@cosmicdrift/kumiko-server-runtime 0.235.4 → 0.236.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.235.4",
+  "version": "0.236.1",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -80,8 +80,8 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.235.4",
-    "@cosmicdrift/kumiko-framework": "0.235.4",
+    "@cosmicdrift/kumiko-bundled-features": "0.236.1",
+    "@cosmicdrift/kumiko-framework": "0.236.1",
     "temporal-polyfill": "^0.3.2"
   },
   "publishConfig": {

package/src/__tests__/run-prod-app.integration.test.ts

@@ -20,7 +20,12 @@ import {
   userSessionEntity,
 } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { userEntity } from "@cosmicdrift/kumiko-bundled-features/user";
-import { NO_ROUTE_MATCH_HEADER_NAME } from "@cosmicdrift/kumiko-framework/api";
+import {
+  createRedisSseBroker,
+  isRedisSseBroker,
+  NO_ROUTE_MATCH_HEADER_NAME,
+  type SseEvent,
+} from "@cosmicdrift/kumiko-framework/api";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { InMemoryKmsAdapter, type KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import { createDbConnection } from "@cosmicdrift/kumiko-framework/db";
@@ -43,6 +48,8 @@ import {
   createProjectionStateTable,
 } from "@cosmicdrift/kumiko-framework/pipeline";
 import { unsafeEnsureEntityTable } from "@cosmicdrift/kumiko-framework/stack";
+import { waitFor } from "@cosmicdrift/kumiko-framework/testing";
+import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Queue } from "bullmq";
 import postgres from "postgres";
 import { z } from "zod";
@@ -1191,4 +1198,59 @@ describe("runProdApp — /metrics endpoint (fw#1352)", () => {
     const res = await handle.entrypoint.app.fetch(new Request("http://test/metrics"));
     expect(res.status).toBe(404);
   });
+
+  // fw#2630 shipped a Redis Pub/Sub fanout fix for SSE/access-invalidation
+  // across replicas, but runProdApp built its own in-memory sseBroker
+  // unconditionally and passed it in as ServerOptions.sseBroker — which
+  // always wins over buildServer's REDIS_URL default — so the fix never
+  // took effect in production. These tests exercise the level prod
+  // actually boots through (runProdApp), not buildServer/createRedisSseBroker
+  // directly, which is why the tests above were green while prod was broken.
+  describe("sseBroker wiring (fw#2630 Redis fanout)", () => {
+    test("wires a Redis-backed sseBroker so SSE events fan out across replicas", async () => {
+      const handle = await boot();
+      const redisUrl = process.env["REDIS_URL"] ?? "redis://localhost:16379";
+      const channel = `runprod-sse-${generateId()}`;
+      const received: SseEvent[] = [];
+      const otherReplica = createRedisSseBroker({ redisUrl });
+      try {
+        otherReplica.addClient(
+          channel,
+          (event) => received.push(event),
+          () => {},
+        );
+        await waitFor(() => {
+          handle.entrypoint.sseBroker.pushToChannel(channel, {
+            type: "unit.updated",
+            data: { id: "1" },
+          });
+          return received.length >= 1;
+        });
+        expect(received[0]).toEqual({ type: "unit.updated", data: { id: "1" } });
+      } finally {
+        await otherReplica.close();
+      }
+    });
+
+    test("closes the Redis-backed sseBroker on shutdown (no leaked connection)", async () => {
+      const handle = await boot();
+      const broker = handle.entrypoint.sseBroker;
+      if (!isRedisSseBroker(broker)) {
+        throw new Error("expected a Redis-backed sseBroker under REDIS_URL");
+      }
+      let closeCalls = 0;
+      const originalClose = broker.close.bind(broker);
+      broker.close = async () => {
+        closeCalls += 1;
+        await originalClose();
+      };
+
+      await handle.stop();
+      // avoid a second stop()/close() from the module-level afterEach
+      const idx = prodAppHandles.indexOf(handle);
+      if (idx >= 0) prodAppHandles.splice(idx, 1);
+
+      expect(closeCalls).toBe(1);
+    });
+  });
 });

package/src/run-prod-app.ts

@@ -74,8 +74,8 @@ import {
 } from "@cosmicdrift/kumiko-bundled-features/tenant-lifecycle";
 import { UserQueries } from "@cosmicdrift/kumiko-bundled-features/user";
 import {
+  createDefaultSseBroker,
   createRedisLoginRateLimiter,
-  createSseBroker,
   type LoginRateLimiter,
   loadJwtSecretOrKeyring,
   type SseBroker,
@@ -898,13 +898,18 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   // gegen die DB resolven müssen (z.B. Subdomain-Tenant-Lookup im
   // tenantResolver) — die Factory closure'd `db` und der Resolver kann
   // sie zur Request-Zeit aufrufen.
-  // sseBroker hier bauen (statt's createApiEntrypoint intern machen zu
-  // lassen) damit extraContext-Factories ihn schon zur Boot-Zeit closure'n
-  // können — z.B. ein extraContext-Provider der direkt SSE-Events
-  // publisht. Wir reichen denselben Broker dann an createApiEntrypoint
-  // durch (sseBroker?-option), damit der Server-internal-Broadcast und
-  // App-spezifische Publishes über genau einen Broker laufen.
-  const sseBroker = createSseBroker();
+  // Build the sseBroker here (instead of letting createApiEntrypoint do it
+  // internally) so extraContext factories can close over it at boot time —
+  // e.g. an extraContext provider that publishes SSE events directly. We
+  // pass the same broker into createApiEntrypoint (sseBroker? option) so
+  // the server-internal broadcast and app-specific publishes run over
+  // exactly one broker. createDefaultSseBroker (not createSseBroker
+  // directly) is what makes that broker Redis-backed under REDIS_URL —
+  // an unconditional in-memory broker here would silently win over
+  // buildServer's own REDIS_URL default (ServerOptions.sseBroker always
+  // wins), which is exactly how fw#2630's cross-replica fanout fix shipped
+  // without ever taking effect in production.
+  const { sseBroker, ownedRedisSseBroker } = createDefaultSseBroker(envSource);
   const deps: RunProdAppDeps = { db, redis, registry, sseBroker };
   const resolvedExtraContext =
     typeof options.extraContext === "function"
@@ -1170,6 +1175,20 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
         }),
       });
 
+  // The broker built above is always ours (runProdApp never accepts a
+  // caller-supplied sseBroker), so — same reasoning as buildServer's own
+  // ownedRedisSseBroker hook — closing it on shutdown is our job, not the
+  // entrypoint's. Registered after createApiEntrypoint/createAllInOneEntrypoint
+  // (which already registered the eventDispatcher/jobRunner hooks above),
+  // so it drains LIFO before those, matching the close-before-teardown
+  // order fw#2630 established for buildServer's own hook.
+  if (ownedRedisSseBroker) {
+    const broker = ownedRedisSseBroker;
+    entrypoint.lifecycle.registerShutdownHook("prodAppRedisSseBroker", async () => {
+      await broker.close();
+    });
+  }
+
   // 8. Build the AppSchema once + serialize. Wird beim Static-Fallback
   //    in die index.html injiziert damit createKumikoApp() im Browser
   //    `window.__KUMIKO_SCHEMA__` synchron lesen kann — gleicher Pfad