feat(podcasts): schema, RLS policy extension, sqlc queries — feed core foundations
Podcast integration task 1.1 (plan: podcast-integration.md §6/§8, D20).
WHY: podcasts are a new first-class media domain — RSS feeds users
subscribe to personally, with episodes as media_items rows so progress,
stats and the audio player work unchanged. Visibility is per-user
(strict: only your subscriptions), which after the RLS migration
(2026-10-29) belongs in the POLICIES, not Go helpers.
Schema (idempotent — schema.sql re-executes every boot):
- 'podcasts' library type seeded (ON CONFLICT DO NOTHING, ARRAY[]::TEXT[]
cast required — bare ARRAY[] 42802s under ON_ERROR_STOP)
- podcast_feeds: per-library feed entity (UNIQUE(library_id, feed_url)),
full RSS/iTunes/Podcasting-2.0 metadata inventory, conditional-GET
validators, is_complete poll backoff
- podcast_subscriptions: the ONLY user-writable podcast state (display
name, auto-download policy); deliberately UNGOVERNED — it IS the read
policy's lookup table
- media_items episode columns: source/source_feed_id/episode_guid/
feed_position/season/episode/enclosure_url/declared_duration/
transcript_url/chapters_url/hosts/guests + download state machine
(pending|queued|downloading|downloaded|failed + error + attempts),
all partial-indexed so scan rows never touch them
- libraries.allow_member_feeds (first per-library knob); library_folders
.purpose ('podcast' download roots, scanner-skipped)
RLS (inside the labeled policy block):
- p_media_items_visible gains the podcast-episode subscription predicate
+ admin escape (source IS DISTINCT FROM 'podcast_episode' guard keeps
scan rows on the cheap path); unset identity still fails loud
- podcast_feeds governed identically: library-visibility join AND
subscriber-or-admin SELECT; permissive write stand-ins (mandatory at
ENABLE time; fetcher/worker declare first-admin, add-feed upsert uses
ON CONFLICT DO UPDATE RETURNING so creators never need SELECT on
foreign rows)
- Verified against dev DB: migration identity sees nothing, admin sees
all, member sees feeds/episodes only post-subscribe (probed in a
rolled-back tx — no rows persisted)
sqlc: 30 new queries (feed upsert/CRUD, subscriptions, episode
upsert-with-write-after-success-guard, download state transitions,
poller worklist, subscription-scoped search) — no visibility clauses
anywhere, per the D20 scoping model.
This commit is contained in:
John O'Keefe committed
1 parent
4ab4f9fa90
commit
0b7ad0f376
6 files changed
+3799
-673
No files matched your search
+195
-2
@@ -18,7 +18,8 @@ INSERT INTO library_types (name, description, allowed_extensions) VALUES
|
||||
('ebooks', 'Ebook files including EPUB, PDF, MOBI, etc.', ARRAY['.epub', '.pdf', '.mobi', '.azw', '.azw3', '.txt', '.rtf', '.doc', '.docx', '.lit', '.fb2', '.pdb']),
|
||||
('comics', 'Comic book archives and image formats', ARRAY['.cbz', '.cbr', '.cb7', '.cbt', '.epub', '.pdf']),
|
||||
('manga', 'Manga files including archives and image folders', ARRAY['.cbz', '.cbr', '.epub', '.pdf', '.png', '.jpg', '.jpeg', '.gif', '.bmp', '.webp', '.avif', '.tiff', '.tif']),
|
||||
('audiobooks', 'Audiobook files; m4b first, breadth formats registered from day one', ARRAY['.m4b', '.m4a', '.mp3', '.flac'])
|
||||
('audiobooks', 'Audiobook files; m4b first, breadth formats registered from day one', ARRAY['.m4b', '.m4a', '.mp3', '.flac']),
|
||||
('podcasts', 'RSS podcast/feed libraries: feeds subscribe-and-download; the scanner never walks these folders', ARRAY[]::TEXT[])
|
||||
ON CONFLICT (name) DO NOTHING;
|
||||
|
||||
-- Create users table
|
||||
@@ -1878,6 +1879,126 @@ CREATE INDEX IF NOT EXISTS idx_hash_conflicts_status ON hash_conflicts(status);
|
||||
-- Widen for databases created before the resolution format settled (no-op otherwise)
|
||||
ALTER TABLE hash_conflicts ALTER COLUMN resolution TYPE VARCHAR(50);
|
||||
|
||||
-- ============================================================
|
||||
-- PODCASTS / RSS FEEDS
|
||||
-- Plan: ~/.opencode/plan/podcast-integration.md (§6).
|
||||
-- Feeds are per-library entities (UNIQUE(library_id, feed_url)); users
|
||||
-- subscribe personally (podcast_subscriptions). Episodes are
|
||||
-- media_items rows with source='podcast_episode' — per-episode
|
||||
-- progress/stats for free — grouped by source_feed_id. Visibility is
|
||||
-- RLS-enforced (see the policy block at the end of this file): an
|
||||
-- episode/feed row is SELECT-visible only to subscribers of the feed
|
||||
-- and to admins. The fetcher/download worker is the SOLE writer of
|
||||
-- feed/episode metadata; users own only their subscription row and the
|
||||
-- reader_settings order override. ALL DDL IDEMPOTENT: schema.sql
|
||||
-- re-executes on EVERY boot.
|
||||
-- ============================================================
|
||||
|
||||
-- First per-library boolean knob (plain column, not KV): when false,
|
||||
-- only admins may add feeds to the library (members keep subscribe
|
||||
-- rights to existing feeds).
|
||||
ALTER TABLE libraries ADD COLUMN IF NOT EXISTS allow_member_feeds BOOLEAN NOT NULL DEFAULT TRUE;
|
||||
|
||||
-- Folder purpose: 'scan' (default; the FS walker's root) vs 'podcast'
|
||||
-- (a podcasts library's download root — scanner skips it wholesale,
|
||||
-- belt-and-braces on top of the library-type skip).
|
||||
ALTER TABLE library_folders ADD COLUMN IF NOT EXISTS purpose VARCHAR(20) NOT NULL DEFAULT 'scan';
|
||||
|
||||
CREATE TABLE IF NOT EXISTS podcast_feeds (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
library_id UUID NOT NULL REFERENCES libraries(id) ON DELETE CASCADE,
|
||||
feed_url TEXT NOT NULL,
|
||||
-- podcast:guid — the feed's canonical identity; dedupes across URL
|
||||
-- migrations (fetcher honors itunes:new-feed-url + redirects).
|
||||
podcast_guid TEXT,
|
||||
title VARCHAR(500) NOT NULL,
|
||||
description TEXT,
|
||||
-- Channel itunes:author (semantically the host) and itunes:owner.
|
||||
host VARCHAR(500),
|
||||
publisher VARCHAR(500),
|
||||
owner_name VARCHAR(500),
|
||||
owner_email VARCHAR(500),
|
||||
language VARCHAR(50),
|
||||
tags TEXT[] DEFAULT '{}',
|
||||
explicit BOOLEAN NOT NULL DEFAULT FALSE,
|
||||
artwork_path VARCHAR(500),
|
||||
-- itunes:type: 'serial' | 'episodic'
|
||||
feed_type VARCHAR(20),
|
||||
-- podcast:medium: 'audiobook' | 'podcast' | 'music' | ...
|
||||
medium VARCHAR(20),
|
||||
-- itunes:complete: poller backs off once the publisher ends the feed.
|
||||
is_complete BOOLEAN NOT NULL DEFAULT FALSE,
|
||||
-- Conditional-GET validators (opaque; echoed verbatim).
|
||||
etag VARCHAR(500),
|
||||
last_modified VARCHAR(500),
|
||||
last_fetched_at TIMESTAMPTZ,
|
||||
last_build_date TIMESTAMPTZ,
|
||||
created_by_admin_id UUID REFERENCES users(id) ON DELETE SET NULL,
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
||||
UNIQUE(library_id, feed_url)
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_podcast_feeds_library ON podcast_feeds(library_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_podcast_feeds_guid ON podcast_feeds(podcast_guid);
|
||||
|
||||
-- User-owned subscription row: the ONLY podcast state a user writes.
|
||||
-- display_name NULL renders as the feed title. auto_download:
|
||||
-- 'off' | 'all' | 'newest' (+ auto_download_count for newest N).
|
||||
CREATE TABLE IF NOT EXISTS podcast_subscriptions (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
||||
feed_id UUID NOT NULL REFERENCES podcast_feeds(id) ON DELETE CASCADE,
|
||||
display_name VARCHAR(500),
|
||||
auto_download VARCHAR(20) NOT NULL DEFAULT 'off',
|
||||
auto_download_count INT,
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
||||
UNIQUE(user_id, feed_id)
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_podcast_subs_user ON podcast_subscriptions(user_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_podcast_subs_feed ON podcast_subscriptions(feed_id);
|
||||
|
||||
-- Episode columns (NULL for scan-sourced items). See the plan §5 for
|
||||
-- the full RSS/iTunes/Podcasting-2.0 field mapping — existing columns
|
||||
-- (title, subtitle, description, authors, explicit, date_published,
|
||||
-- cover_image_path, file_size, mime_type, language, genre/tags) carry
|
||||
-- the shared fields; only genuinely podcast-only storage lives here.
|
||||
ALTER TABLE media_items
|
||||
ADD COLUMN IF NOT EXISTS source VARCHAR(20) NOT NULL DEFAULT 'scan',
|
||||
ADD COLUMN IF NOT EXISTS source_feed_id UUID REFERENCES podcast_feeds(id) ON DELETE CASCADE,
|
||||
-- Stable reorder-proof addressing key (invariant 3): progress
|
||||
-- anchors on guid, never ordinal.
|
||||
ADD COLUMN IF NOT EXISTS episode_guid TEXT,
|
||||
-- Native order as of the latest fetch (renumbered per fetch).
|
||||
ADD COLUMN IF NOT EXISTS feed_position INTEGER,
|
||||
ADD COLUMN IF NOT EXISTS season_number INTEGER,
|
||||
ADD COLUMN IF NOT EXISTS episode_number INTEGER,
|
||||
ADD COLUMN IF NOT EXISTS enclosure_url TEXT,
|
||||
-- itunes:duration claim (often HH:MM:SS or prose); display until
|
||||
-- ffprobe reconciles after download.
|
||||
ADD COLUMN IF NOT EXISTS declared_duration_seconds INTEGER,
|
||||
ADD COLUMN IF NOT EXISTS transcript_url TEXT,
|
||||
ADD COLUMN IF NOT EXISTS chapters_url TEXT,
|
||||
ADD COLUMN IF NOT EXISTS hosts TEXT[] DEFAULT '{}',
|
||||
ADD COLUMN IF NOT EXISTS guests TEXT[] DEFAULT '{}',
|
||||
-- Download state machine: pending | queued | downloading |
|
||||
-- downloaded | failed (+ reason text + attempt count). The episode
|
||||
-- list renders this inline (D8/D19) — never Processing Issues.
|
||||
ADD COLUMN IF NOT EXISTS download_state VARCHAR(20) NOT NULL DEFAULT 'pending',
|
||||
ADD COLUMN IF NOT EXISTS download_error TEXT,
|
||||
ADD COLUMN IF NOT EXISTS download_attempts INT NOT NULL DEFAULT 0;
|
||||
|
||||
-- Identity + ordering + worker-worklist indexes (all partial: scan
|
||||
-- rows never touch these columns).
|
||||
CREATE UNIQUE INDEX IF NOT EXISTS idx_media_items_feed_guid
|
||||
ON media_items(source_feed_id, episode_guid) WHERE source_feed_id IS NOT NULL;
|
||||
CREATE INDEX IF NOT EXISTS idx_media_items_feed_pos
|
||||
ON media_items(source_feed_id, feed_position) WHERE source_feed_id IS NOT NULL;
|
||||
CREATE INDEX IF NOT EXISTS idx_media_items_feed_undownloaded
|
||||
ON media_items(source_feed_id) WHERE source_feed_id IS NOT NULL AND download_state <> 'downloaded';
|
||||
|
||||
|
||||
-- ============================================================
|
||||
-- RLS: PER-USER LIBRARY VISIBILITY (ONE SOURCE OF TRUTH)
|
||||
-- Plan: ~/.opencode/plan/server-rls-library-visibility.md REV 2.
|
||||
@@ -1912,6 +2033,13 @@ ALTER TABLE media_items FORCE ROW LEVEL SECURITY;
|
||||
-- semantics — row absent -> visible; row true -> visible; row false
|
||||
-- -> hidden. No new index needed: library_visibility's
|
||||
-- UNIQUE(user_id, library_id) constraint already indexes the join.
|
||||
-- PODCAST EPISODES (plan D20): source='podcast_episode' rows carry the
|
||||
-- ADDITIONAL subscription predicate — visible only to subscribers of
|
||||
-- source_feed_id, or to admins (admins manage feeds regardless of
|
||||
-- subscription; the escape also satisfies background jobs, which
|
||||
-- declare a first-admin identity). Scan rows pass unchanged via the
|
||||
-- IS DISTINCT FROM guard — the predicate costs them one NULL compare.
|
||||
-- Unset identity FAILS LOUD, never fails open (see the block header).
|
||||
CREATE POLICY p_media_items_visible ON media_items
|
||||
FOR SELECT
|
||||
USING (
|
||||
@@ -1922,6 +2050,19 @@ CREATE POLICY p_media_items_visible ON media_items
|
||||
AND lv.library_id = media_items.library_id
|
||||
AND lv.is_visible = false
|
||||
)
|
||||
AND (
|
||||
media_items.source IS DISTINCT FROM 'podcast_episode'
|
||||
OR EXISTS (
|
||||
SELECT 1 FROM podcast_subscriptions s
|
||||
WHERE s.user_id = current_setting('app.user_id')::uuid
|
||||
AND s.feed_id = media_items.source_feed_id
|
||||
)
|
||||
OR EXISTS (
|
||||
SELECT 1 FROM users u
|
||||
WHERE u.id = current_setting('app.user_id')::uuid
|
||||
AND u.role = 'admin'
|
||||
)
|
||||
)
|
||||
);
|
||||
|
||||
-- WRITE policies: PERMISSIVE STAND-INS for the deferred scoped write
|
||||
@@ -1942,7 +2083,59 @@ CREATE POLICY p_media_items_update ON media_items
|
||||
CREATE POLICY p_media_items_delete ON media_items
|
||||
FOR DELETE USING (true);
|
||||
|
||||
-- Other tables: NONE. collection_items reaches media only via INNER
|
||||
-- Other tables: collection_items reaches media only via INNER
|
||||
-- JOIN media_items (the join drops filtered rows). collections
|
||||
-- metadata (book_count) is a separate counts question — plan A13.
|
||||
|
||||
-- PODCAST FEEDS (plan D20): governed the same way. SELECT-visible to
|
||||
-- subscribers of the feed (their subscription IS the grant — this is
|
||||
-- the predicate's lookup table, podcast_subscriptions itself stays
|
||||
-- UNGOVERNED) plus the library-visibility join (a hidden library
|
||||
-- hides its feeds too), and to admins. WRITE policies are permissive
|
||||
-- stand-ins for the same reason as media_items above: mandatory at
|
||||
-- ENABLE time, and the fetcher/worker (first-admin identity) plus the
|
||||
-- add-feed upsert (ON CONFLICT DO UPDATE needs no separate SELECT)
|
||||
-- cover every legitimate writer.
|
||||
DROP POLICY IF EXISTS p_podcast_feeds_visible ON podcast_feeds;
|
||||
DROP POLICY IF EXISTS p_podcast_feeds_insert ON podcast_feeds;
|
||||
DROP POLICY IF EXISTS p_podcast_feeds_update ON podcast_feeds;
|
||||
DROP POLICY IF EXISTS p_podcast_feeds_delete ON podcast_feeds;
|
||||
|
||||
ALTER TABLE podcast_feeds ENABLE ROW LEVEL SECURITY;
|
||||
ALTER TABLE podcast_feeds FORCE ROW LEVEL SECURITY;
|
||||
|
||||
CREATE POLICY p_podcast_feeds_visible ON podcast_feeds
|
||||
FOR SELECT
|
||||
USING (
|
||||
current_setting('app.user_id') IS NOT NULL
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM library_visibility lv
|
||||
WHERE lv.user_id = current_setting('app.user_id')::uuid
|
||||
AND lv.library_id = podcast_feeds.library_id
|
||||
AND lv.is_visible = false
|
||||
)
|
||||
AND (
|
||||
EXISTS (
|
||||
SELECT 1 FROM podcast_subscriptions s
|
||||
WHERE s.user_id = current_setting('app.user_id')::uuid
|
||||
AND s.feed_id = podcast_feeds.id
|
||||
)
|
||||
OR EXISTS (
|
||||
SELECT 1 FROM users u
|
||||
WHERE u.id = current_setting('app.user_id')::uuid
|
||||
AND u.role = 'admin'
|
||||
)
|
||||
)
|
||||
);
|
||||
|
||||
CREATE POLICY p_podcast_feeds_insert ON podcast_feeds
|
||||
FOR INSERT WITH CHECK (true);
|
||||
CREATE POLICY p_podcast_feeds_update ON podcast_feeds
|
||||
FOR UPDATE USING (true) WITH CHECK (true);
|
||||
CREATE POLICY p_podcast_feeds_delete ON podcast_feeds
|
||||
FOR DELETE USING (true);
|
||||
|
||||
-- podcast_subscriptions: UNGOVERNED, deliberately — it IS the read
|
||||
-- policy's lookup table, and a user must always see their own
|
||||
-- subscription rows (subscribe -> visibility is a single INSERT).
|
||||
-- ============================================================
|
||||
Reference in new issue
Block a user