mirror of
https://github.com/block/buzz.git
synced 2026-10-27 20:41:57 +00:00
f148c0f22c
🤖 > **Review as a pair with block/buzz-app#1084** (the app change that uses this endpoint). Either can merge first: the app falls back to the old search on relays without this endpoint. ## Summary Searching for a person by name over the relay's general search returns profiles that only *mention* the text somewhere else: in an avatar image embedded as text, in the bio, or in the verification address. A search for "wes" could fill every result page with profiles whose avatar data happens to contain "Wes", and never return the person actually named Wes. This adds a relay endpoint, `POST /profiles/search`, that looks only at a profile's **name** and **display name**. Every other profile field is ignored. **Matching and paging are the same as the relay's existing full-text profile search** (NIP-50 search over kind:0 profiles with `search_mode: "prefix"`). A client can switch to this endpoint without a visible change in which people a query finds: - Each query word must match a whole word of the name; the last word can be a prefix. Words can be in any order, so "johnson wes" finds "Wes Johnson". Case is ignored. - Pages work the same way: up to 100 results per page, up to page 1000. - The results are exactly the old results minus profiles that match only outside their names. The order is better for people search: exact name first, then names that start with the query, then names with a later word that starts with it, then other matches. Ties are ordered by `ts_rank_cd` over the two name fields only (not the whole profile, as in NIP-50), then newest first, then event id. The response is a JSON array of the original signed profile events (Nostr kind:0), so clients can verify them as they do today. The buzz-app client change is block/buzz-app#1084. ## Details - Request: `{"query": "wes", "limit": 20, "page": 1}`. `query` is 1–100 characters after trimming; `limit` is 1–100 (default 20); `page` is 1–1000 (default 1); unknown fields are rejected with 400. - The search reuses the full-text search's own query builder (`buzz-search`), so the word rule cannot drift from it. The existing full-text index on events stays the access path; the name check runs only on rows the index already matched. There is no new index. One small migration (`0061`) adds the function `profile_name_fields()`; it reads no table data, so it runs instantly. - Only current profiles count: a replaced profile stops matching. Profiles that are not a JSON object, or whose name fields are not strings, never match. Content that PostgreSQL cannot read as `jsonb` (for example a `\^@` escape or very deep nesting) also never matches, and it cannot make the search fail for everyone else. - The handler loads the matched events through the normal routed event read and applies the same reader visibility check as other reads, in search order. - Access uses the same checks as the relay's GIF search endpoint: a signed HTTP request (NIP-98), identity admission (NIP-FI), rate limit, replay protection, and relay membership. That code moved out of `gifs.rs` into one shared helper in `bridge.rs`; GIF behavior is unchanged. - The route is added to the existing protected-route and NIP-FI shadow/enforce route tables. Docs: `docs/profile-search.md`. - Two test-only lines get `sadscan:disable` comments, as other fixtures already do: an existing public ES256 test key in `router.rs`, and the local Postgres test URL in the search integration test. ### Related issue None found. ### Testing - Postgres test for the search query (`profile_names_match_name_words_only`): only name fields match (avatar data URL, `about`, `nip05`, `banner`, non-string names and non-object content are excluded); words in any order and across both name fields; whole words only for completed words; ranking order; pages split without overlap or gaps; replaced profile; other community; `%` literal. - Postgres end-to-end test through the router: an admitted member gets only the name-matching signed event, and the returned event still verifies. - Request validation unit tests; existing GIF admission tests and router route-table tests pass. - Local end-to-end run with buzz-app#1084 against a relay built from this head, with about 195 seeded profiles. For every query tried, the endpoint's results were a subset of the full-text search's results; the only profiles missing were avatar-only matches. --------- Signed-off-by: Logan Johnson <loganj@squareup.com> Co-authored-by: Larry <627498bd4bd1f281a16431e3c6cce3b5c25b6692798c78672298aefbf2f8f8b5@buzz.block.builderlab.xyz>
212 lines
8.5 KiB
PL/PgSQL
212 lines
8.5 KiB
PL/PgSQL
-- Desired-state database manifest.
|
|
--
|
|
-- `tables/public/<table>.sql` declares one table per file: its CREATE TABLE
|
|
-- and the CREATE INDEX statements on it, the one-table-per-file shape SchemaBot
|
|
-- reads. `tables/` is the SchemaBot schema directory and `public` is its
|
|
-- namespace, so nothing else may live under it.
|
|
--
|
|
-- Everything SchemaBot cannot apply lives in this directory's other
|
|
-- subdirectories: `types/`, `functions/`, `partitions/`, `triggers/` (including
|
|
-- write-fence attachment), `seeds/`, and the `community_write_fence.sql`
|
|
-- bootstrap. This file composes all of them into one fresh database, in load
|
|
-- order: types → functions → tables → partitions → triggers → seeds → fence.
|
|
--
|
|
-- `./bin/pgschema apply --file schema/schema.sql` resolves the `\i` includes
|
|
-- relative to this file (it refuses `..`). `pgschema` skips INSERTs and some
|
|
-- storage parameters, so every apply caller must then run
|
|
-- `scripts/reconcile-schema-after-pgschema.sql`. Raw `psql` resolves `\i`
|
|
-- against the working directory instead, so run it from here:
|
|
-- `cd schema && psql -f schema.sql`.
|
|
--
|
|
-- Adding a table: add `tables/public/<table>.sql` and include it below after
|
|
-- the tables it references; put its partitions, triggers, and seed rows in the
|
|
-- matching subdirectories and include those too. This file holds only `\i`
|
|
-- lines and `CREATE EXTENSION`. Outside `tables/public/`, no file may create,
|
|
-- alter or drop a table or index, except `CREATE TABLE ... PARTITION OF` in
|
|
-- `partitions/`. The layout test enforces both.
|
|
|
|
-- Buzz initial Postgres schema — multi-tenant.
|
|
--
|
|
-- Source of truth for fresh database setup. This is a clean, from-scratch
|
|
-- schema in which `community_id` is a first-class, server-resolved key on
|
|
-- every tenant-scoped row. It is NOT additive over the single-community
|
|
-- schema; the rewrite replaces it. Existing single-community deployments
|
|
-- migrate via the documented backfill migration (0002), which assigns all
|
|
-- pre-existing rows to one default community.
|
|
--
|
|
-- The governing contract is docs/multi-tenant-conformance.md. Every table
|
|
-- below cites the conformance surface it implements. The invariant behind the
|
|
-- whole schema (conformance "row zero"): a request's community is resolved
|
|
-- from the connection host by the server, never supplied by the client, and
|
|
-- every scoped row carries that immutable `community_id`.
|
|
--
|
|
-- Migration-lint obligations enforced by the Lane 0 lint harness:
|
|
-- 1. Every tenant-scoped table has `community_id NOT NULL`.
|
|
-- 2. No UNIQUE / PRIMARY KEY / FK on a scoped table is observable across
|
|
-- communities: each leads with `community_id` (or, for child rows whose
|
|
-- parent already pins the community, joins carry the community tuple).
|
|
-- 3. `channels.community_id` is immutable (triggers/channels.sql; no UPDATE path).
|
|
-- 4. Operator-global tables are named in the explicit allowlist, not implied.
|
|
|
|
CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
|
|
|
-- types
|
|
\i types/channel_type.sql
|
|
\i types/channel_visibility.sql
|
|
\i types/member_role.sql
|
|
\i types/workflow_status.sql
|
|
\i types/run_status.sql
|
|
\i types/approval_status.sql
|
|
\i types/delivery_method.sql
|
|
\i types/subscription_status.sql
|
|
\i types/pause_reason.sql
|
|
\i types/channel_add_policy.sql
|
|
|
|
-- functions
|
|
\i functions/channels_community_id_immutable.sql
|
|
\i functions/refresh_channel_ttl_after_event_insert.sql
|
|
\i functions/guard_channel_roster_snapshot.sql
|
|
\i functions/events_created_at_floor_guard.sql
|
|
\i functions/prevent_community_deletion_request_retargeting.sql
|
|
\i functions/prevent_community_deletion_approval_removal.sql
|
|
\i functions/protect_community_deletion_manifest_keys.sql
|
|
\i functions/community_deletion_lock_key.sql
|
|
\i functions/community_write_fence_excluded_table.sql
|
|
\i functions/community_write_allowed.sql
|
|
\i functions/assert_community_write_allowed.sql
|
|
\i functions/enforce_community_write_fence.sql
|
|
\i functions/enforce_community_tombstone.sql
|
|
\i functions/attach_community_write_fence.sql
|
|
\i functions/profile_name_fields.sql
|
|
|
|
-- tables
|
|
\i tables/public/communities.sql
|
|
\i tables/public/channels.sql
|
|
\i tables/public/channel_members.sql
|
|
\i tables/public/users.sql
|
|
\i tables/public/personal_read_accounts.sql
|
|
\i tables/public/personal_read_frontiers.sql
|
|
\i tables/public/events.sql
|
|
\i tables/public/event_mentions.sql
|
|
\i tables/public/subscriptions.sql
|
|
\i tables/public/delivery_log.sql
|
|
\i tables/public/workflows.sql
|
|
\i tables/public/workflow_runs.sql
|
|
\i tables/public/workflow_approvals.sql
|
|
\i tables/public/scheduled_workflow_fires.sql
|
|
\i tables/public/api_tokens.sql
|
|
\i tables/public/rate_limit_violations.sql
|
|
\i tables/public/thread_metadata.sql
|
|
\i tables/public/reactions.sql
|
|
\i tables/public/pubkey_allowlist.sql
|
|
\i tables/public/relay_members.sql
|
|
\i tables/public/join_policy_acceptances.sql
|
|
\i tables/public/relay_invites.sql
|
|
\i tables/public/archived_identities.sql
|
|
\i tables/public/audit_log.sql
|
|
\i tables/public/moderation_actions.sql
|
|
\i tables/public/moderation_reports.sql
|
|
\i tables/public/community_bans.sql
|
|
\i tables/public/_operator_global_tables.sql
|
|
\i tables/public/git_repo_names.sql
|
|
\i tables/public/parameterized_event_watermarks.sql
|
|
\i tables/public/product_feedback.sql
|
|
\i tables/public/push_leases.sql
|
|
\i tables/public/push_wake_outbox.sql
|
|
\i tables/public/push_match_queue.sql
|
|
\i tables/public/push_gateway_challenges.sql
|
|
\i tables/public/push_gateway_installations.sql
|
|
\i tables/public/push_gateway_delegations.sql
|
|
\i tables/public/push_gateway_endpoint_quotas.sql
|
|
\i tables/public/push_gateway_delivery_auth_replays.sql
|
|
\i tables/public/push_gateway_delivery_request_replays.sql
|
|
\i tables/public/replica_heartbeat.sql
|
|
\i tables/public/community_deletion_requests.sql
|
|
\i tables/public/community_deletion_approvals.sql
|
|
\i tables/public/community_deletion_checkpoints.sql
|
|
\i tables/public/community_deletion_manifest_keys.sql
|
|
\i tables/public/storage_taxonomy_sweeps.sql
|
|
\i tables/public/community_serving_write_leases.sql
|
|
\i tables/public/community_deletion_executor_heartbeats.sql
|
|
\i tables/public/relay_operators.sql
|
|
\i tables/public/relay_admin_actions.sql
|
|
\i tables/public/relay_admin_outbox.sql
|
|
\i tables/public/operator_listener_pubkeys.sql
|
|
\i tables/public/operator_listener_outbox.sql
|
|
\i tables/public/relay_operator_audit.sql
|
|
\i tables/public/storage_accounting_snapshots.sql
|
|
\i tables/public/artifact_heads.sql
|
|
\i tables/public/artifact_revisions.sql
|
|
|
|
-- partitions
|
|
\i partitions/events.sql
|
|
\i partitions/delivery_log.sql
|
|
|
|
-- triggers
|
|
\i triggers/channels.sql
|
|
\i triggers/events.sql
|
|
\i triggers/community_deletion_requests.sql
|
|
\i triggers/community_deletion_approvals.sql
|
|
\i triggers/community_deletion_manifest_keys.sql
|
|
\i triggers/communities.sql
|
|
\i triggers/api_tokens.sql
|
|
\i triggers/archived_identities.sql
|
|
\i triggers/audit_log.sql
|
|
\i triggers/channel_members.sql
|
|
\i triggers/community_bans.sql
|
|
\i triggers/delivery_log.sql
|
|
\i triggers/event_mentions.sql
|
|
\i triggers/git_repo_names.sql
|
|
\i triggers/join_policy_acceptances.sql
|
|
\i triggers/moderation_actions.sql
|
|
\i triggers/moderation_reports.sql
|
|
\i triggers/parameterized_event_watermarks.sql
|
|
\i triggers/personal_read_accounts.sql
|
|
\i triggers/personal_read_frontiers.sql
|
|
\i triggers/pubkey_allowlist.sql
|
|
\i triggers/push_leases.sql
|
|
\i triggers/push_match_queue.sql
|
|
\i triggers/push_wake_outbox.sql
|
|
\i triggers/reactions.sql
|
|
\i triggers/relay_invites.sql
|
|
\i triggers/relay_members.sql
|
|
\i triggers/scheduled_workflow_fires.sql
|
|
\i triggers/subscriptions.sql
|
|
\i triggers/thread_metadata.sql
|
|
\i triggers/users.sql
|
|
\i triggers/workflow_approvals.sql
|
|
\i triggers/workflow_runs.sql
|
|
\i triggers/workflows.sql
|
|
\i triggers/artifact_heads.sql
|
|
\i triggers/artifact_revisions.sql
|
|
|
|
-- seeds
|
|
\i seeds/communities.sql
|
|
\i seeds/rate_limit_violations.sql
|
|
\i seeds/_operator_global_tables.sql
|
|
\i seeds/product_feedback.sql
|
|
\i seeds/push_gateway_challenges.sql
|
|
\i seeds/push_gateway_installations.sql
|
|
\i seeds/push_gateway_delegations.sql
|
|
\i seeds/push_gateway_endpoint_quotas.sql
|
|
\i seeds/push_gateway_delivery_auth_replays.sql
|
|
\i seeds/push_gateway_delivery_request_replays.sql
|
|
\i seeds/replica_heartbeat.sql
|
|
\i seeds/community_deletion_requests.sql
|
|
\i seeds/community_deletion_approvals.sql
|
|
\i seeds/community_deletion_checkpoints.sql
|
|
\i seeds/community_deletion_manifest_keys.sql
|
|
\i seeds/storage_taxonomy_sweeps.sql
|
|
\i seeds/community_serving_write_leases.sql
|
|
\i seeds/community_deletion_executor_heartbeats.sql
|
|
\i seeds/relay_operators.sql
|
|
\i seeds/relay_admin_actions.sql
|
|
\i seeds/relay_admin_outbox.sql
|
|
\i seeds/operator_listener_pubkeys.sql
|
|
\i seeds/operator_listener_outbox.sql
|
|
\i seeds/relay_operator_audit.sql
|
|
\i seeds/storage_accounting_snapshots.sql
|
|
|
|
-- Fence any community-scoped table that lacks an explicit attach.
|
|
\i community_write_fence.sql
|