Files
pansy/internal/store/revisions.go
T
steveandClaude Opus 4.8 b4f3181aef
Build image / build-and-push (push) Successful in 14s
Gadfly review (reusable) / review (pull_request) Canceled after 12m47s
Adversarial Review (Gadfly) / review (pull_request) Canceled after 12m47s
Revision history: change sets, revisions, and revert (#48)
The undo substrate. The agent is going to act freely — "empty the garlic bed and
plant cucumbers" runs without a confirmation prompt — and that is only a
defensible default if the result is easy to roll back. So undo lands before the
agent write path, not after it.

The unit of undo is the OPERATION, not the row. A change set groups the
row-level revisions it produced; revert replays their inverses. Emptying a bed
and replanting it touches one object and many plantings, and undoing half of
that is worse than useless.

Two properties shape the rest:

Revert is itself a change set (reverts_id names its target), so history is
append-only and an undo can be undone. git revert, not git reset.

Revert is version-guarded per entity. Every snapshot carries the row's version;
if something edited that row after the change set being reverted, restoring the
old snapshot would silently discard the newer edit, so it is reported as a
conflict and left alone while the rest of the change set still reverts.

The auto-scope is what keeps this invasive but shallow. Service mutations call
record(), which joins the change set on the context if one is open and otherwise
opens a single-op one on the spot. REST handlers needed no edits at all and
every UI mutation lands in history for free; only the agent wraps a whole turn.
Multi-row operations (FillRegion, ClearObject) pass all their changes in one
record call, so a 12-plop fill is one change set with 12 revisions and one undo.

Revisions are buffered and written with their change set in a single
transaction, so an operation that fails partway leaves no half-recorded history.
Recording is best-effort after the fact: the row is already written, so failing
the caller there would report a failure that didn't happen and invite a
duplicate retry. A gap is logged loudly instead.

Two sharp edges handled explicitly rather than by luck:

Deleting an object cascades its plantings away at the FK level, where the
service never sees them. deleteObjectRecording snapshots them first, or the
delete would be listed in history and not actually be undoable.

Restoring deleted rows reuses their ids, and a restored plop needs its object
back first. planRevert runs three explicit passes — restore parents then
children, then updates, then delete created children before their parents —
instead of trusting reverse-seq ordering to happen to be right.

Garden deletion stays out of scope, as designed: the cascade is invisible to the
service and ON DELETE CASCADE would take the history with it. The history UI
will say so rather than pretend otherwise.

Closes #48

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ
2026-07-21 00:53:55 -04:00

193 lines
6.0 KiB
Go

package store
import (
"context"
"database/sql"
"errors"
"fmt"
"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
)
// changeSetColumns lists change_sets columns in the order scanChangeSet expects.
const changeSetColumns = `id, garden_id, actor_id, source, summary, agent_run_id, reverts_id, created_at`
func scanChangeSet(s scanner) (*domain.ChangeSet, error) {
var cs domain.ChangeSet
if err := s.Scan(
&cs.ID, &cs.GardenID, &cs.ActorID, &cs.Source, &cs.Summary,
&cs.AgentRunID, &cs.RevertsID, &cs.CreatedAt,
); err != nil {
return nil, err
}
return &cs, nil
}
// revisionColumns lists revisions columns in the order scanRevision expects.
const revisionColumns = `id, change_set_id, seq, entity_type, entity_id, op, before, after`
func scanRevision(s scanner) (*domain.Revision, error) {
var r domain.Revision
if err := s.Scan(
&r.ID, &r.ChangeSetID, &r.Seq, &r.EntityType, &r.EntityID, &r.Op, &r.Before, &r.After,
); err != nil {
return nil, err
}
return &r, nil
}
// WriteChangeSet inserts a change set and all of its revisions in one
// transaction, so history never records half an operation. The service buffers
// revisions while the operation runs and calls this once it has succeeded —
// which is also why an operation that fails partway leaves no change set behind.
// seq is assigned from the slice order. Returns the stored change set.
func (d *DB) WriteChangeSet(ctx context.Context, cs *domain.ChangeSet, revs []domain.Revision) (*domain.ChangeSet, error) {
tx, err := d.sql.BeginTx(ctx, nil)
if err != nil {
return nil, fmt.Errorf("store: begin change set: %w", err)
}
defer func() { _ = tx.Rollback() }()
created, err := scanChangeSet(tx.QueryRowContext(ctx,
`INSERT INTO change_sets (garden_id, actor_id, source, summary, agent_run_id, reverts_id)
VALUES (?, ?, ?, ?, ?, ?)
RETURNING `+changeSetColumns,
cs.GardenID, cs.ActorID, cs.Source, cs.Summary, cs.AgentRunID, cs.RevertsID))
if err != nil {
return nil, fmt.Errorf("store: insert change set: %w", err)
}
for i := range revs {
r := &revs[i]
if _, err := tx.ExecContext(ctx,
`INSERT INTO revisions (change_set_id, seq, entity_type, entity_id, op, before, after)
VALUES (?, ?, ?, ?, ?, ?, ?)`,
created.ID, int64(i+1), r.EntityType, r.EntityID, r.Op, r.Before, r.After,
); err != nil {
return nil, fmt.Errorf("store: insert revision: %w", err)
}
}
if err := tx.Commit(); err != nil {
return nil, fmt.Errorf("store: commit change set: %w", err)
}
return created, nil
}
// ListChangeSets returns a garden's change sets newest-first, one page at a time.
// Each carries its actor's display name, the id of the change set that reverted
// it (if any), and per-(entity,op) counts — everything the history list renders,
// without a second round-trip per row. Always a non-nil slice.
func (d *DB) ListChangeSets(ctx context.Context, gardenID int64, limit, offset int) ([]domain.ChangeSet, error) {
rows, err := d.sql.QueryContext(ctx,
`SELECT `+qualifyColumns("cs", changeSetColumns)+`, u.display_name, rev.id
FROM change_sets cs
JOIN users u ON u.id = cs.actor_id
LEFT JOIN change_sets rev ON rev.reverts_id = cs.id
WHERE cs.garden_id = ?
ORDER BY cs.id DESC
LIMIT ? OFFSET ?`,
gardenID, limit, offset)
if err != nil {
return nil, fmt.Errorf("store: list change sets: %w", err)
}
defer rows.Close()
sets := []domain.ChangeSet{}
ids := []any{}
byID := map[int64]int{}
for rows.Next() {
var cs domain.ChangeSet
if err := rows.Scan(
&cs.ID, &cs.GardenID, &cs.ActorID, &cs.Source, &cs.Summary,
&cs.AgentRunID, &cs.RevertsID, &cs.CreatedAt, &cs.ActorName, &cs.RevertedByID,
); err != nil {
return nil, fmt.Errorf("store: scan change set: %w", err)
}
byID[cs.ID] = len(sets)
ids = append(ids, cs.ID)
sets = append(sets, cs)
}
if err := rows.Err(); err != nil {
return nil, fmt.Errorf("store: iterate change sets: %w", err)
}
if len(sets) == 0 {
return sets, nil
}
// One grouped query for the whole page rather than N per-row counts.
countRows, err := d.sql.QueryContext(ctx,
`SELECT change_set_id, entity_type, op, COUNT(*)
FROM revisions
WHERE change_set_id IN (`+placeholders(len(ids))+`)
GROUP BY change_set_id, entity_type, op
ORDER BY change_set_id, entity_type, op`,
ids...)
if err != nil {
return nil, fmt.Errorf("store: count revisions: %w", err)
}
defer countRows.Close()
for countRows.Next() {
var csID int64
var c domain.ChangeCount
if err := countRows.Scan(&csID, &c.EntityType, &c.Op, &c.N); err != nil {
return nil, fmt.Errorf("store: scan revision count: %w", err)
}
if i, ok := byID[csID]; ok {
sets[i].Counts = append(sets[i].Counts, c)
}
}
if err := countRows.Err(); err != nil {
return nil, fmt.Errorf("store: iterate revision counts: %w", err)
}
return sets, nil
}
// GetChangeSet returns one change set with its revisions loaded in seq order, or
// domain.ErrNotFound.
func (d *DB) GetChangeSet(ctx context.Context, id int64) (*domain.ChangeSet, error) {
cs, err := scanChangeSet(d.sql.QueryRowContext(ctx,
`SELECT `+changeSetColumns+` FROM change_sets WHERE id = ?`, id))
if errors.Is(err, sql.ErrNoRows) {
return nil, domain.ErrNotFound
}
if err != nil {
return nil, fmt.Errorf("store: get change set: %w", err)
}
rows, err := d.sql.QueryContext(ctx,
`SELECT `+revisionColumns+` FROM revisions WHERE change_set_id = ? ORDER BY seq`, id)
if err != nil {
return nil, fmt.Errorf("store: list revisions: %w", err)
}
defer rows.Close()
cs.Revisions = []domain.Revision{}
for rows.Next() {
r, err := scanRevision(rows)
if err != nil {
return nil, fmt.Errorf("store: scan revision: %w", err)
}
cs.Revisions = append(cs.Revisions, *r)
}
if err := rows.Err(); err != nil {
return nil, fmt.Errorf("store: iterate revisions: %w", err)
}
return cs, nil
}
// placeholders returns "?, ?, …" for an IN clause of n values.
func placeholders(n int) string {
if n <= 0 {
return "NULL"
}
b := make([]byte, 0, n*3)
for i := 0; i < n; i++ {
if i > 0 {
b = append(b, ',', ' ')
}
b = append(b, '?')
}
return string(b)
}