nodedb 0.4.0

Local-first, real-time, edge-to-cloud hybrid database for multi-modal workloads
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234

// SPDX-License-Identifier: BUSL-1.1

//! Handler for `ALTER DATABASE <name> <operation>`.
//!
//! Ported from the pgwire `ddl::database::alter` handler. Every per-operation
//! privilege gate, catalog read/write, Raft propose / single-node fallback,
//! live-cache / enforcement-component update, and audit record is preserved
//! verbatim; only the result construction changed from pgwire `Response` to the
//! protocol-neutral [`DdlResult`]. `MATERIALIZE` and `PROMOTE` delegate to the
//! `materialize` / `mirror::promote` handlers exactly as before.

use nodedb_sql::ddl_ast::AlterDatabaseOperation;
use nodedb_types::QuotaRecord;

use crate::control::catalog_entry::entry::CatalogEntry;
use crate::control::metadata_proposer::propose_catalog_entry;
use crate::control::security::identity::AuthenticatedIdentity;
use crate::control::state::SharedState;

use super::super::super::result::{DdlError, DdlResult};
use super::gate::{require_cluster_admin, require_database_owner};
use super::support::{ddl_err, status};

/// Handle `ALTER DATABASE <name> <operation>`.
///
/// Required role varies by operation (see per-arm gates below).
pub fn alter_database(
    state: &SharedState,
    identity: &AuthenticatedIdentity,
    name: &str,
    operation: &AlterDatabaseOperation,
) -> Result<Vec<DdlResult>, DdlError> {
    let catalog = state.credentials.catalog();

    let db_id = catalog
        .get_database_id_by_name(name)
        .map_err(|e| ddl_err("XX000", format!("catalog lookup failed: {e}")))?
        .ok_or_else(|| ddl_err("3D000", format!("database '{name}' does not exist")))?;

    let mut descriptor = catalog
        .get_database(db_id)
        .map_err(|e| ddl_err("XX000", format!("catalog read failed: {e}")))?
        .ok_or_else(|| ddl_err("XX000", format!("database '{name}' descriptor missing")))?;

    match operation {
        AlterDatabaseOperation::Rename { new_name } => {
            // Required role: DatabaseOwner(db) or Superuser.
            require_database_owner(
                state,
                identity,
                db_id,
                &format!("ALTER DATABASE {name} RENAME"),
            )?;
            // Reject rename if a different database already holds the target name.
            match catalog.get_database_id_by_name(new_name) {
                Ok(Some(existing_id)) if existing_id != db_id => {
                    return Err(ddl_err(
                        "42P04",
                        format!("database '{new_name}' already exists"),
                    ));
                }
                Ok(_) => {}
                Err(e) => {
                    return Err(ddl_err("XX000", format!("catalog lookup failed: {e}")));
                }
            }
            descriptor.name = new_name.clone();
            let proposed = propose_catalog_entry(
                state,
                &CatalogEntry::PutDatabase(Box::new(descriptor.clone())),
            )
            .map_err(|e| ddl_err("XX000", format!("catalog propose failed: {e}")))?;
            if proposed == 0 {
                catalog
                    .put_database(&descriptor)
                    .map_err(|e| ddl_err("XX000", format!("catalog write failed: {e}")))?;
            }

            state.audit_record_with_db(
                crate::control::security::audit::AuditEvent::DatabaseRenamed,
                None,
                Some(db_id),
                &identity.username,
                &format!("ALTER DATABASE {name} RENAME TO {new_name}"),
            );
        }

        AlterDatabaseOperation::SetQuota(spec) => {
            // Required role: ClusterAdmin or Superuser.
            require_cluster_admin(
                state,
                identity,
                Some(db_id),
                &format!("ALTER DATABASE {name} SET QUOTA"),
            )?;
            // Load existing record (or DEFAULT) — kept verbatim for the audit
            // before/after diff so operators can reconstruct what changed.
            let before = catalog
                .get_database_quota(db_id)
                .map_err(|e| ddl_err("XX000", format!("quota read failed: {e}")))?
                .unwrap_or(QuotaRecord::DEFAULT);
            let mut record = before.clone();
            record.merge(spec);

            // Snapshot the live cluster-wide ceiling configured at startup
            // from `[server]` config; the catalog layer enforces the
            // sum-of-database-quotas invariant against it.
            let ceiling = state.quota_ceiling_snapshot();
            catalog
                .put_database_quota(db_id, &record, &ceiling)
                .map_err(|e| ddl_err("53400", format!("{e}")))?;

            // Push the new quota into live enforcement components.
            state
                .maintenance_budget
                .set_cap(db_id, record.maintenance_cpu_pct);
            if let Some(ref gov) = state.governor {
                if record.max_memory_bytes > 0 {
                    gov.set_database_budget(db_id, record.max_memory_bytes as usize);
                } else {
                    gov.clear_database_budget(db_id);
                }
            }

            state.audit_record_with_db(
                crate::control::security::audit::AuditEvent::DatabaseQuotaChanged,
                None,
                Some(db_id),
                &identity.username,
                &format!(
                    "ALTER DATABASE {name} SET QUOTA — before: [{}] — after: [{}]",
                    before.audit_summary(),
                    record.audit_summary()
                ),
            );
        }

        AlterDatabaseOperation::SetDefault => {
            // Required role: ClusterAdmin or Superuser.
            require_cluster_admin(
                state,
                identity,
                Some(db_id),
                &format!("ALTER DATABASE {name} SET DEFAULT"),
            )?;
            // The per-user default database field lives on AuthenticatedIdentity;
            // the canonical wiring is `ALTER USER <name> SET DEFAULT DATABASE <db>`,
            // which is owned by the user-management DDL path, not this one.
            return Err(ddl_err(
                "0A000",
                "ALTER DATABASE SET DEFAULT is not yet implemented; \
                 use ALTER USER <name> SET DEFAULT DATABASE <db>",
            ));
        }

        AlterDatabaseOperation::SetAuditDml(mode) => {
            // Required role: ClusterAdmin or Superuser.
            require_cluster_admin(
                state,
                identity,
                Some(db_id),
                &format!("ALTER DATABASE {name} SET AUDIT_DML"),
            )?;
            // Update the descriptor's `audit_dml` field and persist it.
            descriptor.audit_dml = *mode;
            let proposed = propose_catalog_entry(
                state,
                &CatalogEntry::PutDatabase(Box::new(descriptor.clone())),
            )
            .map_err(|e| ddl_err("XX000", format!("catalog propose failed: {e}")))?;
            if proposed == 0 {
                catalog
                    .put_database(&descriptor)
                    .map_err(|e| ddl_err("XX000", format!("catalog write failed: {e}")))?;
            }

            // Update live cache so the Event Plane consumer sees the new mode
            // without a restart.
            state.audit_dml_cache.set(db_id, *mode);

            state.audit_record_with_db(
                crate::control::security::audit::AuditEvent::DatabaseAuditDmlChanged,
                None,
                Some(db_id),
                &identity.username,
                &format!("ALTER DATABASE {name} SET AUDIT_DML = {mode}",),
            );
        }

        AlterDatabaseOperation::SetIdleTimeout(secs) => {
            // Required role: ClusterAdmin or Superuser.
            require_cluster_admin(
                state,
                identity,
                Some(db_id),
                &format!("ALTER DATABASE {name} SET IDLE_TIMEOUT"),
            )?;
            let before = descriptor.idle_session_timeout_secs;
            descriptor.idle_session_timeout_secs = *secs;
            let proposed = propose_catalog_entry(
                state,
                &CatalogEntry::PutDatabase(Box::new(descriptor.clone())),
            )
            .map_err(|e| ddl_err("XX000", format!("catalog propose failed: {e}")))?;
            if proposed == 0 {
                catalog
                    .put_database(&descriptor)
                    .map_err(|e| ddl_err("XX000", format!("catalog write failed: {e}")))?;
            }

            // Update the live idle-timeout cache so the sweep loop sees the
            // new value immediately without a restart.
            state.idle_timeout_cache.set(db_id, *secs);

            state.audit_record_with_db(
                crate::control::security::audit::AuditEvent::DatabaseIdleTimeoutChanged,
                None,
                Some(db_id),
                &identity.username,
                &format!("ALTER DATABASE {name} SET IDLE_TIMEOUT = {secs} (was {before})"),
            );
        }

        AlterDatabaseOperation::Materialize => {
            return super::materialize::alter_database_materialize(state, identity, name);
        }

        AlterDatabaseOperation::Promote => {
            return super::mirror::promote::promote_database(state, identity, name);
        }
    }

    Ok(status("ALTER DATABASE"))
}