parsav  Diff

			select (pg_temp.parsavpg_translate_actor(a)).*,

			       au.restrict,
						array['post'    ] <@ au.restrict,
						array['edit'    ] <@ au.restrict,
						array['account' ] <@ au.restrict,
						array['upload'  ] <@ au.restrict,

						array['moderate'] <@ au.restrict,
						array['admin'   ] <@ au.restrict


			from      parsav_auth au
			left join parsav_actors a     on au.uid = a.id

			where au.aid = $1::bigint and au.blacklist = false and
				(au.netmask is null or au.netmask >> $2::inet) and
				($3::bigint = 0 or --slightly abusing the epoch time fmt here, but
................................................................................
			update parsav_actors set
				authtime = $2::bigint
				where id = $1::bigint
		]];
	};

	auth_create_pw = {
		params = {uint64, binblob, int64, pstring}, cmd = true, sql = [[
			insert into parsav_auth (uid, name, kind, cred, valperiod, comment) values (
				$1::bigint,
				(select handle from parsav_actors where id = $1::bigint),
				'pw-sha256', $2::bytea,
				$3::bigint, $4::text



			)



		]]
	};







	auth_purge_type = {
		params = {rawstring, uint64, rawstring}, cmd = true, sql = [[
			delete from parsav_auth where
				((uid = 0 and name = $1::text) or uid = $2::bigint) and
				kind like $3::text
		]]
	};







	auth_enum_uid = {
		params = {uint64}, sql = [[
			select aid, kind, comment, netmask, blacklist from parsav_auth where uid = $1::bigint
		]];
	};

................................................................................
		params = {uint64, uint64, pstring}, cmd = true, sql = [[
			delete from parsav_acts where
				actor = $1::bigint and
				subject = $2::bigint and
				kind = $3::text
		]];
	};







	post_reacts_fetch_uid = {
		params = {uint64, uint64, pstring}, sql = [[
			select id, actor, subject, kind, body, time from parsav_acts where
				($1::bigint = 0 or actor   = $1::bigint) and
				($2::bigint = 0 or subject = $2::bigint) and
				($3::text is null or kind  = $3::text  )
		]]








	};

	post_enum_author_uid = {
		params = {uint64,uint64,uint64,uint64, uint64}, sql = [[
			select (c.post).*
			from pg_temp.parsavpg_known_content as c

................................................................................
		a.ptr.key = r:bin(row,8)
	end
	a.ptr.origin = origin
	if avia.buf ~= nil then avia:free() end
	return a
end

local privmap = lib.store.privmap

local checksha = function(src, hash, origin, username, pw)
	local validate = function(kind, cred, credlen)
		return quote 
			var r = queries.actor_auth_pw.exec(
				[&lib.store.source](src),
				username,
................................................................................
local privupdate = terra(
	src: &lib.store.source,
	ac: &lib.store.actor
): {}
	var pdef: lib.store.powerset pdef:clear()
	var map = array([privmap])
	for i=0, [map.type.N] do
		var d = pdef and map[i].priv
		var u = ac.rights.powers and map[i].priv
		queries.actor_power_delete.exec(src, ac.id, map[i].name)
		if d:sz() > 0 and u:sz() == 0 then
			lib.dbg('blocking power ', {map[i].name.ptr, map[i].name.ct})
			queries.actor_power_insert.exec(src, ac.id, map[i].name, 0)
		elseif d:sz() == 0 and u:sz() > 0 then
			lib.dbg('granting power ', {map[i].name.ptr, map[i].name.ct})
			queries.actor_power_insert.exec(src, ac.id, map[i].name, 1)
................................................................................
	var r = queries.actor_powers_fetch.exec(src, uid)

	for i=0, r.sz do
		for j=0, [map.type.N] do
			var pn = r:_string(i,0)
			if map[j].name:cmp(pn) then
				if r:bool(i,1)
					then powers = powers + map[j].priv
					else powers = powers - map[j].priv
				end
			end
		end
	end

	return powers
end
................................................................................

			var a = row_to_actor(&r, 0)
			a.ptr.source = src

			var au = [lib.stat(lib.store.auth)] { ok = true }
			au.val.aid = aid
			au.val.uid = a.ptr.id
			if not r:null(0,13) then -- restricted?
				au.val.privs:clear()
				(au.val.privs.post    << r:bool(0,14)) 
				(au.val.privs.edit    << r:bool(0,15))
				(au.val.privs.account << r:bool(0,16))
				(au.val.privs.upload  << r:bool(0,17))

				(au.val.privs.moderate<< r:bool(0,18))
				(au.val.privs.admin   << r:bool(0,19))

			else au.val.privs:fill() end

			return au, a
		end

		::fail:: return [lib.stat   (lib.store.auth) ] { ok = false        },
			            [lib.mem.ptr(lib.store.actor)] { ptr = nil, ct = 0 }
................................................................................
		var r = queries.post_fetch.exec(src, post)
		if r.sz == 0 then return [lib.mem.ptr(lib.store.post)].null() end
		var p = row_to_post(&r, 0)
		p.ptr.source = src
		return p
	end];






	post_retweet = [terra(
		src: &lib.store.source,
		uid: uint64,
		post: uint64,
		undo: bool
	): {}
		var time = lib.osclock.time(nil)
		if not undo then

			queries.post_react_simple.exec(src,uid,post,"rt",time)
		else
			queries.post_react_cancel.exec(src,uid,post,"rt")
		end
	end];
	post_like = [terra(
		src: &lib.store.source,
................................................................................

	auth_attach_pw = [terra(
		src: &lib.store.source,
		uid: uint64,
		reset: bool,
		pw: pstring,
		comment: pstring
	): {}
		var hash: uint8[lib.crypt.algsz.sha256]
		if lib.md.mbedtls_md(lib.md.mbedtls_md_info_from_type(lib.crypt.alg.sha256.id),
			[&uint8](pw.ptr), pw.ct, &hash[0]) ~= 0 then
			lib.bail('cannot hash password')
		end
		if reset then queries.auth_purge_type.exec(src, nil, uid, 'pw-%') end
		queries.auth_create_pw.exec(src, uid, binblob {ptr = &hash[0], ct = [hash.type.N]}, lib.osclock.time(nil), comment)



















	end];

	auth_purge_pw = [terra(src: &lib.store.source, uid: uint64, handle: rawstring): {}
		queries.auth_purge_type.exec(src, handle, uid, 'pw-%')
	end];

	auth_purge_otp = [terra(src: &lib.store.source, uid: uint64, handle: rawstring): {}
................................................................................
			post.id, post.chgcount, post.edited,
			post.subject, post.acl, post.body)
	end];

	post_enum_parent = [terra(
		src: &lib.store.source,
		post: uint64
	): lib.mem.ptr(lib.mem.ptr(lib.store.post))
		var r = queries.post_enum_parent.exec(src,post)
		if r.sz == 0 then
			return [lib.mem.ptr(lib.mem.ptr(lib.store.post))].null()
		end
		defer r:free()
		var lst = lib.mem.heapa([lib.mem.ptr(lib.store.post)], r.sz)

		for i=0, r.sz do lst.ptr[i] = row_to_post(&r, i) end

		return lst
	end];






















	thread_latest_arrival_calc = [terra(
		src: &lib.store.source,
		post: uint64
	): lib.store.timepoint
		var r = queries.thread_latest_arrival_calc.exec(src,post)
		if r.sz == 0 or r:null(0,0) then return 0 end

			select (pg_temp.parsavpg_translate_actor(a)).*,

			       au.restrict,
						array['post'    ] <@ au.restrict,
						array['edit'    ] <@ au.restrict,
						array['account' ] <@ au.restrict,
						array['upload'  ] <@ au.restrict,
						array['artifact'] <@ au.restrict,
						array['moderate'] <@ au.restrict,
						array['admin'   ] <@ au.restrict,
						array['invite'  ] <@ au.restrict

			from      parsav_auth au
			left join parsav_actors a     on au.uid = a.id

			where au.aid = $1::bigint and au.blacklist = false and
				(au.netmask is null or au.netmask >> $2::inet) and
				($3::bigint = 0 or --slightly abusing the epoch time fmt here, but
................................................................................
			update parsav_actors set
				authtime = $2::bigint
				where id = $1::bigint
		]];
	};

	auth_create_pw = {
		params = {uint64, binblob, int64, pstring}, sql = [[
			insert into parsav_auth (uid, name, kind, cred, valperiod, comment) values (
				$1::bigint,
				(select handle from parsav_actors where id = $1::bigint),
				'pw-sha256', $2::bytea,
				$3::bigint, $4::text
			) on conflict (name,kind,cred) do update set comment = $4::text returning aid
		]]
	};

	auth_privs_clear = {
		params = {uint64}, cmd = true, sql = [[
			update parsav_auth set restrict = array[]::text[] where aid = $1::bigint
		]];
	};

	auth_priv_install = {
		params = {uint64,pstring}, cmd = true, sql = [[
			update parsav_auth set restrict = restrict || $2::text where aid = $1::bigint
		]];
	};

	auth_purge_type = {
		params = {rawstring, uint64, rawstring}, cmd = true, sql = [[
			delete from parsav_auth where
				((uid = 0 and name = $1::text) or uid = $2::bigint) and
				kind like $3::text
		]]
	};

	auth_purge_aid = {
		params = {uint64}, cmd = true, sql = [[
			delete from parsav_auth where aid = $1::bigint
		]]
	};

	auth_enum_uid = {
		params = {uint64}, sql = [[
			select aid, kind, comment, netmask, blacklist from parsav_auth where uid = $1::bigint
		]];
	};

................................................................................
		params = {uint64, uint64, pstring}, cmd = true, sql = [[
			delete from parsav_acts where
				actor = $1::bigint and
				subject = $2::bigint and
				kind = $3::text
		]];
	};

	post_react_delete = {
		params = {uint64}, cmd = true, sql = [[
			delete from parsav_acts where id = $1::bigint
		]];
	};

	post_reacts_fetch_uid = {
		params = {uint64, uint64, pstring}, sql = [[
			select id, actor, subject, kind, body, time from parsav_acts where
				($1::bigint = 0 or actor   = $1::bigint) and
				($2::bigint = 0 or subject = $2::bigint) and
				($3::text is null or kind  = $3::text  )
		]];
	};

	post_act_fetch_notice = {
		params = {uint64}, sql = [[
			select (pg_temp.parsavpg_translate_act(a)).*
			from parsav_acts as a
				where id = $1::bigint
		]];
	};

	post_enum_author_uid = {
		params = {uint64,uint64,uint64,uint64, uint64}, sql = [[
			select (c.post).*
			from pg_temp.parsavpg_known_content as c

................................................................................
		a.ptr.key = r:bin(row,8)
	end
	a.ptr.origin = origin
	if avia.buf ~= nil then avia:free() end
	return a
end

local privmap = lib.store.powmap

local checksha = function(src, hash, origin, username, pw)
	local validate = function(kind, cred, credlen)
		return quote 
			var r = queries.actor_auth_pw.exec(
				[&lib.store.source](src),
				username,
................................................................................
local privupdate = terra(
	src: &lib.store.source,
	ac: &lib.store.actor
): {}
	var pdef: lib.store.powerset pdef:clear()
	var map = array([privmap])
	for i=0, [map.type.N] do
		var d = pdef and map[i].val
		var u = ac.rights.powers and map[i].val
		queries.actor_power_delete.exec(src, ac.id, map[i].name)
		if d:sz() > 0 and u:sz() == 0 then
			lib.dbg('blocking power ', {map[i].name.ptr, map[i].name.ct})
			queries.actor_power_insert.exec(src, ac.id, map[i].name, 0)
		elseif d:sz() == 0 and u:sz() > 0 then
			lib.dbg('granting power ', {map[i].name.ptr, map[i].name.ct})
			queries.actor_power_insert.exec(src, ac.id, map[i].name, 1)
................................................................................
	var r = queries.actor_powers_fetch.exec(src, uid)

	for i=0, r.sz do
		for j=0, [map.type.N] do
			var pn = r:_string(i,0)
			if map[j].name:cmp(pn) then
				if r:bool(i,1)
					then powers = powers + map[j].val
					else powers = powers - map[j].val
				end
			end
		end
	end

	return powers
end
................................................................................

			var a = row_to_actor(&r, 0)
			a.ptr.source = src

			var au = [lib.stat(lib.store.auth)] { ok = true }
			au.val.aid = aid
			au.val.uid = a.ptr.id
			if not r:null(0,14) then -- restricted?
				au.val.privs:clear()
				(au.val.privs.post    << r:bool(0,15)) 
				(au.val.privs.edit    << r:bool(0,16))
				(au.val.privs.account << r:bool(0,17))
				(au.val.privs.upload  << r:bool(0,18))
				(au.val.privs.artifact<< r:bool(0,19))
				(au.val.privs.moderate<< r:bool(0,20))
				(au.val.privs.admin   << r:bool(0,21))
				(au.val.privs.invite  << r:bool(0,22))
			else au.val.privs:fill() end

			return au, a
		end

		::fail:: return [lib.stat   (lib.store.auth) ] { ok = false        },
			            [lib.mem.ptr(lib.store.actor)] { ptr = nil, ct = 0 }
................................................................................
		var r = queries.post_fetch.exec(src, post)
		if r.sz == 0 then return [lib.mem.ptr(lib.store.post)].null() end
		var p = row_to_post(&r, 0)
		p.ptr.source = src
		return p
	end];

	post_act_cancel = [terra(
		src: &lib.store.source,
		act: uint64
	): {} queries.post_react_delete.exec(src, act) end];

	post_retweet = [terra(
		src: &lib.store.source,
		uid: uint64,
		post: uint64,
		undo: bool
	): {}

		if not undo then
			var time = lib.osclock.time(nil)
			queries.post_react_simple.exec(src,uid,post,"rt",time)
		else
			queries.post_react_cancel.exec(src,uid,post,"rt")
		end
	end];
	post_like = [terra(
		src: &lib.store.source,
................................................................................

	auth_attach_pw = [terra(
		src: &lib.store.source,
		uid: uint64,
		reset: bool,
		pw: pstring,
		comment: pstring
	): uint64
		var hash: uint8[lib.crypt.algsz.sha256]
		if lib.md.mbedtls_md(lib.md.mbedtls_md_info_from_type(lib.crypt.alg.sha256.id),
			[&uint8](pw.ptr), pw.ct, &hash[0]) ~= 0 then
			lib.bail('cannot hash password')
		end
		if reset then queries.auth_purge_type.exec(src, nil, uid, 'pw-%') end
		var r = queries.auth_create_pw.exec(src, uid, binblob {ptr = &hash[0], ct = [hash.type.N]}, lib.osclock.time(nil), comment)
		if r.sz == 0 then return 0 end
		var aid = r:int(uint64,0,0)
		r:free()
		return aid
	end];

	auth_privs_set = [terra(
		src: &lib.store.source,
		aid: uint64,
		set: lib.store.privset
	): {}
		var map = array([lib.store.privmap])
		queries.auth_privs_clear.exec(src,aid)
		if set:sz() == 0 then return end
		for i=0, [map.type.N] do
			if (set and map[i].val):sz() > 0 then
				queries.auth_priv_install.exec(src,aid,map[i].name)
			end
		end
	end];

	auth_purge_pw = [terra(src: &lib.store.source, uid: uint64, handle: rawstring): {}
		queries.auth_purge_type.exec(src, handle, uid, 'pw-%')
	end];

	auth_purge_otp = [terra(src: &lib.store.source, uid: uint64, handle: rawstring): {}
................................................................................
			post.id, post.chgcount, post.edited,
			post.subject, post.acl, post.body)
	end];

	post_enum_parent = [terra(
		src: &lib.store.source,
		post: uint64
	): lib.mem.lstptr(lib.store.post)
		var r = queries.post_enum_parent.exec(src,post)
		if r.sz == 0 then
			return [lib.mem.ptr(lib.mem.ptr(lib.store.post))].null()
		end
		defer r:free()
		var lst = lib.mem.heapa([lib.mem.ptr(lib.store.post)], r.sz)

		for i=0, r.sz do lst.ptr[i] = row_to_post(&r, i) end

		return lst
	end];

	post_act_fetch_notice = [terra(
		src: &lib.store.source,
		act: uint64
	): lib.store.notice
		var r = queries.post_act_fetch_notice.exec(src,act)
		if r.sz == 0 then return lib.store.notice { kind = lib.store.noticetype.none } end
		defer r:free()
		
		var n: lib.store.notice
		n.kind = r:int(uint16,0,0)
		n.when = r:int(int64,0,1)
		n.who = r:int(int64,0,2)
		n.what = r:int(uint64,0,3)
		if n.kind == lib.store.noticetype.react then
			var react = r:_string(0,5)
			lib.str.ncpy(n.reaction, react.ptr, lib.math.smallest(react.ct,[(`n.reaction).tree.type.N]))
		end

		return n
	end];

	thread_latest_arrival_calc = [terra(
		src: &lib.store.source,
		post: uint64
	): lib.store.timepoint
		var r = queries.thread_latest_arrival_calc.exec(src,post)
		if r.sz == 0 or r:null(0,0) then return 0 end