prometheus/service/db.js

/**
 * The listings database — a SQLite file next to the service.
 *
 * The service is small enough that one file + prepared statements beats a
 * server-side DB, and node:sqlite (Node 22+) keeps that free from a native
 * build step. Everything synchronous — fine for the volume we expect at
 * launch, and the schema migrates easily to Postgres if volume forces it.
 *
 * The schema deliberately duplicates the publisher BNS name into the row:
 * a listing is identified by `<publisher>/<slug>`, and that composite is
 * what browse URLs point at. Changing a publisher name later would mean a
 * new row, not an UPDATE — which matches reality (ownership transfers of a
 * BNS name do not transfer the apps published under it).
 */

import { DatabaseSync } from 'node:sqlite';
import { mkdirSync } from 'node:fs';
import { resolve, dirname } from 'node:path';
import { fileURLToPath } from 'node:url';

const DB_PATH = process.env.PROMETHEUS_DB
  || resolve(dirname(fileURLToPath(import.meta.url)), '..', 'db.sqlite');

mkdirSync(dirname(DB_PATH), { recursive: true });

export const db = new DatabaseSync(DB_PATH);

db.exec(`
  PRAGMA journal_mode = WAL;
  PRAGMA foreign_keys = ON;

  CREATE TABLE IF NOT EXISTS listings (
    id              TEXT PRIMARY KEY,
    publisher       TEXT NOT NULL,
    slug            TEXT NOT NULL,
    name            TEXT NOT NULL,
    description     TEXT NOT NULL,
    category        TEXT NOT NULL,
    version         TEXT NOT NULL,
    homepage        TEXT,
    icon            TEXT,
    download_url    TEXT NOT NULL,
    download_sha256 TEXT NOT NULL,
    download_size   INTEGER NOT NULL,
    scan_report     TEXT NOT NULL,  -- the base64url signed envelope from /api/upload
    signer_address  TEXT NOT NULL,
    signature       TEXT NOT NULL,  -- the publisher's BIP-137 signature
    signed_message  TEXT NOT NULL,  -- exact bytes the publisher signed
    created_at      TEXT NOT NULL,
    withdrawn_at    TEXT,
    -- payment_status is one of: 'free' | 'pending' | 'paid'. Free is the opt-in
    -- default (the launch wave underwrites hosting). When PAYMENT_REQUIRED is
    -- set, new listings land as 'pending' and browse hides them until the
    -- matching invoice settles.
    payment_status  TEXT NOT NULL DEFAULT 'free',
    UNIQUE (publisher, slug)
  );

  CREATE INDEX IF NOT EXISTS idx_listings_category
    ON listings(category) WHERE withdrawn_at IS NULL;
  CREATE INDEX IF NOT EXISTS idx_listings_publisher
    ON listings(publisher);

  -- Invoices for the paid wave. One receiving address serves every invoice;
  -- we distinguish them by amount — each invoice has a random few-sat jitter
  -- on top of the base USD-equivalent, so no two in-flight invoices expect
  -- the same number of sats to the same address at the same time.
  CREATE TABLE IF NOT EXISTS invoices (
    id              TEXT PRIMARY KEY,          -- opaque base32 token
    listing_id      TEXT NOT NULL REFERENCES listings(id) ON DELETE CASCADE,
    address         TEXT NOT NULL,             -- the operator receive address
    amount_sat      INTEGER NOT NULL,          -- exact sats expected
    amount_usd      TEXT NOT NULL,             -- the USD figure the quote was based on
    rate_sat_per_usd INTEGER NOT NULL,         -- the price snapshot used for amount_sat
    issued_at       TEXT NOT NULL,
    expires_at      TEXT NOT NULL,             -- 20 min after issued_at
    status          TEXT NOT NULL DEFAULT 'pending',  -- 'pending' | 'paid' | 'expired'
    paid_at         TEXT,
    paid_txid       TEXT,
    paid_by         TEXT                        -- 'manual' | 'watcher'
  );
  CREATE INDEX IF NOT EXISTS idx_invoices_listing ON invoices(listing_id);
  CREATE INDEX IF NOT EXISTS idx_invoices_status  ON invoices(status);

  -- Operator-visible settings. Admin reads/writes through /admin/modes etc.
  -- Values are text; callers coerce when they read.
  CREATE TABLE IF NOT EXISTS settings (
    key         TEXT PRIMARY KEY,
    value       TEXT NOT NULL,
    updated_at  TEXT NOT NULL,
    updated_by  TEXT          -- admin BNS name, NULL for seeded defaults
  );

  -- Append-only hash-chained audit log. Every admin action lands a row; the
  -- chain lets a later reader detect retroactive edits (if row N's prev_hash
  -- does not match row N-1's this_hash, something was tampered with).
  CREATE TABLE IF NOT EXISTS audit (
    seq         INTEGER PRIMARY KEY AUTOINCREMENT,
    at          TEXT NOT NULL,
    actor       TEXT NOT NULL,         -- admin BNS name
    action      TEXT NOT NULL,         -- 'withdraw_listing', 'set_mode', 'login', …
    target      TEXT,                  -- a listing id, a mode key, …
    details     TEXT,                  -- canonical JSON of {before, after, note}
    prev_hash   TEXT NOT NULL,         -- 64 hex of previous row's this_hash
    this_hash   TEXT NOT NULL          -- sha256 over (seq||at||actor||action||target||details||prev_hash)
  );
`);

/* ----------------------- prepared statements ----------------------- */

const stmtInsert = db.prepare(`
  INSERT INTO listings (
    id, publisher, slug, name, description, category, version,
    homepage, icon, download_url, download_sha256, download_size,
    scan_report, signer_address, signature, signed_message, created_at
  ) VALUES (
    @id, @publisher, @slug, @name, @description, @category, @version,
    @homepage, @icon, @download_url, @download_sha256, @download_size,
    @scan_report, @signer_address, @signature, @signed_message, @created_at
  )
`);

const stmtGet = db.prepare(`SELECT * FROM listings WHERE id = ?`);

// "Visible" rows are those that would be shown on browse — not withdrawn, not
// awaiting payment. 'free' and 'paid' both qualify as settled.
const stmtAllActive = db.prepare(`
  SELECT * FROM listings
   WHERE withdrawn_at IS NULL AND payment_status IN ('free', 'paid')
   ORDER BY created_at DESC
`);

const stmtByCategory = db.prepare(`
  SELECT * FROM listings
   WHERE category = ?
     AND withdrawn_at IS NULL
     AND payment_status IN ('free', 'paid')
   ORDER BY created_at DESC
`);

const stmtByPublisher = db.prepare(`
  SELECT * FROM listings WHERE publisher = ? ORDER BY created_at DESC
`);

const stmtCountActive = db.prepare(`
  SELECT COUNT(*) AS n FROM listings
   WHERE withdrawn_at IS NULL AND payment_status IN ('free', 'paid')
`);

const stmtCountByCategory = db.prepare(`
  SELECT category, COUNT(*) AS n FROM listings
   WHERE withdrawn_at IS NULL AND payment_status IN ('free', 'paid')
   GROUP BY category
`);

/* ----------------------- public helpers ----------------------- */

export function insertListing(row) {
  stmtInsert.run(row);
}

export function getListing(id) {
  return stmtGet.get(id) || null;
}

export function allActiveListings() {
  return stmtAllActive.all();
}

export function listingsByCategory(category) {
  return stmtByCategory.all(category);
}

export function listingsByPublisher(publisher) {
  return stmtByPublisher.all(publisher);
}

export function countActive() {
  return stmtCountActive.get().n;
}

export function countByCategory() {
  const rows = stmtCountByCategory.all();
  const out = {};
  for (const row of rows) out[row.category] = row.n;
  return out;
}

/* ----------------------- withdrawal + takedown ----------------------- */

const stmtWithdraw = db.prepare(`
  UPDATE listings SET withdrawn_at = ? WHERE id = ? AND withdrawn_at IS NULL
`);

/**
 * Mark a listing withdrawn. No-op if already withdrawn.
 * @returns {boolean} true if a row was updated.
 */
export function withdrawListing(id, atIso) {
  const info = stmtWithdraw.run(atIso, id);
  return info.changes > 0;
}

const stmtAllIncludingWithdrawn = db.prepare(`
  SELECT * FROM listings ORDER BY created_at DESC
`);

export function allListingsIncludingWithdrawn() {
  return stmtAllIncludingWithdrawn.all();
}

/* ----------------------- settings ----------------------- */

const stmtSettingsGet = db.prepare(`SELECT value FROM settings WHERE key = ?`);
const stmtSettingsSet = db.prepare(`
  INSERT INTO settings (key, value, updated_at, updated_by)
       VALUES (@key, @value, @updated_at, @updated_by)
  ON CONFLICT(key) DO UPDATE SET
    value = excluded.value,
    updated_at = excluded.updated_at,
    updated_by = excluded.updated_by
`);
const stmtSettingsAll = db.prepare(`SELECT * FROM settings ORDER BY key`);

export function getSetting(key, fallback = null) {
  const row = stmtSettingsGet.get(key);
  return row ? row.value : fallback;
}

export function setSetting(key, value, updatedBy, atIso) {
  stmtSettingsSet.run({ key, value: String(value), updated_at: atIso, updated_by: updatedBy || null });
}

export function allSettings() {
  return stmtSettingsAll.all();
}

/* ----------------------- audit log ----------------------- */

const stmtAuditInsert = db.prepare(`
  INSERT INTO audit (at, actor, action, target, details, prev_hash, this_hash)
       VALUES (@at, @actor, @action, @target, @details, @prev_hash, @this_hash)
`);
const stmtAuditTail = db.prepare(`SELECT this_hash FROM audit ORDER BY seq DESC LIMIT 1`);
const stmtAuditRecent = db.prepare(`SELECT * FROM audit ORDER BY seq DESC LIMIT ?`);

/**
 * Last `this_hash`, or 64 zeros when the log is empty — the chain anchor.
 */
export function auditTailHash() {
  const row = stmtAuditTail.get();
  return row ? row.this_hash : '0'.repeat(64);
}

export function insertAuditRow(row) {
  stmtAuditInsert.run(row);
}

export function recentAudit(limit = 50) {
  return stmtAuditRecent.all(limit);
}

/* ----------------------- invoices ----------------------- */

const stmtInsertListingWithStatus = db.prepare(`
  INSERT INTO listings (
    id, publisher, slug, name, description, category, version,
    homepage, icon, download_url, download_sha256, download_size,
    scan_report, signer_address, signature, signed_message, created_at,
    payment_status
  ) VALUES (
    @id, @publisher, @slug, @name, @description, @category, @version,
    @homepage, @icon, @download_url, @download_sha256, @download_size,
    @scan_report, @signer_address, @signature, @signed_message, @created_at,
    @payment_status
  )
`);

/** Insert a listing while explicitly setting payment_status (for paid mode). */
export function insertListingWithPaymentStatus(row) {
  stmtInsertListingWithStatus.run(row);
}

const stmtListingSetPaid = db.prepare(`
  UPDATE listings SET payment_status = 'paid'
   WHERE id = ? AND payment_status != 'paid'
`);

export function markListingPaid(id) {
  const info = stmtListingSetPaid.run(id);
  return info.changes > 0;
}

const stmtInvInsert = db.prepare(`
  INSERT INTO invoices (
    id, listing_id, address, amount_sat, amount_usd, rate_sat_per_usd,
    issued_at, expires_at
  ) VALUES (
    @id, @listing_id, @address, @amount_sat, @amount_usd, @rate_sat_per_usd,
    @issued_at, @expires_at
  )
`);
const stmtInvGet = db.prepare(`SELECT * FROM invoices WHERE id = ?`);
const stmtInvByListing = db.prepare(`
  SELECT * FROM invoices WHERE listing_id = ? ORDER BY issued_at DESC
`);
const stmtInvAll = db.prepare(`SELECT * FROM invoices ORDER BY issued_at DESC`);
const stmtInvMarkPaid = db.prepare(`
  UPDATE invoices
     SET status = 'paid', paid_at = @paid_at, paid_txid = @paid_txid, paid_by = @paid_by
   WHERE id = @id AND status = 'pending'
`);
const stmtInvMarkExpired = db.prepare(`
  UPDATE invoices SET status = 'expired'
   WHERE id = ? AND status = 'pending' AND datetime(expires_at) < datetime('now')
`);
const stmtInvPendingByAddr = db.prepare(`
  SELECT * FROM invoices
   WHERE address = ? AND amount_sat = ? AND status = 'pending'
     AND datetime(expires_at) >= datetime('now')
   ORDER BY issued_at ASC
   LIMIT 1
`);

export function insertInvoice(row)      { stmtInvInsert.run(row); }
export function getInvoice(id)          { return stmtInvGet.get(id) || null; }
export function invoicesForListing(id)  { return stmtInvByListing.all(id); }
export function allInvoices()           { return stmtInvAll.all(); }
export function markInvoicePaid(args)   { const info = stmtInvMarkPaid.run(args); return info.changes > 0; }
export function markInvoiceExpired(id)  { const info = stmtInvMarkExpired.run(id); return info.changes > 0; }
export function matchPendingInvoice(address, amount_sat) {
  return stmtInvPendingByAddr.get(address, amount_sat) || null;
}