack as tarPack } from 'tar-stream'
+import { v4 as uuidv4 } from 'uuid'
+
+import { db, schema } from '../db/client.server.js'
+import { buildArkUrl, collectionToArkId, DEFAULT_NAAN, getOrMintShoulder } from '../lib/ark.js'
+import { downloadFromS3 } from '../lib/s3.js'
+import { type AuthEnv } from './auth.server.js'
// Browse public collections
-export async function list(c: Context,) {
- const q = c.req.query('q',)
- const limit = c.req.query('limit',)
- const offset = c.req.query('offset',)
- const take = Math.min(parseInt(limit ?? '50', 10,), 100,)
- const skip = parseInt(offset ?? '0', 10,)
-
- const conditions = [eq(schema.collections.public, true,),]
+export async function list(c: Context) {
+ const q = c.req.query('q')
+ const limit = c.req.query('limit')
+ const offset = c.req.query('offset')
+ const take = Math.min(parseInt(limit ?? '50', 10), 100)
+ const skip = parseInt(offset ?? '0', 10)
+
+ const conditions = [eq(schema.collections.public, true)]
if (q) {
conditions.push(
or(
- ilike(schema.collections.name, `%${q}%`,),
- ilike(schema.collections.description, `%${q}%`,),
+ ilike(schema.collections.name, `%${q}%`),
+ ilike(schema.collections.description, `%${q}%`),
)!,
)
}
@@ -37,21 +39,26 @@ export async function list(c: Context,) {
ownerName: schema.accounts.displayName,
createdAt: schema.collections.createdAt,
updatedAt: schema.collections.updatedAt,
- },)
- .from(schema.collections,)
- .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id,),)
- .where(and(...conditions,),)
- .limit(take,)
- .offset(skip,)
- .orderBy(schema.collections.updatedAt,)
-
- return c.json(results,)
+ })
+ .from(schema.collections)
+ .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id))
+ .where(and(...conditions))
+ .limit(take)
+ .offset(skip)
+ .orderBy(schema.collections.updatedAt)
+
+ return c.json(results)
}
// Create collection
-export async function create(c: Context,) {
- const owner = c.req.param('owner',)!
- const { slug, name, description, public: isPublic, } = await c.req.json<{
+export async function create(c: Context) {
+ const owner = c.req.param('owner')!
+ const {
+ slug,
+ name,
+ description,
+ public: isPublic,
+ } = await c.req.json<{
slug: string
name: string
description?: string
@@ -59,82 +66,77 @@ export async function create(c: Context,) {
}>()
// Resolve owner account
- const [account,] = await db
+ const [account] = await db
.select()
- .from(schema.accounts,)
- .where(eq(schema.accounts.slug, owner,),)
- .limit(1,)
+ .from(schema.accounts)
+ .where(eq(schema.accounts.slug, owner))
+ .limit(1)
if (!account) {
- return c.json({ error: 'Account not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'Account not found', statusCode: 404 }, 404)
}
// Check permission: user must own the account or be a member of the org
- if (account.type === 'user' && account.id !== c.get('accountId',)) {
- return c.json({ error: 'Forbidden', statusCode: 403, }, 403,)
+ if (account.type === 'user' && account.id !== c.get('accountId')) {
+ return c.json({ error: 'Forbidden', statusCode: 403 }, 403)
}
if (account.type === 'org') {
- const [membership,] = await db
+ const [membership] = await db
.select()
- .from(schema.orgMemberships,)
+ .from(schema.orgMemberships)
.where(
and(
- eq(schema.orgMemberships.orgId, account.id,),
- eq(schema.orgMemberships.userId, c.get('accountId',)!,),
+ eq(schema.orgMemberships.orgId, account.id),
+ eq(schema.orgMemberships.userId, c.get('accountId')!),
),
)
- .limit(1,)
+ .limit(1)
if (!membership) {
- return c.json({ error: 'Forbidden', statusCode: 403, }, 403,)
+ return c.json({ error: 'Forbidden', statusCode: 403 }, 403)
}
}
// Check for existing collection with same slug under this owner
- const [existing,] = await db
- .select({ id: schema.collections.id, },)
- .from(schema.collections,)
- .where(
- and(
- eq(schema.collections.accountId, account.id,),
- eq(schema.collections.slug, slug,),
- ),
- )
- .limit(1,)
+ const [existing] = await db
+ .select({ id: schema.collections.id })
+ .from(schema.collections)
+ .where(and(eq(schema.collections.accountId, account.id), eq(schema.collections.slug, slug)))
+ .limit(1)
if (existing) {
- return c.json({ error: 'Collection already exists', statusCode: 409, }, 409,)
+ return c.json({ error: 'Collection already exists', statusCode: 409 }, 409)
}
const id = uuidv4()
- await db.insert(schema.collections,).values({
+ await db.insert(schema.collections).values({
id,
accountId: account.id,
slug,
name,
description: description ?? null,
public: isPublic ?? false,
- },)
+ })
// Auto-mint ARK for the new collection
try {
- const shoulder = await getOrMintShoulder(account.id,)
- const arkId = collectionToArkId(id,)
- await db.insert(schema.arkCollections,).values({ collectionId: id, arkId, enabled: true, },)
+ const shoulder = await getOrMintShoulder(account.id)
+ const arkId = collectionToArkId(id)
+ await db.insert(schema.arkCollections).values({ collectionId: id, arkId, enabled: true })
const naan = account.arkNaan ?? DEFAULT_NAAN
- const arkUrl = buildArkUrl(naan, shoulder, arkId,)
- return c.json({ id, owner, slug, name, ark: arkUrl, }, 201,)
+ const arkUrl = buildArkUrl(naan, shoulder, arkId)
+ return c.json({ id, owner, slug, name, ark: arkUrl }, 201)
} catch {
// ARK minting failure is non-fatal
- return c.json({ id, owner, slug, name, }, 201,)
+ return c.json({ id, owner, slug, name }, 201)
}
}
// Get collection
-export async function get(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
+export async function get(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
- const [result,] = await db
+ const [result] = await db
.select({
id: schema.collections.id,
slug: schema.collections.slug,
@@ -146,50 +148,50 @@ export async function get(c: Context,) {
ownerType: schema.accounts.type,
createdAt: schema.collections.createdAt,
updatedAt: schema.collections.updatedAt,
- },)
- .from(schema.collections,)
- .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id,),)
- .where(and(eq(schema.accounts.slug, owner,), eq(schema.collections.slug, slug,),),)
- .limit(1,)
+ })
+ .from(schema.collections)
+ .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id))
+ .where(and(eq(schema.accounts.slug, owner), eq(schema.collections.slug, slug)))
+ .limit(1)
if (!result) {
- return c.json({ error: 'Collection not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'Collection not found', statusCode: 404 }, 404)
}
- if (!result.public && c.get('accountId',) !== result.id) {
+ if (!result.public && c.get('accountId') !== result.id) {
// Check if user owns or is member of the owning account
- const [account,] = await db
+ const [account] = await db
.select()
- .from(schema.accounts,)
- .where(eq(schema.accounts.slug, owner,),)
- .limit(1,)
+ .from(schema.accounts)
+ .where(eq(schema.accounts.slug, owner))
+ .limit(1)
if (!account) {
- return c.json({ error: 'Collection not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'Collection not found', statusCode: 404 }, 404)
}
- let hasAccess = account.id === c.get('accountId',)
+ let hasAccess = account.id === c.get('accountId')
if (!hasAccess && account.type === 'org') {
- const [membership,] = await db
+ const [membership] = await db
.select()
- .from(schema.orgMemberships,)
+ .from(schema.orgMemberships)
.where(
and(
- eq(schema.orgMemberships.orgId, account.id,),
- eq(schema.orgMemberships.userId, c.get('accountId',)!,),
+ eq(schema.orgMemberships.orgId, account.id),
+ eq(schema.orgMemberships.userId, c.get('accountId')!),
),
)
- .limit(1,)
+ .limit(1)
hasAccess = !!membership
}
if (!hasAccess) {
- return c.json({ error: 'Collection not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'Collection not found', statusCode: 404 }, 404)
}
}
// Get latest version info
- const [latestVersion,] = await db
+ const [latestVersion] = await db
.select({
id: schema.versions.id,
number: schema.versions.number,
@@ -200,11 +202,11 @@ export async function get(c: Context,) {
createdAt: schema.versions.createdAt,
message: schema.versions.message,
readme: schema.versions.readme,
- },)
- .from(schema.versions,)
- .where(eq(schema.versions.collectionId, result.id,),)
- .orderBy(sql`${schema.versions.number} desc`,)
- .limit(1,)
+ })
+ .from(schema.versions)
+ .where(eq(schema.versions.collectionId, result.id))
+ .orderBy(sql`${schema.versions.number} desc`)
+ .limit(1)
// Get per-type record counts for latest version
let typeCounts: { type: string; count: number }[] = []
@@ -213,138 +215,283 @@ export async function get(c: Context,) {
.select({
type: schema.records.type,
count: sql`count(*)::int`,
- },)
- .from(schema.records,)
- .where(eq(schema.records.versionId, latestVersion.id,),)
- .groupBy(schema.records.type,)
- typeCounts = rows.map((r,) => ({ type: r.type, count: r.count, }))
+ })
+ .from(schema.records)
+ .where(eq(schema.records.versionId, latestVersion.id))
+ .groupBy(schema.records.type)
+ typeCounts = rows.map((r) => ({ type: r.type, count: r.count }))
}
// Fetch ARK URL if enabled
let ark: string | null = null
try {
- const [arkRow,] = await db
+ const [arkRow] = await db
.select({
arkId: schema.arkCollections.arkId,
enabled: schema.arkCollections.enabled,
shoulder: schema.arkShoulders.shoulder,
ownerNaan: schema.accounts.arkNaan,
- },)
- .from(schema.arkCollections,)
- .innerJoin(schema.collections, eq(schema.arkCollections.collectionId, schema.collections.id,),)
- .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id,),)
- .innerJoin(schema.arkShoulders, eq(schema.arkShoulders.accountId, schema.accounts.id,),)
- .where(eq(schema.arkCollections.collectionId, result.id,),)
- .limit(1,)
+ })
+ .from(schema.arkCollections)
+ .innerJoin(schema.collections, eq(schema.arkCollections.collectionId, schema.collections.id))
+ .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id))
+ .innerJoin(schema.arkShoulders, eq(schema.arkShoulders.accountId, schema.accounts.id))
+ .where(eq(schema.arkCollections.collectionId, result.id))
+ .limit(1)
if (arkRow?.enabled) {
- ark = buildArkUrl(arkRow.ownerNaan ?? DEFAULT_NAAN, arkRow.shoulder, arkRow.arkId,)
+ ark = buildArkUrl(arkRow.ownerNaan ?? DEFAULT_NAAN, arkRow.shoulder, arkRow.arkId)
}
} catch {
// Non-fatal
}
- const { id: _vid, ...latestVersionData } = latestVersion ?? { id: undefined, }
- return c.json({ ...result, ark, latestVersion: latestVersion ? { ...latestVersionData, typeCounts, } : null, },)
+ const { id: _vid, ...latestVersionData } = latestVersion ?? { id: undefined }
+ return c.json({
+ ...result,
+ ark,
+ latestVersion: latestVersion ? { ...latestVersionData, typeCounts } : null,
+ })
}
// Update collection
-export async function update(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
+export async function update(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
const updates = await c.req.json<{
name?: string
+ slug?: string
description?: string
public?: boolean
}>()
- const [account,] = await db
+ const [account] = await db
.select()
- .from(schema.accounts,)
- .where(eq(schema.accounts.slug, owner,),)
- .limit(1,)
+ .from(schema.accounts)
+ .where(eq(schema.accounts.slug, owner))
+ .limit(1)
if (!account) {
- return c.json({ error: 'Not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'Not found', statusCode: 404 }, 404)
}
- const [collection,] = await db
+ const [collection] = await db
.select()
- .from(schema.collections,)
- .where(and(eq(schema.collections.accountId, account.id,), eq(schema.collections.slug, slug,),),)
- .limit(1,)
+ .from(schema.collections)
+ .where(and(eq(schema.collections.accountId, account.id), eq(schema.collections.slug, slug)))
+ .limit(1)
if (!collection) {
- return c.json({ error: 'Not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'Not found', statusCode: 404 }, 404)
+ }
+
+ // Validate new slug if provided
+ if (updates.slug !== undefined) {
+ const newSlug = updates.slug
+ if (!newSlug || typeof newSlug !== 'string') {
+ return c.json({ error: 'Slug is required', statusCode: 422 }, 422)
+ }
+ if (!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(newSlug)) {
+ return c.json(
+ { error: 'Slug must be lowercase alphanumeric with hyphens', statusCode: 422 },
+ 422,
+ )
+ }
+ // Check uniqueness within same account
+ const [existing] = await db
+ .select({ id: schema.collections.id })
+ .from(schema.collections)
+ .where(
+ and(eq(schema.collections.accountId, account.id), eq(schema.collections.slug, newSlug)),
+ )
+ .limit(1)
+
+ if (existing && existing.id !== collection.id) {
+ return c.json({ error: 'A collection with that slug already exists', statusCode: 409 }, 409)
+ }
}
await db
- .update(schema.collections,)
- .set({ ...updates, updatedAt: new Date(), },)
- .where(eq(schema.collections.id, collection.id,),)
+ .update(schema.collections)
+ .set({ ...updates, updatedAt: new Date() })
+ .where(eq(schema.collections.id, collection.id))
- return c.json({ ok: true, },)
+ return c.json({ ok: true, slug: updates.slug ?? slug })
}
// Delete collection
-export async function remove(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
+export async function remove(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
- const [account,] = await db
+ const [account] = await db
.select()
- .from(schema.accounts,)
- .where(eq(schema.accounts.slug, owner,),)
- .limit(1,)
+ .from(schema.accounts)
+ .where(eq(schema.accounts.slug, owner))
+ .limit(1)
if (!account) {
- return c.json({ error: 'Not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'Not found', statusCode: 404 }, 404)
}
- const [collection,] = await db
+ const [collection] = await db
.select()
- .from(schema.collections,)
- .where(and(eq(schema.collections.accountId, account.id,), eq(schema.collections.slug, slug,),),)
- .limit(1,)
+ .from(schema.collections)
+ .where(and(eq(schema.collections.accountId, account.id), eq(schema.collections.slug, slug)))
+ .limit(1)
if (!collection) {
- return c.json({ error: 'Not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'Not found', statusCode: 404 }, 404)
+ }
+
+ await db.delete(schema.collections).where(eq(schema.collections.id, collection.id))
+ return c.json({ ok: true })
+}
+
+// Transfer collection to another account
+export async function transfer(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
+ const { targetAccountSlug } = await c.req.json()
+
+ if (!targetAccountSlug || typeof targetAccountSlug !== 'string') {
+ return c.json({ error: 'targetAccountSlug is required', statusCode: 422 }, 422)
+ }
+
+ const callerId = c.get('accountId')!
+
+ // Find source account
+ const [sourceAccount] = await db
+ .select()
+ .from(schema.accounts)
+ .where(eq(schema.accounts.slug, owner))
+ .limit(1)
+
+ if (!sourceAccount) return c.json({ error: 'Source account not found', statusCode: 404 }, 404)
+
+ // Verify caller has access to source account
+ const callerIsSource = sourceAccount.id === callerId
+ let callerHasSourceAccess = callerIsSource
+ if (!callerIsSource && sourceAccount.type === 'org') {
+ const [membership] = await db
+ .select()
+ .from(schema.orgMemberships)
+ .where(
+ and(
+ eq(schema.orgMemberships.orgId, sourceAccount.id),
+ eq(schema.orgMemberships.userId, callerId),
+ ),
+ )
+ .limit(1)
+ callerHasSourceAccess =
+ !!membership && (membership.role === 'owner' || membership.role === 'admin')
+ }
+ if (!callerHasSourceAccess) {
+ return c.json(
+ { error: 'You must be an owner or admin of the source account', statusCode: 403 },
+ 403,
+ )
+ }
+
+ // Find target account
+ const [targetAccount] = await db
+ .select()
+ .from(schema.accounts)
+ .where(eq(schema.accounts.slug, targetAccountSlug))
+ .limit(1)
+
+ if (!targetAccount) return c.json({ error: 'Target account not found', statusCode: 404 }, 404)
+
+ // Verify caller has access to target account
+ const callerIsTarget = targetAccount.id === callerId
+ let callerHasTargetAccess = callerIsTarget
+ if (!callerIsTarget && targetAccount.type === 'org') {
+ const [membership] = await db
+ .select()
+ .from(schema.orgMemberships)
+ .where(
+ and(
+ eq(schema.orgMemberships.orgId, targetAccount.id),
+ eq(schema.orgMemberships.userId, callerId),
+ ),
+ )
+ .limit(1)
+ callerHasTargetAccess =
+ !!membership && (membership.role === 'owner' || membership.role === 'admin')
+ }
+ if (!callerHasTargetAccess) {
+ return c.json(
+ { error: 'You must be an owner or admin of the target account', statusCode: 403 },
+ 403,
+ )
}
- await db.delete(schema.collections,).where(eq(schema.collections.id, collection.id,),)
- return c.json({ ok: true, },)
+ // Find collection
+ const [collection] = await db
+ .select()
+ .from(schema.collections)
+ .where(
+ and(eq(schema.collections.accountId, sourceAccount.id), eq(schema.collections.slug, slug)),
+ )
+ .limit(1)
+
+ if (!collection) return c.json({ error: 'Collection not found', statusCode: 404 }, 404)
+
+ // Check slug uniqueness in target account
+ const [existing] = await db
+ .select({ id: schema.collections.id })
+ .from(schema.collections)
+ .where(
+ and(eq(schema.collections.accountId, targetAccount.id), eq(schema.collections.slug, slug)),
+ )
+ .limit(1)
+
+ if (existing) {
+ return c.json(
+ { error: `Target account already has a collection with slug "${slug}"`, statusCode: 409 },
+ 409,
+ )
+ }
+
+ // Transfer
+ await db
+ .update(schema.collections)
+ .set({ accountId: targetAccount.id, updatedAt: new Date() })
+ .where(eq(schema.collections.id, collection.id))
+
+ return c.json({ ok: true, newOwner: targetAccountSlug })
}
// List collections for an account
-export async function listByOwner(c: Context,) {
- const owner = c.req.param('owner',)!
+export async function listByOwner(c: Context) {
+ const owner = c.req.param('owner')!
- const [account,] = await db
+ const [account] = await db
.select()
- .from(schema.accounts,)
- .where(eq(schema.accounts.slug, owner,),)
- .limit(1,)
+ .from(schema.accounts)
+ .where(eq(schema.accounts.slug, owner))
+ .limit(1)
- if (!account) return c.json([],)
+ if (!account) return c.json([])
// Check if the requester owns this account or is an org member
- let hasFullAccess = c.get('accountId',) === account.id
- if (!hasFullAccess && account.type === 'org' && c.get('accountId',)) {
- const [membership,] = await db
+ let hasFullAccess = c.get('accountId') === account.id
+ if (!hasFullAccess && account.type === 'org' && c.get('accountId')) {
+ const [membership] = await db
.select()
- .from(schema.orgMemberships,)
+ .from(schema.orgMemberships)
.where(
and(
- eq(schema.orgMemberships.orgId, account.id,),
- eq(schema.orgMemberships.userId, c.get('accountId',)!,),
+ eq(schema.orgMemberships.orgId, account.id),
+ eq(schema.orgMemberships.userId, c.get('accountId')!),
),
)
- .limit(1,)
+ .limit(1)
hasFullAccess = !!membership
}
- const conditions = [eq(schema.collections.accountId, account.id,),]
+ const conditions = [eq(schema.collections.accountId, account.id)]
if (!hasFullAccess) {
- conditions.push(eq(schema.collections.public, true,),)
+ conditions.push(eq(schema.collections.public, true))
}
const results = await db
@@ -356,22 +503,22 @@ export async function listByOwner(c: Context,) {
public: schema.collections.public,
createdAt: schema.collections.createdAt,
updatedAt: schema.collections.updatedAt,
- },)
- .from(schema.collections,)
- .where(and(...conditions,),)
- .orderBy(schema.collections.updatedAt,)
+ })
+ .from(schema.collections)
+ .where(and(...conditions))
+ .orderBy(schema.collections.updatedAt)
- return c.json(results,)
+ return c.json(results)
}
// Export collection as .tar.gz archive
-export async function exportArchive(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
- const versionParam = c.req.query('version',)
+export async function exportArchive(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
+ const versionParam = c.req.query('version')
// Resolve collection
- const [collection,] = await db
+ const [collection] = await db
.select({
id: schema.collections.id,
slug: schema.collections.slug,
@@ -379,35 +526,35 @@ export async function exportArchive(c: Context,) {
description: schema.collections.description,
public: schema.collections.public,
accountId: schema.collections.accountId,
- },)
- .from(schema.collections,)
- .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id,),)
- .where(and(eq(schema.accounts.slug, owner,), eq(schema.collections.slug, slug,),),)
- .limit(1,)
+ })
+ .from(schema.collections)
+ .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id))
+ .where(and(eq(schema.accounts.slug, owner), eq(schema.collections.slug, slug)))
+ .limit(1)
if (!collection) {
- return c.json({ error: 'Collection not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'Collection not found', statusCode: 404 }, 404)
}
- if (!collection.public && c.get('accountId',) !== collection.accountId) {
- return c.json({ error: 'Collection not found', statusCode: 404, }, 404,)
+ if (!collection.public && c.get('accountId') !== collection.accountId) {
+ return c.json({ error: 'Collection not found', statusCode: 404 }, 404)
}
// Resolve version (latest if not specified)
- const versionConditions = [eq(schema.versions.collectionId, collection.id,),]
+ const versionConditions = [eq(schema.versions.collectionId, collection.id)]
if (versionParam) {
- versionConditions.push(eq(schema.versions.number, parseInt(versionParam, 10,),),)
+ versionConditions.push(eq(schema.versions.number, parseInt(versionParam, 10)))
}
- const [version,] = await db
+ const [version] = await db
.select()
- .from(schema.versions,)
- .where(and(...versionConditions,),)
- .orderBy(sql`${schema.versions.number} desc`,)
- .limit(1,)
+ .from(schema.versions)
+ .where(and(...versionConditions))
+ .orderBy(sql`${schema.versions.number} desc`)
+ .limit(1)
if (!version) {
- return c.json({ error: 'No versions found', statusCode: 404, }, 404,)
+ return c.json({ error: 'No versions found', statusCode: 404 }, 404)
}
// Fetch records and files for this version
@@ -416,9 +563,9 @@ export async function exportArchive(c: Context,) {
recordId: schema.records.recordId,
type: schema.records.type,
data: schema.records.data,
- },)
- .from(schema.records,)
- .where(eq(schema.records.versionId, version.id,),)
+ })
+ .from(schema.records)
+ .where(eq(schema.records.versionId, version.id))
const versionFiles = await db
.select({
@@ -426,28 +573,26 @@ export async function exportArchive(c: Context,) {
size: schema.files.size,
mimeType: schema.files.mimeType,
storageKey: schema.files.storageKey,
- },)
- .from(schema.versionFiles,)
- .innerJoin(schema.files, eq(schema.versionFiles.fileHash, schema.files.hash,),)
- .where(eq(schema.versionFiles.versionId, version.id,),)
+ })
+ .from(schema.versionFiles)
+ .innerJoin(schema.files, eq(schema.versionFiles.fileHash, schema.files.hash))
+ .where(eq(schema.versionFiles.versionId, version.id))
// Load schemas for this version
const versionSchemaEntries = await db
.select({
slug: schema.versionSchemas.slug,
schemaBody: schema.schemas.schema,
- },)
- .from(schema.versionSchemas,)
- .innerJoin(schema.schemas, eq(schema.versionSchemas.schemaId, schema.schemas.id,),)
- .where(eq(schema.versionSchemas.versionId, version.id,),)
+ })
+ .from(schema.versionSchemas)
+ .innerJoin(schema.schemas, eq(schema.versionSchemas.schemaId, schema.schemas.id))
+ .where(eq(schema.versionSchemas.versionId, version.id))
- const schemasMap = Object.fromEntries(
- versionSchemaEntries.map((e,) => [e.slug, e.schemaBody,]),
- )
+ const schemasMap = Object.fromEntries(versionSchemaEntries.map((e) => [e.slug, e.schemaBody]))
// Add manifest.json
const manifest = {
- collection: { owner, slug, name: collection.name, description: collection.description, },
+ collection: { owner, slug, name: collection.name, description: collection.description },
version: {
number: version.number,
semver: version.semver,
@@ -468,28 +613,30 @@ export async function exportArchive(c: Context,) {
const filename = `${owner}-${slug}-v${version.number}.tar.gz`
// Add manifest
- const manifestBuf = Buffer.from(JSON.stringify(manifest, null, 2,),)
- pack.entry({ name: 'manifest.json', size: manifestBuf.length, }, manifestBuf,)
+ const manifestBuf = Buffer.from(JSON.stringify(manifest, null, 2))
+ pack.entry({ name: 'manifest.json', size: manifestBuf.length }, manifestBuf)
// Add records as NDJSON grouped by type
const recordsByType = new Map()
for (const rec of records) {
- const existing = recordsByType.get(rec.type,) ?? []
- existing.push(rec,)
- recordsByType.set(rec.type, existing,)
+ const existing = recordsByType.get(rec.type) ?? []
+ existing.push(rec)
+ recordsByType.set(rec.type, existing)
}
- for (const [type, typeRecords,] of recordsByType) {
- const lines = typeRecords.map((r,) => JSON.stringify({ id: r.recordId, type: r.type, data: r.data, },))
- const buf = Buffer.from(lines.join('\n',) + '\n',)
- pack.entry({ name: `records/${type}.ndjson`, size: buf.length, }, buf,)
+ for (const [type, typeRecords] of recordsByType) {
+ const lines = typeRecords.map((r) =>
+ JSON.stringify({ id: r.recordId, type: r.type, data: r.data }),
+ )
+ const buf = Buffer.from(lines.join('\n') + '\n')
+ pack.entry({ name: `records/${type}.ndjson`, size: buf.length }, buf)
}
// Add files
for (const file of versionFiles) {
try {
- const fileBuffer = await downloadFromS3(file.storageKey,)
- pack.entry({ name: `files/${file.hash}`, size: fileBuffer.length, }, fileBuffer,)
+ const fileBuffer = await downloadFromS3(file.storageKey)
+ pack.entry({ name: `files/${file.hash}`, size: fileBuffer.length }, fileBuffer)
} catch {
// Skip files that can't be downloaded (shouldn't happen in normal operation)
}
@@ -498,23 +645,23 @@ export async function exportArchive(c: Context,) {
pack.finalize()
// Pipe tar → gzip and collect into a ReadableStream
- const outputStream = pack.pipe(gzip,)
+ const outputStream = pack.pipe(gzip)
const readableStream = new ReadableStream({
- start(controller,) {
- outputStream.on('data', (chunk: Buffer,) => {
- controller.enqueue(new Uint8Array(chunk,),)
- },)
+ start(controller) {
+ outputStream.on('data', (chunk: Buffer) => {
+ controller.enqueue(new Uint8Array(chunk))
+ })
outputStream.on('end', () => {
controller.close()
- },)
- outputStream.on('error', (err,) => {
- controller.error(err,)
- },)
+ })
+ outputStream.on('error', (err) => {
+ controller.error(err)
+ })
},
- },)
+ })
return c.body(readableStream, 200, {
'Content-Type': 'application/gzip',
'Content-Disposition': `attachment; filename="${filename}"`,
- },)
+ })
}
diff --git a/src/api/files.ts b/src/api/files.ts
index cae4f49..ea3aac6 100644
--- a/src/api/files.ts
+++ b/src/api/files.ts
@@ -1,9 +1,11 @@
-import { and, eq, sql, } from 'drizzle-orm'
-import type { Context, } from 'hono'
-import { createHash, } from 'node:crypto'
-import { db, schema, } from '../db/client.server.js'
-import { getS3ObjectMeta, uploadToS3, } from '../lib/s3.js'
-import { type AuthEnv, } from './auth.server.js'
+import { createHash } from 'node:crypto'
+
+import { and, eq, sql } from 'drizzle-orm'
+import type { Context } from 'hono'
+
+import { db, schema } from '../db/client.server.js'
+import { getS3ObjectMeta, uploadToS3 } from '../lib/s3.js'
+import { type AuthEnv } from './auth.server.js'
/**
* Check if a file hash is referenced by any public (non-private) record
@@ -16,15 +18,15 @@ async function isFilePubliclyAccessible(
accountId: string | undefined,
): Promise {
// Resolve collection
- const [collection,] = await db
+ const [collection] = await db
.select({
id: schema.collections.id,
accountId: schema.collections.accountId,
- },)
- .from(schema.collections,)
- .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id,),)
- .where(and(eq(schema.accounts.slug, owner,), eq(schema.collections.slug, slug,),),)
- .limit(1,)
+ })
+ .from(schema.collections)
+ .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id))
+ .where(and(eq(schema.accounts.slug, owner), eq(schema.collections.slug, slug)))
+ .limit(1)
if (!collection) return false
@@ -34,23 +36,23 @@ async function isFilePubliclyAccessible(
}
// Get the latest version
- const [latest,] = await db
- .select({ id: schema.versions.id, },)
- .from(schema.versions,)
- .where(eq(schema.versions.collectionId, collection.id,),)
- .orderBy(sql`${schema.versions.number} desc`,)
- .limit(1,)
+ const [latest] = await db
+ .select({ id: schema.versions.id })
+ .from(schema.versions)
+ .where(eq(schema.versions.collectionId, collection.id))
+ .orderBy(sql`${schema.versions.number} desc`)
+ .limit(1)
if (!latest) return false
// Check if file is associated with this version at all
- const [vf,] = await db
- .select({ fileHash: schema.versionFiles.fileHash, },)
- .from(schema.versionFiles,)
+ const [vf] = await db
+ .select({ fileHash: schema.versionFiles.fileHash })
+ .from(schema.versionFiles)
.where(
- and(eq(schema.versionFiles.versionId, latest.id,), eq(schema.versionFiles.fileHash, fileHash,),),
+ and(eq(schema.versionFiles.versionId, latest.id), eq(schema.versionFiles.fileHash, fileHash)),
)
- .limit(1,)
+ .limit(1)
if (!vf) return false
@@ -59,56 +61,56 @@ async function isFilePubliclyAccessible(
.select({
slug: schema.versionSchemas.slug,
schemaBody: schema.schemas.schema,
- },)
- .from(schema.versionSchemas,)
- .innerJoin(schema.schemas, eq(schema.versionSchemas.schemaId, schema.schemas.id,),)
- .where(eq(schema.versionSchemas.versionId, latest.id,),)
+ })
+ .from(schema.versionSchemas)
+ .innerJoin(schema.schemas, eq(schema.versionSchemas.schemaId, schema.schemas.id))
+ .where(eq(schema.versionSchemas.versionId, latest.id))
const privateTypes = new Set()
const typeSchemaMap = new Map>()
for (const entry of schemaEntries) {
const body = entry.schemaBody as Record
- typeSchemaMap.set(entry.slug, body,)
- if (body?.private === true) privateTypes.add(entry.slug,)
+ typeSchemaMap.set(entry.slug, body)
+ if (body?.private === true) privateTypes.add(entry.slug)
}
// Find public records that reference this file hash
// A record references a file if its data JSON contains the hash string
const records = await db
- .select({ type: schema.records.type, data: schema.records.data, },)
- .from(schema.records,)
+ .select({ type: schema.records.type, data: schema.records.data })
+ .from(schema.records)
.where(
and(
- eq(schema.records.versionId, latest.id,),
- eq(schema.records.private, false,),
+ eq(schema.records.versionId, latest.id),
+ eq(schema.records.private, false),
sql`${schema.records.data}::text LIKE ${'%' + fileHash + '%'}`,
),
)
- .limit(10,)
+ .limit(10)
// Check if any matching record is a public type with the file in a public field
for (const rec of records) {
- if (privateTypes.has(rec.type,)) continue
+ if (privateTypes.has(rec.type)) continue
// Get private fields for this type
- const typeSchema = typeSchemaMap.get(rec.type,)
+ const typeSchema = typeSchemaMap.get(rec.type)
const typeProps = typeSchema?.properties as Record | undefined
if (!typeProps) return true // no schema constraints, allow
const privateFields = new Set()
- for (const [fieldName, fieldDef,] of Object.entries(typeProps,)) {
- if ((fieldDef as any)?.private === true) privateFields.add(fieldName,)
+ for (const [fieldName, fieldDef] of Object.entries(typeProps)) {
+ if ((fieldDef as any)?.private === true) privateFields.add(fieldName)
}
// Check if the file reference is in a public field
const data = rec.data as Record
- for (const [key, val,] of Object.entries(data,)) {
- if (privateFields.has(key,)) continue
+ for (const [key, val] of Object.entries(data)) {
+ if (privateFields.has(key)) continue
if (
- val
- && typeof val === 'object'
- && '$file' in val
- && (val as { $file: string }).$file === `sha256:${fileHash}`
+ val &&
+ typeof val === 'object' &&
+ '$file' in val &&
+ (val as { $file: string }).$file === `sha256:${fileHash}`
) {
return true // found in a public field of a public record
}
@@ -119,136 +121,142 @@ async function isFilePubliclyAccessible(
}
// Check if file exists
-export async function headFile(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
- const hash = c.req.param('hash',)!
- const cleanHash = hash.replace('sha256:', '',)
+export async function headFile(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
+ const hash = c.req.param('hash')!
+ const cleanHash = hash.replace('sha256:', '')
- const [file,] = await db
+ const [file] = await db
.select()
- .from(schema.files,)
- .where(eq(schema.files.hash, cleanHash,),)
- .limit(1,)
+ .from(schema.files)
+ .where(eq(schema.files.hash, cleanHash))
+ .limit(1)
if (!file) {
- return c.body(null, 404,)
+ return c.body(null, 404)
}
// Check visibility
- const accessible = await isFilePubliclyAccessible(owner, slug, cleanHash, c.get('accountId',),)
+ const accessible = await isFilePubliclyAccessible(owner, slug, cleanHash, c.get('accountId'))
if (!accessible) {
- return c.body(null, 404,)
+ return c.body(null, 404)
}
- c.header('Content-Length', String(file.size,),)
- c.header('Content-Type', file.mimeType,)
- return c.body(null, 200,)
+ c.header('Content-Length', String(file.size))
+ c.header('Content-Type', file.mimeType)
+ return c.body(null, 200)
}
// Download file
-export async function getFile(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
- const hash = c.req.param('hash',)!
- const cleanHash = hash.replace('sha256:', '',)
+export async function getFile(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
+ const hash = c.req.param('hash')!
+ const cleanHash = hash.replace('sha256:', '')
- const [file,] = await db
+ const [file] = await db
.select()
- .from(schema.files,)
- .where(eq(schema.files.hash, cleanHash,),)
- .limit(1,)
+ .from(schema.files)
+ .where(eq(schema.files.hash, cleanHash))
+ .limit(1)
if (!file) {
- return c.json({ error: 'File not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'File not found', statusCode: 404 }, 404)
}
// Check visibility
- const accessible = await isFilePubliclyAccessible(owner, slug, cleanHash, c.get('accountId',),)
+ const accessible = await isFilePubliclyAccessible(owner, slug, cleanHash, c.get('accountId'))
if (!accessible) {
- return c.json({ error: 'File not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'File not found', statusCode: 404 }, 404)
}
// Redirect to CDN
- const cdnUrl = `https://assets.underlay.org/files/${cleanHash.slice(0, 2,)}/${cleanHash.slice(2, 4,)}/${cleanHash}`
- return c.redirect(cdnUrl,)
+ const cdnUrl = `https://assets.underlay.org/files/${cleanHash.slice(0, 2)}/${cleanHash.slice(2, 4)}/${cleanHash}`
+ return c.redirect(cdnUrl)
}
// Upload file
-export async function putFile(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
- const hash = c.req.param('hash',)!
- const cleanHash = hash.replace('sha256:', '',)
+export async function putFile(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
+ const hash = c.req.param('hash')!
+ const cleanHash = hash.replace('sha256:', '')
// Check if file already exists in DB
- const [existing,] = await db
+ const [existing] = await db
.select()
- .from(schema.files,)
- .where(eq(schema.files.hash, cleanHash,),)
- .limit(1,)
+ .from(schema.files)
+ .where(eq(schema.files.hash, cleanHash))
+ .limit(1)
if (existing) {
- return c.json({ hash: cleanHash, status: 'exists', }, 200,)
+ return c.json({ hash: cleanHash, status: 'exists' }, 200)
}
// Check if file exists in S3 but not in local DB (shared bucket scenario)
- const s3Key = `files/${cleanHash.slice(0, 2,)}/${cleanHash.slice(2, 4,)}/${cleanHash}`
- const s3Meta = await getS3ObjectMeta(s3Key,)
+ const s3Key = `files/${cleanHash.slice(0, 2)}/${cleanHash.slice(2, 4)}/${cleanHash}`
+ const s3Meta = await getS3ObjectMeta(s3Key)
if (s3Meta !== null) {
- await db.insert(schema.files,).values({
- hash: cleanHash,
- size: s3Meta.size,
- mimeType: s3Meta.contentType,
- storageKey: s3Key,
- },).onConflictDoNothing()
- return c.json({ hash: cleanHash, status: 'exists', }, 200,)
+ await db
+ .insert(schema.files)
+ .values({
+ hash: cleanHash,
+ size: s3Meta.size,
+ mimeType: s3Meta.contentType,
+ storageKey: s3Key,
+ })
+ .onConflictDoNothing()
+ return c.json({ hash: cleanHash, status: 'exists' }, 200)
}
// Try multipart first
- const contentType = c.req.header('content-type',) ?? 'application/octet-stream'
+ const contentType = c.req.header('content-type') ?? 'application/octet-stream'
let buffer: Buffer
let mimeType: string
- if (contentType.startsWith('multipart/',)) {
+ if (contentType.startsWith('multipart/')) {
const body = await c.req.parseBody()
const file = body['file']
if (file instanceof File) {
const ab = await file.arrayBuffer()
- buffer = Buffer.from(ab,)
+ buffer = Buffer.from(ab)
mimeType = file.type || 'application/octet-stream'
} else {
- return c.json({ error: 'No file in multipart body', statusCode: 400, }, 400,)
+ return c.json({ error: 'No file in multipart body', statusCode: 400 }, 400)
}
} else {
// Raw binary body
const ab = await c.req.arrayBuffer()
- buffer = Buffer.from(ab,)
+ buffer = Buffer.from(ab)
mimeType = contentType
}
// Verify hash
- const computedHash = createHash('sha256',).update(buffer,).digest('hex',)
+ const computedHash = createHash('sha256').update(buffer).digest('hex')
if (computedHash !== cleanHash) {
- return c.json({
- error: 'Hash mismatch',
- expected: cleanHash,
- computed: computedHash,
- statusCode: 400,
- }, 400,)
+ return c.json(
+ {
+ error: 'Hash mismatch',
+ expected: cleanHash,
+ computed: computedHash,
+ statusCode: 400,
+ },
+ 400,
+ )
}
- const storageKey = `files/${cleanHash.slice(0, 2,)}/${cleanHash.slice(2, 4,)}/${cleanHash}`
+ const storageKey = `files/${cleanHash.slice(0, 2)}/${cleanHash.slice(2, 4)}/${cleanHash}`
- await uploadToS3(storageKey, buffer, mimeType,)
+ await uploadToS3(storageKey, buffer, mimeType)
- await db.insert(schema.files,).values({
+ await db.insert(schema.files).values({
hash: cleanHash,
size: buffer.length,
mimeType,
storageKey,
- },)
+ })
- return c.json({ hash: cleanHash, size: buffer.length, }, 201,)
+ return c.json({ hash: cleanHash, size: buffer.length }, 201)
}
diff --git a/src/api/health.ts b/src/api/health.ts
index 24bd286..648041b 100644
--- a/src/api/health.ts
+++ b/src/api/health.ts
@@ -1,5 +1,5 @@
-import type { Context, } from 'hono'
+import type { Context } from 'hono'
-export async function check(c: Context,) {
- return c.json({ status: 'ok', timestamp: new Date().toISOString(), },)
+export async function check(c: Context) {
+ return c.json({ status: 'ok', timestamp: new Date().toISOString() })
}
diff --git a/src/api/kf-auth.ts b/src/api/kf-auth.ts
new file mode 100644
index 0000000..a6d367a
--- /dev/null
+++ b/src/api/kf-auth.ts
@@ -0,0 +1,190 @@
+import crypto from 'node:crypto'
+
+import { eq } from 'drizzle-orm'
+import type { Context } from 'hono'
+import { deleteCookie, getCookie, setCookie } from 'hono/cookie'
+import { v4 as uuidv4 } from 'uuid'
+
+import { db, schema } from '../db/client.server.js'
+import {
+ buildAuthorizeUrl,
+ exchangeCode,
+ fetchUserInfo,
+ type KFOrg,
+} from '../lib/kf-auth.server.js'
+import { type AuthEnv, setSessionCookie } from './auth.server.js'
+
+const STATE_COOKIE = 'kf_oauth_state'
+const RETURN_COOKIE = 'kf_oauth_return'
+const VERIFIER_COOKIE = 'kf_oauth_verifier'
+
+/**
+ * GET /auth/login — redirect to KF Auth with CSRF state + PKCE.
+ * Optional ?return_to= query param preserved for post-login redirect.
+ */
+export async function login(c: Context) {
+ const state = crypto.randomBytes(24).toString('hex')
+ const returnTo = c.req.query('return_to') ?? '/dashboard'
+
+ const cookieOpts = {
+ httpOnly: true,
+ secure: process.env.NODE_ENV === 'production',
+ sameSite: 'Lax' as const,
+ path: '/',
+ maxAge: 600, // 10 minutes
+ }
+
+ setCookie(c, STATE_COOKIE, state, cookieOpts)
+ setCookie(c, RETURN_COOKIE, returnTo, cookieOpts)
+
+ const { url, codeVerifier } = buildAuthorizeUrl(state)
+ setCookie(c, VERIFIER_COOKIE, codeVerifier, cookieOpts)
+
+ return c.redirect(url)
+}
+
+/**
+ * GET /auth/callback — handle the OIDC callback.
+ * Exchanges the code for tokens, fetches user info, upserts the local
+ * account, creates a session, and redirects to the return URL.
+ */
+export async function callback(c: Context) {
+ const code = c.req.query('code')
+ const state = c.req.query('state')
+ const error = c.req.query('error')
+
+ if (error) {
+ console.error('KF Auth returned error:', error, c.req.query('error_description'))
+ return c.redirect('/login?error=auth_failed')
+ }
+
+ if (!code || !state) {
+ return c.redirect('/login?error=missing_params')
+ }
+
+ // Validate CSRF state
+ const savedState = getCookie(c, STATE_COOKIE)
+ const codeVerifier = getCookie(c, VERIFIER_COOKIE)
+ deleteCookie(c, STATE_COOKIE, { path: '/' })
+ deleteCookie(c, VERIFIER_COOKIE, { path: '/' })
+
+ if (!savedState || savedState !== state) {
+ return c.redirect('/login?error=invalid_state')
+ }
+
+ if (!codeVerifier) {
+ return c.redirect('/login?error=missing_verifier')
+ }
+
+ // Exchange code for tokens
+ let accessToken: string
+ try {
+ const tokens = await exchangeCode(code, codeVerifier)
+ accessToken = tokens.access_token
+ } catch (err) {
+ console.error('Token exchange failed:', err)
+ return c.redirect('/login?error=token_exchange')
+ }
+
+ // Fetch user info
+ let userInfo: Awaited>
+ try {
+ userInfo = await fetchUserInfo(accessToken)
+ } catch (err) {
+ console.error('UserInfo fetch failed:', err)
+ return c.redirect('/login?error=userinfo')
+ }
+
+ // Find or create local account.
+ // User account id IS the KF Auth user id (userInfo.sub).
+ // No profile data stored locally — fetched from KF Auth on demand.
+ const kfUserId = userInfo.sub
+ const kfOrgs: KFOrg[] = userInfo['https://knowledgefutures.org/orgs'] ?? []
+ const kfPersonalOrg = kfOrgs.find((o) => o.type === 'personal')
+ const accountId = kfUserId
+
+ const [existing] = await db
+ .select({ id: schema.accounts.id })
+ .from(schema.accounts)
+ .where(eq(schema.accounts.id, kfUserId))
+ .limit(1)
+
+ if (existing) {
+ // Update personal org link if it changed
+ if (kfPersonalOrg) {
+ await db
+ .update(schema.accounts)
+ .set({ kfOrgId: kfPersonalOrg.id })
+ .where(eq(schema.accounts.id, accountId))
+ }
+ } else {
+ // Create new account — generate a slug from email or name
+ const baseSlug = (userInfo.email?.split('@')[0] ?? userInfo.name ?? 'user')
+ .toLowerCase()
+ .replace(/[^a-z0-9-]/g, '-')
+ .replace(/-+/g, '-')
+ .slice(0, 30)
+
+ // Ensure slug is unique
+ let slug = baseSlug
+ let attempt = 0
+ while (true) {
+ const [conflict] = await db
+ .select({ id: schema.accounts.id })
+ .from(schema.accounts)
+ .where(eq(schema.accounts.slug, slug))
+ .limit(1)
+
+ if (!conflict) break
+ attempt++
+ slug = `${baseSlug}-${attempt}`
+ }
+
+ await db.insert(schema.accounts).values({
+ id: kfUserId,
+ slug,
+ type: 'user',
+ kfOrgId: kfPersonalOrg?.id ?? null,
+ })
+ }
+
+ // Create session
+ const sessionId = uuidv4()
+ const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000) // 30 days
+ await db.insert(schema.sessions).values({
+ id: sessionId,
+ userId: accountId,
+ expiresAt,
+ userAgent: c.req.header('user-agent') ?? null,
+ ipAddress: c.req.header('x-forwarded-for') || 'unknown',
+ })
+
+ setSessionCookie(c, sessionId)
+
+ // Redirect to saved return URL
+ const returnTo = getCookie(c, RETURN_COOKIE) ?? '/dashboard'
+ deleteCookie(c, RETURN_COOKIE, { path: '/' })
+
+ return c.redirect(returnTo)
+}
+
+/**
+ * POST /auth/logout — clear local session, return JSON.
+ * The client is responsible for redirecting to KF Auth's signout endpoint.
+ */
+export async function logout(c: Context) {
+ const sessionCookie = getCookie(c, 'session')
+ if (sessionCookie) {
+ let sessionId = sessionCookie
+ const dotIdx = sessionCookie.lastIndexOf('.')
+ if (dotIdx > 0) sessionId = sessionCookie.slice(0, dotIdx)
+
+ await db
+ .delete(schema.sessions)
+ .where(eq(schema.sessions.id, sessionId))
+ .catch(() => {})
+ }
+
+ deleteCookie(c, 'session', { path: '/' })
+ return c.json({ ok: true })
+}
diff --git a/src/api/kf-summary.ts b/src/api/kf-summary.ts
new file mode 100644
index 0000000..b028ddf
--- /dev/null
+++ b/src/api/kf-summary.ts
@@ -0,0 +1,125 @@
+import { eq, sql } from 'drizzle-orm'
+import type { Context } from 'hono'
+
+import { db, schema } from '../db/client.server.js'
+
+/**
+ * GET /api/kf/summary?kf_org_id=xxx
+ *
+ * Returns Underlay accounts and their collections linked to a KF org.
+ * For user-type accounts it also includes UL orgs the user belongs to.
+ *
+ * Auth: requires KF_INTERNAL_API_KEY (service-to-service).
+ */
+export async function summary(c: Context) {
+ const kfOrgId = c.req.query('kf_org_id')
+ if (!kfOrgId) {
+ return c.json({ error: 'kf_org_id is required' }, 400)
+ }
+
+ // Verify internal API key
+ const authHeader = c.req.header('Authorization')
+ const expectedKey = process.env.KF_INTERNAL_API_KEY
+ if (!expectedKey || authHeader !== `Bearer ${expectedKey}`) {
+ return c.json({ error: 'Unauthorized' }, 401)
+ }
+
+ const APP_URL = process.env.APP_URL ?? 'http://localhost:4100'
+
+ // Find local accounts linked to this KF org via kf_org_id.
+ const directAccounts = await db
+ .select({
+ id: schema.accounts.id,
+ slug: schema.accounts.slug,
+ type: schema.accounts.type,
+ displayName: schema.accounts.displayName,
+ })
+ .from(schema.accounts)
+ .where(eq(schema.accounts.kfOrgId, kfOrgId))
+
+ if (directAccounts.length === 0) {
+ return c.json({ accounts: [] })
+ }
+
+ const allAccountIds = directAccounts.map((a) => a.id)
+
+ // Get collections for all accounts
+ const collections = await db
+ .select({
+ id: schema.collections.id,
+ slug: schema.collections.slug,
+ name: schema.collections.name,
+ accountId: schema.collections.accountId,
+ ownerSlug: schema.accounts.slug,
+ })
+ .from(schema.collections)
+ .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id))
+ .where(
+ sql`${schema.collections.accountId} IN (${sql.join(
+ allAccountIds.map((id) => sql`${id}`),
+ sql`, `,
+ )})`,
+ )
+
+ // Get version stats if we have collections
+ const statsMap = new Map<
+ string,
+ { versions: number; records: number; files: number; bytes: number }
+ >()
+
+ if (collections.length > 0) {
+ const versionStats = await db
+ .select({
+ collectionId: schema.versions.collectionId,
+ versionCount: sql`count(*)::int`,
+ totalRecords: sql`coalesce(sum(${schema.versions.recordCount}), 0)::int`,
+ totalFiles: sql`coalesce(sum(${schema.versions.fileCount}), 0)::int`,
+ totalBytes: sql`coalesce(sum(${schema.versions.totalBytes}), 0)::bigint`,
+ })
+ .from(schema.versions)
+ .where(
+ sql`${schema.versions.collectionId} IN (${sql.join(
+ collections.map((c) => sql`${c.id}`),
+ sql`, `,
+ )})`,
+ )
+ .groupBy(schema.versions.collectionId)
+
+ for (const s of versionStats) {
+ statsMap.set(s.collectionId, {
+ versions: s.versionCount,
+ records: s.totalRecords,
+ files: s.totalFiles,
+ bytes: s.totalBytes,
+ })
+ }
+ }
+
+ // Group collections by account
+ const collectionsByAccount = new Map()
+ for (const col of collections) {
+ const list = collectionsByAccount.get(col.accountId) ?? []
+ list.push(col)
+ collectionsByAccount.set(col.accountId, list)
+ }
+
+ return c.json({
+ accounts: directAccounts.map((acct) => ({
+ id: acct.id,
+ slug: acct.slug,
+ type: acct.type,
+ name: acct.displayName ?? acct.slug,
+ url: `${APP_URL}/${acct.slug}`,
+ collections: (collectionsByAccount.get(acct.id) ?? []).map((col) => {
+ const stats = statsMap.get(col.id)
+ return {
+ id: col.id,
+ name: col.name,
+ slug: col.slug,
+ url: `${APP_URL}/${col.ownerSlug}/${col.slug}`,
+ stats: stats ?? { versions: 0, records: 0, files: 0, bytes: 0 },
+ }
+ }),
+ })),
+ })
+}
diff --git a/src/api/query.ts b/src/api/query.ts
index ddc2c16..5ecb407 100644
--- a/src/api/query.ts
+++ b/src/api/query.ts
@@ -1,8 +1,9 @@
-import { and, desc, eq, ilike, inArray, or, } from 'drizzle-orm'
-import type { Context, } from 'hono'
-import { db, schema, } from '../db/client.server.js'
-import { buildSqliteBuffer, generateAllDDL, generateDDL, } from '../lib/sqlite-gen.js'
-import { type AuthEnv, } from './auth.server.js'
+import { and, desc, eq, ilike, inArray, or } from 'drizzle-orm'
+import type { Context } from 'hono'
+
+import { db, schema } from '../db/client.server.js'
+import { buildSqliteBuffer, generateAllDDL, generateDDL } from '../lib/sqlite-gen.js'
+import { type AuthEnv } from './auth.server.js'
// In-memory LRU cache: key = `${collectionId}:${versionNumber}`, value = { buffer, expiresAt }
const sqliteCache = new Map<
@@ -20,8 +21,8 @@ const CACHE_MAX_ENTRIES = 10
function cleanExpired() {
const now = Date.now()
- for (const [key, entry,] of sqliteCache) {
- if (entry.expiresAt < now) sqliteCache.delete(key,)
+ for (const [key, entry] of sqliteCache) {
+ if (entry.expiresAt < now) sqliteCache.delete(key)
}
}
@@ -29,51 +30,60 @@ function evictIfNeeded() {
while (sqliteCache.size >= CACHE_MAX_ENTRIES) {
// Evict oldest entry (first key in Map insertion order)
const firstKey = sqliteCache.keys().next().value
- if (firstKey) sqliteCache.delete(firstKey,)
+ if (firstKey) sqliteCache.delete(firstKey)
else break
}
}
// Run cleanup every 5 minutes
-setInterval(cleanExpired, 5 * 60 * 1000,)
+setInterval(cleanExpired, 5 * 60 * 1000)
-async function getOrBuildSqlite(owner: string, slug: string, versionNumber: number,) {
+async function getOrBuildSqlite(owner: string, slug: string, versionNumber: number) {
// Resolve collection
- const [collection,] = await db
- .select({ id: schema.collections.id, accountId: schema.collections.accountId, public: schema.collections.public, },)
- .from(schema.collections,)
- .innerJoin(schema.accounts, eq(schema.accounts.id, schema.collections.accountId,),)
- .where(and(eq(schema.accounts.slug, owner,), eq(schema.collections.slug, slug,),),)
- .limit(1,)
+ const [collection] = await db
+ .select({
+ id: schema.collections.id,
+ accountId: schema.collections.accountId,
+ public: schema.collections.public,
+ })
+ .from(schema.collections)
+ .innerJoin(schema.accounts, eq(schema.accounts.id, schema.collections.accountId))
+ .where(and(eq(schema.accounts.slug, owner), eq(schema.collections.slug, slug)))
+ .limit(1)
if (!collection) return null
// Resolve version
- const [version,] = await db
- .select({ id: schema.versions.id, number: schema.versions.number, },)
- .from(schema.versions,)
- .where(and(eq(schema.versions.collectionId, collection.id,), eq(schema.versions.number, versionNumber,),),)
- .limit(1,)
+ const [version] = await db
+ .select({ id: schema.versions.id, number: schema.versions.number })
+ .from(schema.versions)
+ .where(
+ and(
+ eq(schema.versions.collectionId, collection.id),
+ eq(schema.versions.number, versionNumber),
+ ),
+ )
+ .limit(1)
if (!version) return null
const cacheKey = `${collection.id}:${version.number}`
// Check cache (re-insert to move to end for LRU ordering)
- const cached = sqliteCache.get(cacheKey,)
+ const cached = sqliteCache.get(cacheKey)
if (cached && cached.expiresAt > Date.now()) {
- sqliteCache.delete(cacheKey,)
+ sqliteCache.delete(cacheKey)
cached.expiresAt = Date.now() + CACHE_TTL_MS
- sqliteCache.set(cacheKey, cached,)
+ sqliteCache.set(cacheKey, cached)
return cached
}
// Load schemas for this version
const versionSchemas = await db
- .select({ slug: schema.versionSchemas.slug, schema: schema.schemas.schema, },)
- .from(schema.versionSchemas,)
- .innerJoin(schema.schemas, eq(schema.versionSchemas.schemaId, schema.schemas.id,),)
- .where(eq(schema.versionSchemas.versionId, version.id,),)
+ .select({ slug: schema.versionSchemas.slug, schema: schema.schemas.schema })
+ .from(schema.versionSchemas)
+ .innerJoin(schema.schemas, eq(schema.versionSchemas.schemaId, schema.schemas.id))
+ .where(eq(schema.versionSchemas.versionId, version.id))
const schemasMap: Record = {}
for (const vs of versionSchemas) {
@@ -82,93 +92,100 @@ async function getOrBuildSqlite(owner: string, slug: string, versionNumber: numb
// Load records
const records = await db
- .select({ recordId: schema.records.recordId, type: schema.records.type, data: schema.records.data, },)
- .from(schema.records,)
- .where(eq(schema.records.versionId, version.id,),)
+ .select({
+ recordId: schema.records.recordId,
+ type: schema.records.type,
+ data: schema.records.data,
+ })
+ .from(schema.records)
+ .where(eq(schema.records.versionId, version.id))
// Build SQLite
- const buffer = buildSqliteBuffer(schemasMap, records as any,)
- const ddl = generateAllDDL(schemasMap,)
+ const buffer = buildSqliteBuffer(schemasMap, records as any)
+ const ddl = generateAllDDL(schemasMap)
// Generate sample data (first row per table) for LLM context
const sampleRows: Record> = {}
- for (const [typeName,] of Object.entries(schemasMap,)) {
- const firstRecord = records.find((r,) => r.type === typeName)
+ for (const [typeName] of Object.entries(schemasMap)) {
+ const firstRecord = records.find((r) => r.type === typeName)
if (firstRecord && firstRecord.data && typeof firstRecord.data === 'object') {
sampleRows[typeName] = firstRecord.data as Record
}
}
// Build DDL with inline sample rows (each sample right after its CREATE TABLE)
- const ddlWithSamples = Object.entries(schemasMap,)
- .map(([name, s,],) => {
- const tableDdl = generateDDL(name, s,)
+ const ddlWithSamples = Object.entries(schemasMap)
+ .map(([name, s]) => {
+ const tableDdl = generateDDL(name, s)
const sample = sampleRows[name]
if (sample) {
- return tableDdl + `\n-- Example row: ${JSON.stringify(sample,)}`
+ return tableDdl + `\n-- Example row: ${JSON.stringify(sample)}`
}
return tableDdl
- },)
- .join('\n\n',)
+ })
+ .join('\n\n')
- const entry = { buffer, ddl, ddlWithSamples, sampleRows, expiresAt: Date.now() + CACHE_TTL_MS, }
+ const entry = { buffer, ddl, ddlWithSamples, sampleRows, expiresAt: Date.now() + CACHE_TTL_MS }
evictIfNeeded()
- sqliteCache.set(cacheKey, entry,)
+ sqliteCache.set(cacheKey, entry)
return entry
}
// GET /query/sqlite/:owner/:slug/:version — Download SQLite file for a version
-export async function sqlite(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
- const version = c.req.param('version',)!
- const versionNum = parseInt(version, 10,)
- if (isNaN(versionNum,)) return c.json({ error: 'Invalid version number', }, 400,)
+export async function sqlite(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
+ const version = c.req.param('version')!
+ const versionNum = parseInt(version, 10)
+ if (isNaN(versionNum)) return c.json({ error: 'Invalid version number' }, 400)
- const result = await getOrBuildSqlite(owner, slug, versionNum,)
- if (!result) return c.json({ error: 'Collection or version not found', }, 404,)
+ const result = await getOrBuildSqlite(owner, slug, versionNum)
+ if (!result) return c.json({ error: 'Collection or version not found' }, 404)
- return new Response(new Uint8Array(result.buffer,), {
+ return new Response(new Uint8Array(result.buffer), {
status: 200,
headers: {
'Content-Type': 'application/x-sqlite3',
'Content-Disposition': `attachment; filename="${slug}-v${versionNum}.sqlite"`,
'Cache-Control': 'public, max-age=86400',
},
- },)
+ })
}
// GET /query/ddl/:owner/:slug/:version — Get DDL (schema only) for a version
-export async function ddl(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
- const version = c.req.param('version',)!
- const versionNum = parseInt(version, 10,)
- if (isNaN(versionNum,)) return c.json({ error: 'Invalid version number', }, 400,)
+export async function ddl(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
+ const version = c.req.param('version')!
+ const versionNum = parseInt(version, 10)
+ if (isNaN(versionNum)) return c.json({ error: 'Invalid version number' }, 400)
- const result = await getOrBuildSqlite(owner, slug, versionNum,)
- if (!result) return c.json({ error: 'Collection or version not found', }, 404,)
+ const result = await getOrBuildSqlite(owner, slug, versionNum)
+ if (!result) return c.json({ error: 'Collection or version not found' }, 404)
- return c.json({ ddl: result.ddl, },)
+ return c.json({ ddl: result.ddl })
}
// POST /query/generate-sql — LLM-powered SQL generation from natural language
-export async function generateSql(c: Context,) {
- const { collections: collectionRefs, question, } = await c.req.json()
+export async function generateSql(c: Context) {
+ const { collections: collectionRefs, question } = await c.req.json()
if (!collectionRefs?.length || !question) {
- return c.json({ error: 'collections and question are required', }, 400,)
+ return c.json({ error: 'collections and question are required' }, 400)
}
const cfAccountId = process.env.CF_ACCOUNT_ID
const cfApiToken = process.env.CF_API_TOKEN
if (!cfAccountId || !cfApiToken) {
- return c.json({
- error: 'LLM not configured',
- message:
- 'Set CF_ACCOUNT_ID and CF_API_TOKEN environment variables to enable natural language queries. You can still write SQL directly.',
- }, 503,)
+ return c.json(
+ {
+ error: 'LLM not configured',
+ message:
+ 'Set CF_ACCOUNT_ID and CF_API_TOKEN environment variables to enable natural language queries. You can still write SQL directly.',
+ },
+ 503,
+ )
}
// Build DDL with sample rows server-side
@@ -177,29 +194,33 @@ export async function generateSql(c: Context,) {
if (collectionRefs.length === 1) {
const ref = collectionRefs[0]
- const result = await getOrBuildSqlite(ref.owner, ref.slug, ref.version,)
- if (!result) return c.json({ error: `Collection ${ref.owner}/${ref.slug} v${ref.version} not found`, }, 404,)
+ const result = await getOrBuildSqlite(ref.owner, ref.slug, ref.version)
+ if (!result)
+ return c.json({ error: `Collection ${ref.owner}/${ref.slug} v${ref.version} not found` }, 404)
combinedDdl = result.ddlWithSamples
// Count records from cache (approximation from the version table already captured)
} else {
const parts: string[] = []
for (const ref of collectionRefs) {
- const result = await getOrBuildSqlite(ref.owner, ref.slug, ref.version,)
- if (!result) return c.json({ error: `Collection ${ref.owner}/${ref.slug} v${ref.version} not found`, }, 404,)
- const prefix = ref.slug.replace(/-/g, '_',)
+ const result = await getOrBuildSqlite(ref.owner, ref.slug, ref.version)
+ if (!result)
+ return c.json(
+ { error: `Collection ${ref.owner}/${ref.slug} v${ref.version} not found` },
+ 404,
+ )
+ const prefix = ref.slug.replace(/-/g, '_')
// Prefix table names and add _source column to DDL
const ddlPrefixed = result.ddlWithSamples
- .replace(/CREATE TABLE "([^"]+)"/g, `CREATE TABLE "${prefix}__$1"`,)
- .replace(/\);/g, `,\n "_source" TEXT\n);`,)
- parts.push(`-- Collection: ${ref.owner}/${ref.slug} v${ref.version}\n` + ddlPrefixed,)
+ .replace(/CREATE TABLE "([^"]+)"/g, `CREATE TABLE "${prefix}__$1"`)
+ .replace(/\);/g, `,\n "_source" TEXT\n);`)
+ parts.push(`-- Collection: ${ref.owner}/${ref.slug} v${ref.version}\n` + ddlPrefixed)
}
- combinedDdl = parts.join('\n\n',)
+ combinedDdl = parts.join('\n\n')
}
const isMultiCollection = collectionRefs.length > 1
- const systemPrompt =
- `You are a SQL assistant for SQLite databases. Given a schema and a user's question, produce a single SELECT query that answers it.
+ const systemPrompt = `You are a SQL assistant for SQLite databases. Given a schema and a user's question, produce a single SELECT query that answers it.
Respond in EXACTLY this format (two sections separated by the marker):
@@ -211,24 +232,24 @@ REASONING:
Important rules:
- Examine the "Example row" comments in the schema — they show the ACTUAL data format stored in each column.${
- isMultiCollection
- ? `
+ isMultiCollection
+ ? `
- When multiple collections are loaded, consider ALL of them in your answer unless the question specifies otherwise.
- Every table has a "_source" column containing the collection identifier (e.g. "account/collection"). For row-level results, include _source as a column. For aggregations, include GROUP_CONCAT(DISTINCT _source) as _source so the user can see which collections contributed to the result.
- When counting across multiple tables, use UNION ALL to combine rows, not JOIN.`
- : ''
- }
+ : ''
+ }
- Only use JOIN when the question asks about relationships between tables.
- COUNT(*) counts rows.${
- isMultiCollection ? ' Use UNION ALL to combine rows from separate tables before counting.' : ''
- }
+ isMultiCollection ? ' Use UNION ALL to combine rows from separate tables before counting.' : ''
+ }
- When tables have a prefix like "collection__TableName", always use that full prefixed name.
- Do NOT include columns that don't exist in the schema.`
const userPrompt = `Schema:\n${combinedDdl}\n\nQuestion: ${question}`
// Log the full prompt for debugging
- console.info(`[generate-sql] User prompt:\n${userPrompt}`,)
+ console.info(`[generate-sql] User prompt:\n${userPrompt}`)
try {
const response = await fetch(
@@ -241,84 +262,97 @@ Important rules:
},
body: JSON.stringify({
messages: [
- { role: 'system', content: systemPrompt, },
- { role: 'user', content: userPrompt, },
+ { role: 'system', content: systemPrompt },
+ { role: 'user', content: userPrompt },
],
max_tokens: 800,
temperature: 0,
- },),
+ }),
},
)
if (!response.ok) {
const text = await response.text()
- console.error(`Cloudflare AI error: ${response.status} ${text}`,)
- return c.json({ error: 'LLM request failed', rawResponse: text, }, 502,)
+ console.error(`Cloudflare AI error: ${response.status} ${text}`)
+ return c.json({ error: 'LLM request failed', rawResponse: text }, 502)
}
const data = (await response.json()) as any
let raw = data?.result?.response?.trim()
if (!raw) {
- return c.json({ error: 'LLM returned empty response', rawResponse: JSON.stringify(data,), }, 500,)
+ return c.json(
+ { error: 'LLM returned empty response', rawResponse: JSON.stringify(data) },
+ 500,
+ )
}
// Parse structured response
let sql: string
let reasoning: string | undefined
- const sqlMarker = raw.indexOf('SQL:',)
- const reasoningMarker = raw.indexOf('REASONING:',)
+ const sqlMarker = raw.indexOf('SQL:')
+ const reasoningMarker = raw.indexOf('REASONING:')
if (sqlMarker !== -1 && reasoningMarker !== -1) {
- sql = raw.substring(sqlMarker + 4, reasoningMarker,).replace(/```sql\n?/g, '',).replace(/```/g, '',).trim()
- reasoning = raw.substring(reasoningMarker + 10,).trim()
+ sql = raw
+ .substring(sqlMarker + 4, reasoningMarker)
+ .replace(/```sql\n?/g, '')
+ .replace(/```/g, '')
+ .trim()
+ reasoning = raw.substring(reasoningMarker + 10).trim()
} else {
// Fallback: treat entire response as SQL
- sql = raw.replace(/```sql\n?/g, '',).replace(/```/g, '',).trim()
+ sql = raw
+ .replace(/```sql\n?/g, '')
+ .replace(/```/g, '')
+ .trim()
}
// Basic safety: only allow SELECT statements
- const normalized = sql.replace(/--.*$/gm, '',).trim().toUpperCase()
- if (!normalized.startsWith('SELECT',) && !normalized.startsWith('WITH',)) {
- return c.json({
- error: 'Generated query is not a SELECT statement',
- sql,
- reasoning,
- rawResponse: raw,
- }, 400,)
+ const normalized = sql.replace(/--.*$/gm, '').trim().toUpperCase()
+ if (!normalized.startsWith('SELECT') && !normalized.startsWith('WITH')) {
+ return c.json(
+ {
+ error: 'Generated query is not a SELECT statement',
+ sql,
+ reasoning,
+ rawResponse: raw,
+ },
+ 400,
+ )
}
- return c.json({ sql, reasoning, },)
+ return c.json({ sql, reasoning })
} catch (err: any) {
- console.error(`LLM generation error: ${err.message}`,)
- return c.json({ error: 'Failed to generate SQL', }, 500,)
+ console.error(`LLM generation error: ${err.message}`)
+ return c.json({ error: 'Failed to generate SQL' }, 500)
}
}
// GET /query/collections/search?q=term — Search collections (public + user's private)
-export async function searchCollections(c: Context,) {
- const q = c.req.query('q',)
- if (!q || q.trim().length < 2) return c.json([],)
+export async function searchCollections(c: Context) {
+ const q = c.req.query('q')
+ if (!q || q.trim().length < 2) return c.json([])
const term = `%${q.trim()}%`
- const userId = c.get('accountId',)
+ const userId = c.get('accountId')
// Build accessible account IDs (user's own + orgs they belong to)
let accessibleAccountIds: string[] = []
if (userId) {
const memberships = await db
- .select({ orgId: schema.orgMemberships.orgId, },)
- .from(schema.orgMemberships,)
- .where(eq(schema.orgMemberships.userId, userId,),)
- accessibleAccountIds = [userId, ...memberships.map((m,) => m.orgId),]
+ .select({ orgId: schema.orgMemberships.orgId })
+ .from(schema.orgMemberships)
+ .where(eq(schema.orgMemberships.userId, userId))
+ accessibleAccountIds = [userId, ...memberships.map((m) => m.orgId)]
}
// Query: public collections OR private collections owned by accessible accounts
const searchCondition = or(
- ilike(schema.accounts.slug, term,),
- ilike(schema.collections.slug, term,),
- ilike(schema.collections.name, term,),
+ ilike(schema.accounts.slug, term),
+ ilike(schema.collections.slug, term),
+ ilike(schema.collections.name, term),
)
let whereCondition
@@ -326,12 +360,12 @@ export async function searchCollections(c: Context,) {
whereCondition = and(
searchCondition,
or(
- eq(schema.collections.public, true,),
- inArray(schema.collections.accountId, accessibleAccountIds,),
+ eq(schema.collections.public, true),
+ inArray(schema.collections.accountId, accessibleAccountIds),
),
)
} else {
- whereCondition = and(searchCondition, eq(schema.collections.public, true,),)
+ whereCondition = and(searchCondition, eq(schema.collections.public, true))
}
const collections = await db
@@ -341,27 +375,27 @@ export async function searchCollections(c: Context,) {
name: schema.collections.name,
description: schema.collections.description,
public: schema.collections.public,
- },)
- .from(schema.collections,)
- .innerJoin(schema.accounts, eq(schema.accounts.id, schema.collections.accountId,),)
- .where(whereCondition,)
- .limit(20,)
+ })
+ .from(schema.collections)
+ .innerJoin(schema.accounts, eq(schema.accounts.id, schema.collections.accountId))
+ .where(whereCondition)
+ .limit(20)
// Get latest version + record count for each match
const result = []
for (const c2 of collections) {
- const [latestVersion,] = await db
+ const [latestVersion] = await db
.select({
number: schema.versions.number,
semver: schema.versions.semver,
recordCount: schema.versions.recordCount,
- },)
- .from(schema.versions,)
- .innerJoin(schema.collections, eq(schema.collections.id, schema.versions.collectionId,),)
- .innerJoin(schema.accounts, eq(schema.accounts.id, schema.collections.accountId,),)
- .where(and(eq(schema.accounts.slug, c2.ownerSlug,), eq(schema.collections.slug, c2.slug,),),)
- .orderBy(desc(schema.versions.number,),)
- .limit(1,)
+ })
+ .from(schema.versions)
+ .innerJoin(schema.collections, eq(schema.collections.id, schema.versions.collectionId))
+ .innerJoin(schema.accounts, eq(schema.accounts.id, schema.collections.accountId))
+ .where(and(eq(schema.accounts.slug, c2.ownerSlug), eq(schema.collections.slug, c2.slug)))
+ .orderBy(desc(schema.versions.number))
+ .limit(1)
result.push({
ownerSlug: c2.ownerSlug,
@@ -372,16 +406,16 @@ export async function searchCollections(c: Context,) {
latestVersion: latestVersion?.number ?? null,
latestSemver: latestVersion?.semver ?? null,
recordCount: latestVersion?.recordCount ?? 0,
- },)
+ })
}
- return c.json(result,)
+ return c.json(result)
}
// GET /query/collections/:owner/:slug/versions — List versions for a collection
-export async function collectionVersions(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
+export async function collectionVersions(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
const versions = await db
.select({
@@ -390,22 +424,22 @@ export async function collectionVersions(c: Context,) {
recordCount: schema.versions.recordCount,
createdAt: schema.versions.createdAt,
message: schema.versions.message,
- },)
- .from(schema.versions,)
- .innerJoin(schema.collections, eq(schema.collections.id, schema.versions.collectionId,),)
- .innerJoin(schema.accounts, eq(schema.accounts.id, schema.collections.accountId,),)
+ })
+ .from(schema.versions)
+ .innerJoin(schema.collections, eq(schema.collections.id, schema.versions.collectionId))
+ .innerJoin(schema.accounts, eq(schema.accounts.id, schema.collections.accountId))
.where(
and(
- eq(schema.accounts.slug, owner,),
- eq(schema.collections.slug, slug,),
- eq(schema.collections.public, true,),
+ eq(schema.accounts.slug, owner),
+ eq(schema.collections.slug, slug),
+ eq(schema.collections.public, true),
),
)
- .orderBy(desc(schema.versions.number,),)
+ .orderBy(desc(schema.versions.number))
if (versions.length === 0) {
- return c.json({ error: 'Collection not found or not public', }, 404,)
+ return c.json({ error: 'Collection not found or not public' }, 404)
}
- return c.json(versions,)
+ return c.json(versions)
}
diff --git a/src/api/schemas.ts b/src/api/schemas.ts
index 47af20b..246b4bd 100644
--- a/src/api/schemas.ts
+++ b/src/api/schemas.ts
@@ -1,78 +1,81 @@
-import { and, eq, ilike, inArray, sql, } from 'drizzle-orm'
-import type { Context, } from 'hono'
-import { db, schema, } from '../db/client.server.js'
-import { type AuthEnv, } from './auth.server.js'
+import { and, eq, ilike, inArray, sql } from 'drizzle-orm'
+import type { Context } from 'hono'
+
+import { db, schema } from '../db/client.server.js'
+import { type AuthEnv } from './auth.server.js'
// --- Global schema search ---
// GET /schemas?q=...&slug=...&label=...&schema_hash=...&limit=...&offset=...
-export async function listSchemas(c: Context,) {
- const q = c.req.query('q',)
- const slugFilter = c.req.query('slug',)
- const label = c.req.query('label',)
- const schema_hash = c.req.query('schema_hash',)
- const limit = c.req.query('limit',)
- const offset = c.req.query('offset',)
+export async function listSchemas(c: Context) {
+ const q = c.req.query('q')
+ const slugFilter = c.req.query('slug')
+ const label = c.req.query('label')
+ const schema_hash = c.req.query('schema_hash')
+ const limit = c.req.query('limit')
+ const offset = c.req.query('offset')
- const pageLimit = Math.min(parseInt(limit ?? '50', 10,), 100,)
- const pageOffset = parseInt(offset ?? '0', 10,)
+ const pageLimit = Math.min(parseInt(limit ?? '50', 10), 100)
+ const pageOffset = parseInt(offset ?? '0', 10)
// Search by exact hash
if (schema_hash) {
- const [row,] = await db
+ const [row] = await db
.select()
- .from(schema.schemas,)
- .where(eq(schema.schemas.schemaHash, schema_hash,),)
- .limit(1,)
+ .from(schema.schemas)
+ .where(eq(schema.schemas.schemaHash, schema_hash))
+ .limit(1)
- if (!row) return c.json({ error: 'Schema not found', statusCode: 404, }, 404,)
+ if (!row) return c.json({ error: 'Schema not found', statusCode: 404 }, 404)
const labels = await db
- .select({ label: schema.schemaLabels.label, },)
- .from(schema.schemaLabels,)
- .where(eq(schema.schemaLabels.schemaId, row.id,),)
+ .select({ label: schema.schemaLabels.label })
+ .from(schema.schemaLabels)
+ .where(eq(schema.schemaLabels.schemaId, row.id))
- const usageCount = await getUsageCount(row.id,)
+ const usageCount = await getUsageCount(row.id)
return c.json({
...row,
- labels: labels.map((l,) => l.label),
+ labels: labels.map((l) => l.label),
usageCount,
- },)
+ })
}
// Search by slug (find schemas used as a particular type name)
if (slugFilter) {
const vsRows = await db
- .select({ schemaId: schema.versionSchemas.schemaId, },)
- .from(schema.versionSchemas,)
- .where(eq(schema.versionSchemas.slug, slugFilter,),)
- .groupBy(schema.versionSchemas.schemaId,)
- .limit(pageLimit,)
- .offset(pageOffset,)
+ .select({ schemaId: schema.versionSchemas.schemaId })
+ .from(schema.versionSchemas)
+ .where(eq(schema.versionSchemas.slug, slugFilter))
+ .groupBy(schema.versionSchemas.schemaId)
+ .limit(pageLimit)
+ .offset(pageOffset)
- if (vsRows.length === 0) return c.json([],)
+ if (vsRows.length === 0) return c.json([])
- const schemaIds = vsRows.map((r,) => r.schemaId)
+ const schemaIds = vsRows.map((r) => r.schemaId)
const schemaRows = await db
.select()
- .from(schema.schemas,)
- .where(inArray(schema.schemas.id, schemaIds,),)
+ .from(schema.schemas)
+ .where(inArray(schema.schemas.id, schemaIds))
const allLabels = await db
- .select({ schemaId: schema.schemaLabels.schemaId, label: schema.schemaLabels.label, },)
- .from(schema.schemaLabels,)
- .where(inArray(schema.schemaLabels.schemaId, schemaIds,),)
+ .select({ schemaId: schema.schemaLabels.schemaId, label: schema.schemaLabels.label })
+ .from(schema.schemaLabels)
+ .where(inArray(schema.schemaLabels.schemaId, schemaIds))
const labelsMap = new Map()
for (const l of allLabels) {
- if (!labelsMap.has(l.schemaId,)) labelsMap.set(l.schemaId, [],)
- labelsMap.get(l.schemaId,)!.push(l.label,)
+ if (!labelsMap.has(l.schemaId)) labelsMap.set(l.schemaId, [])
+ labelsMap.get(l.schemaId)!.push(l.label)
}
- return c.json(schemaRows.map((s,) => ({
- ...s,
- labels: labelsMap.get(s.id,) ?? [],
- })),)
+ return c.json(
+ schemaRows.map((s) => ({
+ ...s,
+ labels: labelsMap.get(s.id) ?? [],
+ })),
+ )
}
// Search by label
@@ -81,112 +84,116 @@ export async function listSchemas(c: Context,) {
.select({
schemaId: schema.schemaLabels.schemaId,
label: schema.schemaLabels.label,
- },)
- .from(schema.schemaLabels,)
- .where(ilike(schema.schemaLabels.label, `%${label}%`,),)
- .limit(pageLimit,)
- .offset(pageOffset,)
+ })
+ .from(schema.schemaLabels)
+ .where(ilike(schema.schemaLabels.label, `%${label}%`))
+ .limit(pageLimit)
+ .offset(pageOffset)
- if (labelRows.length === 0) return c.json([],)
+ if (labelRows.length === 0) return c.json([])
- const schemaIds = [...new Set(labelRows.map((r,) => r.schemaId),),]
+ const schemaIds = [...new Set(labelRows.map((r) => r.schemaId))]
const schemaRows = await db
.select()
- .from(schema.schemas,)
- .where(inArray(schema.schemas.id, schemaIds,),)
+ .from(schema.schemas)
+ .where(inArray(schema.schemas.id, schemaIds))
// Gather all labels for these schemas
const allLabels = await db
- .select({ schemaId: schema.schemaLabels.schemaId, label: schema.schemaLabels.label, },)
- .from(schema.schemaLabels,)
- .where(inArray(schema.schemaLabels.schemaId, schemaIds,),)
+ .select({ schemaId: schema.schemaLabels.schemaId, label: schema.schemaLabels.label })
+ .from(schema.schemaLabels)
+ .where(inArray(schema.schemaLabels.schemaId, schemaIds))
const labelsMap = new Map()
for (const l of allLabels) {
- if (!labelsMap.has(l.schemaId,)) labelsMap.set(l.schemaId, [],)
- labelsMap.get(l.schemaId,)!.push(l.label,)
+ if (!labelsMap.has(l.schemaId)) labelsMap.set(l.schemaId, [])
+ labelsMap.get(l.schemaId)!.push(l.label)
}
- return c.json(schemaRows.map((s,) => ({
- ...s,
- labels: labelsMap.get(s.id,) ?? [],
- })),)
+ return c.json(
+ schemaRows.map((s) => ({
+ ...s,
+ labels: labelsMap.get(s.id) ?? [],
+ })),
+ )
}
// Full-text search across schema JSON (search for field names, types, etc.)
if (q) {
const rows = await db
.select()
- .from(schema.schemas,)
- .where(sql`${schema.schemas.schema}::text ILIKE ${'%' + q + '%'}`,)
- .limit(pageLimit,)
- .offset(pageOffset,)
-
- const schemaIds = rows.map((r,) => r.id)
- const allLabels = schemaIds.length > 0
- ? await db
- .select({ schemaId: schema.schemaLabels.schemaId, label: schema.schemaLabels.label, },)
- .from(schema.schemaLabels,)
- .where(inArray(schema.schemaLabels.schemaId, schemaIds,),)
- : []
+ .from(schema.schemas)
+ .where(sql`${schema.schemas.schema}::text ILIKE ${'%' + q + '%'}`)
+ .limit(pageLimit)
+ .offset(pageOffset)
+
+ const schemaIds = rows.map((r) => r.id)
+ const allLabels =
+ schemaIds.length > 0
+ ? await db
+ .select({ schemaId: schema.schemaLabels.schemaId, label: schema.schemaLabels.label })
+ .from(schema.schemaLabels)
+ .where(inArray(schema.schemaLabels.schemaId, schemaIds))
+ : []
const labelsMap = new Map()
for (const l of allLabels) {
- if (!labelsMap.has(l.schemaId,)) labelsMap.set(l.schemaId, [],)
- labelsMap.get(l.schemaId,)!.push(l.label,)
+ if (!labelsMap.has(l.schemaId)) labelsMap.set(l.schemaId, [])
+ labelsMap.get(l.schemaId)!.push(l.label)
}
- return c.json(rows.map((s,) => ({
- ...s,
- labels: labelsMap.get(s.id,) ?? [],
- })),)
+ return c.json(
+ rows.map((s) => ({
+ ...s,
+ labels: labelsMap.get(s.id) ?? [],
+ })),
+ )
}
// No filter: list all schemas
const rows = await db
.select()
- .from(schema.schemas,)
- .orderBy(sql`${schema.schemas.createdAt} desc`,)
- .limit(pageLimit,)
- .offset(pageOffset,)
-
- const schemaIds = rows.map((r,) => r.id)
- const allLabels = schemaIds.length > 0
- ? await db
- .select({ schemaId: schema.schemaLabels.schemaId, label: schema.schemaLabels.label, },)
- .from(schema.schemaLabels,)
- .where(inArray(schema.schemaLabels.schemaId, schemaIds,),)
- : []
+ .from(schema.schemas)
+ .orderBy(sql`${schema.schemas.createdAt} desc`)
+ .limit(pageLimit)
+ .offset(pageOffset)
+
+ const schemaIds = rows.map((r) => r.id)
+ const allLabels =
+ schemaIds.length > 0
+ ? await db
+ .select({ schemaId: schema.schemaLabels.schemaId, label: schema.schemaLabels.label })
+ .from(schema.schemaLabels)
+ .where(inArray(schema.schemaLabels.schemaId, schemaIds))
+ : []
const labelsMap = new Map()
for (const l of allLabels) {
- if (!labelsMap.has(l.schemaId,)) labelsMap.set(l.schemaId, [],)
- labelsMap.get(l.schemaId,)!.push(l.label,)
+ if (!labelsMap.has(l.schemaId)) labelsMap.set(l.schemaId, [])
+ labelsMap.get(l.schemaId)!.push(l.label)
}
- return c.json(rows.map((s,) => ({
- ...s,
- labels: labelsMap.get(s.id,) ?? [],
- })),)
+ return c.json(
+ rows.map((s) => ({
+ ...s,
+ labels: labelsMap.get(s.id) ?? [],
+ })),
+ )
}
// --- Single schema by ID ---
// GET /schemas/:id
-export async function getSchema(c: Context,) {
- const id = c.req.param('id',)!
+export async function getSchema(c: Context) {
+ const id = c.req.param('id')!
- const [row,] = await db
- .select()
- .from(schema.schemas,)
- .where(eq(schema.schemas.id, id,),)
- .limit(1,)
+ const [row] = await db.select().from(schema.schemas).where(eq(schema.schemas.id, id)).limit(1)
- if (!row) return c.json({ error: 'Schema not found', statusCode: 404, }, 404,)
+ if (!row) return c.json({ error: 'Schema not found', statusCode: 404 }, 404)
const labels = await db
- .select({ label: schema.schemaLabels.label, createdAt: schema.schemaLabels.createdAt, },)
- .from(schema.schemaLabels,)
- .where(eq(schema.schemaLabels.schemaId, id,),)
+ .select({ label: schema.schemaLabels.label, createdAt: schema.schemaLabels.createdAt })
+ .from(schema.schemaLabels)
+ .where(eq(schema.schemaLabels.schemaId, id))
// Usage: which collections/versions reference this schema
const usage = await db
@@ -197,68 +204,72 @@ export async function getSchema(c: Context,) {
collectionSlug: schema.collections.slug,
owner: schema.accounts.slug,
isPublic: schema.collections.public,
- },)
- .from(schema.versionSchemas,)
- .innerJoin(schema.versions, eq(schema.versionSchemas.versionId, schema.versions.id,),)
- .innerJoin(schema.collections, eq(schema.versions.collectionId, schema.collections.id,),)
- .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id,),)
- .where(and(eq(schema.versionSchemas.schemaId, id,), eq(schema.collections.public, true,),),)
- .orderBy(sql`${schema.versions.createdAt} desc`,)
- .limit(50,)
+ })
+ .from(schema.versionSchemas)
+ .innerJoin(schema.versions, eq(schema.versionSchemas.versionId, schema.versions.id))
+ .innerJoin(schema.collections, eq(schema.versions.collectionId, schema.collections.id))
+ .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id))
+ .where(and(eq(schema.versionSchemas.schemaId, id), eq(schema.collections.public, true)))
+ .orderBy(sql`${schema.versions.createdAt} desc`)
+ .limit(50)
return c.json({
...row,
- labels: labels.map((l,) => ({ label: l.label, createdAt: l.createdAt, })),
- usage: usage.map((u,) => ({
+ labels: labels.map((l) => ({ label: l.label, createdAt: l.createdAt })),
+ usage: usage.map((u) => ({
slug: u.slug,
semver: u.semver,
versionNumber: u.versionNumber,
collection: `${u.owner}/${u.collectionSlug}`,
})),
- },)
+ })
}
// --- Collection schemas (for a specific version or latest) ---
// GET /collections/:owner/:slug/schemas?version=N
-export async function collectionSchemas(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
- const versionParam = c.req.query('version',)
- const raw = c.req.query('raw',)
+export async function collectionSchemas(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
+ const versionParam = c.req.query('version')
+ const raw = c.req.query('raw')
// Resolve collection
- const [collection,] = await db
+ const [collection] = await db
.select({
id: schema.collections.id,
accountId: schema.collections.accountId,
public: schema.collections.public,
- },)
- .from(schema.collections,)
- .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id,),)
- .where(and(eq(schema.accounts.slug, owner,), eq(schema.collections.slug, slug,),),)
- .limit(1,)
+ })
+ .from(schema.collections)
+ .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id))
+ .where(and(eq(schema.accounts.slug, owner), eq(schema.collections.slug, slug)))
+ .limit(1)
- if (!collection) return c.json({ error: 'Collection not found', statusCode: 404, }, 404,)
+ if (!collection) return c.json({ error: 'Collection not found', statusCode: 404 }, 404)
// Visibility check
- if (!collection.public && c.get('accountId',) !== collection.accountId) {
- return c.json({ error: 'Collection not found', statusCode: 404, }, 404,)
+ if (!collection.public && c.get('accountId') !== collection.accountId) {
+ return c.json({ error: 'Collection not found', statusCode: 404 }, 404)
}
// Resolve version
- const versionConditions = [eq(schema.versions.collectionId, collection.id,),]
+ const versionConditions = [eq(schema.versions.collectionId, collection.id)]
if (versionParam) {
- versionConditions.push(eq(schema.versions.number, parseInt(versionParam, 10,),),)
+ versionConditions.push(eq(schema.versions.number, parseInt(versionParam, 10)))
}
- const [version,] = await db
- .select({ id: schema.versions.id, number: schema.versions.number, semver: schema.versions.semver, },)
- .from(schema.versions,)
- .where(and(...versionConditions,),)
- .orderBy(sql`${schema.versions.number} desc`,)
- .limit(1,)
+ const [version] = await db
+ .select({
+ id: schema.versions.id,
+ number: schema.versions.number,
+ semver: schema.versions.semver,
+ })
+ .from(schema.versions)
+ .where(and(...versionConditions))
+ .orderBy(sql`${schema.versions.number} desc`)
+ .limit(1)
- if (!version) return c.json({ error: 'No versions found', statusCode: 404, }, 404,)
+ if (!version) return c.json({ error: 'No versions found', statusCode: 404 }, 404)
// Load schemas for this version
const entries = await db
@@ -267,36 +278,37 @@ export async function collectionSchemas(c: Context,) {
schemaId: schema.versionSchemas.schemaId,
schemaBody: schema.schemas.schema,
schemaHash: schema.schemas.schemaHash,
- },)
- .from(schema.versionSchemas,)
- .innerJoin(schema.schemas, eq(schema.versionSchemas.schemaId, schema.schemas.id,),)
- .where(eq(schema.versionSchemas.versionId, version.id,),)
+ })
+ .from(schema.versionSchemas)
+ .innerJoin(schema.schemas, eq(schema.versionSchemas.schemaId, schema.schemas.id))
+ .where(eq(schema.versionSchemas.versionId, version.id))
// Load labels for all referenced schemas (unless raw mode)
let labelsMap = new Map()
if (raw !== 'true' && entries.length > 0) {
- const schemaIds = entries.map((e,) => e.schemaId)
+ const schemaIds = entries.map((e) => e.schemaId)
const allLabels = await db
- .select({ schemaId: schema.schemaLabels.schemaId, label: schema.schemaLabels.label, },)
- .from(schema.schemaLabels,)
- .where(inArray(schema.schemaLabels.schemaId, schemaIds,),)
+ .select({ schemaId: schema.schemaLabels.schemaId, label: schema.schemaLabels.label })
+ .from(schema.schemaLabels)
+ .where(inArray(schema.schemaLabels.schemaId, schemaIds))
for (const l of allLabels) {
- if (!labelsMap.has(l.schemaId,)) labelsMap.set(l.schemaId, [],)
- labelsMap.get(l.schemaId,)!.push(l.label,)
+ if (!labelsMap.has(l.schemaId)) labelsMap.set(l.schemaId, [])
+ labelsMap.get(l.schemaId)!.push(l.label)
}
}
return c.json({
version: version.number,
semver: version.semver,
- schemas: entries.map((e,) => {
- const labels = labelsMap.get(e.schemaId,) ?? []
- const body = raw === 'true'
- ? e.schemaBody
- : labels.length > 0
- ? { ...(e.schemaBody as object), 'x-underlay-labels': labels, }
- : e.schemaBody
+ schemas: entries.map((e) => {
+ const labels = labelsMap.get(e.schemaId) ?? []
+ const body =
+ raw === 'true'
+ ? e.schemaBody
+ : labels.length > 0
+ ? { ...(e.schemaBody as object), 'x-underlay-labels': labels }
+ : e.schemaBody
return {
slug: e.slug,
@@ -304,75 +316,75 @@ export async function collectionSchemas(c: Context,) {
schemaHash: e.schemaHash,
schema: body,
}
- },),
- },)
+ }),
+ })
}
// --- Label management ---
// Add a label to a schema
// POST /schemas/:id/labels { label: "schema.org/Person" }
-export async function addLabel(c: Context,) {
- const id = c.req.param('id',)!
- const { label, } = await c.req.json()
+export async function addLabel(c: Context) {
+ const id = c.req.param('id')!
+ const { label } = await c.req.json()
if (!label || typeof label !== 'string' || label.trim().length === 0) {
- return c.json({ error: 'Label is required', statusCode: 400, }, 400,)
+ return c.json({ error: 'Label is required', statusCode: 400 }, 400)
}
// Verify schema exists
- const [existing,] = await db
- .select({ id: schema.schemas.id, },)
- .from(schema.schemas,)
- .where(eq(schema.schemas.id, id,),)
- .limit(1,)
+ const [existing] = await db
+ .select({ id: schema.schemas.id })
+ .from(schema.schemas)
+ .where(eq(schema.schemas.id, id))
+ .limit(1)
if (!existing) {
- return c.json({ error: 'Schema not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'Schema not found', statusCode: 404 }, 404)
}
// Upsert label (ignore conflict on duplicate)
try {
- const [inserted,] = await db
- .insert(schema.schemaLabels,)
- .values({ schemaId: id, label: label.trim(), },)
+ const [inserted] = await db
+ .insert(schema.schemaLabels)
+ .values({ schemaId: id, label: label.trim() })
.onConflictDoNothing()
.returning()
if (!inserted) {
- return c.json({ status: 'exists', schemaId: id, label: label.trim(), },)
+ return c.json({ status: 'exists', schemaId: id, label: label.trim() })
}
- return c.json({ status: 'created', schemaId: id, label: label.trim(), }, 201,)
+ return c.json({ status: 'created', schemaId: id, label: label.trim() }, 201)
} catch (err: any) {
- return c.json({ error: 'Failed to add label', statusCode: 500, }, 500,)
+ return c.json({ error: 'Failed to add label', statusCode: 500 }, 500)
}
}
// Remove a label from a schema
// DELETE /schemas/:id/labels/:label
-export async function removeLabel(c: Context,) {
- const id = c.req.param('id',)!
- const label = c.req.param('label',)!
+export async function removeLabel(c: Context) {
+ const id = c.req.param('id')!
+ const label = c.req.param('label')!
const result = await db
- .delete(schema.schemaLabels,)
- .where(and(eq(schema.schemaLabels.schemaId, id,), eq(schema.schemaLabels.label, label,),),)
+ .delete(schema.schemaLabels)
+ .where(and(eq(schema.schemaLabels.schemaId, id), eq(schema.schemaLabels.label, label)))
.returning()
if (result.length === 0) {
- return c.json({ error: 'Label not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'Label not found', statusCode: 404 }, 404)
}
- return c.json({ status: 'deleted', schemaId: id, label, },)
+ return c.json({ status: 'deleted', schemaId: id, label })
}
// --- Helpers ---
-async function getUsageCount(schemaId: string,): Promise {
- const [result,] = await db
- .select({ count: sql`count(distinct ${schema.versionSchemas.versionId})::int`, },)
- .from(schema.versionSchemas,)
- .where(eq(schema.versionSchemas.schemaId, schemaId,),)
+async function getUsageCount(schemaId: string): Promise {
+ const [result] = await db
+ .select({ count: sql`count(distinct ${schema.versionSchemas.versionId})::int` })
+ .from(schema.versionSchemas)
+ .where(eq(schema.versionSchemas.schemaId, schemaId))
return result?.count ?? 0
}
diff --git a/src/api/uploads.ts b/src/api/uploads.ts
index 9f50200..8fef07f 100644
--- a/src/api/uploads.ts
+++ b/src/api/uploads.ts
@@ -1,8 +1,10 @@
-import { and, eq, inArray, sql, } from 'drizzle-orm'
-import type { Context, } from 'hono'
-import { createHash, } from 'node:crypto'
-import { db, schema, } from '../db/client.server.js'
-import { getS3ObjectMeta, } from '../lib/s3.js'
+import { createHash } from 'node:crypto'
+
+import { and, eq, inArray, sql } from 'drizzle-orm'
+import type { Context } from 'hono'
+
+import { db, schema } from '../db/client.server.js'
+import { getS3ObjectMeta } from '../lib/s3.js'
import {
ajv,
deriveSemver,
@@ -14,7 +16,7 @@ import {
loadVersionSchemas,
type SchemaEntry,
} from '../lib/version-helpers.server.js'
-import { type AuthEnv, } from './auth.server.js'
+import { type AuthEnv } from './auth.server.js'
/** Session expiry: 1 hour from creation */
const SESSION_TTL_MS = 60 * 60 * 1000
@@ -22,24 +24,24 @@ const SESSION_TTL_MS = 60 * 60 * 1000
/** Max records per batch request */
const MAX_BATCH_SIZE = 10_000
-async function resolveCollection(owner: string, slug: string,) {
- const [result,] = await db
+async function resolveCollection(owner: string, slug: string) {
+ const [result] = await db
.select({
id: schema.collections.id,
accountId: schema.collections.accountId,
slug: schema.collections.slug,
- },)
- .from(schema.collections,)
- .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id,),)
- .where(and(eq(schema.accounts.slug, owner,), eq(schema.collections.slug, slug,),),)
- .limit(1,)
+ })
+ .from(schema.collections)
+ .innerJoin(schema.accounts, eq(schema.collections.accountId, schema.accounts.id))
+ .where(and(eq(schema.accounts.slug, owner), eq(schema.collections.slug, slug)))
+ .limit(1)
return result ?? null
}
// --- Start a chunked upload session ---
-export async function startSession(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
+export async function startSession(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
const body = await c.req.json<{
base_version: number | null
message?: string
@@ -49,38 +51,41 @@ export async function startSession(c: Context,) {
schemas?: Record
}>()
- const collection = await resolveCollection(owner, slug,)
- if (!collection) return c.json({ error: 'Collection not found', statusCode: 404, }, 404,)
+ const collection = await resolveCollection(owner, slug)
+ if (!collection) return c.json({ error: 'Collection not found', statusCode: 404 }, 404)
// Verify the caller owns this collection
- if (c.get('accountId',) !== collection.accountId) {
- return c.json({ error: 'Not authorized for this collection', statusCode: 403, }, 403,)
+ if (c.get('accountId') !== collection.accountId) {
+ return c.json({ error: 'Not authorized for this collection', statusCode: 403 }, 403)
}
// Optimistic lock check at session creation time
- const [latest,] = await db
- .select({ number: schema.versions.number, },)
- .from(schema.versions,)
- .where(eq(schema.versions.collectionId, collection.id,),)
- .orderBy(sql`${schema.versions.number} desc`,)
- .limit(1,)
+ const [latest] = await db
+ .select({ number: schema.versions.number })
+ .from(schema.versions)
+ .where(eq(schema.versions.collectionId, collection.id))
+ .orderBy(sql`${schema.versions.number} desc`)
+ .limit(1)
const currentNumber = latest?.number ?? 0
if (body.base_version !== null && body.base_version !== currentNumber) {
- return c.json({
- error: 'Version conflict',
- currentVersion: currentNumber,
- statusCode: 409,
- }, 409,)
+ return c.json(
+ {
+ error: 'Version conflict',
+ currentVersion: currentNumber,
+ statusCode: 409,
+ },
+ 409,
+ )
}
- const expiresAt = new Date(Date.now() + SESSION_TTL_MS,)
+ const expiresAt = new Date(Date.now() + SESSION_TTL_MS)
- const [session,] = await db
- .insert(schema.uploadSessions,)
+ const [session] = await db
+ .insert(schema.uploadSessions)
.values({
collectionId: collection.id,
- accountId: c.get('accountId',)!,
+ accountId: c.get('accountId')!,
baseVersion: body.base_version ?? null,
message: body.message ?? null,
readme: body.readme ?? null,
@@ -90,20 +95,23 @@ export async function startSession(c: Context,) {
status: 'open',
recordCount: 0,
expiresAt,
- },)
- .returning({ id: schema.uploadSessions.id, },)
-
- return c.json({
- sessionId: session!.id,
- expiresAt: expiresAt.toISOString(),
- }, 201,)
+ })
+ .returning({ id: schema.uploadSessions.id })
+
+ return c.json(
+ {
+ sessionId: session!.id,
+ expiresAt: expiresAt.toISOString(),
+ },
+ 201,
+ )
}
// --- Append a batch of changes to a session ---
-export async function appendBatch(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
- const sessionId = c.req.param('sessionId',)!
+export async function appendBatch(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
+ const sessionId = c.req.param('sessionId')!
const body = await c.req.json<{
changes: {
added?: { id: string; type: string; data: unknown; private?: boolean }[]
@@ -113,37 +121,40 @@ export async function appendBatch(c: Context,) {
}>()
// Validate session exists and belongs to caller
- const [session,] = await db
+ const [session] = await db
.select()
- .from(schema.uploadSessions,)
- .where(eq(schema.uploadSessions.id, sessionId,),)
- .limit(1,)
+ .from(schema.uploadSessions)
+ .where(eq(schema.uploadSessions.id, sessionId))
+ .limit(1)
if (!session) {
- return c.json({ error: 'Upload session not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'Upload session not found', statusCode: 404 }, 404)
}
- if (session.accountId !== c.get('accountId',)) {
- return c.json({ error: 'Not authorized for this session', statusCode: 403, }, 403,)
+ if (session.accountId !== c.get('accountId')) {
+ return c.json({ error: 'Not authorized for this session', statusCode: 403 }, 403)
}
if (session.status !== 'open') {
- return c.json({
- error: 'Session is not open',
- status: session.status,
- statusCode: 409,
- }, 409,)
+ return c.json(
+ {
+ error: 'Session is not open',
+ status: session.status,
+ statusCode: 409,
+ },
+ 409,
+ )
}
- if (new Date(session.expiresAt,) < new Date()) {
+ if (new Date(session.expiresAt) < new Date()) {
await db
- .update(schema.uploadSessions,)
- .set({ status: 'expired', },)
- .where(eq(schema.uploadSessions.id, sessionId,),)
- return c.json({ error: 'Upload session expired', statusCode: 410, }, 410,)
+ .update(schema.uploadSessions)
+ .set({ status: 'expired' })
+ .where(eq(schema.uploadSessions.id, sessionId))
+ return c.json({ error: 'Upload session expired', statusCode: 410 }, 410)
}
// Verify collection matches
- const collection = await resolveCollection(owner, slug,)
+ const collection = await resolveCollection(owner, slug)
if (!collection || collection.id !== session.collectionId) {
- return c.json({ error: 'Collection mismatch', statusCode: 404, }, 404,)
+ return c.json({ error: 'Collection mismatch', statusCode: 404 }, 404)
}
// Count total records in this batch
@@ -153,13 +164,16 @@ export async function appendBatch(c: Context,) {
const batchSize = addedCount + updatedCount + removedCount
if (batchSize === 0) {
- return c.json({ error: 'Empty batch', statusCode: 400, }, 400,)
+ return c.json({ error: 'Empty batch', statusCode: 400 }, 400)
}
if (batchSize > MAX_BATCH_SIZE) {
- return c.json({
- error: `Batch too large. Maximum ${MAX_BATCH_SIZE} records per batch.`,
- statusCode: 400,
- }, 400,)
+ return c.json(
+ {
+ error: `Batch too large. Maximum ${MAX_BATCH_SIZE} records per batch.`,
+ statusCode: 400,
+ },
+ 400,
+ )
}
// Insert records into staging table (upsert to handle re-sends)
@@ -180,7 +194,7 @@ export async function appendBatch(c: Context,) {
data: rec.data,
private: rec.private ?? false,
operation: 'add',
- },)
+ })
}
for (const rec of body.changes.updated ?? []) {
rows.push({
@@ -190,7 +204,7 @@ export async function appendBatch(c: Context,) {
data: rec.data,
private: rec.private ?? false,
operation: 'update',
- },)
+ })
}
for (const id of body.changes.removed ?? []) {
rows.push({
@@ -200,59 +214,59 @@ export async function appendBatch(c: Context,) {
data: null,
private: false,
operation: 'remove',
- },)
+ })
}
// Batch insert (upsert: last write wins for same recordId)
const BATCH = 1000
for (let i = 0; i < rows.length; i += BATCH) {
- const batch = rows.slice(i, i + BATCH,)
+ const batch = rows.slice(i, i + BATCH)
await db
- .insert(schema.uploadRecords,)
- .values(batch,)
+ .insert(schema.uploadRecords)
+ .values(batch)
.onConflictDoUpdate({
- target: [schema.uploadRecords.sessionId, schema.uploadRecords.recordId,],
+ target: [schema.uploadRecords.sessionId, schema.uploadRecords.recordId],
set: {
type: sql`excluded.type`,
data: sql`excluded.data`,
private: sql`excluded.private`,
operation: sql`excluded.operation`,
},
- },)
+ })
}
// Update session record count
- const [countResult,] = await db
- .select({ count: sql`count(*)`, },)
- .from(schema.uploadRecords,)
- .where(eq(schema.uploadRecords.sessionId, sessionId,),)
+ const [countResult] = await db
+ .select({ count: sql`count(*)` })
+ .from(schema.uploadRecords)
+ .where(eq(schema.uploadRecords.sessionId, sessionId))
await db
- .update(schema.uploadSessions,)
- .set({ recordCount: countResult?.count ?? 0, },)
- .where(eq(schema.uploadSessions.id, sessionId,),)
+ .update(schema.uploadSessions)
+ .set({ recordCount: countResult?.count ?? 0 })
+ .where(eq(schema.uploadSessions.id, sessionId))
return c.json({
- received: { added: addedCount, updated: updatedCount, removed: removedCount, },
+ received: { added: addedCount, updated: updatedCount, removed: removedCount },
totalStaged: countResult?.count ?? 0,
- },)
+ })
}
// --- Get session status ---
-export async function getSession(c: Context,) {
- const sessionId = c.req.param('sessionId',)!
+export async function getSession(c: Context) {
+ const sessionId = c.req.param('sessionId')!
- const [session,] = await db
+ const [session] = await db
.select()
- .from(schema.uploadSessions,)
- .where(eq(schema.uploadSessions.id, sessionId,),)
- .limit(1,)
+ .from(schema.uploadSessions)
+ .where(eq(schema.uploadSessions.id, sessionId))
+ .limit(1)
if (!session) {
- return c.json({ error: 'Upload session not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'Upload session not found', statusCode: 404 }, 404)
}
- if (session.accountId !== c.get('accountId',)) {
- return c.json({ error: 'Not authorized for this session', statusCode: 403, }, 403,)
+ if (session.accountId !== c.get('accountId')) {
+ return c.json({ error: 'Not authorized for this session', statusCode: 403 }, 403)
}
return c.json({
@@ -262,128 +276,147 @@ export async function getSession(c: Context,) {
baseVersion: session.baseVersion,
expiresAt: session.expiresAt,
createdAt: session.createdAt,
- },)
+ })
}
// --- Finalize: build the version from staged records ---
-export async function finalize(c: Context,) {
- const owner = c.req.param('owner',)!
- const slug = c.req.param('slug',)!
- const sessionId = c.req.param('sessionId',)!
+export async function finalize(c: Context) {
+ const owner = c.req.param('owner')!
+ const slug = c.req.param('slug')!
+ const sessionId = c.req.param('sessionId')!
// Load and validate session
- const [session,] = await db
+ const [session] = await db
.select()
- .from(schema.uploadSessions,)
- .where(eq(schema.uploadSessions.id, sessionId,),)
- .limit(1,)
+ .from(schema.uploadSessions)
+ .where(eq(schema.uploadSessions.id, sessionId))
+ .limit(1)
if (!session) {
- return c.json({ error: 'Upload session not found', statusCode: 404, }, 404,)
+ return c.json({ error: 'Upload session not found', statusCode: 404 }, 404)
}
- if (session.accountId !== c.get('accountId',)) {
- return c.json({ error: 'Not authorized for this session', statusCode: 403, }, 403,)
+ if (session.accountId !== c.get('accountId')) {
+ return c.json({ error: 'Not authorized for this session', statusCode: 403 }, 403)
}
if (session.status !== 'open') {
- return c.json({
- error: `Session cannot be finalized (status: ${session.status})`,
- statusCode: 409,
- }, 409,)
+ return c.json(
+ {
+ error: `Session cannot be finalized (status: ${session.status})`,
+ statusCode: 409,
+ },
+ 409,
+ )
}
- if (new Date(session.expiresAt,) < new Date()) {
+ if (new Date(session.expiresAt) < new Date()) {
await db
- .update(schema.uploadSessions,)
- .set({ status: 'expired', },)
- .where(eq(schema.uploadSessions.id, sessionId,),)
- return c.json({ error: 'Upload session expired', statusCode: 410, }, 410,)
+ .update(schema.uploadSessions)
+ .set({ status: 'expired' })
+ .where(eq(schema.uploadSessions.id, sessionId))
+ return c.json({ error: 'Upload session expired', statusCode: 410 }, 410)
}
- const collection = await resolveCollection(owner, slug,)
+ const collection = await resolveCollection(owner, slug)
if (!collection || collection.id !== session.collectionId) {
- return c.json({ error: 'Collection mismatch', statusCode: 404, }, 404,)
+ return c.json({ error: 'Collection mismatch', statusCode: 404 }, 404)
}
// Mark session as finalizing
await db
- .update(schema.uploadSessions,)
- .set({ status: 'finalizing', },)
- .where(eq(schema.uploadSessions.id, sessionId,),)
+ .update(schema.uploadSessions)
+ .set({ status: 'finalizing' })
+ .where(eq(schema.uploadSessions.id, sessionId))
try {
// Re-check optimistic lock
- const [latest,] = await db
+ const [latest] = await db
.select()
- .from(schema.versions,)
- .where(eq(schema.versions.collectionId, collection.id,),)
- .orderBy(sql`${schema.versions.number} desc`,)
- .limit(1,)
+ .from(schema.versions)
+ .where(eq(schema.versions.collectionId, collection.id))
+ .orderBy(sql`${schema.versions.number} desc`)
+ .limit(1)
const currentNumber = latest?.number ?? 0
if (session.baseVersion !== null && session.baseVersion !== currentNumber) {
await db
- .update(schema.uploadSessions,)
- .set({ status: 'failed', },)
- .where(eq(schema.uploadSessions.id, sessionId,),)
- return c.json({
- error: 'Version conflict',
- currentVersion: currentNumber,
- statusCode: 409,
- }, 409,)
+ .update(schema.uploadSessions)
+ .set({ status: 'failed' })
+ .where(eq(schema.uploadSessions.id, sessionId))
+ return c.json(
+ {
+ error: 'Version conflict',
+ currentVersion: currentNumber,
+ statusCode: 409,
+ },
+ 409,
+ )
}
// --- Resolve schemas ---
let prevSchemaEntries: SchemaEntry[] = []
if (latest) {
- prevSchemaEntries = await loadVersionSchemas(latest.id,)
+ prevSchemaEntries = await loadVersionSchemas(latest.id)
}
let schemasInput: Record
- if (session.schemas && Object.keys(session.schemas as object,).length > 0) {
+ if (session.schemas && Object.keys(session.schemas as object).length > 0) {
schemasInput = session.schemas as Record
} else if (prevSchemaEntries.length > 0) {
- schemasInput = Object.fromEntries(prevSchemaEntries.map((e,) => [e.slug, e.schema,]),)
+ schemasInput = Object.fromEntries(prevSchemaEntries.map((e) => [e.slug, e.schema]))
} else {
await db
- .update(schema.uploadSessions,)
- .set({ status: 'failed', },)
- .where(eq(schema.uploadSessions.id, sessionId,),)
- return c.json({
- error: 'Schemas required',
- message: 'First version must include a `schemas` map with at least one type definition.',
- statusCode: 422,
- }, 422,)
+ .update(schema.uploadSessions)
+ .set({ status: 'failed' })
+ .where(eq(schema.uploadSessions.id, sessionId))
+ return c.json(
+ {
+ error: 'Schemas required',
+ message: 'First version must include a `schemas` map with at least one type definition.',
+ statusCode: 422,
+ },
+ 422,
+ )
}
// Hash and upsert schemas
- const newSchemaSet: { slug: string; schemaId: string; schemaHash: string; schema: Record }[] = []
- for (const [typeSlug, typeSchema,] of Object.entries(schemasInput,)) {
- const hash = hashSchema(typeSchema,)
- const [existing,] = await db
- .select({ id: schema.schemas.id, },)
- .from(schema.schemas,)
- .where(eq(schema.schemas.schemaHash, hash,),)
- .limit(1,)
+ const newSchemaSet: {
+ slug: string
+ schemaId: string
+ schemaHash: string
+ schema: Record
+ }[] = []
+ for (const [typeSlug, typeSchema] of Object.entries(schemasInput)) {
+ const hash = hashSchema(typeSchema)
+ const [existing] = await db
+ .select({ id: schema.schemas.id })
+ .from(schema.schemas)
+ .where(eq(schema.schemas.schemaHash, hash))
+ .limit(1)
let schemaId: string
if (existing) {
schemaId = existing.id
} else {
- const [inserted,] = await db
- .insert(schema.schemas,)
- .values({ schema: typeSchema as any, schemaHash: hash, },)
- .returning({ id: schema.schemas.id, },)
+ const [inserted] = await db
+ .insert(schema.schemas)
+ .values({ schema: typeSchema as any, schemaHash: hash })
+ .returning({ id: schema.schemas.id })
schemaId = inserted!.id
}
- newSchemaSet.push({ slug: typeSlug, schemaId, schemaHash: hash, schema: typeSchema as Record, },)
+ newSchemaSet.push({
+ slug: typeSlug,
+ schemaId,
+ schemaHash: hash,
+ schema: typeSchema as Record,
+ })
}
// Check schema changes
- const prevSchemaMap = new Map(prevSchemaEntries.map((e,) => [e.slug, e.schemaHash,]),)
- const newSchemaMap = new Map(newSchemaSet.map((e,) => [e.slug, e.schemaHash,]),)
+ const prevSchemaMap = new Map(prevSchemaEntries.map((e) => [e.slug, e.schemaHash]))
+ const newSchemaMap = new Map(newSchemaSet.map((e) => [e.slug, e.schemaHash]))
let schemaChanged = prevSchemaMap.size !== newSchemaMap.size
if (!schemaChanged) {
- for (const [s, hash,] of newSchemaMap) {
- if (prevSchemaMap.get(s,) !== hash) {
+ for (const [s, hash] of newSchemaMap) {
+ if (prevSchemaMap.get(s) !== hash) {
schemaChanged = true
break
}
@@ -393,17 +426,17 @@ export async function finalize(c: Context,) {
// Build validators
const validators = new Map>()
for (const entry of newSchemaSet) {
- validators.set(entry.slug, ajv.compile(entry.schema as object,),)
+ validators.set(entry.slug, ajv.compile(entry.schema as object))
}
// Get file hashes from previous version
let existingFileHashes: string[] = []
if (latest) {
const vf = await db
- .select({ hash: schema.versionFiles.fileHash, },)
- .from(schema.versionFiles,)
- .where(eq(schema.versionFiles.versionId, latest.id,),)
- existingFileHashes = vf.map((f,) => f.hash)
+ .select({ hash: schema.versionFiles.fileHash })
+ .from(schema.versionFiles)
+ .where(eq(schema.versionFiles.versionId, latest.id))
+ existingFileHashes = vf.map((f) => f.hash)
}
// --- Streaming finalize ---
@@ -422,7 +455,7 @@ export async function finalize(c: Context,) {
data jsonb NOT NULL,
private boolean NOT NULL DEFAULT false
) ON COMMIT DROP
- `,)
+ `)
// Insert existing records from base version (if any)
if (latest) {
@@ -431,7 +464,7 @@ export async function finalize(c: Context,) {
SELECT record_id, type, data, private
FROM records
WHERE version_id = ${latest.id}
- `,)
+ `)
}
// Apply staged changes (upserts and deletes)
@@ -445,7 +478,7 @@ export async function finalize(c: Context,) {
type = EXCLUDED.type,
data = EXCLUDED.data,
private = EXCLUDED.private
- `,)
+ `)
// Remove deleted records
await db.execute(sql`
@@ -454,64 +487,68 @@ export async function finalize(c: Context,) {
SELECT record_id FROM upload_records
WHERE session_id = ${sessionId} AND operation = 'remove'
)
- `,)
+ `)
// Get total count
- const [countResult,] = await db.execute(sql`SELECT count(*) as cnt FROM _finalize_records`,)
- const totalRecordCount = Number((countResult as any).cnt,)
+ const [countResult] = await db.execute(sql`SELECT count(*) as cnt FROM _finalize_records`)
+ const totalRecordCount = Number((countResult as any).cnt)
// Check all record types have schemas
- const [typesResult,] = await db.execute(sql`SELECT DISTINCT type FROM _finalize_records`,)
+ const [typesResult] = await db.execute(sql`SELECT DISTINCT type FROM _finalize_records`)
// typesResult is an array of rows
- const allTypes: string[] = (Array.isArray(typesResult,) ? typesResult : [typesResult,])
- .filter(Boolean,)
- .map((r: any,) => r.type)
- const missingSchemas = allTypes.filter((t,) => !(t in schemasInput))
+ const allTypes: string[] = (Array.isArray(typesResult) ? typesResult : [typesResult])
+ .filter(Boolean)
+ .map((r: any) => r.type)
+ const missingSchemas = allTypes.filter((t) => !(t in schemasInput))
if (missingSchemas.length > 0) {
- await db.update(schema.uploadSessions,).set({ status: 'failed', },).where(
- eq(schema.uploadSessions.id, sessionId,),
+ await db
+ .update(schema.uploadSessions)
+ .set({ status: 'failed' })
+ .where(eq(schema.uploadSessions.id, sessionId))
+ await db.execute(sql`DROP TABLE IF EXISTS _finalize_records`)
+ return c.json(
+ {
+ error: 'Missing schemas for record types',
+ types: missingSchemas,
+ statusCode: 422,
+ },
+ 422,
)
- await db.execute(sql`DROP TABLE IF EXISTS _finalize_records`,)
- return c.json({
- error: 'Missing schemas for record types',
- types: missingSchemas,
- statusCode: 422,
- }, 422,)
}
// --- Stream through records in sorted batches ---
// We compute hashes incrementally and validate + collect file refs + insert records
const STREAM_BATCH = 5000
- const privateTypes = getPrivateTypes(newSchemaSet as SchemaEntry[],)
+ const privateTypes = getPrivateTypes(newSchemaSet as SchemaEntry[])
// Streaming hash state
- const privateHasher = createHash('sha256',)
- const publicHasher = createHash('sha256',)
+ const privateHasher = createHash('sha256')
+ const publicHasher = createHash('sha256')
// We build the canonical hash as: {"schemas":{...},"records":[],"files":[...],"readme":...}
// For streaming, we compute records portion incrementally
const schemaSetForHash = newSchemaSet
- .map((e,) => ({ slug: e.slug, schemaHash: e.schemaHash, }))
- .sort((a, b,) => a.slug.localeCompare(b.slug,))
+ .map((e) => ({ slug: e.slug, schemaHash: e.schemaHash }))
+ .sort((a, b) => a.slug.localeCompare(b.slug))
const publicSchemaSet = newSchemaSet
- .filter((e,) => !privateTypes.has(e.slug,))
- .map((e,) => ({ slug: e.slug, schemaHash: hashSchema(filterTypeSchema(e.schema,),), }))
- .sort((a, b,) => a.slug.localeCompare(b.slug,))
+ .filter((e) => !privateTypes.has(e.slug))
+ .map((e) => ({ slug: e.slug, schemaHash: hashSchema(filterTypeSchema(e.schema)) }))
+ .sort((a, b) => a.slug.localeCompare(b.slug))
// We'll collect all record canonical forms for hashing
// Using incremental approach: hash prefix, then each record, then suffix
const schemasCanonical = JSON.stringify(
- Object.fromEntries(schemaSetForHash.map((s,) => [s.slug, s.schemaHash,]),),
+ Object.fromEntries(schemaSetForHash.map((s) => [s.slug, s.schemaHash])),
)
const publicSchemasCanonical = JSON.stringify(
- Object.fromEntries(publicSchemaSet.map((s,) => [s.slug, s.schemaHash,]),),
+ Object.fromEntries(publicSchemaSet.map((s) => [s.slug, s.schemaHash])),
)
// Start building canonical: {"schemas":...,"records":[
- privateHasher.update(`{"schemas":${schemasCanonical},"records":[`,)
- publicHasher.update(`{"schemas":${publicSchemasCanonical},"records":[`,)
+ privateHasher.update(`{"schemas":${schemasCanonical},"records":[`)
+ publicHasher.update(`{"schemas":${publicSchemasCanonical},"records":[`)
- const referencedHashes = new Set(existingFileHashes,)
+ const referencedHashes = new Set(existingFileHashes)
const validationErrors: { recordId: string; type: string; errors: string[] }[] = []
let totalBytes = 0
let recordCount = 0
@@ -521,16 +558,16 @@ export async function finalize(c: Context,) {
let hasMore = true
// Check if staged records exist (indicates changes)
- const [stagedCount,] = await db
- .select({ count: sql`count(*)`, },)
- .from(schema.uploadRecords,)
- .where(eq(schema.uploadRecords.sessionId, sessionId,),)
+ const [stagedCount] = await db
+ .select({ count: sql`count(*)` })
+ .from(schema.uploadRecords)
+ .where(eq(schema.uploadRecords.sessionId, sessionId))
hasChanges = (stagedCount?.count ?? 0) > 0
// Insert the new version early to get its ID for record insertion
// We'll update the hash fields after streaming
const readmeValue = session.readme !== null ? session.readme : (latest?.readme ?? null)
- const semver = deriveSemver(latest?.semver ?? null, schemaChanged, hasChanges,)
+ const semver = deriveSemver(latest?.semver ?? null, schemaChanged, hasChanges)
const newNumber = currentNumber + 1
// We need to process all records before we can insert the version (need hashes)
@@ -539,15 +576,15 @@ export async function finalize(c: Context,) {
// Phase 2: insert records (re-stream from temp table)
while (hasMore) {
- const batch = await db.execute(sql`
+ const batch = (await db.execute(sql`
SELECT record_id, type, data, private
FROM _finalize_records
WHERE record_id > ${cursor}
ORDER BY record_id ASC
LIMIT ${STREAM_BATCH}
- `,) as any[]
+ `)) as any[]
- const rows = Array.isArray(batch,) ? batch : []
+ const rows = Array.isArray(batch) ? batch : []
if (rows.length === 0) {
hasMore = false
break
@@ -555,56 +592,56 @@ export async function finalize(c: Context,) {
for (const rec of rows) {
// Validate
- const validate = validators.get(rec.type,)
+ const validate = validators.get(rec.type)
if (!validate) {
validationErrors.push({
recordId: rec.record_id,
type: rec.type,
- errors: [`No schema defined for record type "${rec.type}"`,],
- },)
- } else if (!validate(rec.data,)) {
+ errors: [`No schema defined for record type "${rec.type}"`],
+ })
+ } else if (!validate(rec.data)) {
validationErrors.push({
recordId: rec.record_id,
type: rec.type,
errors: (validate.errors ?? []).map(
- (e,) => `${e.instancePath || '/'} ${e.message ?? 'validation failed'}`,
+ (e) => `${e.instancePath || '/'} ${e.message ?? 'validation failed'}`,
),
- },)
+ })
}
// Feed into private hash (all records)
- const recCanonical = JSON.stringify({ id: rec.record_id, type: rec.type, data: rec.data, },)
- if (recordCount > 0) privateHasher.update(',',)
- privateHasher.update(recCanonical,)
+ const recCanonical = JSON.stringify({ id: rec.record_id, type: rec.type, data: rec.data })
+ if (recordCount > 0) privateHasher.update(',')
+ privateHasher.update(recCanonical)
recordCount++
// Feed into public hash (non-private records only, with private fields stripped)
const isPrivateRecord = rec.private === true
- const isPrivateType = privateTypes.has(rec.type,)
+ const isPrivateType = privateTypes.has(rec.type)
if (!isPrivateRecord && !isPrivateType) {
- const entry = newSchemaSet.find((e,) => e.slug === rec.type)
- const privFields = entry ? getPrivateFields(entry.schema,) : new Set()
- const pubData = privFields.size > 0 ? filterRecordData(rec.data, privFields,) : rec.data
- const pubCanonical = JSON.stringify({ id: rec.record_id, type: rec.type, data: pubData, },)
- if (publicRecordCount > 0) publicHasher.update(',',)
- publicHasher.update(pubCanonical,)
+ const entry = newSchemaSet.find((e) => e.slug === rec.type)
+ const privFields = entry ? getPrivateFields(entry.schema) : new Set()
+ const pubData = privFields.size > 0 ? filterRecordData(rec.data, privFields) : rec.data
+ const pubCanonical = JSON.stringify({ id: rec.record_id, type: rec.type, data: pubData })
+ if (publicRecordCount > 0) publicHasher.update(',')
+ publicHasher.update(pubCanonical)
publicRecordCount++
}
// Compute bytes
- totalBytes += Buffer.byteLength(JSON.stringify(rec.data,), 'utf-8',)
+ totalBytes += Buffer.byteLength(JSON.stringify(rec.data), 'utf-8')
// Scan for $file references
const data = rec.data as Record
Underlay