dguiducci
178a38357e
Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.
## UserManager + per-user encryption (§9/§11)
New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.
New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).
- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
<0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
`create_owner_tables` (one owner's content, identical in every file). No FK in
the owner bucket may reach the registry — enforced by a standalone test.
Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
so a crash leaves an orphan file, never a user without a database. `open_db`
never creates: a missing file is an error, not a silent empty database.
Not consumed yet: no login, call sites still use the shared system.db pool.
## Extract crates/skald-core
The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:
- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
(sibling of `http_router`), so the core no longer downcasts to
`MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
teardown-and-respawn; the core defaults to the supervisor exit code. The core
loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
only emits tracing events.
All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.
104 lines
2.8 KiB
Rust
104 lines
2.8 KiB
Rust
use anyhow::{Context, Result};
|
|
use sqlx::SqlitePool;
|
|
|
|
use super::ImageGenerateModelRecord;
|
|
|
|
#[derive(sqlx::FromRow)]
|
|
struct ImageGenerateModelRow {
|
|
id: i64,
|
|
provider_id: i64,
|
|
model_id: String,
|
|
name: String,
|
|
priority: i64,
|
|
}
|
|
|
|
pub async fn load_all(pool: &SqlitePool) -> Result<Vec<ImageGenerateModelRecord>> {
|
|
let rows = sqlx::query_as::<_, ImageGenerateModelRow>(
|
|
"SELECT id, provider_id, model_id, name, priority
|
|
FROM image_generate_models
|
|
WHERE removed_at IS NULL
|
|
ORDER BY priority ASC, name ASC",
|
|
)
|
|
.fetch_all(pool)
|
|
.await
|
|
.context("image_generate_models: load_all")?;
|
|
|
|
Ok(rows.into_iter().map(row_to_record).collect())
|
|
}
|
|
|
|
pub async fn insert(pool: &SqlitePool, r: &ImageGenerateModelRecord) -> Result<i64> {
|
|
let restored = sqlx::query_scalar::<_, i64>(
|
|
"UPDATE image_generate_models
|
|
SET provider_id=?1, model_id=?2, name=?3, priority=?4, removed_at=NULL
|
|
WHERE id = (
|
|
SELECT id FROM image_generate_models
|
|
WHERE removed_at IS NOT NULL
|
|
AND (provider_id=?1 AND model_id=?2 OR name=?3)
|
|
LIMIT 1
|
|
)
|
|
RETURNING id",
|
|
)
|
|
.bind(r.provider_id)
|
|
.bind(&r.model_id)
|
|
.bind(&r.name)
|
|
.bind(r.priority as i64)
|
|
.fetch_optional(pool)
|
|
.await
|
|
.context("image_generate_models: restore soft-deleted")?;
|
|
|
|
if let Some(id) = restored {
|
|
return Ok(id);
|
|
}
|
|
|
|
sqlx::query_scalar::<_, i64>(
|
|
"INSERT INTO image_generate_models (provider_id, model_id, name, priority)
|
|
VALUES (?1, ?2, ?3, ?4)
|
|
RETURNING id",
|
|
)
|
|
.bind(r.provider_id)
|
|
.bind(&r.model_id)
|
|
.bind(&r.name)
|
|
.bind(r.priority as i64)
|
|
.fetch_one(pool)
|
|
.await
|
|
.context("image_generate_models: insert")
|
|
}
|
|
|
|
pub async fn update(pool: &SqlitePool, id: i64, r: &ImageGenerateModelRecord) -> Result<()> {
|
|
sqlx::query(
|
|
"UPDATE image_generate_models
|
|
SET provider_id=?1, model_id=?2, name=?3, priority=?4
|
|
WHERE id=?5",
|
|
)
|
|
.bind(r.provider_id)
|
|
.bind(&r.model_id)
|
|
.bind(&r.name)
|
|
.bind(r.priority as i64)
|
|
.bind(id)
|
|
.execute(pool)
|
|
.await
|
|
.context("image_generate_models: update")?;
|
|
Ok(())
|
|
}
|
|
|
|
pub async fn soft_delete(pool: &SqlitePool, id: i64) -> Result<()> {
|
|
sqlx::query(
|
|
"UPDATE image_generate_models SET removed_at = datetime('now') WHERE id = ?1",
|
|
)
|
|
.bind(id)
|
|
.execute(pool)
|
|
.await
|
|
.context("image_generate_models: soft-delete")?;
|
|
Ok(())
|
|
}
|
|
|
|
fn row_to_record(r: ImageGenerateModelRow) -> ImageGenerateModelRecord {
|
|
ImageGenerateModelRecord {
|
|
id: r.id,
|
|
provider_id: r.provider_id,
|
|
model_id: r.model_id,
|
|
name: r.name,
|
|
priority: r.priority as i32,
|
|
}
|
|
}
|