monkrb 0.19.0 → 0.20.0

data/lib/monk/websocket/redis_fanout.rb

@@ -38,6 +38,83 @@ module Monk
       # already shareable.
       CHANNEL_PREFIX = "monk:ws:".freeze
 
+      # The body of #listen!'s subscriber Ractor. A class method because
+      # the Ractor has no RedisFanout instance to call into. Reports :ok,
+      # or why it couldn't subscribe, on `ready`, then relays messages for
+      # the rest of the process's life.
+      #
+      # A dropped connection (a Redis restart, a failover) is resubscribed
+      # with backoff. Messages published while it was down are lost, so
+      # once subscribed again every open socket is closed
+      # (Listeners::MISSED_CODE), and each client reconnects and resyncs.
+      def self.subscribe(registry, url, own_origin, ready)
+        listening = false
+        delay = Listeners::RETRY_INITIAL
+        loop do
+          Redis.new(url: url).psubscribe("#{CHANNEL_PREFIX}*") do |on|
+            on.psubscribe do
+              delay = Listeners::RETRY_INITIAL
+              if listening
+                closed = registry.close_all(Listeners::MISSED_CODE, Listeners::MISSED_REASON)
+                log(:info, "subscribed again; closed #{closed} socket(s) so their pages resync")
+              else
+                listening = true
+                ready.send(:ok)
+              end
+            end
+            on.pmessage { |_pattern, channel, envelope| relay(registry, own_origin, channel, envelope) }
+          end
+        rescue StandardError => e
+          # Not narrower: redis-rb lets redis-client's own
+          # RedisClient::ConnectionError out of psubscribe, not a
+          # Redis::BaseConnectionError. #relay rescues its own errors, so
+          # what gets here is the connection.
+          return ready.send("#{e.class}: #{e.message}") unless listening
+
+          log(:error, "subscriber connection failed (#{e.class}: #{e.message}); retrying in #{delay}s")
+          sleep delay
+          delay = Listeners.next_delay(delay)
+        end
+      end
+
+      # One message into this process's registry. Anything that goes wrong
+      # here drops this message only: escaping, it would end the
+      # subscriber Ractor, and with it every later broadcast, silently.
+      #
+      # Redis channel names are always Strings, but Registry's own keys
+      # are ordinary Hash keys the app chooses -- every existing caller
+      # (Registry's own tests, the websocket_server scaffold's :chat
+      # channel) uses a Symbol. #to_sym here is what makes
+      # registry.broadcast(:chat, ...) land on the same Hash key
+      # #register(:chat, port) used -- without it this silently
+      # broadcasts to an unrelated "chat" String key that nothing is ever
+      # registered under, and #broadcast still returns true either way
+      # (Registry#broadcast succeeds whether or not any port is registered
+      # for a key).
+      def self.relay(registry, own_origin, channel, envelope)
+        sender, payload = envelope.split("\0", 2)
+        raise ArgumentError, "no origin separator in the message" unless payload
+        return if sender == own_origin
+
+        registry.broadcast(channel.delete_prefix(CHANNEL_PREFIX).to_sym, payload)
+      rescue StandardError => e
+        log(:error, "dropped a message on #{channel}: #{e.class}: #{e.message}")
+      end
+
+      def self.log(level, message) = Listeners.log(name, level, message)
+      private_class_method :relay, :log
+
+      # Closes the calling Ractor's publisher client (#publisher), if it
+      # opened one; the next broadcast in this Ractor reconnects.
+      # Server.serve runs it as each socket ends, as PgFanout's.
+      def self.disconnect_publisher
+        client = Ractor.current[:monk_redis_fanout_publisher]
+        return unless client
+
+        Ractor.current[:monk_redis_fanout_publisher] = nil
+        client.close
+      end
+
       def initialize(registry, redis_url:)
         @registry = registry
         @redis_url = redis_url.dup.freeze
@@ -73,35 +150,7 @@ module Monk
         # Redis client itself is built inside the block, never passed in --
         # mirrors PG::Connection's per-Ractor pattern (persistence/pg.rb).
         Ractor.new(@registry, @redis_url, @origin, ready) do |registry, url, origin, ready|
-          subscribed = false
-          Redis.new(url: url).psubscribe("#{Monk::WebSocket::RedisFanout::CHANNEL_PREFIX}*") do |on|
-            on.psubscribe do
-              subscribed = true
-              ready.send(:ok)
-            end
-
-            on.pmessage do |_pattern, channel, envelope|
-              sender, payload = envelope.split("\0", 2)
-              next if sender == origin
-
-              # Redis channel names are always Strings, but Registry's own
-              # keys are ordinary Hash keys the app chooses -- every
-              # existing caller (Registry's own tests, the websocket_server
-              # scaffold's :chat channel) uses a Symbol. #to_sym here is
-              # what makes registry.broadcast(:chat, ...) land on the same
-              # Hash key #register(:chat, port) used -- without it this
-              # silently broadcasts to an unrelated "chat" String key that
-              # nothing is ever registered under, and #broadcast still
-              # returns true either way (Registry#broadcast succeeds
-              # whether or not any port is registered for a key).
-              key = channel.delete_prefix(Monk::WebSocket::RedisFanout::CHANNEL_PREFIX).to_sym
-              registry.broadcast(key, payload)
-            end
-          end
-        rescue StandardError => e
-          raise if subscribed
-
-          ready.send("#{e.class}: #{e.message}")
+          Monk::WebSocket::RedisFanout.subscribe(registry, url, origin, ready)
         end
 
         result = ready.receive

data/lib/monk/websocket/registry.rb

@@ -1,5 +1,10 @@
 module Monk
   module WebSocket
+    # Sent through a registered port instead of a payload: the socket
+    # behind it closes with this code and reason. Registry#close_all sends
+    # it; Connection's and Live::Session's relays act on it.
+    CloseRequest = Data.define(:code, :reason)
+
     # A dedicated Ractor holding the live set of connection handles keyed by
     # an app-assigned channel/subject -- mirrors StateRactor's shape
     # (docs/design/ractor.md): the mutable Hash stays hidden inside this one
@@ -41,6 +46,17 @@ module Monk
                 true
               when :count
                 keys[key].size
+              when :close_all
+                # Once per port: a Live page holds one port for all its
+                # topics. Entries stay until each connection's own cleanup
+                # unregisters them, as on any other close.
+                ports = keys.values.flatten.uniq
+                ports.each do |port|
+                  port.send(arg)
+                rescue Ractor::ClosedError
+                  nil
+                end
+                ports.size
               end
             reply_port.send(result)
           end
@@ -67,6 +83,14 @@ module Monk
         ask(:count, key, nil)
       end
 
+      # Closes every registered connection's socket with code and reason,
+      # so each client reconnects -- a fanout's subscriber does this after
+      # missing broadcasts, to make every page resync. Returns how many
+      # connections were asked to close.
+      def close_all(code, reason)
+        ask(:close_all, nil, Ractor.make_shareable(CloseRequest.new(code: code, reason: reason.to_s)))
+      end
+
       # Nothing to listen to: every broadcast reaching this registry comes
       # from this process. Here so a WS process calls #listen! the same
       # way whether it holds a Registry or a RedisFanout/PgFanout around

data/lib/monk/websocket/server.rb

@@ -40,6 +40,15 @@ module Monk
       # under true, and to an anonymous connection that sends an Origin,
       # since only a browser does.
       #
+      # db_pool: (a pool name, docs/history/plan-pg-pool.md) runs those
+      # Monk::Auth.verify calls -- the handshake's and reverify_interval's
+      # -- in that Monk::Persistence::Pg pool instead of in the socket's
+      # own Ractor. Without it, each socket's Ractor opens a connection of
+      # its own on the first verify and holds it while the socket is open:
+      # one Postgres connection per open page. With it, the server holds
+      # the pool's. Requires authenticate:, and the pool started
+      # (start_pools!) before the server.
+      #
       # max_payload_size: (bytes) -- see Connection::DEFAULT_MAX_PAYLOAD_SIZE
       # for what it guards against (gap 5). Unlike ping_interval:/
       # reverify_interval:, always on: this is insurance against a
@@ -53,7 +62,7 @@ module Monk
 
       def initialize(
         port:, bind: "0.0.0.0", allowed_origins: nil, authenticate: false, ping_interval: nil,
-        reverify_interval: nil, max_payload_size: Connection::DEFAULT_MAX_PAYLOAD_SIZE
+        reverify_interval: nil, max_payload_size: Connection::DEFAULT_MAX_PAYLOAD_SIZE, db_pool: nil
       )
         if ping_interval && !ping_interval.positive?
           raise ArgumentError, "ping_interval must be positive, got #{ping_interval.inspect}"
@@ -70,6 +79,8 @@ module Monk
           raise ArgumentError, "reverify_interval requires authenticate: true or :optional" unless authenticate
         end
 
+        raise ArgumentError, "db_pool requires authenticate: true or :optional" if db_pool && !authenticate
+
         unless max_payload_size.positive?
           raise ArgumentError, "max_payload_size must be positive, got #{max_payload_size.inspect}"
         end
@@ -91,12 +102,17 @@ module Monk
           Monk.freeze!
         end
 
+        # Raises now, not on the first connection, if the pool was never
+        # declared or isn't started in this process.
+        Monk::Persistence::Pg.pool(db_pool) if db_pool
+
         @tcp_server = TCPServer.new(bind, port)
         @allowed_origins = allowed_origins ? Ractor.make_shareable(allowed_origins.dup) : nil
         @authenticate = authenticate
         @ping_interval = ping_interval
         @reverify_interval = reverify_interval
         @max_payload_size = max_payload_size
+        @db_pool = db_pool
       end
 
       def port
@@ -117,12 +133,13 @@ module Monk
         loop do
           socket = @tcp_server.accept
           ractor = Ractor.new(
-            shareable_block, @authenticate, @allowed_origins, @ping_interval, @reverify_interval, @max_payload_size
-          ) do |blk, authenticate, origins, ping_interval, reverify_interval, max_payload_size|
+            shareable_block, @authenticate, @allowed_origins, @ping_interval, @reverify_interval, @max_payload_size,
+            @db_pool
+          ) do |blk, authenticate, origins, ping_interval, reverify_interval, max_payload_size, db_pool|
             Monk::WebSocket::Server.serve(
               Ractor.receive, blk,
-              authenticate: authenticate, allowed_origins: origins,
-              ping_interval: ping_interval, reverify_interval: reverify_interval, max_payload_size: max_payload_size
+              authenticate: authenticate, allowed_origins: origins, ping_interval: ping_interval,
+              reverify_interval: reverify_interval, max_payload_size: max_payload_size, db_pool: db_pool
             )
           end
           ractor.send(socket, move: true)
@@ -152,7 +169,7 @@ module Monk
       # TCPServer) is never Ractor-shareable and can't cross into here.
       def self.serve(
         socket, block, authenticate: false, allowed_origins: nil, ping_interval: nil, reverify_interval: nil,
-        max_payload_size: Connection::DEFAULT_MAX_PAYLOAD_SIZE
+        max_payload_size: Connection::DEFAULT_MAX_PAYLOAD_SIZE, db_pool: nil
       )
         request = read_handshake_request(socket)
         return socket.close unless request
@@ -167,12 +184,12 @@ module Monk
         subject = nil
         case authenticate
         when true
-          subject = authenticate!(socket, headers, allowed_origins)
+          subject = authenticate!(socket, headers, allowed_origins, db_pool)
           return unless subject
         when :optional
           return unless origin_allowed_for_optional?(socket, headers, allowed_origins)
 
-          subject = identify(headers)
+          subject = identify(headers, db_pool)
         end
 
         socket.write(Handshake.response_for(request))
@@ -181,7 +198,7 @@ module Monk
         connection.start_heartbeat(ping_interval) if ping_interval
         reverify_thread =
           if reverify_interval && subject
-            start_reverify(connection, Handshake.credential_from(headers)[:token], reverify_interval)
+            start_reverify(connection, Handshake.credential_from(headers)[:token], reverify_interval, db_pool)
           end
         begin
           block.call(connection)
@@ -201,7 +218,21 @@ module Monk
         connection&.unsubscribe!
         connection&.stop_heartbeat!
         socket.close
+        disconnect_all
+      end
+
+      # Closes the connections this socket's Ractor opened: its database
+      # connection (verifying the session without db_pool:, or a block
+      # that queries) and a fan-out's publisher (a block that broadcasts).
+      # Left alone, each would stay open until the garbage collector
+      # happened to run, which a mostly idle server may not do for a long
+      # time. The fan-outs are opt-in, so each is closed only if loaded.
+      def self.disconnect_all
+        Monk::Persistence.disconnect_all
+        PgFanout.disconnect_publisher if defined?(PgFanout)
+        RedisFanout.disconnect_publisher if defined?(RedisFanout)
       end
+      private_class_method :disconnect_all
 
       # docs/history/plan-websocket.md steps 22-23: the Origin allowlist check runs
       # before Monk::Auth.verify, and only for a cookie-derived
@@ -209,7 +240,7 @@ module Monk
       # by construction (mirrors require_csrf!'s own Bearer exemption in
       # docs/history/plan-auth.md). Returns the verified subject, or nil after writing
       # the appropriate 403/401 response itself.
-      def self.authenticate!(socket, headers, allowed_origins)
+      def self.authenticate!(socket, headers, allowed_origins, db_pool)
         credential = Handshake.credential_from(headers)
 
         if credential&.fetch(:via) == :cookie && allowed_origins
@@ -220,7 +251,7 @@ module Monk
           end
         end
 
-        subject = credential && Monk::Auth.verify(credential[:token])
+        subject = credential && verify(credential[:token], db_pool)
         socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n") unless subject
         subject
       end
@@ -248,9 +279,9 @@ module Monk
 
       # The subject of a valid session, or nil -- no credential, or one
       # Monk::Auth no longer accepts, both mean anonymous under :optional.
-      def self.identify(headers)
+      def self.identify(headers, db_pool)
         credential = Handshake.credential_from(headers)
-        credential && Monk::Auth.verify(credential[:token])
+        credential && verify(credential[:token], db_pool)
       end
       private_class_method :identify
 
@@ -263,11 +294,11 @@ module Monk
       # own Thread rather than blocking the handler's own read loop,
       # mirroring Connection#start_heartbeat's shape; killed from #serve's
       # ensure the same way.
-      def self.start_reverify(connection, raw_token, interval)
+      def self.start_reverify(connection, raw_token, interval, db_pool)
         Thread.new do
           loop do
             sleep interval
-            break unless Monk::Auth.verify(raw_token)
+            break unless verify(raw_token, db_pool)
           end
           connection.close(code: 1008, reason: "session no longer valid")
         rescue IOError, Errno::EPIPE, Errno::ECONNRESET
@@ -278,6 +309,14 @@ module Monk
       end
       private_class_method :start_reverify
 
+      # Monk::Auth.verify, here or in the db_pool: pool (Server.new).
+      def self.verify(raw_token, db_pool)
+        return Monk::Auth.verify(raw_token) unless db_pool
+
+        Monk::Persistence::Pg.pool(db_pool).call(Monk::Auth, :verify, raw_token)
+      end
+      private_class_method :verify
+
       def self.read_handshake_request(socket)
         request = +""
         until request.end_with?("\r\n\r\n")

data/lib/monk/websocket.rb

@@ -3,6 +3,8 @@ require_relative "errors"
 # true) always raises this precise error, per ADR 0003, rather than a bare
 # NameError when an app calls it without ever requiring "monk/auth" at all.
 require_relative "auth/errors"
+# Dependency-free too: Server.serve closes a socket Ractor's connections.
+require_relative "persistence"
 require_relative "websocket/errors"
 require_relative "websocket/handshake"
 require_relative "websocket/frame"

data/lib/monk.rb

@@ -24,6 +24,8 @@ module Monk
     parts << " - auth=on" if defined?(Auth) && Auth.config
     backends = persistence_backends
     parts << " - persistence=#{backends.join(",")}" unless backends.empty?
+    pools = running_pools
+    parts << " - pools=#{pools.join(",")}" unless pools.empty?
     parts << "\n"
 
     $stdout.puts parts.join("\n")
@@ -42,4 +44,12 @@ module Monk
       .filter_map { |hook| "#{hook.name.split("::").last.downcase}:#{hook.names.join(",")}" if hook.names.any? }
   end
   private_class_method :persistence_backends
+
+  # "name(size)" for every pool started in this process, by any backend.
+  def self.running_pools
+    freeze_hooks
+      .select { |hook| hook.is_a?(Module) && hook.singleton_class.include?(Persistence::Registry) }
+      .flat_map { |hook| hook.running_pools.map { |name, size| "#{name}(#{size})" } }
+  end
+  private_class_method :running_pools
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: monkrb
 version: !ruby/object:Gem::Version
-  version: 0.19.0
+  version: 0.20.0
 platform: ruby
 authors:
 - Matteo Folin
@@ -212,6 +212,7 @@ files:
 - lib/monk/persistence/pg/errors.rb
 - lib/monk/persistence/pg/migrator.rb
 - lib/monk/persistence/pg/model.rb
+- lib/monk/persistence/pool.rb
 - lib/monk/scaffold.rb
 - lib/monk/settings.rb
 - lib/monk/state_ractor.rb
@@ -261,6 +262,7 @@ files:
 - lib/monk/templates/postgres/bin/migrate
 - lib/monk/templates/postgres/bin/setup_db
 - lib/monk/templates/postgres/config/persistence.rb
+- lib/monk/templates/postgres/db/migrate/.keep
 - lib/monk/templates/redis/Gemfile.extra
 - lib/monk/version.rb
 - lib/monk/views.rb