@arcote.tech/arc-host 0.7.26 → 0.7.28

package/src/middleware/http.ts

@@ -1,9 +1,27 @@
 import type { ArcRouteAny } from "@arcote.tech/arc";
-import { ScopedModel } from "@arcote.tech/arc";
+import { ArcValidationError, arcErrorStatus, ScopedModel } from "@arcote.tech/arc";
 import type { ConnectionManager } from "../connection-manager";
 import type { ContextHandler } from "../context-handler";
 import type { ArcHttpHandler, ArcRequestContext } from "./types";
 
+// ---------------------------------------------------------------------------
+// Error → HTTP mapping
+//
+// Typed Arc errors map to 400/401/403 with safe bodies. Anything else is an
+// unexpected failure → 500 with a GENERIC message (never leak error.message
+// or stack to the client).
+// ---------------------------------------------------------------------------
+
+function errorBody(error: unknown): { status: number; body: Record<string, any> } {
+  const status = arcErrorStatus(error) ?? 500;
+  if (error instanceof ArcValidationError) {
+    return { status, body: { error: "Invalid parameters", fields: error.fields } };
+  }
+  if (status === 401) return { status, body: { error: "Unauthorized" } };
+  if (status === 403) return { status, body: { error: "Forbidden" } };
+  return { status: 500, body: { error: "Internal server error" } };
+}
+
 // ---------------------------------------------------------------------------
 // Shared
 // ---------------------------------------------------------------------------
@@ -76,11 +94,11 @@ export function commandHandler(ch: ContextHandler): ArcHttpHandler {
         headers: ctx.corsHeaders,
       });
     } catch (error) {
-      console.error(`[ARC] Command '${commandName}' error:`, error);
-      return Response.json(
-        { error: (error as Error).message },
-        { status: 500, headers: ctx.corsHeaders },
-      );
+      const { status, body } = errorBody(error);
+      if (status === 500) {
+        console.error(`[ARC] Command '${commandName}' error:`, error);
+      }
+      return Response.json(body, { status, headers: ctx.corsHeaders });
     }
   };
 }
@@ -119,10 +137,9 @@ export function queryHandler(ch: ContextHandler): ArcHttpHandler {
 
       return Response.json(result, { headers: ctx.corsHeaders });
     } catch (error) {
-      return Response.json(
-        { error: (error as Error).message },
-        { status: 500, headers: ctx.corsHeaders },
-      );
+      const { status, body } = errorBody(error);
+      if (status === 500) console.error(`[ARC] Query error:`, error);
+      return Response.json(body, { status, headers: ctx.corsHeaders });
     }
   };
 }
@@ -153,9 +170,11 @@ export function eventSyncHandler(ch: ContextHandler): ArcHttpHandler {
         { headers: ctx.corsHeaders },
       );
     } catch (error) {
+      const { status, body } = errorBody(error);
+      if (status === 500) console.error(`[ARC] Event sync error:`, error);
       return Response.json(
-        { success: false, error: (error as Error).message },
-        { status: 500, headers: ctx.corsHeaders },
+        { success: false, ...body },
+        { status, headers: ctx.corsHeaders },
       );
     }
   };
@@ -269,10 +288,9 @@ export function routeHandler(ch: ContextHandler): ArcHttpHandler {
         headers: newHeaders,
       });
     } catch (error) {
-      return Response.json(
-        { error: (error as Error).message },
-        { status: 500, headers: ctx.corsHeaders },
-      );
+      const { status, body: errBody } = errorBody(error);
+      if (status === 500) console.error(`[ARC] Route error:`, error);
+      return Response.json(errBody, { status, headers: ctx.corsHeaders });
     }
   };
 }

package/src/middleware/types.ts

@@ -28,7 +28,7 @@ export type ArcHttpHandler = (
 export interface ArcWsContext {
   contextHandler: ContextHandler;
   connectionManager: ConnectionManager;
-  verifyToken: (token: string) => TokenPayload | null;
+  verifyToken: (token: string) => Promise<TokenPayload | null>;
 }
 
 /**

package/src/middleware/ws.ts

@@ -1,23 +1,73 @@
-import { LiveQuery } from "@arcote.tech/arc";
+import { applyQueryChanges, LiveQuery } from "@arcote.tech/arc";
 import { filterEventsForTokens } from "../event-auth";
 import type { ArcWsHandler } from "./types";
 
 // ---------------------------------------------------------------------------
 // Live query subscriptions
 //
-// One LiveQuery per (client, subscriptionId). ALL query logic — execution,
-// token restrictions, change detection, delta computation — lives in core's
-// LiveQuery (query layer); this module only forwards its updates over WS.
+// One LiveQuery per (scope, descriptor, token) — clients subscribed to the
+// SAME query with the SAME token share a single server-side LiveQuery, so a
+// mutation triggers one re-execute + diff instead of one per subscriber
+// (packages/benchmarks/FINDINGS.md, F-08). The token is part of the key
+// because protectBy restrictions make results token-specific. ALL query
+// logic — execution, token restrictions, change detection, delta
+// computation — lives in core's LiveQuery (query layer); this module only
+// fans its updates out over WS.
 // ---------------------------------------------------------------------------
 
-/** clientId → subscriptionId → LiveQuery */
-const clientQuerySubs = new Map<string, Map<string, LiveQuery>>();
+interface SharedQueryEntry {
+  live: LiveQuery;
+  /** clientId → subscriptionIds subscribed under this shared query. */
+  subscribers: Map<string, Set<string>>;
+  /**
+   * Mirror of the current result — late joiners get their snapshot from it
+   * without re-executing. Maintained by the same update stream the clients
+   * receive, so it can't diverge from what they hold.
+   */
+  lastResult: unknown;
+  /** start() resolved and the initial snapshot is trustworthy. */
+  ready: boolean;
+}
 
-export function cleanupClientSubs(clientId: string): void {
-  const subs = clientQuerySubs.get(clientId);
+/** sharedKey → entry. */
+const sharedQueries = new Map<string, SharedQueryEntry>();
+/** clientId → subscriptionId → sharedKey (reverse index for cleanup). */
+const clientSubKeys = new Map<string, Map<string, string>>();
+
+function sharedKeyFor(
+  descriptor: unknown,
+  scope: string,
+  rawToken: string | null,
+): string {
+  // JSON tablicy = jednoznaczny klucz bez założeń o separatorach.
+  return JSON.stringify([scope, rawToken, descriptor]);
+}
+
+function detachSub(
+  clientId: string,
+  subscriptionId: string,
+  sharedKey: string,
+): void {
+  const entry = sharedQueries.get(sharedKey);
+  if (!entry) return;
+  const subs = entry.subscribers.get(clientId);
   if (subs) {
-    for (const live of subs.values()) live.stop();
-    clientQuerySubs.delete(clientId);
+    subs.delete(subscriptionId);
+    if (subs.size === 0) entry.subscribers.delete(clientId);
+  }
+  if (entry.subscribers.size === 0) {
+    entry.live.stop();
+    sharedQueries.delete(sharedKey);
+  }
+}
+
+export function cleanupClientSubs(clientId: string): void {
+  const keys = clientSubKeys.get(clientId);
+  if (keys) {
+    for (const [subscriptionId, sharedKey] of keys) {
+      detachSub(clientId, subscriptionId, sharedKey);
+    }
+    clientSubKeys.delete(clientId);
   }
 }
 
@@ -28,7 +78,7 @@ export function cleanupClientSubs(clientId: string): void {
 export function scopeAuthHandler(): ArcWsHandler {
   return async (client, message, ctx) => {
     if (message.type !== "scope:auth") return false;
-    const decoded = ctx.verifyToken(message.token);
+    const decoded = await ctx.verifyToken(message.token);
     if (decoded) {
       ctx.connectionManager.setScopeToken(
         client.id,
@@ -187,48 +237,114 @@ export function querySubscriptionHandler(): ArcWsHandler {
       }
 
       // Re-subscribe with the same id (reconnect resend) — drop the old one
-      clientQuerySubs.get(client.id)?.get(subscriptionId)?.stop();
+      const prevKey = clientSubKeys.get(client.id)?.get(subscriptionId);
+      if (prevKey) detachSub(client.id, subscriptionId, prevKey);
+
+      const sharedKey = sharedKeyFor(descriptor, scope, rawToken);
+      const attach = (entry: SharedQueryEntry) => {
+        if (!entry.subscribers.has(client.id)) {
+          entry.subscribers.set(client.id, new Set());
+        }
+        entry.subscribers.get(client.id)!.add(subscriptionId);
+        if (!clientSubKeys.has(client.id)) {
+          clientSubKeys.set(client.id, new Map());
+        }
+        clientSubKeys.get(client.id)!.set(subscriptionId, sharedKey);
+      };
+
+      const existing = sharedQueries.get(sharedKey);
+      if (existing && existing.ready) {
+        // Late joiner — snapshot from the mirror, no re-execute.
+        attach(existing);
+        ctx.connectionManager.sendToClient(client.id, {
+          type: "query-snapshot",
+          subscriptionId,
+          result: existing.lastResult ?? null,
+        });
+        return true;
+      }
+      if (existing) {
+        // start() in flight (another subscriber won the race) — attach;
+        // the starter's post-start broadcast covers this subscription too.
+        attach(existing);
+        return true;
+      }
 
-      const live = new LiveQuery(
+      const entry: SharedQueryEntry = {
+        live: null as unknown as LiveQuery,
+        subscribers: new Map(),
+        lastResult: null,
+        ready: false,
+      };
+      entry.live = new LiveQuery(
         ctx.contextHandler.getModel(),
         descriptor,
         scope,
         rawToken,
         (update) => {
+          // Keep the mirror in the same sequence the clients apply.
           if (update.type === "changes") {
-            ctx.connectionManager.sendToClient(client.id, {
-              type: "query-changes",
-              subscriptionId,
-              changes: update.changes,
-            });
+            if (Array.isArray(entry.lastResult)) {
+              entry.lastResult = applyQueryChanges(
+                entry.lastResult as Array<{ _id: string }>,
+                update.changes,
+              );
+            }
           } else {
-            ctx.connectionManager.sendToClient(client.id, {
-              type: "query-snapshot",
-              subscriptionId,
-              result: update.result ?? null,
-            });
+            entry.lastResult = update.result ?? null;
+          }
+          for (const [subClientId, subIds] of entry.subscribers) {
+            for (const subId of subIds) {
+              ctx.connectionManager.sendToClient(
+                subClientId,
+                update.type === "changes"
+                  ? {
+                      type: "query-changes",
+                      subscriptionId: subId,
+                      changes: update.changes,
+                    }
+                  : {
+                      type: "query-snapshot",
+                      subscriptionId: subId,
+                      result: update.result ?? null,
+                    },
+              );
+            }
           }
         },
       );
-
-      if (!clientQuerySubs.has(client.id)) {
-        clientQuerySubs.set(client.id, new Map());
-      }
-      clientQuerySubs.get(client.id)!.set(subscriptionId, live);
+      sharedQueries.set(sharedKey, entry);
+      attach(entry);
 
       try {
-        const result = await live.start();
-        ctx.connectionManager.sendToClient(client.id, {
-          type: "query-snapshot",
-          subscriptionId,
-          result: result ?? null,
-        });
+        const result = await entry.live.start();
+        entry.lastResult = result ?? null;
+        entry.ready = true;
+        // Initial snapshot for EVERY subscription attached so far — the
+        // starter and any joiners that raced into the start window.
+        for (const [subClientId, subIds] of entry.subscribers) {
+          for (const subId of subIds) {
+            ctx.connectionManager.sendToClient(subClientId, {
+              type: "query-snapshot",
+              subscriptionId: subId,
+              result: result ?? null,
+            });
+          }
+        }
         // Catch-up pass AFTER the snapshot went out — diffs out any commit
         // that slipped into the initial-execute window.
-        live.flush();
+        entry.live.flush();
       } catch (err) {
-        live.stop();
-        clientQuerySubs.get(client.id)?.delete(subscriptionId);
+        entry.live.stop();
+        sharedQueries.delete(sharedKey);
+        for (const subClientId of entry.subscribers.keys()) {
+          const keys = clientSubKeys.get(subClientId);
+          if (keys) {
+            for (const [subId, key] of keys) {
+              if (key === sharedKey) keys.delete(subId);
+            }
+          }
+        }
         console.error(
           `[Arc] Query subscription error (${descriptor?.element}.${descriptor?.method}):`,
           err,
@@ -242,11 +358,10 @@ export function querySubscriptionHandler(): ArcWsHandler {
     }
 
     if (message.type === "unsubscribe-query") {
-      const subs = clientQuerySubs.get(client.id);
-      const live = subs?.get(message.subscriptionId);
-      if (live) {
-        live.stop();
-        subs!.delete(message.subscriptionId);
+      const key = clientSubKeys.get(client.id)?.get(message.subscriptionId);
+      if (key) {
+        detachSub(client.id, message.subscriptionId, key);
+        clientSubKeys.get(client.id)?.delete(message.subscriptionId);
       }
       return true;
     }