feat(openflare): migrate of_node_access_logs to ClickHouse

Move node access log storage from PostgreSQL/SQLite to ClickHouse
(database: openflare). System startup now requires a healthy ClickHouse
connection and auto-initializes the schema. Agent heartbeat writes access
logs via batch insert; goose migration drops the legacy relational table.

openflare-server/internal/model/errs.go

@@ -6,6 +6,7 @@ package model
 const (
 	errRegistrationDisabled                 = "注册已关闭"
 	errDatabaseNotInitialized               = "database not initialized"
+	errClickHouseNotInitialized             = "clickhouse not initialized"
 	errUsernameExists                       = "用户名已存在"
 	errEmailAlreadyBound                    = "该邮箱已被其他账号绑定"
 	errConfigIntParseFailed                 = "配置 %s 的值 '%s' 无法转换为整数: %w"

openflare-server/internal/model/openflare_access_log.go

@@ -5,18 +5,11 @@ package model
 
 import (
 	"context"
-	"errors"
-	"fmt"
 	"sort"
 	"strings"
 	"time"
-
-	"github.com/Rain-kl/Wavelet/internal/db"
-	"gorm.io/gorm"
 )
 
-const openFlareAccessLogTable = "of_node_access_logs"
-
 type openFlareAccessLogBucketAggregateRow struct {
 	BucketEpoch      int64 `gorm:"column:bucket_epoch"`
 	RequestCount     int64 `gorm:"column:request_count"`
@@ -56,81 +49,24 @@ func ListOpenFlareAccessLogsForWAFIPGroup(ctx context.Context, query OpenFlareAc
 	return ListOpenFlareAccessLogs(ctx, query)
 }
 
+// InsertOpenFlareAccessLogsBatch inserts access log rows into ClickHouse.
+func InsertOpenFlareAccessLogsBatch(ctx context.Context, records []*OpenFlareAccessLog) error {
+	return currentAccessLogStore().InsertBatch(ctx, records)
+}
+
 // ListOpenFlareAccessLogs lists access logs matching the query.
 func ListOpenFlareAccessLogs(ctx context.Context, query OpenFlareAccessLogQuery) ([]*OpenFlareAccessLog, error) {
-	conn := db.DB(ctx)
-	if conn == nil {
-		return nil, errors.New(errDatabaseNotInitialized)
-	}
-	tx := applyOpenFlareAccessLogFilters(conn.Model(&OpenFlareAccessLog{}), query)
-	tx = tx.Order(openFlareAccessLogOrderClause(query.SortBy, query.SortOrder))
-	if query.PageSize > 0 {
-		if query.Page < 0 {
-			query.Page = 0
-		}
-		tx = tx.Offset(query.Page * query.PageSize).Limit(query.PageSize)
-	}
-	var rows []*OpenFlareAccessLog
-	if err := tx.Find(&rows).Error; err != nil {
-		if isMissingTableError(err) {
-			return []*OpenFlareAccessLog{}, nil
-		}
-		return nil, err
-	}
-	return rows, nil
+	return currentAccessLogStore().List(ctx, query)
 }
 
 // CountOpenFlareAccessLogs counts access logs and distinct IPs matching the query.
 func CountOpenFlareAccessLogs(ctx context.Context, query OpenFlareAccessLogQuery) (int64, int64, error) {
-	conn := db.DB(ctx)
-	if conn == nil {
-		return 0, 0, errors.New(errDatabaseNotInitialized)
-	}
-	totalRecords, err := countOpenFlareAccessLogRecords(conn, query)
-	if err != nil {
-		if isMissingTableError(err) {
-			return 0, 0, nil
-		}
-		return 0, 0, err
-	}
-	totalIPs, err := countDistinctOpenFlareAccessLogIPs(conn, query)
-	if err != nil {
-		if isMissingTableError(err) {
-			return 0, 0, nil
-		}
-		return 0, 0, err
-	}
-	return totalRecords, totalIPs, nil
+	return currentAccessLogStore().Count(ctx, query)
 }
 
 // ListOpenFlareAccessLogRegionCounts returns region counts for access logs.
 func ListOpenFlareAccessLogRegionCounts(ctx context.Context, nodeID string, since time.Time, limit int) ([]*OpenFlareAccessLogRegionCount, error) {
-	conn := db.DB(ctx)
-	if conn == nil {
-		return nil, errors.New(errDatabaseNotInitialized)
-	}
-	filter := OpenFlareAccessLogQuery{
-		NodeID: nodeID,
-		Since:  since,
-	}
-	clause, args := buildOpenFlareAccessLogFilterClause(filter)
-	sql := fmt.Sprintf(`
-SELECT TRIM(region) AS region, COUNT(*) AS count
-FROM %s
-WHERE %s AND TRIM(region) <> ''
-GROUP BY TRIM(region)
-ORDER BY count DESC, region ASC`, openFlareAccessLogTable, clause)
-	if limit > 0 {
-		sql += fmt.Sprintf(" LIMIT %d", limit)
-	}
-	var rows []*OpenFlareAccessLogRegionCount
-	if err := conn.Raw(sql, args...).Scan(&rows).Error; err != nil {
-		if isMissingTableError(err) {
-			return []*OpenFlareAccessLogRegionCount{}, nil
-		}
-		return nil, err
-	}
-	return rows, nil
+	return currentAccessLogStore().RegionCounts(ctx, nodeID, since, limit)
 }
 
 // ListOpenFlareAccessLogBuckets lists folded access log buckets.
@@ -201,10 +137,6 @@ func CountOpenFlareAccessLogIPSummaries(ctx context.Context, query OpenFlareAcce
 
 // ListOpenFlareAccessLogIPTrend lists IP trend points.
 func ListOpenFlareAccessLogIPTrend(ctx context.Context, query OpenFlareAccessLogIPTrendQuery) ([]*OpenFlareAccessLogIPTrendRow, error) {
-	conn := db.DB(ctx)
-	if conn == nil {
-		return nil, errors.New(errDatabaseNotInitialized)
-	}
 	remoteAddr := strings.TrimSpace(query.RemoteAddr)
 	if remoteAddr == "" {
 		return []*OpenFlareAccessLogIPTrendRow{}, nil
@@ -215,76 +147,45 @@ func ListOpenFlareAccessLogIPTrend(ctx context.Context, query OpenFlareAccessLog
 		Host:       query.Host,
 		Since:      query.Since,
 	}
-	clause, args := buildOpenFlareAccessLogFilterClause(filter)
 	bucketSeconds := int64(query.BucketMinutes * 60)
 	if bucketSeconds <= 0 {
 		bucketSeconds = 1800
 	}
-	bucketExpr := openFlareAccessLogBucketEpochExpr(openFlareAccessLogDialect(conn), bucketSeconds)
-	queryClause := combineOpenFlareAccessLogSQLClauses(clause, "TRIM(remote_addr) = ?")
-	queryArgs := append(append([]any{}, args...), remoteAddr)
-	sql := fmt.Sprintf(`
-SELECT
-	%s AS bucket_epoch,
-	COUNT(*) AS request_count
-FROM %s
-WHERE %s
-GROUP BY bucket_epoch
-ORDER BY bucket_epoch ASC`, bucketExpr, openFlareAccessLogTable, queryClause)
-	var rows []*OpenFlareAccessLogIPTrendRow
-	if err := conn.Raw(sql, queryArgs...).Scan(&rows).Error; err != nil {
-		if isMissingTableError(err) {
-			return []*OpenFlareAccessLogIPTrendRow{}, nil
-		}
+	rows, err := currentAccessLogStore().IPTrend(ctx, filter, bucketSeconds)
+	if err != nil {
 		return nil, err
 	}
-	return rows, nil
+	result := make([]*OpenFlareAccessLogIPTrendRow, len(rows))
+	for index, row := range rows {
+		result[index] = &OpenFlareAccessLogIPTrendRow{
+			BucketEpoch:  row.BucketEpoch,
+			RequestCount: row.RequestCount,
+		}
+	}
+	return result, nil
 }
 
 // DeleteAllOpenFlareAccessLogs deletes all access logs.
 func DeleteAllOpenFlareAccessLogs(ctx context.Context) (int64, error) {
-	conn := db.DB(ctx)
-	if conn == nil {
-		return 0, errors.New(errDatabaseNotInitialized)
-	}
-	result := conn.Where("1 = 1").Delete(&OpenFlareAccessLog{})
-	if result.Error != nil {
-		if isMissingTableError(result.Error) {
-			return 0, nil
-		}
-		return 0, result.Error
-	}
-	return result.RowsAffected, nil
+	return currentAccessLogStore().DeleteAll(ctx)
 }
 
 // DeleteOpenFlareAccessLogsBefore deletes access logs older than cutoff.
 func DeleteOpenFlareAccessLogsBefore(ctx context.Context, cutoff time.Time) (int64, error) {
-	conn := db.DB(ctx)
-	if conn == nil {
-		return 0, errors.New(errDatabaseNotInitialized)
-	}
-	result := conn.Where("logged_at < ?", cutoff).Delete(&OpenFlareAccessLog{})
-	if result.Error != nil {
-		if isMissingTableError(result.Error) {
-			return 0, nil
-		}
-		return 0, result.Error
-	}
-	return result.RowsAffected, nil
+	return currentAccessLogStore().DeleteBefore(ctx, cutoff)
+}
+
+// DeleteOpenFlareAccessLogsByNodeBefore deletes access logs for a node older than cutoff.
+func DeleteOpenFlareAccessLogsByNodeBefore(ctx context.Context, nodeID string, cutoff time.Time) (int64, error) {
+	return currentAccessLogStore().DeleteByNodeBefore(ctx, nodeID, cutoff)
 }
 
 func buildOpenFlareAccessLogBucketRows(ctx context.Context, query OpenFlareAccessLogBucketQuery) ([]*OpenFlareAccessLogBucketRow, error) {
-	conn := db.DB(ctx)
-	if conn == nil {
-		return nil, errors.New(errDatabaseNotInitialized)
-	}
 	filter := openFlareAccessLogQueryFromBucket(query)
-	clause, args := buildOpenFlareAccessLogFilterClause(filter)
 	bucketSeconds := int64(query.FoldMinutes * 60)
 	if bucketSeconds <= 0 {
 		bucketSeconds = 180
 	}
-	bucketExpr := openFlareAccessLogBucketEpochExpr(openFlareAccessLogDialect(conn), bucketSeconds)
 
 	type bucketAccumulator struct {
 		requestCount     int64
@@ -296,21 +197,8 @@ func buildOpenFlareAccessLogBucketRows(ctx context.Context, query OpenFlareAcces
 	}
 	accumulators := make(map[int64]*bucketAccumulator)
 
-	var partials []openFlareAccessLogBucketAggregateRow
-	sql := fmt.Sprintf(`
-SELECT
-	%s AS bucket_epoch,
-	COUNT(*) AS request_count,
-	SUM(CASE WHEN status_code < 400 THEN 1 ELSE 0 END) AS success_count,
-	SUM(CASE WHEN status_code >= 400 AND status_code < 500 THEN 1 ELSE 0 END) AS client_error_count,
-	SUM(CASE WHEN status_code >= 500 THEN 1 ELSE 0 END) AS server_error_count
-FROM %s
-WHERE %s
-GROUP BY bucket_epoch`, bucketExpr, openFlareAccessLogTable, clause)
-	if err := conn.Raw(sql, args...).Scan(&partials).Error; err != nil {
-		if isMissingTableError(err) {
-			return []*OpenFlareAccessLogBucketRow{}, nil
-		}
+	partials, err := currentAccessLogStore().BucketAggregates(ctx, filter, bucketSeconds)
+	if err != nil {
 		return nil, err
 	}
 	for _, partial := range partials {
@@ -329,7 +217,7 @@ GROUP BY bucket_epoch`, bucketExpr, openFlareAccessLogTable, clause)
 	}
 
 	for _, column := range []string{"remote_addr", "host"} {
-		dimensions, err := queryOpenFlareAccessLogBucketDimensionRows(conn, clause, args, column, bucketExpr)
+		dimensions, err := currentAccessLogStore().BucketDimensions(ctx, filter, column, bucketSeconds)
 		if err != nil {
 			return nil, err
 		}
@@ -371,24 +259,6 @@ GROUP BY bucket_epoch`, bucketExpr, openFlareAccessLogTable, clause)
 	return rows, nil
 }
 
-func queryOpenFlareAccessLogBucketDimensionRows(conn *gorm.DB, clause string, args []any, column string, bucketExpr string) ([]openFlareAccessLogBucketDimensionRow, error) {
-	var rows []openFlareAccessLogBucketDimensionRow
-	sql := fmt.Sprintf(`
-SELECT
-	%s AS bucket_epoch,
-	TRIM(%s) AS value
-FROM %s
-WHERE %s AND TRIM(%s) <> ''
-GROUP BY bucket_epoch, TRIM(%s)`, bucketExpr, column, openFlareAccessLogTable, clause, column, column)
-	if err := conn.Raw(sql, args...).Scan(&rows).Error; err != nil {
-		if isMissingTableError(err) {
-			return []openFlareAccessLogBucketDimensionRow{}, nil
-		}
-		return nil, err
-	}
-	return rows, nil
-}
-
 func buildOpenFlareAccessLogBucketIPRows(ctx context.Context, query OpenFlareAccessLogBucketIPQuery) ([]*OpenFlareAccessLogBucketIPRow, error) {
 	if query.BucketStartedAt.IsZero() {
 		return []*OpenFlareAccessLogBucketIPRow{}, nil
@@ -415,39 +285,14 @@ func buildOpenFlareAccessLogBucketIPRows(ctx context.Context, query OpenFlareAcc
 }
 
 func buildOpenFlareAccessLogIPSummaryRows(ctx context.Context, query OpenFlareAccessLogIPSummaryQuery, recentSince time.Time) ([]*OpenFlareAccessLogIPSummaryRow, error) {
-	conn := db.DB(ctx)
-	if conn == nil {
-		return nil, errors.New(errDatabaseNotInitialized)
-	}
 	filter := OpenFlareAccessLogQuery{
 		NodeID:     query.NodeID,
 		RemoteAddr: query.RemoteAddr,
 		Host:       query.Host,
 		Since:      query.Since,
 	}
-	clause, args := buildOpenFlareAccessLogFilterClause(filter)
-	lastSeenExpr := openFlareAccessLogEpochExpr(openFlareAccessLogDialect(conn))
-	recentClause := "0"
-	queryArgs := make([]any, 0, len(args)+1)
-	if !recentSince.IsZero() {
-		recentClause = "CASE WHEN logged_at >= ? THEN 1 ELSE 0 END"
-		queryArgs = append(queryArgs, recentSince)
-	}
-	queryArgs = append(queryArgs, args...)
-	sql := fmt.Sprintf(`
-SELECT
-	TRIM(remote_addr) AS remote_addr,
-	COUNT(*) AS total_requests,
-	SUM(%s) AS recent_requests,
-	MAX(%s) AS last_seen_epoch
-FROM %s
-WHERE %s AND TRIM(remote_addr) <> ''
-GROUP BY TRIM(remote_addr)`, recentClause, lastSeenExpr, openFlareAccessLogTable, clause)
-	var partials []openFlareAccessLogIPSummaryRow
-	if err := conn.Raw(sql, queryArgs...).Scan(&partials).Error; err != nil {
-		if isMissingTableError(err) {
-			return []*OpenFlareAccessLogIPSummaryRow{}, nil
-		}
+	partials, err := currentAccessLogStore().IPSummaries(ctx, filter, recentSince)
+	if err != nil {
 		return nil, err
 	}
 	rows := make([]*OpenFlareAccessLogIPSummaryRow, 0, len(partials))
@@ -468,38 +313,8 @@ GROUP BY TRIM(remote_addr)`, recentClause, lastSeenExpr, openFlareAccessLogTable
 }
 
 func queryOpenFlareAccessLogIPAggregateRows(ctx context.Context, filter OpenFlareAccessLogQuery, exactRemoteAddr bool) ([]*OpenFlareAccessLogBucketIPRow, error) {
-	conn := db.DB(ctx)
-	if conn == nil {
-		return nil, errors.New(errDatabaseNotInitialized)
-	}
-	clause, args := buildOpenFlareAccessLogFilterClause(filter)
-	lastSeenExpr := openFlareAccessLogEpochExpr(openFlareAccessLogDialect(conn))
-	queryClause := clause
-	queryArgs := append([]any{}, args...)
-	if exactRemoteAddr {
-		trimmed := strings.TrimSpace(filter.RemoteAddr)
-		if trimmed == "" {
-			return []*OpenFlareAccessLogBucketIPRow{}, nil
-		}
-		queryClause = combineOpenFlareAccessLogSQLClauses(queryClause, "TRIM(remote_addr) = ?")
-		queryArgs = append(queryArgs, trimmed)
-	}
-	sql := fmt.Sprintf(`
-SELECT
-	TRIM(remote_addr) AS remote_addr,
-	COUNT(*) AS request_count,
-	SUM(CASE WHEN status_code < 400 THEN 1 ELSE 0 END) AS success_count,
-	SUM(CASE WHEN status_code >= 400 AND status_code < 500 THEN 1 ELSE 0 END) AS client_error_count,
-	SUM(CASE WHEN status_code >= 500 THEN 1 ELSE 0 END) AS server_error_count,
-	MAX(%s) AS last_seen_epoch
-FROM %s
-WHERE %s AND TRIM(remote_addr) <> ''
-GROUP BY TRIM(remote_addr)`, lastSeenExpr, openFlareAccessLogTable, queryClause)
-	var partials []openFlareAccessLogIPAggregateRow
-	if err := conn.Raw(sql, queryArgs...).Scan(&partials).Error; err != nil {
-		if isMissingTableError(err) {
-			return []*OpenFlareAccessLogBucketIPRow{}, nil
-		}
+	partials, err := currentAccessLogStore().IPAggregates(ctx, filter, exactRemoteAddr)
+	if err != nil {
 		return nil, err
 	}
 	rows := make([]*OpenFlareAccessLogBucketIPRow, 0, len(partials))
@@ -551,82 +366,20 @@ func buildOpenFlareAccessLogFilterClause(query OpenFlareAccessLogQuery) (string,
 	}
 	if !query.Since.IsZero() {
 		parts = append(parts, "logged_at >= ?")
-		args = append(args, query.Since)
+		args = append(args, query.Since.UTC())
 	}
 	if !query.Until.IsZero() {
 		parts = append(parts, "logged_at < ?")
-		args = append(args, query.Until)
+		args = append(args, query.Until.UTC())
 	}
 	if len(parts) == 0 {
-		return "TRUE", nil
+		return "1", nil
 	}
 	return strings.Join(parts, " AND "), args
 }
 
-func applyOpenFlareAccessLogFilters(tx *gorm.DB, query OpenFlareAccessLogQuery) *gorm.DB {
-	clause, args := buildOpenFlareAccessLogFilterClause(query)
-	if clause == "TRUE" {
-		return tx
-	}
-	return tx.Where(clause, args...)
-}
-
-func countOpenFlareAccessLogRecords(conn *gorm.DB, query OpenFlareAccessLogQuery) (int64, error) {
-	var count int64
-	if err := applyOpenFlareAccessLogFilters(conn.Model(&OpenFlareAccessLog{}), query).Count(&count).Error; err != nil {
-		return 0, err
-	}
-	return count, nil
-}
-
-func countDistinctOpenFlareAccessLogIPs(conn *gorm.DB, query OpenFlareAccessLogQuery) (int64, error) {
-	clause, args := buildOpenFlareAccessLogFilterClause(query)
-	sql := fmt.Sprintf(`
-SELECT COUNT(*) FROM (
-	SELECT TRIM(remote_addr) AS remote_addr
-	FROM %s
-	WHERE %s AND remote_addr <> ''
-	GROUP BY TRIM(remote_addr)
-) AS ips`, openFlareAccessLogTable, clause)
-	var total int64
-	if err := conn.Raw(sql, args...).Scan(&total).Error; err != nil {
-		return 0, err
-	}
-	return total, nil
-}
-
-func openFlareAccessLogDialect(conn *gorm.DB) string {
-	if conn == nil || conn.Dialector == nil {
-		return "sqlite"
-	}
-	switch conn.Dialector.Name() {
-	case "postgres":
-		return "postgres"
-	default:
-		return "sqlite"
-	}
-}
-
-func openFlareAccessLogBucketEpochExpr(dialect string, bucketSeconds int64) string {
-	switch dialect {
-	case "postgres":
-		return fmt.Sprintf("FLOOR(EXTRACT(EPOCH FROM logged_at AT TIME ZONE 'UTC') / %d) * %d", bucketSeconds, bucketSeconds)
-	default:
-		return fmt.Sprintf("(CAST(strftime('%%s', logged_at) AS INTEGER) / %d) * %d", bucketSeconds, bucketSeconds)
-	}
-}
-
-func openFlareAccessLogEpochExpr(dialect string) string {
-	switch dialect {
-	case "postgres":
-		return "FLOOR(EXTRACT(EPOCH FROM logged_at AT TIME ZONE 'UTC'))::bigint"
-	default:
-		return "CAST((julianday(logged_at) - 2440587.5) * 86400 AS INTEGER)"
-	}
-}
-
 func combineOpenFlareAccessLogSQLClauses(left string, right string) string {
-	if strings.TrimSpace(left) == "" || left == "TRUE" {
+	if strings.TrimSpace(left) == "" || left == "TRUE" || left == "1" {
 		return right
 	}
 	return left + " AND " + right
@@ -656,7 +409,7 @@ func openFlareAccessLogOrderClause(sortBy string, sortOrder string) string {
 
 func sortOpenFlareAccessLogBucketIPRows(items []*OpenFlareAccessLogBucketIPRow, sortBy string, sortOrder string) {
 	desc := openFlareAccessLogNormalizeSortOrder(sortOrder) != "asc"
-	sort.Slice(items, func(i int, j int) bool {
+	sort.Slice(items, func(i, j int) bool {
 		left := items[i]
 		right := items[j]
 		if left == nil || right == nil {
@@ -686,7 +439,7 @@ func sortOpenFlareAccessLogBucketIPRows(items []*OpenFlareAccessLogBucketIPRow,
 
 func sortOpenFlareAccessLogBucketRows(items []*OpenFlareAccessLogBucketRow, sortBy string, sortOrder string) {
 	desc := openFlareAccessLogNormalizeSortOrder(sortOrder) != "asc"
-	sort.Slice(items, func(i int, j int) bool {
+	sort.Slice(items, func(i, j int) bool {
 		left := items[i]
 		right := items[j]
 		if left == nil || right == nil {
@@ -711,7 +464,7 @@ func sortOpenFlareAccessLogBucketRows(items []*OpenFlareAccessLogBucketRow, sort
 
 func sortOpenFlareAccessLogIPSummaryRows(items []*OpenFlareAccessLogIPSummaryRow, sortBy string, sortOrder string) {
 	desc := openFlareAccessLogNormalizeSortOrder(sortOrder) != "asc"
-	sort.Slice(items, func(i int, j int) bool {
+	sort.Slice(items, func(i, j int) bool {
 		left := items[i]
 		right := items[j]
 		if left == nil || right == nil {
@@ -776,3 +529,4 @@ func openFlareAccessLogCompareInt64(left int64, right int64) int {
 		return 0
 	}
 }
+

openflare-server/internal/model/openflare_access_log_store.go

@@ -0,0 +1,465 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/ClickHouse/clickhouse-go/v2/lib/driver"
+	"github.com/Rain-kl/Wavelet/internal/db"
+	"github.com/Rain-kl/Wavelet/internal/db/idgen"
+)
+
+const openFlareAccessLogTable = "of_node_access_logs"
+
+type accessLogStore interface {
+	InsertBatch(ctx context.Context, records []*OpenFlareAccessLog) error
+	List(ctx context.Context, query OpenFlareAccessLogQuery) ([]*OpenFlareAccessLog, error)
+	Count(ctx context.Context, query OpenFlareAccessLogQuery) (int64, int64, error)
+	RegionCounts(ctx context.Context, nodeID string, since time.Time, limit int) ([]*OpenFlareAccessLogRegionCount, error)
+	BucketAggregates(ctx context.Context, filter OpenFlareAccessLogQuery, bucketSeconds int64) ([]openFlareAccessLogBucketAggregateRow, error)
+	BucketDimensions(ctx context.Context, filter OpenFlareAccessLogQuery, column string, bucketSeconds int64) ([]openFlareAccessLogBucketDimensionRow, error)
+	IPAggregates(ctx context.Context, filter OpenFlareAccessLogQuery, exactRemoteAddr bool) ([]openFlareAccessLogIPAggregateRow, error)
+	IPSummaries(ctx context.Context, filter OpenFlareAccessLogQuery, recentSince time.Time) ([]openFlareAccessLogIPSummaryRow, error)
+	IPTrend(ctx context.Context, filter OpenFlareAccessLogQuery, bucketSeconds int64) ([]openFlareAccessLogIPTrendRow, error)
+	DeleteAll(ctx context.Context) (int64, error)
+	DeleteBefore(ctx context.Context, cutoff time.Time) (int64, error)
+	DeleteByNodeBefore(ctx context.Context, nodeID string, before time.Time) (int64, error)
+}
+
+var (
+	accessLogStoreMu     sync.RWMutex
+	accessLogStoreHolder accessLogStore
+)
+
+func currentAccessLogStore() accessLogStore {
+	accessLogStoreMu.RLock()
+	defer accessLogStoreMu.RUnlock()
+	if accessLogStoreHolder != nil {
+		return accessLogStoreHolder
+	}
+	return clickhouseAccessLogStore{}
+}
+
+// SetAccessLogStoreForTest swaps the access log store implementation for unit tests.
+func SetAccessLogStoreForTest(store accessLogStore) func() {
+	accessLogStoreMu.Lock()
+	previous := accessLogStoreHolder
+	accessLogStoreHolder = store
+	accessLogStoreMu.Unlock()
+	return func() {
+		accessLogStoreMu.Lock()
+		accessLogStoreHolder = previous
+		accessLogStoreMu.Unlock()
+	}
+}
+
+// NewMemoryAccessLogStore returns an in-memory access log store for unit tests.
+func NewMemoryAccessLogStore() accessLogStore {
+	return &memoryAccessLogStore{
+		records: make([]*OpenFlareAccessLog, 0),
+	}
+}
+
+type clickhouseAccessLogStore struct{}
+
+func (clickhouseAccessLogStore) conn() (driver.Conn, error) {
+	if db.ChConn == nil {
+		return nil, errors.New(errClickHouseNotInitialized)
+	}
+	return db.ChConn, nil
+}
+
+func (clickhouseAccessLogStore) InsertBatch(ctx context.Context, records []*OpenFlareAccessLog) error {
+	if len(records) == 0 {
+		return nil
+	}
+	conn, err := clickhouseAccessLogStore{}.conn()
+	if err != nil {
+		return err
+	}
+	batch, err := conn.PrepareBatch(ctx, fmt.Sprintf(
+		"INSERT INTO %s (id, node_id, logged_at, remote_addr, region, host, path, status_code, created_at)",
+		openFlareAccessLogTable,
+	))
+	if err != nil {
+		return err
+	}
+	now := time.Now().UTC()
+	for _, record := range records {
+		if record == nil {
+			continue
+		}
+		id := record.ID
+		if id == 0 {
+			id = uint(idgen.NextUint64ID())
+		}
+		createdAt := record.CreatedAt
+		if createdAt.IsZero() {
+			createdAt = now
+		}
+		if err := batch.Append(
+			uint64(id),
+			record.NodeID,
+			record.LoggedAt.UTC(),
+			record.RemoteAddr,
+			record.Region,
+			record.Host,
+			record.Path,
+			int32(record.StatusCode),
+			createdAt.UTC(),
+		); err != nil {
+			return err
+		}
+	}
+	return batch.Send()
+}
+
+func (clickhouseAccessLogStore) List(ctx context.Context, query OpenFlareAccessLogQuery) ([]*OpenFlareAccessLog, error) {
+	conn, err := clickhouseAccessLogStore{}.conn()
+	if err != nil {
+		return nil, err
+	}
+	clause, args := buildOpenFlareAccessLogFilterClause(query)
+	sql := fmt.Sprintf(`
+SELECT id, node_id, logged_at, remote_addr, region, host, path, status_code, created_at
+FROM %s
+WHERE %s
+ORDER BY %s`, openFlareAccessLogTable, clause, openFlareAccessLogOrderClause(query.SortBy, query.SortOrder))
+	if query.PageSize > 0 {
+		if query.Page < 0 {
+			query.Page = 0
+		}
+		sql += " LIMIT ? OFFSET ?"
+		args = append(args, query.PageSize, query.Page*query.PageSize)
+	}
+	rows, err := conn.Query(ctx, sql, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = rows.Close() }()
+	return scanOpenFlareAccessLogRows(rows)
+}
+
+func scanOpenFlareAccessLogRows(rows driver.Rows) ([]*OpenFlareAccessLog, error) {
+	var result []*OpenFlareAccessLog
+	for rows.Next() {
+		var (
+			id         uint64
+			nodeID     string
+			loggedAt   time.Time
+			remoteAddr string
+			region     string
+			host       string
+			path       string
+			statusCode int32
+			createdAt  time.Time
+		)
+		if err := rows.Scan(&id, &nodeID, &loggedAt, &remoteAddr, &region, &host, &path, &statusCode, &createdAt); err != nil {
+			return nil, err
+		}
+		result = append(result, &OpenFlareAccessLog{
+			ID:         uint(id),
+			NodeID:     nodeID,
+			LoggedAt:   loggedAt.UTC(),
+			RemoteAddr: remoteAddr,
+			Region:     region,
+			Host:       host,
+			Path:       path,
+			StatusCode: int(statusCode),
+			CreatedAt:  createdAt.UTC(),
+		})
+	}
+	return result, nil
+}
+
+func (clickhouseAccessLogStore) Count(ctx context.Context, query OpenFlareAccessLogQuery) (int64, int64, error) {
+	conn, err := clickhouseAccessLogStore{}.conn()
+	if err != nil {
+		return 0, 0, err
+	}
+	clause, args := buildOpenFlareAccessLogFilterClause(query)
+	var totalRecords int64
+	countSQL := fmt.Sprintf("SELECT count() FROM %s WHERE %s", openFlareAccessLogTable, clause)
+	if err := conn.QueryRow(ctx, countSQL, args...).Scan(&totalRecords); err != nil {
+		return 0, 0, err
+	}
+	ipSQL := fmt.Sprintf(`
+SELECT count() FROM (
+	SELECT trim(remote_addr) AS remote_addr
+	FROM %s
+	WHERE %s AND remote_addr != ''
+	GROUP BY trim(remote_addr)
+)`, openFlareAccessLogTable, clause)
+	var totalIPs int64
+	if err := conn.QueryRow(ctx, ipSQL, args...).Scan(&totalIPs); err != nil {
+		return 0, 0, err
+	}
+	return totalRecords, totalIPs, nil
+}
+
+func (clickhouseAccessLogStore) RegionCounts(ctx context.Context, nodeID string, since time.Time, limit int) ([]*OpenFlareAccessLogRegionCount, error) {
+	conn, err := clickhouseAccessLogStore{}.conn()
+	if err != nil {
+		return nil, err
+	}
+	filter := OpenFlareAccessLogQuery{NodeID: nodeID, Since: since}
+	clause, args := buildOpenFlareAccessLogFilterClause(filter)
+	sql := fmt.Sprintf(`
+SELECT trim(region) AS region, count() AS count
+FROM %s
+WHERE %s AND trim(region) != ''
+GROUP BY trim(region)
+ORDER BY count DESC, region ASC`, openFlareAccessLogTable, clause)
+	if limit > 0 {
+		sql += " LIMIT ?"
+		args = append(args, limit)
+	}
+	rows, err := conn.Query(ctx, sql, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = rows.Close() }()
+	var result []*OpenFlareAccessLogRegionCount
+	for rows.Next() {
+		var item OpenFlareAccessLogRegionCount
+		if err := rows.Scan(&item.Region, &item.Count); err != nil {
+			return nil, err
+		}
+		result = append(result, &item)
+	}
+	return result, nil
+}
+
+func (clickhouseAccessLogStore) BucketAggregates(ctx context.Context, filter OpenFlareAccessLogQuery, bucketSeconds int64) ([]openFlareAccessLogBucketAggregateRow, error) {
+	conn, err := clickhouseAccessLogStore{}.conn()
+	if err != nil {
+		return nil, err
+	}
+	clause, args := buildOpenFlareAccessLogFilterClause(filter)
+	bucketExpr := openFlareAccessLogBucketEpochExpr(bucketSeconds)
+	sql := fmt.Sprintf(`
+SELECT
+	%s AS bucket_epoch,
+	count() AS request_count,
+	countIf(status_code < 400) AS success_count,
+	countIf(status_code >= 400 AND status_code < 500) AS client_error_count,
+	countIf(status_code >= 500) AS server_error_count
+FROM %s
+WHERE %s
+GROUP BY bucket_epoch`, bucketExpr, openFlareAccessLogTable, clause)
+	rows, err := conn.Query(ctx, sql, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = rows.Close() }()
+	var result []openFlareAccessLogBucketAggregateRow
+	for rows.Next() {
+		var item openFlareAccessLogBucketAggregateRow
+		if err := rows.Scan(&item.BucketEpoch, &item.RequestCount, &item.SuccessCount, &item.ClientErrorCount, &item.ServerErrorCount); err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, nil
+}
+
+func (clickhouseAccessLogStore) BucketDimensions(ctx context.Context, filter OpenFlareAccessLogQuery, column string, bucketSeconds int64) ([]openFlareAccessLogBucketDimensionRow, error) {
+	conn, err := clickhouseAccessLogStore{}.conn()
+	if err != nil {
+		return nil, err
+	}
+	clause, args := buildOpenFlareAccessLogFilterClause(filter)
+	bucketExpr := openFlareAccessLogBucketEpochExpr(bucketSeconds)
+	sql := fmt.Sprintf(`
+SELECT
+	%s AS bucket_epoch,
+	trim(%s) AS value
+FROM %s
+WHERE %s AND trim(%s) != ''
+GROUP BY bucket_epoch, trim(%s)`, bucketExpr, column, openFlareAccessLogTable, clause, column, column)
+	rows, err := conn.Query(ctx, sql, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = rows.Close() }()
+	var result []openFlareAccessLogBucketDimensionRow
+	for rows.Next() {
+		var item openFlareAccessLogBucketDimensionRow
+		if err := rows.Scan(&item.BucketEpoch, &item.Value); err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, nil
+}
+
+func (clickhouseAccessLogStore) IPAggregates(ctx context.Context, filter OpenFlareAccessLogQuery, exactRemoteAddr bool) ([]openFlareAccessLogIPAggregateRow, error) {
+	conn, err := clickhouseAccessLogStore{}.conn()
+	if err != nil {
+		return nil, err
+	}
+	clause, args := buildOpenFlareAccessLogFilterClause(filter)
+	queryClause := clause
+	queryArgs := append([]any{}, args...)
+	if exactRemoteAddr {
+		trimmed := strings.TrimSpace(filter.RemoteAddr)
+		if trimmed == "" {
+			return []openFlareAccessLogIPAggregateRow{}, nil
+		}
+		queryClause = combineOpenFlareAccessLogSQLClauses(queryClause, "trim(remote_addr) = ?")
+		queryArgs = append(queryArgs, trimmed)
+	}
+	lastSeenExpr := openFlareAccessLogEpochExpr()
+	sql := fmt.Sprintf(`
+SELECT
+	trim(remote_addr) AS remote_addr,
+	count() AS request_count,
+	countIf(status_code < 400) AS success_count,
+	countIf(status_code >= 400 AND status_code < 500) AS client_error_count,
+	countIf(status_code >= 500) AS server_error_count,
+	max(%s) AS last_seen_epoch
+FROM %s
+WHERE %s AND trim(remote_addr) != ''
+GROUP BY trim(remote_addr)`, lastSeenExpr, openFlareAccessLogTable, queryClause)
+	rows, err := conn.Query(ctx, sql, queryArgs...)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = rows.Close() }()
+	var result []openFlareAccessLogIPAggregateRow
+	for rows.Next() {
+		var item openFlareAccessLogIPAggregateRow
+		if err := rows.Scan(&item.RemoteAddr, &item.RequestCount, &item.SuccessCount, &item.ClientErrorCount, &item.ServerErrorCount, &item.LastSeenEpoch); err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, nil
+}
+
+func (clickhouseAccessLogStore) IPSummaries(ctx context.Context, filter OpenFlareAccessLogQuery, recentSince time.Time) ([]openFlareAccessLogIPSummaryRow, error) {
+	conn, err := clickhouseAccessLogStore{}.conn()
+	if err != nil {
+		return nil, err
+	}
+	clause, args := buildOpenFlareAccessLogFilterClause(filter)
+	lastSeenExpr := openFlareAccessLogEpochExpr()
+	recentClause := "0"
+	queryArgs := make([]any, 0, len(args)+1)
+	if !recentSince.IsZero() {
+		recentClause = "if(logged_at >= ?, 1, 0)"
+		queryArgs = append(queryArgs, recentSince)
+	}
+	queryArgs = append(queryArgs, args...)
+	sql := fmt.Sprintf(`
+SELECT
+	trim(remote_addr) AS remote_addr,
+	count() AS total_requests,
+	sum(%s) AS recent_requests,
+	max(%s) AS last_seen_epoch
+FROM %s
+WHERE %s AND trim(remote_addr) != ''
+GROUP BY trim(remote_addr)`, recentClause, lastSeenExpr, openFlareAccessLogTable, clause)
+	rows, err := conn.Query(ctx, sql, queryArgs...)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = rows.Close() }()
+	var result []openFlareAccessLogIPSummaryRow
+	for rows.Next() {
+		var item openFlareAccessLogIPSummaryRow
+		if err := rows.Scan(&item.RemoteAddr, &item.TotalRequests, &item.RecentRequests, &item.LastSeenEpoch); err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, nil
+}
+
+func (clickhouseAccessLogStore) IPTrend(ctx context.Context, filter OpenFlareAccessLogQuery, bucketSeconds int64) ([]openFlareAccessLogIPTrendRow, error) {
+	conn, err := clickhouseAccessLogStore{}.conn()
+	if err != nil {
+		return nil, err
+	}
+	clause, args := buildOpenFlareAccessLogFilterClause(filter)
+	bucketExpr := openFlareAccessLogBucketEpochExpr(bucketSeconds)
+	sql := fmt.Sprintf(`
+SELECT
+	%s AS bucket_epoch,
+	count() AS request_count
+FROM %s
+WHERE %s
+GROUP BY bucket_epoch
+ORDER BY bucket_epoch ASC`, bucketExpr, openFlareAccessLogTable, clause)
+	rows, err := conn.Query(ctx, sql, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = rows.Close() }()
+	var result []openFlareAccessLogIPTrendRow
+	for rows.Next() {
+		var item openFlareAccessLogIPTrendRow
+		if err := rows.Scan(&item.BucketEpoch, &item.RequestCount); err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, nil
+}
+
+func (s clickhouseAccessLogStore) DeleteAll(ctx context.Context) (int64, error) {
+	return s.deleteWithCount(ctx, "SELECT count() FROM "+openFlareAccessLogTable, nil, "ALTER TABLE "+openFlareAccessLogTable+" DELETE WHERE 1")
+}
+
+func (s clickhouseAccessLogStore) DeleteBefore(ctx context.Context, cutoff time.Time) (int64, error) {
+	return s.deleteWithCount(
+		ctx,
+		fmt.Sprintf("SELECT count() FROM %s WHERE logged_at < ?", openFlareAccessLogTable),
+		[]any{cutoff.UTC()},
+		fmt.Sprintf("ALTER TABLE %s DELETE WHERE logged_at < ?", openFlareAccessLogTable),
+		cutoff.UTC(),
+	)
+}
+
+func (s clickhouseAccessLogStore) DeleteByNodeBefore(ctx context.Context, nodeID string, before time.Time) (int64, error) {
+	return s.deleteWithCount(
+		ctx,
+		fmt.Sprintf("SELECT count() FROM %s WHERE node_id = ? AND logged_at < ?", openFlareAccessLogTable),
+		[]any{nodeID, before.UTC()},
+		fmt.Sprintf("ALTER TABLE %s DELETE WHERE node_id = ? AND logged_at < ?", openFlareAccessLogTable),
+		nodeID, before.UTC(),
+	)
+}
+
+func (clickhouseAccessLogStore) deleteWithCount(ctx context.Context, countSQL string, countArgs []any, deleteSQL string, deleteArgs ...any) (int64, error) {
+	conn, err := clickhouseAccessLogStore{}.conn()
+	if err != nil {
+		return 0, err
+	}
+	var count int64
+	if err := conn.QueryRow(ctx, countSQL, countArgs...).Scan(&count); err != nil {
+		return 0, err
+	}
+	if count == 0 {
+		return 0, nil
+	}
+	if err := conn.Exec(ctx, deleteSQL, deleteArgs...); err != nil {
+		return 0, err
+	}
+	return count, nil
+}
+
+func openFlareAccessLogBucketEpochExpr(bucketSeconds int64) string {
+	return fmt.Sprintf("toInt64(intDiv(toUnixTimestamp(logged_at), %d) * %d)", bucketSeconds, bucketSeconds)
+}
+
+func openFlareAccessLogEpochExpr() string {
+	return "toInt64(toUnixTimestamp(logged_at))"
+}

openflare-server/internal/model/openflare_access_log_store_memory.go

@@ -0,0 +1,379 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package model
+
+import (
+	"context"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/Rain-kl/Wavelet/internal/db/idgen"
+)
+
+type memoryAccessLogStore struct {
+	mu      sync.RWMutex
+	records []*OpenFlareAccessLog
+}
+
+func (s *memoryAccessLogStore) InsertBatch(_ context.Context, records []*OpenFlareAccessLog) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	now := time.Now().UTC()
+	for _, record := range records {
+		if record == nil {
+			continue
+		}
+		copyRecord := *record
+		if copyRecord.ID == 0 {
+			copyRecord.ID = uint(idgen.NextUint64ID())
+		}
+		if copyRecord.CreatedAt.IsZero() {
+			copyRecord.CreatedAt = now
+		}
+		copyRecord.LoggedAt = copyRecord.LoggedAt.UTC()
+		copyRecord.CreatedAt = copyRecord.CreatedAt.UTC()
+		s.records = append(s.records, &copyRecord)
+	}
+	return nil
+}
+
+func (s *memoryAccessLogStore) List(_ context.Context, query OpenFlareAccessLogQuery) ([]*OpenFlareAccessLog, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	rows := s.filterRecords(query)
+	sortOpenFlareAccessLogRows(rows, query.SortBy, query.SortOrder)
+	if query.PageSize > 0 {
+		start, end := openFlareAccessLogPaginateBounds(len(rows), query.Page, query.PageSize)
+		return cloneAccessLogSlice(rows[start:end]), nil
+	}
+	return cloneAccessLogSlice(rows), nil
+}
+
+func (s *memoryAccessLogStore) Count(_ context.Context, query OpenFlareAccessLogQuery) (int64, int64, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	rows := s.filterRecords(query)
+	ips := make(map[string]struct{})
+	for _, row := range rows {
+		remoteAddr := strings.TrimSpace(row.RemoteAddr)
+		if remoteAddr == "" {
+			continue
+		}
+		ips[remoteAddr] = struct{}{}
+	}
+	return int64(len(rows)), int64(len(ips)), nil
+}
+
+func (s *memoryAccessLogStore) RegionCounts(_ context.Context, nodeID string, since time.Time, limit int) ([]*OpenFlareAccessLogRegionCount, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	rows := s.filterRecords(OpenFlareAccessLogQuery{NodeID: nodeID, Since: since})
+	counts := make(map[string]int64)
+	for _, row := range rows {
+		region := strings.TrimSpace(row.Region)
+		if region == "" {
+			continue
+		}
+		counts[region]++
+	}
+	result := make([]*OpenFlareAccessLogRegionCount, 0, len(counts))
+	for region, count := range counts {
+		result = append(result, &OpenFlareAccessLogRegionCount{Region: region, Count: count})
+	}
+	sort.Slice(result, func(i, j int) bool {
+		if result[i].Count == result[j].Count {
+			return result[i].Region < result[j].Region
+		}
+		return result[i].Count > result[j].Count
+	})
+	if limit > 0 && len(result) > limit {
+		result = result[:limit]
+	}
+	return result, nil
+}
+
+func (s *memoryAccessLogStore) BucketAggregates(_ context.Context, filter OpenFlareAccessLogQuery, bucketSeconds int64) ([]openFlareAccessLogBucketAggregateRow, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	rows := s.filterRecords(filter)
+	aggregates := make(map[int64]*openFlareAccessLogBucketAggregateRow)
+	for _, row := range rows {
+		bucketEpoch := memoryAccessLogBucketEpoch(row.LoggedAt, bucketSeconds)
+		item := aggregates[bucketEpoch]
+		if item == nil {
+			item = &openFlareAccessLogBucketAggregateRow{BucketEpoch: bucketEpoch}
+			aggregates[bucketEpoch] = item
+		}
+		item.RequestCount++
+		switch {
+		case row.StatusCode < 400:
+			item.SuccessCount++
+		case row.StatusCode < 500:
+			item.ClientErrorCount++
+		default:
+			item.ServerErrorCount++
+		}
+	}
+	result := make([]openFlareAccessLogBucketAggregateRow, 0, len(aggregates))
+	for _, item := range aggregates {
+		result = append(result, *item)
+	}
+	return result, nil
+}
+
+func (s *memoryAccessLogStore) BucketDimensions(_ context.Context, filter OpenFlareAccessLogQuery, column string, bucketSeconds int64) ([]openFlareAccessLogBucketDimensionRow, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	rows := s.filterRecords(filter)
+	seen := make(map[int64]map[string]struct{})
+	var result []openFlareAccessLogBucketDimensionRow
+	for _, row := range rows {
+		var value string
+		switch column {
+		case "remote_addr":
+			value = strings.TrimSpace(row.RemoteAddr)
+		case "host":
+			value = strings.TrimSpace(row.Host)
+		default:
+			continue
+		}
+		if value == "" {
+			continue
+		}
+		bucketEpoch := memoryAccessLogBucketEpoch(row.LoggedAt, bucketSeconds)
+		if seen[bucketEpoch] == nil {
+			seen[bucketEpoch] = make(map[string]struct{})
+		}
+		if _, ok := seen[bucketEpoch][value]; ok {
+			continue
+		}
+		seen[bucketEpoch][value] = struct{}{}
+		result = append(result, openFlareAccessLogBucketDimensionRow{BucketEpoch: bucketEpoch, Value: value})
+	}
+	return result, nil
+}
+
+func (s *memoryAccessLogStore) IPAggregates(_ context.Context, filter OpenFlareAccessLogQuery, exactRemoteAddr bool) ([]openFlareAccessLogIPAggregateRow, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	if exactRemoteAddr && strings.TrimSpace(filter.RemoteAddr) == "" {
+		return []openFlareAccessLogIPAggregateRow{}, nil
+	}
+	rows := s.filterRecords(filter)
+	aggregates := make(map[string]*openFlareAccessLogIPAggregateRow)
+	for _, row := range rows {
+		remoteAddr := strings.TrimSpace(row.RemoteAddr)
+		if remoteAddr == "" {
+			continue
+		}
+		if exactRemoteAddr && remoteAddr != strings.TrimSpace(filter.RemoteAddr) {
+			continue
+		}
+		item := aggregates[remoteAddr]
+		if item == nil {
+			item = &openFlareAccessLogIPAggregateRow{RemoteAddr: remoteAddr}
+			aggregates[remoteAddr] = item
+		}
+		item.RequestCount++
+		epoch := row.LoggedAt.UTC().Unix()
+		if epoch > item.LastSeenEpoch {
+			item.LastSeenEpoch = epoch
+		}
+		switch {
+		case row.StatusCode < 400:
+			item.SuccessCount++
+		case row.StatusCode < 500:
+			item.ClientErrorCount++
+		default:
+			item.ServerErrorCount++
+		}
+	}
+	result := make([]openFlareAccessLogIPAggregateRow, 0, len(aggregates))
+	for _, item := range aggregates {
+		result = append(result, *item)
+	}
+	return result, nil
+}
+
+func (s *memoryAccessLogStore) IPSummaries(_ context.Context, filter OpenFlareAccessLogQuery, recentSince time.Time) ([]openFlareAccessLogIPSummaryRow, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	rows := s.filterRecords(filter)
+	aggregates := make(map[string]*openFlareAccessLogIPSummaryRow)
+	for _, row := range rows {
+		remoteAddr := strings.TrimSpace(row.RemoteAddr)
+		if remoteAddr == "" {
+			continue
+		}
+		item := aggregates[remoteAddr]
+		if item == nil {
+			item = &openFlareAccessLogIPSummaryRow{RemoteAddr: remoteAddr}
+			aggregates[remoteAddr] = item
+		}
+		item.TotalRequests++
+		if !recentSince.IsZero() && !row.LoggedAt.Before(recentSince) {
+			item.RecentRequests++
+		}
+		epoch := row.LoggedAt.UTC().Unix()
+		if epoch > item.LastSeenEpoch {
+			item.LastSeenEpoch = epoch
+		}
+	}
+	result := make([]openFlareAccessLogIPSummaryRow, 0, len(aggregates))
+	for _, item := range aggregates {
+		result = append(result, *item)
+	}
+	return result, nil
+}
+
+func (s *memoryAccessLogStore) IPTrend(_ context.Context, filter OpenFlareAccessLogQuery, bucketSeconds int64) ([]openFlareAccessLogIPTrendRow, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	rows := s.filterRecords(filter)
+	aggregates := make(map[int64]int64)
+	for _, row := range rows {
+		bucketEpoch := memoryAccessLogBucketEpoch(row.LoggedAt, bucketSeconds)
+		aggregates[bucketEpoch]++
+	}
+	result := make([]openFlareAccessLogIPTrendRow, 0, len(aggregates))
+	for bucketEpoch, count := range aggregates {
+		result = append(result, openFlareAccessLogIPTrendRow{BucketEpoch: bucketEpoch, RequestCount: count})
+	}
+	sort.Slice(result, func(i, j int) bool { return result[i].BucketEpoch < result[j].BucketEpoch })
+	return result, nil
+}
+
+func (s *memoryAccessLogStore) DeleteAll(_ context.Context) (int64, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	count := int64(len(s.records))
+	s.records = nil
+	return count, nil
+}
+
+func (s *memoryAccessLogStore) DeleteBefore(_ context.Context, cutoff time.Time) (int64, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	cutoff = cutoff.UTC()
+	remaining := make([]*OpenFlareAccessLog, 0, len(s.records))
+	var deleted int64
+	for _, row := range s.records {
+		if row.LoggedAt.Before(cutoff) {
+			deleted++
+			continue
+		}
+		remaining = append(remaining, row)
+	}
+	s.records = remaining
+	return deleted, nil
+}
+
+func (s *memoryAccessLogStore) DeleteByNodeBefore(_ context.Context, nodeID string, before time.Time) (int64, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	before = before.UTC()
+	remaining := make([]*OpenFlareAccessLog, 0, len(s.records))
+	var deleted int64
+	for _, row := range s.records {
+		if row.NodeID == nodeID && row.LoggedAt.Before(before) {
+			deleted++
+			continue
+		}
+		remaining = append(remaining, row)
+	}
+	s.records = remaining
+	return deleted, nil
+}
+
+func (s *memoryAccessLogStore) filterRecords(query OpenFlareAccessLogQuery) []*OpenFlareAccessLog {
+	result := make([]*OpenFlareAccessLog, 0, len(s.records))
+	for _, row := range s.records {
+		if !memoryAccessLogMatches(row, query) {
+			continue
+		}
+		result = append(result, row)
+	}
+	return result
+}
+
+func memoryAccessLogMatches(row *OpenFlareAccessLog, query OpenFlareAccessLogQuery) bool {
+	if row == nil {
+		return false
+	}
+	if trimmed := strings.TrimSpace(query.NodeID); trimmed != "" && row.NodeID != trimmed {
+		return false
+	}
+	if trimmed := strings.TrimSpace(query.RemoteAddr); trimmed != "" && !strings.HasPrefix(strings.TrimSpace(row.RemoteAddr), trimmed) {
+		return false
+	}
+	if trimmed := strings.TrimSpace(query.Host); trimmed != "" && !strings.HasPrefix(strings.TrimSpace(row.Host), trimmed) {
+		return false
+	}
+	if trimmed := strings.TrimSpace(query.Path); trimmed != "" && !strings.HasPrefix(strings.TrimSpace(row.Path), trimmed) {
+		return false
+	}
+	if !query.Since.IsZero() && row.LoggedAt.Before(query.Since) {
+		return false
+	}
+	if !query.Until.IsZero() && !row.LoggedAt.Before(query.Until) {
+		return false
+	}
+	return true
+}
+
+func memoryAccessLogBucketEpoch(loggedAt time.Time, bucketSeconds int64) int64 {
+	if bucketSeconds <= 0 {
+		bucketSeconds = 180
+	}
+	epoch := loggedAt.UTC().Unix()
+	return (epoch / bucketSeconds) * bucketSeconds
+}
+
+func cloneAccessLogSlice(rows []*OpenFlareAccessLog) []*OpenFlareAccessLog {
+	result := make([]*OpenFlareAccessLog, len(rows))
+	for index, row := range rows {
+		if row == nil {
+			continue
+		}
+		copyRecord := *row
+		result[index] = &copyRecord
+	}
+	return result
+}
+
+func sortOpenFlareAccessLogRows(items []*OpenFlareAccessLog, sortBy string, sortOrder string) {
+	desc := openFlareAccessLogNormalizeSortOrder(sortOrder) != "asc"
+	sort.Slice(items, func(i, j int) bool {
+		left := items[i]
+		right := items[j]
+		if left == nil || right == nil {
+			return left != nil
+		}
+		var compare int
+		switch strings.TrimSpace(sortBy) {
+		case "status_code":
+			compare = left.StatusCode - right.StatusCode
+		case "remote_addr":
+			compare = strings.Compare(left.RemoteAddr, right.RemoteAddr)
+		case "host":
+			compare = strings.Compare(left.Host, right.Host)
+		case "path":
+			compare = strings.Compare(left.Path, right.Path)
+		default:
+			compare = openFlareAccessLogCompareInt64(left.LoggedAt.Unix(), right.LoggedAt.Unix())
+		}
+		if compare == 0 {
+			compare = openFlareAccessLogCompareInt64(left.LoggedAt.Unix(), right.LoggedAt.Unix())
+		}
+		if compare == 0 {
+			compare = openFlareAccessLogCompareInt64(int64(left.ID), int64(right.ID))
+		}
+		if desc {
+			return compare > 0
+		}
+		return compare < 0
+	})
+}

openflare-server/internal/model/openflare_access_log_test.go

@@ -9,23 +9,16 @@ import (
 	"testing"
 	"time"
 
-	"github.com/Rain-kl/Wavelet/internal/db"
-	"github.com/glebarez/sqlite"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gorm.io/gorm"
 )
 
 func setupOpenFlareAccessLogTestEnvironment(t *testing.T) (context.Context, func()) {
 	t.Helper()
-	sqliteDB, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{
-		DisableForeignKeyConstraintWhenMigrating: true,
-	})
-	require.NoError(t, err)
-	require.NoError(t, sqliteDB.AutoMigrate(&OpenFlareAccessLog{}))
-	db.SetDB(sqliteDB)
+	store := NewMemoryAccessLogStore()
+	reset := SetAccessLogStoreForTest(store)
 	return context.Background(), func() {
-		db.SetDB(nil)
+		reset()
 	}
 }
 
@@ -38,9 +31,7 @@ func seedOpenFlareAccessLogs(t *testing.T, ctx context.Context, now time.Time) {
 		{NodeID: "node-b", LoggedAt: now.Add(-2 * time.Minute), RemoteAddr: "3.3.3.3", Region: "EU", Host: "b.example.com", Path: "/delta", StatusCode: 200},
 		{NodeID: "node-b", LoggedAt: now.Add(-1 * time.Minute), RemoteAddr: "", Region: "", Host: "b.example.com", Path: "/empty-ip", StatusCode: 200},
 	}
-	for index, record := range records {
-		require.NoError(t, db.DB(ctx).Create(record).Error, "seed access log %d", index)
-	}
+	require.NoError(t, InsertOpenFlareAccessLogsBatch(ctx, records))
 }
 
 func TestListOpenFlareAccessLogsPaginated(t *testing.T) {
@@ -57,7 +48,7 @@ func TestListOpenFlareAccessLogsPaginated(t *testing.T) {
 			Path:       fmt.Sprintf("/path-%02d", index),
 			StatusCode: 200,
 		}
-		require.NoError(t, db.DB(ctx).Create(record).Error)
+		require.NoError(t, InsertOpenFlareAccessLogsBatch(ctx, []*OpenFlareAccessLog{record}))
 	}
 
 	query := OpenFlareAccessLogQuery{
@@ -111,22 +102,6 @@ func TestListOpenFlareAccessLogsFiltersAndSort(t *testing.T) {
 	assert.Equal(t, 200, rows[1].StatusCode)
 }
 
-func TestListOpenFlareAccessLogsMissingTableGraceful(t *testing.T) {
-	ctx, cleanup := setupOpenFlareAccessLogTestEnvironment(t)
-	defer cleanup()
-	require.NoError(t, db.DB(ctx).Migrator().DropTable(&OpenFlareAccessLog{}))
-
-	query := OpenFlareAccessLogQuery{Since: time.Now().UTC().Add(-time.Hour)}
-	rows, err := ListOpenFlareAccessLogs(ctx, query)
-	require.NoError(t, err)
-	assert.Empty(t, rows)
-
-	totalRecords, totalIPs, err := CountOpenFlareAccessLogs(ctx, query)
-	require.NoError(t, err)
-	assert.Zero(t, totalRecords)
-	assert.Zero(t, totalIPs)
-}
-
 func TestDeleteOpenFlareAccessLogsBefore(t *testing.T) {
 	ctx, cleanup := setupOpenFlareAccessLogTestEnvironment(t)
 	defer cleanup()
@@ -141,4 +116,4 @@ func TestDeleteOpenFlareAccessLogsBefore(t *testing.T) {
 	totalRecords, _, err := CountOpenFlareAccessLogs(ctx, OpenFlareAccessLogQuery{Since: now.Add(-10 * time.Minute)})
 	require.NoError(t, err)
 	assert.Equal(t, int64(2), totalRecords)
-}
+}

openflare-server/internal/model/openflare_observability.go

@@ -55,7 +55,7 @@ func (OpenFlareRequestReport) TableName() string {
 	return "of_node_request_reports"
 }
 
-// OpenFlareAccessLog stores a single access log row (v1 single table, no sharding).
+// OpenFlareAccessLog stores a single access log row in ClickHouse (database: openflare).
 type OpenFlareAccessLog struct {
 	ID         uint      `json:"id" gorm:"primaryKey;autoIncrement"`
 	NodeID     string    `json:"node_id" gorm:"index;size:64;not null"`