Skip to content
rachel/workerd
File

Blob: src/workerd/util/sqlite.c++

97.8 KB
1// Copyright (c) 2023 Cloudflare, Inc.
2// Licensed under the Apache 2.0 license found in the LICENSE file or at:
3//     https://opensource.org/licenses/Apache-2.0
4 
5#include "sqlite.h"
6 
7#include <workerd/util/autogate.h>
8#include <workerd/util/sentry.h>
9 
10#include <kj/debug.h>
11#include <kj/refcount.h>
12#include <kj/string-tree.h>
13 
14#if _WIN32
15#include <windows.h>
16 
17#include <kj/win32-api-version.h>
18#include <kj/windows-sanity.h>
19#else
20#include <unistd.h>
21#endif
22 
23#include <fcntl.h>
24#include <sqlite3.h>
25#include <sys/stat.h>
26 
27#include <kj/map.h>
28#include <kj/mutex.h>
29#include <kj/vector.h>
30 
31#include <atomic>
32 
33#if _WIN32
34#define strncasecmp _strnicmp
35#define strcasecmp _stricmp
36#endif
37 
38namespace workerd {
39 
40namespace {
41 
42// SQLite has a function like this in its internals, but it's not exposed to library consumers.
43//
44// These error codes come from https://www.sqlite.org/rescode.html#primary_result_code_list.
45kj::String namedErrorCode(int errorCode) {
46#define LITERAL(name)                                                                              \
47  case name:                                                                                       \
48    return kj::str(#name);
49  switch (errorCode) {
50    LITERAL(SQLITE_OK)
51    LITERAL(SQLITE_ERROR)
52    LITERAL(SQLITE_INTERNAL)
53    LITERAL(SQLITE_PERM)
54    LITERAL(SQLITE_ABORT)
55    LITERAL(SQLITE_BUSY)
56    LITERAL(SQLITE_LOCKED)
57    LITERAL(SQLITE_NOMEM)
58    LITERAL(SQLITE_READONLY)
59    LITERAL(SQLITE_INTERRUPT)
60    LITERAL(SQLITE_IOERR)
61    LITERAL(SQLITE_CORRUPT)
62    LITERAL(SQLITE_NOTFOUND)
63    LITERAL(SQLITE_FULL)
64    LITERAL(SQLITE_CANTOPEN)
65    LITERAL(SQLITE_PROTOCOL)
66    LITERAL(SQLITE_EMPTY)
67    LITERAL(SQLITE_SCHEMA)
68    LITERAL(SQLITE_TOOBIG)
69    LITERAL(SQLITE_CONSTRAINT)
70    LITERAL(SQLITE_MISMATCH)
71    LITERAL(SQLITE_MISUSE)
72    LITERAL(SQLITE_NOLFS)
73    LITERAL(SQLITE_AUTH)
74    LITERAL(SQLITE_FORMAT)
75    LITERAL(SQLITE_RANGE)
76    LITERAL(SQLITE_NOTADB)
77    LITERAL(SQLITE_NOTICE)
78    LITERAL(SQLITE_WARNING)
79    LITERAL(SQLITE_ROW)
80    LITERAL(SQLITE_DONE)
81    default:
82      return kj::str("SQLITE_UNKNOWN_ERROR_CODE(", errorCode, ")");
83  }
84#undef LITERAL
85}
86 
87// Maps extended error codes to their symbolic names.
88// See https://www.sqlite.org/rescode.html#extended_result_code_list.
89kj::Maybe<kj::String> namedExtendedErrorCode(int extendedErrorCode) {
90#define LITERAL(name)                                                                              \
91  case name:                                                                                       \
92    return kj::str(#name);
93  switch (extendedErrorCode) {
94    LITERAL(SQLITE_ABORT_ROLLBACK)
95    LITERAL(SQLITE_AUTH_USER)
96    LITERAL(SQLITE_BUSY_RECOVERY)
97    LITERAL(SQLITE_BUSY_SNAPSHOT)
98    LITERAL(SQLITE_BUSY_TIMEOUT)
99    LITERAL(SQLITE_CANTOPEN_CONVPATH)
100    LITERAL(SQLITE_CANTOPEN_DIRTYWAL)
101    LITERAL(SQLITE_CANTOPEN_FULLPATH)
102    LITERAL(SQLITE_CANTOPEN_ISDIR)
103    LITERAL(SQLITE_CANTOPEN_NOTEMPDIR)
104    LITERAL(SQLITE_CANTOPEN_SYMLINK)
105    LITERAL(SQLITE_CONSTRAINT_CHECK)
106    LITERAL(SQLITE_CONSTRAINT_COMMITHOOK)
107    LITERAL(SQLITE_CONSTRAINT_DATATYPE)
108    LITERAL(SQLITE_CONSTRAINT_FOREIGNKEY)
109    LITERAL(SQLITE_CONSTRAINT_FUNCTION)
110    LITERAL(SQLITE_CONSTRAINT_NOTNULL)
111    LITERAL(SQLITE_CONSTRAINT_PINNED)
112    LITERAL(SQLITE_CONSTRAINT_PRIMARYKEY)
113    LITERAL(SQLITE_CONSTRAINT_ROWID)
114    LITERAL(SQLITE_CONSTRAINT_TRIGGER)
115    LITERAL(SQLITE_CONSTRAINT_UNIQUE)
116    LITERAL(SQLITE_CONSTRAINT_VTAB)
117    LITERAL(SQLITE_CORRUPT_INDEX)
118    LITERAL(SQLITE_CORRUPT_SEQUENCE)
119    LITERAL(SQLITE_CORRUPT_VTAB)
120    LITERAL(SQLITE_ERROR_MISSING_COLLSEQ)
121    LITERAL(SQLITE_ERROR_RETRY)
122    LITERAL(SQLITE_ERROR_SNAPSHOT)
123    LITERAL(SQLITE_IOERR_ACCESS)
124    LITERAL(SQLITE_IOERR_AUTH)
125    LITERAL(SQLITE_IOERR_BEGIN_ATOMIC)
126    LITERAL(SQLITE_IOERR_BLOCKED)
127    LITERAL(SQLITE_IOERR_CHECKRESERVEDLOCK)
128    LITERAL(SQLITE_IOERR_CLOSE)
129    LITERAL(SQLITE_IOERR_COMMIT_ATOMIC)
130    LITERAL(SQLITE_IOERR_CONVPATH)
131    LITERAL(SQLITE_IOERR_CORRUPTFS)
132    LITERAL(SQLITE_IOERR_DATA)
133    LITERAL(SQLITE_IOERR_DELETE)
134    LITERAL(SQLITE_IOERR_DELETE_NOENT)
135    LITERAL(SQLITE_IOERR_DIR_CLOSE)
136    LITERAL(SQLITE_IOERR_DIR_FSYNC)
137    LITERAL(SQLITE_IOERR_FSTAT)
138    LITERAL(SQLITE_IOERR_FSYNC)
139    LITERAL(SQLITE_IOERR_GETTEMPPATH)
140    LITERAL(SQLITE_IOERR_LOCK)
141    LITERAL(SQLITE_IOERR_MMAP)
142    LITERAL(SQLITE_IOERR_NOMEM)
143    LITERAL(SQLITE_IOERR_RDLOCK)
144    LITERAL(SQLITE_IOERR_READ)
145    LITERAL(SQLITE_IOERR_ROLLBACK_ATOMIC)
146    LITERAL(SQLITE_IOERR_SEEK)
147    LITERAL(SQLITE_IOERR_SHMLOCK)
148    LITERAL(SQLITE_IOERR_SHMMAP)
149    LITERAL(SQLITE_IOERR_SHMOPEN)
150    LITERAL(SQLITE_IOERR_SHMSIZE)
151    LITERAL(SQLITE_IOERR_SHORT_READ)
152    LITERAL(SQLITE_IOERR_TRUNCATE)
153    LITERAL(SQLITE_IOERR_UNLOCK)
154    LITERAL(SQLITE_IOERR_VNODE)
155    LITERAL(SQLITE_IOERR_WRITE)
156    LITERAL(SQLITE_LOCKED_SHAREDCACHE)
157    LITERAL(SQLITE_LOCKED_VTAB)
158    LITERAL(SQLITE_NOTICE_RECOVER_ROLLBACK)
159    LITERAL(SQLITE_NOTICE_RECOVER_WAL)
160    LITERAL(SQLITE_OK_LOAD_PERMANENTLY)
161    LITERAL(SQLITE_READONLY_CANTINIT)
162    LITERAL(SQLITE_READONLY_CANTLOCK)
163    LITERAL(SQLITE_READONLY_DBMOVED)
164    LITERAL(SQLITE_READONLY_DIRECTORY)
165    LITERAL(SQLITE_READONLY_RECOVERY)
166    LITERAL(SQLITE_READONLY_ROLLBACK)
167    LITERAL(SQLITE_WARNING_AUTOINDEX)
168    default:
169      return kj::none;
170  }
171#undef LITERAL
172}
173 
174constexpr size_t RA_MAX_METRICS_QUERY_SIZE = 1024;
175 
176kj::String dbErrorMessage(int errorCode, sqlite3* db) {
177  kj::StringTree msg = kj::strTree(sqlite3_errmsg(db));
178  if (int offset = sqlite3_error_offset(db); offset != -1) {
179    msg = kj::strTree(kj::mv(msg), " at offset ", offset);
180  }
181  msg = kj::strTree(kj::mv(msg), ": ", namedErrorCode(errorCode));
182  int extendedCode = sqlite3_extended_errcode(db);
183  if (extendedCode != errorCode) {
184    KJ_IF_SOME(extendedName, namedExtendedErrorCode(extendedCode)) {
185      msg = kj::strTree(kj::mv(msg), " (extended: ", extendedName, ")");
186    }
187  }
188  return msg.flatten();
189}
190 
191// If a VFS call throws an exception, and vfsErrorListener is non-null, the exception will
192// be placed there, otherwise it will be logged. This is used to implement pass-through of KJ
193// exceptions through SQLite.
194static thread_local kj::Maybe<kj::Exception>* vfsErrorListener = nullptr;
195 
196// Report that in a sqlite VFS callback, an exception was caught, and SQLITE_IOERROR is being
197// returned to SQLite.
198//
199// The exception must be caught using `catch (kj::Exception& e)`, NOT using `catch (...)` followed
200// by kj::getCaughtExceptionAsKj(). This is because the latter truncates the stack trace to show
201// only the frames between the throw and the catch. We actually want to retain the full trace
202// through SQLite.
203void reportVfsErrorCaught(kj::Exception&& e) {
204  if (vfsErrorListener != nullptr) {
205    // Only capture the first error; assume subsequent errors are side effects.
206    if (*vfsErrorListener == kj::none) {
207      *vfsErrorListener = kj::mv(e);
208    }
209  } else {
210    LOG_EXCEPTION("sqliteVfsError", e);
211  }
212}
213 
214// Implements SQLITE_CALL_SCOPE.
215class SqliteCallScope {
216 public:
217  SqliteCallScope() {
218    KJ_DASSERT(vfsErrorListener == nullptr);
219    vfsErrorListener = &error;
220  }
221  ~SqliteCallScope() {
222    vfsErrorListener = nullptr;
223  }
224 
225  void rethrowVfsError() {
226    KJ_IF_SOME(e, error) {
227      // Slight hack: The exception already has a stack trace attached which should include the
228      // current stack, but `kj::throwFatalException()` would re-append the current stack trace
229      // to the exception. We can avoid that by calling
230      // kj::getExceptionCallback().onFatalException() directly, which is what
231      // `throwFatalException()` does after extending the stack.
232      kj::getExceptionCallback().onFatalException(kj::mv(e));
233    }
234  }
235 
236  kj::Maybe<const kj::Exception&> getException() {
237    return error;
238  }
239 
240  // Hack to allow block syntax with for(); see SQLITE_CALL_SCOPE.
241  bool done = false;
242 
243 private:
244  kj::Maybe<kj::Exception> error;
245};
246 
247}  // namespace
248 
249// Like KJ_REQUIRE() but give the Regulator a chance to report the error. `errorMessage` is either
250// the return value of sqlite3_errmsg() or a string literal containing a similarly
251// application-approriate error message. A reference called `regulator` must be in-scope.
252// sqliteErrorCode is a kj::Maybe<int> and represents the error code from sqlite.
253#define SQLITE_REQUIRE(condition, sqliteErrorCode, errorMessage, ...)                              \
254  if (!(condition)) {                                                                              \
255    regulator.onError(sqliteErrorCode, errorMessage);                                              \
256    KJ_FAIL_REQUIRE("SENTRY_DO SQLite failed", errorMessage, ##__VA_ARGS__);                       \
257  }
258 
259// Make a SQLite call and check the returned error code. Use this version when the call is not
260// associated with an open DB connection.
261#define SQLITE_CALL_NODB(code, ...)                                                                \
262  do {                                                                                             \
263    int _ec = code;                                                                                \
264    KJ_ASSERT(                                                                                     \
265        _ec == SQLITE_OK, kj::str(sqlite3_errstr(_ec), ": ", namedErrorCode(_ec)), ##__VA_ARGS__); \
266  } while (false)
267 
268// This version requires the scope to contain a variable named `db` which is of type sqlite3*, or
269// can convert to it.
270#define SQLITE_CALL(code, ...)                                                                     \
271  do {                                                                                             \
272    SqliteCallScope sqliteCallScope;                                                               \
273    int _ec = code;                                                                                \
274    /* SQLITE_MISUSE doesn't put error info on the database object, so check it separately */      \
275    KJ_ASSERT(_ec != SQLITE_MISUSE, "SQLite misused: " #code, ##__VA_ARGS__);                      \
276    handleCriticalError(_ec, dbErrorMessage(_ec, db), sqliteCallScope.getException());             \
277    if (_ec == SQLITE_IOERR) sqliteCallScope.rethrowVfsError();                                    \
278    SQLITE_REQUIRE(_ec == SQLITE_OK, _ec, dbErrorMessage(_ec, db), ##__VA_ARGS__);                 \
279  } while (false)
280 
281// Version of `SQLITE_CALL` that can be called after inspecting the error code, in case some codes
282// aren't really errors.
283//
284// Temporarily marking SQLITE_BUSY as NOSENTRY to reduce sentry volume while debugging issue.
285// TODO(soon): reenable SQLITE_BUSY sentry logging.
286#define SQLITE_CALL_FAILED(code, error, ...)                                                       \
287  do {                                                                                             \
288    KJ_ASSERT(error != SQLITE_MISUSE, "SQLite misused: " code, ##__VA_ARGS__);                     \
289    handleCriticalError(error, dbErrorMessage(error, db), sqliteCallScope.getException());         \
290    if (error == SQLITE_IOERR) sqliteCallScope.rethrowVfsError();                                  \
291    SQLITE_REQUIRE(error != SQLITE_BUSY, error, kj::str("NOSENTRY ", dbErrorMessage(error, db)),   \
292        ##__VA_ARGS__);                                                                            \
293    SQLITE_REQUIRE(error == SQLITE_OK, error, dbErrorMessage(error, db), ##__VA_ARGS__);           \
294  } while (false);
295 
296// When using SQLITE_CALL_FAILED(), you must place the actual sqlite call and the
297// SQLITE_CALL_FAILED() invocation within a SQLITE_CALL_SCOPE block, in order to set up VFS error
298// capture. Example:
299//
300//   SQLITE_CALL_SCOPE {
301//     int errorCode = sqlite3_do_something();
302//     if (errorCode != SQLITE_OK) {
303//       SQLITE_CALL_FAILED("sqlite3_do_something()", errorCode, "failed to do something");
304//     }
305//   }
306//
307// Note that if you use SQLITE_CALL(), this is handled automatically.
308#define SQLITE_CALL_SCOPE                                                                          \
309  for (SqliteCallScope sqliteCallScope; !sqliteCallScope.done; sqliteCallScope.done = true)
310 
311namespace {
312 
313void disposeSqlite(sqlite3_stmt* stmt) {
314  sqlite3_finalize(stmt);
315 
316  // Note that any returned error code is actually the last error to occur while executing the
317  // statement. This does not really mean that finalization failed, and the error in question
318  // should have been checked and reported earlier. So, we ignore it here.
319}
320 
321template <typename T>
322class SqliteDisposer: public kj::Disposer {
323 public:
324  void disposeImpl(void* pointer) const override {
325    disposeSqlite(reinterpret_cast<T*>(pointer));
326  }
327};
328 
329template <typename T>
330kj::Own<T> ownSqlite(T* obj) {
331  static const SqliteDisposer<T> disposer;
332  return kj::Own<T>(obj, disposer);
333}
334 
335#if _WIN32
336// https://github.com/capnproto/capnproto/blob/master/c%2B%2B/src/kj/filesystem-disk-win32.c%2B%2B#L255-L269
337static kj::Path getPathFromWin32Handle(HANDLE handle) {
338  DWORD tryLen = MAX_PATH;
339  for (;;) {
340    auto temp = kj::heapArray<wchar_t>(tryLen + 1);
341    DWORD len = GetFinalPathNameByHandleW(handle, temp.begin(), tryLen, 0);
342    if (len == 0) {
343      KJ_FAIL_WIN32("GetFinalPathNameByHandleW", GetLastError());
344    }
345    if (len < temp.size()) {
346      return kj::Path::parseWin32Api(temp.first(len));
347    }
348    // Try again with new length.
349    tryLen = len;
350  }
351}
352#endif
353 
354kj::Maybe<kj::StringPtr> toMaybeString(const char* cstr) {
355  if (cstr == nullptr) {
356    return kj::none;
357  } else {
358    return kj::StringPtr(cstr);
359  }
360}
361 
362// We allowlist these SQLite functions.
363static constexpr kj::StringPtr ALLOWED_SQLITE_FUNCTIONS[] = {
364  // https://www.sqlite.org/lang_corefunc.html
365  "abs"_kj,
366  "changes"_kj,
367  "char"_kj,
368  "coalesce"_kj,
369  "concat"_kj,
370  "concat_ws"_kj,
371  "format"_kj,
372  "glob"_kj,
373  "hex"_kj,
374  "ifnull"_kj,
375  "iif"_kj,
376  "instr"_kj,
377  "last_insert_rowid"_kj,
378  "length"_kj,
379  "like"_kj,
380  "likelihood"_kj,
381  "likely"_kj,
382  "load_extension"_kj,
383  "lower"_kj,
384  "ltrim"_kj,
385  "max_scalar"_kj,
386  "min_scalar"_kj,
387  "nullif"_kj,
388  "octet_length"_kj,
389  "printf"_kj,
390  "quote"_kj,
391  "random"_kj,
392  "randomblob"_kj,
393  "replace"_kj,
394  "round"_kj,
395  "rtrim"_kj,
396  "sign"_kj,
397  "soundex"_kj,
398  // These functions query SQLite internals and build details in a way we'd prefer not to reveal.
399  // "sqlite_compileoption_get"_kj,
400  // "sqlite_compileoption_used"_kj,
401  // "sqlite_offset"_kj,
402  // "sqlite_source_id"_kj,
403  // "sqlite_version"_kj,
404  "substr"_kj,
405  "substring"_kj,
406  "total_changes"_kj,
407  "trim"_kj,
408  "typeof"_kj,
409  "unhex"_kj,
410  "unicode"_kj,
411  "unlikely"_kj,
412  "upper"_kj,
413  "zeroblob"_kj,
414 
415  // https://www.sqlite.org/lang_datefunc.html
416  "date"_kj,
417  "time"_kj,
418  "datetime"_kj,
419  "julianday"_kj,
420  "unixepoch"_kj,
421  "strftime"_kj,
422  "timediff"_kj,
423  "current_date"_kj,
424  "current_time"_kj,
425  "current_timestamp"_kj,
426 
427  // https://www.sqlite.org/lang_aggfunc.html
428  "avg"_kj,
429  "count"_kj,
430  "group_concat"_kj,
431  "max"_kj,
432  "min"_kj,
433  "string_agg"_kj,
434  "sum"_kj,
435  "total"_kj,
436 
437  // https://www.sqlite.org/windowfunctions.html#biwinfunc
438  "row_number"_kj,
439  "rank"_kj,
440  "dense_rank"_kj,
441  "percent_rank"_kj,
442  "cume_dist"_kj,
443  "ntile"_kj,
444  "lag"_kj,
445  "lead"_kj,
446  "first_value"_kj,
447  "last_value"_kj,
448  "nth_value"_kj,
449 
450  // https://www.sqlite.org/lang_mathfunc.html
451  "acos"_kj,
452  "acosh"_kj,
453  "asin"_kj,
454  "asinh"_kj,
455  "atan"_kj,
456  "atan2"_kj,
457  "atanh"_kj,
458  "ceil"_kj,
459  "cos"_kj,
460  "cosh"_kj,
461  "degrees"_kj,
462  "exp"_kj,
463  "floor"_kj,
464  "ln"_kj,
465  "log"_kj,
466  "log2"_kj,
467  "mod"_kj,
468  "pi"_kj,
469  "pow"_kj,
470  "radians"_kj,
471  "sin"_kj,
472  "sinh"_kj,
473  "sqrt"_kj,
474  "tan"_kj,
475  "tanh"_kj,
476  "trunc"_kj,
477 
478  // https://www.sqlite.org/json1.html
479  "json"_kj,
480  "jsonb"_kj,
481  "json_array"_kj,
482  "jsonb_array"_kj,
483  "json_array_length"_kj,
484  "json_extract"_kj,
485  "jsonb_extract"_kj,
486  "->"_kj,
487  "->>"_kj,
488  "json_insert"_kj,
489  "jsonb_insert"_kj,
490  "json_object"_kj,
491  "jsonb_object"_kj,
492  "json_patch"_kj,
493  "jsonb_patch"_kj,
494  "json_remove"_kj,
495  "jsonb_remove"_kj,
496  "json_replace"_kj,
497  "jsonb_replace"_kj,
498  "json_set"_kj,
499  "jsonb_set"_kj,
500  "json_type"_kj,
501  "json_valid"_kj,
502  "json_quote"_kj,
503  "json_group_array"_kj,
504  "jsonb_group_array"_kj,
505  "json_group_object"_kj,
506  "jsonb_group_object"_kj,
507  "json_each"_kj,
508  "json_tree"_kj,
509 
510  // https://www.sqlite.org/fts5.html
511  "match"_kj,
512  "highlight"_kj,
513  "bm25"_kj,
514  "snippet"_kj,
515 
516  // https://www.sqlite.org/lang_altertable.html
517  // Functions declared in https://sqlite.org/src/file?name=src/alter.c&ci=trunk
518  "sqlite_rename_column"_kj,
519  "sqlite_rename_table"_kj,
520  "sqlite_rename_test"_kj,
521  "sqlite_drop_column"_kj,
522  "sqlite_rename_quotefix"_kj,
523};
524 
525enum class PragmaSignature {
526  NO_ARG,
527  BOOLEAN,
528  OBJECT_NAME,
529  OPTIONAL_OBJECT_NAME,
530  NULL_OR_NUMBER,
531  NULL_NUMBER_OR_OBJECT_NAME
532};
533struct PragmaInfo {
534  kj::StringPtr name;
535  PragmaSignature signature;
536};
537 
538// We allowlist these SQLite pragmas (for read only, never with arguments).
539// https://www.sqlite.org/pragma.html
540static constexpr PragmaInfo ALLOWED_PRAGMAS[] = {{"data_version"_kj, PragmaSignature::NO_ARG},
541 
542  // We allowlist some SQLite pragmas for changing internal state
543 
544  // Toggle constraints on/off
545  {"case_sensitive_like"_kj, PragmaSignature::BOOLEAN},
546  {"foreign_keys"_kj, PragmaSignature::BOOLEAN},
547  {"defer_foreign_keys"_kj, PragmaSignature::BOOLEAN},
548  {"ignore_check_constraints"_kj, PragmaSignature::BOOLEAN},
549  {"legacy_alter_table"_kj, PragmaSignature::BOOLEAN},
550  {"recursive_triggers"_kj, PragmaSignature::BOOLEAN},
551  {"reverse_unordered_selects"_kj, PragmaSignature::BOOLEAN},
552 
553  // Takes an argument of table name or index name, returns info about it.
554  {"foreign_key_check"_kj, PragmaSignature::OPTIONAL_OBJECT_NAME},
555  {"foreign_key_list"_kj, PragmaSignature::OBJECT_NAME},
556  {"index_info"_kj, PragmaSignature::OBJECT_NAME}, {"index_list"_kj, PragmaSignature::OBJECT_NAME},
557  {"index_xinfo"_kj, PragmaSignature::OBJECT_NAME},
558 
559  // Takes an argument of table name/index name OR a max number of results, or nothing
560  {"quick_check"_kj, PragmaSignature::NULL_NUMBER_OR_OBJECT_NAME},
561 
562  // Takes a number representing a bit mask or nothing to use the default mask.
563  {"optimize"_kj, PragmaSignature::NULL_OR_NUMBER}};
564 
565}  // namespace
566 
567// =======================================================================================
568 
569SqliteObserver SqliteObserver::DEFAULT = SqliteObserver{};
570 
571SqliteDatabase::SqliteDatabase(const Vfs& vfs,
572    kj::Path path,
573    kj::Maybe<kj::WriteMode> maybeMode,
574    size_t sqliteMaxMemoryBytes,
575    SqliteObserver& sqliteObserver,
576    kj::Maybe<const ActorAccountLimits&> actorAccountLimits)
577    : vfs(vfs),
578      path(kj::mv(path)),
579      readOnly(maybeMode == kj::none),
580      sqliteObserver(sqliteObserver),
581      sqliteMaxMemoryBytes(sqliteMaxMemoryBytes),
582      actorAccountLimits(actorAccountLimits) {
583  init(maybeMode);
584}
585 
586void SqliteDatabase::init(kj::Maybe<kj::WriteMode> maybeMode) {
587  KJ_ASSERT(maybeDb == kj::none);
588  sqlite3* db = nullptr;
589 
590  auto memoryScope = enterMemoryScope();
591 
592  KJ_IF_SOME(mode, maybeMode) {
593    int flags = SQLITE_OPEN_READWRITE;
594    if (kj::has(mode, kj::WriteMode::CREATE)) {
595      flags |= SQLITE_OPEN_CREATE;
596 
597      if (kj::has(mode, kj::WriteMode::CREATE_PARENT) && path.size() > 1) {
598        // SQLite isn't going to try to create the parent directory so let's try to create it now.
599        vfs.directory.openSubdir(path.parent(),
600            kj::WriteMode::CREATE | kj::WriteMode::MODIFY | kj::WriteMode::CREATE_PARENT);
601      }
602    }
603    KJ_REQUIRE(
604        kj::has(mode, kj::WriteMode::MODIFY), "SQLite doesn't support create-exclusive mode");
605 
606    KJ_IF_SOME(rootedPath, vfs.tryAppend(path)) {
607      // If we can get the path rooted in the VFS's directory, use the system's default VFS instead
608      // TODO(bug): This doesn't honor vfs.options. (This branch is only used on Windows.)
609      SQLITE_CALL_NODB(
610          sqlite3_open_v2(rootedPath.toNativeString(true).cStr(), &db, flags, nullptr));
611    } else {
612      SQLITE_CALL_NODB(sqlite3_open_v2(path.toString().cStr(), &db, flags, vfs.getName().cStr()));
613    }
614  } else {
615    KJ_IF_SOME(rootedPath, vfs.tryAppend(path)) {
616      // If we can get the path rooted in the VFS's directory, use the system's default VFS instead
617      // TODO(bug): This doesn't honor vfs.options. (This branch is only used on Windows.)
618      SQLITE_CALL_NODB(sqlite3_open_v2(
619          rootedPath.toNativeString(true).cStr(), &db, SQLITE_OPEN_READONLY, nullptr));
620    } else {
621      SQLITE_CALL_NODB(
622          sqlite3_open_v2(path.toString().cStr(), &db, SQLITE_OPEN_READONLY, vfs.getName().cStr()));
623    }
624  }
625 
626  KJ_ON_SCOPE_FAILURE(sqlite3_close_v2(db));
627 
628  setupSecurity(db);
629 
630  maybeDb = *db;
631}
632 
633SqliteDatabase::~SqliteDatabase() noexcept(false) {
634  sqlite3* db = &KJ_UNWRAP_OR(maybeDb, return);
635 
636  auto memoryScope = enterMemoryScope();
637 
638  auto err = sqlite3_close(db);
639  if (err == SQLITE_BUSY) {
640    KJ_LOG(ERROR, "sqlite database destroyed while dependent objects still exist");
641    // SQLite actually provides a lazy-close API which we might as well use here instead of leaking
642    // memory.
643    err = sqlite3_close_v2(db);
644  }
645 
646  KJ_REQUIRE(err == SQLITE_OK, sqlite3_errstr(err)) {
647    break;
648  }
649}
650 
651SqliteDatabase::operator sqlite3*() {
652  return &KJ_ASSERT_NONNULL(maybeDb, "previous reset() failed");
653}
654 
655SqliteMemoryScope SqliteDatabase::enterMemoryScope() {
656  return SqliteMemoryScope(sqliteMemoryBytes, sqliteMaxMemoryBytes);
657}
658 
659bool SqliteDatabase::observedCriticalError() {
660  return criticalErrorOccurred;
661}
662 
663void SqliteDatabase::notifyWrite(bool allowUnconfirmed) {
664  KJ_IF_SOME(cb, onWriteCallback) {
665    cb(allowUnconfirmed);
666  }
667}
668 
669void SqliteDatabase::handleCriticalError(kj::Maybe<int> errorCode,
670    kj::StringPtr errorMessage,
671    kj::Maybe<const kj::Exception&> maybeException) {
672  KJ_IF_SOME(code, errorCode) {
673    // Only errors listed in https://www.sqlite.org/lang_transaction.html#response_to_errors_within_a_transaction
674    // should be considered here as SQLITE auto rollbacks the transaction when we hit these errors
675    if (code == SQLITE_FULL || code == SQLITE_IOERR || code == SQLITE_NOMEM ||
676        code == SQLITE_INTERRUPT) {
677 
678      sqlite3* db = &KJ_ASSERT_NONNULL(maybeDb, "previous reset() failed");
679      // We are in a transaction
680      if (inTransaction || !savepoints.empty()) {
681        // The transaction was auto-rolledback, re-enabling the auto commit mode, so we should fail
682        if (sqlite3_get_autocommit(db) != 0) {
683          criticalErrorOccurred = true;
684          KJ_IF_SOME(cb, onCriticalErrorCallback) {
685            cb(errorMessage, maybeException.map([](const kj::Exception& e) { return e.clone(); }));
686          }
687        }
688      }
689    }
690  }
691}
692 
693kj::StringPtr SqliteDatabase::getCurrentQueryForDebug() {
694  KJ_IF_SOME(s, currentStatement) {
695    return sqlite3_normalized_sql(&s);
696  } else {
697    return "(no statement is running)";
698  }
699}
700 
701void SqliteDatabase::applyChange(const StateChange& change) {
702  KJ_SWITCH_ONEOF(change) {
703    KJ_CASE_ONEOF(none, NoChange) {
704      // Nothing.
705    }
706 
707    KJ_CASE_ONEOF(begin, BeginTxn) {
708      KJ_IF_SOME(name, begin.savepointName) {
709        savepoints.add(
710            Savepoint{.name = kj::str(name), .rollbackCallbackIndex = rollbackCallbacks.size()});
711      } else {
712        KJ_ASSERT(savepoints.empty(),
713            "BEGIN TRANSACTION should have failed when savepoints are present?");
714        KJ_ASSERT(
715            !inTransaction, "BEGIN TRANSACTION should have failed when already in a transaction?");
716        KJ_ASSERT(rollbackCallbacks.empty(),
717            "we shouldn't have been keeping rollback callbacks with no transaction open!");
718        inTransaction = true;
719      }
720    }
721 
722    KJ_CASE_ONEOF(commit, CommitTxn) {
723      KJ_IF_SOME(name, commit.savepointName) {
724        // According to https://www.sqlite.org/lang_savepoint.html, releasing a savepoint also
725        // releases all later savepoints. In theory it seems like savepoints shouldn't need to
726        // be LIFO like this, but the docs say they are!
727        for (;;) {
728          KJ_ASSERT(!savepoints.empty(), "released a savepoint that didn't exist?");
729          auto sp = kj::mv(savepoints.back());
730          savepoints.removeLast();
731          if (sp.name == name) break;
732        }
733      } else {
734        KJ_ASSERT(inTransaction, "COMMIT TRANSACTION without BEGIN TRANSACTION?");
735 
736        // Since BEGIN TRANSACTION cannot be nested within a savepoint, this must have released
737        // all savepoints implicitly.
738        savepoints.clear();
739        inTransaction = false;
740      }
741 
742      if (savepoints.empty() && !inTransaction) {
743        // Transaction stack is empty, so the transaction is committed. We can release the rollback
744        // callbacks.
745        rollbackCallbacks.clear();
746      }
747    }
748 
749    KJ_CASE_ONEOF(rollback, RollbackTxn) {
750      KJ_IF_SOME(name, rollback.savepointName) {
751        for (;;) {
752          KJ_ASSERT(!savepoints.empty(), "released a savepoint that didn't exist?");
753          if (savepoints.back().name == name) {
754            // Found the savepoint.
755            // Call all rollback callbacks later than the savepoint.
756            size_t index = savepoints.back().rollbackCallbackIndex;
757            KJ_ASSERT(rollbackCallbacks.size() >= index);
758            while (rollbackCallbacks.size() > index) {
759              rollbackCallbacks.back()();
760              rollbackCallbacks.removeLast();
761            }
762 
763            // NOTE: Rolling back to a savepoint does not actually release the savepoint. Hence
764            //   we save this savepoint as the last item in `savepoints`. It must be released
765            //   separately.
766            break;
767          }
768 
769          savepoints.removeLast();
770        }
771      } else {
772        KJ_ASSERT(inTransaction, "ROLLBACK TRANSACTION without BEGIN TRANSACTION?");
773 
774        savepoints.clear();
775        inTransaction = false;
776 
777        while (!rollbackCallbacks.empty()) {
778          rollbackCallbacks.back()();
779          rollbackCallbacks.removeLast();
780        }
781      }
782    }
783  }
784}
785 
786// Set up the regulator that will be used for authorizer callbacks while preparing this
787// statement.
788SqliteDatabase::StatementAndEffect SqliteDatabase::prepareSql(const Regulator& regulator,
789    kj::StringPtr sqlCode,
790    uint prepFlags,
791    Multi multi,
792    kj::Maybe<kj::Vector<Statement>&> prelude) {
793  sqlite3* db = &KJ_ASSERT_NONNULL(maybeDb, "previous reset() failed");
794 
795  ParseContext parseContext;
796  KJ_ASSERT(currentParseContext == kj::none, "recursive prepareSql()?");
797  KJ_DEFER(currentParseContext = kj::none);
798  currentParseContext = parseContext;
799 
800  KJ_ASSERT(currentRegulator == kj::none,
801      "can't prepare statements inside executeWithRegulator() callback");
802  KJ_DEFER(currentRegulator = kj::none);
803  currentRegulator = regulator;
804 
805  // If we fail, we need to discard any statements we added to the prelude, because the next time
806  // the statement runs they'll be parsed again and added again.
807  uint preludeInitialSize = 0;
808  KJ_IF_SOME(p, prelude) {
809    preludeInitialSize = p.size();
810  }
811  KJ_ON_SCOPE_FAILURE({
812    KJ_IF_SOME(p, prelude) {
813      while (p.size() > preludeInitialSize) {
814        p.removeLast();
815      }
816    } else {
817      // (else block needed to squelch spurious clang warning)
818    }
819  });
820 
821  auto memoryScope = enterMemoryScope();
822 
823  for (;;) {
824    sqlite3_stmt* result;
825    const char* tail;
826 
827    SQLITE_CALL_SCOPE {
828      auto prepareResult =
829          sqlite3_prepare_v3(db, sqlCode.begin(), sqlCode.size(), prepFlags, &result, &tail);
830 
831      // If we had an auth error specifically, check if we recorded a better error message during
832      // the authorizer callback.
833      if (prepareResult == SQLITE_AUTH) {
834        KJ_IF_SOME(error, parseContext.authError) {
835          // Throw the tailored auth error.
836          kj::throwFatalException(kj::mv(error));
837        }
838        // we don't have a better error, so fall back to SQLITE_CALL_FAILED below
839      }
840 
841      if (prepareResult != SQLITE_OK) {
842        SQLITE_CALL_FAILED("sqlite3_prepare_v3", prepareResult);
843      }
844    }
845 
846    SQLITE_REQUIRE(result != nullptr, kj::none, "SQL code did not contain a statement.", sqlCode);
847    auto ownResult = ownSqlite(result);
848 
849    while (*tail == ' ' || *tail == '\t' || *tail == '\n' || *tail == '\r' || *tail == '\v' ||
850        *tail == '\f')
851      ++tail;
852 
853    switch (multi) {
854      case SINGLE:
855        SQLITE_REQUIRE(tail == sqlCode.end(), kj::none,
856            "A prepared SQL statement must contain only one statement.", tail);
857        break;
858 
859      case MULTI:
860        if (tail != sqlCode.end()) {
861          // There are more statements after this one, so execute this statement now.
862 
863          SQLITE_REQUIRE(sqlite3_bind_parameter_count(result) == 0, kj::none,
864              "When executing multiple SQL statements in a single call, only the last statement "
865              "can have parameters.");
866 
867          // Be sure to call the onWrite callback if necessary for this statement.
868          KJ_IF_SOME(cb, onWriteCallback) {
869            if (!sqlite3_stmt_readonly(result)) {
870              // The callback is allowed to invoke queries of its own, so we have to un-set the
871              // regulator and parse context while we call it.
872              currentRegulator = kj::none;
873              KJ_DEFER(currentRegulator = regulator);
874              currentParseContext = kj::none;
875              KJ_DEFER(currentParseContext = parseContext);
876              cb(false);  // prepareSql doesn't have access to allowUnconfirmed, use safe default
877            }
878          }
879 
880          // This isn't the last statement in the code. Execute it immediately.
881          SQLITE_CALL_SCOPE {
882            auto start = sqliteObserver.now();
883            auto dbWalSizeBefore = sqliteObserver.getDbWalSize();
884 
885            int err = sqlite3_step(result);
886            int extendedCode = sqlite3_extended_errcode(db);
887 
888            kj::Duration queryLatency = sqliteObserver.now() - start;
889            auto dbWalBytesWritten = sqliteObserver.getDbWalSize() - dbWalSizeBefore;
890            auto rowsRead = sqlite3_stmt_status(result, LIBSQL_STMTSTATUS_ROWS_READ, 0);
891            auto rowsWritten = sqlite3_stmt_status(result, LIBSQL_STMTSTATUS_ROWS_WRITTEN, 0);
892 
893            kj::Maybe<kj::String> queryStatement;
894            kj::Maybe<kj::String> queryErrorDescription;
895            try {
896              kj::StringPtr statement = sqlite3_sql(result);
897              queryStatement = kj::heapString(
898                  statement.slice(0, kj::min(statement.size(), RA_MAX_METRICS_QUERY_SIZE)));
899            } catch (kj::Exception& e) {
900              kj::StringPtr errorDescription = e.getDescription();
901              queryErrorDescription = kj::heapString(errorDescription.slice(
902                  0, kj::min(RA_MAX_METRICS_QUERY_SIZE, errorDescription.size())));
903            }
904 
905            // Report queryEvent for this statement
906            sqliteObserver.reportQueryEvent(kj::mv(queryStatement), rowsRead, rowsWritten,
907                queryLatency, dbWalBytesWritten, err, extendedCode, regulator.shouldAddQueryStats(),
908                kj::mv(queryErrorDescription));
909 
910            if (err == SQLITE_DONE) {
911              // good
912            } else if (err == SQLITE_ROW) {
913              // Intermediate statement returned results. We will discard.
914            } else {
915              SQLITE_CALL_FAILED("sqlite3_step()", err);
916            }
917          }
918 
919          // Apply any state changes from executing the statement.
920          applyChange(parseContext.stateChange);
921 
922          KJ_IF_SOME(p, prelude) {
923            p.add(Statement(*this, regulator,
924                StatementAndEffect{.statement = kj::mv(ownResult),
925                  .stateChange = kj::mv(parseContext.stateChange)}));
926          }
927 
928          // Reset parse context for next statement.
929          parseContext = {};
930 
931          // Reduce `sqlCode` to include only what we haven't already executed.
932          sqlCode = kj::StringPtr(tail, sqlCode.end());
933 
934          continue;
935        }
936        break;
937    }
938 
939    return {.statement = kj::mv(ownResult), .stateChange = kj::mv(parseContext.stateChange)};
940  }
941}
942 
943SqliteDatabase::IngestResult SqliteDatabase::ingestSql(
944    const Regulator& regulator, kj::StringPtr sqlCode) {
945  uint64_t rowsRead = 0;
946  uint64_t rowsWritten = 0;
947  uint64_t statementCount = 0;
948 
949  // While there's still some input SQL to process
950  while (sqlCode.begin() != sqlCode.end()) {
951    // And there are still valid statements:
952    auto statementLength = sqlite3_complete_length(sqlCode.begin(), 1);
953    if (!statementLength) break;
954 
955    // Slice off the next valid statement SQL
956    auto nextStatement = kj::str(sqlCode.first(statementLength));
957    // Create a Query object, which will prepare & execute it
958    auto q = Query(*this, QueryOptions{.regulator = regulator}, nextStatement);
959 
960    rowsRead += q.getRowsRead();
961    rowsWritten += q.getRowsWritten();
962    statementCount++;
963    sqlCode = sqlCode.slice(statementLength);
964  }
965 
966  // Return the leftover buffer
967  return {.remainder = sqlCode,
968    .rowsRead = rowsRead,
969    .rowsWritten = rowsWritten,
970    .statementCount = statementCount};
971}
972 
973void SqliteDatabase::executeWithRegulator(
974    const Regulator& regulator, kj::FunctionParam<void()> func) {
975  // currentRegulator would only be set if we're running this method while running something else
976  // with a regulator.  I'm not sure what the ramifications are, so for now, we'll just assume that
977  // we can only call executeWithRegulator when no regulator is currently set.
978  KJ_REQUIRE(currentRegulator == kj::none);
979 
980  currentRegulator = regulator;
981  KJ_DEFER(currentRegulator = kj::none);
982 
983  auto memoryScope = enterMemoryScope();
984  func();
985}
986 
987void SqliteDatabase::reset() {
988  KJ_REQUIRE(!readOnly, "can't reset() read-only database");
989 
990  // If transactions are open during reset(), whatever had the transaction open is going to get
991  // confused at best, or lose data at worst. Let's just not allow this.
992  KJ_REQUIRE(!inTransaction && savepoints.empty(), "can't reset() a database during a transaction");
993 
994  auto memoryScope = enterMemoryScope();
995 
996  // Temporarily disable the on-write callback while resetting.
997  auto writeCb = kj::mv(onWriteCallback);
998  KJ_DEFER(onWriteCallback = kj::mv(writeCb));
999 
1000  KJ_IF_SOME(db, maybeDb) {
1001    for (auto& listener: resetListeners) {
1002      listener.beforeSqliteReset();
1003    }
1004 
1005    auto err = sqlite3_close(&db);
1006    KJ_REQUIRE(err == SQLITE_OK, "can't reset() database because dependent objects still exist",
1007        sqlite3_errstr(err));
1008 
1009    maybeDb = kj::none;
1010    vfs.directory.remove(path);
1011  }
1012 
1013  KJ_ON_SCOPE_FAILURE(maybeDb = kj::none);
1014  init(kj::WriteMode::CREATE | kj::WriteMode::MODIFY);
1015 
1016  KJ_IF_SOME(resetCb, afterResetCallback) {
1017    resetCb(*this);
1018  }
1019}
1020 
1021bool SqliteDatabase::isAuthorized(int actionCode,
1022    kj::Maybe<kj::StringPtr> param1,
1023    kj::Maybe<kj::StringPtr> param2,
1024    kj::Maybe<kj::StringPtr> dbName,
1025    kj::Maybe<kj::StringPtr> triggerName) {
1026  const Regulator& regulator = KJ_UNWRAP_OR(currentRegulator, {
1027    // We're not currently preparing a statement, so we didn't expect the authorizer callback to
1028    // run. We blanket-deny in this case as a precaution.
1029    KJ_LOG(ERROR, "SQLite authorizer callback invoked at unexpected time", kj::getStackTrace());
1030    return false;
1031  });
1032 
1033  KJ_IF_SOME(t, triggerName) {
1034    if (!regulator.isAllowedTrigger(t)) {
1035      // Log an error because it seems really suspicious if a trigger runs when it's not allowed.
1036      // I want to understand if this can even happen.
1037      KJ_LOG(ERROR, "disallowed trigger somehow ran in trusted scope?", t, kj::getStackTrace());
1038 
1039      // TODO(security): Is it better to return SQLITE_IGNORE to ignore the trigger? I don't fully
1040      //   understand the implications of SQLITE_IGNORE. The documentation mentions that in the
1041      //   case of SQLITE_DELETE, it doesn't actually ignore the delete, which is weird. Hopefully
1042      //   it's impossible for people to register a trigger on protected tables in the first place,
1043      //   so triggers will never run.
1044      return false;
1045    }
1046  }
1047 
1048  // For some reason, for these two operations, SQLite sends the DB Name through as param1, with
1049  // the table name (for ALTER_TABLE) in param2 instead of param1 like all other table operations.
1050  // For simplicity, and because the following comment precedes sqlite3_set_authorizer in sqlite.h:
1051  //
1052  //     > The 5th parameter to the authorizer callback is the name of the database
1053  //     > ("main", "temp", etc.) if applicable.
1054  //
1055  // we are treating this as an SQLite bug and swapping the values around.
1056  if (actionCode == SQLITE_ALTER_TABLE || actionCode == SQLITE_DETACH) {
1057    auto swap = param1;  // contains dbName
1058    param1 = param2;     // contains table name (for SQLITE_ALTER_TABLE, null otherwise)
1059    param2 = dbName;     // should always be null
1060    dbName = swap;
1061  }
1062 
1063  KJ_IF_SOME(d, dbName) {
1064    if (d == "temp"_kj) {
1065      return isAuthorizedTemp(actionCode, param1, param2, regulator);
1066    } else if (d != "main"_kj) {
1067      // We don't allow opening multiple databases (except for 'main' and the 'temp'
1068      // temporary database), as our storage engine is not designed to track multiple
1069      // files on-disk.
1070      return false;
1071    }
1072  }
1073 
1074  if (&regulator == &TRUSTED && actionCode != SQLITE_TRANSACTION &&
1075      actionCode != SQLITE_SAVEPOINT) {
1076    // Everything is allowed for trusted queries. (But transactions and savepoints need special
1077    // handling below.)
1078    return true;
1079  }
1080 
1081  switch (actionCode) {
1082      // ---------------------------------------------------------------
1083      // Stuff that is (sometimes) allowed
1084 
1085    case SQLITE_SELECT: /* NULL            NULL            */
1086      // Yes, SELECT statements are allowed. (Note that if the SELECT names any tables, a separate
1087      // SQLITE_READ will be authorized for each one.)
1088      KJ_ASSERT(param1 == kj::none);
1089      KJ_ASSERT(param2 == kj::none);
1090      return true;
1091 
1092    case SQLITE_CREATE_TABLE: /* Table Name      NULL            */
1093    case SQLITE_DELETE:       /* Table Name      NULL            */
1094    case SQLITE_DROP_TABLE:   /* Table Name      NULL            */
1095    case SQLITE_INSERT:       /* Table Name      NULL            */
1096    case SQLITE_CREATE_VIEW:  /* View Name       NULL            */
1097    case SQLITE_DROP_VIEW:    /* View Name       NULL            */
1098    case SQLITE_REINDEX:      /* Index Name      NULL            */
1099      KJ_ASSERT(param2 == kj::none);
1100      return regulator.isAllowedName(KJ_ASSERT_NONNULL(param1));
1101 
1102    case SQLITE_ANALYZE: /* Table Name      NULL            */
1103      KJ_ASSERT(param2 == kj::none);
1104      // We allow all names (including names where isAllowedName() would return false) because
1105      // `PRAGMA optimize` issues an ANALYZE statement with no arguments and a SQLite ANALYZE
1106      // statement with no parameters will analyze all tables, including otherwise restricted
1107      // tables.
1108      //
1109      // The ANALYZE statement records information about the distribution of rows in each index in
1110      // the database in a special sqlite_stat1 table.  While the sqlite_stat1 table leaks metadata
1111      // about restricted tables (like the names of indices and the sizes of those tables), the
1112      // sqlite_stat1 does not contain data from the restricted tables.  As such, it's OK to allow
1113      // users to ANALYZE restricted tables.
1114      //
1115      // Note that users can *modify* the sqlite_stat1 table, which means that they can make the
1116      // query planner work in suboptimal ways by writing bogus data to the table.
1117      //
1118      // See https://www.sqlite.org/fileformat2.html#stat1tab for more details.
1119      return true;
1120 
1121    case SQLITE_ALTER_TABLE: /* Table Name      NULL (modified) */
1122      return regulator.isAllowedName(KJ_ASSERT_NONNULL(param1));
1123 
1124    case SQLITE_READ:   /* Table Name      Column Name     */
1125    case SQLITE_UPDATE: /* Table Name      Column Name     */
1126      return regulator.isAllowedName(KJ_ASSERT_NONNULL(param1));
1127 
1128    case SQLITE_CREATE_INDEX:   /* Index Name      Table Name      */
1129    case SQLITE_DROP_INDEX:     /* Index Name      Table Name      */
1130    case SQLITE_CREATE_TRIGGER: /* Trigger Name    Table Name      */
1131    case SQLITE_DROP_TRIGGER:   /* Trigger Name    Table Name      */
1132      return regulator.isAllowedName(KJ_ASSERT_NONNULL(param1)) &&
1133          regulator.isAllowedName(KJ_ASSERT_NONNULL(param2));
1134 
1135    case SQLITE_TRANSACTION: /* Operation       NULL            */
1136    {
1137      if (!regulator.allowTransactions()) {
1138        return false;
1139      }
1140 
1141      kj::StringPtr op = KJ_ASSERT_NONNULL(param1);
1142      StateChange change;
1143      if (op == "BEGIN") {
1144        change = BeginTxn{kj::none};
1145      } else if (op == "COMMIT") {
1146        change = CommitTxn{kj::none};
1147      } else if (op == "ROLLBACK") {
1148        change = RollbackTxn{kj::none};
1149      } else {
1150        KJ_FAIL_ASSERT("unknown SQLITE_TRANSACTION op", op);
1151      }
1152      KJ_IF_SOME(ctx, currentParseContext) {
1153        ctx.stateChange = kj::mv(change);
1154      }
1155 
1156      KJ_ASSERT(param2 == kj::none);
1157      return true;
1158    }
1159 
1160    case SQLITE_SAVEPOINT: /* Operation       Savepoint Name  */
1161    {
1162      kj::String name = kj::str(KJ_ASSERT_NONNULL(param2));
1163      if (!regulator.allowTransactions() || !regulator.isAllowedName(name)) {
1164        return false;
1165      }
1166 
1167      kj::StringPtr op = KJ_ASSERT_NONNULL(param1);
1168      StateChange change;
1169      if (op == "BEGIN") {
1170        change = BeginTxn{kj::mv(name)};
1171      } else if (op == "RELEASE") {
1172        change = CommitTxn{kj::mv(name)};
1173      } else if (op == "ROLLBACK") {
1174        change = RollbackTxn{kj::mv(name)};
1175      } else {
1176        KJ_FAIL_ASSERT("unknown SQLITE_TRANSACTION op", op);
1177      }
1178      KJ_IF_SOME(ctx, currentParseContext) {
1179        ctx.stateChange = kj::mv(change);
1180      }
1181 
1182      return true;
1183    }
1184 
1185    case SQLITE_PRAGMA: /* Pragma Name     1st arg or NULL */
1186      // We currently only permit a few pragmas.
1187      {
1188        kj::StringPtr pragma = KJ_ASSERT_NONNULL(param1);
1189 
1190        if (pragma == "table_list") {
1191          // Annoyingly, this will list internal tables. However, the existence of these tables
1192          // isn't really a secret, we just don't want people to access them.
1193          return true;
1194          // TODO function_list & pragma_list should be authorized but return
1195          // ALLOWED_SQLITE_FUNCTIONS & ALLOWED_[READ|WRITE]_PRAGMAS
1196          // respectively
1197        } else if (pragma == "table_info" || pragma == "table_xinfo") {
1198          // Allow if the specific named table is not protected.
1199          KJ_IF_SOME(name, param2) {
1200            return regulator.isAllowedName(name);
1201          } else {
1202            return false;  // shouldn't happen?
1203          }
1204        }
1205 
1206        static const kj::HashMap<kj::StringPtr, PragmaSignature> allowedPragmas = []() {
1207          kj::HashMap<kj::StringPtr, PragmaSignature> result;
1208          for (auto& [name, signature]: ALLOWED_PRAGMAS) {
1209            result.insert(name, signature);
1210          }
1211          return result;
1212        }();
1213 
1214        PragmaSignature sig = KJ_UNWRAP_OR(allowedPragmas.find(pragma), return false);
1215        switch (sig) {
1216          case PragmaSignature::NO_ARG:
1217            return param2 == kj::none;
1218          case PragmaSignature::BOOLEAN: {
1219            // We allow omitting the argument in order to read back the current value.
1220            auto val = KJ_UNWRAP_OR(param2, return true).asArray();
1221 
1222            // SQLite offers many different ways to express booleans...
1223 
1224            // They can be quoted. Remove quotes if present.
1225            if (val.size() >= 2 && (val.front() == '\'' || val.front() == '\"') &&
1226                val.back() == val.front()) {
1227              val = val.slice(1, val.size() - 1);
1228            }
1229 
1230            // Compare against every possible representation. Case-insensitive!
1231            return strncasecmp(val.begin(), "true", 4) == 0 ||
1232                strncasecmp(val.begin(), "false", 5) == 0 ||
1233                strncasecmp(val.begin(), "yes", 3) == 0 || strncasecmp(val.begin(), "no", 2) == 0 ||
1234                strncasecmp(val.begin(), "on", 2) == 0 || strncasecmp(val.begin(), "off", 3) == 0 ||
1235                strncasecmp(val.begin(), "1", 1) == 0 || strncasecmp(val.begin(), "0", 1) == 0;
1236          }
1237          case PragmaSignature::OBJECT_NAME: {
1238            // Argument is required.
1239            auto val = KJ_UNWRAP_OR(param2, return false);
1240            return regulator.isAllowedName(val);
1241          }
1242          case PragmaSignature::OPTIONAL_OBJECT_NAME: {
1243            auto val = KJ_UNWRAP_OR(param2, return true);
1244            return regulator.isAllowedName(val);
1245          }
1246          case PragmaSignature::NULL_OR_NUMBER: {
1247            // Argument is not required
1248            auto val = KJ_UNWRAP_OR(param2, return true);
1249            // val is allowed if it parses to an integer
1250            return val.tryParseAs<int32_t>() != kj::none;
1251          }
1252          case PragmaSignature::NULL_NUMBER_OR_OBJECT_NAME: {
1253            // Argument is not required
1254            auto val = KJ_UNWRAP_OR(param2, return true);
1255            // val is allowed if it parses to an integer
1256            if (val.tryParseAs<uint>() != kj::none) return true;
1257            // Otherwise, val must be the name of an object the user has access to
1258            return regulator.isAllowedName(val);
1259          }
1260        }
1261        KJ_UNREACHABLE;
1262      }
1263 
1264      return false;
1265 
1266    case SQLITE_FUNCTION: /* NULL            Function Name   */
1267    {
1268      static const kj::HashSet<kj::StringPtr> allowSet = []() {
1269        kj::HashSet<kj::StringPtr> result;
1270        for (const kj::StringPtr& func: ALLOWED_SQLITE_FUNCTIONS) {
1271          result.insert(func);
1272        }
1273        return result;
1274      }();
1275      return allowSet.contains(KJ_ASSERT_NONNULL(param2));
1276    }
1277 
1278      // ---------------------------------------------------------------
1279      // Stuff that is never allowed
1280 
1281    case SQLITE_CREATE_VTABLE: /* Table Name      Module Name     */
1282    case SQLITE_DROP_VTABLE:   /* Table Name      Module Name     */
1283      // Virtual tables are tables backed by some native-code callbacks.
1284      // We don't support these except for FTS5 (Full Text Search) https://www.sqlite.org/fts5.html
1285      // (Which also includes fts5vocab: "[fts5vocab] is available whenever FTS5 is")
1286      {
1287        KJ_IF_SOME(moduleName, param2) {
1288          if (strcasecmp(moduleName.begin(), "fts5") == 0 ||
1289              strcasecmp(moduleName.begin(), "fts5vocab") == 0) {
1290            if (util::Autogate::isEnabled(util::AutogateKey::SQL_RESTRICT_RESERVED_NAMES)) {
1291              return regulator.isAllowedName(KJ_ASSERT_NONNULL(param1));
1292            }
1293            auto& tableName = KJ_ASSERT_NONNULL(param1);
1294            if (tableName.size() >= 4 && strncasecmp(tableName.begin(), "_cf_", 4) == 0) {
1295              LOG_WARNING_PERIODICALLY("FTS5 virtual table uses reserved _cf_ prefix");
1296            }
1297            return true;
1298          }
1299        }
1300        return false;
1301      }
1302 
1303    case SQLITE_ATTACH: /* Filename        NULL            */
1304    case SQLITE_DETACH: /* Table Name      NULL (modified) */
1305      // We do not support attached databases. It seems unlikely that we ever will.
1306      return false;
1307 
1308    case SQLITE_CREATE_TEMP_TABLE:   /* Table Name      NULL            */
1309    case SQLITE_DROP_TEMP_TABLE:     /* Table Name      NULL            */
1310    case SQLITE_CREATE_TEMP_INDEX:   /* Index Name      Table Name      */
1311    case SQLITE_DROP_TEMP_INDEX:     /* Index Name      Table Name      */
1312    case SQLITE_CREATE_TEMP_TRIGGER: /* Trigger Name    Table Name      */
1313    case SQLITE_DROP_TEMP_TRIGGER:   /* Trigger Name    Table Name      */
1314    case SQLITE_CREATE_TEMP_VIEW:    /* View Name       NULL            */
1315    case SQLITE_DROP_TEMP_VIEW:      /* View Name       NULL            */
1316      // TODO(someday): Allow temporary tables. Creating a temporary table actually causes
1317      //   SQLite to open a separate temporary file to place the data in. Currently, our storage
1318      //   engine has no support for this.
1319      return false;
1320 
1321    case SQLITE_RECURSIVE: /* NULL            NULL            */
1322      // Recursive select, this is fine.
1323      return true;
1324 
1325    case SQLITE_COPY: /* No longer used */
1326      // These are operations we simply don't support today.
1327      return false;
1328 
1329    default:
1330      KJ_LOG(WARNING, "unknown SQLite action", actionCode);
1331      return false;
1332  }
1333}
1334 
1335// Temp databases have very restricted operations
1336bool SqliteDatabase::isAuthorizedTemp(int actionCode,
1337    const kj::Maybe<kj::StringPtr>& param1,
1338    const kj::Maybe<kj::StringPtr>& param2,
1339    const Regulator& regulator) {
1340 
1341  switch (actionCode) {
1342    case SQLITE_READ:   /* Table Name      Column Name     */
1343    case SQLITE_UPDATE: /* Table Name      Column Name     */
1344      return regulator.isAllowedName(KJ_ASSERT_NONNULL(param1));
1345    default:
1346      return false;
1347  }
1348}
1349 
1350// Set up security restrictions.
1351// See: https://www.sqlite.org/security.html
1352void SqliteDatabase::setupSecurity(sqlite3* db) {
1353  // 1. Set defensive mode.
1354  SQLITE_CALL_NODB(sqlite3_db_config(db, SQLITE_DBCONFIG_DEFENSIVE, 1, nullptr));
1355 
1356  // 2. Reduce limits
1357  // We use the suggested limits from the web site. Note that sqlite3_limit() does NOT return an
1358  // error code; it returns the old limit.
1359 
1360  // This limit is set higher than what is suggested on sqlite.org/security.html
1361  // because we want to allow storing values of 1MiB, and we added some extra
1362  // padding on top of that
1363  sqlite3_limit(db, SQLITE_LIMIT_LENGTH, 2200000);
1364  sqlite3_limit(db, SQLITE_LIMIT_SQL_LENGTH, 100000);
1365  sqlite3_limit(db, SQLITE_LIMIT_COLUMN, 100);
1366  sqlite3_limit(db, SQLITE_LIMIT_EXPR_DEPTH, 100);
1367  // Enforces limits on UNION/UNION ALL/INTERSECT/etc
1368  // https://www.sqlite.org/limits.html#max_compound_select
1369  sqlite3_limit(db, SQLITE_LIMIT_COMPOUND_SELECT, 5);
1370  sqlite3_limit(db, SQLITE_LIMIT_VDBE_OP, 25000);
1371  // For SQLITE_LIMIT_FUNCTION_ARG we use the default instead of the "security" recommendation
1372  // because there are too many valid use cases for large argument lists, especially json_object.
1373  sqlite3_limit(db, SQLITE_LIMIT_FUNCTION_ARG, 127);
1374  sqlite3_limit(db, SQLITE_LIMIT_ATTACHED, 0);
1375  sqlite3_limit(db, SQLITE_LIMIT_LIKE_PATTERN_LENGTH, 50);
1376  sqlite3_limit(db, SQLITE_LIMIT_VARIABLE_NUMBER, 100);
1377  sqlite3_limit(db, SQLITE_LIMIT_TRIGGER_DEPTH, 10);
1378  sqlite3_limit(db, SQLITE_LIMIT_WORKER_THREADS, 0);
1379 
1380  // 3. Setup authorizer.
1381  SQLITE_CALL_NODB(sqlite3_set_authorizer(db,
1382      [](void* userdata, int actionCode, const char* param1, const char* param2, const char* dbName,
1383          const char* triggerName) {
1384    try {
1385      return reinterpret_cast<SqliteDatabase*>(userdata)->isAuthorized(actionCode,
1386                 toMaybeString(param1), toMaybeString(param2), toMaybeString(dbName),
1387                 toMaybeString(triggerName))
1388          ? SQLITE_OK
1389          : SQLITE_DENY;
1390    } catch (kj::Exception& e) {
1391      // We'll crash if we throw to SQLite. Instead, shove the error into the parse context and
1392      // report authorization denied. We'll pull it back out later.
1393      KJ_IF_SOME(context, reinterpret_cast<SqliteDatabase*>(userdata)->currentParseContext) {
1394        context.authError = kj::mv(e);
1395      } else {
1396        KJ_LOG(ERROR, e);
1397      }
1398      return SQLITE_DENY;
1399    }
1400  },
1401      this));
1402 
1403  // 4. Set a progress handler or use interrupt() to limit CPU time.
1404  // This happens inside LimitEnforcer.
1405 
1406  // 5. Limit process-wide heap size.
1407  // Set a 128MB "soft" limit so that SQLite will purge the page cache when per-process memory
1408  // consumption exceeds this value, and an 8 GiB "hard" limit as a defense in depth mechanism to
1409  // prevent SQLite from consuming too much per-process memory. The primary mechanism for limiting
1410  // SQLite memory consumption is the metering done in the sqlite-metering module.
1411  static bool doOnce KJ_UNUSED = []() {
1412    sqlite3_soft_heap_limit64(128u << 20);
1413    sqlite3_hard_heap_limit64(
1414        util::Autogate::isEnabled(util::AutogateKey::INCREASE_SQLITE_HARD_HEAP_LIMIT)
1415            ? (8ull << 30)    // 8 GiB
1416            : (512u << 20));  // 512 MiB
1417    return false;
1418  }();
1419 
1420  // 6. Set SQLITE_MAX_ALLOCATION_SIZE compile flag.
1421  // (handled in BUILD.sqlite3)
1422 
1423  // 7. Consider giving SQLite a fixed heap space.
1424  // This is suggested mainly for embedded systems. It involves giving SQLite a fixed preallocated
1425  // heap space which the library restricts itself to instead of using malloc. We probably don't
1426  // want this.
1427 
1428  // 8. Set the SQLITE_PRINTF_PRECISION_LIMIT compile flag.
1429  // (handled in BUILD.sqlite3)
1430}
1431 
1432SqliteDatabase::Statement SqliteDatabase::prepare(
1433    const Regulator& regulator, kj::StringPtr sqlCode) {
1434  return Statement(
1435      *this, regulator, prepareSql(regulator, sqlCode, SQLITE_PREPARE_PERSISTENT, SINGLE));
1436}
1437 
1438SqliteDatabase::StatementAndEffect& SqliteDatabase::Statement::prepareForExecution() {
1439  for (auto& stmt: prelude) {
1440    stmt.run();
1441  }
1442 
1443  KJ_IF_SOME(sqlCode, stmt.tryGet<kj::String>()) {
1444    // Database was reset. Recompile the statement against the new database. (This could throw,
1445    // of course, if the statement depends on tables that haven't been recreated yet.)
1446    //
1447    // We use the MULTI flag here in case this Statement was created by prepareMulti(). If multiple
1448    // statements are parsed, they'll be added to our `prelude`, and also executed immediately.
1449    stmt = db.prepareSql(regulator, sqlCode, SQLITE_PREPARE_PERSISTENT, MULTI, prelude);
1450  }
1451 
1452  return KJ_ASSERT_NONNULL(stmt.tryGet<StatementAndEffect>());
1453}
1454 
1455void SqliteDatabase::Statement::beforeSqliteReset() {
1456  KJ_IF_SOME(prepared, stmt.tryGet<StatementAndEffect>()) {
1457    // Pull the original SQL code out of the statement and store it.
1458    stmt = kj::str(sqlite3_sql(prepared.statement));
1459  }
1460}
1461 
1462SqliteDatabase::Statement::~Statement() noexcept(false) {
1463  // Install memory scope for sqlite3_finalize called when stmt (containing StatementAndEffect
1464  // with kj::Own<sqlite3_stmt>) is destroyed. Also covers prelude destruction.
1465  auto memoryScope = db.enterMemoryScope();
1466  auto stmtToDestroy = kj::mv(stmt);
1467  auto preludeToDestroy = kj::mv(prelude);
1468}
1469 
1470SqliteDatabase::Query::Query(SqliteDatabase& db,
1471    QueryOptions options,
1472    Statement& statement,
1473    kj::ArrayPtr<const ValuePtr> bindings)
1474    : ResetListener(db),
1475      regulator(options.regulator),
1476      maybeStatement(statement.prepareForExecution()),
1477      queryEvent(this->db.sqliteObserver) {
1478  // If we throw from the constructor, the destructor won't run. Need to call destroy() explicitly.
1479  KJ_ON_SCOPE_FAILURE(destroy());
1480  init(bindings);
1481}
1482 
1483SqliteDatabase::Query::Query(SqliteDatabase& db,
1484    QueryOptions options,
1485    kj::StringPtr sqlCode,
1486    kj::ArrayPtr<const ValuePtr> bindings)
1487    : ResetListener(db),
1488      regulator(options.regulator),
1489      ownStatement(db.prepareSql(regulator, sqlCode, 0, MULTI)),
1490      maybeStatement(ownStatement),
1491      queryEvent(this->db.sqliteObserver) {
1492  // If we throw from the constructor, the destructor won't run. Need to call destroy() explicitly.
1493  KJ_ON_SCOPE_FAILURE(destroy());
1494  init(bindings);
1495}
1496 
1497SqliteDatabase::Query::~Query() noexcept(false) {
1498  destroy();
1499}
1500 
1501void SqliteDatabase::Query::destroy() {
1502  // Install memory scope for sqlite3_reset, sqlite3_clear_bindings, and sqlite3_finalize (via
1503  // ownStatement destruction). The scope is idempotent, so this is safe even if a scope is already
1504  // active from the caller.
1505  auto memoryScope = db.enterMemoryScope();
1506 
1507  if (regulator.shouldAddQueryStats()) {
1508    // Update the db stats that we have collected for the query.
1509    db.sqliteObserver.addQueryStats(rowsRead, rowsWritten);
1510  }
1511 
1512  queryEvent.setQueryEventStats(rowsRead, rowsWritten, !(regulator.shouldAddQueryStats()));
1513 
1514  try {
1515    kj::StringPtr statement = sqlite3_sql(getStatementAndEffect().statement);
1516    queryEvent.setQueryStatement(
1517        kj::heapString(statement.slice(0, kj::min(statement.size(), RA_MAX_METRICS_QUERY_SIZE))));
1518  } catch (kj::Exception& e) {
1519    kj::StringPtr errorDescription = e.getDescription();
1520    queryEvent.setQueryErrorDescription(kj::heapString(
1521        errorDescription.slice(0, kj::min(RA_MAX_METRICS_QUERY_SIZE, errorDescription.size()))));
1522  }
1523 
1524  // Move ownStatement to a local variable so that it goes out of scope while memoryScope is still
1525  // active. ownStatement is used by getStatementAndEffect(), so we cannot move it until this
1526  // point.
1527  auto ownStatementToDestroy = kj::mv(ownStatement);
1528 
1529  // We only need to reset the statement if we don't own it. If we own it, it's about to be
1530  // destroyed anyway.
1531  if (ownStatementToDestroy.statement.get() == nullptr) {
1532    KJ_IF_SOME(statement, maybeStatement) {
1533      // The error code returned by sqlite3_reset() actually represents the last error encountered
1534      // when stepping the statement. This doesn't mean that the reset failed.
1535      sqlite3_reset(statement.statement);
1536 
1537      // sqlite3_clear_bindings() returns int, but there is no documentation on how the return code
1538      // should be interpreted, so we ignore it.
1539      sqlite3_clear_bindings(statement.statement);
1540 
1541      // Reset the rows read/written counters.
1542      sqlite3_stmt_status(statement.statement, LIBSQL_STMTSTATUS_ROWS_READ, 1);
1543      sqlite3_stmt_status(statement.statement, LIBSQL_STMTSTATUS_ROWS_WRITTEN, 1);
1544    }
1545  }
1546}
1547 
1548void SqliteDatabase::Query::checkRequirements(size_t size) {
1549  if (regulator.shouldAddQueryStats()) {
1550    KJ_IF_SOME(actorAccountLimits, db.actorAccountLimits) {
1551      actorAccountLimits.requireActorCanExecuteQueries();
1552    }
1553  }
1554 
1555  sqlite3_stmt* statement = getStatement();
1556 
1557  SQLITE_REQUIRE(!sqlite3_stmt_busy(statement), kj::none,
1558      "A SQL prepared statement can only be executed once at a time.");
1559  SQLITE_REQUIRE(size == sqlite3_bind_parameter_count(statement), kj::none,
1560      "Wrong number of parameter bindings for SQL query.");
1561 
1562  KJ_IF_SOME(cb, db.onWriteCallback) {
1563    if (!sqlite3_stmt_readonly(statement)) {
1564      cb(allowUnconfirmed);
1565    }
1566  }
1567}
1568 
1569void SqliteDatabase::Query::init(kj::ArrayPtr<const ValuePtr> bindings) {
1570  checkRequirements(bindings.size());
1571 
1572  for (auto i: kj::indices(bindings)) {
1573    bind(i, bindings[i]);
1574  }
1575 
1576  nextRow(/*first=*/true);
1577}
1578 
1579void SqliteDatabase::Query::bind(uint i, ValuePtr value) {
1580  sqlite3_stmt* statement = getStatement();
1581 
1582  KJ_SWITCH_ONEOF(value) {
1583    KJ_CASE_ONEOF(blob, kj::ArrayPtr<const byte>) {
1584      SQLITE_CALL(sqlite3_bind_blob(statement, i + 1, blob.begin(), blob.size(), SQLITE_STATIC));
1585    }
1586    KJ_CASE_ONEOF(text, kj::StringPtr) {
1587      SQLITE_CALL(sqlite3_bind_text(statement, i + 1, text.begin(), text.size(), SQLITE_STATIC));
1588    }
1589    KJ_CASE_ONEOF(n, int64_t) {
1590      SQLITE_CALL(sqlite3_bind_int64(statement, i + 1, static_cast<long long>(n)));
1591    }
1592    KJ_CASE_ONEOF(x, double) {
1593      SQLITE_CALL(sqlite3_bind_double(statement, i + 1, x));
1594    }
1595    KJ_CASE_ONEOF(_, decltype(nullptr)) {
1596      SQLITE_CALL(sqlite3_bind_null(statement, i + 1));
1597    }
1598  }
1599}
1600 
1601uint64_t SqliteDatabase::Query::getRowsRead() {
1602  sqlite3_stmt* statement = getStatement();
1603  KJ_REQUIRE(statement != nullptr);
1604  return sqlite3_stmt_status(statement, LIBSQL_STMTSTATUS_ROWS_READ, 0);
1605}
1606 
1607uint64_t SqliteDatabase::Query::getRowsWritten() {
1608  sqlite3_stmt* statement = getStatement();
1609  return sqlite3_stmt_status(statement, LIBSQL_STMTSTATUS_ROWS_WRITTEN, 0);
1610}
1611 
1612void SqliteDatabase::Query::bind(uint i, kj::ArrayPtr<const byte> value) {
1613  auto memoryScope = db.enterMemoryScope();
1614  sqlite3_stmt* statement = getStatement();
1615  SQLITE_CALL(sqlite3_bind_blob(statement, i + 1, value.begin(), value.size(), SQLITE_STATIC));
1616}
1617 
1618void SqliteDatabase::Query::bind(uint i, kj::StringPtr value) {
1619  auto memoryScope = db.enterMemoryScope();
1620  sqlite3_stmt* statement = getStatement();
1621  SQLITE_CALL(sqlite3_bind_text(statement, i + 1, value.begin(), value.size(), SQLITE_STATIC));
1622}
1623 
1624void SqliteDatabase::Query::bind(uint i, long long value) {
1625  auto memoryScope = db.enterMemoryScope();
1626  sqlite3_stmt* statement = getStatement();
1627  SQLITE_CALL(sqlite3_bind_int64(statement, i + 1, value));
1628}
1629 
1630void SqliteDatabase::Query::bind(uint i, double value) {
1631  auto memoryScope = db.enterMemoryScope();
1632  sqlite3_stmt* statement = getStatement();
1633  SQLITE_CALL(sqlite3_bind_double(statement, i + 1, value));
1634}
1635 
1636void SqliteDatabase::Query::bind(uint i, decltype(nullptr)) {
1637  auto memoryScope = db.enterMemoryScope();
1638  sqlite3_stmt* statement = getStatement();
1639  SQLITE_CALL(sqlite3_bind_null(statement, i + 1));
1640}
1641 
1642void SqliteDatabase::Query::nextRow(bool first) {
1643  auto& statementAndEffect = getStatementAndEffect();
1644  sqlite3_stmt* statement = statementAndEffect.statement;
1645 
1646  KJ_ASSERT(db.currentStatement == kj::none, "recursive nextRow()?");
1647  KJ_DEFER(db.currentStatement = kj::none);
1648  db.currentStatement = *statement;
1649 
1650  // The statement could be "re-prepared" during sqlite3_step, so we must set up the regulator.
1651  KJ_ASSERT(db.currentRegulator == kj::none, "nextRow() during prepare()?");
1652  KJ_DEFER(db.currentRegulator = kj::none);
1653  db.currentRegulator = regulator;
1654 
1655  auto memoryScope = db.enterMemoryScope();
1656  SQLITE_CALL_SCOPE {
1657    int err = sqlite3_step(statement);
1658    queryEvent.setQueryResult(err);
1659 
1660    int extendedCode = sqlite3_extended_errcode(db);
1661    queryEvent.setQueryExtendedCode(extendedCode);
1662 
1663    // TODO(perf): This is slightly inefficient to call for every row read, but not bad enough to
1664    // fix it immediately. The alternate way would be to getRowsRead/Written once when we emit it
1665    // in the Dtor, and handle the case where the statement could be null when the Query gets
1666    // destructed
1667    rowsRead = getRowsRead();
1668    rowsWritten = getRowsWritten();
1669    if (err == SQLITE_DONE) {
1670      done = true;
1671    } else if (err != SQLITE_ROW) {
1672      SQLITE_CALL_FAILED("sqlite3_step()", err);
1673    }
1674  }
1675 
1676  if (first) {
1677    // A statement's effect is applied on the first step.
1678    db.applyChange(statementAndEffect.stateChange);
1679  }
1680}
1681 
1682uint SqliteDatabase::Query::changeCount() {
1683  KJ_REQUIRE(done);
1684  KJ_DREQUIRE(
1685      columnCount() == 0, "changeCount() can only be called on INSERT/UPDATE/DELETE queries");
1686  return sqlite3_changes(db);
1687}
1688 
1689uint SqliteDatabase::Query::columnCount() {
1690  auto memoryScope = db.enterMemoryScope();
1691  sqlite3_stmt* statement = getStatement();
1692  return sqlite3_column_count(statement);
1693}
1694 
1695SqliteDatabase::Query::ValuePtr SqliteDatabase::Query::getValue(uint column) {
1696  auto memoryScope = db.enterMemoryScope();
1697  sqlite3_stmt* statement = getStatement();
1698  switch (sqlite3_column_type(statement, column)) {
1699    case SQLITE_INTEGER:
1700      return getInt64(column);
1701    case SQLITE_FLOAT:
1702      return getDouble(column);
1703    case SQLITE_TEXT:
1704      return getText(column);
1705    case SQLITE_BLOB:
1706      return getBlob(column);
1707    case SQLITE_NULL:
1708      return nullptr;
1709  }
1710  KJ_UNREACHABLE;
1711}
1712 
1713kj::StringPtr SqliteDatabase::Query::getColumnName(uint column) {
1714  auto memoryScope = db.enterMemoryScope();
1715  sqlite3_stmt* statement = getStatement();
1716  return sqlite3_column_name(statement, column);
1717}
1718 
1719kj::ArrayPtr<const byte> SqliteDatabase::Query::getBlob(uint column) {
1720  auto memoryScope = db.enterMemoryScope();
1721  sqlite3_stmt* statement = getStatement();
1722  const byte* ptr = reinterpret_cast<const byte*>(sqlite3_column_blob(statement, column));
1723  return kj::arrayPtr(ptr, sqlite3_column_bytes(statement, column));
1724}
1725 
1726kj::StringPtr SqliteDatabase::Query::getText(uint column) {
1727  auto memoryScope = db.enterMemoryScope();
1728  sqlite3_stmt* statement = getStatement();
1729  const char* ptr = reinterpret_cast<const char*>(sqlite3_column_text(statement, column));
1730  return kj::StringPtr(ptr, sqlite3_column_bytes(statement, column));
1731}
1732 
1733int SqliteDatabase::Query::getInt(uint column) {
1734  auto memoryScope = db.enterMemoryScope();
1735  sqlite3_stmt* statement = getStatement();
1736  return sqlite3_column_int(statement, column);
1737}
1738 
1739int64_t SqliteDatabase::Query::getInt64(uint column) {
1740  auto memoryScope = db.enterMemoryScope();
1741  sqlite3_stmt* statement = getStatement();
1742  return sqlite3_column_int64(statement, column);
1743}
1744 
1745double SqliteDatabase::Query::getDouble(uint column) {
1746  auto memoryScope = db.enterMemoryScope();
1747  sqlite3_stmt* statement = getStatement();
1748  return sqlite3_column_double(statement, column);
1749}
1750 
1751bool SqliteDatabase::Query::isNull(uint column) {
1752  auto memoryScope = db.enterMemoryScope();
1753  sqlite3_stmt* statement = getStatement();
1754  return sqlite3_column_type(statement, column) == SQLITE_NULL;
1755}
1756 
1757SqliteDatabase::StatementAndEffect& SqliteDatabase::Query::getStatementAndEffect() {
1758  return KJ_UNWRAP_OR(maybeStatement, {
1759    regulator.onError(kj::none, "SQLite query was canceled because the database was deleted.");
1760    KJ_FAIL_REQUIRE("query canceled because reset() was called on the database");
1761  });
1762}
1763 
1764void SqliteDatabase::Query::beforeSqliteReset() {
1765  // Note that if we don't own the statement, then `maybeStatement` is probably already dangling
1766  // here. Luckily, we don't need to reset it or anything because the statement will be destroyed
1767  // by Statement::beforeSqliteReset().
1768  maybeStatement = kj::none;
1769  ownStatement = {};
1770}
1771 
1772// =======================================================================================
1773// VFS
1774 
1775// -----------------------------------------------------------------------------
1776// Code to wrap SQLite's native VFS so that it can be rooted in some `kj::Directory`, where that
1777// directory points at a real disk directory.
1778//
1779// A native disk `kj::Directory` -- at least on Unix -- wraps an open file descriptor, pointing at
1780// a directory. It does NOT keep track of the directory's path on disk. In fact, the directory can
1781// be moved or renamed, and `kj::Directory` will continue to point at it.
1782//
1783// There is no portable way to query the current path of a directory. In order to open files within
1784// a directory given only the directory descriptor, you must use syscalls like `openat()`, which
1785// take a directory file descriptor to use as the root.
1786//
1787// SQLite's native VFS, however, is not openat()-aware. Luckily, it _does_ provide the ability to
1788// redirect its syscalls to custom implementations. So we can intercept `open()` and make it use
1789// `openat()` instead! With a little thread-local hackery, we can make sure to use the desired root
1790// directory descriptor from the `kj::Directory`.
1791//
1792// Of course, SQLite also lets us virtualize the whole filesystem at a higher level. Why go to all
1793// the bother to hack it at a low level rather than just implement an entire VFS based on the
1794// `kj::Directory` interface? The problem is, SQLite's native VFS contains a ton of code to handle
1795// all sorts of corner cases and do things just right. When our files are actually on real disk,
1796// we want to leverage all that code. If we can just make it interpret paths differently, then we
1797// can reuse the rest of the implementation.
1798 
1799#if !_WIN32
1800namespace {
1801 
1802static thread_local int currentVfsRoot = AT_FDCWD;
1803// We will tell SQLite to use alternate implementations of path-oriented syscalls which use the
1804// `*at()` versions of the calls with `currentVfsRoot` as the directory descriptor. When the
1805// descriptor is `AT_FDCWD`, this will naturally reproduce the behavior of the non-`at()` versions.
1806// We temporarily swap this for a real descriptor when our custom VFS wrapper is being invoked.
1807 
1808static int replaced_open(const char* path, int flags, int mode) {
1809  return openat(currentVfsRoot, path, flags, mode);
1810}
1811static int replaced_access(const char* path, int type) {
1812  return faccessat(currentVfsRoot, path, type, 0);
1813}
1814static char* replaced_getcwd(char* buf, size_t size) noexcept {
1815  KJ_REQUIRE(currentVfsRoot == AT_FDCWD,
1816      "SQLite custom VFS shouldn't call getcwd() because we overrode xFullPathname");
1817  return getcwd(buf, size);
1818}
1819static int replaced_stat(const char* path, struct stat* stats) {
1820  return fstatat(currentVfsRoot, path, stats, 0);
1821}
1822static int replaced_unlink(const char* path) {
1823  return unlinkat(currentVfsRoot, path, 0);
1824}
1825static int replaced_mkdir(const char* path, mode_t mode) {
1826  return mkdirat(currentVfsRoot, path, mode);
1827}
1828static int replaced_rmdir(const char* path) {
1829  return unlinkat(currentVfsRoot, path, AT_REMOVEDIR);
1830}
1831static ssize_t replaced_readlink(const char* path, char* buf, size_t len) {
1832  return readlinkat(currentVfsRoot, path, buf, len);
1833}
1834static int replaced_lstat(const char* path, struct stat* stats) {
1835  return fstatat(currentVfsRoot, path, stats, AT_SYMLINK_NOFOLLOW);
1836}
1837 
1838};  // namespace
1839 
1840// The sqlite3_file implementation we use when wrapping the native filesystem.
1841struct SqliteDatabase::Vfs::WrappedNativeFileImpl: public sqlite3_file {
1842  const Vfs* vfs;
1843  int rootFd;
1844 
1845  // It's expected that the wrapped sqlite_file begins in memory immediately after this object.
1846  sqlite3_file* getWrapped() {
1847    return reinterpret_cast<sqlite3_file*>(this + 1);
1848  }
1849 
1850  static const sqlite3_io_methods METHOD_TABLE;
1851};
1852 
1853// This completely nutso template generates wrapper functions for each of the function pointer
1854// members of sqlite3_vfs. The wrapper function temporarily sets `currentVfsRoot` to the FD
1855// of the directory from the SqliteDatabase::Vfs instance in use, then invokes the same function
1856// on the underlying native VFS.
1857template <typename Result,
1858    typename... Params,
1859    Result (*sqlite3_vfs::*slot)(sqlite3_vfs* vfs, Params...)>
1860struct SqliteDatabase::Vfs::MethodWrapperHack<Result (*sqlite3_vfs::*)(sqlite3_vfs* vfs, Params...),
1861    slot> {
1862  static Result wrapper(sqlite3_vfs* vfs, Params... params) noexcept {
1863    auto& self = *reinterpret_cast<SqliteDatabase::Vfs*>(vfs->pAppData);
1864    KJ_ASSERT(currentVfsRoot == AT_FDCWD);
1865    currentVfsRoot = self.rootFd;
1866    KJ_DEFER(currentVfsRoot = AT_FDCWD);
1867    return (self.native.*slot)(&self.native, params...);
1868  }
1869};
1870 
1871// Specialization of MethodWrapperHack for wrapping methods of sqlite_file, aka
1872// sqlite3_io_methods. Unfortunately, some file methods go back and perform filesystem ops. In
1873// particular, accessing shared memory associated with a file actually opens another adjacent
1874// file.
1875template <typename Result,
1876    typename... Params,
1877    Result (*sqlite3_io_methods::*slot)(sqlite3_file* file, Params...)>
1878struct SqliteDatabase::Vfs::
1879    MethodWrapperHack<Result (*sqlite3_io_methods::*)(sqlite3_file* file, Params...), slot> {
1880  static Result wrapper(sqlite3_file* file, Params... params) noexcept {
1881    auto wrapper = static_cast<WrappedNativeFileImpl*>(file);
1882    file = wrapper->getWrapped();
1883    KJ_ASSERT(currentVfsRoot == AT_FDCWD);
1884    currentVfsRoot = wrapper->rootFd;
1885    KJ_DEFER(currentVfsRoot = AT_FDCWD);
1886    return (file->pMethods->*slot)(file, params...);
1887  }
1888};
1889 
1890// clang-format off
1891//
1892// The code below has a lot of lambdas inside struct initializers, which clang-format does not
1893// handle well, making it extremely hard to read if we leave the formatter on.
1894 
1895const sqlite3_io_methods SqliteDatabase::Vfs::WrappedNativeFileImpl::METHOD_TABLE = {
1896  .iVersion = 3,
1897 
1898#define WRAP(name)                                                                                 \
1899  .name =                                                                                          \
1900      &MethodWrapperHack<decltype(&sqlite3_io_methods::name), &sqlite3_io_methods::name>::wrapper
1901 
1902  WRAP(xClose),
1903  WRAP(xRead),
1904  WRAP(xWrite),
1905  WRAP(xTruncate),
1906  WRAP(xSync),
1907  WRAP(xFileSize),
1908  WRAP(xLock),
1909  WRAP(xUnlock),
1910  WRAP(xCheckReservedLock),
1911  WRAP(xFileControl),
1912  WRAP(xSectorSize),
1913  .xDeviceCharacteristics = [](sqlite3_file* file) noexcept -> int {
1914    auto wrapper = static_cast<WrappedNativeFileImpl*>(file);
1915    file = wrapper->getWrapped();
1916    KJ_ASSERT(currentVfsRoot == AT_FDCWD);
1917    currentVfsRoot = wrapper->rootFd;
1918    KJ_DEFER(currentVfsRoot = AT_FDCWD);
1919    return (file->pMethods->xDeviceCharacteristics)(file) |
1920        wrapper->vfs->options.deviceCharacteristics;
1921  },
1922 
1923  WRAP(xShmMap),
1924  WRAP(xShmLock),
1925  WRAP(xShmBarrier),
1926  WRAP(xShmUnmap),
1927 
1928  WRAP(xFetch),
1929  WRAP(xUnfetch),
1930#undef WRAP
1931};
1932 
1933// The native VFS gives us the ability to override its syscalls. We need to do so, in
1934// particular to force them to use the *at() versions of the calls that accept a directory FD
1935// to use as the root.
1936//
1937// Unfortunately, these overrides are global for the process, with no ability to pass down any
1938// context to them. So, we stash the current root FD in `currentVfsRoot` whenever we call into
1939// the native VFS. We also don't want to interfere with anything else in the process that is
1940// using SQLite directly, so we make sure that when we're not specifically trying to invoke
1941// our wrapper, then `currentVfsRoot` is `AT_FDCWD`, which causes the *at() syscalls to match
1942// their non-at() versions.
1943sqlite3_vfs SqliteDatabase::Vfs::makeWrappedNativeVfs() {
1944  static bool registerOnce KJ_UNUSED = ([&]() {
1945#define REPLACE_SYSCALL(name)                                                                      \
1946  native.xSetSystemCall(&native, #name, (sqlite3_syscall_ptr)replaced_##name);
1947    REPLACE_SYSCALL(open);
1948    REPLACE_SYSCALL(access);
1949    REPLACE_SYSCALL(getcwd);
1950    REPLACE_SYSCALL(stat);
1951    REPLACE_SYSCALL(unlink);
1952    REPLACE_SYSCALL(mkdir);
1953    REPLACE_SYSCALL(rmdir);
1954    REPLACE_SYSCALL(readlink);
1955    REPLACE_SYSCALL(lstat);
1956#undef REPLACE_SYSCALL
1957 
1958    return true;
1959  })();
1960 
1961  // We construct a sqlite3_vfs that is basically a copy of the native VFS, except each method is
1962  // wrapped so that it sets `currentVfsRoot` while running.
1963  return {
1964    .iVersion = kj::min(3, native.iVersion),
1965    .szOsFile = native.szOsFile + static_cast<int>(sizeof(WrappedNativeFileImpl)),
1966    .mxPathname = native.mxPathname,
1967    .pNext = nullptr,
1968    .zName = name.cStr(),
1969    .pAppData = this,
1970 
1971    .xOpen = [](sqlite3_vfs* vfs, sqlite3_filename zName, sqlite3_file* file, int flags,
1972                 int* pOutFlags) -> int {
1973      // We have to wrap xOpen explicitly because we need to further wrap each created file.
1974      //
1975      // My trick here is to prefix the native file with a second vtable. So the layout of the
1976      // `sqlite3_file` that we construct is actually a simple `struct sqlite_file` (which just
1977      // contains a single pointer to sqlite3_io_methods, i.e. the vtable pointer) _followed by_
1978      // the regular native file structure.
1979 
1980      auto wrapper = static_cast<WrappedNativeFileImpl*>(file);
1981      file = wrapper->getWrapped();
1982      file->pMethods = nullptr;
1983 
1984      // Set up currentVfsRoot.
1985      auto& self = *reinterpret_cast<const SqliteDatabase::Vfs*>(vfs->pAppData);
1986      KJ_ASSERT(currentVfsRoot == AT_FDCWD);
1987      currentVfsRoot = self.rootFd;
1988      KJ_DEFER(currentVfsRoot = AT_FDCWD);
1989 
1990      int result = self.native.xOpen(&self.native, zName, file, flags, pOutFlags);
1991 
1992      // `xOpen` setting `pMethods` to non-null indicates that `xClose` is needed, i.e. the file
1993      // has been constructed. We need our wrapper to match.
1994      if (file->pMethods == nullptr) {
1995        wrapper->pMethods = nullptr;
1996      } else {
1997        wrapper->pMethods = &WrappedNativeFileImpl::METHOD_TABLE;
1998        wrapper->vfs = &self;
1999        wrapper->rootFd = self.rootFd;
2000      }
2001 
2002      return result;
2003    },
2004 
2005#define WRAP(name)                                                                                 \
2006  .name = &MethodWrapperHack<decltype(&sqlite3_vfs::name), &sqlite3_vfs::name>::wrapper
2007 
2008    WRAP(xDelete),
2009    WRAP(xAccess),
2010    .xFullPathname = [](sqlite3_vfs*, const char* zName, int nOut, char* zOut) -> int {
2011      // Override xFullPathname so that it doesn't rewrite the path at all.
2012      size_t len = kj::min(strlen(zName), nOut - 1);
2013      memcpy(zOut, zName, len);
2014      zOut[len] = 0;
2015      return SQLITE_OK;
2016    },
2017 
2018    .xDlOpen = nullptr,
2019    .xDlError = nullptr,
2020    .xDlSym = nullptr,
2021    .xDlClose = nullptr,
2022    // There is no dlopenat(), but we don't need to support these anyway.
2023 
2024    WRAP(xRandomness),
2025    WRAP(xSleep),
2026    WRAP(xCurrentTime),
2027    WRAP(xGetLastError),
2028    WRAP(xCurrentTimeInt64),
2029 
2030    .xSetSystemCall = nullptr,
2031    .xGetSystemCall = nullptr,
2032    .xNextSystemCall = nullptr,
2033  // We don't support further overriding syscalls.
2034#undef WRAP
2035  };
2036}
2037#endif  // #if !_WIN32
2038 
2039// -----------------------------------------------------------------------------
2040// Code to implement a true SQLite VFS based on `kj::Directory`.
2041//
2042// This VFS implementation actually delegates to the KJ filesystem interface for everything.
2043// This is used only when given a `kj::Directory` that does NOT represent a native file, i.e.
2044// one where `getFd()` returns null. This is mainly used for unit tests which want to use in-memory
2045// directories.
2046 
2047// Implementation of sqlite3_file.
2048//
2049// Weirdly, for sqlite3_file, SQLite uses a C++-like inheritance approach, with a separate
2050// virtual table that can be shared among all files of the same type. This is different from the
2051// way sqlite3_vfs works, where the function pointers are inlined into the sqlite3_vfs struct.
2052// In any case, as a result, `FileImpl`, unlike `VfsImpl`, is NOT just a namespace struct, but
2053// an actual instance.
2054struct SqliteDatabase::Vfs::FileImpl: public sqlite3_file {
2055  const Vfs& vfs;
2056  kj::Maybe<const kj::File&> writableFile;
2057  kj::Own<const kj::ReadableFile> file;
2058 
2059  kj::Maybe<kj::Own<Lock>> lock;
2060  // Rather complicatedly, SQLite doesn't consider the -shm file to be a separate file that it
2061  // opens via the VFS, but rather a facet of the database file itself. We implement it using an
2062  // entirely different interface anyway.
2063  //
2064  // We leave this null if the file is not the main database file.
2065 
2066  FileImpl(const Vfs& vfs, kj::Own<const kj::File> file, kj::Maybe<kj::Own<Lock>> lock)
2067      : sqlite3_file{.pMethods = &FILE_METHOD_TABLE},
2068        vfs(vfs),
2069        writableFile(*file),
2070        file(kj::mv(file)),
2071        lock(kj::mv(lock)) {}
2072  FileImpl(const Vfs& vfs, kj::Own<const kj::ReadableFile> file, kj::Maybe<kj::Own<Lock>> lock)
2073      : sqlite3_file{.pMethods = &FILE_METHOD_TABLE},
2074        vfs(vfs),
2075        file(kj::mv(file)),
2076        lock(kj::mv(lock)) {}
2077 
2078  static const sqlite3_io_methods FILE_METHOD_TABLE;
2079};
2080 
2081const sqlite3_io_methods SqliteDatabase::Vfs::FileImpl::FILE_METHOD_TABLE = {
2082  .iVersion = 3,
2083#define WRAP_METHOD(errorCode, block)                                                              \
2084  auto& self KJ_UNUSED = *static_cast<FileImpl*>(file);                                            \
2085  try block catch (kj::Exception& e) {                                                             \
2086    reportVfsErrorCaught(kj::mv(e));                                                               \
2087    return errorCode;                                                                              \
2088  }
2089 
2090  .xClose = [](sqlite3_file* file) noexcept -> int {
2091    WRAP_METHOD(SQLITE_OK, {
2092      auto& self = *static_cast<FileImpl*>(file);
2093 
2094      // Caller will free the object's memory, but knows nothing of destructors.
2095      kj::dtor(self);
2096 
2097      return SQLITE_OK;  // return value is ignored by SQLite
2098    });
2099  },
2100 
2101  .xRead = [](sqlite3_file* file, void* buffer, int iAmt, sqlite3_int64 iOfst) noexcept -> int {
2102    WRAP_METHOD(SQLITE_IOERR_READ, {
2103      auto bytes = kj::arrayPtr(reinterpret_cast<byte*>(buffer), iAmt);
2104      size_t actual = self.file->read(iOfst, bytes);
2105 
2106      if (actual < iAmt) {
2107        bytes.slice(actual).fill(0);
2108        return SQLITE_IOERR_SHORT_READ;
2109      } else {
2110        return SQLITE_OK;
2111      }
2112    });
2113  },
2114 
2115  .xWrite =
2116      [](sqlite3_file* file, const void* buffer, int iAmt, sqlite3_int64 iOfst) noexcept -> int {
2117    WRAP_METHOD(SQLITE_IOERR_WRITE, {
2118      KJ_IF_SOME(writableFile, self.writableFile) {
2119        auto bytes = kj::arrayPtr(reinterpret_cast<const byte*>(buffer), iAmt);
2120        writableFile.write(iOfst, bytes);
2121        return SQLITE_OK;
2122      } else {
2123        return SQLITE_READONLY;
2124      }
2125    });
2126  },
2127 
2128  .xTruncate = [](sqlite3_file* file, sqlite3_int64 size) noexcept -> int {
2129    WRAP_METHOD(SQLITE_IOERR_TRUNCATE, {
2130      KJ_IF_SOME(writableFile, self.writableFile) {
2131        writableFile.truncate(size);
2132        return SQLITE_OK;
2133      } else {
2134        return SQLITE_READONLY;
2135      }
2136    });
2137  },
2138 
2139  .xSync = [](sqlite3_file* file, int flags) noexcept -> int {
2140    WRAP_METHOD(SQLITE_IOERR_FSYNC, {
2141      if (flags & SQLITE_SYNC_DATAONLY) {
2142        self.file->datasync();
2143      } else {
2144        self.file->sync();
2145      }
2146      return SQLITE_OK;
2147    });
2148  },
2149 
2150  .xFileSize = [](sqlite3_file* file, sqlite3_int64* pSize) noexcept -> int {
2151    WRAP_METHOD(SQLITE_IOERR_FSTAT, {
2152      *pSize = self.file->stat().size;
2153      return SQLITE_OK;
2154    });
2155  },
2156 
2157  .xLock = [](sqlite3_file* file, int level) noexcept -> int {
2158    // Verify that our enum's values match the SQLite constants. (We didn't want to include
2159    // sqlite3.h in our header, so defined a parallel enum.)
2160    static_assert(Lock::UNLOCKED == SQLITE_LOCK_NONE);
2161    static_assert(Lock::SHARED == SQLITE_LOCK_SHARED);
2162    static_assert(Lock::RESERVED == SQLITE_LOCK_RESERVED);
2163    static_assert(Lock::PENDING == SQLITE_LOCK_PENDING);
2164    static_assert(Lock::EXCLUSIVE == SQLITE_LOCK_EXCLUSIVE);
2165 
2166    WRAP_METHOD(SQLITE_IOERR_LOCK, {
2167      auto& lock = *KJ_ASSERT_NONNULL(self.lock, "xLock called on file that isn't main database?");
2168      if (lock.tryIncreaseLevel(static_cast<Lock::Level>(level))) {
2169        return SQLITE_OK;
2170      } else {
2171        return SQLITE_BUSY;
2172      }
2173    });
2174  },
2175 
2176  .xUnlock = [](sqlite3_file* file, int level) noexcept -> int {
2177    WRAP_METHOD(SQLITE_IOERR_UNLOCK, {
2178      auto& lock = *KJ_ASSERT_NONNULL(self.lock, "xLock called on file that isn't main database?");
2179      lock.decreaseLevel(static_cast<Lock::Level>(level));
2180      return SQLITE_OK;
2181    });
2182  },
2183 
2184  .xCheckReservedLock = [](sqlite3_file* file, int* pResOut) noexcept -> int {
2185    WRAP_METHOD(SQLITE_IOERR_CHECKRESERVEDLOCK, {
2186      auto& lock = *KJ_ASSERT_NONNULL(self.lock, "xLock called on file that isn't main database?");
2187      *pResOut = lock.checkReservedLock();
2188      return SQLITE_OK;
2189    });
2190  },
2191 
2192  .xFileControl = [](sqlite3_file* file, int op, void* pArg) noexcept -> int {
2193    // Apparently we can return SQLITE_NOTFOUND for controls we don't implement.
2194    return SQLITE_NOTFOUND;
2195  },
2196  .xSectorSize = [](sqlite3_file* file) noexcept -> int {
2197    // This function doesn't return a status code, it returns the size. It's largely a performance
2198    // hint, I think. For in-memory file systems, it has no real meaning. 4096 is the value of
2199    // SQLITE_DEFAULT_SECTOR_SIZE in the SQLite codebase, though the comments also say the result
2200    // is "almost always 512".
2201    return 4096;
2202  },
2203  .xDeviceCharacteristics = [](sqlite3_file* file) noexcept -> int {
2204    WRAP_METHOD(SQLITE_IOERR, { return self.vfs.options.deviceCharacteristics; });
2205  },
2206 
2207  .xShmMap =
2208      [](sqlite3_file* file, int iRegion, int szRegion, int bExtend, void volatile** pp) noexcept
2209      -> int {
2210    WRAP_METHOD(SQLITE_IOERR_SHMMAP, {
2211      KJ_ASSERT(iRegion >= 0);
2212      KJ_ASSERT(szRegion >= 0);
2213      auto& lock = *KJ_ASSERT_NONNULL(self.lock, "xShmMap called on file that isn't main database?");
2214 
2215      auto bytes = lock.getSharedMemoryRegion(iRegion, szRegion, bExtend);
2216      if (bytes == nullptr) {
2217        *pp = nullptr;
2218      } else {
2219        *pp = bytes.begin();
2220      }
2221      return SQLITE_OK;
2222    });
2223  },
2224  .xShmLock = [](sqlite3_file* file, int offset, int n, int flags) noexcept -> int {
2225    WRAP_METHOD(SQLITE_IOERR_SHMLOCK, {
2226      auto& lock = *KJ_ASSERT_NONNULL(self.lock, "xShmMap called on file that isn't main database?");
2227      if (flags & SQLITE_SHM_LOCK) {
2228        if (flags & SQLITE_SHM_EXCLUSIVE) {
2229          if (!lock.tryLockWalExclusive(offset, n)) return SQLITE_BUSY;
2230        } else {
2231          KJ_ASSERT(flags & SQLITE_SHM_SHARED);
2232          if (!lock.tryLockWalShared(offset, n)) return SQLITE_BUSY;
2233        }
2234      } else {
2235        KJ_ASSERT(flags & SQLITE_SHM_UNLOCK);
2236        if (flags & SQLITE_SHM_EXCLUSIVE) {
2237          lock.unlockWalExclusive(offset, n);
2238        } else {
2239          KJ_ASSERT(flags & SQLITE_SHM_SHARED);
2240          lock.unlockWalShared(offset, n);
2241        }
2242      }
2243      return SQLITE_OK;
2244    });
2245  },
2246  .xShmBarrier = [](sqlite3_file*) noexcept -> void {
2247    // I don't quite get why this is virtualized. The native implementation does
2248    // __sync_synchronize() (equivalent to below, I think) and also "for redundancy" locks and
2249    // unlocks a mutex.
2250    std::atomic_thread_fence(std::memory_order_acq_rel);
2251  },
2252  .xShmUnmap = [](sqlite3_file* file, int deleteFlag) noexcept -> int {
2253    WRAP_METHOD(SQLITE_OK, {
2254      auto& lock = *KJ_ASSERT_NONNULL(self.lock, "xShmMap called on file that isn't main database?");
2255      if (deleteFlag) {
2256        lock.clearSharedMemory();
2257      }
2258      return SQLITE_OK;  // return value is ignored by sqlite
2259    });
2260  },
2261 
2262  .xFetch = [](sqlite3_file* file, sqlite3_int64 iOfst, int iAmt, void** pp) noexcept -> int {
2263    // This is essentially requesting an mmap(). kj::File supports mmap(). Great, right?
2264    //
2265    // Well, there's a problem. We mostly use this VFS implementation to wrap an in-memory
2266    // `kj::File`. Such files support mmap by returning a pointer into the backing store. But
2267    // while such a mapping exists, the backing store cannot be resized. So write()s that extend
2268    // the file may fail. This does not work for SQLite's use case.
2269    //
2270    // So, alas, we must act like we don't support this. Luckily, SQLite has fallbacks for this.
2271    *pp = nullptr;
2272    return SQLITE_OK;
2273  },
2274  .xUnfetch = [](sqlite3_file* file, sqlite3_int64 iOfst, void* p) noexcept -> int {
2275    // Shouldn't ever be called since xFetch() always produces null? But the native implementation
2276    // return SQLITE_OK even when mmap is disabled so we will too.
2277    return SQLITE_OK;
2278  },
2279#undef WRAP_METHOD
2280};
2281 
2282// SQLite VFS implementation based on abstract `kj::Directory`. This is used only when the
2283// directory is NOT a true disk directory.
2284//
2285// This is a namespace-struct defining static methods to fill in the function pointers of
2286// sqlite3_vfs.
2287sqlite3_vfs SqliteDatabase::Vfs::makeKjVfs() {
2288  return {
2289    .iVersion = kj::min(3, native.iVersion), .szOsFile = sizeof(FileImpl),
2290 
2291    // We have no real limit on paths but SQLite likes to allocate buffers of this size whenever
2292    // doing path stuff so making it huge would be bad. The default unix implementation uses
2293    // 512 as a limit so that "should be enough for anyone".
2294    .mxPathname = 512,
2295 
2296    .pNext = nullptr,
2297    .zName = name.cStr(),
2298    .pAppData = this,
2299 
2300#define WRAP_METHOD(errorCode, block)                                                              \
2301  auto& self KJ_UNUSED = *static_cast<const SqliteDatabase::Vfs*>(vfs->pAppData);                  \
2302  try block catch (kj::Exception& e) {                                                             \
2303    KJ_LOG(ERROR, "SQLite VFS I/O error", e);                                                      \
2304    return errorCode;                                                                              \
2305  }
2306 
2307    .xOpen = [](sqlite3_vfs* vfs, sqlite3_filename zName, sqlite3_file* file, int flags,
2308                 int* pOutFlags) -> int {
2309      WRAP_METHOD(SQLITE_CANTOPEN, {
2310        auto& target = *static_cast<FileImpl*>(file);
2311 
2312        if (flags & SQLITE_OPEN_READONLY) {
2313          KJ_REQUIRE(zName != nullptr, "readonly unnamed temporary file? what?");
2314          KJ_REQUIRE(!(flags & SQLITE_OPEN_CREATE), "create readonly file? what?");
2315 
2316          auto path = kj::Path::parse(zName);
2317          auto kjFile = KJ_UNWRAP_OR(self.directory.tryOpenFile(path), { return SQLITE_CANTOPEN; });
2318          kj::Maybe<kj::Own<Lock>> lock;
2319          if (flags & SQLITE_OPEN_MAIN_DB) {
2320            lock = self.lockManager.lock(path, *kjFile);
2321          }
2322 
2323          kj::ctor(target, self, kj::mv(kjFile), kj::mv(lock));
2324        } else {
2325          kj::Own<const kj::File> kjFile;
2326          kj::Maybe<kj::Own<Lock>> lock;
2327 
2328          if (zName == nullptr) {
2329            // Open a temp file.
2330            KJ_ASSERT(flags & SQLITE_OPEN_DELETEONCLOSE);
2331            KJ_ASSERT(!(flags & SQLITE_OPEN_MAIN_DB), "main DB can't be a temporary file");
2332            kjFile = self.directory.createTemporary();
2333          } else {
2334            kj::WriteMode mode;
2335            if (flags & SQLITE_OPEN_CREATE) {
2336              if (flags & SQLITE_OPEN_EXCLUSIVE) {
2337                mode = kj::WriteMode::CREATE;
2338              } else {
2339                mode = kj::WriteMode::CREATE | kj::WriteMode::MODIFY;
2340              }
2341            } else {
2342              mode = kj::WriteMode::MODIFY;
2343            }
2344 
2345            auto path = kj::Path::parse(zName);
2346            kjFile =
2347                KJ_UNWRAP_OR(self.directory.tryOpenFile(path, mode), { return SQLITE_CANTOPEN; });
2348            if (flags & SQLITE_OPEN_MAIN_DB) {
2349              lock = self.lockManager.lock(path, *kjFile);
2350            }
2351 
2352            if (flags & SQLITE_OPEN_DELETEONCLOSE) {
2353              self.directory.remove(path);
2354            }
2355          }
2356 
2357          kj::ctor(target, self, kj::mv(kjFile), kj::mv(lock));
2358        }
2359 
2360        // In theory if read-write was requested, but failed, we should retry read-only, and then
2361        // alter the pOutFlags to reflect this... I'm not going to bother.
2362        if (pOutFlags != nullptr) {
2363          *pOutFlags = flags;
2364        }
2365 
2366        return SQLITE_OK;
2367      });
2368    },
2369    .xDelete = [](sqlite3_vfs* vfs, const char* zName, int syncDir) -> int {
2370      WRAP_METHOD(SQLITE_IOERR_DELETE, {
2371        if (self.directory.tryRemove(kj::Path::parse(zName))) {
2372          return SQLITE_OK;
2373        } else {
2374          return SQLITE_IOERR_DELETE_NOENT;
2375        }
2376      });
2377    },
2378    .xAccess = [](sqlite3_vfs* vfs, const char* zName, int flags, int* pResOut) -> int {
2379      WRAP_METHOD(SQLITE_IOERR_ACCESS, {
2380        // Technically, depending on the flags, this may be checking whether the file is readable
2381        // or writable, rather than just whether it exists. However, the KJ filesystem API
2382        // assumes that all descendents of a writable directory are readable and writable, hence
2383        // this is equivalent to checking for existence.
2384        //
2385        // If we were to extend the VFS so it can wrap `kj::ReadableDirectory` then in that case
2386        // we would want to return false when querying writability.
2387        *pResOut = self.directory.exists(kj::Path::parse(zName));
2388        return SQLITE_OK;
2389      });
2390    },
2391    .xFullPathname = [](sqlite3_vfs*, const char* zName, int nOut, char* zOut) -> int {
2392      // Don't rewrite the path at all. All paths are canonical. Our path parsing will reject
2393      // the existence of `.` or `..` as path components as well as leading `/`.
2394      size_t len = kj::min(strlen(zName), nOut - 1);
2395      memcpy(zOut, zName, len);
2396      zOut[len] = 0;
2397      return SQLITE_OK;
2398    },
2399 
2400    // We don't support loading shared libraries from virtual files.
2401    .xDlOpen = nullptr,
2402    .xDlError = nullptr,
2403    .xDlSym = nullptr,
2404    .xDlClose = nullptr,
2405 
2406    // Use native implementations of these OS functions. I'm not sure why these are even part
2407    // of the VFS. (Exception: xGetLastError is actually sensibly a VFS thing, but we are allowed
2408    // to just not implement it.)
2409    .xRandomness = native.xRandomness,
2410    .xSleep = native.xSleep,
2411    .xCurrentTime = native.xCurrentTime,
2412    .xGetLastError = nullptr,
2413    .xCurrentTimeInt64 = native.xCurrentTimeInt64,
2414 
2415    // We don't support overriding any syscalls.
2416    .xSetSystemCall = nullptr,
2417    .xGetSystemCall = nullptr,
2418    .xNextSystemCall = nullptr,
2419 
2420#undef WRAP_METHOD
2421  };
2422};
2423 
2424// clang-format on
2425 
2426// -----------------------------------------------------------------------------
2427 
2428class SqliteDatabase::Vfs::DefaultLockManager final: public SqliteDatabase::LockManager {
2429 public:
2430  kj::Own<Lock> lock(kj::PathPtr path, const kj::ReadableFile& mainDatabaseFile) const override {
2431    return kj::heap<LockImpl>(*this, path);
2432  }
2433 
2434 private:
2435  class LockImpl;
2436  struct LockState;
2437  using LockMap = kj::HashMap<kj::PathPtr, LockState*>;
2438  kj::MutexGuarded<LockMap> lockMap;
2439 
2440  struct LockState: public kj::Refcounted {
2441    // Note: The refcount of this object is protected by `lockMap`'s mutex.
2442 
2443    struct Guarded {
2444      kj::Vector<kj::Array<byte>> regions;
2445 
2446      uint sharedLockCount = 0;
2447      bool hasReserved = false;
2448      bool hasPendingOrExclusive = false;
2449 
2450      uint walLocks[Lock::WAL_LOCK_COUNT] = {0, 0, 0, 0, 0, 0, 0, 0};
2451      // Each slot contains the count of shared locks, or kj::maxValue if an exclusive lock is
2452      // held.
2453    };
2454 
2455    const kj::Path path;
2456    kj::MutexGuarded<Guarded> guarded;
2457 
2458    LockState(kj::Path path): path(kj::mv(path)) {}
2459  };
2460 
2461  class LockImpl final: public Lock {
2462   public:
2463    LockImpl(const DefaultLockManager& lockManager, kj::PathPtr path): lockManager(lockManager) {
2464      auto mlock = lockManager.lockMap.lockExclusive();
2465      auto& slot = mlock->findOrCreate(path, [&]() {
2466        state = kj::refcounted<LockState>(path.clone());
2467        return LockMap::Entry{.key = state->path, .value = state.get()};
2468      });
2469      if (state.get() == nullptr) {
2470        state = kj::addRef(*slot);
2471      }
2472    }
2473 
2474    ~LockImpl() noexcept(false) {
2475      // It's important that we drop the state object under lock to ensure no other thread is
2476      // in the process of grabbing it out of the map at the same time. Since we have to take a
2477      // lock here anyway, `LockState` uses regular non-atomic refcounts rather than atomic.
2478      auto mlock = lockManager.lockMap.lockExclusive();
2479      auto stateToDrop = kj::mv(state);
2480      if (!stateToDrop->isShared()) {
2481        mlock->erase(stateToDrop->path);
2482      }
2483    }
2484 
2485    bool tryIncreaseLevel(Level newLevel) override {
2486      if (newLevel <= currentLevel) return true;
2487 
2488      auto slock = state->guarded.lockExclusive();
2489 
2490      if (currentLevel < SHARED) {
2491        if (slock->hasPendingOrExclusive) {
2492          return false;
2493        }
2494        ++slock->sharedLockCount;
2495        currentLevel = SHARED;
2496      }
2497 
2498      if (newLevel == SHARED) {
2499        return true;
2500      }
2501 
2502      if (newLevel == RESERVED) {
2503        if (slock->hasReserved || slock->hasPendingOrExclusive) {
2504          return false;
2505        }
2506        if (currentLevel == SHARED) {
2507          KJ_ASSERT(slock->sharedLockCount > 0);
2508          --slock->sharedLockCount;
2509        }
2510        slock->hasReserved = true;
2511        currentLevel = RESERVED;
2512        return true;
2513      }
2514 
2515      // Requesting PENDING or EXCLUSIVE. If EXCLUSIVE, we still have to transition through
2516      // PENDING first, if we're not there already.
2517      if (currentLevel < PENDING) {
2518        if (currentLevel != RESERVED && slock->hasReserved) {
2519          return false;
2520        }
2521        if (slock->hasPendingOrExclusive) {
2522          return false;
2523        }
2524        if (currentLevel == SHARED) {
2525          KJ_ASSERT(slock->sharedLockCount > 0);
2526          --slock->sharedLockCount;
2527        }
2528        slock->hasReserved = false;
2529        slock->hasPendingOrExclusive = true;
2530        currentLevel = PENDING;
2531      }
2532 
2533      if (newLevel == EXCLUSIVE) {
2534        if (slock->sharedLockCount > 0) {
2535          return false;
2536        }
2537        currentLevel = EXCLUSIVE;
2538      }
2539 
2540      return true;
2541    }
2542 
2543    void decreaseLevel(Level newLevel) override {
2544      if (newLevel >= currentLevel) return;
2545      KJ_REQUIRE(newLevel <= SHARED);
2546 
2547      auto slock = state->guarded.lockExclusive();
2548      if (currentLevel >= PENDING) {
2549        slock->hasPendingOrExclusive = false;
2550      }
2551      if (currentLevel == RESERVED) {
2552        slock->hasReserved = false;
2553      }
2554      if (currentLevel == SHARED && newLevel == UNLOCKED) {
2555        KJ_ASSERT(slock->sharedLockCount > 0);
2556        --slock->sharedLockCount;
2557      }
2558      if (newLevel == SHARED) {
2559        ++slock->sharedLockCount;
2560      }
2561      currentLevel = newLevel;
2562    }
2563 
2564    bool checkReservedLock() override {
2565      return state->guarded.lockShared()->hasReserved;
2566    }
2567 
2568    kj::ArrayPtr<byte> getSharedMemoryRegion(uint index, uint size, bool extend) override {
2569      if (extend) {
2570        auto slock = state->guarded.lockExclusive();
2571 
2572        while (index >= slock->regions.size()) {
2573          auto newRegion = kj::heapArray<byte>(size);
2574          newRegion.asPtr().fill(0);
2575          slock->regions.add(kj::mv(newRegion));
2576        }
2577 
2578        return slock->regions[index];
2579      } else {
2580        auto slock = state->guarded.lockShared();
2581 
2582        if (index >= slock->regions.size()) {
2583          return nullptr;
2584        } else {
2585          kj::ArrayPtr<const byte> region = slock->regions[index];
2586          // const_cast OK because the caller will carefully control access to shared memory.
2587          return kj::arrayPtr(const_cast<byte*>(region.begin()), region.size());
2588        }
2589      }
2590    }
2591 
2592    void clearSharedMemory() override {
2593      auto slock = state->guarded.lockExclusive();
2594      slock->regions.clear();
2595    }
2596 
2597    bool tryLockWalShared(uint start, uint count) override {
2598      auto slock = state->guarded.lockExclusive();
2599 
2600      for (uint i = start; i < start + count; i++) {
2601        if (slock->walLocks[i] == static_cast<uint>(kj::maxValue)) {
2602          // blocked by exclusive lock
2603          return false;
2604        }
2605      }
2606      for (uint i = start; i < start + count; i++) {
2607        ++slock->walLocks[i];
2608      }
2609      return true;
2610    }
2611    bool tryLockWalExclusive(uint start, uint count) override {
2612      auto slock = state->guarded.lockExclusive();
2613 
2614      for (uint i = start; i < start + count; i++) {
2615        if (slock->walLocks[i] != 0) {
2616          // blocked by another lock
2617          return false;
2618        }
2619      }
2620      for (uint i = start; i < start + count; i++) {
2621        slock->walLocks[i] = kj::maxValue;
2622      }
2623      return true;
2624    }
2625 
2626    void unlockWalShared(uint start, uint count) override {
2627      auto slock = state->guarded.lockExclusive();
2628      for (uint i = start; i < start + count; i++) {
2629        KJ_ASSERT(slock->walLocks[i] != 0);
2630        --slock->walLocks[i];
2631      }
2632    }
2633    void unlockWalExclusive(uint start, uint count) override {
2634      auto slock = state->guarded.lockExclusive();
2635      for (uint i = start; i < start + count; i++) {
2636        KJ_REQUIRE(slock->walLocks[i] == (uint)kj::maxValue);
2637        slock->walLocks[i] = 0;
2638      }
2639    }
2640 
2641   private:
2642    const DefaultLockManager& lockManager;
2643    kj::Own<LockState> state;
2644    Level currentLevel = UNLOCKED;
2645  };
2646};
2647 
2648SqliteDatabase::Vfs::Vfs(const kj::Directory& directory, Options options)
2649    : directory(directory),
2650      ownLockManager(kj::heap<DefaultLockManager>()),
2651      lockManager(*ownLockManager),
2652      options(kj::mv(options)),
2653      native(*sqlite3_vfs_find(nullptr)) {
2654#if _WIN32
2655  vfs = kj::heap(makeKjVfs());
2656#else
2657  KJ_IF_SOME(fd, directory.getFd()) {
2658    rootFd = fd;
2659    vfs = kj::heap(makeWrappedNativeVfs());
2660  } else {
2661    vfs = kj::heap(makeKjVfs());
2662  }
2663#endif
2664  sqlite3_vfs_register(vfs, false);
2665}
2666 
2667SqliteDatabase::Vfs::Vfs(
2668    const kj::Directory& directory, const LockManager& lockManager, Options options)
2669    : directory(directory),
2670      lockManager(lockManager),
2671      options(kj::mv(options)),
2672      native(*sqlite3_vfs_find(nullptr)),
2673      // Always use KJ VFS when using a custom LockManager.
2674      vfs(kj::heap(makeKjVfs())) {
2675  sqlite3_vfs_register(vfs, false);
2676}
2677 
2678SqliteDatabase::Vfs::~Vfs() noexcept(false) {
2679  sqlite3_vfs_unregister(vfs);
2680}
2681 
2682kj::String SqliteDatabase::Vfs::makeName() {
2683  // A pointer to this object should be suitably unique. (Ugghhhh.)
2684  return kj::str("kj-", this);
2685}
2686 
2687#if _WIN32
2688kj::Maybe<kj::Path> SqliteDatabase::Vfs::tryAppend(kj::PathPtr suffix) const {
2689  auto handle = KJ_UNWRAP_OR_RETURN(directory.getWin32Handle(), nullptr);
2690  auto root = getPathFromWin32Handle(handle);
2691  return root.append(suffix);
2692}
2693#else
2694kj::Maybe<kj::Path> SqliteDatabase::Vfs::tryAppend(kj::PathPtr suffix) const {
2695  // TODO(someday): consider implementing this on other platforms
2696  return kj::none;
2697}
2698#endif
2699 
2700// =======================================================================================
2701 
2702}  // namespace workerd