From f44d31eb5830262a44704a7258eb6a39b0ff2952 Mon Sep 17 00:00:00 2001
From: Seongmin Lee <git@boltless.me>
Date: Tue, 21 Jul 2026 16:00:57 +0900
Subject: [PATCH] spindle: acl db table

Signed-off-by: Seongmin Lee <git@boltless.me>
---
 spindle/db/db.go         | 17 +++++++++++++++
 spindle/db/known_dids.go | 47 ++++++++++++++++++++--------------------
 spindle/server.go        |  2 +-
 3 files changed, 42 insertions(+), 24 deletions(-)

diff --git a/spindle/db/db.go b/spindle/db/db.go
index eb7484cc..090be2bb 100644
--- a/spindle/db/db.go
+++ b/spindle/db/db.go
@@ -270,6 +270,23 @@ func runMigrations(_ context.Context, conn *sql.Conn, logger *slog.Logger) error
 		return err
 	}
 
+	if err := orm.RunMigration(conn, logger, "user-acl-table", func(tx *sql.Tx) error {
+		_, err := tx.Exec(`
+			CREATE TABLE users (
+				did     TEXT    PRIMARY KEY,
+				blocked INTEGER DEFAULT 0,
+			);
+
+			insert or ignore into users (did)
+			select did from known_dids;
+
+			drop table known_dids;
+		`)
+		return err
+	}); err != nil {
+		return err
+	}
+
 	return nil
 }
 
diff --git a/spindle/db/known_dids.go b/spindle/db/known_dids.go
index 2192e069..ab624bb0 100644
--- a/spindle/db/known_dids.go
+++ b/spindle/db/known_dids.go
@@ -1,24 +1,13 @@
 package db
 
-func AddDid(q DBTX, did string) error {
-	_, err := q.Exec(`insert or ignore into known_dids (did) values (?)`, did)
-	return err
-}
-
-func RemoveDid(q DBTX, did string) error {
-	_, err := q.Exec(`delete from known_dids where did = ?`, did)
-	return err
-}
-
-func (d *DB) GetAllDids() ([]string, error) {
-	var dids []string
-
+func (d *DB) ListAllowedMembers() ([]string, error) {
 	rows, err := d.Query(`select did from known_dids`)
 	if err != nil {
 		return nil, err
 	}
 	defer rows.Close()
 
+	var dids []string
 	for rows.Next() {
 		var did string
 		if err := rows.Scan(&did); err != nil {
@@ -27,18 +16,30 @@ func (d *DB) GetAllDids() ([]string, error) {
 		dids = append(dids, did)
 	}
 
-	if err := rows.Err(); err != nil {
-		return nil, err
+	return dids, rows.Err()
+}
+
+func (d *DB) IsAllowedUser(did string, isPublic bool) (bool, error) {
+	var blocked bool
+	if err := d.QueryRow(`select exists (select 1 from blocked_dids where did = ?)`, did).Scan(&blocked); err != nil {
+		return false, err
+	}
+	if blocked {
+		return false, nil
+	}
+	if isPublic {
+		return true, nil
 	}
 
-	return dids, nil
+	var allowed bool
+	err := d.QueryRow(`select exists (select 1 from known_dids where did = ?)`, did).Scan(&allowed)
+	return allowed, err
 }
 
-func (d *DB) HasKnownDids() bool {
-	var count int
-	err := d.QueryRow(`select count(*) from known_dids`).Scan(&count)
-	if err != nil {
-		return false
-	}
-	return count > 0
+func (d *DB) AllowUser(did string) error {
+	panic("unimplemented")
+}
+
+func (d *DB) BlockUser(did string) error {
+	panic("unimplemented")
 }
diff --git a/spindle/server.go b/spindle/server.go
index c1e6b080..5b814f0f 100644
--- a/spindle/server.go
+++ b/spindle/server.go
@@ -125,7 +125,7 @@ func New(ctx context.Context, cfg *config.Config, d *db.DB, engines map[string]m
 	jc.ExemptCollection(tangled.RepoPullNSID)
 
 	// Check if the spindle knows about any Dids;
-	dids, err := d.GetAllDids()
+	dids, err := d.ListAllowedMembers()
 	if err != nil {
 		return nil, fmt.Errorf("failed to get all dids: %w", err)
 	}
-- 
2.51.2