feat: add libSQL/Turso embedded database backend (#47)

* feat: add libSQL/Turso database backend with full feature parity Introduce a Database trait abstraction (~60 async methods) enabling compile-time backend selection between PostgreSQL and libSQL/Turso. Convert all modules from concrete Store to Arc<dyn Database>, add LibSqlSecretsStore and LibSqlWasmToolStore implementations, wire libsql stores throughout CLI and main entry points, and make the setup wizard backend-agnostic. Key changes: - src/db/: Database trait, PostgresDatabase adapter, LibSqlBackend with native SQLite-dialect SQL, and idempotent migration system - src/secrets/store.rs: LibSqlSecretsStore (all 8 trait methods) - src/tools/wasm/storage.rs: LibSqlWasmToolStore (all 7 trait methods) - src/main.rs, cli/tool.rs, cli/mcp.rs: backend-conditional wiring - src/setup/channels.rs: SecretsContext uses Arc<dyn SecretsStore> - Feature-gate postgres-only tests and examples Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: enable onboarding wizard for libSQL builds Refactor the setup wizard to work with both postgres and libsql feature flags. Previously the wizard was gated behind #[cfg(feature = "postgres")] only, so libsql-only builds would print an error on `ironclaw onboard`. - Add libsql fields to Settings (database_backend, libsql_path, libsql_url) - Split wizard database/migration/secrets methods into feature-gated variants - Add step_database_libsql() with local path and Turso remote replica prompts - Update setup/mod.rs and main.rs feature gates to any(postgres, libsql) - Extend check_onboard_needed() to detect libsql database presence Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address PR review feedback for libSQL backend - P0: Switch libsql_backend to connection-per-operation pattern to fix shared Connection concurrency issue across tokio tasks - P0: Wrap secrets store INSERT+SELECT in transaction to fix TOCTOU race - P0: Document encryption-at-rest limitations and json_patch divergence - P1: Fix get_opt_text removing .filter(|s| !s.is_empty()) that conflated empty strings with NULL - P1: Replace datetime('now') with fmt_ts(&Utc::now()) for consistent RFC 3339 timestamps across all queries - P2: Use explicit _rowid column in FTS5 triggers and joins for stability across VACUUM operations - P2: Add tracing::warn when embedding provided but vector search disabled in hybrid_search - Extract shared connect_from_config() helper to deduplicate DB connection logic across main.rs, cli/config.rs, and cli/mcp.rs Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: add missing JobContext fields and resolve fmt/clippy warnings Add total_tokens_used and max_tokens fields to JobContext in libsql_backend.rs, apply cargo fmt, and fix clippy warnings. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: review fixes for libSQL backend (shared connections, panics, indexes) - Replace .expect() with proper error propagation in 3 call sites - Share Arc<Database> between backend and stores instead of single Connection - Add connect-per-operation pattern to LibSqlSecretsStore and LibSqlWasmToolStore - Wrap store() INSERT + SELECT-back in a transaction - Add ~22 missing indexes for parity with PostgreSQL schema - Add 18 leak_detection_patterns seed rows matching PostgreSQL V2 migration - Fix super:: import to use crate:: style - Gate mask_password_in_url behind #[cfg(feature = "postgres")] - Rewrite secrets store init with or_else chain for runtime backend selection Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: Resolve clippy lints (collapsible_if, too_many_arguments) Collapse nested if blocks into let_chains to satisfy clippy's collapsible_if lint (CI uses -D warnings). Suppress too_many_arguments on libsql_row_to_tool_at since refactoring the positional index pattern would be a larger change. Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]> Co-authored-by: Illia Polosukhin <[email protected]>
2026-08-27 08:00:17 +00:00 · 2026-02-14 02:05:05 +00:00
parent 54e9206f0b
commit e843c18141
45 changed files with 6973 additions and 321 deletions
@@ -1,7 +1,9 @@
 //! Configuration management CLI commands.
 //!
 //! Commands for viewing and modifying settings.
-//! Settings are stored in PostgreSQL (env > DB > default).
+//! Settings are stored in the database (env > DB > default).
+
+use std::sync::Arc;

 use clap::Subcommand;

@@ -49,8 +51,8 @@ pub async fn run_config_command(cmd: ConfigCommand) -> anyhow::Result<()> {
    let _ = dotenvy::dotenv();

    // Try to connect to the DB for settings access
-    let store = match connect_store().await {
-        Ok(s) => Some(s),
+    let db: Option<Arc<dyn crate::db::Database>> = match connect_db().await {
+        Ok(d) => Some(d),
        Err(e) => {
            eprintln!(
                "Warning: Could not connect to database ({}), using disk fallback",
@@ -60,29 +62,30 @@ pub async fn run_config_command(cmd: ConfigCommand) -> anyhow::Result<()> {
        }
    };

+    let db_ref = db.as_deref();
    match cmd {
-        ConfigCommand::List { filter } => list_settings(store.as_ref(), filter).await,
-        ConfigCommand::Get { path } => get_setting(store.as_ref(), &path).await,
-        ConfigCommand::Set { path, value } => set_setting(store.as_ref(), &path, &value).await,
-        ConfigCommand::Reset { path } => reset_setting(store.as_ref(), &path).await,
-        ConfigCommand::Path => show_path(store.is_some()),
+        ConfigCommand::List { filter } => list_settings(db_ref, filter).await,
+        ConfigCommand::Get { path } => get_setting(db_ref, &path).await,
+        ConfigCommand::Set { path, value } => set_setting(db_ref, &path, &value).await,
+        ConfigCommand::Reset { path } => reset_setting(db_ref, &path).await,
+        ConfigCommand::Path => show_path(db_ref.is_some()),
    }
 }

-/// Bootstrap a DB connection for config commands.
-async fn connect_store() -> anyhow::Result<crate::history::Store> {
+/// Bootstrap a DB connection for config commands (backend-agnostic).
+async fn connect_db() -> anyhow::Result<Arc<dyn crate::db::Database>> {
    let config = crate::config::Config::from_env()
        .await
        .map_err(|e| anyhow::anyhow!("{}", e))?;
-    let store = crate::history::Store::new(&config.database).await?;
-    store.run_migrations().await?;
-    Ok(store)
+    crate::db::connect_from_config(&config.database)
+        .await
+        .map_err(|e| anyhow::anyhow!("{}", e))
 }

 const DEFAULT_USER_ID: &str = "default";

 /// Load settings: DB if available, else disk.
-async fn load_settings(store: Option<&crate::history::Store>) -> Settings {
+async fn load_settings(store: Option<&dyn crate::db::Database>) -> Settings {
    if let Some(store) = store {
        match store.get_all_settings(DEFAULT_USER_ID).await {
            Ok(map) if !map.is_empty() => return Settings::from_db_map(&map),
@@ -94,7 +97,7 @@ async fn load_settings(store: Option<&crate::history::Store>) -> Settings {

 /// List all settings.
 async fn list_settings(
-    store: Option<&crate::history::Store>,
+    store: Option<&dyn crate::db::Database>,
    filter: Option<String>,
 ) -> anyhow::Result<()> {
    let settings = load_settings(store).await;
@@ -126,7 +129,7 @@ async fn list_settings(
 }

 /// Get a specific setting.
-async fn get_setting(store: Option<&crate::history::Store>, path: &str) -> anyhow::Result<()> {
+async fn get_setting(store: Option<&dyn crate::db::Database>, path: &str) -> anyhow::Result<()> {
    let settings = load_settings(store).await;

    match settings.get(path) {
@@ -142,7 +145,7 @@ async fn get_setting(store: Option<&crate::history::Store>, path: &str) -> anyho

 /// Set a setting value.
 async fn set_setting(
-    store: Option<&crate::history::Store>,
+    store: Option<&dyn crate::db::Database>,
    path: &str,
    value: &str,
 ) -> anyhow::Result<()> {
@@ -171,7 +174,7 @@ async fn set_setting(
 }

 /// Reset a setting to default.
-async fn reset_setting(store: Option<&crate::history::Store>, path: &str) -> anyhow::Result<()> {
+async fn reset_setting(store: Option<&dyn crate::db::Database>, path: &str) -> anyhow::Result<()> {
    let default = Settings::default();
    let default_value = default
        .get(path)
@@ -196,7 +199,7 @@ async fn reset_setting(store: Option<&crate::history::Store>, path: &str) -> any
 /// Show the settings storage info.
 fn show_path(has_db: bool) -> anyhow::Result<()> {
    if has_db {
-        println!("Settings stored in: PostgreSQL (settings table)");
+        println!("Settings stored in: database (settings table)");
        println!(
            "Bootstrap config:   {}",
            crate::bootstrap::BootstrapConfig::default_path().display()
@@ -8,8 +8,10 @@ use std::sync::Arc;
 use clap::Subcommand;

 use crate::config::Config;
-use crate::history::Store;
-use crate::secrets::{PostgresSecretsStore, SecretsCrypto, SecretsStore};
+use crate::db::Database;
+#[cfg(feature = "postgres")]
+use crate::secrets::PostgresSecretsStore;
+use crate::secrets::{SecretsCrypto, SecretsStore};
 use crate::tools::mcp::{
    McpClient, McpServerConfig, McpSessionManager, OAuthConfig,
    auth::{authorize_mcp_server, is_authenticated},
@@ -172,10 +174,10 @@ async fn add_server(
    config.validate()?;

    // Save (DB if available, else disk)
-    let store = connect_store().await;
-    let mut servers = load_servers(store.as_ref()).await?;
+    let db = connect_db().await;
+    let mut servers = load_servers(db.as_deref()).await?;
    servers.upsert(config);
-    save_servers(store.as_ref(), &servers).await?;
+    save_servers(db.as_deref(), &servers).await?;

    println!();
    println!("  ✓ Added MCP server '{}'", name);
@@ -193,12 +195,12 @@ async fn add_server(

 /// Remove an MCP server.
 async fn remove_server(name: String) -> anyhow::Result<()> {
-    let store = connect_store().await;
-    let mut servers = load_servers(store.as_ref()).await?;
+    let db = connect_db().await;
+    let mut servers = load_servers(db.as_deref()).await?;
    if !servers.remove(&name) {
        anyhow::bail!("Server '{}' not found", name);
    }
-    save_servers(store.as_ref(), &servers).await?;
+    save_servers(db.as_deref(), &servers).await?;

    println!();
    println!("  ✓ Removed MCP server '{}'", name);
@@ -209,8 +211,8 @@ async fn remove_server(name: String) -> anyhow::Result<()> {

 /// List configured MCP servers.
 async fn list_servers(verbose: bool) -> anyhow::Result<()> {
-    let store = connect_store().await;
-    let servers = load_servers(store.as_ref()).await?;
+    let db = connect_db().await;
+    let servers = load_servers(db.as_deref()).await?;

    if servers.servers.is_empty() {
        println!();
@@ -268,8 +270,8 @@ async fn list_servers(verbose: bool) -> anyhow::Result<()> {
 /// Authenticate with an MCP server.
 async fn auth_server(name: String, user_id: String) -> anyhow::Result<()> {
    // Get server config
-    let store = connect_store().await;
-    let servers = load_servers(store.as_ref()).await?;
+    let db = connect_db().await;
+    let servers = load_servers(db.as_deref()).await?;
    let server = servers
        .get(&name)
        .cloned()
@@ -341,8 +343,8 @@ async fn auth_server(name: String, user_id: String) -> anyhow::Result<()> {
 /// Test connection to an MCP server.
 async fn test_server(name: String, user_id: String) -> anyhow::Result<()> {
    // Get server config
-    let store = connect_store().await;
-    let servers = load_servers(store.as_ref()).await?;
+    let db = connect_db().await;
+    let servers = load_servers(db.as_deref()).await?;
    let server = servers
        .get(&name)
        .cloned()
@@ -437,8 +439,8 @@ async fn test_server(name: String, user_id: String) -> anyhow::Result<()> {

 /// Toggle server enabled/disabled state.
 async fn toggle_server(name: String, enable: bool, disable: bool) -> anyhow::Result<()> {
-    let store = connect_store().await;
-    let mut servers = load_servers(store.as_ref()).await?;
+    let db = connect_db().await;
+    let mut servers = load_servers(db.as_deref()).await?;

    let server = servers
        .get_mut(&name)
@@ -453,7 +455,7 @@ async fn toggle_server(name: String, enable: bool, disable: bool) -> anyhow::Res
    };

    server.enabled = new_state;
-    save_servers(store.as_ref(), &servers).await?;
+    save_servers(db.as_deref(), &servers).await?;

    let status = if new_state { "enabled" } else { "disabled" };
    println!();
@@ -465,18 +467,16 @@ async fn toggle_server(name: String, enable: bool, disable: bool) -> anyhow::Res

 const DEFAULT_USER_ID: &str = "default";

-/// Try to connect to the database store for DB-backed config.
-async fn connect_store() -> Option<Store> {
+/// Try to connect to the database (backend-agnostic).
+async fn connect_db() -> Option<Arc<dyn Database>> {
    let config = Config::from_env().await.ok()?;
-    let store = Store::new(&config.database).await.ok()?;
-    store.run_migrations().await.ok()?;
-    Some(store)
+    crate::db::connect_from_config(&config.database).await.ok()
 }

 /// Load MCP servers (DB if available, else disk).
-async fn load_servers(store: Option<&Store>) -> Result<McpServersFile, config::ConfigError> {
-    if let Some(store) = store {
-        config::load_mcp_servers_from_db(store, DEFAULT_USER_ID).await
+async fn load_servers(db: Option<&dyn Database>) -> Result<McpServersFile, config::ConfigError> {
+    if let Some(db) = db {
+        config::load_mcp_servers_from_db(db, DEFAULT_USER_ID).await
    } else {
        config::load_mcp_servers().await
    }
@@ -484,11 +484,11 @@ async fn load_servers(store: Option<&Store>) -> Result<McpServersFile, config::C

 /// Save MCP servers (DB if available, else disk).
 async fn save_servers(
-    store: Option<&Store>,
+    db: Option<&dyn Database>,
    servers: &McpServersFile,
 ) -> Result<(), config::ConfigError> {
-    if let Some(store) = store {
-        config::save_mcp_servers_to_db(store, DEFAULT_USER_ID, servers).await
+    if let Some(db) = db {
+        config::save_mcp_servers_to_db(db, DEFAULT_USER_ID, servers).await
    } else {
        config::save_mcp_servers(servers).await
    }
@@ -504,14 +504,61 @@ async fn get_secrets_store() -> anyhow::Result<Arc<dyn SecretsStore + Send + Syn
        )
    })?;

-    let store = Store::new(&config.database).await?;
-    store.run_migrations().await?;
-
    let crypto = SecretsCrypto::new(master_key.clone())?;
-    Ok(Arc::new(PostgresSecretsStore::new(
-        store.pool(),
-        Arc::new(crypto),
-    )))
+
+    #[cfg(feature = "postgres")]
+    {
+        let store = crate::history::Store::new(&config.database).await?;
+        store.run_migrations().await?;
+        Ok(Arc::new(PostgresSecretsStore::new(
+            store.pool(),
+            Arc::new(crypto),
+        )))
+    }
+
+    #[cfg(all(feature = "libsql", not(feature = "postgres")))]
+    {
+        use crate::db::Database as _;
+        use crate::db::libsql_backend::LibSqlBackend;
+        use secrecy::ExposeSecret as _;
+
+        let default_path = crate::config::default_libsql_path();
+        let db_path = config
+            .database
+            .libsql_path
+            .as_deref()
+            .unwrap_or(&default_path);
+
+        let backend = if let Some(ref url) = config.database.libsql_url {
+            let token = config.database.libsql_auth_token.as_ref().ok_or_else(|| {
+                anyhow::anyhow!("LIBSQL_AUTH_TOKEN is required when LIBSQL_URL is set")
+            })?;
+            LibSqlBackend::new_remote_replica(db_path, url, token.expose_secret())
+                .await
+                .map_err(|e| anyhow::anyhow!("{}", e))?
+        } else {
+            LibSqlBackend::new_local(db_path)
+                .await
+                .map_err(|e| anyhow::anyhow!("{}", e))?
+        };
+        backend
+            .run_migrations()
+            .await
+            .map_err(|e| anyhow::anyhow!("{}", e))?;
+
+        return Ok(Arc::new(crate::secrets::LibSqlSecretsStore::new(
+            backend.shared_db(),
+            Arc::new(crypto),
+        )));
+    }
+
+    #[cfg(not(any(feature = "postgres", feature = "libsql")))]
+    {
+        let _ = crypto;
+        anyhow::bail!(
+            "No database backend available for secrets. Enable 'postgres' or 'libsql' feature."
+        );
+    }
 }

 #[cfg(test)]
@@ -9,6 +9,30 @@ use clap::Subcommand;

 use crate::workspace::{EmbeddingProvider, SearchConfig, Workspace};

+/// Run a memory command using the Database trait (works with any backend).
+pub async fn run_memory_command_with_db(
+    cmd: MemoryCommand,
+    db: std::sync::Arc<dyn crate::db::Database>,
+    embeddings: Option<Arc<dyn EmbeddingProvider>>,
+) -> anyhow::Result<()> {
+    let mut workspace = Workspace::new_with_db("default", db);
+    if let Some(emb) = embeddings {
+        workspace = workspace.with_embeddings(emb);
+    }
+
+    match cmd {
+        MemoryCommand::Search { query, limit } => search(&workspace, &query, limit).await,
+        MemoryCommand::Read { path } => read(&workspace, &path).await,
+        MemoryCommand::Write {
+            path,
+            content,
+            append,
+        } => write(&workspace, &path, content, append).await,
+        MemoryCommand::Tree { path, depth } => tree(&workspace, &path, depth).await,
+        MemoryCommand::Status => status(&workspace).await,
+    }
+}
+
 #[derive(Subcommand, Debug, Clone)]
 pub enum MemoryCommand {
    /// Search workspace memory (hybrid full-text + semantic)
@@ -55,7 +79,8 @@ pub enum MemoryCommand {
    Status,
 }

-/// Run a memory command.
+/// Run a memory command (PostgreSQL backend).
+#[cfg(feature = "postgres")]
 pub async fn run_memory_command(
    cmd: MemoryCommand,
    pool: deadpool_postgres::Pool,
@@ -18,7 +18,10 @@ mod tool;

 pub use config::{ConfigCommand, run_config_command};
 pub use mcp::{McpCommand, run_mcp_command};
-pub use memory::{MemoryCommand, run_memory_command};
+pub use memory::MemoryCommand;
+#[cfg(feature = "postgres")]
+pub use memory::run_memory_command;
+pub use memory::run_memory_command_with_db;
 pub use pairing::{PairingCommand, run_pairing_command, run_pairing_command_with_store};
 pub use status::run_status_command;
 pub use tool::{ToolCommand, run_tool_command};
@@ -135,6 +135,7 @@ pub async fn run_status_command() -> anyhow::Result<()> {
    Ok(())
 }

+#[cfg(feature = "postgres")]
 async fn check_database() -> anyhow::Result<()> {
    let _ = dotenvy::dotenv();
    let settings = Settings::load();
@@ -167,6 +168,12 @@ async fn check_database() -> anyhow::Result<()> {
    Ok(())
 }

+#[cfg(not(feature = "postgres"))]
+async fn check_database() -> anyhow::Result<()> {
+    // For non-postgres backends, just report configured
+    Ok(())
+}
+
 fn count_wasm_files(dir: &std::path::Path) -> usize {
    std::fs::read_dir(dir)
        .map(|entries| {
@@ -11,8 +11,11 @@ use clap::Subcommand;
 use tokio::fs;

 use crate::config::Config;
-use crate::history::Store;
-use crate::secrets::{CreateSecretParams, PostgresSecretsStore, SecretsCrypto, SecretsStore};
+#[allow(unused_imports)]
+use crate::db::Database;
+#[cfg(feature = "postgres")]
+use crate::secrets::PostgresSecretsStore;
+use crate::secrets::{CreateSecretParams, SecretsCrypto, SecretsStore};
 use crate::tools::wasm::{CapabilitiesFile, compute_binary_hash};

 /// Default tools directory.
@@ -722,11 +725,58 @@ async fn auth_tool(name: String, dir: Option<PathBuf>, user_id: String) -> anyho
        )
    })?;

-    let store = Store::new(&config.database).await?;
-    store.run_migrations().await?;
-
    let crypto = SecretsCrypto::new(master_key.clone())?;
-    let secrets_store = Arc::new(PostgresSecretsStore::new(store.pool(), Arc::new(crypto)));
+
+    let secrets_store: Arc<dyn SecretsStore + Send + Sync> = {
+        #[cfg(feature = "postgres")]
+        {
+            let store = crate::history::Store::new(&config.database).await?;
+            store.run_migrations().await?;
+            Arc::new(PostgresSecretsStore::new(store.pool(), Arc::new(crypto)))
+        }
+        #[cfg(all(feature = "libsql", not(feature = "postgres")))]
+        {
+            use crate::db::Database as _;
+            use crate::db::libsql_backend::LibSqlBackend;
+            use secrecy::ExposeSecret as _;
+
+            let default_path = crate::config::default_libsql_path();
+            let db_path = config
+                .database
+                .libsql_path
+                .as_deref()
+                .unwrap_or(&default_path);
+
+            let backend = if let Some(ref url) = config.database.libsql_url {
+                let token = config.database.libsql_auth_token.as_ref().ok_or_else(|| {
+                    anyhow::anyhow!("LIBSQL_AUTH_TOKEN is required when LIBSQL_URL is set")
+                })?;
+                LibSqlBackend::new_remote_replica(db_path, url, token.expose_secret())
+                    .await
+                    .map_err(|e| anyhow::anyhow!("{}", e))?
+            } else {
+                LibSqlBackend::new_local(db_path)
+                    .await
+                    .map_err(|e| anyhow::anyhow!("{}", e))?
+            };
+            backend
+                .run_migrations()
+                .await
+                .map_err(|e| anyhow::anyhow!("{}", e))?;
+
+            Arc::new(crate::secrets::LibSqlSecretsStore::new(
+                backend.shared_db(),
+                Arc::new(crypto),
+            ))
+        }
+        #[cfg(not(any(feature = "postgres", feature = "libsql")))]
+        {
+            let _ = crypto;
+            anyhow::bail!(
+                "No database backend available for secrets. Enable 'postgres' or 'libsql' feature."
+            );
+        }
+    };

    // Check if already configured
    let already_configured = secrets_store
@@ -773,29 +823,29 @@ async fn auth_tool(name: String, dir: Option<PathBuf>, user_id: String) -> anyho
                    println!("  Validation failed: {}", e);
                    println!();
                    println!("  Falling back to manual entry...");
-                    return auth_tool_manual(&secrets_store, &user_id, &auth).await;
+                    return auth_tool_manual(secrets_store.as_ref(), &user_id, &auth).await;
                }
            }
        }

        // Save the token
-        save_token(&secrets_store, &user_id, &auth, &token).await?;
+        save_token(secrets_store.as_ref(), &user_id, &auth, &token).await?;
        print_success(display_name);
        return Ok(());
    }

    // Check for OAuth configuration
    if let Some(ref oauth) = auth.oauth {
-        return auth_tool_oauth(&secrets_store, &user_id, &auth, oauth).await;
+        return auth_tool_oauth(secrets_store.as_ref(), &user_id, &auth, oauth).await;
    }

    // Fall back to manual entry
-    auth_tool_manual(&secrets_store, &user_id, &auth).await
+    auth_tool_manual(secrets_store.as_ref(), &user_id, &auth).await
 }

 /// OAuth browser-based login flow.
 async fn auth_tool_oauth(
-    store: &PostgresSecretsStore,
+    store: &(dyn SecretsStore + Send + Sync),
    user_id: &str,
    auth: &crate::tools::wasm::AuthCapabilitySchema,
    oauth: &crate::tools::wasm::OAuthConfigSchema,
@@ -1041,7 +1091,7 @@ async fn auth_tool_oauth(

 /// Manual token entry flow.
 async fn auth_tool_manual(
-    store: &PostgresSecretsStore,
+    store: &(dyn SecretsStore + Send + Sync),
    user_id: &str,
    auth: &crate::tools::wasm::AuthCapabilitySchema,
 ) -> anyhow::Result<()> {
@@ -1214,7 +1264,7 @@ async fn validate_token(

 /// Save token to secrets store.
 async fn save_token(
-    store: &PostgresSecretsStore,
+    store: &(dyn SecretsStore + Send + Sync),
    user_id: &str,
    auth: &crate::tools::wasm::AuthCapabilitySchema,
    token: &str,