|
| 1 | +import { latestByColumn } from '@cipherstash/migrate' |
| 2 | +import type pg from 'pg' |
| 3 | + |
| 4 | +/** |
| 5 | + * `latestByColumn` from `@cipherstash/migrate`, but tolerant of the |
| 6 | + * pre-install case where `cipherstash.cs_migrations` doesn't exist. |
| 7 | + * The encryption-rollout commands all need to be readable on a fresh |
| 8 | + * project; treating "table missing" as "no events" keeps them so. |
| 9 | + */ |
| 10 | +export async function latestByColumnSafe( |
| 11 | + client: pg.ClientBase, |
| 12 | +): Promise<ReturnType<typeof latestByColumn> extends Promise<infer T> ? T : never> { |
| 13 | + try { |
| 14 | + return (await latestByColumn(client)) as Awaited<ReturnType<typeof latestByColumn>> |
| 15 | + } catch (err) { |
| 16 | + if ( |
| 17 | + err instanceof Error && |
| 18 | + /cs_migrations|schema "cipherstash"/i.test(err.message) |
| 19 | + ) { |
| 20 | + return new Map() as Awaited<ReturnType<typeof latestByColumn>> |
| 21 | + } |
| 22 | + throw err |
| 23 | + } |
| 24 | +} |
| 25 | + |
| 26 | +export interface EqlColumnInfo { |
| 27 | + /** Index kinds attached to this column in the EQL config (`unique`, |
| 28 | + * `match`, `ore`, `ste_vec`). Empty when no indexes are configured. */ |
| 29 | + indexes: string[] |
| 30 | + /** Lifecycle state of the EQL config row this column belongs to. */ |
| 31 | + state: 'active' | 'pending' | 'encrypting' |
| 32 | +} |
| 33 | + |
| 34 | +/** |
| 35 | + * Read every column registered in `eql_v2_configuration` (active, |
| 36 | + * pending, or encrypting) keyed by `<table>.<column>`. Active rows win |
| 37 | + * when a column appears in more than one state. |
| 38 | + * |
| 39 | + * The call is best-effort: if `eql_v2_configuration` doesn't exist yet |
| 40 | + * (EQL not installed), an empty map is returned instead of throwing. |
| 41 | + */ |
| 42 | +export async function fetchActiveEqlConfig( |
| 43 | + client: pg.ClientBase, |
| 44 | +): Promise<Map<string, EqlColumnInfo>> { |
| 45 | + const out = new Map<string, EqlColumnInfo>() |
| 46 | + try { |
| 47 | + const result = await client.query<{ state: string; data: unknown }>( |
| 48 | + `SELECT state, data FROM public.eql_v2_configuration |
| 49 | + WHERE state IN ('active', 'pending', 'encrypting') |
| 50 | + ORDER BY CASE state WHEN 'active' THEN 0 WHEN 'encrypting' THEN 1 ELSE 2 END`, |
| 51 | + ) |
| 52 | + for (const row of result.rows) { |
| 53 | + const data = row.data as { |
| 54 | + tables?: Record< |
| 55 | + string, |
| 56 | + Record<string, { indexes?: Record<string, unknown> }> |
| 57 | + > |
| 58 | + } | null |
| 59 | + if (!data?.tables) continue |
| 60 | + for (const [tableName, columns] of Object.entries(data.tables)) { |
| 61 | + for (const [columnName, column] of Object.entries(columns)) { |
| 62 | + const key = `${tableName}.${columnName}` |
| 63 | + if (out.has(key)) continue |
| 64 | + out.set(key, { |
| 65 | + indexes: Object.keys(column.indexes ?? {}), |
| 66 | + state: row.state as 'active' | 'pending' | 'encrypting', |
| 67 | + }) |
| 68 | + } |
| 69 | + } |
| 70 | + } |
| 71 | + } catch (err) { |
| 72 | + if (err instanceof Error && /eql_v2_configuration/i.test(err.message)) { |
| 73 | + return out |
| 74 | + } |
| 75 | + throw err |
| 76 | + } |
| 77 | + return out |
| 78 | +} |
| 79 | + |
| 80 | +/** |
| 81 | + * Read `information_schema.columns` and group column names by table. |
| 82 | + * When `tables` is provided the query is constrained to that set — |
| 83 | + * status's quest log only ever needs ~5 specific tables, so passing |
| 84 | + * the manifest's tables avoids a full-schema scan. |
| 85 | + */ |
| 86 | +export async function fetchPhysicalColumns( |
| 87 | + client: pg.ClientBase, |
| 88 | + tables?: ReadonlyArray<string>, |
| 89 | +): Promise<Map<string, Set<string>>> { |
| 90 | + const out = new Map<string, Set<string>>() |
| 91 | + try { |
| 92 | + const result = |
| 93 | + tables === undefined |
| 94 | + ? await client.query<{ table_name: string; column_name: string }>( |
| 95 | + `SELECT table_name, column_name FROM information_schema.columns |
| 96 | + WHERE table_schema = current_schema()`, |
| 97 | + ) |
| 98 | + : await client.query<{ table_name: string; column_name: string }>( |
| 99 | + `SELECT table_name, column_name FROM information_schema.columns |
| 100 | + WHERE table_schema = current_schema() |
| 101 | + AND table_name = ANY($1::text[])`, |
| 102 | + [tables], |
| 103 | + ) |
| 104 | + for (const row of result.rows) { |
| 105 | + const set = out.get(row.table_name) ?? new Set<string>() |
| 106 | + set.add(row.column_name) |
| 107 | + out.set(row.table_name, set) |
| 108 | + } |
| 109 | + } catch { |
| 110 | + // information_schema is always present; failures here are surprising |
| 111 | + // enough to swallow rather than crash the read-only status path. |
| 112 | + } |
| 113 | + return out |
| 114 | +} |
0 commit comments