@happyvertical/smrt-core 0.51.10 → 0.51.11

package/dist/change-feed.js

@@ -1,3 +1,4 @@
+import { getChangeFeedSensitiveTables, isChangeFeedSensitiveTable, isChangeFeedSensitiveWrite } from "./change-feed-sensitivity.js";
 import { resolveDbCacheKey } from "./collection-cache.js";
 import { toSafeInteger } from "./utils/safe-integer.js";
 import { publishChangeSignal } from "./change-signals.js";
@@ -8,6 +9,7 @@ import { detectEngine } from "./schema/ddl/index.js";
 import { CREATE_SMRT_CHANGES_TABLE, ENSURE_POSTGRES_CHANGE_FEED_APPEND_FUNCTION, ENSURE_POSTGRES_CHANGE_FEED_SCHEMA, FRAMEWORK_OPERATIONAL_TABLES, POSTGRES_CHANGE_FEED_APPEND_BATCH_FUNCTION_IDENTITY, POSTGRES_CHANGE_FEED_APPEND_BATCH_FUNCTION_NAME, POSTGRES_CHANGE_FEED_APPEND_FUNCTION_IDENTITY, POSTGRES_CHANGE_FEED_APPEND_FUNCTION_NAME, POSTGRES_CHANGE_FEED_DRAIN_FUNCTION_IDENTITY, POSTGRES_CHANGE_FEED_DRAIN_FUNCTION_NAME, POSTGRES_CHANGE_FEED_HELPER_MARKER, POSTGRES_CHANGE_FEED_PENDING_TABLE, REPLACE_POSTGRES_CHANGE_FEED_APPEND_FUNCTION, RETIRED_SYSTEM_TABLES } from "./system/schema.js";
 import { SYSTEM_TABLE_NAMES } from "./schema/system-table-shapes.js";
 import { createLogger } from "@happyvertical/logger";
+import { randomBytes } from "node:crypto";
 //#region src/change-feed.ts
 /**
 * Adapter-agnostic change feed — the framework's change-observation spine
@@ -157,6 +159,11 @@ var CHANGE_FEED_TABLE = "_smrt_changes";
 * the feed's own table so it can never observe itself), the model-backed
 * operational plumbing ({@link FRAMEWORK_OPERATIONAL_TABLES}), and the retired
 * system tables that may still exist on older databases.
+*
+* Credential-bearing *application* tables are excluded separately, because
+* that set grows at registration time rather than being fixed at module load
+* — see {@link isChangeFeedSensitiveTable} and `change-feed-sensitivity.ts`
+* (#2937).
 */
 var CHANGE_FEED_EXCLUDED_TABLES = /* @__PURE__ */ new Set([
 	...SYSTEM_TABLE_NAMES,
@@ -167,11 +174,17 @@ var CHANGE_FEED_EXCLUDED_TABLES = /* @__PURE__ */ new Set([
 /**
 * Whether framework writes to `tableName` are recorded in the change feed.
 *
+* Two reasons a table is not observable: it is framework bookkeeping
+* ({@link CHANGE_FEED_EXCLUDED_TABLES}), or it is credential-bearing
+* ({@link isChangeFeedSensitiveTable}, #2937). The second is evaluated live
+* rather than folded into the frozen set above, because a class declaring
+* `@smrt({ sensitive: true })` registers after this module loads.
+*
 * Exported so tooling and tests can reason about feed coverage without
-* re-deriving the rule. See {@link CHANGE_FEED_EXCLUDED_TABLES}.
+* re-deriving the rule.
 */
 function isChangeFeedObservableTable(tableName) {
-	return Boolean(tableName) && !CHANGE_FEED_EXCLUDED_TABLES.has(tableName);
+	return Boolean(tableName) && !CHANGE_FEED_EXCLUDED_TABLES.has(tableName) && !isChangeFeedSensitiveTable(tableName);
 }
 /** Interceptor name of the framework's change-feed writer. */
 var CHANGE_FEED_INTERCEPTOR_NAME = "smrt-change-feed";
@@ -471,6 +484,7 @@ async function appendChange(db, input) {
 	if (!table) throw new Error("appendChange requires a non-empty table name");
 	const operation = input.operation ?? "update";
 	if (!VALID_OPERATIONS.has(operation)) throw new Error(`appendChange operation must be one of create/update/delete, got '${String(input.operation)}'`);
+	if (isChangeFeedSensitiveTable(table)) return null;
 	const engine = getEngine(db);
 	const p = placeholders(db);
 	const sql = engine === "postgres" ? `SELECT allocated_seq, error_code, error_message FROM ${POSTGRES_CHANGE_FEED_APPEND_FUNCTION_NAME}(${p(1)}, ${p(2)}, ${p(3)}, ${p(4)}, ${p(5)})` : `INSERT INTO ${CHANGE_FEED_TABLE} (seq, table_name, row_id, operation, tenant_id, created_at) SELECT COALESCE(MAX(seq), 0) + 1, ${p(1)}, ${p(2)}, ${p(3)}, ${p(4)}, ${p(5)} FROM ${CHANGE_FEED_TABLE} RETURNING seq`;
@@ -536,13 +550,42 @@ async function appendChange(db, input) {
 * entry, preserves rollback/failure isolation, and never waits on the feed
 * head.  Direct batches allocate contiguous sequences in input order.
 */
+/**
+* Validate one {@link appendChanges} entry, returning its normalized table and
+* operation. Shared by the sensitive-entry filter and the batch builder so both
+* apply exactly the same rules (#2937).
+*/
+function validateAppendChangesInput(input) {
+	const table = input.table?.trim();
+	if (!table) throw new Error("appendChanges requires a non-empty table name");
+	const operation = input.operation ?? "update";
+	if (!VALID_OPERATIONS.has(operation)) throw new Error(`appendChanges operation must be one of create/update/delete, got '${String(input.operation)}'`);
+	return {
+		table,
+		operation
+	};
+}
 async function appendChanges(db, inputs) {
 	if (inputs.length === 0) return [];
+	if (inputs.some((input) => isChangeFeedSensitiveTable(input.table?.trim()))) {
+		for (const input of inputs) validateAppendChangesInput(input);
+		const kept = [];
+		inputs.forEach((input, index) => {
+			if (!isChangeFeedSensitiveTable(input.table?.trim())) kept.push({
+				input,
+				index
+			});
+		});
+		const result = Array(inputs.length).fill(null);
+		if (kept.length === 0) return result;
+		const sequences = await appendChanges(db, kept.map(({ input }) => input));
+		kept.forEach(({ index }, position) => {
+			result[index] = sequences[position] ?? null;
+		});
+		return result;
+	}
 	const entries = inputs.map((input) => {
-		const table = input.table?.trim();
-		if (!table) throw new Error("appendChanges requires a non-empty table name");
-		const operation = input.operation ?? "update";
-		if (!VALID_OPERATIONS.has(operation)) throw new Error(`appendChanges operation must be one of create/update/delete, got '${String(input.operation)}'`);
+		const { table, operation } = validateAppendChangesInput(input);
 		return {
 			table,
 			rowId: input.rowId ?? null,
@@ -897,10 +940,18 @@ async function getChangesSince(db, options) {
 	params.push(since);
 	conditions.push(`seq <= ${next()}`);
 	params.push(servedHorizon);
-	const tables = options.tables?.filter((table) => table.trim().length > 0);
+	const tables = options.tables?.filter((table) => table.trim().length > 0).filter((table) => !isChangeFeedSensitiveTable(table.trim()));
 	if (tables && tables.length > 0) {
 		conditions.push(`table_name IN (${tables.map(() => next()).join(", ")})`);
 		params.push(...tables);
+	} else if (options.tables && options.tables.length > 0) return {
+		changes: [],
+		cursor: servedHorizon
+	};
+	const sensitiveTables = getChangeFeedSensitiveTables();
+	if (sensitiveTables.length > 0) {
+		conditions.push(`table_name NOT IN (${sensitiveTables.map(() => next()).join(", ")})`);
+		params.push(...sensitiveTables);
 	}
 	if (options.tenantId === null) conditions.push("tenant_id IS NULL");
 	else if (typeof options.tenantId === "string") {
@@ -909,10 +960,10 @@ async function getChangesSince(db, options) {
 	}
 	const sql = `SELECT seq, table_name, row_id, operation, tenant_id, created_at FROM ${CHANGE_FEED_TABLE} WHERE ${conditions.join(" AND ")} ORDER BY seq ASC LIMIT ${next()}`;
 	params.push(limit);
-	const changes = getQueryRows(await db.query(sql, ...params)).map(rowToEntry);
+	const entries = getQueryRows(await db.query(sql, ...params)).map(rowToEntry);
 	return {
-		changes,
-		cursor: changes.length === limit ? changes[changes.length - 1].seq : servedHorizon
+		changes: entries.filter((entry) => !isChangeFeedSensitiveTable(entry.table)),
+		cursor: entries.length === limit ? entries[entries.length - 1].seq : servedHorizon
 	};
 }
 /**
@@ -975,12 +1026,38 @@ async function getTenantScopedChangesSince(db, options) {
 * high-water mark that survives pruning would remove even that cost; it is a
 * deliberate follow-up, out of scope for this slice.
 *
+* ## Tables the feed does not observe (#2937)
+*
+* The whole contract above — "any write to the table appends a new sequence
+* strictly greater than every previously-observed value" — rests on the table
+* being recorded at all. For a credential-bearing table it is not, so there is
+* no version to compute: the value would pin at whatever an older build last
+* wrote, then fall back to the global horizon, which only moves when some
+* *other* table writes. A client revalidating with `If-None-Match` would be
+* answered `304` for a revoked API key, a rotated session or a changed
+* identity, and stay stale until unrelated traffic happened to bump the
+* horizon — a silent stale read of security state.
+*
+* Such a table therefore gets a deliberately **unrepeatable** value, so every
+* ETag derived from it is fresh and no *concrete* `If-None-Match` can match.
+* Those reads cost a full response every time, which is the correct trade for
+* a credential store, and the caller needs no special case: this is the one
+* place every ETag path (the runtime `APIGenerator`, the generated SvelteKit
+* `conditionalVersionedRead`, and route files already emitted by an older
+* generator) goes through.
+*
+* A wildcard `If-None-Match: *` still yields `304`, and deliberately so: the
+* read paths evaluate it only *after* the payload is built, so it distinguishes
+* nothing beyond 200-versus-404 — which an unconditional request reveals too —
+* and it carries no stale representation.
+*
 * Idempotently ensures the feed table exists first, so it is safe to call from
 * a read route on a raw handle that has never been written to.
 */
 async function getTableVersion(db, table) {
 	const name = table?.trim();
 	if (!name) throw new Error("getTableVersion requires a non-empty table name");
+	if (!isChangeFeedObservableTable(name)) return randomUnobservableTableVersion();
 	await ensureChangeFeedTable(db);
 	const p = placeholders(db);
 	const row = getQueryRows(await db.query(getEngine(db) === "postgres" ? `SELECT
@@ -995,6 +1072,15 @@ async function getTableVersion(db, table) {
 	if (tableVersion != null) return toSeqNumber(tableVersion) + staged;
 	return toSeqNumber(row?.horizon) + staged;
 }
+/**
+* A fresh, effectively-unique version for a table the feed does not observe
+* (#2937). 48 bits keeps it inside `Number.MAX_SAFE_INTEGER` so it round-trips
+* through the same numeric ETag path as a real sequence.
+*/
+function randomUnobservableTableVersion() {
+	const bytes = randomBytes(6);
+	return bytes[0] * 2 ** 40 + bytes[1] * 2 ** 32 + bytes[2] * 2 ** 24 + bytes[3] * 2 ** 16 + bytes[4] * 2 ** 8 + bytes[5];
+}
 function toSeqNumber(value) {
 	return toSafeInteger(value ?? 0, "Change-feed sequence");
 }
@@ -1046,18 +1132,46 @@ async function pruneChangeFeed(db, retention) {
 	if (horizon === 0) return { pruned: 0 };
 	let pruned = 0;
 	let prunedThrough = 0;
+	const sensitiveTables = getChangeFeedSensitiveTables();
+	if (sensitiveTables.length > 0) pruned += await deleteCounted(db, `seq < ${p(1)} AND table_name IN (${sensitiveTables.map((_, offset) => p(offset + 2)).join(", ")})`, [horizon, ...sensitiveTables], dryRun);
+	/**
+	* Under `dryRun` nothing was actually deleted, so the bounds below would
+	* count the sensitive rows the purge already reported. Append an exclusion to
+	* their predicates in that mode only — after a real delete the rows are gone
+	* and the extra clause would be dead weight. `offset` is the number of
+	* placeholders the caller's own predicate already consumed, so the numbered
+	* dialects stay aligned.
+	*/
+	const excludeSensitive = (offset) => {
+		if (!dryRun || sensitiveTables.length === 0) return {
+			sql: "",
+			params: []
+		};
+		return {
+			sql: ` AND table_name NOT IN (${sensitiveTables.map((_, index) => p(offset + index + 1)).join(", ")})`,
+			params: [...sensitiveTables]
+		};
+	};
 	if (maxRows != null) {
 		const pruneThrough = Math.min(horizon - Math.floor(maxRows), horizon - 1);
 		if (pruneThrough > 0) {
 			prunedThrough = pruneThrough;
-			pruned += await deleteCounted(db, `seq <= ${p(1)}`, [pruneThrough], dryRun);
+			const exclusion = excludeSensitive(1);
+			pruned += await deleteCounted(db, `seq <= ${p(1)}${exclusion.sql}`, [pruneThrough, ...exclusion.params], dryRun);
 		}
 	}
 	if (maxAgeMs != null) {
 		const cutoff = new Date(Date.now() - maxAgeMs).toISOString();
 		const firstRetained = toSeqNumber(getQueryRows(await db.query(`SELECT MIN(seq) AS first_retained FROM ${CHANGE_FEED_TABLE} WHERE created_at >= ${p(1)}`, cutoff))[0]?.first_retained);
 		const ageThrough = Math.min(firstRetained > 0 ? firstRetained - 1 : horizon - 1, horizon - 1);
-		if (ageThrough > prunedThrough) pruned += await deleteCounted(db, `seq <= ${p(1)} AND seq > ${p(2)}`, [ageThrough, prunedThrough], dryRun);
+		if (ageThrough > prunedThrough) {
+			const exclusion = excludeSensitive(2);
+			pruned += await deleteCounted(db, `seq <= ${p(1)} AND seq > ${p(2)}${exclusion.sql}`, [
+				ageThrough,
+				prunedThrough,
+				...exclusion.params
+			], dryRun);
+		}
 	}
 	return { pruned };
 }
@@ -1140,6 +1254,7 @@ async function appendForInstance(instance, operation) {
 	try {
 		table = instance.tableName;
 		if (!isChangeFeedObservableTable(table)) return;
+		if (isChangeFeedSensitiveWrite(table, instance.constructor)) return;
 		db = instance.db;
 	} catch {
 		return;
@@ -1182,6 +1297,7 @@ async function recordInstanceChanges(entries) {
 	for (const entry of entries) try {
 		const table = entry.instance.tableName;
 		if (!isChangeFeedObservableTable(table)) continue;
+		if (isChangeFeedSensitiveWrite(table, entry.instance.constructor)) continue;
 		const id = entry.instance.id;
 		const tenantId = entry.instance.tenantId;
 		prepared.push({