@arcote.tech/arc-host 0.7.14 → 0.7.15

package/src/middleware/view-subscription.integration.test.ts

@@ -0,0 +1,307 @@
+import { beforeEach, describe, expect, it } from "bun:test";
+import {
+  LocalEventPublisher,
+  MasterDataStorage,
+  context,
+  token,
+  view,
+} from "@arcote.tech/arc";
+import type { ConnectedClient } from "../types";
+import {
+  broadcastViewChanges,
+  cleanupClientSubs,
+  viewSubscriptionHandler,
+} from "./ws";
+
+// ---------------------------------------------------------------------------
+// Test rig: real MasterDataStorage + LocalEventPublisher + ws handler,
+// in-memory DB adapter, fake connection manager collecting messages.
+// Covers the full server pipeline: subscribe-view → snapshot → publish →
+// commit → onViewChanges → per-subscriber filtered view-changes.
+// ---------------------------------------------------------------------------
+
+function memoryAdapter() {
+  const tables = new Map<string, Map<string, any>>();
+  const table = (s: string) => {
+    if (!tables.has(s)) tables.set(s, new Map());
+    return tables.get(s)!;
+  };
+  const tx = {
+    async find(store: string, options: any) {
+      const rows = Array.from(table(store).values());
+      const where = options?.where;
+      if (!where) return rows;
+      return rows.filter((r) =>
+        Object.entries(where).every(([k, v]) => r[k] === v),
+      );
+    },
+    async set(store: string, data: any) {
+      table(store).set(data._id, structuredClone(data));
+    },
+    async remove(store: string, id: any) {
+      table(store).delete(String(id));
+    },
+    async commit() {},
+  };
+  return {
+    readWriteTransaction: () => tx,
+    readTransaction: () => tx,
+    executeReinitTables: async () => {},
+  } as any;
+}
+
+const wsToken = token("workspace", {});
+
+const tasksView = view("tasksView", null as any, {} as any)
+  .handle({
+    "task.created": async (ctx: any, event: any) => {
+      await ctx.set(event.payload.taskId, {
+        title: event.payload.title,
+        workspaceId: event.payload.workspaceId,
+      });
+    },
+    "task.moved": async (ctx: any, event: any) => {
+      await ctx.modify(event.payload.taskId, { workspaceId: event.payload.to });
+    },
+    "task.removed": async (ctx: any, event: any) => {
+      await ctx.remove(event.payload.taskId);
+    },
+  })
+  .protectBy(wsToken as any, (p: any) => ({ workspaceId: p.workspaceId }));
+
+function fakeJwt(tokenName: string, params: Record<string, any>): string {
+  const b64 = (o: any) => Buffer.from(JSON.stringify(o)).toString("base64");
+  return `${b64({ alg: "none" })}.${b64({ tokenName, params })}.sig`;
+}
+
+function fakeClient(
+  id: string,
+  scope: string,
+  tokenName: string,
+  params: Record<string, any>,
+): ConnectedClient {
+  return {
+    id,
+    scopeTokens: new Map([
+      [scope, { decoded: { tokenType: tokenName, params }, raw: fakeJwt(tokenName, params) }],
+    ]),
+    lastHostEventId: null,
+    ws: null,
+  };
+}
+
+let eventCounter = 0;
+function makeEvent(type: string, payload: any) {
+  return {
+    id: `evt_${++eventCounter}`,
+    type,
+    payload,
+    createdAt: new Date(0),
+    authContext: null,
+  } as any;
+}
+
+function rig() {
+  const storage = new MasterDataStorage(memoryAdapter());
+  const testContext = context([tasksView as any]);
+  const fakeModel = {
+    context: testContext,
+    getAdapters: () => ({ dataStorage: storage }),
+    getEnvironment: () => "server" as const,
+  };
+
+  const sent: Array<{ clientId: string; message: any }> = [];
+  const connectionManager = {
+    sendToClient: (clientId: string, message: any) => {
+      sent.push({ clientId, message });
+      return true;
+    },
+  } as any;
+
+  const wsCtx = {
+    contextHandler: {
+      getModel: () => fakeModel,
+      getDataStorage: () => storage,
+    },
+    connectionManager,
+    verifyToken: () => null,
+  } as any;
+
+  const publisher = new LocalEventPublisher(storage);
+  publisher.registerViews([tasksView as any]);
+  publisher.onViewChanges((changes) =>
+    broadcastViewChanges(changes, connectionManager),
+  );
+
+  const handler = viewSubscriptionHandler();
+  const subscribe = (client: ConnectedClient, scope: string) =>
+    handler(client, { type: "subscribe-view", element: "tasksView", scope }, wsCtx);
+
+  const messagesFor = (clientId: string, type?: string) =>
+    sent
+      .filter((s) => s.clientId === clientId)
+      .map((s) => s.message)
+      .filter((m) => (type ? m.type === type : true));
+
+  return { storage, publisher, subscribe, handler, wsCtx, sent, messagesFor };
+}
+
+let clientSeq = 0;
+const uid = (p: string) => `${p}_${++clientSeq}`;
+
+describe("view subscriptions — end-to-end host pipeline", () => {
+  beforeEach(() => {
+    // module-level registry — drop anything previous tests left behind
+    for (let i = 0; i <= clientSeq; i++) {
+      cleanupClientSubs(`A_${i}`);
+      cleanupClientSubs(`B_${i}`);
+      cleanupClientSubs(`X_${i}`);
+    }
+  });
+
+  it("snapshot contains ONLY the subscriber's slice of the view", async () => {
+    const r = rig();
+    await r.publisher.publish(
+      makeEvent("task.created", { taskId: "t1", title: "Mine", workspaceId: "w1" }),
+    );
+    await r.publisher.publish(
+      makeEvent("task.created", { taskId: "t2", title: "Theirs", workspaceId: "w2" }),
+    );
+
+    const a = fakeClient(uid("A"), "workspace", "workspace", { workspaceId: "w1" });
+    await r.subscribe(a, "workspace");
+
+    const snapshots = r.messagesFor(a.id, "view-snapshot");
+    expect(snapshots).toHaveLength(1);
+    expect(snapshots[0].element).toBe("tasksView");
+    expect(snapshots[0].scope).toBe("workspace");
+    expect(snapshots[0].items).toHaveLength(1);
+    expect(snapshots[0].items[0]).toMatchObject({ _id: "t1", title: "Mine" });
+  });
+
+  it("publish → set delta to the owning tenant ONLY (no message to others)", async () => {
+    const r = rig();
+    const a = fakeClient(uid("A"), "workspace", "workspace", { workspaceId: "w1" });
+    const b = fakeClient(uid("B"), "workspace", "workspace", { workspaceId: "w2" });
+    await r.subscribe(a, "workspace");
+    await r.subscribe(b, "workspace");
+    r.sent.length = 0;
+
+    await r.publisher.publish(
+      makeEvent("task.created", { taskId: "t1", title: "New", workspaceId: "w1" }),
+    );
+
+    const toA = r.messagesFor(a.id, "view-changes");
+    expect(toA).toHaveLength(1);
+    expect(toA[0].changes).toEqual([
+      {
+        type: "set",
+        id: "t1",
+        item: { _id: "t1", title: "New", workspaceId: "w1" },
+      },
+    ]);
+
+    // tenant isolation: B gets NOTHING (not even a delete for a foreign id)
+    expect(r.messagesFor(b.id)).toHaveLength(0);
+  });
+
+  it("scope transition: move w1→w2 emits delete to A and full-item set to B", async () => {
+    const r = rig();
+    await r.publisher.publish(
+      makeEvent("task.created", { taskId: "t1", title: "Task", workspaceId: "w1" }),
+    );
+
+    const a = fakeClient(uid("A"), "workspace", "workspace", { workspaceId: "w1" });
+    const b = fakeClient(uid("B"), "workspace", "workspace", { workspaceId: "w2" });
+    await r.subscribe(a, "workspace");
+    await r.subscribe(b, "workspace");
+    r.sent.length = 0;
+
+    await r.publisher.publish(makeEvent("task.moved", { taskId: "t1", to: "w2" }));
+
+    const toA = r.messagesFor(a.id, "view-changes");
+    expect(toA).toHaveLength(1);
+    expect(toA[0].changes).toEqual([{ type: "delete", id: "t1", item: null }]);
+
+    // B receives the FULL merged item (modify was partial — deepMerge on server)
+    const toB = r.messagesFor(b.id, "view-changes");
+    expect(toB).toHaveLength(1);
+    expect(toB[0].changes).toEqual([
+      {
+        type: "set",
+        id: "t1",
+        item: { _id: "t1", title: "Task", workspaceId: "w2" },
+      },
+    ]);
+  });
+
+  it("remove emits delete only to the tenant that owned the item", async () => {
+    const r = rig();
+    await r.publisher.publish(
+      makeEvent("task.created", { taskId: "t1", title: "Task", workspaceId: "w1" }),
+    );
+    const a = fakeClient(uid("A"), "workspace", "workspace", { workspaceId: "w1" });
+    const b = fakeClient(uid("B"), "workspace", "workspace", { workspaceId: "w2" });
+    await r.subscribe(a, "workspace");
+    await r.subscribe(b, "workspace");
+    r.sent.length = 0;
+
+    await r.publisher.publish(makeEvent("task.removed", { taskId: "t1" }));
+
+    expect(r.messagesFor(a.id, "view-changes")).toHaveLength(1);
+    expect(r.messagesFor(a.id, "view-changes")[0].changes).toEqual([
+      { type: "delete", id: "t1", item: null },
+    ]);
+    expect(r.messagesFor(b.id)).toHaveLength(0);
+  });
+
+  it("token that matches no protection → empty snapshot and no deltas", async () => {
+    const r = rig();
+    await r.publisher.publish(
+      makeEvent("task.created", { taskId: "t1", title: "Task", workspaceId: "w1" }),
+    );
+
+    const x = fakeClient(uid("X"), "workspace", "intruder", {});
+    await r.subscribe(x, "workspace");
+
+    const snapshots = r.messagesFor(x.id, "view-snapshot");
+    expect(snapshots).toHaveLength(1);
+    expect(snapshots[0].items).toEqual([]);
+
+    r.sent.length = 0;
+    await r.publisher.publish(
+      makeEvent("task.created", { taskId: "t2", title: "More", workspaceId: "w1" }),
+    );
+    expect(r.messagesFor(x.id)).toHaveLength(0);
+  });
+
+  it("unsubscribe-view stops deltas", async () => {
+    const r = rig();
+    const a = fakeClient(uid("A"), "workspace", "workspace", { workspaceId: "w1" });
+    await r.subscribe(a, "workspace");
+    await r.handler(
+      a,
+      { type: "unsubscribe-view", element: "tasksView", scope: "workspace" },
+      r.wsCtx,
+    );
+    r.sent.length = 0;
+
+    await r.publisher.publish(
+      makeEvent("task.created", { taskId: "t1", title: "New", workspaceId: "w1" }),
+    );
+    expect(r.messagesFor(a.id)).toHaveLength(0);
+  });
+
+  it("disconnect cleanup stops deltas", async () => {
+    const r = rig();
+    const a = fakeClient(uid("A"), "workspace", "workspace", { workspaceId: "w1" });
+    await r.subscribe(a, "workspace");
+    cleanupClientSubs(a.id);
+    r.sent.length = 0;
+
+    await r.publisher.publish(
+      makeEvent("task.created", { taskId: "t1", title: "New", workspaceId: "w1" }),
+    );
+    expect(r.messagesFor(a.id)).toHaveLength(0);
+  });
+});

package/src/middleware/ws.test.ts

@@ -0,0 +1,95 @@
+import { describe, expect, it } from "bun:test";
+import type { CommittedChange } from "@arcote.tech/arc";
+import { filterChangeForSubscriber } from "./ws";
+
+const R = { workspaceId: "w1" };
+
+function change(partial: Partial<CommittedChange>): CommittedChange {
+  return { store: "tasks", id: "t1", oldRow: null, newRow: null, ...partial };
+}
+
+describe("filterChangeForSubscriber — old/new restriction matrix", () => {
+  it("new row matches → set with the full row", () => {
+    const result = filterChangeForSubscriber(
+      change({ newRow: { _id: "t1", title: "A", workspaceId: "w1" } }),
+      R,
+    );
+    expect(result).toEqual({
+      type: "set",
+      id: "t1",
+      item: { _id: "t1", title: "A", workspaceId: "w1" },
+    });
+  });
+
+  it("neither row matches → null (no id leakage to other tenants)", () => {
+    const result = filterChangeForSubscriber(
+      change({
+        oldRow: { _id: "t1", workspaceId: "w2" },
+        newRow: { _id: "t1", workspaceId: "w2" },
+      }),
+      R,
+    );
+    expect(result).toBeNull();
+  });
+
+  it("scope transition OUT: old matched, new does not → delete", () => {
+    const result = filterChangeForSubscriber(
+      change({
+        oldRow: { _id: "t1", workspaceId: "w1" },
+        newRow: { _id: "t1", workspaceId: "w2" },
+      }),
+      R,
+    );
+    expect(result).toEqual({ type: "delete", id: "t1", item: null });
+  });
+
+  it("scope transition IN: old did not match, new does → set", () => {
+    const result = filterChangeForSubscriber(
+      change({
+        oldRow: { _id: "t1", workspaceId: "w2" },
+        newRow: { _id: "t1", workspaceId: "w1" },
+      }),
+      R,
+    );
+    expect(result?.type).toBe("set");
+  });
+
+  it("delete of an item in my slice → delete", () => {
+    const result = filterChangeForSubscriber(
+      change({ oldRow: { _id: "t1", workspaceId: "w1" }, newRow: null }),
+      R,
+    );
+    expect(result).toEqual({ type: "delete", id: "t1", item: null });
+  });
+
+  it("delete of another tenant's item → null", () => {
+    const result = filterChangeForSubscriber(
+      change({ oldRow: { _id: "t1", workspaceId: "w2" }, newRow: null }),
+      R,
+    );
+    expect(result).toBeNull();
+  });
+
+  it("brand new item outside my slice → null", () => {
+    const result = filterChangeForSubscriber(
+      change({ newRow: { _id: "t1", workspaceId: "w2" } }),
+      R,
+    );
+    expect(result).toBeNull();
+  });
+
+  it("null restrictions (unprotected view) → everything as set/delete", () => {
+    expect(
+      filterChangeForSubscriber(
+        change({ newRow: { _id: "t1", workspaceId: "anything" } }),
+        null,
+      )?.type,
+    ).toBe("set");
+    expect(
+      filterChangeForSubscriber(
+        change({ oldRow: { _id: "t1", workspaceId: "anything" }, newRow: null }),
+        null,
+      )?.type,
+    ).toBe("delete");
+  });
+});