Changeset 0.29.0 (#195)

2026-03-17 16:28:47 +00:00
parent 128cbb8174
commit 5d637d3a90
129 changed files with 9418 additions and 3016 deletions
--- a/server/store/postgres/extension_permissions.go
+++ b/server/store/postgres/extension_permissions.go
@@ -0,0 +1,169 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"git.gobha.me/xcaliber/chat-switchboard/models"
+)
+
+type ExtensionPermissionStore struct {
+	db *sql.DB
+}
+
+func NewExtensionPermissionStore(db *sql.DB) *ExtensionPermissionStore {
+	return &ExtensionPermissionStore{db: db}
+}
+
+func (s *ExtensionPermissionStore) DeclareForPackage(ctx context.Context, packageID string, permissions []string) error {
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+
+	// Remove permissions no longer in manifest
+	if len(permissions) == 0 {
+		_, err = tx.ExecContext(ctx, `DELETE FROM extension_permissions WHERE package_id = $1`, packageID)
+		if err != nil {
+			return err
+		}
+		return tx.Commit()
+	}
+
+	// Build set of current declared
+	declared := make(map[string]bool, len(permissions))
+	for _, p := range permissions {
+		declared[p] = true
+	}
+
+	// Get existing
+	rows, err := tx.QueryContext(ctx,
+		`SELECT permission FROM extension_permissions WHERE package_id = $1`, packageID)
+	if err != nil {
+		return err
+	}
+	existing := make(map[string]bool)
+	for rows.Next() {
+		var perm string
+		if err := rows.Scan(&perm); err != nil {
+			rows.Close()
+			return err
+		}
+		existing[perm] = true
+	}
+	rows.Close()
+
+	// Delete removed
+	for perm := range existing {
+		if !declared[perm] {
+			_, err = tx.ExecContext(ctx,
+				`DELETE FROM extension_permissions WHERE package_id = $1 AND permission = $2`,
+				packageID, perm)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	// Upsert new (preserving existing grants)
+	for _, perm := range permissions {
+		if !existing[perm] {
+			_, err = tx.ExecContext(ctx,
+				`INSERT INTO extension_permissions (id, package_id, permission)
+				 VALUES (gen_random_uuid(), $1, $2)
+				 ON CONFLICT (package_id, permission) DO NOTHING`,
+				packageID, perm)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (s *ExtensionPermissionStore) ListForPackage(ctx context.Context, packageID string) ([]models.ExtensionPermission, error) {
+	rows, err := s.db.QueryContext(ctx,
+		`SELECT id, package_id, permission, granted, granted_by, granted_at, created_at
+		 FROM extension_permissions
+		 WHERE package_id = $1
+		 ORDER BY permission`, packageID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var perms []models.ExtensionPermission
+	for rows.Next() {
+		var p models.ExtensionPermission
+		if err := rows.Scan(&p.ID, &p.PackageID, &p.Permission, &p.Granted, &p.GrantedBy, &p.GrantedAt, &p.CreatedAt); err != nil {
+			return nil, err
+		}
+		perms = append(perms, p)
+	}
+	if perms == nil {
+		perms = []models.ExtensionPermission{}
+	}
+	return perms, nil
+}
+
+func (s *ExtensionPermissionStore) GrantedForPackage(ctx context.Context, packageID string) ([]string, error) {
+	rows, err := s.db.QueryContext(ctx,
+		`SELECT permission FROM extension_permissions
+		 WHERE package_id = $1 AND granted = true
+		 ORDER BY permission`, packageID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var perms []string
+	for rows.Next() {
+		var p string
+		if err := rows.Scan(&p); err != nil {
+			return nil, err
+		}
+		perms = append(perms, p)
+	}
+	if perms == nil {
+		perms = []string{}
+	}
+	return perms, nil
+}
+
+func (s *ExtensionPermissionStore) Grant(ctx context.Context, packageID, permission, grantedBy string) error {
+	now := time.Now()
+	_, err := s.db.ExecContext(ctx,
+		`UPDATE extension_permissions
+		 SET granted = true, granted_by = $1, granted_at = $2
+		 WHERE package_id = $3 AND permission = $4`,
+		grantedBy, now, packageID, permission)
+	return err
+}
+
+func (s *ExtensionPermissionStore) Revoke(ctx context.Context, packageID, permission string) error {
+	_, err := s.db.ExecContext(ctx,
+		`UPDATE extension_permissions
+		 SET granted = false, granted_by = NULL, granted_at = NULL
+		 WHERE package_id = $1 AND permission = $2`,
+		packageID, permission)
+	return err
+}
+
+func (s *ExtensionPermissionStore) GrantAll(ctx context.Context, packageID, grantedBy string) error {
+	now := time.Now()
+	_, err := s.db.ExecContext(ctx,
+		`UPDATE extension_permissions
+		 SET granted = true, granted_by = $1, granted_at = $2
+		 WHERE package_id = $3 AND granted = false`,
+		grantedBy, now, packageID)
+	return err
+}
+
+func (s *ExtensionPermissionStore) DeleteForPackage(ctx context.Context, packageID string) error {
+	_, err := s.db.ExecContext(ctx,
+		`DELETE FROM extension_permissions WHERE package_id = $1`, packageID)
+	return err
+}