dguiducci
178a38357e
Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.
## UserManager + per-user encryption (§9/§11)
New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.
New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).
- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
<0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
`create_owner_tables` (one owner's content, identical in every file). No FK in
the owner bucket may reach the registry — enforced by a standalone test.
Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
so a crash leaves an orphan file, never a user without a database. `open_db`
never creates: a missing file is an error, not a silent empty database.
Not consumed yet: no login, call sites still use the shared system.db pool.
## Extract crates/skald-core
The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:
- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
(sibling of `http_router`), so the core no longer downcasts to
`MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
teardown-and-respawn; the core defaults to the supervisor exit code. The core
loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
only emits tracing events.
All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.
57 lines
1.9 KiB
Rust
57 lines
1.9 KiB
Rust
//! How this binary renders the bootstrap lines that `skald_core::boot` emits.
|
|
//!
|
|
//! Rendering is the shell's business, not the core's: a desktop bundle or a
|
|
//! setup wizard would format the same `boot` target differently, or not at all.
|
|
//! Wired in `main.rs` as a stdout layer filtered on `boot::TARGET`, independent
|
|
//! of `RUST_LOG`, so this output always appears whatever the log filter is.
|
|
|
|
use std::fmt;
|
|
|
|
use tracing::field::{Field, Visit};
|
|
use tracing::{Event, Level};
|
|
use tracing_subscriber::fmt::format::Writer;
|
|
use tracing_subscriber::fmt::{FmtContext, FormatEvent, FormatFields};
|
|
use tracing_subscriber::registry::LookupSpan;
|
|
|
|
/// Minimal stdout formatter for bootstrap lines: prints just the event's
|
|
/// message (no timestamp/level/target), in red when the level is WARN or ERROR.
|
|
pub struct BootFormat;
|
|
|
|
#[derive(Default)]
|
|
struct MessageVisitor(String);
|
|
|
|
impl Visit for MessageVisitor {
|
|
fn record_debug(&mut self, field: &Field, value: &dyn fmt::Debug) {
|
|
if field.name() == "message" {
|
|
use std::fmt::Write;
|
|
let _ = write!(self.0, "{value:?}");
|
|
}
|
|
}
|
|
}
|
|
|
|
impl<S, N> FormatEvent<S, N> for BootFormat
|
|
where
|
|
S: tracing::Subscriber + for<'a> LookupSpan<'a>,
|
|
N: for<'a> FormatFields<'a> + 'static,
|
|
{
|
|
fn format_event(
|
|
&self,
|
|
_ctx: &FmtContext<'_, S, N>,
|
|
mut writer: Writer<'_>,
|
|
event: &Event<'_>,
|
|
) -> fmt::Result {
|
|
let mut visitor = MessageVisitor::default();
|
|
event.record(&mut visitor);
|
|
|
|
// Level ordering in tracing: TRACE > DEBUG > INFO > WARN > ERROR, so
|
|
// `<= WARN` matches both WARN and ERROR.
|
|
let is_failure = *event.metadata().level() <= Level::WARN;
|
|
if writer.has_ansi_escapes() && is_failure {
|
|
write!(writer, "\u{1b}[31m{}\u{1b}[0m", visitor.0)?;
|
|
} else {
|
|
write!(writer, "{}", visitor.0)?;
|
|
}
|
|
writeln!(writer)
|
|
}
|
|
}
|