dguiducci
178a38357e
Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.
## UserManager + per-user encryption (§9/§11)
New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.
New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).
- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
<0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
`create_owner_tables` (one owner's content, identical in every file). No FK in
the owner bucket may reach the registry — enforced by a standalone test.
Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
so a crash leaves an orphan file, never a user without a database. `open_db`
never creates: a missing file is an error, not a silent empty database.
Not consumed yet: no login, call sites still use the shared system.db pool.
## Extract crates/skald-core
The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:
- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
(sibling of `http_router`), so the core no longer downcasts to
`MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
teardown-and-respawn; the core defaults to the supervisor exit code. The core
loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
only emits tracing events.
All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.
73 lines
2.6 KiB
Rust
73 lines
2.6 KiB
Rust
use std::sync::Arc;
|
|
|
|
use anyhow::Result;
|
|
use serde_json::{Value, json};
|
|
|
|
use crate::plugin::PluginManager;
|
|
use crate::tools::{Tool, ToolDescriptionLength};
|
|
|
|
pub struct ConfigurePlugin(pub Arc<PluginManager>);
|
|
|
|
impl Tool for ConfigurePlugin {
|
|
fn name(&self) -> &str { "configure_plugin" }
|
|
fn category(&self) -> crate::tools::ToolCategory { crate::tools::ToolCategory::Config }
|
|
|
|
fn description(&self) -> &str {
|
|
"Update the configuration of a plugin and restart it immediately. \
|
|
Use `list_items` (type=plugins) to see available plugin ids and their config schemas. \
|
|
The config object must match the plugin's schema — extra keys are ignored."
|
|
}
|
|
|
|
fn parameters_schema(&self) -> Value {
|
|
json!({
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "string",
|
|
"description": "Plugin id (e.g. \"remote_connectivity\", \"telegram\")."
|
|
},
|
|
"config": {
|
|
"type": "object",
|
|
"description": "Config object matching the plugin's schema. Existing keys not provided here are cleared.",
|
|
"additionalProperties": true
|
|
},
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Whether to enable the plugin. Defaults to true.",
|
|
"default": true
|
|
}
|
|
},
|
|
"required": ["id", "config"]
|
|
})
|
|
}
|
|
|
|
fn describe(&self, args: &Value, _length: ToolDescriptionLength) -> String {
|
|
let id = args["id"].as_str().unwrap_or("?");
|
|
let enabled = args["enabled"].as_bool().unwrap_or(true);
|
|
let action = if enabled { "configure" } else { "disable" };
|
|
format!("{action} plugin `{id}`")
|
|
}
|
|
|
|
fn execute(&self, args: Value) -> Result<String> {
|
|
let id = args["id"]
|
|
.as_str()
|
|
.ok_or_else(|| anyhow::anyhow!("configure_plugin: missing required argument `id`"))?;
|
|
let config = args["config"].clone();
|
|
if !config.is_object() {
|
|
anyhow::bail!("configure_plugin: `config` must be an object");
|
|
}
|
|
let enabled = args["enabled"].as_bool().unwrap_or(true);
|
|
|
|
tokio::task::block_in_place(|| {
|
|
tokio::runtime::Handle::current()
|
|
.block_on(self.0.update_config(id, enabled, config))
|
|
})?;
|
|
|
|
Ok(format!(
|
|
"Plugin '{}' configured and {}.",
|
|
id,
|
|
if enabled { "started" } else { "stopped" }
|
|
))
|
|
}
|
|
}
|