pike/glyph Public Public: anyone can read this; nobody can change it.

/**

 * Everything the app can do, as plain functions: `(db, who, input)` in,

 * data or a named failure out. The page, the JSON API, the MCP server and

 * the terminal are doors onto these and decide nothing themselves — so a

 * rule written here holds at every door, and a new door is only a new

 * way to call.

 */

import type { Database } from "bun:sqlite";

import { record, type AuditRow } from "./audit.ts";

import { permit } from "./contract.ts";

import { emit } from "./live.ts";

import type { Who } from "./who.ts";

export interface Note {

  readonly id: number;

  readonly body: string;

  readonly author_id: string;

  readonly author_name: string;

  readonly created_at: string;

  readonly updated_at: string;

}

export type Failure = "signin_required" | "forbidden" | "not_found" | "invalid";

export type Result<T> =

  | { ok: true; value: T }

  | { ok: false; error: Failure; message: string };

const ok = <T>(value: T): Result<T> => ({ ok: true, value });

const fail = <T>(error: Failure, message: string): Result<T> => ({

  ok: false,

  error,

  message,

});

export const BODY_MAX = 500;

/** The refusal for a "no": who is not signed in is asked to; who is, is told. */

const refuse = <T>(who: Who, signIn: string, no: string): Result<T> =>

  who.role === "anon" ? fail("signin_required", signIn) : fail("forbidden", no);

/**

 * A change, written into the audit trail whichever way it went: the row it

 * made or touched, or the one it was refused. Every action that changes

 * something returns through here, so the trail holds at every door.

 */

const audited = <T extends { readonly id: number }>(

  db: Database,

  who: Who,

  resource: string,

  verb: "create" | "update" | "delete",

  target: number | undefined,

  result: Result<T>,

): Result<T> => {

  record(db, {

    who,

    resource,

    verb,

    target: result.ok ? result.value.id : target,

    outcome: result.ok ? "ok" : result.error,

  });

  return result;

};

export function listNotes(

  db: Database,

  who: Who,

  input: { limit?: number } = {},

): Result<Note[]> {

  const limit = Math.min(

    Math.max(Math.trunc(input.limit ?? 100) || 100, 1),

    500,

  );

  // "yes" is every note. When the table gives `list` to a role a row holds

  // (`author`), the answer names the columns instead, and the list is the

  // notes that name whoever asks. The names are the contract's, checked when

  // it was read; the value is bound.

  const may = permit(who, "note", "list");

  if (may === "no")

    return refuse(who, "Sign in to see notes.", "You may not see these notes.");

  if (may === "yes")

    return ok(

      db

        .query<Note, [number]>("SELECT * FROM note ORDER BY id DESC LIMIT ?1")

        .all(limit),

    );

  const mine = may.where.map((column) => `${column} = ?2`).join(" OR ");

  return ok(

    db

      .query<

        Note,

        [number, string]

      >(`SELECT * FROM note WHERE ${mine} ORDER BY id DESC LIMIT ?1`)

      .all(limit, who.role === "anon" ? "" : who.id),

  );

}

export const addNote = (

  db: Database,

  who: Who,

  input: { body: string },

): Result<Note> =>

  audited(db, who, "note", "create", undefined, add(db, who, input));

function add(db: Database, who: Who, input: { body: string }): Result<Note> {

  // The table decides; the type only learns it here: whoever may create is

  // signed in, and carries a name to write beside the note.

  if (who.role === "anon" || permit(who, "note", "create") !== "yes")

    return refuse(who, "Sign in to add a note.", "You may not add a note.");

  const body = input.body.trim();

  if (body.length === 0 || body.length > BODY_MAX)

    return fail("invalid", `A note is 1 to ${BODY_MAX} characters.`);

  const note = db

    .query<

      Note,

      [string, string, string]

    >("INSERT INTO note (body, author_id, author_name) VALUES (?1, ?2, ?3) RETURNING *")

    .get(body, who.id, who.name)!;

  emit("note.added", note);

  return ok(note);

}

/**

 * One note, for `who` to do `verb` to. The door is asked before the row is

 * looked for, so whoever may not is told that and never learns whether the

 * row exists; whoever may, and asked for nothing, hears `not_found`.

 */

function noteFor(

  db: Database,

  who: Who,

  verb: "read" | "update" | "delete",

  id: number,

  said: { signIn: string; no: string },

): Result<Note> {

  const note = Number.isInteger(id)

    ? db.query<Note, [number]>("SELECT * FROM note WHERE id = ?1").get(id)

    : null;

  // With no row to show, the door is asked about a row of their own: whoever

  // could not pass even then is refused, and learns nothing about what

  // exists; whoever could is told there is no such note.

  const row: Readonly<Record<string, unknown>> =

    note === null ? { author_id: who.role === "anon" ? null : who.id } : { ...note };

  if (permit(who, "note", verb, row) !== "yes")

    return refuse(who, said.signIn, said.no);

  if (note !== null) return ok(note);

  if (!Number.isInteger(id))

    return fail("invalid", "A note id is a whole number.");

  return fail("not_found", "No such note.");

}

export function getNote(

  db: Database,

  who: Who,

  input: { id: number },

): Result<Note> {

  return noteFor(db, who, "read", input.id, {

    signIn: "Sign in to read this note.",

    no: "You may not read this note.",

  });

}

export const updateNote = (

  db: Database,

  who: Who,

  input: { id: number; body: string },

): Result<Note> =>

  audited(db, who, "note", "update", input.id, update(db, who, input));

function update(

  db: Database,

  who: Who,

  input: { id: number; body: string },

): Result<Note> {

  const found = noteFor(db, who, "update", input.id, {

    signIn: "Sign in to edit a note.",

    no: "Only the author or an admin can edit a note.",

  });

  if (!found.ok) return found;

  const body = input.body.trim();

  if (body.length === 0 || body.length > BODY_MAX)

    return fail("invalid", `A note is 1 to ${BODY_MAX} characters.`);

  const note = db

    .query<

      Note,

      [string, number]

    >("UPDATE note SET body = ?1, updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ?2 RETURNING *")

    .get(body, found.value.id)!;

  emit("note.changed", note);

  return ok(note);

}

export const deleteNote = (

  db: Database,

  who: Who,

  input: { id: number },

): Result<{ id: number }> =>

  audited(db, who, "note", "delete", input.id, remove(db, who, input));

function remove(

  db: Database,

  who: Who,

  input: { id: number },

): Result<{ id: number }> {

  const found = noteFor(db, who, "delete", input.id, {

    signIn: "Sign in to remove a note.",

    no: "Only the author or an admin can remove a note.",

  });

  if (!found.ok) return found;

  db.query("DELETE FROM note WHERE id = ?1").run(found.value.id);

  emit("note.removed", { id: found.value.id });

  return ok({ id: found.value.id });

}

/** Whether `who` may remove `note`: the table's answer, for the page and the terminal to draw from. */

export const canDelete = (who: Who, note: Note): boolean =>

  permit(who, "note", "delete", { ...note }) === "yes";

/**

 * The audit trail, newest first, for whoever the table lets read it (an

 * admin, as the scaffold has it). `before` pages back by id. Audit rows name

 * no author, so a cell that gave `list` to a row's role would find nothing

 * of its own: anything but "yes" is a refusal here.

 */

export function listAudit(

  db: Database,

  who: Who,

  input: { limit?: number; before?: number } = {},

): Result<AuditRow[]> {

  if (permit(who, "audit", "list") !== "yes")

    return refuse(

      who,

      "Sign in to read the audit trail.",

      "Only an admin can read the audit trail.",

    );

  const limit = Math.min(

    Math.max(Math.trunc(input.limit ?? 100) || 100, 1),

    500,

  );

  const before = Number.isInteger(input.before)

    ? input.before!

    : Number.MAX_SAFE_INTEGER;

  return ok(

    db

      .query<

        AuditRow,

        [number, number]

      >("SELECT * FROM audit WHERE id < ?1 ORDER BY id DESC LIMIT ?2")

      .all(before, limit),

  );

}

export function getAudit(

  db: Database,

  who: Who,

  input: { id: number },

): Result<AuditRow> {

  const row = Number.isInteger(input.id)

    ? db

        .query<AuditRow, [number]>("SELECT * FROM audit WHERE id = ?1")

        .get(input.id)

    : null;

  if (permit(who, "audit", "read", { ...row }) !== "yes")

    return refuse(

      who,

      "Sign in to read the audit trail.",

      "Only an admin can read the audit trail.",

    );

  if (row !== null) return ok(row);

  if (!Number.isInteger(input.id))

    return fail("invalid", "An audit id is a whole number.");

  return fail("not_found", "No such audit row.");

}