Files
Skald-Circle/crates/skald-core/src/tts/openai_tts.rs
T
dguiducci 178a38357e feat(users): UserManager with per-user SQLCipher, and extract skald-core crate
Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.

## UserManager + per-user encryption (§9/§11)

New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.

New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).

- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
  <0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
  the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
  the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
  `create_owner_tables` (one owner's content, identical in every file). No FK in
  the owner bucket may reach the registry — enforced by a standalone test.
  Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
  key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
  so a crash leaves an orphan file, never a user without a database. `open_db`
  never creates: a missing file is an error, not a silent empty database.

Not consumed yet: no login, call sites still use the shared system.db pool.

## Extract crates/skald-core

The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:

- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
  (sibling of `http_router`), so the core no longer downcasts to
  `MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
  teardown-and-respawn; the core defaults to the supervisor exit code. The core
  loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
  only emits tracing events.

All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.
2026-07-10 16:48:51 +01:00

162 lines
6.3 KiB
Rust

/// OpenAiTtsSynthesiser — cloud Text-to-Speech via any OpenAI-compatible
/// audio speech endpoint (OpenAI, …).
///
/// Calls `POST {base_url}/audio/speech` with a JSON body.
/// Returns raw audio bytes in the configured `response_format` (default `mp3`).
use anyhow::{anyhow, Result};
use async_trait::async_trait;
use tracing::{debug, info, warn};
use super::TextToSpeech;
// ── OpenAiTtsSynthesiser ──────────────────────────────────────────────────────
pub struct OpenAiTtsSynthesiser {
/// Stable identifier, e.g. `"openai_tts_alloy"`.
id: String,
base_url: String,
api_key: String,
model: String,
/// Voice/speaker name sent as the `voice` field. `None` ⇒ `alloy`.
/// Provider-specific: OpenAI uses `alloy`/`echo`/`nova`/…; Gemini uses
/// `Kore`/`Puck`/`Zephyr`/… — an unknown name may make the provider error.
voice: Option<String>,
/// Default instructions (voice style, tone, speed). Overridable per call.
instructions: Option<String>,
/// Requested audio format (`response_format`). `None` ⇒ `mp3`.
response_format: Option<String>,
http: reqwest::Client,
}
impl OpenAiTtsSynthesiser {
pub fn new(
id: impl Into<String>,
base_url: impl Into<String>,
api_key: impl Into<String>,
model: impl Into<String>,
voice: Option<String>,
instructions: Option<String>,
response_format: Option<String>,
) -> Self {
Self {
id: id.into(),
base_url: base_url.into(),
api_key: api_key.into(),
model: model.into(),
voice,
instructions,
response_format,
http: reqwest::Client::new(),
}
}
}
#[async_trait]
impl TextToSpeech for OpenAiTtsSynthesiser {
fn id(&self) -> &str { &self.id }
fn name(&self) -> &str { &self.id }
fn instructions(&self) -> Option<&str> { self.instructions.as_deref() }
fn output_format(&self) -> &str { self.response_format.as_deref().unwrap_or("mp3") }
async fn synthesize(&self, text: &str, instructions: Option<&str>) -> Result<Vec<u8>> {
let effective_instructions = instructions.or(self.instructions.as_deref());
// `None` ⇒ provider default. Some models reject `mp3` and require a
// specific value (e.g. Gemini TTS only accepts `pcm`).
let response_format = self.response_format.as_deref().unwrap_or("mp3");
debug!(
chars = text.len(),
model = %self.model,
response_format,
has_instructions = effective_instructions.is_some(),
"openai_tts: synthesising",
);
let url = format!("{}/audio/speech", self.base_url.trim_end_matches('/'));
// Voice from the model config (`tts_models.voice_id`), `alloy` if unset.
// `voice` is required by the OpenAI schema. NOTE: `alloy` is an OpenAI
// voice — providers like Gemini use their own names (`Kore`, `Puck`, …)
// and may reject/500 on an unknown one. Logged below on error.
let voice = self.voice.as_deref().unwrap_or("alloy");
let mut body = serde_json::json!({
"model": self.model,
"input": text,
"voice": voice,
"response_format": response_format,
});
if let Some(instr) = effective_instructions {
body["instructions"] = serde_json::Value::String(instr.to_string());
}
let resp = self.http
.post(&url)
.bearer_auth(&self.api_key)
.header("X-Title", core_api::APP_NAME)
.json(&body)
.send()
.await
.map_err(|e| anyhow!("openai_tts: request failed: {e}"))?;
let status = resp.status();
if !status.is_success() {
// Read the body once, as text. For 5xx the standard `error.message`
// is usually generic ("Internal Server Error") and the real cause sits
// in the raw body — OpenRouter nests the upstream provider error under
// `error.metadata`. Capturing the full body is the only way to see it.
let raw = resp.text().await.unwrap_or_default();
let detail = extract_error_detail(&raw);
warn!(
%status,
model = %self.model,
voice,
response_format,
url = %url,
response_body = %raw.chars().take(2000).collect::<String>(),
"openai_tts: provider returned error",
);
anyhow::bail!("openai_tts: API error {status}: {detail}");
}
let audio = resp
.bytes()
.await
.map_err(|e| anyhow!("openai_tts: failed to read audio bytes: {e}"))?
.to_vec();
info!(
bytes = audio.len(),
model = %self.model,
"openai_tts: synthesis complete",
);
Ok(audio)
}
}
/// Pull the most informative message out of an OpenAI/OpenRouter error body.
/// Prefers OpenRouter's upstream detail (`error.metadata.raw` / `provider_error`),
/// then the standard `error.message`, then the raw body itself. Falls back to a
/// placeholder for an empty body so the caller never reports a bare status code.
fn extract_error_detail(raw: &str) -> String {
if let Ok(v) = serde_json::from_str::<serde_json::Value>(raw) {
let msg = v["error"]["message"].as_str().unwrap_or("").trim();
// OpenRouter wraps the upstream provider's real error here on 5xx.
let upstream = v["error"]["metadata"]["raw"].as_str()
.or_else(|| v["error"]["metadata"]["provider_error"].as_str())
.map(str::trim)
.filter(|s| !s.is_empty());
return match (msg.is_empty(), upstream) {
(false, Some(up)) => format!("{msg} — upstream: {up}"),
(false, None) => msg.to_string(),
(true, Some(up)) => up.to_string(),
(true, None) => raw.trim().to_string(),
};
}
let t = raw.trim();
if t.is_empty() { "<empty response body>".into() } else { t.into() }
}