dckcandClaude Opus 5.5
7fcd251261
Each request parsed every mount's labels and searched them in JS. Labels now sit one per row in mount_label, indexed on (key, value): a lookup joins the request's labels (json_each) on the index and keeps the vat whose every label matched. The overlap check at registration is SQL too. mount.labels keeps the whole set as JSON; mounts stored before mount_label get their rows filled in when the schema runs. The SQL lives in mounts-sql.js, tested on node:sqlite, old-shape state included. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
54 lines
2.2 KiB
JavaScript
54 lines
2.2 KiB
JavaScript
/**
|
|
* @file The ingress's mounts, in SQL: which vat serves which label set.
|
|
*
|
|
* Labels sit one per row, so a lookup can use an index; `mount.labels`
|
|
* keeps the whole set as JSON. Request and mount labels arrive as JSON
|
|
* objects, split into rows by `json_each`.
|
|
*/
|
|
|
|
export const MOUNT_SCHEMA = [
|
|
"CREATE TABLE IF NOT EXISTS mount (vat TEXT PRIMARY KEY, labels TEXT)",
|
|
"CREATE TABLE IF NOT EXISTS mount_label (vat TEXT, key TEXT, value TEXT, PRIMARY KEY (vat, key))",
|
|
"CREATE INDEX IF NOT EXISTS mount_label_kv ON mount_label (key, value)",
|
|
// mounts made before mount_label existed
|
|
`INSERT OR IGNORE INTO mount_label
|
|
SELECT m.vat, j.key, j.value FROM mount m, json_each(m.labels) j
|
|
WHERE NOT EXISTS (SELECT 1 FROM mount_label l WHERE l.vat = m.vat)`,
|
|
];
|
|
|
|
/**
|
|
* Another mount (than ?2's) whose labels conflict with none of ?1's.
|
|
* Flower's registration rule: every mount must conflict with every other.
|
|
*/
|
|
export const OVERLAP = `
|
|
SELECT 1 FROM mount m WHERE m.vat != ?2 AND NOT EXISTS (
|
|
SELECT 1 FROM mount_label l JOIN json_each(?1) r ON r.key = l.key
|
|
WHERE l.vat = m.vat AND l.value != r.value)
|
|
LIMIT 1`;
|
|
|
|
export const MOUNT = "INSERT OR REPLACE INTO mount VALUES (?1, ?2)";
|
|
export const MOUNT_LABELS = "INSERT INTO mount_label SELECT ?1, key, value FROM json_each(?2)";
|
|
export const UNMOUNT = "DELETE FROM mount WHERE vat = ?1";
|
|
export const UNMOUNT_LABELS = "DELETE FROM mount_label WHERE vat = ?1";
|
|
|
|
/**
|
|
* The mount whose every label ?1 (the request's labels) carries, with the
|
|
* same value: the labels that match, counted per vat, against how many
|
|
* the vat has. A mount with no labels matches any request.
|
|
*
|
|
* Stricter than Flower's match (no conflict): an ingress client holds no
|
|
* constrained handle, so a label it omits must not match, or a secret
|
|
* label would protect nothing.
|
|
*/
|
|
export const LOOKUP = `
|
|
SELECT m.vat, m.labels FROM mount m JOIN (
|
|
SELECT l.vat, count(*) AS hits
|
|
FROM json_each(?1) r JOIN mount_label l ON l.key = r.key AND l.value = r.value
|
|
GROUP BY l.vat
|
|
) h ON h.vat = m.vat
|
|
WHERE h.hits = (SELECT count(*) FROM mount_label WHERE vat = m.vat)
|
|
UNION ALL
|
|
SELECT m.vat, m.labels FROM mount m
|
|
WHERE NOT EXISTS (SELECT 1 FROM mount_label l WHERE l.vat = m.vat)
|
|
LIMIT 1`;
|