@cratis/arc 21.2.0 → 21.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cratis/arc",
-    "version": "21.2.0",
+    "version": "21.3.1",
     "description": "",
     "author": "Cratis",
     "license": "MIT",

package/queries/ObservableQueryConnection.ts

@@ -17,6 +17,7 @@ export class ObservableQueryConnection<TDataType> implements IObservableQueryCon
 
     private _socket!: WebSocket;
     private _disconnected = false;
+    private _unauthorized = false;
     private _url: string;
     private _pingInterval?: ReturnType<typeof setInterval>;
     private _pingIntervalMs: number = 10000;
@@ -95,13 +96,13 @@ export class ObservableQueryConnection<TDataType> implements IObservableQueryCon
                 this.startPinging();
             };
             this._socket.onclose = () => {
-                if (this._disconnected) return;
+                if (this._disconnected || this._unauthorized) return;
                 console.log(`Unexpected connection closed for route '${url}'`);
                 this.stopPinging();
                 this._reconnectPolicy.schedule(connectSocket, url);
             };
             this._socket.onerror = (error) => {
-                if (this._disconnected) return;
+                if (this._disconnected || this._unauthorized) return;
                 console.log(`Error with connection for '${url}' - ${error}`);
                 this.stopPinging();
                 this._reconnectPolicy.schedule(connectSocket, url);
@@ -115,7 +116,7 @@ export class ObservableQueryConnection<TDataType> implements IObservableQueryCon
             };
         };
 
-        if (this._disconnected) return;
+        if (this._disconnected || this._unauthorized) return;
         connectSocket();
     }
 
@@ -172,13 +173,36 @@ export class ObservableQueryConnection<TDataType> implements IObservableQueryCon
                 // For new-style messages (type === 'Data') the query result is wrapped in message.data.
                 // For legacy/backward-compatible messages (no type) the entire message IS the query result.
                 const data = message.type === WebSocketMessageType.Data ? message.data : message;
-                dataReceived(data as QueryResult<TDataType>);
+                const result = data as QueryResult<TDataType>;
+
+                if (result?.isAuthorized === false) {
+                    this.handleUnauthorized(result, dataReceived);
+                    return;
+                }
+
+                dataReceived(result);
             }
         } catch (error) {
             console.error('Error parsing WebSocket message:', error);
         }
     }
 
+    /**
+     * Handles the terminal result the server sends when the caller is no longer authorized for the query it is
+     * subscribed to. The subscription is over for good, so the result is delivered and the automatic reconnect is
+     * suppressed — reconnecting would re-subscribe, be denied again, and loop.
+     * @param {QueryResult<TDataType>} result The unauthorized result to deliver.
+     * @param {DataReceived<TDataType>} dataReceived Callback that receives the result.
+     */
+    private handleUnauthorized(result: QueryResult<TDataType>, dataReceived: DataReceived<TDataType>) {
+        console.warn(`Connection for '${this._url}' was ended by the server - no longer authorized`);
+        this._unauthorized = true;
+        this.stopPinging();
+        this._reconnectPolicy.cancel();
+        dataReceived(result);
+        this._socket?.close();
+    }
+
     private handlePong(message: WebSocketMessage) {
         if (message.timestamp && this._lastPingSentTime) {
             const latency = Date.now() - message.timestamp;

package/queries/ServerSentEventQueryConnection.ts

@@ -23,6 +23,7 @@ export const SSE_HUB_ROUTE = '/.cratis/queries/sse';
 export class ServerSentEventQueryConnection<TDataType> implements IObservableQueryConnection<TDataType> {
     private _eventSource?: EventSource;
     private _disconnected = false;
+    private _unauthorized = false;
 
     /** @inheritdoc */
     readonly lastPingLatency: number = 0;
@@ -38,7 +39,7 @@ export class ServerSentEventQueryConnection<TDataType> implements IObservableQue
 
     /** @inheritdoc */
     connect(dataReceived: DataReceived<TDataType>, queryArguments?: object): void {
-        if (this._disconnected) return;
+        if (this._disconnected || this._unauthorized) return;
 
         // Guard against environments where EventSource is not available (e.g. Node.js, SSR)
         // and no custom factory has been supplied to substitute it.
@@ -64,6 +65,10 @@ export class ServerSentEventQueryConnection<TDataType> implements IObservableQue
             if (this._disconnected) return;
             try {
                 const result = JSON.parse(event.data as string) as QueryResult<TDataType>;
+                if ((result as unknown as { isAuthorized?: boolean })?.isAuthorized === false) {
+                    this.handleUnauthorized(url, result, dataReceived);
+                    return;
+                }
                 dataReceived(result);
             } catch (error) {
                 console.error('SSE: error parsing message', error);
@@ -71,7 +76,7 @@ export class ServerSentEventQueryConnection<TDataType> implements IObservableQue
         };
 
         this._eventSource.onerror = () => {
-            if (this._disconnected) return;
+            if (this._disconnected || this._unauthorized) return;
             console.warn(`SSE: connection error for '${url}', EventSource will retry automatically.`);
         };
     }
@@ -83,4 +88,23 @@ export class ServerSentEventQueryConnection<TDataType> implements IObservableQue
         this._eventSource?.close();
         this._eventSource = undefined;
     }
+
+    /**
+     * Handles the terminal result the server sends when the caller is no longer authorized for the query it is
+     * subscribed to.
+     *
+     * Unlike a WebSocket, an `EventSource` re-establishes a stream the server ended - the server closing its response
+     * is precisely the signal the browser retries on, roughly every three seconds. Each retry re-runs the whole query
+     * pipeline server side just to be denied again, so the stream is only actually terminal if this client closes it.
+     * @param {string} url The stream url, for diagnostics.
+     * @param {QueryResult<TDataType>} result The unauthorized result to deliver.
+     * @param {DataReceived<TDataType>} dataReceived Callback that receives the result.
+     */
+    private handleUnauthorized(url: string, result: QueryResult<TDataType>, dataReceived: DataReceived<TDataType>): void {
+        console.warn(`SSE: stream for '${url}' was ended by the server - no longer authorized`);
+        this._unauthorized = true;
+        this._eventSource?.close();
+        this._eventSource = undefined;
+        dataReceived(result);
+    }
 }

package/queries/for_ObservableQueryConnection/given/an_observable_query_connection_with_a_reconnect_policy.ts

@@ -0,0 +1,72 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import sinon from 'sinon';
+import { ObservableQueryConnection } from '../../ObservableQueryConnection';
+import { IReconnectPolicy } from '../../IReconnectPolicy';
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+export type FakeWebSocketWithPolicy = {
+    onopen: (() => void) | null;
+    onclose: (() => void) | null;
+    onerror: ((error: unknown) => void) | null;
+    onmessage: ((event: { data: string }) => void) | null;
+    close: sinon.SinonStub;
+    send: sinon.SinonStub;
+    readyState: number;
+};
+
+export class an_observable_query_connection_with_a_reconnect_policy {
+    connection: ObservableQueryConnection<unknown>;
+    fakeWebSocket!: FakeWebSocketWithPolicy;
+    reconnectPolicy: IReconnectPolicy;
+    schedule: sinon.SinonStub;
+    cancel: sinon.SinonStub;
+
+    constructor() {
+        this.fakeWebSocket = {
+            onopen: null,
+            onclose: null,
+            onerror: null,
+            onmessage: null,
+            close: sinon.stub(),
+            send: sinon.stub(),
+            readyState: WebSocket.OPEN,
+        };
+
+        const fakeWebSocket = this.fakeWebSocket;
+        const FakeWebSocketClass = function (this: any) {
+            fakeWebSocket.onopen = null;
+            fakeWebSocket.onclose = null;
+            fakeWebSocket.onerror = null;
+            fakeWebSocket.onmessage = null;
+            return fakeWebSocket;
+        };
+        (globalThis as any)['WebSocket'] = FakeWebSocketClass;
+
+        this.schedule = sinon.stub().returns(true);
+        this.cancel = sinon.stub();
+        this.reconnectPolicy = {
+            attempt: 0,
+            schedule: this.schedule,
+            reset: sinon.stub(),
+            cancel: this.cancel,
+        } as unknown as IReconnectPolicy;
+
+        this.connection = new ObservableQueryConnection<unknown>(
+            new URL('https://example.com/api/test'),
+            'test-microservice',
+            10000,
+            this.reconnectPolicy
+        );
+    }
+
+    simulateMessage(payload: object): void {
+        this.fakeWebSocket.onmessage?.({ data: JSON.stringify(payload) });
+    }
+
+    simulateClose(): void {
+        this.fakeWebSocket.onclose?.();
+    }
+}

package/queries/for_ObservableQueryConnection/when_receiving_unauthorized/terminates_without_reconnecting.ts

@@ -0,0 +1,57 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { given } from '../../../given';
+import { an_observable_query_connection_with_a_reconnect_policy } from '../given/an_observable_query_connection_with_a_reconnect_policy';
+import { QueryResult } from '../../QueryResult';
+import { WebSocketMessageType } from '../../WebSocketMessage';
+
+describe('when receiving unauthorized it terminates without reconnecting', given(an_observable_query_connection_with_a_reconnect_policy, context => {
+    const unauthorizedResult = {
+        data: null,
+        isSuccess: false,
+        isAuthorized: false,
+        isValid: true,
+        hasExceptions: false,
+        validationResults: [],
+        exceptionMessages: [],
+        exceptionStackTrace: '',
+        paging: { page: 0, size: 0, totalItems: 0, totalPages: 0 }
+    };
+
+    let receivedResults: QueryResult<unknown>[] = [];
+
+    beforeEach(() => {
+        receivedResults = [];
+        context.connection.connect((data) => {
+            receivedResults.push(data as QueryResult<unknown>);
+        });
+        context.simulateMessage({
+            type: WebSocketMessageType.Data,
+            data: unauthorizedResult
+        });
+
+        // The server closes the stream right after the terminal result.
+        context.simulateClose();
+    });
+
+    it('should deliver the unauthorized result', () => {
+        receivedResults.should.have.lengthOf(1);
+    });
+
+    it('should deliver it as not authorized', () => {
+        (receivedResults[0] as unknown as { isAuthorized: boolean }).isAuthorized.should.be.false;
+    });
+
+    it('should not schedule a reconnect', () => {
+        context.schedule.called.should.be.false;
+    });
+
+    it('should cancel any pending reconnect', () => {
+        context.cancel.called.should.be.true;
+    });
+
+    it('should close the socket', () => {
+        context.fakeWebSocket.close.called.should.be.true;
+    });
+}));

package/queries/for_ServerSentEventQueryConnection/when_receiving_unauthorized/terminates_without_reconnecting.ts

@@ -0,0 +1,63 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import sinon from 'sinon';
+import { ServerSentEventQueryConnection } from '../../ServerSentEventQueryConnection';
+import { QueryResult } from '../../QueryResult';
+
+/**
+ * Unlike a WebSocket, an EventSource treats the server ending its response as the signal to retry - roughly every
+ * three seconds, and each retry re-runs the entire query pipeline server side just to be denied again. The terminal
+ * unauthorized result is only terminal if this client closes the stream itself.
+ */
+describe('when receiving unauthorized it terminates without reconnecting', () => {
+    const unauthorizedResult = {
+        data: null,
+        isSuccess: false,
+        isAuthorized: false,
+        isValid: true,
+        hasExceptions: false,
+        validationResults: [],
+        exceptionMessages: [],
+        exceptionStackTrace: '',
+        paging: { page: 0, size: 0, totalItems: 0, totalPages: 0 }
+    };
+
+    let fakeEventSource: Record<string, unknown>;
+    let closeStub: sinon.SinonStub;
+    let constructedCount: number;
+    let connection: ServerSentEventQueryConnection<string[]>;
+    let receivedResults: QueryResult<string[]>[];
+
+    beforeEach(() => {
+        closeStub = sinon.stub();
+        constructedCount = 0;
+        fakeEventSource = { onmessage: null, onerror: null, close: closeStub };
+
+        (globalThis as Record<string, unknown>)['EventSource'] = function () {
+            constructedCount++;
+            return fakeEventSource;
+        };
+
+        receivedResults = [];
+        connection = new ServerSentEventQueryConnection<string[]>(new URL('http://localhost/api/queries/latest'));
+        connection.connect((result: QueryResult<string[]>) => receivedResults.push(result));
+
+        (fakeEventSource['onmessage'] as (event: MessageEvent) => void)(
+            { data: JSON.stringify(unauthorizedResult) } as MessageEvent
+        );
+
+        // Anything that would normally bring the stream back up must now be refused.
+        connection.connect(() => { });
+    });
+
+    afterEach(() => {
+        delete (globalThis as Record<string, unknown>)['EventSource'];
+        sinon.restore();
+    });
+
+    it('should deliver the unauthorized result', () => receivedResults.length.should.equal(1));
+    it('should deliver it as not authorized', () => (receivedResults[0] as unknown as { isAuthorized: boolean }).isAuthorized.should.be.false);
+    it('should close the event source', () => closeStub.calledOnce.should.be.true);
+    it('should not re-establish the stream', () => constructedCount.should.equal(1));
+});