@korajs/server 1.0.0-beta.10 → 1.0.0-beta.11

package/dist/index.cjs

@@ -169,6 +169,7 @@ var index_exports = {};
 __export(index_exports, {
   AwarenessRelay: () => AwarenessRelay,
   ClientSession: () => ClientSession,
+  DEFAULT_MAX_SCOPE_PREDICATE_VALUES: () => DEFAULT_MAX_SCOPE_PREDICATE_VALUES,
   HttpServerTransport: () => HttpServerTransport,
   KoraAuthProvider: () => KoraAuthProvider,
   KoraSyncServer: () => KoraSyncServer,
@@ -188,7 +189,9 @@ __export(index_exports, {
   createProductionServer: () => createProductionServer,
   createSilentLogger: () => createSilentLogger,
   createSqliteServerStore: () => createSqliteServerStore,
-  isRetriableRejection: () => isRetriableRejection
+  isRetriableRejection: () => isRetriableRejection,
+  normalizeScopeMap: () => normalizeScopeMap,
+  operationMatchesScopes: () => operationMatchesScopes
 });
 module.exports = __toCommonJS(index_exports);
 init_cjs_shims();
@@ -2725,6 +2728,39 @@ function mergeScopeMaps(base, overlay, source) {
 
 // src/scopes/server-scope-filter.ts
 init_cjs_shims();
+var DEFAULT_MAX_SCOPE_PREDICATE_VALUES = 100;
+function normalizeScopeMap(scopes, maxValues = DEFAULT_MAX_SCOPE_PREDICATE_VALUES) {
+  const normalized = {};
+  for (const collection of Object.keys(scopes).sort()) {
+    const predicate = {};
+    for (const field of Object.keys(scopes[collection] ?? {}).sort()) {
+      const expected = scopes[collection]?.[field];
+      if (expected && typeof expected === "object" && !Array.isArray(expected) && "$in" in expected) {
+        const values = expected.$in;
+        if (!Array.isArray(values))
+          throw new Error(`Invalid $in predicate for ${collection}.${field}`);
+        const unique = [...new Map(values.map((value) => [stableValueKey(value), value])).values()];
+        if (unique.length > maxValues)
+          throw new Error(
+            `Scope predicate for ${collection}.${field} exceeds the ${maxValues}-value limit`
+          );
+        predicate[field] = {
+          $in: unique.sort((a, b) => stableValueKey(a).localeCompare(stableValueKey(b)))
+        };
+      } else predicate[field] = expected;
+    }
+    normalized[collection] = predicate;
+  }
+  return normalized;
+}
+function stableValueKey(value) {
+  if (Array.isArray(value)) return `[${value.map(stableValueKey).join(",")}]`;
+  if (value && typeof value === "object")
+    return `{${Object.keys(value).sort().map(
+      (key) => `${JSON.stringify(key)}:${stableValueKey(value[key])}`
+    ).join(",")}}`;
+  return JSON.stringify(value);
+}
 function operationMatchesScopes(op, scopes, fullRecord) {
   if (!scopes) return true;
   const collectionScope = scopes[op.collection];
@@ -2733,12 +2769,19 @@ function operationMatchesScopes(op, scopes, fullRecord) {
   const snapshot = buildSnapshot(op, fullRecord);
   if (!snapshot) return false;
   for (const [field, expected] of Object.entries(collectionScope)) {
-    if (snapshot[field] !== expected) {
+    if (!matchesPredicate(snapshot[field], expected)) {
       return false;
     }
   }
   return true;
 }
+function matchesPredicate(actual, expected) {
+  if (expected && typeof expected === "object" && !Array.isArray(expected) && "$in" in expected) {
+    const values = expected.$in;
+    return Array.isArray(values) && values.some((value) => Object.is(actual, value));
+  }
+  return Object.is(actual, expected);
+}
 function missingScopeFields(op, scopes) {
   if (!scopes) return [];
   const collectionScope = scopes[op.collection];
@@ -2857,7 +2900,8 @@ function stableStringify(value) {
   return JSON.stringify(value);
 }
 function sameScopeMap(a, b) {
-  return stableStringify(a ?? null) === stableStringify(b ?? null);
+  const normalize = (value) => value && typeof value === "object" ? normalizeScopeMap(value) : value;
+  return stableStringify(normalize(a) ?? null) === stableStringify(normalize(b) ?? null);
 }
 var ClientSession = class _ClientSession {
   state = "connected";
@@ -3227,10 +3271,24 @@ var ClientSession = class _ClientSession {
       this.authContext = context;
       this.state = "authenticated";
     }
-    const resolvedScopes = resolveSessionScopes(this.store.getSchema(), {
+    const rawResolvedScopes = resolveSessionScopes(this.store.getSchema(), {
       handshakeScope: msg.syncScope,
       authScopes: this.authContext?.scopes
     });
+    let resolvedScopes;
+    try {
+      resolvedScopes = rawResolvedScopes ? normalizeScopeMap(rawResolvedScopes) : void 0;
+    } catch (error) {
+      this.sendToClient({
+        type: "error",
+        messageId: (0, import_core11.generateUUIDv7)(),
+        code: "SCOPE_PREDICATE_LIMIT",
+        message: error instanceof Error ? error.message : "Invalid scope predicate",
+        retriable: false
+      });
+      this.close("invalid scope predicate");
+      return;
+    }
     if (resolvedScopes) {
       if (this.authContext) {
         this.authContext = { ...this.authContext, scopes: resolvedScopes };
@@ -5727,6 +5785,7 @@ function formatUptime(ms) {
 0 && (module.exports = {
   AwarenessRelay,
   ClientSession,
+  DEFAULT_MAX_SCOPE_PREDICATE_VALUES,
   HttpServerTransport,
   KoraAuthProvider,
   KoraSyncServer,
@@ -5746,6 +5805,8 @@ function formatUptime(ms) {
   createProductionServer,
   createSilentLogger,
   createSqliteServerStore,
-  isRetriableRejection
+  isRetriableRejection,
+  normalizeScopeMap,
+  operationMatchesScopes
 });
 //# sourceMappingURL=index.cjs.map