@aooth/user 0.1.77 → 0.1.79

package/dist/index.cjs

@@ -137,9 +137,17 @@ const DEFAULTS = {
 	saltLength: 32
 };
 const PREFIX = "$scrypt$";
+/** Node's default scrypt memory cap (32 MiB) — kept as the floor. */
+const DEFAULT_MAXMEM = 32 * 1024 * 1024;
+/** Upper bound for the memory a (possibly stored, untrusted) parameter set may ask for. */
+const MAX_MAXMEM = 1024 * 1024 * 1024;
 function scryptAsync(password, salt, keyLength, options) {
+	const maxmem = Math.min(MAX_MAXMEM, Math.max(DEFAULT_MAXMEM, 256 * options.N * options.r + 1024 * 1024));
 	return new Promise((resolve, reject) => {
-		(0, node_crypto.scrypt)(password, salt, keyLength, options, (err, derived) => {
+		(0, node_crypto.scrypt)(password, salt, keyLength, {
+			...options,
+			maxmem
+		}, (err, derived) => {
 			if (err) reject(err);
 			else resolve(derived);
 		});
@@ -337,10 +345,72 @@ var UserService = class {
 	store;
 	config;
 	hasher;
+	/** Moves on every store write through this service (start and end). */
+	writeEpoch = 0;
+	writeListeners = /* @__PURE__ */ new Set();
+	snapshots = /* @__PURE__ */ new WeakMap();
 	constructor(store, config) {
 		this.store = store;
 		this.config = resolveConfig(config);
 		this.hasher = new PasswordHasher(this.config.password);
+		this.store = observeWrites(store, {
+			start: () => {
+				this.writeEpoch++;
+			},
+			end: (id) => {
+				this.writeEpoch++;
+				let failure;
+				for (const listener of this.writeListeners) try {
+					listener(id);
+				} catch (error) {
+					failure ??= { error };
+				}
+				if (failure) throw failure.error;
+			}
+		});
+	}
+	/**
+	* Subscribe to user writes made through this service (or its store): the
+	* listener gets the written user's id once the write settles (`undefined`
+	* when it cannot be told). E.g. evict a cross-request cache:
+	* `users.onUserWrite((id) => arbacUserCache.invalidate(id))`.
+	*
+	* @returns unsubscribe
+	* @since 0.1.78
+	*/
+	onUserWrite(listener) {
+		this.writeListeners.add(listener);
+		return () => {
+			this.writeListeners.delete(listener);
+		};
+	}
+	/**
+	* {@link getUser} memoized per `scope` — an object that lives as long as
+	* one unit of work (typically the current event context): repeated reads of
+	* the same user in that scope share one store read, until any write goes
+	* through this service (then the next read is fresh). Rejections are not
+	* kept. Writes made around this service are not seen — use `getUser` when
+	* that matters.
+	*
+	* @since 0.1.78
+	*/
+	getUserSnapshot(id, scope) {
+		let perScope = this.snapshots.get(scope);
+		if (!perScope) {
+			perScope = /* @__PURE__ */ new Map();
+			this.snapshots.set(scope, perScope);
+		}
+		const hit = perScope.get(id);
+		if (hit && hit.epoch === this.writeEpoch) return hit.user;
+		const entry = {
+			epoch: this.writeEpoch,
+			user: this.getUser(id)
+		};
+		perScope.set(id, entry);
+		entry.user.catch(() => {
+			if (perScope.get(id) === entry) perScope.delete(id);
+		});
+		return entry.user;
 	}
 	/**
 	* Creates a user with `account.active: false`. The invite workflow relies
@@ -964,6 +1034,40 @@ var UserService = class {
 		throw new require_federated_identity_store.UserAuthError(errorCode);
 	}
 };
+/** The store methods that write (keyed by the user id, or `create`'s row). */
+const WRITE_METHODS = /* @__PURE__ */ new Set([
+	"create",
+	"update",
+	"delete",
+	"withCas"
+]);
+/**
+* `store` with its write methods reporting to `hooks` (before the call and
+* once it settles, with the user id); everything else passes through, bound
+* to the store itself.
+*/
+function observeWrites(store, hooks) {
+	const bound = /* @__PURE__ */ new Map();
+	return new Proxy(store, { get(target, prop) {
+		const value = Reflect.get(target, prop, target);
+		if (typeof value !== "function") return value;
+		let fn = bound.get(prop);
+		if (fn === void 0 || fn.__of !== value) {
+			const method = value;
+			fn = WRITE_METHODS.has(prop) ? Object.assign(async (...args) => {
+				const id = typeof args[0] === "string" ? args[0] : args[0]?.id;
+				hooks.start();
+				try {
+					return await method.apply(target, args);
+				} finally {
+					hooks.end(typeof id === "string" ? id : void 0);
+				}
+			}, { __of: value }) : Object.assign(method.bind(target), { __of: value });
+			bound.set(prop, fn);
+		}
+		return fn;
+	} });
+}
 //#endregion
 //#region src/store/memory.ts
 var UserStoreMemory = class extends require_federated_identity_store.UserStore {

package/dist/index.d.cts

@@ -85,7 +85,32 @@ declare class UserService<T extends object = object> {
   protected readonly store: UserStore<T>;
   protected readonly config: ResolvedConfig;
   protected readonly hasher: PasswordHasher;
+  /** Moves on every store write through this service (start and end). */
+  private writeEpoch;
+  private readonly writeListeners;
+  private readonly snapshots;
   constructor(store: UserStore<T>, config?: UserServiceConfig);
+  /**
+   * Subscribe to user writes made through this service (or its store): the
+   * listener gets the written user's id once the write settles (`undefined`
+   * when it cannot be told). E.g. evict a cross-request cache:
+   * `users.onUserWrite((id) => arbacUserCache.invalidate(id))`.
+   *
+   * @returns unsubscribe
+   * @since 0.1.78
+   */
+  onUserWrite(listener: (id: string | undefined) => void): () => void;
+  /**
+   * {@link getUser} memoized per `scope` — an object that lives as long as
+   * one unit of work (typically the current event context): repeated reads of
+   * the same user in that scope share one store read, until any write goes
+   * through this service (then the next read is fresh). Rejections are not
+   * kept. Writes made around this service are not seen — use `getUser` when
+   * that matters.
+   *
+   * @since 0.1.78
+   */
+  getUserSnapshot(id: string, scope: object): Promise<UserCredentials & T>;
   /**
    * Creates a user with `account.active: false`. The invite workflow relies
    * on this default (see `InviteWorkflow.acceptInvite` — pending invitees stay

package/dist/index.d.mts

@@ -85,7 +85,32 @@ declare class UserService<T extends object = object> {
   protected readonly store: UserStore<T>;
   protected readonly config: ResolvedConfig;
   protected readonly hasher: PasswordHasher;
+  /** Moves on every store write through this service (start and end). */
+  private writeEpoch;
+  private readonly writeListeners;
+  private readonly snapshots;
   constructor(store: UserStore<T>, config?: UserServiceConfig);
+  /**
+   * Subscribe to user writes made through this service (or its store): the
+   * listener gets the written user's id once the write settles (`undefined`
+   * when it cannot be told). E.g. evict a cross-request cache:
+   * `users.onUserWrite((id) => arbacUserCache.invalidate(id))`.
+   *
+   * @returns unsubscribe
+   * @since 0.1.78
+   */
+  onUserWrite(listener: (id: string | undefined) => void): () => void;
+  /**
+   * {@link getUser} memoized per `scope` — an object that lives as long as
+   * one unit of work (typically the current event context): repeated reads of
+   * the same user in that scope share one store read, until any write goes
+   * through this service (then the next read is fresh). Rejections are not
+   * kept. Writes made around this service are not seen — use `getUser` when
+   * that matters.
+   *
+   * @since 0.1.78
+   */
+  getUserSnapshot(id: string, scope: object): Promise<UserCredentials & T>;
   /**
    * Creates a user with `account.active: false`. The invite workflow relies
    * on this default (see `InviteWorkflow.acceptInvite` — pending invitees stay

package/dist/index.mjs

@@ -136,9 +136,17 @@ const DEFAULTS = {
 	saltLength: 32
 };
 const PREFIX = "$scrypt$";
+/** Node's default scrypt memory cap (32 MiB) — kept as the floor. */
+const DEFAULT_MAXMEM = 32 * 1024 * 1024;
+/** Upper bound for the memory a (possibly stored, untrusted) parameter set may ask for. */
+const MAX_MAXMEM = 1024 * 1024 * 1024;
 function scryptAsync(password, salt, keyLength, options) {
+	const maxmem = Math.min(MAX_MAXMEM, Math.max(DEFAULT_MAXMEM, 256 * options.N * options.r + 1024 * 1024));
 	return new Promise((resolve, reject) => {
-		scrypt(password, salt, keyLength, options, (err, derived) => {
+		scrypt(password, salt, keyLength, {
+			...options,
+			maxmem
+		}, (err, derived) => {
 			if (err) reject(err);
 			else resolve(derived);
 		});
@@ -336,10 +344,72 @@ var UserService = class {
 	store;
 	config;
 	hasher;
+	/** Moves on every store write through this service (start and end). */
+	writeEpoch = 0;
+	writeListeners = /* @__PURE__ */ new Set();
+	snapshots = /* @__PURE__ */ new WeakMap();
 	constructor(store, config) {
 		this.store = store;
 		this.config = resolveConfig(config);
 		this.hasher = new PasswordHasher(this.config.password);
+		this.store = observeWrites(store, {
+			start: () => {
+				this.writeEpoch++;
+			},
+			end: (id) => {
+				this.writeEpoch++;
+				let failure;
+				for (const listener of this.writeListeners) try {
+					listener(id);
+				} catch (error) {
+					failure ??= { error };
+				}
+				if (failure) throw failure.error;
+			}
+		});
+	}
+	/**
+	* Subscribe to user writes made through this service (or its store): the
+	* listener gets the written user's id once the write settles (`undefined`
+	* when it cannot be told). E.g. evict a cross-request cache:
+	* `users.onUserWrite((id) => arbacUserCache.invalidate(id))`.
+	*
+	* @returns unsubscribe
+	* @since 0.1.78
+	*/
+	onUserWrite(listener) {
+		this.writeListeners.add(listener);
+		return () => {
+			this.writeListeners.delete(listener);
+		};
+	}
+	/**
+	* {@link getUser} memoized per `scope` — an object that lives as long as
+	* one unit of work (typically the current event context): repeated reads of
+	* the same user in that scope share one store read, until any write goes
+	* through this service (then the next read is fresh). Rejections are not
+	* kept. Writes made around this service are not seen — use `getUser` when
+	* that matters.
+	*
+	* @since 0.1.78
+	*/
+	getUserSnapshot(id, scope) {
+		let perScope = this.snapshots.get(scope);
+		if (!perScope) {
+			perScope = /* @__PURE__ */ new Map();
+			this.snapshots.set(scope, perScope);
+		}
+		const hit = perScope.get(id);
+		if (hit && hit.epoch === this.writeEpoch) return hit.user;
+		const entry = {
+			epoch: this.writeEpoch,
+			user: this.getUser(id)
+		};
+		perScope.set(id, entry);
+		entry.user.catch(() => {
+			if (perScope.get(id) === entry) perScope.delete(id);
+		});
+		return entry.user;
 	}
 	/**
 	* Creates a user with `account.active: false`. The invite workflow relies
@@ -963,6 +1033,40 @@ var UserService = class {
 		throw new UserAuthError(errorCode);
 	}
 };
+/** The store methods that write (keyed by the user id, or `create`'s row). */
+const WRITE_METHODS = /* @__PURE__ */ new Set([
+	"create",
+	"update",
+	"delete",
+	"withCas"
+]);
+/**
+* `store` with its write methods reporting to `hooks` (before the call and
+* once it settles, with the user id); everything else passes through, bound
+* to the store itself.
+*/
+function observeWrites(store, hooks) {
+	const bound = /* @__PURE__ */ new Map();
+	return new Proxy(store, { get(target, prop) {
+		const value = Reflect.get(target, prop, target);
+		if (typeof value !== "function") return value;
+		let fn = bound.get(prop);
+		if (fn === void 0 || fn.__of !== value) {
+			const method = value;
+			fn = WRITE_METHODS.has(prop) ? Object.assign(async (...args) => {
+				const id = typeof args[0] === "string" ? args[0] : args[0]?.id;
+				hooks.start();
+				try {
+					return await method.apply(target, args);
+				} finally {
+					hooks.end(typeof id === "string" ? id : void 0);
+				}
+			}, { __of: value }) : Object.assign(method.bind(target), { __of: value });
+			bound.set(prop, fn);
+		}
+		return fn;
+	} });
+}
 //#endregion
 //#region src/store/memory.ts
 var UserStoreMemory = class extends UserStore {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/user",
-  "version": "0.1.77",
+  "version": "0.1.79",
   "description": "User credential primitives for aoothjs",
   "keywords": [
     "aoothjs",
@@ -60,18 +60,18 @@
     "access": "public"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.101",
-    "@atscript/db": "^0.1.150",
-    "@atscript/db-sql-tools": "^0.1.150",
-    "@atscript/db-sqlite": "^0.1.150",
-    "@atscript/typescript": "^0.1.101",
+    "@atscript/core": "^0.1.103",
+    "@atscript/db": "^0.1.153",
+    "@atscript/db-sql-tools": "^0.1.153",
+    "@atscript/db-sqlite": "^0.1.153",
+    "@atscript/typescript": "^0.1.103",
     "@types/better-sqlite3": "^7.6.13",
-    "@uniqu/core": "^0.1.13",
+    "@uniqu/core": "^0.1.15",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.1.101"
+    "unplugin-atscript": "^0.1.103"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.150"
+    "@atscript/db": "^0.1.153"
   },
   "peerDependenciesMeta": {
     "@atscript/db": {