bvandeusenandClaude Opus 5
f90b9203a7
`android/ffi` is to Android what `desktop/src-tauri/src/commands/` is to the
desktop: a shim over the shared core holding no logic of its own. Third workspace
member, so the desktop lane's `cargo clippy --all-targets` compiles and lints it
— which until the Android lane lands (step 5) is the only thing that does.
Three decisions worth stating.
MIRRORED RECORDS, NOT DERIVES ON THE CORE. The core's model structs are serde
shapes contracted with the shared Vue frontend, and one of them holds a
serde_json::Value, which has no uniffi representation. Hanging uniffi derives on
them would couple two unrelated consumers to one definition. The cost of
mirroring is drift — an Android client quietly missing a field the desktop
gained — so every conversion destructures the core struct exhaustively. Add a
field to core::local::models::Note and this crate stops compiling until Android
is told what to do with it.
NoteEdit IS A LIST, NOT A STRUCT OF NULLABLE FIELDS. The store's patch format
distinguishes three states: leave alone, set, and clear to null. Kotlin cannot
express the third with a nullable field — `title = null` in a data class is
indistinguishable from `title` unset — so the editor could never clear a title.
Explicit Clear* variants say it out loud and give Kotlin a sealed class.
ASYNC IS TOKIO-BACKED, AND CANCELLATION ALREADY WORKED. Exported async methods
become Kotlin suspend functions. When a coroutine is cancelled uniffi drops the
future, and no async path in the core holds the store lock across an await —
a std MutexGuard isn't Send, so the compiler has been enforcing that all along.
A cancelled sync leaves the store consistent and simply hasn't stamped
last_sync_at, which is only written after both halves of a cycle succeed.
Also here:
* core gains Db::conn(). Every consumer was writing
`db.0.lock().map_err(|e| e.to_string())?` by hand, and worse, any helper
returning the guard had to NAME rusqlite::Connection — which would have made
rusqlite a dependency of a layer whose whole point is not knowing what the
store is made of. Same trap as the update.rs test module in step 1.
* The uniffi `cli` feature is gated behind our own `bindgen` feature. It drags
in clap, askama and goblin for a three-line binary, and the desktop lane
should not compile a code generator it never runs.
* The bindgen binary lives in this workspace on purpose: generated bindings and
the linked uniffi runtime are two halves of one ABI, and compiling the
generator against the same dependency keeps them in step by construction.
That is why ci-rust-android ships no uniffi-bindgen.
Tests cover the round trip the Android skeleton needs (open a store in a
directory that does not exist yet, write a note, read it back), that a body-only
note still has a display_title, that set and clear are genuinely different
edits, and that an unlinked app reports NotLinked rather than an error.
Known and deliberate: the workspace sets panic = "abort", so a panic crossing the
FFI aborts instead of arriving in Kotlin as an exception. Same behaviour the
desktop already has; noted in the crate header rather than silently changed.
Scribe #2733.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
79 lines
3.0 KiB
Rust
79 lines
3.0 KiB
Rust
//! The local-first store: on-device SQLite, and the source of truth for every
|
|
//! client. A client built on this is fully usable with no server and no account.
|
|
//!
|
|
//! Framework-free on purpose. The desktop reaches it through Tauri commands and
|
|
//! Android through uniffi, but neither of those concerns appears in here.
|
|
|
|
pub mod derive;
|
|
pub mod models;
|
|
pub mod retention;
|
|
pub mod schema;
|
|
pub mod store;
|
|
|
|
use std::path::Path;
|
|
use std::sync::Mutex;
|
|
|
|
use rusqlite::Connection;
|
|
|
|
/// The shared database handle. rusqlite connections aren't `Sync`, so a `Mutex`
|
|
/// serializes access — fine, since operations are quick and a client is single-user.
|
|
/// How it is held is the caller's business: Tauri manages it as state, Android holds
|
|
/// it in the uniffi object.
|
|
pub struct Db(pub Mutex<Connection>);
|
|
|
|
impl Db {
|
|
/// Lock the store, reporting a poisoned lock as a message rather than a panic.
|
|
///
|
|
/// Every consumer was writing `db.0.lock().map_err(|e| e.to_string())?` at each
|
|
/// call site. Beyond the repetition, that spelling forces the caller to NAME
|
|
/// `rusqlite::Connection` in any helper that returns the guard — which would make
|
|
/// rusqlite a dependency of a layer whose whole point is not to know what the
|
|
/// store is made of. Returning it from here means callers can bind the guard by
|
|
/// inference and never name the type.
|
|
///
|
|
/// A poisoned lock means some earlier call panicked while holding it. The store
|
|
/// is not necessarily corrupt, but this connection can't be trusted blind, so it
|
|
/// surfaces as an error the UI can show instead of a second panic.
|
|
pub fn conn(&self) -> Result<std::sync::MutexGuard<'_, Connection>, String> {
|
|
self.0
|
|
.lock()
|
|
.map_err(|_| "the local store lock was poisoned by an earlier panic".to_string())
|
|
}
|
|
}
|
|
|
|
/// Open (creating if needed) the database at `path` and bring it to the latest schema.
|
|
pub fn open(path: &Path) -> rusqlite::Result<Db> {
|
|
let conn = Connection::open(path)?;
|
|
schema::migrate(&conn)?;
|
|
Ok(Db(Mutex::new(conn)))
|
|
}
|
|
|
|
/// Open a migrated, in-memory store.
|
|
///
|
|
/// Exists so a CONSUMER can test against a real schema without taking a rusqlite
|
|
/// dependency of its own just to build a `Db` — which is exactly what the desktop
|
|
/// crate was doing before the core was extracted. The Android bindings will want the
|
|
/// same thing.
|
|
pub fn open_in_memory() -> rusqlite::Result<Db> {
|
|
let conn = Connection::open_in_memory()?;
|
|
schema::migrate(&conn)?;
|
|
Ok(Db(Mutex::new(conn)))
|
|
}
|
|
|
|
/// A one-line count summary of the store, for the startup log.
|
|
pub fn summary(db: &Db) -> String {
|
|
let conn = match db.0.lock() {
|
|
Ok(c) => c,
|
|
Err(_) => return "counts unavailable (lock poisoned)".to_string(),
|
|
};
|
|
let count = |sql: &str| {
|
|
conn.query_row(sql, [], |r| r.get::<_, i64>(0))
|
|
.unwrap_or(-1)
|
|
};
|
|
format!(
|
|
"{} notes, {} labels",
|
|
count("SELECT COUNT(*) FROM notes"),
|
|
count("SELECT COUNT(*) FROM labels"),
|
|
)
|
|
}
|