178a38357e
Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.
## UserManager + per-user encryption (§9/§11)
New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.
New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).
- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
<0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
`create_owner_tables` (one owner's content, identical in every file). No FK in
the owner bucket may reach the registry — enforced by a standalone test.
Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
so a crash leaves an orphan file, never a user without a database. `open_db`
never creates: a missing file is an error, not a silent empty database.
Not consumed yet: no login, call sites still use the shared system.db pool.
## Extract crates/skald-core
The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:
- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
(sibling of `http_router`), so the core no longer downcasts to
`MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
teardown-and-respawn; the core defaults to the supervisor exit code. The core
loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
only emits tracing events.
All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.
168 lines
6.1 KiB
Rust
168 lines
6.1 KiB
Rust
//! Per-source input inbox for ChatHub.
|
|
//!
|
|
//! Each interactive source (telegram, web, mobile…) gets one `SourceInbox` and a
|
|
//! single consumer task (spawned lazily in `ChatHub`). A single consumer per
|
|
//! source makes delivery strictly FIFO, removing the ordering race of the old
|
|
//! detached-spawn dispatch.
|
|
//!
|
|
//! Messages are kept as **individual** units — they are not coalesced here. The
|
|
//! consumer pops one to seed a turn (`build_unit`); any further messages that
|
|
//! pile up while the turn runs are drained, one row each, at the turn's round
|
|
//! boundaries (`drain_leading_user`) and injected live into the running turn.
|
|
//! Coalescing for the LLM (merging consecutive user rows into one `role:user`)
|
|
//! happens later in the `MessageBuilder`, not here, so the DB keeps each message
|
|
//! distinct while the model still sees a single clean user turn.
|
|
//!
|
|
//! Serialization of the turns themselves still lives in
|
|
//! `ChatSessionHandler.processing`; this inbox sits in front of it, adding ordering.
|
|
|
|
use std::collections::VecDeque;
|
|
use std::sync::atomic::AtomicU64;
|
|
|
|
use tokio::sync::{Mutex, Notify};
|
|
|
|
use core_api::chat_hub::SendMessageOptions;
|
|
use core_api::message_meta::MessageMetadata;
|
|
|
|
/// One queued user message awaiting dispatch.
|
|
pub(super) struct QueuedMessage {
|
|
pub prompt: String,
|
|
pub opts: SendMessageOptions,
|
|
}
|
|
|
|
/// Pending queue + wake signal for a single source.
|
|
#[derive(Default)]
|
|
pub(super) struct SourceInbox {
|
|
pub pending: Mutex<VecDeque<QueuedMessage>>,
|
|
pub notify: Notify,
|
|
/// Bumped by `ChatHub::cancel` (after clearing `pending`) so the consumer can
|
|
/// drop a unit it drained microseconds before a `/stop`.
|
|
pub cancel_epoch: AtomicU64,
|
|
}
|
|
|
|
/// Pops the next dispatch unit from `pending` — a **single** message, used by the
|
|
/// consumer to seed a turn. No coalescing: any further queued messages are drained
|
|
/// into the running turn at its round boundaries (see `drain_leading_user`).
|
|
///
|
|
/// Empty queue → `None`. Synthetic messages (notification/TIC) and plain user
|
|
/// messages are treated identically here; only `drain_leading_user` distinguishes
|
|
/// them, leaving synthetic ones for the notification path.
|
|
pub(super) fn build_unit(
|
|
pending: &mut VecDeque<QueuedMessage>,
|
|
) -> Option<(String, SendMessageOptions)> {
|
|
let m = pending.pop_front()?;
|
|
Some((m.prompt, m.opts))
|
|
}
|
|
|
|
/// One drained user message ready to be appended to history mid-turn.
|
|
pub(super) struct DrainedMessage {
|
|
pub content: String,
|
|
pub metadata: Option<MessageMetadata>,
|
|
}
|
|
|
|
/// Drains the leading run of **non-synthetic** messages, returning them
|
|
/// individually (no coalescing). Stops at the first synthetic message, which is
|
|
/// left in the queue for the notification path. Used by the running turn to
|
|
/// inject newly-queued user input at a round boundary.
|
|
pub(super) fn drain_leading_user(
|
|
pending: &mut VecDeque<QueuedMessage>,
|
|
) -> Vec<DrainedMessage> {
|
|
let mut out = Vec::new();
|
|
while pending.front().is_some_and(|m| !m.opts.is_synthetic) {
|
|
let mut m = pending.pop_front().unwrap();
|
|
out.push(DrainedMessage {
|
|
content: m.prompt,
|
|
metadata: m.opts.metadata.take(),
|
|
});
|
|
}
|
|
out
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
fn msg(prompt: &str, synthetic: bool) -> QueuedMessage {
|
|
QueuedMessage {
|
|
prompt: prompt.to_string(),
|
|
opts: SendMessageOptions { is_synthetic: synthetic, ..Default::default() },
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn empty_queue_yields_none() {
|
|
let mut q = VecDeque::new();
|
|
assert!(build_unit(&mut q).is_none());
|
|
}
|
|
|
|
#[test]
|
|
fn build_unit_pops_a_single_message() {
|
|
let mut q = VecDeque::from(vec![msg("hello", false), msg("also this", false)]);
|
|
let (prompt, _) = build_unit(&mut q).unwrap();
|
|
assert_eq!(prompt, "hello");
|
|
// The second message is left for the round-boundary drain.
|
|
assert_eq!(q.len(), 1);
|
|
}
|
|
|
|
#[test]
|
|
fn drain_returns_leading_user_messages_individually() {
|
|
let mut q = VecDeque::from(vec![msg("a", false), msg("b", false)]);
|
|
let drained = drain_leading_user(&mut q);
|
|
let contents: Vec<_> = drained.iter().map(|d| d.content.as_str()).collect();
|
|
assert_eq!(contents, vec!["a", "b"]);
|
|
assert!(q.is_empty());
|
|
}
|
|
|
|
#[test]
|
|
fn drain_stops_at_a_synthetic_boundary() {
|
|
let mut q = VecDeque::from(vec![
|
|
msg("a", false),
|
|
msg("b", false),
|
|
msg("notification", true),
|
|
]);
|
|
let drained = drain_leading_user(&mut q);
|
|
let contents: Vec<_> = drained.iter().map(|d| d.content.as_str()).collect();
|
|
assert_eq!(contents, vec!["a", "b"]);
|
|
assert_eq!(q.len(), 1); // the synthetic message is left for the next unit
|
|
}
|
|
|
|
#[test]
|
|
fn drain_skips_leading_synthetic() {
|
|
let mut q = VecDeque::from(vec![msg("notification", true), msg("user text", false)]);
|
|
let drained = drain_leading_user(&mut q);
|
|
assert!(drained.is_empty());
|
|
assert_eq!(q.len(), 2);
|
|
}
|
|
|
|
fn msg_with_attachment(prompt: &str, path: &str) -> QueuedMessage {
|
|
use core_api::message_meta::{Attachment, MessageMetadata};
|
|
QueuedMessage {
|
|
prompt: prompt.to_string(),
|
|
opts: SendMessageOptions {
|
|
metadata: Some(MessageMetadata {
|
|
attachments: vec![Attachment {
|
|
path: path.to_string(),
|
|
name: path.to_string(),
|
|
mimetype: None,
|
|
filesize: None,
|
|
}],
|
|
..Default::default()
|
|
}),
|
|
..Default::default()
|
|
},
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn drain_preserves_per_message_attachments() {
|
|
let mut q = VecDeque::from(vec![
|
|
msg_with_attachment("first", "a.pdf"),
|
|
msg_with_attachment("second", "b.pdf"),
|
|
]);
|
|
let drained = drain_leading_user(&mut q);
|
|
assert_eq!(drained.len(), 2);
|
|
assert_eq!(drained[0].metadata.as_ref().unwrap().attachments[0].path, "a.pdf");
|
|
assert_eq!(drained[1].metadata.as_ref().unwrap().attachments[0].path, "b.pdf");
|
|
}
|
|
}
|