@mmmbuto/nexuscrew 0.9.56 → 0.9.58

package/lib/notify/event-feed-client.js

@@ -14,6 +14,7 @@
 const BACKOFF_MIN_MS = 5000;
 const BACKOFF_MAX_MS = 60000;
 const IDLE_TIMEOUT_MS = 60000;
+const ERROR_BODY_TIMEOUT_MS = 5000;
 const MAX_CONSECUTIVE_RESETS = 3;
 // `resync-exhausted` ferma il loop ma non deve parcheggiare la view
 // per sempre. Al tappo la view prende un cooldown a gradini — 30 s → 2 min →
@@ -68,6 +69,12 @@ function contentTypeOf(r) {
   }
 }
 
+function isNamedFeedReason(reason) {
+  return ['shape', 'owner-mismatch', 'snapshot-oversize', 'snapshot-element-oversize',
+    'snapshot-resync-required', 'snapshot-content-type'].includes(reason)
+    || (typeof reason === 'string' && reason.startsWith('snapshot-schema:'));
+}
+
 function createEventFeedClient(opts = {}) {
   // deps: { nodesPath, token(), eventsHub, now, fetchImpl, log }
   const fetchImpl = opts.fetchImpl || fetch;
@@ -86,9 +93,40 @@ function createEventFeedClient(opts = {}) {
   let stopped = false;
   let generation = 0;
 
-  function backoffMs(peer) {
-    const fails = (peer._fails || 0) + 1;
-    peer._fails = fails;
+  const retries = new Map(); // ownerId -> persistent retry state
+  const configurations = new Map();
+  function retryFor(ownerId) {
+    if (!retries.has(ownerId)) retries.set(ownerId, { fails: 0, nextRetryAt: 0, timer: null });
+    return retries.get(ownerId);
+  }
+  function clearRetry(ownerId, reset = false) {
+    const retry = retries.get(ownerId);
+    if (!retry) return;
+    if (retry.timer) clearTimeout(retry.timer);
+    retry.timer = null;
+    if (reset) { retry.fails = 0; retry.nextRetryAt = 0; }
+  }
+  function active(ownerId, slot) {
+    return !stopped && running.get(ownerId) === slot && !slot.controller.signal.aborted;
+  }
+  async function withDeadline(slot, milliseconds, operation) {
+    const controller = slot ? slot.controller : new AbortController();
+    const signal = controller.signal;
+    let rejectAbort;
+    const aborted = new Promise((_resolve, reject) => { rejectAbort = () => reject(new Error('acquisition aborted')); });
+    signal.addEventListener('abort', rejectAbort, { once: true });
+    const timer = setTimeout(() => controller.abort(), milliseconds);
+    try {
+      if (signal.aborted) throw new Error('acquisition aborted');
+      return await Promise.race([operation(signal), aborted]);
+    } finally {
+      clearTimeout(timer);
+      signal.removeEventListener('abort', rejectAbort);
+    }
+  }
+  function backoffMs(ownerId) {
+    const retry = retryFor(ownerId);
+    const fails = ++retry.fails;
     const base = Math.min(BACKOFF_MAX_MS, BACKOFF_MIN_MS * Math.pow(2, fails - 1));
     return Math.floor(base / 2 + Math.random() * (base / 2));
   }
@@ -296,7 +334,7 @@ function createEventFeedClient(opts = {}) {
     return Math.max(oldest + INGRESS_WINDOW_MS, t) + INGRESS_BLOCK_BACKOFF_MS;
   }
 
-  async function streamOnce(peer, ownerId, store) {
+  async function streamOnce(peer, ownerId, store, slot) {
     const view = viewFor(ownerId);
     // The deadline expired: the peer is admitted again and the block is closed
     // by the transition that reopens the stream, not by a silent timeout.
@@ -305,15 +343,16 @@ function createEventFeedClient(opts = {}) {
       view.ingressBlockReason = null;
     }
     const after = view.cursor ? `?after=${encodeURIComponent(view.cursor)}` : '';
-    const ctrl = new AbortController();
-    running.set(ownerId, { abort: () => ctrl.abort() });
-    let timer = setTimeout(() => ctrl.abort(), IDLE_TIMEOUT_MS); // 60 s without bytes
+    const ctrl = slot.controller;
     try {
-      const r = await fetchImpl(routeUrl(peer, '/event-feed', after), {
-        headers: identityHeaders(peer, store), signal: ctrl.signal,
-      });
-      if (r.status === 403 && (await r.json().catch(() => ({}))).reason === 'events-disabled') {
-        view.stale = true; return;
+      const r = await withDeadline(slot, IDLE_TIMEOUT_MS, (signal) => fetchImpl(routeUrl(peer, '/event-feed', after), {
+        headers: identityHeaders(peer, store), signal,
+      }));
+      if (!active(ownerId, slot)) return;
+      if (r.status === 403) {
+        const body = await withDeadline(slot, ERROR_BODY_TIMEOUT_MS, () => r.json().catch(() => ({})));
+        if (!active(ownerId, slot)) return;
+        if (body.reason === 'events-disabled') { view.stale = true; return; }
       }
       if (r.status === 409) { // reset-required / cursor-future: resync from a fresh snapshot
         view.cursor = null;
@@ -321,17 +360,15 @@ function createEventFeedClient(opts = {}) {
         return;
       }
       if (!r.ok) { view.stale = true; throw new Error(`event-feed HTTP ${r.status}`); }
-      peer._fails = 0;
+      if (!active(ownerId, slot)) return;
       const reader = r.body.getReader();
       const dec = new TextDecoder();
       let buffer = '';
       for (;;) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        // ONE idle timer, rearmed on every chunk: a stale armed timeout must
-        // never survive next to a new one.
-        clearTimeout(timer);
-        timer = setTimeout(() => ctrl.abort(), IDLE_TIMEOUT_MS);
+        const { done, value } = await withDeadline(slot, IDLE_TIMEOUT_MS, () => reader.read());
+        if (!active(ownerId, slot)) return;
+        if (done) throw new Error('event-feed EOF');
+        // Each read owns one deadline; no previous timeout survives the chunk.
         const chunk = dec.decode(value, { stream: true });
         buffer += chunk;
         let idx;
@@ -376,35 +413,42 @@ function createEventFeedClient(opts = {}) {
           view.consecutiveResets = 0; // a usable frame: the streak is over
           view.resyncExhaustions = 0; // and a working stream: the cooldown ladder back to the first step
           view.cursor = `${epochStr}:${sStr}`;
+          clearRetry(ownerId, true);
           reemit(envelope);
         }
       }
     } finally {
-      clearTimeout(timer);
-      running.delete(ownerId);
+      // The acquisition slot owns the connection throughout its lifecycle.
+      ctrl.abort();
     }
   }
 
   // Capability BEFORE subscribing: an owner without the feed capability makes
   // the view unsupported — no fallback, no infinite backoff.
-  async function checkCapability(peer, ownerId) {
+  async function checkCapability(peer, ownerId, slot) {
     const view = viewFor(ownerId);
     if (view.capabilityChecked) return true;
     // The health endpoint of the OWNER is probed directly (same pattern as
     // the tunnel health probe): /federation/health with the peer's token.
-    const r = await fetchImpl(`http://127.0.0.1:${peer.localPort}/federation/health`, {
-      headers: { authorization: `Bearer ${peer.token}` },
+    const body = await withDeadline(slot, 5000, async (signal) => {
+      const r = await fetchImpl(`http://127.0.0.1:${peer.localPort}/federation/health`, {
+        headers: { authorization: `Bearer ${peer.token}` }, signal,
+      });
+      if (!r.ok) throw new Error(`health HTTP ${r.status}`);
+      return r.json();
     });
-    if (!r.ok) { view.stale = true; throw new Error(`health HTTP ${r.status}`); }
-    const body = await r.json();
+    if (!active(ownerId, slot)) throw new Error('obsolete acquisition');
     if (body.eventFeedV1 !== true || body.instanceId !== ownerId) {
       view.unsupported = true;
       view.lastError = 'event-feed-unsupported';
+      view.capabilityRecheckAt = now() + BACKOFF_MAX_MS;
       // One transition log, not one per tick: the poll gate keeps this
       // owner out from here on.
       log(`event-feed-client: ${ownerId.slice(0, 8)}… no feed capability, subscription refused`);
       return false;
     }
+    view.unsupported = false;
+    view.capabilityRecheckAt = null;
     view.capabilityChecked = true;
     return true;
   }
@@ -518,7 +562,7 @@ function createEventFeedClient(opts = {}) {
   //     vista resta ferma e STALE con la sua causa — ma l'elenco asks torna
   //     comunque alla porta, che è autorizzata a decidere: un campo che la
   //     chiusura non legge non può tenere aperta una card chiusa dall'owner.
-  async function snapshotOnce(peer, ownerId, store, { profile = 'view' } = {}) {
+  async function snapshotOnce(peer, ownerId, store, { profile = 'view', slot = null } = {}) {
     const view = viewFor(ownerId);
     // INVARIANTE (punto d'ingresso, per owner): al massimo uno snapshot per
     // finestra, da qualunque causa di resync. Se la finestra non è trascorsa
@@ -538,14 +582,14 @@ function createEventFeedClient(opts = {}) {
     view.lastSnapshotAt = now();
     view.nextSnapshotAllowedAt = null;
     const gen = generation;
-    const r = await fetchImpl(routeUrl(peer, '/event-feed/snapshot'), {
-      headers: identityHeaders(peer, store),
+    const { r, text } = await withDeadline(slot, 8000, async (signal) => {
+      const r = await fetchImpl(routeUrl(peer, '/event-feed/snapshot'), {
+        headers: identityHeaders(peer, store), signal,
+      });
+      if (!r.ok) throw new Error(`snapshot HTTP ${r.status}`);
+      return { r, text: await r.text() };
     });
-    if (!r.ok) { view.stale = true; throw new Error(`snapshot HTTP ${r.status}`); }
-    // Size cap BEFORE JSON.parse: a body over the server budget is refused on
-    // sight, never parsed. La regola vive nel validatore unico; qui è la
-    // scorciatoia che evita di pagare il parse di un corpo già rifiutato.
-    const text = await r.text();
+    if ((slot && !active(ownerId, slot)) || gen !== generation) throw new Error('obsolete acquisition');
     const bytes = Buffer.byteLength(text, 'utf8');
     if (bytes > 3 * 1024 * 1024) {
       view.stale = true; view.lastError = 'snapshot-oversize';
@@ -576,6 +620,7 @@ function createEventFeedClient(opts = {}) {
       return { state: 'failed' };
     }
     applySnapshot(ownerId, snap, gen);
+    clearRetry(ownerId, true);
     return { state: 'applied', asks: snap.asks, appliedToView: true };
   }
 
@@ -586,15 +631,31 @@ function createEventFeedClient(opts = {}) {
     if (!store) return;
     const peers = (store.nodes || []).filter((n) => n && n.direction === 'outbound'
       && n.eventsReceive === true && n.token && n.localPort && n.nodeId);
+    const eligible = new Map(peers.map((peer) => [peer.nodeId, peer]));
+    const fingerprint = (peer) => JSON.stringify([peer.token, peer.localPort, peer.nodeId, peer.accessGrants, peer.accessPreset]);
+    for (const [ownerId, config] of configurations) {
+      const peer = eligible.get(ownerId);
+      if (!peer || fingerprint(peer) !== config) {
+        const slot = running.get(ownerId);
+        if (slot) { running.delete(ownerId); slot.abort(); }
+        clearRetry(ownerId, true);
+        configurations.delete(ownerId);
+        const view = views.get(ownerId);
+        if (view) { view.cursor = null; view.stale = true; view.capabilityChecked = false; view.unsupported = false; }
+      }
+    }
     await Promise.all(peers.map(async (peer) => {
       const ownerId = peer.nodeId;
+      configurations.set(ownerId, fingerprint(peer));
+      if (now() < retryFor(ownerId).nextRetryAt) return;
       if (running.has(ownerId)) return; // one loop per pair
       // Il guard vale per TUTTO il round, non solo per lo stream: due poll
       // sovrapposti (tick + backoff, o macchina carica) facevano due snapshot
       // nella stessa finestra e il secondo, senza il flag di recupero,
-      // saltava il riarma del cooldown. streamOnce
-      // sovrascrive lo slot col vero handle di abort.
-      const slot = { abort: () => {} };
+      // saltava il riarma del cooldown. Lo stesso controller resta attivo
+      // dalla prima acquisizione fino alla chiusura dello stream.
+      const controller = new AbortController();
+      const slot = { controller, abort: () => controller.abort() };
       running.set(ownerId, slot);
       const view = viewFor(ownerId);
       try {
@@ -619,7 +680,11 @@ function createEventFeedClient(opts = {}) {
           recovery = true;
           log(`event-feed-client: ${ownerId.slice(0, 8)}… resync cooldown expired: one fresh snapshot attempt`);
         }
-        if (view.unsupported || (view.ingressBlockedUntil || 0) > Date.now()) return;
+        if (view.unsupported) {
+          if (now() < view.capabilityRecheckAt) return;
+          view.capabilityChecked = false;
+        }
+        if ((view.ingressBlockedUntil || 0) > Date.now()) return;
         // La fase di ACQUISIZIONE del tentativo (capability + snapshot) ha UN
         // SOLO punto di uscita per gli esiti non riusciti: throw, timeout,
         // abort e 'failed' convergono tutti lì — non un ramo per tipo di
@@ -635,15 +700,16 @@ function createEventFeedClient(opts = {}) {
         let snapState = null; // null = tentativo non fatto (cursor già valido)
         try {
           if (!view.capabilityChecked) {
-            const capOk = await checkCapability(peer, ownerId);
+            const capOk = await checkCapability(peer, ownerId, slot);
             if (!capOk) return; // senza la capability il gate blocca: nessun tentativo fatto
           }
           if (!view.cursor) {
-            snapState = await snapshotOnce(peer, ownerId, store); // profilo view
+            snapState = await snapshotOnce(peer, ownerId, store, { slot }); // profilo view
           }
         } catch (e) {
           attemptError = e;
         }
+        if (stopped || running.get(ownerId) !== slot) return;
         if (attemptError || (snapState && snapState.state === 'failed')) {
           if (recovery) armResyncCooldown(view, attemptError ? 'recovery attempt failed' : 'recovery snapshot failed');
         }
@@ -651,21 +717,27 @@ function createEventFeedClient(opts = {}) {
         // Un tentativo fallito o posticipato ferma il round; NESSUN tentativo
         // (cursor già valido) va dritto allo stream.
         if (snapState && snapState.state !== 'applied') return;
-        await streamOnce(peer, ownerId, store);
+        await streamOnce(peer, ownerId, store, slot);
       } catch (e) {
+        if (stopped || running.get(ownerId) !== slot) return;
+        view.cursor = null;
         view.stale = true;
         // A named feed reason (e.g. owner-mismatch) survives a later transport
         // error: it is the reason the operator needs to see.
-        if (view.lastError !== 'owner-mismatch') {
+        if (!isNamedFeedReason(view.lastError)) {
           view.lastError = String((e && e.message) || e);
         }
-        const delay = backoffMs(peer);
+        const delay = backoffMs(ownerId);
+        const retry = retryFor(ownerId);
+        clearRetry(ownerId);
+        retry.nextRetryAt = now() + delay;
         log(`event-feed-client: ${ownerId.slice(0, 8)}… retry in ${delay} ms (${view.lastError})`);
-        setTimeout(() => { void poll(); }, delay);
+        retry.timer = setTimeout(() => { retry.timer = null; void poll(); }, delay);
+        if (typeof retry.timer.unref === 'function') retry.timer.unref();
       } finally {
-        // Libera lo slot solo se è ancora il NOSTRO: se il round è arrivato a
-        // streamOnce, quello ha già messo (e alla fine tolto) il suo slot vero.
+        // Un round obsoleto non libera mai lo slot della nuova generazione.
         if (running.get(ownerId) === slot) running.delete(ownerId);
+        slot.abort();
       }
     }));
   }
@@ -685,7 +757,9 @@ function createEventFeedClient(opts = {}) {
   function stop() {
     stopped = true; generation += 1;
     if (pollTimer) { clearInterval(pollTimer); pollTimer = null; }
+    for (const ownerId of retries.keys()) clearRetry(ownerId, true);
     for (const [, h] of running) { try { h.abort(); } catch (_) {} }
+    running.clear();
   }
 
   // Local aggregated read: connected views only, with the watermark the UI

package/lib/notify/routes.js

@@ -18,6 +18,7 @@
 // Il paste della risposta riusa ESATTAMENTE pasteToSession (bracketed literal,
 // niente Invio, control char rifiutati): qui si sanifica il testo PRIMA.
 const express = require('express');
+const accessPresets = require('../nodes/access-presets.js');
 const { createAskAnswerService } = require('./ask-answer-service.js');
 // Gli insiemi degli esiti vivono nella coda: il fan-out decide COSA accodare con
 // la stessa definizione con cui la coda decide cosa ritentare. Due copie della
@@ -116,23 +117,33 @@ function replyLabel(cfg) {
 // peer autorizzati di questo nodo. L'enumerazione sta qui e non nel dispatcher
 // perche' il dispatcher conosce solo il target esatto: una wildcard implicita
 // sarebbe un modo per parlare a chi non si e' scelto.
-async function resolveFanTargets(peerTargets, target, self) {
-  if (target !== undefined) return target === self ? [] : [String(target)];
-  if (!peerTargets) return [];
+async function resolveQualifiedFanTargets(peerTargets, target, self, log = () => {}) {
+  if (target === self) return { targets: [], known: true };
+  if (!peerTargets) return { targets: [], known: false };
   let list;
-  try { list = await peerTargets(); } catch (_) { return []; }
-  if (!Array.isArray(list)) return [];
+  try { list = await peerTargets(); } catch (_) { return { targets: [], known: false }; }
+  if (!Array.isArray(list)) return { targets: [], known: false };
   const seen = new Set();
   const out = [];
+  let skipped = 0;
   for (const raw of list) {
     const id = raw && typeof raw === 'object' ? (raw.nodeId || raw.instanceId) : raw;
     const clean = String(id || '');
-    if (!TARGET_RE.test(clean)) continue;
-    if (self && clean === self) continue;
-    if (seen.has(clean)) continue;
-    seen.add(clean); out.push(clean);
+    if (!TARGET_RE.test(clean) || (self && clean === self) || seen.has(clean)) continue;
+    if (target !== undefined && clean !== String(target)) continue;
+    seen.add(clean);
+    // A routed destination is qualified by this node's own direct first hop.
+    const view = accessPresets.grantsOf(raw && typeof raw === 'object' ? (raw.firstHop || raw) : null);
+    if (!view.configured || view.label !== 'admin') { skipped++; continue; }
+    out.push(clean);
   }
-  return out;
+  if (target !== undefined && !seen.has(String(target))) skipped++;
+  if (skipped) { try { log(`ask fan-out skipped: not admin (${skipped})`); } catch (_) {} }
+  return { targets: out, known: true };
+}
+
+async function resolveFanTargets(peerTargets, target, self, log = () => {}) {
+  return (await resolveQualifiedFanTargets(peerTargets, target, self, log)).targets;
 }
 
 // La CHIUSURA di un ask segue la stessa strada dell'andata: chi ha ricevuto la
@@ -154,10 +165,13 @@ function createClosureFanout({
     const self = localNodeId();
     // `targets` esplicito = ritentativo: si va SOLO verso i pendenti, non di
     // nuovo verso tutti. Senza, si enumerano i peer autorizzati come sempre.
-    const targets2 = Array.isArray(targets) && targets.length
-      ? targets
-      : await resolveFanTargets(peerTargets, undefined, self);
-    const out = [];
+    const inventory = await resolveQualifiedFanTargets(peerTargets, undefined, self, log);
+    const eligible = inventory.targets;
+    const allowed = new Set(eligible);
+    const targets2 = Array.isArray(targets) && targets.length ? targets.filter(target => allowed.has(target)) : eligible;
+    const out = Array.isArray(targets) ? targets.filter(target => !allowed.has(target))
+      .map(target => ({ target, status: inventory.known ? 'refused' : 'unknown',
+        reason: inventory.known ? 'ask-target-not-admin' : 'ask-targets-unavailable' })) : [];
     for (const target of targets2) {
       try {
         const r = await dispatcher.dispatch({
@@ -191,7 +205,7 @@ function createClosureFanout({
 }
 
 function notifyRoutes({
-  cfg, notifier, push, asks, paste, sessionExists,
+  cfg, notifier, push, asks, submit, sessionExists,
   fleetP = null, instanceId = null, identityMode = 'legacy',
   // Federazione delle notifiche. Assenti (test unitari, montaggi parziali) la
   // route resta esattamente quella locale di prima: nessun percorso nuovo si
@@ -215,7 +229,8 @@ function notifyRoutes({
   // not inject one: the local route and the federated surface must never drift
   // into two different implementations.
   const askService = answerService || createAskAnswerService({
-    asks, paste,
+    asks,
+    submit, receipts,
     labelPrefix: replyLabel(cfg),
     onClosure: (kind, info) => { try { notifier.emitRaw({ type: kind, id: info.askId }); } catch (_) {} },
   });
@@ -384,7 +399,7 @@ function notifyRoutes({
   // perche' il dispatcher non conosce i broadcast: target esatto soltanto, e
   // deve restare cosi' (una wildcard implicita e' un modo per parlare a chi non
   // si e' scelto).
-  const askFanTargets = (target, self) => resolveFanTargets(peerTargets, target, self);
+  const askFanTargets = (target, self) => resolveFanTargets(peerTargets, target, self, log);
   const closureFanout = closureFanoutDep || createClosureFanout({ dispatcher, peerTargets, localNodeId, log, retry: closureRetry });
 
   // da revisione: gated READONLY (mutGate) — crea stato durevole (asks.json) e domande