memory_core/store/

mod.rs

pub mod schema;
pub mod memory;
pub mod metrics;
pub mod session;
pub mod scope;
pub mod dedup;
pub mod privacy;
pub mod relations;

use rusqlite::Connection;

use crate::config::Config;
use crate::Error;

pub struct Store {
    conn: Connection,
    config: Config,
}

impl Store {
    pub fn open(path: &str, config: Config, passphrase: Option<&str>) -> crate::Result<Self> {
        if config.storage.encryption_enabled && passphrase.is_none() {
            return Err(Error::Encryption(
                "encryption is enabled but no passphrase was provided".into(),
            ));
        }
        let mut conn = Connection::open(path)?;
        if let Some(key) = passphrase {
            apply_passphrase(&conn, key)?;
            verify_access(&conn)?;
        }
        configure_connection(&conn, &config)?;
        schema::check_version(&conn)?;
        run_migrations(&mut conn)?;
        Ok(Self { conn, config })
    }

    pub fn open_in_memory() -> crate::Result<Self> {
        Self::open_in_memory_with_config(Config::default())
    }

    pub fn open_in_memory_with_config(config: Config) -> crate::Result<Self> {
        let mut conn = Connection::open_in_memory()?;
        configure_connection(&conn, &config)?;
        run_migrations(&mut conn)?;
        Ok(Self { conn, config })
    }

    pub fn config(&self) -> &Config {
        &self.config
    }

    pub(crate) fn conn(&self) -> &Connection {
        &self.conn
    }

    pub fn get_metadata(&self, key: &str) -> crate::Result<Option<String>> {
        match self.conn.query_row(
            "SELECT value FROM _metadata WHERE key = ?1",
            rusqlite::params![key],
            |row| row.get::<_, String>(0),
        ) {
            Ok(val) => Ok(Some(val)),
            Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),
            Err(e) => Err(e.into()),
        }
    }

    pub fn set_metadata(&self, key: &str, value: &str) -> crate::Result<()> {
        self.conn.execute(
            "INSERT INTO _metadata (key, value) VALUES (?1, ?2)
             ON CONFLICT(key) DO UPDATE SET value = excluded.value",
            rusqlite::params![key, value],
        )?;
        Ok(())
    }

    pub fn schema_version(&self) -> crate::Result<i64> {
        Ok(self
            .conn
            .pragma_query_value(None, "user_version", |r| r.get(0))?)
    }

    /// Check if a database file is encrypted (requires `encryption` feature to detect).
    pub fn is_encrypted(path: &str) -> bool {
        // Try opening without a key — if it fails on sqlite_master, it's encrypted
        let conn = match Connection::open(path) {
            Ok(c) => c,
            Err(_) => return false,
        };
        conn.query_row("SELECT count(*) FROM sqlite_master", [], |_| Ok(()))
            .is_err()
    }

    /// Encrypt an existing unencrypted database using SQLCipher's ATTACH + sqlcipher_export.
    #[cfg(feature = "encryption")]
    pub fn encrypt(path: &str, passphrase: &str, config: Config) -> crate::Result<()> {
        use std::fs;
        let tmp_path = format!("{}.encrypting", path);
        {
            let conn = Connection::open(path)?;
            // Attach encrypted destination
            conn.execute_batch(&format!(
                "ATTACH DATABASE '{}' AS encrypted KEY '{}';",
                escape_sql_string(&tmp_path),
                escape_sql_string(passphrase)
            ))?;
            conn.execute_batch("SELECT sqlcipher_export('encrypted');")?;
            // Copy schema version
            let ver: i64 = conn.pragma_query_value(None, "user_version", |r| r.get(0))?;
            conn.execute_batch(&format!(
                "PRAGMA encrypted.user_version = {};",
                ver
            ))?;
            conn.execute_batch("DETACH DATABASE encrypted;")?;
        }
        // Replace original with encrypted version
        fs::rename(&tmp_path, path)
            .map_err(|e| Error::Encryption(format!("failed to replace db: {}", e)))?;
        // Verify we can open it
        let _store = Store::open(path, config, Some(passphrase))?;
        Ok(())
    }

    /// Decrypt an encrypted database back to plaintext.
    #[cfg(feature = "encryption")]
    pub fn decrypt(path: &str, passphrase: &str, config: Config) -> crate::Result<()> {
        use std::fs;
        let tmp_path = format!("{}.decrypting", path);
        {
            let conn = Connection::open(path)?;
            apply_passphrase(&conn, passphrase)?;
            verify_access(&conn)?;
            // Attach plaintext destination (empty key = no encryption)
            conn.execute_batch(&format!(
                "ATTACH DATABASE '{}' AS plaintext KEY '';",
                escape_sql_string(&tmp_path)
            ))?;
            conn.execute_batch("SELECT sqlcipher_export('plaintext');")?;
            let ver: i64 = conn.pragma_query_value(None, "user_version", |r| r.get(0))?;
            conn.execute_batch(&format!(
                "PRAGMA plaintext.user_version = {};",
                ver
            ))?;
            conn.execute_batch("DETACH DATABASE plaintext;")?;
        }
        fs::rename(&tmp_path, path)
            .map_err(|e| Error::Encryption(format!("failed to replace db: {}", e)))?;
        // Verify we can open without passphrase
        let mut verify_config = config;
        verify_config.storage.encryption_enabled = false;
        let _store = Store::open(path, verify_config, None)?;
        Ok(())
    }
}

fn apply_passphrase(conn: &Connection, passphrase: &str) -> crate::Result<()> {
    // PRAGMA key must be the FIRST statement after opening (SQLCipher requirement)
    conn.pragma_update(None, "key", passphrase)
        .map_err(|e| Error::Encryption(format!("failed to set encryption key: {}", e)))?;
    Ok(())
}

fn verify_access(conn: &Connection) -> crate::Result<()> {
    conn.query_row("SELECT count(*) FROM sqlite_master", [], |_| Ok(()))
        .map_err(|_| {
            Error::Encryption("cannot access database — wrong passphrase or not encrypted".into())
        })?;
    Ok(())
}

fn configure_connection(conn: &Connection, config: &Config) -> rusqlite::Result<()> {
    conn.execute_batch(&format!(
        "PRAGMA journal_mode = WAL;
         PRAGMA busy_timeout = {};
         PRAGMA synchronous = NORMAL;
         PRAGMA foreign_keys = ON;
         PRAGMA cache_size = -{};",
        config.storage.busy_timeout_ms,
        config.storage.cache_size_kb
    ))?;
    Ok(())
}

fn run_migrations(conn: &mut Connection) -> crate::Result<()> {
    let migrations = schema::migrations();
    migrations
        .to_latest(conn)
        .map_err(|e| Error::Migration(e.to_string()))?;
    Ok(())
}

#[cfg(feature = "encryption")]
fn escape_sql_string(s: &str) -> String {
    s.replace('\'', "''")
}