lib.rs

//! McpMux Storage Layer
//!
//! SQLite database with field-level encryption for sensitive data.
//!
//! # Architecture
//!
//! ```text
//! ┌──────────────────────────────────────────────────────┐
//! │                    Application                       │
//! ├──────────────────────────────────────────────────────┤
//! │               Repository Traits                      │
//! │        (SpaceRepository, CredentialRepository, etc.) │
//! ├──────────────────────────────────────────────────────┤
//! │            SQLite Implementations                    │
//! │    (SqliteSpaceRepository, SqliteCredentialRepo)     │
//! ├──────────────────────────────────────────────────────┤
//! │         FieldEncryptor (AES-256-GCM)                 │
//! │        (Encrypts tokens/credentials)                 │
//! ├──────────────────────────────────────────────────────┤
//! │    DpapiKeyProvider (Windows) / KeychainKeyProvider   │
//! │    (DPAPI file storage / OS Keychain)                 │
//! ├──────────────────────────────────────────────────────┤
//! │                   Database                           │
//! │                   (SQLite)                           │
//! └──────────────────────────────────────────────────────┘
//! ```
//!
//! # Usage
//!
//! ```rust,ignore
//! use mcpmux_storage::{
//!     Database, SqliteSpaceRepository, SqliteCredentialRepository,
//!     FieldEncryptor, MasterKeyProvider,
//! };
//! use std::sync::Arc;
//! use tokio::sync::Mutex;
//!
//! // Get master key (DPAPI on Windows, OS Keychain elsewhere)
//! let key_provider = mcpmux_storage::create_key_provider(&data_dir)?;
//! let master_key = key_provider.get_or_create_key()?;
//!
//! // Open database
//! let db = Database::open(&path)?;
//! let db = Arc::new(Mutex::new(db));
//!
//! // Create encryptor for sensitive fields
//! let encryptor = Arc::new(FieldEncryptor::new(&master_key)?);
//!
//! // Create repositories
//! let space_repo = SqliteSpaceRepository::new(db.clone());
//! let credential_repo = SqliteCredentialRepository::new(db.clone(), encryptor);
//! ```

pub mod crypto;
mod database;
pub mod keychain;
#[cfg(windows)]
pub mod keychain_dpapi;
#[cfg(not(windows))]
pub mod keychain_file;
mod repositories;

pub use crypto::{generate_master_key, FieldEncryptor, KEY_SIZE};
pub use database::Database;
pub use keychain::{
    generate_jwt_secret, JwtSecretProvider, KeychainJwtSecretProvider, KeychainKeyProvider,
    MasterKeyProvider, JWT_SECRET_SIZE,
};
#[cfg(windows)]
pub use keychain_dpapi::{DpapiJwtSecretProvider, DpapiKeyProvider};
#[cfg(not(windows))]
pub use keychain_file::{FileJwtSecretProvider, FileKeyProvider};
pub use repositories::*;

/// Default database file name.
pub const DATABASE_FILE: &str = "mcpmux.db";

/// Get the default database path for the current platform.
pub fn default_database_path() -> Option<std::path::PathBuf> {
    dirs::data_local_dir().map(|p| p.join("mcpmux").join(DATABASE_FILE))
}

/// Create the platform-appropriate master key provider.
///
/// - **Windows**: Uses DPAPI file-based storage (key not visible in Credential Manager UI).
///   Also migrates existing keys from Credential Manager on first use.
/// - **macOS/Linux**: Uses the OS keychain (Keychain / Secret Service).
pub fn create_key_provider(
    data_dir: &std::path::Path,
) -> anyhow::Result<Box<dyn MasterKeyProvider>> {
    #[cfg(windows)]
    {
        // Migrate any existing keys from Credential Manager to DPAPI files
        if let Err(e) = keychain_dpapi::migrate_from_credential_manager(data_dir) {
            tracing::warn!("Credential Manager migration encountered an error: {}", e);
        }
        Ok(Box::new(DpapiKeyProvider::new(data_dir)?))
    }

    #[cfg(not(windows))]
    {
        // Try OS keychain first, fall back to file-based storage if unavailable
        match KeychainKeyProvider::new() {
            Ok(provider) => match provider.get_or_create_key() {
                Ok(_) => return Ok(Box::new(provider)),
                Err(e) => tracing::warn!(
                    "OS keychain unavailable ({e}), using file-based key storage. \
                     For better security, install gnome-keyring or another Secret Service provider."
                ),
            },
            Err(e) => {
                tracing::warn!("OS keychain unavailable ({e}), using file-based key storage.")
            }
        }
        Ok(Box::new(FileKeyProvider::new(data_dir)?))
    }
}

/// Create the platform-appropriate JWT secret provider.
///
/// - **Windows**: Uses DPAPI file-based storage.
/// - **macOS/Linux**: Uses the OS keychain, with file-based fallback if unavailable.
pub fn create_jwt_secret_provider(
    data_dir: &std::path::Path,
) -> anyhow::Result<Box<dyn JwtSecretProvider>> {
    #[cfg(windows)]
    {
        Ok(Box::new(DpapiJwtSecretProvider::new(data_dir)?))
    }

    #[cfg(not(windows))]
    {
        match KeychainJwtSecretProvider::new() {
            Ok(provider) => match provider.get_or_create_secret() {
                Ok(_) => return Ok(Box::new(provider)),
                Err(e) => tracing::warn!(
                    "OS keychain unavailable for JWT secret ({e}), using file-based storage."
                ),
            },
            Err(e) => tracing::warn!(
                "OS keychain unavailable for JWT secret ({e}), using file-based storage."
            ),
        }
        Ok(Box::new(FileJwtSecretProvider::new(data_dir)?))
    }
}