package sqlite import ( "context" "database/sql" "fmt" "strings" "github.com/pkg/errors" "google.golang.org/protobuf/encoding/protojson" "github.com/usememos/memos/internal/filter" storepb "github.com/usememos/memos/proto/gen/store" "github.com/usememos/memos/store" ) func (d *DB) CreateAttachment(ctx context.Context, create *store.Attachment) (*store.Attachment, error) { if create.Policy == nil { return insertSQLiteAttachment(ctx, d.db, create) } if create.MemoID == nil || create.CreatorID != create.Policy.ActorUserID { return nil, store.ErrMemoPermissionDenied } tx, err := d.db.BeginTx(ctx, nil) if err != nil { return nil, err } defer func() { _ = tx.Rollback() }() if err := validateSQLiteMemoWritePolicy(ctx, tx, *create.MemoID, create.Policy, nil); err != nil { return nil, err } attachment, err := insertSQLiteAttachment(ctx, tx, create) if err != nil { return nil, err } if err := tx.Commit(); err != nil { return nil, err } return attachment, nil } func insertSQLiteAttachment(ctx context.Context, executor dbExecutor, create *store.Attachment) (*store.Attachment, error) { fields := []string{"`uid`", "`filename`", "`blob`", "`type`", "`size`", "`creator_id`", "`memo_id`", "`storage_type`", "`reference`", "`payload`"} placeholder := []string{"?", "?", "?", "?", "?", "?", "?", "?", "?", "?"} storageType := "" if create.StorageType != storepb.AttachmentStorageType_ATTACHMENT_STORAGE_TYPE_UNSPECIFIED { storageType = create.StorageType.String() } payloadString := "{}" if create.Payload != nil { bytes, err := protojson.Marshal(create.Payload) if err != nil { return nil, errors.Wrap(err, "failed to marshal attachment payload") } payloadString = string(bytes) } args := []any{create.UID, create.Filename, create.Blob, create.Type, create.Size, create.CreatorID, create.MemoID, storageType, create.Reference, payloadString} stmt := "INSERT INTO `attachment` (" + strings.Join(fields, ", ") + ") VALUES (" + strings.Join(placeholder, ", ") + ") RETURNING `id`, `created_ts`, `updated_ts`" if err := executor.QueryRowContext(ctx, stmt, args...).Scan(&create.ID, &create.CreatedTs, &create.UpdatedTs); err != nil { return nil, err } return create, nil } func (d *DB) ListAttachments(ctx context.Context, find *store.FindAttachment) ([]*store.Attachment, error) { where, args := []string{"1 = 1"}, []any{} if v := find.ID; v != nil { where, args = append(where, "`attachment`.`id` = ?"), append(args, *v) } if v := find.UID; v != nil { where, args = append(where, "`attachment`.`uid` = ?"), append(args, *v) } if v := find.CreatorID; v != nil { where, args = append(where, "`attachment`.`creator_id` = ?"), append(args, *v) } if v := find.Filename; v != nil { where, args = append(where, "`attachment`.`filename` = ?"), append(args, *v) } if v := find.FilenameSearch; v != nil { where, args = append(where, "`attachment`.`filename` LIKE ?"), append(args, fmt.Sprintf("%%%s%%", *v)) } if v := find.MemoID; v != nil { where, args = append(where, "`attachment`.`memo_id` = ?"), append(args, *v) } if len(find.MemoIDList) > 0 { placeholders := make([]string, 0, len(find.MemoIDList)) for range find.MemoIDList { placeholders = append(placeholders, "?") } where = append(where, "`attachment`.`memo_id` IN ("+strings.Join(placeholders, ",")+")") for _, id := range find.MemoIDList { args = append(args, id) } } if find.HasRelatedMemo { where = append(where, "`attachment`.`memo_id` IS NOT NULL") } if len(find.Filters) > 0 { engine, err := filter.DefaultAttachmentEngine() if err != nil { return nil, errors.Wrap(err, "failed to get filter engine") } if err := filter.AppendConditions(ctx, engine, find.Filters, filter.DialectSQLite, &where, &args); err != nil { return nil, errors.Wrap(err, "failed to append filter conditions") } } if access := find.Access; access != nil { scopeClauses := []string{} if access.UserID != nil { scopeClauses = append(scopeClauses, "(`attachment`.`memo_id` IS NULL AND EXISTS (SELECT 1 FROM `user` AS `attachment_user` WHERE `attachment_user`.`id` = ? AND `attachment_user`.`row_status` = 'NORMAL') AND `attachment`.`creator_id` = ?)") args = append(args, *access.UserID, *access.UserID) } scopeClauses = append(scopeClauses, "(`attachment`.`memo_id` IS NOT NULL AND "+sqliteMemoAccessPredicate(access, "`memo`", "`attachment_member`", &args)+")") if len(scopeClauses) == 0 { where = append(where, "1 = 0") } else { where = append(where, "("+strings.Join(scopeClauses, " OR ")+")") } } fields := []string{ "`attachment`.`id` AS `id`", "`attachment`.`uid` AS `uid`", "`attachment`.`filename` AS `filename`", "`attachment`.`type` AS `type`", "`attachment`.`size` AS `size`", "`attachment`.`creator_id` AS `creator_id`", "`attachment`.`created_ts` AS `created_ts`", "`attachment`.`updated_ts` AS `updated_ts`", "`attachment`.`memo_id` AS `memo_id`", "`attachment`.`storage_type` AS `storage_type`", "`attachment`.`reference` AS `reference`", "`attachment`.`payload` AS `payload`", "CASE WHEN `memo`.`uid` IS NOT NULL THEN `memo`.`uid` ELSE NULL END AS `memo_uid`", } if find.GetBlob { fields = append(fields, "`attachment`.`blob` AS `blob`") } query := "SELECT " + strings.Join(fields, ", ") + " FROM `attachment`" + " " + "LEFT JOIN `memo` ON `attachment`.`memo_id` = `memo`.`id`" + " " + "LEFT JOIN `space` AS `attachment_space` ON `memo`.`space_id` = `attachment_space`.`id`" + " " + "WHERE " + strings.Join(where, " AND ") + " " + "ORDER BY `attachment`.`updated_ts` DESC" if find.Limit != nil { query = fmt.Sprintf("%s LIMIT %d", query, *find.Limit) if find.Offset != nil { query = fmt.Sprintf("%s OFFSET %d", query, *find.Offset) } } rows, err := d.db.QueryContext(ctx, query, args...) if err != nil { return nil, err } defer rows.Close() list := make([]*store.Attachment, 0) for rows.Next() { attachment := store.Attachment{} var memoID sql.NullInt32 var storageType string var payloadBytes []byte dests := []any{ &attachment.ID, &attachment.UID, &attachment.Filename, &attachment.Type, &attachment.Size, &attachment.CreatorID, &attachment.CreatedTs, &attachment.UpdatedTs, &memoID, &storageType, &attachment.Reference, &payloadBytes, &attachment.MemoUID, } if find.GetBlob { dests = append(dests, &attachment.Blob) } if err := rows.Scan(dests...); err != nil { return nil, err } if memoID.Valid { attachment.MemoID = &memoID.Int32 } attachment.StorageType = storepb.AttachmentStorageType(storepb.AttachmentStorageType_value[storageType]) payload := &storepb.AttachmentPayload{} if err := protojsonUnmarshaler.Unmarshal(payloadBytes, payload); err != nil { return nil, err } attachment.Payload = payload list = append(list, &attachment) } if err := rows.Err(); err != nil { return nil, err } return list, nil } func (d *DB) UpdateAttachment(ctx context.Context, update *store.UpdateAttachment) error { if update.Policy == nil { return applySQLiteAttachmentUpdate(ctx, d.db, update) } if update.MemoID != nil { return store.ErrMemoMutationConflict } attachmentIDs := []int32{update.ID} tx, err := d.db.BeginTx(ctx, nil) if err != nil { return err } defer func() { _ = tx.Rollback() }() attachments, err := listSQLiteAttachmentSnapshots(ctx, tx, attachmentIDs) if err != nil { return err } memoIDs, err := store.ValidateAttachmentMutationTargets(update.Policy.ActorUserID, attachmentIDs, attachments) if err != nil { return err } if err := authorizeSQLiteAttachmentMutation(ctx, tx, update.Policy.ActorUserID, memoIDs, nil); err != nil { return err } if err := applySQLiteAttachmentUpdate(ctx, tx, update); err != nil { return err } return tx.Commit() } func applySQLiteAttachmentUpdate(ctx context.Context, executor dbExecutor, update *store.UpdateAttachment) error { set, args := []string{}, []any{} if v := update.UID; v != nil { set, args = append(set, "`uid` = ?"), append(args, *v) } if v := update.UpdatedTs; v != nil { set, args = append(set, "`updated_ts` = ?"), append(args, *v) } if v := update.Filename; v != nil { set, args = append(set, "`filename` = ?"), append(args, *v) } if v := update.MemoID; v != nil { set, args = append(set, "`memo_id` = ?"), append(args, *v) } if v := update.Payload; v != nil { bytes, err := protojson.Marshal(v) if err != nil { return errors.Wrap(err, "failed to marshal attachment payload") } set, args = append(set, "`payload` = ?"), append(args, string(bytes)) } args = append(args, update.ID) stmt := "UPDATE `attachment` SET " + strings.Join(set, ", ") + " WHERE `id` = ?" if len(set) == 0 { return nil } result, err := executor.ExecContext(ctx, stmt, args...) if err != nil { return errors.Wrap(err, "failed to update attachment") } if _, err := result.RowsAffected(); err != nil { return err } return nil } func (d *DB) DeleteAttachment(ctx context.Context, delete *store.DeleteAttachment) error { return d.DeleteAttachments(ctx, []*store.DeleteAttachment{delete}) } func (d *DB) DeleteAttachments(ctx context.Context, deletes []*store.DeleteAttachment) error { if len(deletes) == 0 { return nil } tx, err := d.db.BeginTx(ctx, nil) if err != nil { return errors.Wrap(err, "failed to start attachment delete transaction") } defer func() { _ = tx.Rollback() }() stmt := "DELETE FROM `attachment` WHERE `id` = ?" for _, delete := range deletes { result, err := tx.ExecContext(ctx, stmt, delete.ID) if err != nil { return err } if _, err := result.RowsAffected(); err != nil { return err } } return tx.Commit() }