@abraca/dabra 2.20.0 → 2.21.0

package/dist/index.d.ts

@@ -158,9 +158,12 @@ declare class OfflineStore {
   private db;
   /**
    * @param docId       The document UUID.
-   * @param serverOrigin  Hostname of the server (e.g. "abra.cou.sh").
-   *                    When provided the IndexedDB database is namespaced
-   *                    per-server, preventing cross-server data contamination.
+   * @param serverOrigin  Host of the server, including a non-default port
+   *                    (e.g. "abra.cou.sh", "localhost:3001"). When provided
+   *                    the IndexedDB database is namespaced per-server,
+   *                    preventing cross-server data contamination — the port
+   *                    matters because two same-host servers sharing the
+   *                    default root_doc_id would otherwise collide.
    */
   constructor(docId: string, serverOrigin?: string);
   private dbPromise;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abraca/dabra",
-  "version": "2.20.0",
+  "version": "2.21.0",
   "description": "abracadabra provider",
   "keywords": [
     "abracadabra",
@@ -41,7 +41,7 @@
     "yjs": "^13.6.8"
   },
   "devDependencies": {
-    "@abraca/schema": "2.20.0"
+    "@abraca/schema": "2.21.0"
   },
   "scripts": {
     "test": "node --no-warnings --conditions=source --experimental-transform-types --test 'tests/*.test.ts'"

package/src/AbracadabraBaseProvider.ts

@@ -717,9 +717,18 @@ export class AbracadabraBaseProvider extends EventEmitter {
 
     this.configuration.websocketProvider.on("rateLimited", this.forwardRateLimited);
 
-    this.configuration.websocketProvider.attach(this);
-
+    // Mark attached BEFORE registering with the socket: when the shared
+    // socket is already connected (the loadChild case), wsp.attach()
+    // synchronously invokes onOpen() → sendToken(), and send() drops frames
+    // while _isAttached is false. With a crypto identity OBJECT sendToken()
+    // hits no await before send(), so the AUTH frame was silently swallowed
+    // and the doc never authenticated on the connection — the server then
+    // (correctly) ignored every subsequent frame for it: child providers
+    // never synced and their writes were dropped. (JWT auth only survived
+    // by accident: `await getToken()` defers send() past attach().)
     this._isAttached = true;
+
+    this.configuration.websocketProvider.attach(this);
   }
 
   permissionDeniedHandler(reason: string) {

package/src/AbracadabraProvider.ts

@@ -244,7 +244,13 @@ export class AbracadabraProvider extends AbracadabraBaseProvider {
 				config.url ??
 				(config.websocketProvider as AbracadabraWS | undefined)?.url ??
 				client?.wsUrl;
-			if (url) return new URL(url).hostname;
+			// `host` (NOT `hostname`): the port is part of a server's identity.
+			// Two servers on the same host but different ports would otherwise
+			// share one IDB namespace — and since default-config servers also
+			// share the same root_doc_id, one server's cached doc state silently
+			// hydrated into the other's Y.Doc (cross-server contamination that
+			// can then sync back upstream).
+			if (url) return new URL(url).host;
 		} catch {
 			// Malformed URL — fall back to no scoping
 		}

package/src/BackgroundSyncManager.ts

@@ -165,10 +165,12 @@ export class BackgroundSyncManager extends EventEmitter {
 			maxRetries: opts?.maxRetries ?? 2,
 		};
 
-		// Derive server origin from client URL for IDB namespacing
+		// Derive server origin from client URL for IDB namespacing.
+		// `host` (not `hostname`): port-scoped so same-host servers on
+		// different ports don't share a namespace.
 		let serverOrigin = "default";
 		try {
-			serverOrigin = new URL((client as any).baseUrl ?? "").hostname;
+			serverOrigin = new URL((client as any).baseUrl ?? "").host;
 		} catch {}
 
 		this.persistence = new BackgroundSyncPersistence(serverOrigin);
@@ -377,10 +379,10 @@ export class BackgroundSyncManager extends EventEmitter {
 			docIds.add(docId);
 		}
 
-		// Derive server origin the same way the provider does
+		// Derive server origin the same way the provider does (`host`, port-scoped)
 		let serverOrigin: string | undefined;
 		try {
-			serverOrigin = new URL((this.client as any).baseUrl ?? "").hostname;
+			serverOrigin = new URL((this.client as any).baseUrl ?? "").host;
 		} catch {}
 
 		// Clear each document's offline store contents

package/src/OfflineStore.ts

@@ -69,9 +69,12 @@ export class OfflineStore {
 
 	/**
 	 * @param docId       The document UUID.
-	 * @param serverOrigin  Hostname of the server (e.g. "abra.cou.sh").
-	 *                    When provided the IndexedDB database is namespaced
-	 *                    per-server, preventing cross-server data contamination.
+	 * @param serverOrigin  Host of the server, including a non-default port
+	 *                    (e.g. "abra.cou.sh", "localhost:3001"). When provided
+	 *                    the IndexedDB database is namespaced per-server,
+	 *                    preventing cross-server data contamination — the port
+	 *                    matters because two same-host servers sharing the
+	 *                    default root_doc_id would otherwise collide.
 	 */
 	constructor(docId: string, serverOrigin?: string) {
 		this.storeKey = serverOrigin ? `${serverOrigin}/${docId}` : docId;