@objy/server 0.0.0-stage → 0.1.0

package/src/object-store.js

@@ -0,0 +1,288 @@
+import { stableKey } from "./query.js";
+
+const DEFAULT_VALUE_DIRECTORY = Object.freeze({
+  enabled: true,
+  minRefs: 2,
+  maxEntries: 100_000,
+  maxCandidates: 4_096,
+  maxCandidatesPerPath: 256,
+  maxPaths: 1_024,
+  maxStringLength: 256,
+  maxKeyBytes: 512,
+  poolStructuredValues: false,
+  maxNestedContainerEntries: 64,
+});
+
+export class ObjectRowStore {
+  constructor(options = {}) {
+    this.rows = new Map();
+    this.valueDirectory = new ValueDirectory(options.valueDirectory);
+  }
+
+  rebuild(id, live, options = {}) {
+    const old = this.rows.get(id);
+    if (old) this.valueDirectory.releaseAll(old.refs);
+    this.rows.delete(id);
+
+    if (!live.length) return;
+    const refs = [];
+    const value = {};
+    const storeOptions = { trusted: options.trusted === true };
+    for (const [key, item] of live) value[key] = this.valueDirectory.store(item, refs, key, storeOptions);
+    this.rows.set(id, { value, refs });
+  }
+
+  removeObject(id) {
+    const old = this.rows.get(id);
+    if (!old) return;
+    this.valueDirectory.releaseAll(old.refs);
+    this.rows.delete(id);
+  }
+
+  clear() {
+    this.rows.clear();
+    this.valueDirectory.clear();
+  }
+
+  read(id) {
+    const row = this.rows.get(id);
+    return row ? cloneValue(row.value) : undefined;
+  }
+
+  readForQuery(id) {
+    return this.rows.get(id)?.value;
+  }
+
+  bytes() {
+    let total = 0;
+    for (const row of this.rows.values()) total += estimateValue(row.value);
+    return total + this.valueDirectory.bytes();
+  }
+
+  shapeStats() {
+    return [{
+      engine: "object",
+      rows: this.rows.size,
+      bytes: this.bytes(),
+      valueDirectory: this.valueDirectory.stats(),
+    }];
+  }
+}
+
+class ValueDirectory {
+  constructor(options = {}) {
+    const config = { ...DEFAULT_VALUE_DIRECTORY, ...(options || {}) };
+    this.enabled = config.enabled !== false;
+    this.minRefs = positiveInt(config.minRefs, DEFAULT_VALUE_DIRECTORY.minRefs);
+    this.maxEntries = positiveInt(config.maxEntries, DEFAULT_VALUE_DIRECTORY.maxEntries);
+    this.maxCandidates = positiveInt(config.maxCandidates, DEFAULT_VALUE_DIRECTORY.maxCandidates);
+    this.maxCandidatesPerPath = positiveInt(config.maxCandidatesPerPath, DEFAULT_VALUE_DIRECTORY.maxCandidatesPerPath);
+    this.maxPaths = positiveInt(config.maxPaths, DEFAULT_VALUE_DIRECTORY.maxPaths);
+    this.maxStringLength = positiveInt(config.maxStringLength, DEFAULT_VALUE_DIRECTORY.maxStringLength);
+    this.maxKeyBytes = positiveInt(config.maxKeyBytes, DEFAULT_VALUE_DIRECTORY.maxKeyBytes);
+    this.poolStructuredValues = config.poolStructuredValues === true;
+    this.maxNestedContainerEntries = positiveInt(config.maxNestedContainerEntries, DEFAULT_VALUE_DIRECTORY.maxNestedContainerEntries);
+    this.pool = new Map();
+    this.pathCandidates = new Map();
+    this.candidateCount = 0;
+  }
+
+  store(value, refs, path = "$", options = {}) {
+    if (!this.enabled) return cloneValue(value, options);
+
+    const key = this.keyFor(value);
+    if (key) {
+      const pooled = this.pool.get(key);
+      if (pooled) {
+        pooled.refs++;
+        refs.push(key);
+        return pooled.value;
+      }
+      if (this.shouldPromote(path, key)) {
+        const stored = deepFreeze(cloneValue(value));
+        this.pool.set(key, {
+          value: stored,
+          refs: 1,
+          bytes: estimateValue(stored),
+        });
+        this.deleteCandidate(path, key);
+        refs.push(key);
+        return stored;
+      }
+    }
+
+    return this.cloneWithNestedPooling(value, refs, path, options);
+  }
+
+  cloneWithNestedPooling(value, refs, path, options = {}) {
+    if (options.trusted && !this.poolStructuredValues) return value;
+    if (Array.isArray(value)) {
+      if (value.length > this.maxNestedContainerEntries) return cloneValue(value, options);
+      return value.map((item) => this.store(item, refs, `${path}[]`, options));
+    }
+    if (isPlainObject(value)) {
+      const entries = Object.entries(value);
+      if (entries.length > this.maxNestedContainerEntries) return cloneValue(value, options);
+      return Object.fromEntries(
+        entries.map(([key, item]) => [key, this.store(item, refs, `${path}.${key}`, options)]),
+      );
+    }
+    return cloneValue(value, options);
+  }
+
+  releaseAll(refs) {
+    for (const key of refs || []) this.release(key);
+  }
+
+  release(key) {
+    const pooled = this.pool.get(key);
+    if (!pooled) return;
+    pooled.refs--;
+    if (pooled.refs <= 0) this.pool.delete(key);
+  }
+
+  shouldPromote(path, key) {
+    if (this.pool.size >= this.maxEntries) return false;
+    const candidates = this.candidatesForPath(path);
+    if (!candidates) return false;
+    const count = (candidates.get(key) || 0) + 1;
+    if (count >= this.minRefs) return true;
+    this.rememberCandidate(candidates, key, count);
+    return false;
+  }
+
+  candidatesForPath(path) {
+    const normalized = path || "$";
+    let candidates = this.pathCandidates.get(normalized);
+    if (candidates) return candidates;
+    if (this.pathCandidates.size >= this.maxPaths) return null;
+    candidates = new Map();
+    this.pathCandidates.set(normalized, candidates);
+    return candidates;
+  }
+
+  rememberCandidate(candidates, key, count) {
+    if (this.maxCandidates <= 0 || this.maxCandidatesPerPath <= 0) return;
+    if (candidates.has(key)) {
+      candidates.set(key, count);
+      return;
+    }
+    while (this.candidateCount >= this.maxCandidates && this.dropOldestCandidate()) {}
+    if (this.candidateCount >= this.maxCandidates) return;
+    if (candidates.size >= this.maxCandidatesPerPath) {
+      const oldest = candidates.keys().next().value;
+      if (oldest !== undefined) {
+        candidates.delete(oldest);
+        this.candidateCount--;
+      }
+    }
+    if (this.candidateCount < this.maxCandidates && candidates.size < this.maxCandidatesPerPath) {
+      candidates.set(key, count);
+      this.candidateCount++;
+    }
+  }
+
+  deleteCandidate(path, key) {
+    const candidates = this.pathCandidates.get(path || "$");
+    if (!candidates?.delete(key)) return;
+    this.candidateCount--;
+  }
+
+  dropOldestCandidate() {
+    for (const candidates of this.pathCandidates.values()) {
+      const oldest = candidates.keys().next().value;
+      if (oldest === undefined) continue;
+      candidates.delete(oldest);
+      this.candidateCount--;
+      return true;
+    }
+    return false;
+  }
+
+  clear() {
+    this.pool.clear();
+    this.pathCandidates.clear();
+    this.candidateCount = 0;
+  }
+
+  keyFor(value) {
+    if (typeof value === "string") {
+      if (value.length > this.maxStringLength) return null;
+      return `string:${value}`;
+    }
+    if (!this.poolStructuredValues) return null;
+    if (Array.isArray(value) || isPlainObject(value)) {
+      const key = stableKey(value);
+      if (!key || key.length > this.maxKeyBytes) return null;
+      return `${Array.isArray(value) ? "array" : "object"}:${key}`;
+    }
+    return null;
+  }
+
+  bytes() {
+    let total = 0;
+    for (const [key, entry] of this.pool) total += key.length * 2 + entry.bytes;
+    for (const candidates of this.pathCandidates.values()) {
+      for (const key of candidates.keys()) total += key.length * 2 + 8;
+    }
+    return total;
+  }
+
+  stats() {
+    let refs = 0;
+    for (const entry of this.pool.values()) refs += entry.refs;
+    return {
+      enabled: this.enabled,
+      entries: this.pool.size,
+      refs,
+      candidates: this.candidateCount,
+      candidatePaths: this.pathCandidates.size,
+      bytes: this.bytes(),
+      minRefs: this.minRefs,
+      maxEntries: this.maxEntries,
+      maxCandidates: this.maxCandidates,
+      maxCandidatesPerPath: this.maxCandidatesPerPath,
+      maxPaths: this.maxPaths,
+      maxStringLength: this.maxStringLength,
+      maxKeyBytes: this.maxKeyBytes,
+      poolStructuredValues: this.poolStructuredValues,
+      maxNestedContainerEntries: this.maxNestedContainerEntries,
+    };
+  }
+}
+
+function cloneValue(value, options = {}) {
+  if (value === null || typeof value !== "object") return value;
+  if (options.trusted) return value;
+  return structuredClone(value);
+}
+
+function deepFreeze(value) {
+  if (value === null || typeof value !== "object" || Object.isFrozen(value)) return value;
+  Object.freeze(value);
+  for (const item of Object.values(value)) deepFreeze(item);
+  return value;
+}
+
+function estimateValue(value) {
+  if (value === null || value === undefined) return 0;
+  if (typeof value === "number") return 8;
+  if (typeof value === "boolean") return 1;
+  if (typeof value === "string") return value.length * 2;
+  if (Array.isArray(value)) return 24 + value.reduce((sum, item) => sum + 8 + estimateValue(item), 0);
+  if (typeof value === "object") {
+    return 32 + Object.entries(value).reduce((sum, [key, item]) => {
+      return sum + key.length * 2 + 8 + estimateValue(item);
+    }, 0);
+  }
+  return 0;
+}
+
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function positiveInt(value, fallback) {
+  const n = Number(value);
+  return Number.isFinite(n) && n >= 0 ? Math.floor(n) : fallback;
+}

package/src/patch.js

@@ -0,0 +1,87 @@
+const PROTECTED_ROOTS = new Set(["_id"]);
+
+export function applyPatchToObject(current, patch) {
+  if (!isPlainObject(patch)) throw new TypeError("patch body must be a plain object");
+  assertSupportedPatchKeys(patch);
+
+  const next = clonePatchValue(current || {});
+  delete next._id;
+
+  const set = patch.$set ?? {};
+  if (!isPlainObject(set)) throw new TypeError("$set must be a plain object when provided");
+  for (const [path, value] of Object.entries(set)) {
+    setPath(next, path, clonePatchValue(value), `$set.${path}`);
+  }
+
+  for (const path of unsetPaths(patch.$unset)) {
+    unsetPath(next, path, "$unset");
+  }
+
+  return next;
+}
+
+export function patchUnsetsPath(patch, path) {
+  if (!path || !isPlainObject(patch)) return false;
+  return unsetPaths(patch.$unset).includes(path);
+}
+
+function assertSupportedPatchKeys(patch) {
+  for (const key of Object.keys(patch)) {
+    if (key !== "$set" && key !== "$unset") {
+      throw new TypeError(`unsupported patch key "${key}"`);
+    }
+  }
+}
+
+function unsetPaths(value) {
+  if (value === undefined) return [];
+  if (Array.isArray(value)) return value;
+  if (isPlainObject(value)) return Object.keys(value);
+  throw new TypeError("$unset must be an array of dot-notation paths or an object when provided");
+}
+
+function setPath(target, path, value, field) {
+  const parts = assertPatchPath(path, field);
+  let cursor = target;
+  for (let i = 0; i < parts.length - 1; i++) {
+    const part = parts[i];
+    const next = cursor[part];
+    if (!isPlainObject(next)) cursor[part] = {};
+    cursor = cursor[part];
+  }
+  cursor[parts[parts.length - 1]] = value;
+}
+
+function unsetPath(target, path, field) {
+  const parts = assertPatchPath(path, field);
+  let cursor = target;
+  for (let i = 0; i < parts.length - 1; i++) {
+    cursor = cursor[parts[i]];
+    if (!isPlainObject(cursor)) return;
+  }
+  delete cursor[parts[parts.length - 1]];
+}
+
+function assertPatchPath(path, field) {
+  if (typeof path !== "string" || path.length === 0) {
+    throw new TypeError(`${field} must be a non-empty dot-notation path`);
+  }
+  const parts = path.split(".");
+  if (parts.some((part) => part.length === 0)) {
+    throw new TypeError(`${field} must be a valid dot-notation path`);
+  }
+  if (PROTECTED_ROOTS.has(parts[0])) {
+    throw new TypeError(`${parts[0]} cannot be changed`);
+  }
+  return parts;
+}
+
+function clonePatchValue(value) {
+  if (!value || typeof value !== "object") return value;
+  if (Array.isArray(value)) return value.map(clonePatchValue);
+  return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, clonePatchValue(child)]));
+}
+
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}

package/src/permissions.js

@@ -0,0 +1,178 @@
+import { matchesQuery } from "./query.js";
+
+const OP_CODES = {
+  create: "c",
+  read: "r",
+  update: "u",
+  delete: "d",
+};
+
+const VALID_PERMS = new Set(["c", "r", "u", "d"]);
+const QUERY_CONTROLS = new Set([
+  "$aggregate",
+  "$cursor",
+  "$limit",
+  "$offset",
+  "$page",
+  "$pageSize",
+  "$refDepth",
+  "$skip",
+  "$sort",
+  "$vector",
+]);
+
+export function normalizePermissions(permissions) {
+  if (permissions === undefined || permissions === null) return [];
+  if (!Array.isArray(permissions)) throw permissionConfigError("permissions must be an array");
+
+  return permissions.map((rule, index) => normalizeRule(rule, index)).filter(Boolean);
+}
+
+export function normalizeCollectionPermissions(permissions) {
+  if (permissions === undefined) return { read: [], write: [] };
+  if (!isPlainObject(permissions)) throw permissionConfigError("collectionPermissions must be an object");
+  for (const key of Object.keys(permissions)) {
+    if (key !== "read" && key !== "write") {
+      throw permissionConfigError(`collectionPermissions.${key} is not supported`);
+    }
+  }
+  const normalizeNames = (key) => {
+    const names = permissions[key] === undefined ? [] : permissions[key];
+    if (!Array.isArray(names) || names.some((name) => typeof name !== "string" || !name.trim())) {
+      throw permissionConfigError(`collectionPermissions.${key} must be a list of collection names`);
+    }
+    return [...new Set(names)];
+  };
+  return { read: normalizeNames("read"), write: normalizeNames("write") };
+}
+
+export function mergeReadPermissionQuery(criteria = {}, user = null, collection = null) {
+  if (hasCollectionPermission(user, "read", collection)) return { denied: false, query: criteria || {} };
+  const permissions = readRules(user);
+  if (permissions.some(isAllowAllRule)) return { denied: false, query: criteria || {} };
+  if (!permissions.length) return { denied: true, query: null };
+
+  const authQuery = permissions.length === 1
+    ? cloneValue(permissions[0].query || {})
+    : { $or: permissions.map((rule) => cloneValue(rule.query || {})) };
+  if (!criteria || Object.keys(criteria).length === 0) return { denied: false, query: authQuery };
+  return {
+    denied: false,
+    query: { $and: [criteria, authQuery] },
+  };
+}
+
+export function canCreate(user, object, collection = null) {
+  return can(user, "create", object, collection);
+}
+
+export function canRead(user, object, collection = null) {
+  return can(user, "read", object, collection);
+}
+
+export function canUpdate(user, before, after, collection = null) {
+  return can(user, "update", before, collection) && can(user, "update", after, collection);
+}
+
+export function canDelete(user, object, collection = null) {
+  return can(user, "delete", object, collection);
+}
+
+export function can(user, operation, object, collection = null) {
+  const code = OP_CODES[operation] || operation;
+  const collectionAction = code === "r" ? "read" : ["c", "u", "d"].includes(code) ? "write" : null;
+  if (collectionAction && hasCollectionPermission(user, collectionAction, collection)) {
+    return true;
+  }
+  return rulesFor(user).some((rule) => permits(rule, code) && matchesPermissionQuery(rule, object));
+}
+
+export function isPermissionBypass(userOrClaims) {
+  return Boolean(
+    userOrClaims?.admin === true ||
+      (userOrClaims?.globalUser === true && userOrClaims?.role === "admin"),
+  );
+}
+
+export function permissionError(operation, id = null) {
+  const err = new Error(`Permission denied: ${operation}${id ? ` ${id}` : ""}`);
+  err.status = 403;
+  err.code = "E_PERMISSION_DENIED";
+  return err;
+}
+
+function readRules(user) {
+  return rulesFor(user).filter((rule) => permits(rule, OP_CODES.read));
+}
+
+function hasCollectionPermission(user, operation, collection) {
+  if (!user || isPermissionBypass(user)) return true;
+  if (typeof collection !== "string" || !collection) return false;
+  const names = user.collectionPermissions?.[operation];
+  return Array.isArray(names) && names.includes(collection);
+}
+
+function rulesFor(user) {
+  if (!user || isPermissionBypass(user)) return [{ query: {}, perm: "*" }];
+  try {
+    return normalizePermissions(user.permissions);
+  } catch {
+    return [];
+  }
+}
+
+function normalizeRule(rule, index) {
+  if (!isPlainObject(rule)) throw permissionConfigError(`permissions[${index}] must be an object`);
+  const perm = normalizePerm(rule.perm);
+  if (!perm) return null;
+  const query = rule.query === undefined ? {} : rule.query;
+  if (!isPlainObject(query)) throw permissionConfigError(`permissions[${index}].query must be an object`);
+  for (const key of Object.keys(query)) {
+    if (QUERY_CONTROLS.has(key)) throw permissionConfigError(`permissions[${index}].query must not include ${key}`);
+  }
+
+  return {
+    ...(typeof rule.name === "string" && rule.name.length > 0 ? { name: rule.name } : {}),
+    query: cloneValue(query),
+    perm,
+  };
+}
+
+function normalizePerm(value) {
+  const raw = typeof value === "string" ? value.trim().toLowerCase() : "";
+  if (raw === "*") return "*";
+  const chars = [];
+  for (const ch of raw) {
+    if (!VALID_PERMS.has(ch) || chars.includes(ch)) continue;
+    chars.push(ch);
+  }
+  return chars.join("");
+}
+
+function permits(rule, code) {
+  return rule.perm === "*" || (typeof rule.perm === "string" && rule.perm.includes(code));
+}
+
+function matchesPermissionQuery(rule, object) {
+  if (isAllowAllRule(rule)) return true;
+  return Boolean(object) && matchesQuery(object, rule.query || {});
+}
+
+function isAllowAllRule(rule) {
+  return rule?.perm === "*" && Object.keys(rule.query || {}).length === 0;
+}
+
+function permissionConfigError(message) {
+  const err = new TypeError(message);
+  err.status = 400;
+  return err;
+}
+
+function cloneValue(value) {
+  if (value === null || typeof value !== "object") return value;
+  return structuredClone(value);
+}
+
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}