@carno.js/live 1.8.0

package/test/authorization.test.ts

@@ -0,0 +1,175 @@
+import { beforeEach, describe, expect, test } from 'bun:test';
+import { Controller, Get } from '@carno.js/core';
+import { Live } from '../src/decorators/Live';
+import { resolveLiveConfig } from '../src/config';
+import { InProcessBus } from '../src/bus/InProcessBus';
+import { DependencyGraph } from '../src/graph/DependencyGraph';
+import { SubscriptionRegistry } from '../src/graph/SubscriptionRegistry';
+import { ResourceRegistry } from '../src/resource/ResourceRegistry';
+import { dependencyContext } from '../src/resource/dependency-context';
+import { LiveEngine, type LiveTransport } from '../src/LiveEngine';
+import type { LiveAuthorizationRequest, LiveAuthorizer } from '../src/auth/authorizer';
+import type { ServerMessage } from '../src/shared/protocol';
+import { directResourceExecutor } from './resource-registry-helper';
+
+let counter = 0;
+
+@Controller('/board')
+class BoardController {
+    @Get('/')
+    @Live({ shared: 'public' })
+    board() {
+        dependencyContext.current()?.add({ key: 'orm:cards', columns: null });
+        return { counter };
+    }
+}
+
+class FakeTransport implements LiveTransport {
+    readonly sent: { connectionId: string; message: ServerMessage }[] = [];
+
+    send(connectionId: string, message: ServerMessage): number {
+        this.sent.push({ connectionId, message });
+        return 1;
+    }
+
+    messagesFor(connectionId: string): ServerMessage[] {
+        return this.sent.filter(entry => entry.connectionId === connectionId).map(entry => entry.message);
+    }
+
+    clear(): void {
+        this.sent.length = 0;
+    }
+}
+
+/** Denies whichever principals are in `denied` at the moment it is asked. */
+class RosterAuthorizer implements LiveAuthorizer {
+    readonly denied = new Set<string>();
+    calls = 0;
+
+    authorize(request: LiveAuthorizationRequest): boolean {
+        this.calls += 1;
+        return !this.denied.has(String(request.scope.principal));
+    }
+}
+
+class ThrowingAuthorizer implements LiveAuthorizer {
+    authorize(): boolean {
+        throw new Error('authorization backend is down');
+    }
+}
+
+function build(authorizer: LiveAuthorizer) {
+    const resources = new ResourceRegistry();
+    resources.register(BoardController, new BoardController(), directResourceExecutor);
+
+    const bus = new InProcessBus();
+    const transport = new FakeTransport();
+    const engine = new LiveEngine(
+        resources,
+        new DependencyGraph(),
+        new SubscriptionRegistry(),
+        bus,
+        transport,
+        resolveLiveConfig({ coalesceMs: 1, unsubGraceMs: 5 }),
+        authorizer
+    );
+    engine.start();
+
+    return { engine, transport };
+}
+
+const settle = () => new Promise(resolve => setTimeout(resolve, 30));
+
+beforeEach(() => {
+    counter = 0;
+});
+
+describe('authorization at subscribe time', () => {
+    test('a denied principal gets an error and no data', async () => {
+        const authorizer = new RosterAuthorizer();
+        authorizer.denied.add('intruder');
+        const { engine, transport } = build(authorizer);
+
+        await engine.subscribe('c1', 's1', 'BoardController.board', { params: {}, query: {} }, { principal: 'intruder' });
+
+        const messages = transport.messagesFor('c1');
+        expect(messages).toHaveLength(1);
+        expect(messages[0]).toMatchObject({ t: 'error', code: 'forbidden' });
+    });
+
+    test('an authorizer that throws denies instead of leaking', async () => {
+        const { engine, transport } = build(new ThrowingAuthorizer());
+
+        await engine.subscribe('c1', 's1', 'BoardController.board', { params: {}, query: {} }, { principal: 'ada' });
+
+        expect(transport.messagesFor('c1')[0]).toMatchObject({ t: 'error', code: 'forbidden' });
+    });
+
+    test('an allowed principal gets the snapshot', async () => {
+        const { engine, transport } = build(new RosterAuthorizer());
+
+        await engine.subscribe('c1', 's1', 'BoardController.board', { params: {}, query: {} }, { principal: 'ada' });
+
+        expect(transport.messagesFor('c1')[0]).toMatchObject({ t: 'snapshot' });
+    });
+});
+
+describe('authorization after the subscription', () => {
+    test('revoking one principal does not disturb the others on a shared instance', async () => {
+        const authorizer = new RosterAuthorizer();
+        const { engine, transport } = build(authorizer);
+
+        await engine.subscribe('c1', 's1', 'BoardController.board', { params: {}, query: {} }, { principal: 'ada' });
+        await engine.subscribe('c2', 's1', 'BoardController.board', { params: {}, query: {} }, { principal: 'linus' });
+        transport.clear();
+
+        authorizer.denied.add('ada');
+        engine.invalidate('auth:principal#ada');
+        await settle();
+
+        expect(transport.messagesFor('c1')).toEqual([
+            expect.objectContaining({ t: 'error', code: 'forbidden' })
+        ]);
+        expect(transport.messagesFor('c2')).toEqual([]);
+
+        transport.clear();
+        counter = 1;
+        engine.invalidate('orm:cards');
+        await settle();
+
+        // The revoked connection is gone; the other one keeps its patches.
+        expect(transport.messagesFor('c1')).toEqual([]);
+        expect(transport.messagesFor('c2')[0]).toMatchObject({ t: 'patch' });
+    });
+
+    test('a broad auth key revokes every principal under it', async () => {
+        const authorizer = new RosterAuthorizer();
+        const { engine, transport } = build(authorizer);
+
+        await engine.subscribe('c1', 's1', 'BoardController.board', { params: {}, query: {} }, { principal: 'ada' });
+        await engine.subscribe('c2', 's1', 'BoardController.board', { params: {}, query: {} }, { principal: 'linus' });
+        transport.clear();
+
+        authorizer.denied.add('ada');
+        authorizer.denied.add('linus');
+        engine.invalidate('auth:principal');
+        await settle();
+
+        expect(transport.messagesFor('c1')[0]).toMatchObject({ t: 'error', code: 'forbidden' });
+        expect(transport.messagesFor('c2')[0]).toMatchObject({ t: 'error', code: 'forbidden' });
+    });
+
+    test('the decision is cached, so a patch does not re-ask the authorizer', async () => {
+        const authorizer = new RosterAuthorizer();
+        const { engine } = build(authorizer);
+
+        await engine.subscribe('c1', 's1', 'BoardController.board', { params: {}, query: {} }, { principal: 'ada' });
+        const afterSubscribe = authorizer.calls;
+
+        counter = 1;
+        engine.invalidate('orm:cards');
+        await settle();
+
+        expect(authorizer.calls).toBe(afterSubscribe);
+    });
+});

package/test/client-core.test.ts

@@ -0,0 +1,287 @@
+import { describe, expect, test } from 'bun:test';
+import { LiveClient, type LiveSocket } from '../src/client/core';
+import { PollingTransport } from '../src/client/transport';
+import type { ClientMessage, ServerMessage } from '../src/shared/protocol';
+
+class FakeSocket implements LiveSocket {
+    onopen: (() => void) | null = null;
+    onmessage: ((event: { data: string }) => void) | null = null;
+    onclose: (() => void) | null = null;
+    onerror: ((error: unknown) => void) | null = null;
+
+    readonly sent: ClientMessage[] = [];
+    closed = false;
+
+    send(data: string): void {
+        this.sent.push(JSON.parse(data));
+    }
+
+    close(): void {
+        this.closed = true;
+        this.onclose?.();
+    }
+
+    open(): void {
+        this.onopen?.();
+    }
+
+    deliver(message: ServerMessage): void {
+        this.onmessage?.({ data: JSON.stringify(message) });
+    }
+
+    subs(): Extract<ClientMessage, { t: 'sub' }>[] {
+        return this.sent.filter(m => m.t === 'sub') as any;
+    }
+}
+
+function build(options: Partial<ConstructorParameters<typeof LiveClient>[0]> = {}) {
+    const socket = new FakeSocket();
+    const client = new LiveClient({
+        url: 'ws://test/live',
+        socketFactory: () => socket,
+        unsubGraceMs: 5,
+        ...options
+    });
+
+    return { client, socket };
+}
+
+describe('LiveClient store', () => {
+    test('does not duplicate the first polling GET when the transport opens synchronously', async () => {
+        const calls: string[] = [];
+        const fetchStub = (async (url: any) => {
+            calls.push(String(url));
+            return new Response(JSON.stringify([]), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json', ETag: '"h1"' }
+            });
+        }) as unknown as typeof fetch;
+
+        const client = new LiveClient({
+            url: 'http://test/live',
+            transportFactory: () => new PollingTransport(
+                'http://test',
+                { 'UsersController.list': { method: 'get', path: '/users' } },
+                { intervalMs: 10_000, fetch: fetchStub }
+            )
+        });
+
+        const store = client.store('UsersController.list', { params: {}, query: {} });
+        store.subscribe(() => {});
+
+        await new Promise(resolve => setTimeout(resolve, 20));
+
+        expect(calls).toEqual(['http://test/users']);
+        client.close();
+    });
+
+    test('starts pending and subscribes on open', () => {
+        const { client, socket } = build();
+        const store = client.store('UsersController.list', { params: {}, query: {} });
+        store.subscribe(() => {});
+        socket.open();
+
+        expect(store.getSnapshot().pending).toBe(true);
+        expect(socket.subs()[0]).toMatchObject({ resource: 'UsersController.list' });
+    });
+
+    test('a snapshot fills the store and clears pending', () => {
+        const { client, socket } = build();
+        const store = client.store<{ id: number }[]>('r', { params: {}, query: {} });
+        store.subscribe(() => {});
+        socket.open();
+
+        socket.deliver({ t: 'snapshot', sid: socket.subs()[0].sid, rev: 1, hash: 'h1', data: [{ id: 1 }], key: 'id' });
+
+        expect(store.getSnapshot()).toMatchObject({ pending: false, error: null, stale: false });
+        expect(store.getSnapshot().data).toEqual([{ id: 1 }]);
+    });
+
+    test('getSnapshot is referentially stable until something changes', () => {
+        const { client, socket } = build();
+        const store = client.store('r', { params: {}, query: {} });
+        store.subscribe(() => {});
+        socket.open();
+        socket.deliver({ t: 'snapshot', sid: socket.subs()[0].sid, rev: 1, hash: 'h1', data: { a: 1 } });
+
+        const first = store.getSnapshot();
+        expect(store.getSnapshot()).toBe(first);
+
+        socket.deliver({ t: 'patch', sid: socket.subs()[0].sid, from: 1, to: 2, hash: 'h2', ops: [{ op: 'set', path: ['a'], value: 2 }] });
+
+        expect(store.getSnapshot()).not.toBe(first);
+        expect(store.getSnapshot().data).toEqual({ a: 2 });
+    });
+
+    test('applies keyed patches keeping untouched rows identical', () => {
+        const { client, socket } = build();
+        const store = client.store<{ id: number; n: string }[]>('r', { params: {}, query: {} });
+        store.subscribe(() => {});
+        socket.open();
+        const sid = socket.subs()[0].sid;
+        socket.deliver({ t: 'snapshot', sid, rev: 1, hash: 'h1', key: 'id', data: [{ id: 1, n: 'a' }, { id: 2, n: 'b' }] });
+
+        const before = store.getSnapshot().data!;
+        socket.deliver({
+            t: 'patch', sid, from: 1, to: 2, hash: 'h2',
+            ops: [{ op: 'upsert', path: [], key: 2, index: 1, value: { id: 2, n: 'bb' } }]
+        });
+
+        expect(store.getSnapshot().data![0]).toBe(before[0]);
+        expect(store.getSnapshot().data![1]).toEqual({ id: 2, n: 'bb' });
+    });
+
+    test('asks for a resync when the patch revision does not follow', () => {
+        const { client, socket } = build();
+        const store = client.store('r', { params: {}, query: {} });
+        store.subscribe(() => {});
+        socket.open();
+        const sid = socket.subs()[0].sid;
+        socket.deliver({ t: 'snapshot', sid, rev: 1, hash: 'h1', data: { a: 1 } });
+
+        socket.deliver({ t: 'patch', sid, from: 5, to: 6, hash: 'h9', ops: [] });
+
+        expect(socket.sent.some(m => m.t === 'resync' && m.sid === sid)).toBe(true);
+    });
+
+    test('marks the store stale without dropping the data', () => {
+        const { client, socket } = build();
+        const store = client.store('r', { params: {}, query: {} });
+        store.subscribe(() => {});
+        socket.open();
+        const sid = socket.subs()[0].sid;
+        socket.deliver({ t: 'snapshot', sid, rev: 1, hash: 'h1', data: { a: 1 } });
+        socket.deliver({ t: 'stale', sid, reason: 'db down' });
+
+        expect(store.getSnapshot()).toMatchObject({ stale: true });
+        expect(store.getSnapshot().data).toEqual({ a: 1 });
+    });
+
+    test('surfaces a server error on the store', () => {
+        const { client, socket } = build();
+        const store = client.store('r', { params: {}, query: {} });
+        store.subscribe(() => {});
+        socket.open();
+        socket.deliver({ t: 'error', sid: socket.subs()[0].sid, code: 'unknown_resource', message: 'nope' });
+
+        expect(store.getSnapshot()).toMatchObject({ pending: false, error: 'nope' });
+    });
+
+    test('removes a rejected subscription before reconnect while preserving its error', async () => {
+        const sockets: FakeSocket[] = [];
+        const client = new LiveClient({
+            url: 'ws://test/live',
+            reconnect: { initialMs: 1, maxMs: 2 },
+            socketFactory: () => {
+                const socket = new FakeSocket();
+                sockets.push(socket);
+                return socket;
+            }
+        });
+
+        const store = client.store('r', { params: {}, query: {} });
+        store.subscribe(() => {});
+        sockets[0].open();
+        const sid = sockets[0].subs()[0].sid;
+
+        sockets[0].deliver({ t: 'error', sid, code: 'forbidden', message: 'nope' });
+        expect(store.getSnapshot()).toMatchObject({ pending: false, error: 'nope' });
+
+        sockets[0].onclose?.();
+
+        await new Promise(resolve => {
+            setTimeout(() => {
+                sockets[1].open();
+                resolve(undefined);
+            }, 20);
+        });
+
+        expect(sockets[1].subs()).toHaveLength(0);
+        expect(store.getSnapshot()).toMatchObject({ pending: false, error: 'nope' });
+        client.close();
+    });
+
+    test('two stores with the same resource and inputs share one subscription', () => {
+        const { client, socket } = build();
+        const a = client.store('r', { params: {}, query: { x: '1' } });
+        const b = client.store('r', { params: {}, query: { x: '1' } });
+        a.subscribe(() => {});
+        b.subscribe(() => {});
+        socket.open();
+
+        expect(a).toBe(b);
+        expect(socket.subs()).toHaveLength(1);
+    });
+
+    test('unsubscribing the last listener sends unsub after the grace period', async () => {
+        const { client, socket } = build({ unsubGraceMs: 10 });
+        const store = client.store('r', { params: {}, query: {} });
+        const off = store.subscribe(() => {});
+        socket.open();
+        off();
+
+        expect(socket.sent.some(m => m.t === 'unsub')).toBe(false);
+        await new Promise(resolve => setTimeout(resolve, 30));
+        expect(socket.sent.some(m => m.t === 'unsub')).toBe(true);
+    });
+
+    test('hydration seeds the store and subscribes with the hash it already has', () => {
+        const hydrate = { 'r|{"body":null,"params":{},"query":{}}': { data: { a: 1 }, hash: 'h1' } };
+        const { client, socket } = build({ hydrate });
+        const store = client.store('r', { params: {}, query: {} });
+        store.subscribe(() => {});
+        socket.open();
+
+        expect(store.getSnapshot()).toMatchObject({ pending: false });
+        expect(store.getSnapshot().data).toEqual({ a: 1 });
+        expect(socket.subs()[0].hash).toBe('h1');
+    });
+
+    test('a current response leaves the hydrated data untouched', () => {
+        const hydrate = { 'r|{"body":null,"params":{},"query":{}}': { data: { a: 1 }, hash: 'h1' } };
+        const { client, socket } = build({ hydrate });
+        const store = client.store('r', { params: {}, query: {} });
+        store.subscribe(() => {});
+        socket.open();
+        const before = store.getSnapshot();
+
+        socket.deliver({ t: 'current', sid: socket.subs()[0].sid, rev: 1, hash: 'h1' });
+
+        expect(store.getSnapshot().data).toBe(before.data);
+    });
+
+    test('resubscribes every live store on reconnect, carrying the hash', () => {
+        const sockets: FakeSocket[] = [];
+        const client = new LiveClient({
+            url: 'ws://test/live',
+            unsubGraceMs: 5,
+            reconnect: { initialMs: 1, maxMs: 2 },
+            socketFactory: () => {
+                const socket = new FakeSocket();
+                sockets.push(socket);
+                return socket;
+            }
+        });
+
+        const store = client.store('r', { params: {}, query: {} });
+        store.subscribe(() => {});
+        sockets[0].open();
+        socketDeliverSnapshot(sockets[0]);
+
+        sockets[0].onclose?.();
+
+        return new Promise<void>(resolve => {
+            setTimeout(() => {
+                expect(sockets.length).toBeGreaterThan(1);
+                sockets[1].open();
+                expect(sockets[1].subs()[0].hash).toBe('h1');
+                client.close();
+                resolve();
+            }, 40);
+        });
+    });
+});
+
+function socketDeliverSnapshot(socket: FakeSocket): void {
+    socket.deliver({ t: 'snapshot', sid: socket.subs()[0].sid, rev: 1, hash: 'h1', data: { a: 1 } });
+}

package/test/client-transport.test.ts

@@ -0,0 +1,154 @@
+import { describe, expect, test } from 'bun:test';
+import { LiveClient, type LiveSocket } from '../src/client/core';
+import { WebSocketTransport, type ClientTransport, type TransportHandlers } from '../src/client/transport';
+
+function fakeSocket(): LiveSocket & { sent: string[] } {
+    const socket = {
+        sent: [] as string[],
+        send(data: string) { socket.sent.push(data); },
+        close() {},
+        onopen: null as (() => void) | null,
+        onmessage: null as ((event: { data: string }) => void) | null,
+        onclose: null as (() => void) | null,
+        onerror: null as ((error: unknown) => void) | null
+    };
+
+    return socket;
+}
+
+describe('WebSocketTransport', () => {
+    test('reports itself as websocket and forwards the three events', () => {
+        const socket = fakeSocket();
+        const transport = new WebSocketTransport('ws://x/live', () => socket);
+        const seen: string[] = [];
+
+        transport.start({
+            onOpen: () => seen.push('open'),
+            onMessage: raw => seen.push(`message:${raw}`),
+            onClose: () => seen.push('close')
+        });
+
+        expect(transport.kind).toBe('websocket');
+
+        socket.onopen?.();
+        socket.onmessage?.({ data: 'hi' });
+        socket.onclose?.();
+
+        expect(seen).toEqual(['open', 'message:hi', 'close']);
+    });
+
+    test('an error counts as a close, because both mean the pipe is gone', () => {
+        const socket = fakeSocket();
+        const transport = new WebSocketTransport('ws://x/live', () => socket);
+        let closes = 0;
+
+        transport.start({ onOpen: () => {}, onMessage: () => {}, onClose: () => { closes += 1; } });
+        socket.onerror?.(new Error('boom'));
+
+        expect(closes).toBe(1);
+    });
+
+    test('close() does not report a close back, so it cannot trigger a reconnect', () => {
+        const socket = fakeSocket();
+        const transport = new WebSocketTransport('ws://x/live', () => socket);
+        let closes = 0;
+
+        transport.start({ onOpen: () => {}, onMessage: () => {}, onClose: () => { closes += 1; } });
+        transport.close();
+        socket.onclose?.();
+
+        expect(closes).toBe(0);
+    });
+});
+
+describe('LiveClient over a custom transport', () => {
+    test('passes configured SSE paths to the default transport ladder', async () => {
+        const streamUrls: string[] = [];
+        const controlUrls: string[] = [];
+        const previousEventSource = (globalThis as any).EventSource;
+        const previousFetch = globalThis.fetch;
+
+        class FakeEventSource {
+            onopen: ((event: unknown) => void) | null = null;
+            onmessage: ((event: { data: string }) => void) | null = null;
+            onerror: ((event: unknown) => void) | null = null;
+
+            constructor(url: string) {
+                streamUrls.push(url);
+                queueMicrotask(() => this.onmessage?.({
+                    data: JSON.stringify({ t: 'ready', cid: 'sse-1' })
+                }));
+            }
+
+            close(): void {}
+        }
+
+        (globalThis as any).EventSource = FakeEventSource;
+        globalThis.fetch = (async (url: any) => {
+            controlUrls.push(String(url));
+            return new Response(null, { status: 200 });
+        }) as unknown as typeof fetch;
+
+        try {
+            const socket = fakeSocket();
+            const client = new LiveClient({
+                url: 'ws://test/live',
+                httpBaseUrl: 'http://test',
+                socketFactory: () => socket,
+                ssePath: '/custom/live-stream',
+                sseControlPath: '/custom/live-control',
+                transportProbeMs: 100
+            });
+
+            client.store('CardsController.list', { params: {}, query: {} }).subscribe(() => {});
+            socket.onerror?.(new Error('websocket unavailable'));
+
+            await new Promise(resolve => setTimeout(resolve, 20));
+
+            expect(streamUrls).toEqual(['http://test/custom/live-stream']);
+            expect(controlUrls).toEqual(['http://test/custom/live-control', 'http://test/custom/live-control']);
+            client.close();
+        } finally {
+            if (previousEventSource === undefined) {
+                delete (globalThis as any).EventSource;
+            } else {
+                (globalThis as any).EventSource = previousEventSource;
+            }
+            globalThis.fetch = previousFetch;
+        }
+    });
+
+    test('uses transportFactory when one is given, and reports its kind', () => {
+        const sent: string[] = [];
+        let handlers: TransportHandlers | null = null;
+
+        const custom: ClientTransport = {
+            kind: 'sse',
+            start(next) { handlers = next; },
+            send(raw) { sent.push(raw); },
+            close() {}
+        };
+
+        const client = new LiveClient({ url: 'http://x/live', transportFactory: () => custom });
+
+        expect(client.transport()).toBeNull();
+
+        client.store('CardsController.list', { params: {}, query: {} }).subscribe(() => {});
+        handlers!.onOpen();
+
+        expect(client.transport()).toBe('sse');
+        expect(sent.some(raw => raw.includes('"t":"hello"'))).toBe(true);
+        expect(sent.some(raw => raw.includes('"t":"sub"'))).toBe(true);
+    });
+
+    test('socketFactory still works, unchanged', () => {
+        const socket = fakeSocket();
+        const client = new LiveClient({ url: 'ws://x/live', socketFactory: () => socket });
+
+        client.store('CardsController.list', { params: {}, query: {} }).subscribe(() => {});
+        socket.onopen?.();
+
+        expect(client.transport()).toBe('websocket');
+        expect(socket.sent.some(raw => raw.includes('"t":"sub"'))).toBe(true);
+    });
+});