@carno.js/live 1.8.0

package/test/pg-listen-probe.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, test } from 'bun:test';
+import { SQL } from 'bun';
+import { getDriverType } from '../../orm/src/driver/driver-factory';
+
+const URL = process.env.CARNO_TEST_PG_URL
+    ?? 'postgres://postgres:postgres@localhost:5433/postgres';
+
+const describePostgres = getDriverType() === 'postgres' ? describe : describe.skip;
+
+describePostgres('Bun LISTEN/NOTIFY', () => {
+    test('a notification sent on one connection arrives on the listening one', async () => {
+        const listener = new SQL({ url: URL, max: 1 }) as any;
+        const writer = new SQL({ url: URL, max: 1 }) as any;
+        const received: string[] = [];
+
+        expect(typeof listener.listen).toBe('function');
+        expect(typeof writer.notify).toBe('function');
+
+        await listener.listen('carno_probe', (payload: string) => {
+            received.push(payload);
+        });
+        await writer.notify('carno_probe', 'hello');
+
+        const deadline = Date.now() + 3000;
+
+        while (received.length === 0 && Date.now() < deadline) {
+            await new Promise(resolve => setTimeout(resolve, 10));
+        }
+
+        await listener.close();
+        await writer.close();
+
+        expect(received).toEqual(['hello']);
+    });
+});
+
+describePostgres('PgListener against a real database', () => {
+    test('delivers a notification through the listener', async () => {
+        const { PgListener } = await import('../src/emitters/pg-listener');
+        const listener = new PgListener({ url: URL, heartbeatMs: 0 });
+        const seen: string[] = [];
+
+        await listener.listen('carno_probe_listener', payload => seen.push(payload));
+        await listener.notify('carno_probe_listener', '{"t":"users","i":"7"}');
+
+        const deadline = Date.now() + 3000;
+
+        while (seen.length === 0 && Date.now() < deadline) {
+            await new Promise(resolve => setTimeout(resolve, 10));
+        }
+
+        await listener.close();
+
+        expect(seen).toEqual(['{"t":"users","i":"7"}']);
+    });
+});

package/test/pg-listener.test.ts

@@ -0,0 +1,134 @@
+import { describe, expect, test } from 'bun:test';
+import { PgListener, type ListenableSql } from '../src/emitters/pg-listener';
+
+class FakeSql implements ListenableSql {
+    readonly listened: string[] = [];
+    readonly notified: { channel: string; payload: string }[] = [];
+    readonly handlers = new Map<string, (payload: string) => void>();
+    healthy = true;
+    closed = false;
+
+    async listen(channel: string, onNotify: (payload: string) => void): Promise<void> {
+        this.listened.push(channel);
+        this.handlers.set(channel, onNotify);
+    }
+
+    async notify(channel: string, payload = ''): Promise<void> {
+        this.notified.push({ channel, payload });
+    }
+
+    async unsafe(): Promise<void> {
+        if (!this.healthy) {
+            throw new Error('connection lost');
+        }
+    }
+
+    async close(): Promise<void> {
+        this.closed = true;
+    }
+
+    emit(channel: string, payload: string): void {
+        this.handlers.get(channel)?.(payload);
+    }
+}
+
+function build() {
+    const created: FakeSql[] = [];
+    let reconnects = 0;
+    const listener = new PgListener({
+        url: 'postgres://ignored',
+        heartbeatMs: 0,
+        retryMs: 1,
+        sqlFactory: () => {
+            const sql = new FakeSql();
+            created.push(sql);
+            return sql;
+        },
+        onReconnect: () => {
+            reconnects += 1;
+        }
+    });
+
+    return { listener, created, reconnects: () => reconnects };
+}
+
+describe('PgListener', () => {
+    test('subscribes the channel and delivers payloads', async () => {
+        const { listener, created } = build();
+        const seen: string[] = [];
+
+        await listener.listen('carno_live', payload => seen.push(payload));
+        created[0].emit('carno_live', '{"t":"users"}');
+
+        expect(created[0].listened).toEqual(['carno_live']);
+        expect(seen).toEqual(['{"t":"users"}']);
+
+        await listener.close();
+    });
+
+    test('a second channel reuses the same connection', async () => {
+        const { listener, created } = build();
+
+        await listener.listen('one', () => {});
+        await listener.listen('two', () => {});
+
+        expect(created).toHaveLength(1);
+        expect(created[0].listened).toEqual(['one', 'two']);
+
+        await listener.close();
+    });
+
+    test('a dead connection is rebuilt and every channel is re-listened', async () => {
+        const { listener, created, reconnects } = build();
+        const seen: string[] = [];
+
+        await listener.listen('carno_live', payload => seen.push(payload));
+        created[0].healthy = false;
+
+        await listener.check();
+
+        expect(created).toHaveLength(2);
+        expect(created[0].closed).toBe(true);
+        expect(created[1].listened).toEqual(['carno_live']);
+        expect(reconnects()).toBe(1);
+
+        created[1].emit('carno_live', 'after');
+        expect(seen).toEqual(['after']);
+
+        await listener.close();
+    });
+
+    test('a healthy connection is left alone', async () => {
+        const { listener, created, reconnects } = build();
+
+        await listener.listen('carno_live', () => {});
+        await listener.check();
+
+        expect(created).toHaveLength(1);
+        expect(reconnects()).toBe(0);
+
+        await listener.close();
+    });
+
+    test('notify goes out on the same connection', async () => {
+        const { listener, created } = build();
+
+        await listener.notify('carno_bus', 'payload');
+
+        expect(created[0].notified).toEqual([{ channel: 'carno_bus', payload: 'payload' }]);
+
+        await listener.close();
+    });
+
+    test('close shuts the connection and stops reconnecting', async () => {
+        const { listener, created } = build();
+
+        await listener.listen('carno_live', () => {});
+        await listener.close();
+
+        expect(created[0].closed).toBe(true);
+
+        await listener.check();
+        expect(created).toHaveLength(1);
+    });
+});

package/test/pg-notify-emitter.test.ts

@@ -0,0 +1,113 @@
+import { describe, expect, test } from 'bun:test';
+import {
+    UnsafeIdentifierError,
+    assertIdentifier,
+    createFunctionSql,
+    createTriggerSql,
+    dropTriggerSql,
+    triggerNameOf
+} from '../src/emitters/pg-trigger-sql';
+import { eventsFromPayload } from '../src/emitters/pg-notify-emitter';
+import { DEFAULT_LIVE_CONFIG } from '../src/config';
+import { AppEmitter } from '../src/emitters/AppEmitter';
+import { InProcessBus } from '../src/bus/InProcessBus';
+import { statementObserver } from '@carno.js/orm';
+import type { InvalidationEvent } from '../src/graph/types';
+
+describe('trigger SQL', () => {
+    test('refuses an identifier that is not a bare name', () => {
+        expect(() => assertIdentifier('table', 'users; DROP TABLE users')).toThrow(UnsafeIdentifierError);
+        expect(() => assertIdentifier('table', 'public.users')).toThrow(UnsafeIdentifierError);
+        expect(() => assertIdentifier('table', '"users"')).toThrow(UnsafeIdentifierError);
+        expect(assertIdentifier('table', 'live_tasks')).toBe('live_tasks');
+    });
+
+    test('names the trigger after the table', () => {
+        expect(triggerNameOf('live_tasks')).toBe('carno_live_live_tasks');
+    });
+
+    test('the trigger fires on every write and carries the key column', () => {
+        const sql = createTriggerSql('live_tasks', 'id', 'carno_live');
+
+        expect(sql).toContain('AFTER INSERT OR UPDATE OR DELETE ON live_tasks');
+        expect(sql).toContain('FOR EACH ROW');
+        expect(sql).toContain(`EXECUTE FUNCTION carno_live_notify('id', 'carno_live')`);
+        expect(sql).toContain('DROP TRIGGER IF EXISTS carno_live_live_tasks ON live_tasks');
+    });
+
+    test('the function refuses to notify when an UPDATE changed nothing', () => {
+        const sql = createFunctionSql(7000);
+
+        expect(sql).toContain('IF changed IS NULL THEN');
+        expect(sql).toContain('octet_length(payload) > 7000');
+        expect(sql).toContain('PERFORM pg_notify(channel, payload)');
+    });
+
+    test('drop is idempotent', () => {
+        expect(dropTriggerSql('live_tasks')).toBe(
+            'DROP TRIGGER IF EXISTS carno_live_live_tasks ON live_tasks;'
+        );
+    });
+});
+
+describe('eventsFromPayload', () => {
+    test('a row write becomes a row key with its columns', () => {
+        expect(eventsFromPayload('{"t":"live_tasks","i":"42","c":["title"]}')).toEqual([
+            { key: 'orm:live_tasks#42', columns: ['title'] }
+        ]);
+    });
+
+    test('a write with no columns is a wildcard', () => {
+        expect(eventsFromPayload('{"t":"live_tasks","i":"42","c":null}')).toEqual([
+            { key: 'orm:live_tasks#42', columns: null }
+        ]);
+    });
+
+    test('an empty column list is a wildcard, not an empty filter', () => {
+        expect(eventsFromPayload('{"t":"live_tasks","i":"42","c":[]}')).toEqual([
+            { key: 'orm:live_tasks#42', columns: null }
+        ]);
+    });
+
+    test('a payload with no id degrades to the whole table', () => {
+        expect(eventsFromPayload('{"t":"live_tasks","i":null,"c":null}')).toEqual([
+            { key: 'orm:live_tasks', columns: null }
+        ]);
+    });
+
+    test('garbage on the channel is ignored, not thrown', () => {
+        expect(eventsFromPayload('not json')).toEqual([]);
+        expect(eventsFromPayload('{"i":"42"}')).toEqual([]);
+    });
+});
+
+describe('AppEmitter with a covered table', () => {
+    test('does not publish writes announced by another emitter', () => {
+        const bus = new InProcessBus();
+        const published: InvalidationEvent[] = [];
+        bus.subscribe(events => published.push(...events));
+
+        const emitter = new AppEmitter(bus, DEFAULT_LIVE_CONFIG);
+        emitter.setCoveredTables(['live_tasks']);
+        emitter.attach();
+
+        statementObserver.notifyWrite({
+            statement: 'update',
+            table: 'live_tasks',
+            where: 'id = 1',
+            values: { title: 'x' },
+            primaryKeyColumnName: 'id'
+        } as any);
+        statementObserver.notifyWrite({
+            statement: 'update',
+            table: 'other_table',
+            where: 'id = 1',
+            values: { title: 'x' },
+            primaryKeyColumnName: 'id'
+        } as any);
+
+        emitter.detach();
+
+        expect(published).toEqual([{ key: 'orm:other_table#1', columns: ['title'] }]);
+    });
+});

package/test/pg-notify-integration.test.ts

@@ -0,0 +1,88 @@
+import { describe, expect, test } from 'bun:test';
+import { withDatabase } from '../../orm/src/testing';
+import { getDriverType } from '../../orm/src/driver/driver-factory';
+import { PgNotifyEmitter } from '../src/emitters/pg-notify-emitter';
+import type { InvalidationEvent } from '../src/graph/types';
+
+const URL = process.env.CARNO_TEST_PG_URL
+    ?? 'postgres://postgres:postgres@localhost:5433/postgres';
+
+const TABLE_STATEMENTS = [
+    'CREATE TABLE pg_notify_rows (id SERIAL PRIMARY KEY, title TEXT NOT NULL, note TEXT NULL);'
+];
+
+const describePostgres = getDriverType() === 'postgres' ? describe : describe.skip;
+
+async function waitFor(events: InvalidationEvent[], count: number): Promise<void> {
+    const deadline = Date.now() + 3000;
+
+    while (events.length < count && Date.now() < deadline) {
+        await new Promise(resolve => setTimeout(resolve, 10));
+    }
+}
+
+describePostgres('PgNotifyEmitter against a real database', () => {
+    test('a raw SQL write that never touched the ORM produces an invalidation', async () => {
+        await withDatabase(TABLE_STATEMENTS, async ({ executeSql }) => {
+            const received: InvalidationEvent[] = [];
+            const emitter = new PgNotifyEmitter(events => received.push(...events), {
+                tables: [{ table: 'pg_notify_rows', primaryKey: 'id' }],
+                url: URL,
+                execute: sql => executeSql(sql),
+                channel: 'carno_live_test',
+                heartbeatMs: 0
+            });
+
+            await emitter.attach();
+
+            // No ORM, no entity, no repository: this is what a migration, a
+            // psql session or a service in another language looks like.
+            await executeSql(`INSERT INTO pg_notify_rows (title) VALUES ('first');`);
+            await waitFor(received, 1);
+
+            await executeSql(`UPDATE pg_notify_rows SET title = 'second' WHERE id = 1;`);
+            await waitFor(received, 2);
+
+            // An update that writes the same value must not wake anyone.
+            await executeSql(`UPDATE pg_notify_rows SET title = 'second' WHERE id = 1;`);
+            await new Promise(resolve => setTimeout(resolve, 300));
+
+            await executeSql(`DELETE FROM pg_notify_rows WHERE id = 1;`);
+            await waitFor(received, 3);
+
+            await emitter.detach();
+
+            expect(received).toEqual([
+                { key: 'orm:pg_notify_rows#1', columns: null },
+                { key: 'orm:pg_notify_rows#1', columns: ['title'] },
+                { key: 'orm:pg_notify_rows#1', columns: null }
+            ]);
+        });
+    });
+});
+
+describePostgres('PgNotifyBus against a real database', () => {
+    test('two nodes see each other and not their own echo', async () => {
+        const { PgNotifyBus } = await import('../src/bus/PgNotifyBus');
+        const nodeA = new PgNotifyBus({ url: URL, channel: 'carno_bus_test', nodeId: 'node-a' });
+        const nodeB = new PgNotifyBus({ url: URL, channel: 'carno_bus_test', nodeId: 'node-b' });
+        const seenByA: InvalidationEvent[] = [];
+        const seenByB: InvalidationEvent[] = [];
+
+        nodeA.subscribe(events => seenByA.push(...events));
+        nodeB.subscribe(events => seenByB.push(...events));
+
+        await nodeA.start();
+        await nodeB.start();
+
+        nodeA.publish([{ key: 'orm:users#1', columns: ['name'] }]);
+        await waitFor(seenByB, 1);
+
+        await nodeA.stop();
+        await nodeB.stop();
+
+        expect(seenByB).toEqual([{ key: 'orm:users#1', columns: ['name'] }]);
+        // Delivered locally once, when published; the echo back was dropped.
+        expect(seenByA).toEqual([{ key: 'orm:users#1', columns: ['name'] }]);
+    });
+});

package/test/polling-auth.test.ts

@@ -0,0 +1,169 @@
+import { afterEach, describe, expect, test } from 'bun:test';
+import { Controller, Get, Use } from '@carno.js/core';
+import { createTestHarness } from '@carno.js/core';
+import { Live, LivePlugin } from '../src';
+import type { LiveAuthorizationRequest, LiveAuthorizer } from '../src/auth/authorizer';
+import type { LiveScopeResolver } from '../src/transport/scope-resolver';
+import { PollingTransport } from '../src/client/transport';
+import { closeLiveRuntime } from '../src/runtime';
+
+@Controller('/private')
+class PrivateController {
+    @Get('/')
+    @Live({ shared: 'private' })
+    read() {
+        return { secret: true };
+    }
+}
+
+class DenyPolling implements LiveAuthorizer {
+    calls = 0;
+
+    authorize(_request: LiveAuthorizationRequest): boolean {
+        this.calls++;
+        return false;
+    }
+}
+
+class AllowPolling implements LiveAuthorizer {
+    calls = 0;
+
+    authorize(_request: LiveAuthorizationRequest): boolean {
+        this.calls++;
+        return true;
+    }
+}
+
+@Controller('/scoped')
+@Use(ctx => {
+    if (ctx.headers.get('x-live-tenant') !== 'acme') {
+        return new Response('forbidden', { status: 403 });
+    }
+})
+class ScopedController {
+    @Get('/')
+    @Live({ shared: 'private' })
+    read() {
+        return { tenant: 'acme' };
+    }
+}
+
+describe('PollingTransport authorization', () => {
+    afterEach(async () => {
+        await closeLiveRuntime();
+    });
+
+    test('consults the live scope and authorizer instead of polling the route anonymously', async () => {
+        const authorizer = new DenyPolling();
+        let resolvedToken: string | undefined;
+        const resolver: LiveScopeResolver = {
+            resolve: async ({ token }) => {
+                resolvedToken = token;
+                return { principal: 'ada' };
+            }
+        };
+        const harness = await createTestHarness({
+            plugins: [LivePlugin.create({
+                controllers: [PrivateController],
+                scopeResolver: resolver,
+                authorizer
+            })],
+            listen: true
+        });
+
+        const received: unknown[] = [];
+        const nativeFetch = (globalThis as { __carnoNativeFetch?: typeof fetch }).__carnoNativeFetch ?? fetch;
+        const transport = new PollingTransport(
+            `http://127.0.0.1:${harness.port}`,
+            {
+                'PrivateController.read': { method: 'GET', path: '/private' }
+            },
+            {
+                intervalMs: 10_000,
+                token: 'poll-secret',
+                fetch: (async (url, init) => nativeFetch(url, init)) as typeof fetch
+            }
+        );
+
+        try {
+            transport.start({
+                onOpen: () => {},
+                onMessage: raw => received.push(JSON.parse(raw)),
+                onClose: () => {}
+            });
+            transport.send(JSON.stringify({
+                t: 'sub',
+                sid: 's1',
+                resource: 'PrivateController.read',
+                inputs: { params: {}, query: {} }
+            }));
+
+            await new Promise(resolve => setTimeout(resolve, 30));
+
+            expect(authorizer.calls).toBe(1);
+            expect(resolvedToken).toBe('poll-secret');
+            expect(received[0]).toMatchObject({ t: 'error', sid: 's1', code: 'forbidden' });
+        } finally {
+            transport.close();
+            await harness.close();
+        }
+    });
+
+    test('propagates the token and resolver headers through the HTTP route pipeline', async () => {
+        const authorizer = new AllowPolling();
+        let resolvedToken: string | undefined;
+        const resolver: LiveScopeResolver = {
+            resolve: async ({ token }) => {
+                resolvedToken = token;
+                return { principal: 'ada', headers: { 'x-live-tenant': 'acme' } };
+            }
+        };
+        const harness = await createTestHarness({
+            plugins: [LivePlugin.create({
+                controllers: [ScopedController],
+                scopeResolver: resolver,
+                authorizer
+            })],
+            listen: true
+        });
+
+        const received: unknown[] = [];
+        const nativeFetch = (globalThis as { __carnoNativeFetch?: typeof fetch }).__carnoNativeFetch ?? fetch;
+        const transport = new PollingTransport(
+            `http://127.0.0.1:${harness.port}`,
+            { 'ScopedController.read': { method: 'GET', path: '/scoped' } },
+            {
+                intervalMs: 10_000,
+                token: 'poll-secret',
+                fetch: (async (url, init) => nativeFetch(url, init)) as typeof fetch
+            }
+        );
+
+        try {
+            transport.start({
+                onOpen: () => {},
+                onMessage: raw => received.push(JSON.parse(raw)),
+                onClose: () => {}
+            });
+            transport.send(JSON.stringify({
+                t: 'sub',
+                sid: 's1',
+                resource: 'ScopedController.read',
+                inputs: { params: {}, query: {} }
+            }));
+
+            await new Promise(resolve => setTimeout(resolve, 30));
+
+            expect(resolvedToken).toBe('poll-secret');
+            expect(authorizer.calls).toBe(1);
+            expect(received[0]).toMatchObject({
+                t: 'snapshot',
+                sid: 's1',
+                data: { tenant: 'acme' }
+            });
+        } finally {
+            transport.close();
+            await harness.close();
+        }
+    });
+});