shadowdaoandClaude Opus 4.7
077d0a0825
End-to-end Phase 1 of shared-memory: a logged-in Authentik user can sign into the Web UI (/me debug page), and an MCP client with an Authentik- issued bearer token can call memory.write / memory.list / memory.get / memory.delete plus project.identify against /api/mcp. Stack: - Next.js 15 (App Router) + React 19 + TypeScript, pnpm workspaces - Drizzle ORM + Postgres 16 + pgvector + pg_trgm - Auth.js v5 with Authentik provider (Web UI) - jose + Authentik JWKS for MCP bearer-token validation - JSON-RPC 2.0 dispatcher implementing the MCP wire protocol over plain HTTP POST (hand-rolled to fit Next.js App Router; switches to SSE in a later phase if server-initiated events are needed) - bge-small embeddings sidecar deferred to Phase 2; the schema already reserves the vector(384) column + IVFFlat index, FTS via a STORED tsvector column, and the visibility enum (private/shared/team) so cross-user memory sharing can be added without a future migration Deployment supports two modes (set in .env, never committed): - Behind an external reverse proxy (HAProxy / nginx / Cloudflare Tunnel / Traefik) — DEFAULT; the app exposes APP_PORT on the host with X-Forwarded-* trusted, no in-container TLS - Built-in TLS via Caddy — opt-in with `docker compose --profile tls up` Discovery endpoint at /.well-known/oauth-protected-resource (RFC 9728) points MCP clients at the Authentik authorization server after a 401. README walks through both Authentik providers (Web UI + MCP resource server), the audience scope mapping, redirect URIs, and includes a worked HAProxy config snippet. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
66 lines
1.9 KiB
TypeScript
66 lines
1.9 KiB
TypeScript
/**
|
|
* Run pending SQL migrations from ./drizzle in lexical filename order.
|
|
*
|
|
* Lightweight runner — drizzle-kit's TS migrator doesn't handle the raw SQL
|
|
* features we need (pgvector, generated columns), so we manage migration
|
|
* state ourselves in `_migrations` and apply files as plain SQL.
|
|
*/
|
|
import { readFile, readdir } from "node:fs/promises";
|
|
import { dirname, join } from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import postgres from "postgres";
|
|
|
|
const __dirname = dirname(fileURLToPath(import.meta.url));
|
|
const MIGRATIONS_DIR = join(__dirname, "..", "drizzle");
|
|
|
|
async function main() {
|
|
const url = process.env.DATABASE_URL;
|
|
if (!url) {
|
|
console.error("DATABASE_URL is not set");
|
|
process.exit(1);
|
|
}
|
|
|
|
const sql = postgres(url, { max: 1, prepare: false });
|
|
|
|
try {
|
|
await sql`
|
|
CREATE TABLE IF NOT EXISTS "_migrations" (
|
|
"id" serial PRIMARY KEY,
|
|
"name" text NOT NULL UNIQUE,
|
|
"applied_at" timestamptz NOT NULL DEFAULT now()
|
|
)
|
|
`;
|
|
|
|
const files = (await readdir(MIGRATIONS_DIR))
|
|
.filter((f) => f.endsWith(".sql"))
|
|
.sort();
|
|
|
|
const applied = new Set(
|
|
(await sql<{ name: string }[]>`SELECT name FROM "_migrations"`).map((r) => r.name),
|
|
);
|
|
|
|
for (const file of files) {
|
|
if (applied.has(file)) {
|
|
console.log(`✓ ${file} (already applied)`);
|
|
continue;
|
|
}
|
|
const body = await readFile(join(MIGRATIONS_DIR, file), "utf8");
|
|
console.log(`→ ${file} (applying)`);
|
|
await sql.begin(async (tx) => {
|
|
await tx.unsafe(body);
|
|
await tx`INSERT INTO "_migrations" (name) VALUES (${file})`;
|
|
});
|
|
console.log(`✓ ${file}`);
|
|
}
|
|
|
|
console.log("Migrations complete.");
|
|
} finally {
|
|
await sql.end({ timeout: 5 });
|
|
}
|
|
}
|
|
|
|
main().catch((err) => {
|
|
console.error("Migration failed:", err);
|
|
process.exit(1);
|
|
});
|