Merge origin/security into security

Author: farhan-syah

docs/full-text-search.md

@@ -39,6 +39,12 @@ CREATE SEARCH INDEX ON articles FIELDS title, body
     ANALYZER 'english'
     FUZZY true;
 
+-- `CREATE FULLTEXT INDEX` is an exact alias, and the column list may also be
+-- written in parentheses. ANALYZER takes 'standard' or a supported language
+-- name; an unknown name is rejected rather than silently falling back.
+-- FUZZY sets the collection default — queries may still opt in per call.
+CREATE FULLTEXT INDEX idx_articles_text ON articles (title, body) ANALYZER 'english';
+
 -- Basic search with text_match
 SELECT title, bm25_score(body, 'distributed database rust') AS score
 FROM articles

docs/spatial.md

@@ -17,8 +17,10 @@ Spatial is a **columnar profile**. Collections with a `SPATIAL_INDEX` column mod
 - **R\*-tree index** — Bulk loading, nearest neighbor, range queries
 - **Geohash** — Encode/decode, neighbor cells, area covering
 - **H3 hexagonal index** — Uber's H3 via h3o for uniform-area spatial binning
-- **OGC predicates** — `ST_Contains`, `ST_Intersects`, `ST_Within`, `ST_DWithin`, `ST_Distance`, `ST_Intersection`, `ST_Buffer`, `ST_Envelope`, `ST_Union`
-- **Geometry constructors** — `ST_MakePoint`, `ST_GeomFromText` (WKT), `ST_GeomFromWKB`, `ST_GeomFromGeoJSON` — usable directly in `INSERT VALUES`
+- **OGC predicates** — `ST_Contains`, `ST_Intersects`, `ST_Within`, `ST_Disjoint`, `ST_DWithin`, `ST_IsValid`
+- **Geometry constructors** — `ST_Point`, `ST_MakePoint`, `ST_GeomFromText` (WKT), `ST_GeomFromWKB`, `ST_GeomFromGeoJSON`, `ST_MakeLine`, `ST_MakePolygon`, `ST_MakeEnvelope`
+- **Accessors and measures** — `ST_AsText`, `ST_AsGeoJSON`, `ST_X`, `ST_Y`, `ST_GeometryType`, `ST_NPoints`, `ST_SRID`, `ST_Distance`, `ST_Length`, `ST_Perimeter`, `ST_Area`
+- **Geometry operations** — `ST_Buffer`, `ST_Envelope`, `ST_Centroid`, `ST_Union`, `ST_Intersection`
 - **Format support** — WKB, WKT, GeoJSON interchange. GeoParquet v1.1.0 + GeoArrow metadata.
 - **Hybrid spatial-vector** — Spatial R\*-tree narrows candidates by location, then HNSW ranks by semantic similarity in one query
 - **Spatial join** — R\*-tree probe join between two collections
@@ -82,6 +84,84 @@ FROM restaurants r, delivery_zones z
 WHERE ST_Contains(z.boundary, r.location);
 ```
 
+## Geometry Functions
+
+Every geometry function works in every position a geometry expression may
+appear: an `INSERT` value, a `SELECT` projection, and a spatial predicate's
+query-geometry argument. Constructors nest, so `ST_Buffer(ST_Point(...), 500)`
+is a valid search area.
+
+A string literal in geometry position is read as either WKT or GeoJSON, so
+`ST_DWithin(loc, 'POINT(1 2)', 500)` and
+`ST_DWithin(loc, '{"type":"Point","coordinates":[1,2]}', 500)` are equivalent.
+
+### Constructors
+
+| Function | Result |
+| --- | --- |
+| `ST_Point(lng, lat)` | Point |
+| `ST_MakePoint(x, y [, z])` | Point |
+| `ST_GeomFromText(wkt [, srid])` | Geometry parsed from WKT |
+| `ST_GeomFromGeoJSON(json)` | Geometry parsed from GeoJSON |
+| `ST_GeomFromWKB(bytes [, srid])` | Geometry parsed from WKB; accepts an `X'...'` literal or its hex string |
+| `ST_MakeLine(point, point, ...)` | LineString |
+| `ST_MakePolygon(ring, ...)` | Polygon, each ring an array of `[lng, lat]` pairs |
+| `ST_MakeEnvelope(min_lng, min_lat, max_lng, max_lat)` | Rectangular Polygon |
+
+### Accessors
+
+| Function | Result |
+| --- | --- |
+| `ST_AsText(geom)` | WKT rendering |
+| `ST_AsGeoJSON(geom)` | GeoJSON rendering |
+| `ST_X(geom)` / `ST_Y(geom)` | Ordinate of a Point; NULL for any other geometry |
+| `ST_GeometryType(geom)` | Type name, e.g. `Point` |
+| `ST_NPoints(geom)` | Total vertex count |
+| `ST_SRID(geom)` | Always `4326` — geometry is stored as GeoJSON, which RFC 7946 defines as WGS 84 |
+| `ST_IsValid(geom)` | Whether the geometry is well-formed |
+
+### Measures
+
+Every measure is geodesic: lengths in meters, areas in square meters.
+
+| Function | Result |
+| --- | --- |
+| `ST_Distance(a, b)` | Distance between two geometries |
+| `ST_Length(geom)` | Total length of linear components; `0` for points and polygons |
+| `ST_Perimeter(geom)` | Boundary length of areal components, holes included |
+| `ST_Area(geom)` | Area of areal components, less holes; `0` for points and lines |
+
+### Predicates and operations
+
+| Function | Result |
+| --- | --- |
+| `ST_Contains(a, b)` | Whether `a` contains `b` |
+| `ST_Within(a, b)` | Whether `a` lies within `b` — the converse of `ST_Contains` |
+| `ST_Intersects(a, b)` / `ST_Disjoint(a, b)` | Whether the two geometries share any point |
+| `ST_DWithin(a, b, meters)` | Whether the two geometries lie within a geodesic distance |
+| `ST_Buffer(geom, meters [, segments])` | Geometry grown by a distance |
+| `ST_Envelope(geom)` | Bounding rectangle |
+| `ST_Centroid(geom)` | Centroid, weighted by the highest dimension present |
+| `ST_Union(a, b)` / `ST_Intersection(a, b)` | Combined / shared geometry |
+
+`ST_Contains`, `ST_Within`, `ST_Intersects` and `ST_DWithin` are answered from
+the R\*-tree when the first argument is an indexed geometry column; the rest
+evaluate per row.
+
+```sql
+-- Read stored geometry back in either interchange format
+SELECT name, ST_AsText(location), ST_X(location), ST_Y(location)
+FROM restaurants;
+
+-- Measure and describe
+SELECT name, ST_GeometryType(boundary), ST_Area(boundary), ST_Perimeter(boundary)
+FROM delivery_zones;
+
+-- A buffered point is a valid query geometry
+SELECT name FROM restaurants
+WHERE ST_Within(location, ST_Buffer(ST_Point(-73.990, 40.750), 1000));
+```
+
 ## Spatial as a Peer Engine
 
 The `SPATIAL_INDEX` column modifier designates a geometry column for automatic R\*-tree indexing. Spatial is a peer engine alongside columnar, timeseries, and the rest:

docs/vectors.md

@@ -36,6 +36,11 @@ NodeDB's vector engine is built for production semantic search — not vectors s
 CREATE COLLECTION articles;
 CREATE VECTOR INDEX idx_articles_embedding ON articles METRIC cosine DIM 384;
 
+-- DIM is required and is enforced on every write: an embedding of any other
+-- width is rejected at INSERT rather than quietly indexed at the wrong size.
+-- Name the column explicitly to carry several embeddings on one collection.
+CREATE VECTOR INDEX idx_articles_clip ON articles (clip_embedding) METRIC cosine DIM 512;
+
 -- Insert documents with embeddings
 INSERT INTO articles {
     title: 'Understanding Transformers',

nodedb-cluster-tests/tests/cluster_array.rs

@@ -285,7 +285,7 @@ async fn cluster_array_vector_prefilter_distributed() {
         .expect("CREATE COLLECTION genes");
     cluster
         .exec_ddl_on_any_leader(
-            "CREATE VECTOR INDEX idx_genes_emb ON genes FIELD embedding METRIC cosine DIM 3",
+            "CREATE VECTOR INDEX idx_genes_emb ON genes (embedding) METRIC cosine DIM 3",
         )
         .await
         .expect("CREATE VECTOR INDEX");

nodedb-fts/src/index/analyzer_config.rs

@@ -3,8 +3,9 @@
 //! Per-collection analyzer configuration stored in backend metadata.
 //!
 //! Uses structural `(tid, collection, subkey)` meta blobs:
-//! - `subkey = "analyzer"` → analyzer name (e.g. "german", "cjk_bigram")
+//! - `subkey = "analyzer"` → analyzer name (e.g. "german", "standard")
 //! - `subkey = "language"` → lang code (e.g. "de", "ja")
+//! - `subkey = "fuzzy"` → `"1"` when the collection defaults to fuzzy matching
 //!
 //! Applied automatically at both index time and query time.
 
@@ -49,6 +50,37 @@ impl<B: FtsBackend> FtsIndex<B> {
         )
     }
 
+    /// Set whether searches over this collection fall back to fuzzy
+    /// (Levenshtein) matching by default. Persists to backend metadata.
+    pub fn set_collection_fuzzy(
+        &self,
+        database_id: u64,
+        tid: u64,
+        collection: &str,
+        fuzzy: bool,
+    ) -> Result<(), B::Error> {
+        self.backend.write_meta(
+            database_id,
+            tid,
+            collection,
+            "fuzzy",
+            if fuzzy { b"1" } else { b"0" },
+        )
+    }
+
+    /// Whether this collection defaults to fuzzy matching. `false` when unset.
+    pub fn get_collection_fuzzy(
+        &self,
+        database_id: u64,
+        tid: u64,
+        collection: &str,
+    ) -> Result<bool, B::Error> {
+        Ok(self
+            .backend
+            .read_meta(database_id, tid, collection, "fuzzy")?
+            .is_some_and(|bytes| bytes.as_slice() == b"1"))
+    }
+
     /// Get the configured analyzer name for a collection.
     pub fn get_collection_analyzer(
         &self,
@@ -115,6 +147,20 @@ impl<B: FtsBackend> FtsIndex<B> {
     }
 }
 
+/// Whether `name` resolves to a real analyzer.
+///
+/// [`resolve_analyzer`] falls back to the standard analyzer for anything it
+/// does not know, which silently turns a misspelled analyzer name into a
+/// different analyzer. Callers that accept a name from a user — DDL, config —
+/// gate on this first so the fallback is only ever reached for a name that
+/// was already checked. The two must stay in step: every arm below has a
+/// matching arm there.
+pub fn analyzer_exists(name: &str) -> bool {
+    name == "standard"
+        || LanguageAnalyzer::new(name).is_some()
+        || NoStemAnalyzer::new(name).is_some()
+}
+
 /// Resolve an analyzer name to a `Box<dyn TextAnalyzer>`.
 fn resolve_analyzer(name: &str) -> Box<dyn TextAnalyzer> {
     match name {

nodedb-fts/src/search/bm25_search.rs

@@ -82,6 +82,16 @@ impl<B: FtsBackend> FtsIndex<B> {
             mode,
             prefilter,
         } = params;
+        // A collection configured with `FUZZY true` falls back to fuzzy
+        // matching even when the query did not ask for it — that is what
+        // makes it an index property rather than a per-query flag. Resolved
+        // here, at the one point every search path funnels through, so no
+        // caller can be wired up without it.
+        let fuzzy_enabled = fuzzy_enabled
+            || self
+                .get_collection_fuzzy(database_id, tid, collection)
+                .map_err(FtsIndexError::backend)?;
+
         // Parse the query for NOT / - negation operators before analysis.
         let parsed = parse_query(query)?;
 

nodedb-physical/src/physical_plan/document/mod.rs

@@ -6,6 +6,7 @@ pub mod enforcement_types;
 pub mod merge_types;
 pub mod ollp_edge;
 pub mod op;
+pub mod timeseries_schema;
 pub mod types;
 pub mod update_value;
 
@@ -15,6 +16,7 @@ pub use enforcement_types::{
 pub use merge_types::{MergeActionOp, MergeClauseKind as MergeClauseKindOp, MergeClauseOp};
 pub use ollp_edge::OllpPredictedEdge;
 pub use op::DocumentOp;
+pub use timeseries_schema::TimeseriesSchema;
 pub use types::{
     BalancedDef, EnforcementOptions, GeneratedColumnSpec, MaterializedSumBinding, PeriodLockConfig,
     RegisteredIndex, RegisteredIndexState, ReturningColumns, ReturningItem, ReturningSpec,

nodedb-physical/src/physical_plan/document/op.rs

@@ -4,6 +4,7 @@ use nodedb_types::{Surrogate, SurrogateBitmap, SystemTimeScope};
 
 use super::merge_types::MergeClauseOp;
 use super::ollp_edge::OllpPredictedEdge;
+use super::timeseries_schema::TimeseriesSchema;
 use super::types::{EnforcementOptions, RegisteredIndex, ReturningSpec, StorageMode, UpdateValue};
 
 /// Document engine physical operations (schemaless + strict + DML).
@@ -184,6 +185,12 @@ pub enum DocumentOp {
         /// `None` = no explicit policy persisted; the registry falls back to
         /// the ephemeral default.
         conflict_policy: Option<String>,
+        /// Declared columns + designated `TIME_KEY` for a timeseries
+        /// collection. `Some` for every `engine='timeseries'` collection;
+        /// `None` for every other engine. The Data Plane builds the
+        /// collection's memtable schema from this instead of inferring one
+        /// from the first ingested batch.
+        timeseries: Option<Box<TimeseriesSchema>>,
     },
 
     /// Lookup documents by secondary index value.

nodedb-physical/src/physical_plan/document/timeseries_schema.rs

@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! The declared shape of a timeseries collection, propagated from the
+//! catalog to the Data Plane on collection registration.
+
+/// A timeseries collection's DDL-declared column list plus its designated
+/// `TIME_KEY` column.
+///
+/// This is the authority for the collection's storage layout. Without it the
+/// Data Plane would have to derive a schema from whatever the first ingested
+/// batch happened to contain, which cannot recover the declared column order,
+/// the declared types, or — critically — which column is the time key. Every
+/// path that needs to know "which column carries this collection's time"
+/// reads [`Self::time_key`]; none may guess it from a column name.
+#[derive(
+    Debug,
+    Clone,
+    PartialEq,
+    Eq,
+    serde::Serialize,
+    serde::Deserialize,
+    zerompk::ToMessagePack,
+    zerompk::FromMessagePack,
+)]
+pub struct TimeseriesSchema {
+    /// Name of the designated time-key column, exactly as declared.
+    pub time_key: String,
+    /// Declared `(column_name, type_str)` pairs in declaration order.
+    pub columns: Vec<(String, String)>,
+}
+
+impl TimeseriesSchema {
+    /// Position of the time key in `columns`, or `None` when the declared
+    /// column list does not contain it (an inconsistent catalog record).
+    pub fn time_key_index(&self) -> Option<usize> {
+        self.columns.iter().position(|(n, _)| *n == self.time_key)
+    }
+}

nodedb-physical/src/physical_plan/mod.rs

@@ -33,7 +33,7 @@ pub use crdt::CrdtOp;
 pub use document::{
     BalancedDef, DocumentOp, EnforcementOptions, GeneratedColumnSpec, MaterializedSumBinding,
     OllpPredictedEdge, PeriodLockConfig, RegisteredIndex, RegisteredIndexState, ReturningColumns,
-    ReturningItem, ReturningSpec, StorageMode, UpdateValue,
+    ReturningItem, ReturningSpec, StorageMode, TimeseriesSchema, UpdateValue,
 };
 pub use exchange::{ExchangeMode, ExchangeOp};
 pub use graph::{
@@ -45,7 +45,7 @@ pub use query::{AggregateSpec, GroupKeySpec, JoinProjection, QueryOp};
 pub use routing::plan_contains_cluster_partitioned_leaf;
 pub use spatial::{SpatialOp, SpatialPredicate};
 pub use text::TextOp;
-pub use timeseries::TimeseriesOp;
+pub use timeseries::{TimeseriesOp, UNBOUNDED_TIME_RANGE};
 pub use vector::VectorOp;
 pub use wire::{decode, encode};
 
@@ -279,7 +279,7 @@ impl PhysicalPlan {
             | PhysicalPlan::Text(TextOp::BM25ScoreScan { collection, .. })
             | PhysicalPlan::Text(TextOp::FtsIndexDoc { collection, .. })
             | PhysicalPlan::Text(TextOp::FtsDeleteDoc { collection, .. })
-            | PhysicalPlan::Text(TextOp::SetAnalyzer { collection, .. })
+            | PhysicalPlan::Text(TextOp::SetTextConfig { collection, .. })
             | PhysicalPlan::Query(QueryOp::PartialAggregate { collection, .. })
             | PhysicalPlan::Query(QueryOp::FacetCounts { collection, .. })
             | PhysicalPlan::Document(DocumentOp::BulkUpdate { collection, .. })