feat(database): add account-scoped database manager

scripts/test-cloud.mjs

@@ -8,6 +8,7 @@ const sqlite = new DatabaseSync(":memory:");
 sqlite.exec("PRAGMA foreign_keys = ON");
 sqlite.exec(readFileSync(new URL("../drizzle/0000_lifeos_cloud_state.sql", import.meta.url), "utf8"));
 sqlite.exec(readFileSync(new URL("../drizzle/0001_lifeos_records.sql", import.meta.url), "utf8"));
+sqlite.exec(readFileSync(new URL("../drizzle/0002_lifeos_db_admin.sql", import.meta.url), "utf8"));
 const db = {
   prepare(sql) {
     return {
@@ -36,7 +37,7 @@ async function call(path, method = "GET", data, as = headers) {
   const response = await worker.fetch(new Request("https://life-os.test" + path, {
     method, headers: { ...as, "content-type": "application/json" },
     body: data === undefined ? undefined : JSON.stringify(data)
-  }), { DB: db });
+  }), { DB: db, LIFEOS_DB_ADMIN_PASSWORD: "local test password with 28 chars" });
   return { status: response.status, body: await response.json() };
 }
 
@@ -102,4 +103,24 @@ const pending = client.window.CloudTest.changes(snapshot.state, client.window.Cl
 assert.deepEqual(Array.from(pending, item => item.kind), ["tasks"], "editing a task only writes one record");
 await client.window.CloudTest.sync();
 assert.equal((await call("/api/lifeos-state")).body.state.system.tasksBoard.tasks[0].done, true);
+assert.equal((await call("/api/db-admin/tables/tasks/rows")).status, 401);
+assert.equal((await call("/api/db-admin/login", "POST", { username: "lifeos-admin", password: "bad", acknowledged: true })).status, 401);
+const login = await call("/api/db-admin/login", "POST", {
+  username: "lifeos-admin", password: "local test password with 28 chars", acknowledged: true
+});
+assert.equal(login.status, 200);
+const auth = { ...headers, "x-lifeos-admin-session": login.body.token };
+assert.equal((await call("/api/db-admin/tables/tasks/rows", "GET", undefined, { ...auth, origin: "https://evil.example" })).status, 403);
+let admin = await call("/api/db-admin/tables/tasks/rows", "GET", undefined, auth);
+assert.equal(admin.status, 200);
+assert.equal(admin.body.total, 2);
+assert.equal((await call("/api/db-admin/tables/tasks/rows", "GET", undefined, { ...auth, "oai-authenticated-user-id": "bob" })).status, 401, "admin session is tied to one user");
+admin = await call("/api/db-admin/tables/tasks/rows/t3", "POST", { baseVersion: 0, value: { id: "t3", title: "From database" } }, auth);
+assert.equal(admin.body.version, 1);
+admin = await call("/api/db-admin/tables/tasks/rows/t3", "PATCH", { baseVersion: 1, value: { id: "t3", title: "Edited" } }, auth);
+assert.equal(admin.body.version, 2);
+assert.equal((await call("/api/db-admin/tables/tasks/rows/t3", "PATCH", { baseVersion: 1, value: { id: "t3", title: "Stale" } }, auth)).status, 409);
+assert.equal((await call("/api/db-admin/tables/tasks/rows/t3?version=2", "DELETE", undefined, auth)).status, 200);
+assert.equal((await call("/api/db-admin/logout", "POST", {}, auth)).status, 200);
+assert.equal((await call("/api/db-admin/tables/tasks/rows", "GET", undefined, auth)).status, 401);
 console.log("Life OS record migration, sync conflict, tags, and user isolation valid");