@evolu/common 8.17.0 → 8.19.0

package/src/local-first/Relay.ts

@@ -13,7 +13,8 @@ import {
 } from "../Array.ts";
 import { assert } from "../Assert.ts";
 import type { TimingSafeEqualDep } from "../Crypto.ts";
-import { err, ok } from "../Result.ts";
+import { createUnknownError } from "../Error.ts";
+import { err, ok, trySync } from "../Result.ts";
 import type { SqliteDep } from "../Sqlite.ts";
 import { sql } from "../Sqlite.ts";
 import { createMutexByKey } from "../Task.ts";
@@ -25,12 +26,13 @@ import {
   // OwnerTransport,
   OwnerWriteKey,
 } from "./Owner.ts";
+import type { ProtocolWriteKeyError } from "./Protocol.ts";
 import type {
   EncryptedDbChange,
   SqliteStorageDeps,
   Storage,
   StorageConfig,
-  StorageQuotaError,
+  StorageWriteMessagesError,
 } from "./Storage.ts";
 import {
   createBaseSqliteStorage,
@@ -66,7 +68,15 @@ export interface RelayConfig extends StorageConfig {
    *
    * OwnerId is used rather than short-lived tokens because this only controls
    * relay access, not write permissions. Since all data is encrypted on the
-   * relay, OwnerId exposure is safe.
+   * relay, OwnerId exposure reveals no data.
+   *
+   * It does allow write-key squatting. The relay stores the first write key
+   * presented for an owner, so anyone who learns an OwnerId before the owner's
+   * own write key reaches the relay can claim it. The owner then gets
+   * {@link ProtocolWriteKeyError} on this relay until the operator deletes the
+   * owner's row in `evolu_writeKey`. This callback does not prevent that: it
+   * receives only the OwnerId of a connection, which a squatter can name as
+   * well, and every message on the connection can name another owner.
    *
    * Owners specify which relays to connect to via `OwnerTransport`. In
    * WebSocket-based implementations, this check occurs before accepting the
@@ -186,6 +196,9 @@ export const createRelaySqliteStorage =
           return deps.timingSafeEqual(rows[0].writeKey, writeKey);
         }
 
+        // When SQLite fails this insert, for example on a full disk, the throw
+        // reaches the protocol, which logs it and answers with WriteError,
+        // because a boolean has no room for the error.
         deps.sqlite.exec(sql`
           insert into evolu_writeKey (ownerId, writeKey)
           values (${ownerId}, ${writeKey});
@@ -194,15 +207,6 @@ export const createRelaySqliteStorage =
         return true;
       },
 
-      setWriteKey: (ownerId, writeKey) => {
-        deps.sqlite.exec(sql`
-          insert into evolu_writeKey (ownerId, writeKey)
-          values (${ownerId}, ${writeKey})
-          on conflict (ownerId) do update
-            set writeKey = excluded.writeKey;
-        `);
-      },
-
       writeMessages: (ownerIdBytes, messages) => async (run) => {
         const ownerId = ownerIdBytesToOwnerId(ownerIdBytes);
         const uniqueMessagesWithTimestampBytes = dedupeArray(
@@ -215,32 +219,42 @@ export const createRelaySqliteStorage =
 
         return run(
           mutexByOwnerId.withLock(ownerId, async () => {
-            const existingTimestampsResult =
-              sqliteStorageBase.getExistingTimestamps(
-                ownerIdBytes,
-                mapArray(uniqueMessagesWithTimestampBytes, (m) => m.timestamp),
+            // SQLite can fail these reads, for example on a corrupt page, and
+            // a throw would panic the relay's shared Run.
+            const readResult = trySync(() => {
+              const existingTimestampsResult =
+                sqliteStorageBase.getExistingTimestamps(
+                  ownerIdBytes,
+                  mapArray(
+                    uniqueMessagesWithTimestampBytes,
+                    (m) => m.timestamp,
+                  ),
+                );
+
+              const existingTimestampKeys = new Set(
+                mapArray(existingTimestampsResult, uint8ArrayToBase64Url),
+              );
+              const newMessages = filterArray(
+                uniqueMessagesWithTimestampBytes,
+                (message) =>
+                  !existingTimestampKeys.has(
+                    uint8ArrayToBase64Url(message.timestamp),
+                  ),
               );
 
-            const existingTimestampKeys = new Set(
-              mapArray(existingTimestampsResult, uint8ArrayToBase64Url),
-            );
-            const newMessages = filterArray(
-              uniqueMessagesWithTimestampBytes,
-              (message) =>
-                !existingTimestampKeys.has(
-                  uint8ArrayToBase64Url(message.timestamp),
-                ),
-            );
+              // Nothing to write
+              if (!isNonEmptyArray(newMessages)) return null;
 
-            // Nothing to write
-            if (!isNonEmptyArray(newMessages)) {
-              return ok();
-            }
+              const usage = readOwnerUsageOrDefault(deps)(
+                ownerIdBytes,
+                firstInArray(newMessages).timestamp,
+              );
 
-            const usage = readOwnerUsageOrDefault(deps)(
-              ownerIdBytes,
-              firstInArray(newMessages).timestamp,
-            );
+              return { newMessages, usage };
+            }, createUnknownError);
+            if (!readResult.ok) return readResult;
+            if (readResult.value === null) return ok();
+            const { newMessages, usage } = readResult.value;
 
             const incomingBytes = newMessages.reduce(
               (sum, m) => sum + m.change.length,
@@ -260,7 +274,7 @@ export const createRelaySqliteStorage =
               ? await quotaResult
               : quotaResult;
             if (!isWithinQuota) {
-              return err<StorageQuotaError>({
+              return err<StorageWriteMessagesError>({
                 type: "StorageQuotaError",
                 ownerId,
               });
@@ -268,39 +282,42 @@ export const createRelaySqliteStorage =
 
             let { firstTimestamp, lastTimestamp } = usage;
 
-            return deps.sqlite.transaction(() => {
-              for (const { timestamp, change } of newMessages) {
-                let strategy;
-                [strategy, firstTimestamp, lastTimestamp] =
-                  getTimestampInsertStrategy(
+            // SQLite can fail the write, for example on a full disk. The
+            // transaction has rolled back, and a throw would panic the relay's
+            // shared Run.
+            return trySync(() => {
+              deps.sqlite.transaction(() => {
+                for (const { timestamp, change } of newMessages) {
+                  let strategy;
+                  [strategy, firstTimestamp, lastTimestamp] =
+                    getTimestampInsertStrategy(
+                      timestamp,
+                      firstTimestamp,
+                      lastTimestamp,
+                    );
+
+                  sqliteStorageBase.insertTimestamp(
+                    ownerIdBytes,
                     timestamp,
-                    firstTimestamp,
-                    lastTimestamp,
+                    strategy,
                   );
 
-                sqliteStorageBase.insertTimestamp(
+                  deps.sqlite.exec(sql`
+                    insert into evolu_message
+                      ("ownerId", "timestamp", "change")
+                    values (${ownerIdBytes}, ${timestamp}, ${change})
+                    on conflict do nothing;
+                  `);
+                }
+
+                updateOwnerUsage(deps)(
                   ownerIdBytes,
-                  timestamp,
-                  strategy,
+                  newStoredBytes,
+                  firstTimestamp,
+                  lastTimestamp,
                 );
-
-                deps.sqlite.exec(sql`
-                  insert into evolu_message
-                    ("ownerId", "timestamp", "change")
-                  values (${ownerIdBytes}, ${timestamp}, ${change})
-                  on conflict do nothing;
-                `);
-              }
-
-              updateOwnerUsage(deps)(
-                ownerIdBytes,
-                newStoredBytes,
-                firstTimestamp,
-                lastTimestamp,
-              );
-
-              return ok();
-            });
+              });
+            }, createUnknownError);
           }),
         );
       },
@@ -329,13 +346,7 @@ export const createRelaySqliteStorage =
             delete from evolu_message where ownerId = ${ownerId};
           `);
 
-          deps.sqlite.exec(sql`
-            delete from evolu_usage where ownerId = ${ownerId};
-          `);
-
           sqliteStorageBase.deleteOwner(ownerId);
-
-          return ok();
         });
       },
     };

package/src/local-first/Shared.test.ts

@@ -21,7 +21,11 @@ import type { ConsoleEntry, ConsoleLevel } from "../Console.ts";
 import type { DecryptWithXChaCha20Poly1305Error } from "../Crypto.ts";
 import { createUnknownError, UnknownError } from "../Error.ts";
 import { isPlainObject } from "../Object.ts";
-import type { DbWorkerInit, UnsupportedDbVersionError } from "./Db.ts";
+import type {
+  DatabaseHeldError,
+  DbWorkerInit,
+  UnsupportedDbVersionError,
+} from "./Db.ts";
 import {
   createAppOwner,
   createOwnerSecret,
@@ -11442,4 +11446,36 @@ describe("startup refusal", () => {
     await testWaitForWorkerMessage();
     assertEqual(leaderInputs, [{ type: "Dispose" }]);
   });
+
+  const heldRefusal: DatabaseHeldError = {
+    type: "DatabaseHeldError",
+    name: testName,
+  };
+
+  for (const error of [heldRefusal, refusal])
+    it(`disposes a worker that acquired leadership before the ${error.type} refusal of a worker requested earlier arrived`, async () => {
+      await using setup = await setupSharedWorker();
+      await using disposer = new AsyncDisposableStack();
+      const instance = await setup.createEvoluBeforeDbWorkerLeader();
+      const initDbWorker = await setupTabLeader(setup, disposer);
+      using leaderPort = testCreateMessagePort<DbWorkerOutput, DbWorkerInput>(
+        initDbWorker.port,
+      );
+      const leaderInputs: Array<DbWorkerInput> = [];
+      leaderPort.onMessage = (input) => {
+        leaderInputs.push(input);
+      };
+
+      // Browsers deliver the refusal first, because the refusing worker posts
+      // it while it still holds the database lock the other one waits for.
+      // The tenant does not depend on that order.
+      leaderPort.postMessage({
+        type: "LeaderAcquired",
+        clock: createTimestamp(),
+      });
+      await testWaitForWorkerMessage();
+      instance.dbWorkerPort.postMessage({ type: "LeaderRefused", error });
+      await testWaitForWorkerMessage();
+      assertEqual(leaderInputs, [{ type: "Dispose" }]);
+    });
 });