feat: Phase 1 — Authentik auth, MCP endpoint, persistent memory

End-to-end Phase 1 of shared-memory: a logged-in Authentik user can sign into the Web UI (/me debug page), and an MCP client with an Authentik- issued bearer token can call memory.write / memory.list / memory.get / memory.delete plus project.identify against /api/mcp. Stack: - Next.js 15 (App Router) + React 19 + TypeScript, pnpm workspaces - Drizzle ORM + Postgres 16 + pgvector + pg_trgm - Auth.js v5 with Authentik provider (Web UI) - jose + Authentik JWKS for MCP bearer-token validation - JSON-RPC 2.0 dispatcher implementing the MCP wire protocol over plain HTTP POST (hand-rolled to fit Next.js App Router; switches to SSE in a later phase if server-initiated events are needed) - bge-small embeddings sidecar deferred to Phase 2; the schema already reserves the vector(384) column + IVFFlat index, FTS via a STORED tsvector column, and the visibility enum (private/shared/team) so cross-user memory sharing can be added without a future migration Deployment supports two modes (set in .env, never committed): - Behind an external reverse proxy (HAProxy / nginx / Cloudflare Tunnel / Traefik) — DEFAULT; the app exposes APP_PORT on the host with X-Forwarded-* trusted, no in-container TLS - Built-in TLS via Caddy — opt-in with `docker compose --profile tls up` Discovery endpoint at /.well-known/oauth-protected-resource (RFC 9728) points MCP clients at the Authentik authorization server after a 401. README walks through both Authentik providers (Web UI + MCP resource server), the audience scope mapping, redirect URIs, and includes a worked HAProxy config snippet. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-15 07:04:11 -07:00
parent d5be753cfb
commit 077d0a0825
37 changed files with 7294 additions and 8 deletions
@@ -0,0 +1,25 @@
+import { drizzle } from "drizzle-orm/postgres-js";
+import postgres from "postgres";
+import { env } from "@/lib/env";
+import * as schema from "./schema";
+
+// Reuse a single connection pool across hot reloads in dev.
+type GlobalWithPg = typeof globalThis & {
+  __sharedMemoryPg?: ReturnType<typeof postgres>;
+};
+const g = globalThis as GlobalWithPg;
+
+function makePool() {
+  return postgres(env().DATABASE_URL, {
+    max: 10,
+    idle_timeout: 30,
+    connect_timeout: 10,
+    prepare: false,
+  });
+}
+
+const sql = g.__sharedMemoryPg ?? makePool();
+if (process.env.NODE_ENV !== "production") g.__sharedMemoryPg = sql;
+
+export const db = drizzle(sql, { schema, logger: env().LOG_LEVEL === "debug" });
+export { sql as pg, schema };
@@ -0,0 +1,162 @@
+import {
+  pgTable,
+  pgEnum,
+  uuid,
+  text,
+  timestamp,
+  jsonb,
+  uniqueIndex,
+  index,
+  customType,
+  vector,
+  varchar,
+} from "drizzle-orm/pg-core";
+import { sql } from "drizzle-orm";
+
+// ---------- custom column types ----------
+
+// Postgres tsvector — generated server-side from `content`, not written by app.
+const tsvector = customType<{ data: string; driverData: string }>({
+  dataType() {
+    return "tsvector";
+  },
+});
+
+// Text array helper (Drizzle's `.array()` works, but this keeps intent explicit).
+const textArray = customType<{ data: string[]; driverData: string }>({
+  dataType() {
+    return "text[]";
+  },
+  toDriver(value) {
+    return `{${value.map((v) => `"${v.replace(/"/g, '\\"')}"`).join(",")}}`;
+  },
+});
+
+// ---------- enums ----------
+
+export const memoryScope = pgEnum("memory_scope", ["project", "user"]);
+export const memoryVisibility = pgEnum("memory_visibility", ["private", "shared", "team"]);
+export const auditActor = pgEnum("audit_actor", ["mcp", "web", "system"]);
+
+// ---------- tables ----------
+
+export const users = pgTable(
+  "users",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    // OIDC `sub` claim from Authentik — stable identifier for this user.
+    oidcSub: text("oidc_sub").notNull(),
+    // OIDC `iss` so we can disambiguate if we ever federate.
+    oidcIss: text("oidc_iss").notNull(),
+    email: text("email"),
+    name: text("name"),
+    picture: text("picture"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => ({
+    uniqueIss: uniqueIndex("users_iss_sub_uq").on(t.oidcIss, t.oidcSub),
+  }),
+);
+
+export const projects = pgTable(
+  "projects",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    userId: uuid("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    // Caller-supplied stable identifier (e.g. repo name or any string).
+    key: varchar("key", { length: 200 }).notNull(),
+    displayName: text("display_name"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => ({
+    uniqueUserKey: uniqueIndex("projects_user_key_uq").on(t.userId, t.key),
+  }),
+);
+
+export const memories = pgTable(
+  "memories",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    userId: uuid("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    // NULL when scope = 'user' (global to the user across all projects).
+    projectId: uuid("project_id").references(() => projects.id, { onDelete: "set null" }),
+    scope: memoryScope("scope").notNull().default("project"),
+    visibility: memoryVisibility("visibility").notNull().default("private"),
+    content: text("content").notNull(),
+    tags: textArray("tags").notNull().default([]),
+    // Populated by Phase 2 once the embedder sidecar is online; NULL in Phase 1.
+    embedding: vector("embedding", { dimensions: 384 }),
+    // Generated column — see migration SQL for definition.
+    contentTsv: tsvector("content_tsv"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+    deletedAt: timestamp("deleted_at", { withTimezone: true }),
+  },
+  (t) => ({
+    userIdx: index("memories_user_idx").on(t.userId),
+    projectIdx: index("memories_project_idx").on(t.projectId),
+    createdIdx: index("memories_created_idx").on(t.createdAt),
+    // Vector index, tsvector index, and trigram index for tags are declared
+    // in the SQL migration since drizzle-kit doesn't model them.
+  }),
+);
+
+export const snippets = pgTable(
+  "snippets",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    userId: uuid("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    name: varchar("name", { length: 200 }).notNull(),
+    body: text("body").notNull(),
+    description: text("description"),
+    tags: textArray("tags").notNull().default([]),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => ({
+    uniqueUserName: uniqueIndex("snippets_user_name_uq").on(t.userId, t.name),
+  }),
+);
+
+export const auditLog = pgTable(
+  "audit_log",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    userId: uuid("user_id").references(() => users.id, { onDelete: "set null" }),
+    actor: auditActor("actor").notNull(),
+    action: text("action").notNull(),
+    entityType: text("entity_type"),
+    entityId: uuid("entity_id"),
+    payload: jsonb("payload"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => ({
+    userIdx: index("audit_user_idx").on(t.userId),
+    createdIdx: index("audit_created_idx").on(t.createdAt),
+  }),
+);
+
+// Re-export sql helper so callers can compose raw fragments without a
+// second drizzle import.
+export { sql };
+
+// ---------- inferred types ----------
+
+export type User = typeof users.$inferSelect;
+export type NewUser = typeof users.$inferInsert;
+export type Project = typeof projects.$inferSelect;
+export type NewProject = typeof projects.$inferInsert;
+export type Memory = typeof memories.$inferSelect;
+export type NewMemory = typeof memories.$inferInsert;
+export type Snippet = typeof snippets.$inferSelect;
+export type NewSnippet = typeof snippets.$inferInsert;
+export type AuditEntry = typeof auditLog.$inferSelect;
+export type NewAuditEntry = typeof auditLog.$inferInsert;