dexiecable 2.0.1 → 2.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 05e9525058173a0392999802c6243cac3eb5c0406a28cb405963a9069d20b098
-  data.tar.gz: 3394af2d34854137a4032dd672bb0e1ebc6073e907872b168a5e31e9ffea1daf
+  metadata.gz: c5284c177e5517bff845edf2e5317d1ab9c676deafd605a662b3dea1b7363b6a
+  data.tar.gz: 94f3e811e2bca16d05967c0c0dbf242bcae00b880212ad0dba7d1ee44f8263c9
 SHA512:
-  metadata.gz: 936fa88cb0cd6dc55665e9214d54064eb914863552bf8b84e58e1ca4d616751863f9572740ceb00c7b09503ed9996fe9ec52640a65279b2bc5249498d3671684
-  data.tar.gz: 1b9a73d2e21d3ac4e5138feeb1c13c958f9b4eccffeb7968c0f7fbc28a45cd24b8dff7f6ab4e2f976730536dcee3fc30758cae5aaa04c4bd8dd3940ec83b5ef6
+  metadata.gz: 4999890a88da548b86e19843b40a0221654eb2a144ec52f954c7723cb652c287d7884fd34e0703d5895131e3b1213ee840a427f31defa91ff21738a38133514a
+  data.tar.gz: 67bb97e60d5d9fc7416e239e0695b69ff00a4930df8d97d8380da29bd51686af9f2d70f04bd69d92322e61ea042a71704ce4e98bbc35d14ee5f0a33d13343def

data/README.md

@@ -1,9 +1,9 @@
 # DexieCable
 
 > [!NOTE]
-> DexieCable is NOT meant to be a local-first solution. It has no automatic capability to sync updates back to the server. For now, think of it as an alternative to Turbo Streams built with component frameworks (Vue, React, Svelte, etc) in mind.
+> By itself, DexieCable is NOT a local-first solution. It has no automatic capability to push client-side changes back to the server.
 >
-> Full synchronization utilizing event streams will arrive in DexieCable 3.0.
+> An addon providing full synchronization based on event streams is currently in development. But for now, if you need full synchronization, you'll have to roll your own.
 
 DexieCable gives your ActionCable channel a query DSL that mirrors the Dexie.js API, letting you push database mutations from the server to the client in real time. It also gives you a [`syncs_to_dexie`](#syncs_to_dexie-automatic-model-streaming) ActiveRecord macro for automatic change syncing.
 
@@ -26,6 +26,40 @@ class Notification < ApplicationRecord
 end
 ```
 
+## What's new in 2.0
+
+DexieCable 2.0 is a mixin. Create your own `DexieChannel` and `include DexieCable`:
+
+```ruby
+class DexieChannel < ApplicationCable::Channel
+  include DexieCable
+end
+```
+
+On the client, subscribe to that channel and add streams as needed. `addStream` accepts a signed token or a plain string, and returns a function that removes the stream:
+
+```js
+const subscription = subscribe(db);
+const unsubscribe = subscription.addStream(userStreamToken);
+```
+
+You can then use the new `subscribed_to` hook to push initial data before any live mutation arrives. The first argument is the record the token was issued for, or the plain stream name for a public stream:
+
+```ruby
+class DexieChannel < ApplicationCable::Channel
+  include DexieCable
+
+  def subscribed_to(record, params)
+    case record
+    when "feed"
+      table(record).bulkAdd(Announcement.for_stream(record).map(&:as_json_for_dexie))
+    when User
+      table("notifications").bulkAdd(record.notifications.map(&:as_json_for_dexie))
+    end
+  end
+end
+```
+
 ## Installation
 
 ### Ruby gem
@@ -101,6 +135,8 @@ Tokens never expire by default. Pass `expires_in:` or `expires_at:` to limit a t
 DexieChannel.stream_token_for(current_user, expires_in: 1.day)
 ```
 
+An expired token, or one whose record no longer exists, is rejected. Only plain strings are treated as public stream names.
+
 Send that token to the client (render it in a view, return it from an endpoint, etc.) and add it to the subscription:
 
 ```js
@@ -228,6 +264,9 @@ Add to any ActiveRecord model. Optionally provide the broadcast target.
 
 ```ruby
 class Message < ApplicationRecord
+  belongs_to :conversation
+  belongs_to :receiver
+  
   # Calls send(:receiver), then broadcasts: DexieChannel.broadcast_to(receiver, ...)
   syncs_to_dexie via: :receiver
 

data/lib/dexiecable/concern.rb

@@ -72,29 +72,35 @@ module DexieCable
   end
 
   def add_stream(data)
-    record = resolve_subscribe_target(data["stream"])
+    token = data["stream"].to_s
     params = data.except("action", "stream").with_indifferent_access
 
-    if record
+    if signed_token?(token)
+      # A token that no longer resolves (expired, revoked, deleted record) is
+      # rejected instead of being treated as a public stream name.
+      record = resolve_subscribe_target(token)
+      return unless record
+
       stream_for record
       subscribed_to(record, params)
     else
-      name = data["stream"].to_s
-      return if name.blank?
+      return if token.blank?
 
-      stream_from public_stream_name(name)
-      subscribed_to(name, params)
+      stream_from public_stream_name(token)
+      subscribed_to(token, params)
     end
   end
 
   def remove_stream(data)
-    record = resolve_subscribe_target(data["stream"])
+    token = data["stream"].to_s
+
+    if signed_token?(token)
+      record = resolve_subscribe_target(token)
+      return unless record
 
-    if record
       stop_stream_from self.class.broadcasting_for(record)
     else
-      name = data["stream"].to_s
-      stop_stream_from public_stream_name(name) if name.present?
+      stop_stream_from public_stream_name(token) if token.present?
     end
   end
 
@@ -110,6 +116,15 @@ module DexieCable
 
   private
 
+  # Distinguishes a signed stream token from a public stream name. A signed
+  # token keeps a valid signature even after it expires, which is what lets us
+  # reject expired tokens instead of falling back to a public stream.
+  def signed_token?(token)
+    return false if token.blank? || SignedGlobalID.verifier.nil?
+
+    SignedGlobalID.verifier.valid_message?(token)
+  end
+
   def public_stream_name(name)
     self.class.broadcasting_for("#{PUBLIC_STREAM_PREFIX}#{name}")
   end

data/lib/dexiecable/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DexieCable
-  VERSION = "2.0.1"
+  VERSION = "2.0.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dexiecable
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.0.2
 platform: ruby
 authors:
 - Stefan Buhrmester