@jant/core 0.6.16 → 0.7.0

package/src/runtime/cloudflare.ts

@@ -52,6 +52,13 @@ export interface CloudflareRequestRuntime {
 export async function createCloudflareRequestRuntime(
   env: Bindings,
   publicRequestUrl: string,
+  options?: {
+    /**
+     * Anchor this request's first read to the primary instead of any replica.
+     * Set for requests that carry a session cookie — see `createRequestRuntime`.
+     */
+    anchorReadsToPrimary?: boolean;
+  },
 ): Promise<CloudflareRequestRuntime> {
   if (!env.DB) {
     throw new Error("Cloudflare runtime requires a DB binding.");
@@ -62,8 +69,19 @@ export async function createCloudflareRequestRuntime(
     throw new Error("AUTH_SECRET should be set after startup validation.");
   }
 
-  // Use withSession() to enable D1 Read Replication.
-  const session = env.DB.withSession();
+  // Use withSession() to enable D1 Read Replication. The constraint applies to
+  // the session's *first* query; every later query is anchored to the bookmark
+  // that one returns, so the whole request is sequentially consistent.
+  //
+  // Bookmarks are not carried across requests, so an unconstrained first read
+  // may land on a replica that has not caught up yet. For anonymous traffic
+  // that is fine and it is the point of replication. For a request holding a
+  // session cookie it is not: the session row is written on the primary, and a
+  // lagging replica answers "no such session" — the visitor is bounced to
+  // sign-in even though they never signed out.
+  const session = env.DB.withSession(
+    options?.anchorReadsToPrimary ? "first-primary" : "first-unconstrained",
+  );
 
   // Note: Drizzle ORM doesn't officially support D1DatabaseSession yet
   // (issue #2226), but it works at runtime.
@@ -89,6 +107,7 @@ export async function createCloudflareRequestRuntime(
 
   const servicesConfig = {
     databaseDialect: "sqlite" as const,
+    authSecret,
     bootstrapSite: getSingleSiteBootstrapOptions(env),
     enforceHostedMediaQuota: getSiteResolutionMode(env) === "host-based",
     hostedControlPlane: createHostedControlPlaneClient(env),

package/src/runtime/index.ts

@@ -2,13 +2,39 @@ import { createCloudflareRequestRuntime } from "./cloudflare.js";
 import { createNodeRequestRuntime } from "./node.js";
 import type { Bindings } from "../types/bindings.js";
 
+/**
+ * Whether a `Cookie` header carries a better-auth session token.
+ *
+ * Matched on the `.session_token` suffix so it holds for both the plain and
+ * the `__Secure-`-prefixed cookie name. This is a cheap "probably signed in"
+ * hint used to pick a database consistency mode — it does not verify the
+ * cookie's signature, and it must not be used to make an auth decision.
+ *
+ * @param cookieHeader - Raw `Cookie` request header, if any
+ * @returns `true` when a session token cookie appears to be present
+ *
+ * @example
+ * ```ts
+ * hasSessionCookie("__Secure-better-auth.session_token=abc"); // true
+ * hasSessionCookie("theme=dark");                             // false
+ * ```
+ */
+export function hasSessionCookie(
+  cookieHeader: string | null | undefined,
+): boolean {
+  return !!cookieHeader?.includes(".session_token=");
+}
+
 export async function createRequestRuntime(
   env: Bindings,
   publicRequestUrl: string,
+  request?: Request,
 ) {
   if (env.NODE_DATABASE || env.NODE_SQLITE) {
     return createNodeRequestRuntime(env, publicRequestUrl);
   }
 
-  return createCloudflareRequestRuntime(env, publicRequestUrl);
+  return createCloudflareRequestRuntime(env, publicRequestUrl, {
+    anchorReadsToPrimary: hasSessionCookie(request?.headers.get("cookie")),
+  });
 }

package/src/runtime/node.ts

@@ -27,6 +27,7 @@ import {
   getResolvedSiteBaseUrl,
   resolveCliSite,
   resolveRequestSite,
+  type CliSiteSelector,
 } from "./site.js";
 
 export interface NodeRequestRuntime {
@@ -144,6 +145,7 @@ export async function createNodeRequestRuntime(
 
   const servicesConfig = {
     databaseDialect,
+    authSecret,
     bootstrapSite: getSingleSiteBootstrapOptions(env),
     enforceHostedMediaQuota: getSiteResolutionMode(env) === "host-based",
     hostedControlPlane: createHostedControlPlaneClient(env),
@@ -175,9 +177,24 @@ export async function createNodeRequestRuntime(
  * Builds the runtime objects needed by local CLI commands.
  *
  * Unlike the request runtime, this path does not require auth configuration.
+ *
+ * @param env - Bindings with a resolved `NODE_DATABASE` or `NODE_SQLITE`
+ * @param selector - The site the command acts on. Required in host-based
+ *   mode; single-site mode falls back to the instance's one site.
+ * @returns Services, storage and database scoped to that site
+ * @throws {Error} When host-based mode has no selector, or the selector
+ *   matches no site
+ * @example
+ * ```ts
+ * const runtime = await createNodeCliRuntime(bindings, {
+ *   kind: "site",
+ *   idOrKey: "demo",
+ * });
+ * ```
  */
 export async function createNodeCliRuntime(
   env: Bindings,
+  selector: CliSiteSelector | null = null,
 ): Promise<NodeCliRuntime> {
   const nodeDatabase = env.NODE_DATABASE;
   const sqlite = env.NODE_SQLITE;
@@ -194,7 +211,7 @@ export async function createNodeCliRuntime(
 
   const slugIdLength =
     parseInt(getEnvString(env, "SLUG_ID_LENGTH") ?? "5", 10) || 5;
-  const siteLookup = await resolveCliSite(db, env, databaseSchema);
+  const siteLookup = await resolveCliSite(db, env, selector, databaseSchema);
 
   return {
     currentSite: siteLookup.site,

package/src/runtime/site.ts

@@ -17,7 +17,7 @@ import {
   type SiteLookupResult,
   TRANSIENT_SINGLE_SITE_ID,
 } from "../services/site.js";
-import { NotFoundError } from "../lib/errors.js";
+import { NotFoundError, SiteUnavailableError } from "../lib/errors.js";
 import type { Bindings } from "../types/bindings.js";
 
 function logHostedSiteResolutionFailure(input: {
@@ -115,45 +115,116 @@ export async function resolveRequestSite(
       siteKey: resolved.site.key,
       siteStatus: resolved.site.status,
     });
-    throw new NotFoundError("Site");
+    // The host resolved, so the site is real — it is just suspended (hosted
+    // plan ended, or an operator took it down). Serving a 404 here told the
+    // visitor the address was wrong and told crawlers to drop the site, both
+    // of which are false while it can still be restored.
+    throw new SiteUnavailableError();
   }
   return resolved;
 }
 
-export async function resolveCliSite(
+/**
+ * The site a CLI command was told to act on. The `jant` CLI builds it from
+ * `--site <key|id>`, `--host <host>` with `--path-prefix`, or `--url <url>`
+ * (see `parseCliSiteSelector` in `bin/lib/site-selection.js`).
+ */
+export type CliSiteSelector =
+  | { kind: "site"; idOrKey: string }
+  | {
+      kind: "host";
+      host: string;
+      /** The domain's stored prefix (`/blog`), or null for a root domain. */
+      pathPrefix: string | null;
+    };
+
+/**
+ * Printed when a host-based CLI command names no site. Kept word for word with
+ * the raw-SQL resolver the D1 path uses in `bin/lib/site-selection.js`.
+ */
+const HOST_BASED_CLI_SITE_REQUIRED_MESSAGE =
+  "host-based mode needs a target site. Pass --site <key|id>, --host <host>, or --url <url>.";
+
+async function resolveSelectedCliSite(
   db: Database,
-  env: Bindings,
-  databaseSchema: DatabaseSchema = sqliteSchemaBundle,
+  selector: CliSiteSelector,
+  databaseSchema: DatabaseSchema,
 ): Promise<SiteLookupResult> {
   const siteService = createSiteService(db, databaseSchema);
-  const resolutionMode = getSiteResolutionMode(env);
 
-  if (resolutionMode === "single-site") {
-    const resolved = await siteService.resolveSingleSite({
-      ...getSingleSiteBootstrapOptions(env),
-      createIfMissing: false,
-    });
-
-    if (resolved.site.id === TRANSIENT_SINGLE_SITE_ID) {
-      throw new Error(
-        "No site is configured for this instance yet. Finish /setup before running this command.",
-      );
+  if (selector.kind === "site") {
+    const site = await siteService.getByIdOrKey(selector.idOrKey);
+    if (!site) {
+      throw new Error(`No site found for --site ${selector.idOrKey}.`);
     }
+    return {
+      site,
+      domain: await siteService.getPrimaryDomainForSite(site.id),
+    };
+  }
 
-    return resolved;
+  const resolved = await siteService.resolveByHost(
+    selector.host,
+    selector.pathPrefix,
+  );
+  if (!resolved) {
+    throw new Error(
+      `No site found for host "${selector.host}"${selector.pathPrefix ? ` and path prefix "${selector.pathPrefix}"` : ""}.`,
+    );
   }
+  return resolved;
+}
+
+/**
+ * Resolve the site a CLI command acts on.
+ *
+ * A selector wins in either mode. Without one, single-site mode uses the
+ * instance's one site, and host-based mode fails before touching the
+ * database: a hosted database holds every tenant, so there is no default to
+ * fall back to — not even when it happens to hold one site today.
+ *
+ * @param db - The database
+ * @param env - Bindings that carry `SITE_RESOLUTION_MODE` and the single-site
+ *   origin
+ * @param selector - The site the command was told to act on, if any
+ * @param databaseSchema - The schema bundle for the database's dialect
+ * @returns The site and its domain
+ * @throws {Error} When the selector matches no site, when host-based mode has
+ *   no selector, or when single-site mode has not finished setup
+ * @example
+ * ```ts
+ * await resolveCliSite(db, env, { kind: "site", idOrKey: "demo" });
+ * ```
+ */
+export async function resolveCliSite(
+  db: Database,
+  env: Bindings,
+  selector: CliSiteSelector | null = null,
+  databaseSchema: DatabaseSchema = sqliteSchemaBundle,
+): Promise<SiteLookupResult> {
+  if (selector) {
+    return resolveSelectedCliSite(db, selector, databaseSchema);
+  }
+
+  if (getSiteResolutionMode(env) === "host-based") {
+    throw new Error(HOST_BASED_CLI_SITE_REQUIRED_MESSAGE);
+  }
+
+  const resolved = await createSiteService(
+    db,
+    databaseSchema,
+  ).resolveSingleSite({
+    ...getSingleSiteBootstrapOptions(env),
+    createIfMissing: false,
+  });
 
-  const onlySite = await siteService.getOnlySite();
-  if (!onlySite) {
+  if (resolved.site.id === TRANSIENT_SINGLE_SITE_ID) {
     throw new Error(
-      "CLI site selection for host-based mode is not implemented yet.",
+      "No site is configured for this instance yet. Finish /setup before running this command.",
     );
   }
 
-  return {
-    site: onlySite,
-    domain: null,
-  };
+  return resolved;
 }
 
 export function getResolvedSiteBaseUrl(

package/src/services/__tests__/auth.test.ts

@@ -18,6 +18,7 @@ import {
   siteDomains,
   siteMembers,
   sites,
+  smartCollections,
   user,
   verification,
 } from "../../db/schema.js";
@@ -172,6 +173,56 @@ describe("AuthService", () => {
       createdAt: timestamp,
     });
 
+    // A smart collection that filters *by* the collection above, with every row
+    // that hangs off it. This is the shape a factory reset used to die on: the
+    // condition column once carried `ON DELETE restrict`, so clearing
+    // `collection` threw halfway through a reset that runs without a
+    // transaction on SQLite and D1, leaving a half-erased site behind.
+    await db.insert(smartCollections).values({
+      id: "smc_01km9authdelete00000000000",
+      siteId: DEFAULT_TEST_SITE_ID,
+      title: "Untitled notes",
+      collectionId: "col_01km9authdelete00000000000",
+      format: "note",
+      hasTitle: false,
+      sort: "newest",
+      createdAt: timestamp,
+      updatedAt: timestamp,
+    });
+
+    await db.insert(pathRegistry).values({
+      id: "pth_01km9authsmart0000000000000",
+      siteId: DEFAULT_TEST_SITE_ID,
+      path: "untitled-notes",
+      kind: "slug",
+      smartCollectionId: "smc_01km9authdelete00000000000",
+      createdAt: timestamp,
+      updatedAt: timestamp,
+    });
+
+    await db.insert(collectionDirectoryItems).values({
+      id: "cdi_01km9authsmart0000000000000",
+      siteId: DEFAULT_TEST_SITE_ID,
+      type: "smart_collection",
+      smartCollectionId: "smc_01km9authdelete00000000000",
+      label: null,
+      position: "a1",
+      createdAt: timestamp,
+      updatedAt: timestamp,
+    });
+
+    await db.insert(navItems).values({
+      id: "nav_01km9authsmart0000000000000",
+      siteId: DEFAULT_TEST_SITE_ID,
+      type: "smart_collection",
+      smartCollectionId: "smc_01km9authdelete00000000000",
+      label: "",
+      url: "/untitled-notes",
+      position: "a1",
+      createdAt: timestamp,
+      updatedAt: timestamp,
+    });
+
     await db.insert(navItems).values({
       id: "nav_01km9authdelete00000000000",
       siteId: DEFAULT_TEST_SITE_ID,
@@ -241,6 +292,9 @@ describe("AuthService", () => {
       const remainingPosts = await db.select().from(posts);
       const remainingMedia = await db.select().from(media);
       const remainingCollections = await db.select().from(collections);
+      const remainingSmartCollections = await db
+        .select()
+        .from(smartCollections);
       const remainingPaths = await db.select().from(pathRegistry);
       const remainingDirectoryItems = await db
         .select()
@@ -262,6 +316,7 @@ describe("AuthService", () => {
       expect(remainingPosts).toHaveLength(0);
       expect(remainingMedia).toHaveLength(0);
       expect(remainingCollections).toHaveLength(0);
+      expect(remainingSmartCollections).toHaveLength(0);
       expect(remainingPaths).toHaveLength(0);
       expect(remainingDirectoryItems).toHaveLength(0);
       expect(remainingThreadCollections).toHaveLength(0);
@@ -287,12 +342,16 @@ describe("AuthService", () => {
       const remainingSiteMembers = await db.select().from(siteMembers);
       const remainingUsers = await db.select().from(user);
       const remainingPosts = await db.select().from(posts);
+      const remainingSmartCollections = await db
+        .select()
+        .from(smartCollections);
       const remainingSettings = await db.select().from(settingsTable);
       const existingSites = await db.select().from(sites);
       const existingSiteDomains = await db.select().from(siteDomains);
       expect(remainingSiteMembers).toHaveLength(0);
       expect(remainingUsers).toHaveLength(0);
       expect(remainingPosts).toHaveLength(0);
+      expect(remainingSmartCollections).toHaveLength(0);
       expect(remainingSettings).toHaveLength(0);
       expect(existingSites).toHaveLength(0);
       expect(existingSiteDomains).toHaveLength(0);
@@ -305,22 +364,72 @@ describe("AuthService", () => {
       db = testDb.db as unknown as Database;
     });
 
-    it("validates delete CSRF tokens in Node runtimes", async () => {
+    function createTokenService(authSecret = "test-auth-secret") {
       const settingsService = createSettingsService(db, DEFAULT_TEST_SITE_ID);
-      const authService = createAuthService(db, settingsService, {
+      return createAuthService(db, settingsService, {
         databaseDialect: "pg",
+        authSecret,
       });
+    }
+
+    it("validates delete CSRF tokens in Node runtimes", async () => {
+      const authService = createTokenService();
 
-      const token = await authService.generateDeleteCsrfToken();
+      const token = await authService.generateDeleteCsrfToken("ses_1");
 
-      await expect(authService.validateDeleteCsrfToken(token)).resolves.toBe(
-        true,
-      );
       await expect(
-        authService.validateDeleteCsrfToken(`${token}nope`),
+        authService.validateDeleteCsrfToken(token, "ses_1"),
+      ).resolves.toBe(true);
+      await expect(
+        authService.validateDeleteCsrfToken(`${token}nope`, "ses_1"),
       ).resolves.toBe(false);
     });
 
+    it("issues the same delete token however often a session asks", async () => {
+      // Rendering the delete page is a GET. Issuing twice must not invalidate
+      // the copy already sitting in an open tab — that turned any prefetch or
+      // browser extension re-fetching the page into a dead delete button.
+      const authService = createTokenService();
+
+      const first = await authService.generateDeleteCsrfToken("ses_1");
+      const second = await authService.generateDeleteCsrfToken("ses_1");
+
+      expect(second).toBe(first);
+      await expect(
+        authService.validateDeleteCsrfToken(first, "ses_1"),
+      ).resolves.toBe(true);
+    });
+
+    it("refuses a delete token minted for another session", async () => {
+      const authService = createTokenService();
+
+      const token = await authService.generateDeleteCsrfToken("ses_1");
+
+      await expect(
+        authService.validateDeleteCsrfToken(token, "ses_2"),
+      ).resolves.toBe(false);
+    });
+
+    it("refuses a delete token minted under another signing key", async () => {
+      const token =
+        await createTokenService("secret-a").generateDeleteCsrfToken("ses_1");
+
+      await expect(
+        createTokenService("secret-b").validateDeleteCsrfToken(token, "ses_1"),
+      ).resolves.toBe(false);
+    });
+
+    it("refuses to mint a delete token without a signing key", async () => {
+      const settingsService = createSettingsService(db, DEFAULT_TEST_SITE_ID);
+      const authService = createAuthService(db, settingsService, {
+        databaseDialect: "pg",
+      });
+
+      await expect(
+        authService.generateDeleteCsrfToken("ses_1"),
+      ).rejects.toThrow(/AUTH_SECRET/);
+    });
+
     it("validates password reset tokens in Node runtimes", async () => {
       const settingsService = createSettingsService(db, DEFAULT_TEST_SITE_ID);
       const authService = createAuthService(db, settingsService, {

package/src/services/__tests__/collection.test.ts

@@ -267,6 +267,102 @@ describe("CollectionService", () => {
   });
 
   describe("listDirectoryData", () => {
+    it("counts only what this reader can see", async () => {
+      const reading = await collectionService.create({
+        slug: "reading",
+        title: "Reading",
+      });
+
+      const published = await postService.create({
+        format: "note",
+        bodyMarkdown: "Published",
+      });
+      const draft = await postService.create({
+        format: "note",
+        bodyMarkdown: "Draft",
+        status: "draft",
+      });
+      const secret = await postService.create({
+        format: "note",
+        bodyMarkdown: "Private",
+        visibility: "private",
+      });
+      for (const post of [published, draft, secret]) {
+        await collectionService.addThread(reading.id, post.id);
+      }
+
+      // A stranger who could subtract the directory's number from the
+      // collection page's would learn how much unpublished work is in here.
+      const anonymous = await collectionService.listDirectoryData({
+        isAuthenticated: false,
+      });
+      expect(anonymous.collections[0]?.threadCount).toBe(1);
+      expect(anonymous.collections[0]?.recentActivityAt).toBe(
+        published.lastActivityAt,
+      );
+
+      const author = await collectionService.listDirectoryData({
+        isAuthenticated: true,
+      });
+      expect(author.collections[0]?.threadCount).toBe(2);
+    });
+
+    it("counts a Thread once, whichever of its posts matched", async () => {
+      const reading = await collectionService.create({
+        slug: "reading",
+        title: "Reading",
+      });
+      const root = await postService.create({
+        format: "note",
+        bodyMarkdown: "Root",
+      });
+      await postService.create({
+        format: "note",
+        bodyMarkdown: "Reply",
+        replyToId: root.id,
+      });
+      await collectionService.addThread(reading.id, root.id);
+
+      const directory = await collectionService.listDirectoryData({
+        isAuthenticated: false,
+      });
+      expect(directory.collections[0]?.threadCount).toBe(1);
+    });
+
+    it("narrows counts to the view's language", async () => {
+      const reading = await collectionService.create({
+        slug: "reading",
+        title: "Reading",
+      });
+      const english = await postService.create({
+        format: "note",
+        bodyMarkdown: "English",
+        language: "en",
+      });
+      const japanese = await postService.create({
+        format: "note",
+        bodyMarkdown: "Japanese",
+        language: "ja",
+      });
+      for (const post of [english, japanese]) {
+        await collectionService.addThread(reading.id, post.id);
+      }
+
+      const englishView = await collectionService.listDirectoryData({
+        isAuthenticated: false,
+        lang: "en",
+      });
+      expect(englishView.collections[0]?.threadCount).toBe(1);
+
+      // The row itself stays listed in every view — only its number narrows.
+      const japaneseView = await collectionService.listDirectoryData({
+        isAuthenticated: false,
+        lang: "ja",
+      });
+      expect(japaneseView.collections).toHaveLength(1);
+      expect(japaneseView.collections[0]?.threadCount).toBe(1);
+    });
+
     it("returns collections with recent activity and labeled dividers", async () => {
       const reading = await collectionService.create({
         slug: "reading",
@@ -283,7 +379,9 @@ describe("CollectionService", () => {
       });
       await collectionService.addThread(reading.id, post.id);
 
-      const directory = await collectionService.listDirectoryData();
+      const directory = await collectionService.listDirectoryData({
+        isAuthenticated: false,
+      });
 
       expect(directory.collections).toHaveLength(1);
       expect(directory.collections[0]?.recentActivityAt).toBe(
@@ -329,7 +427,9 @@ describe("CollectionService", () => {
         vi.setSystemTime(new Date("2024-01-01T00:01:00Z"));
         await postService.update(root.id, { bodyMarkdown: "after" });
 
-        const directory = await collectionService.listDirectoryData();
+        const directory = await collectionService.listDirectoryData({
+          isAuthenticated: false,
+        });
         expect(directory.collections[0]?.recentActivityAt).toBe(1704067200);
       } finally {
         vi.useRealTimers();
@@ -357,7 +457,9 @@ describe("CollectionService", () => {
           replyToId: root.id,
         });
 
-        const directory = await collectionService.listDirectoryData();
+        const directory = await collectionService.listDirectoryData({
+          isAuthenticated: false,
+        });
         expect(directory.collections[0]?.recentActivityAt).toBe(1704067260);
       } finally {
         vi.useRealTimers();
@@ -371,7 +473,9 @@ describe("CollectionService", () => {
         url: "/archive?format=quote",
       });
 
-      const directory = await collectionService.listDirectoryData();
+      const directory = await collectionService.listDirectoryData({
+        isAuthenticated: false,
+      });
 
       expect(directory.directoryItems).toContainEqual(
         expect.objectContaining({