@palbase/backend 32.0.0 → 33.0.0

package/dist/{chunk-AZJIKCOR.js → chunk-DCDHAKF3.js}

@@ -3,15 +3,15 @@ import {
   assertNoOrphanEntryPoints,
   buildContainer,
   buildRelations
-} from "./chunk-5C5UCILO.js";
+} from "./chunk-N54QZER3.js";
 import {
   __requestALS,
   __runStartHooks,
   __runWithRuntime
-} from "./chunk-XEGZ3S2Q.js";
+} from "./chunk-QMFOL2K6.js";
 import {
   CODECS
-} from "./chunk-KGP6ALIU.js";
+} from "./chunk-XOX6RFPZ.js";
 import {
   assertNoExpressionHandles,
   assertUsableFilter,
@@ -25,7 +25,7 @@ import {
   looksLikeUnbrandedPlanRef,
   looksLikeUnbrandedRef,
   qualifiedTableKey
-} from "./chunk-IXAX5CON.js";
+} from "./chunk-C4ZA5AT2.js";
 import {
   getRoutes,
   resolveEffectiveAuth
@@ -3187,23 +3187,21 @@ async function createApp(opts) {
     if (spec.required && !callerClaims) {
       return envelope("unauthorized", "A valid access token is required", 401, requestId);
     }
-    if (callerClaims) {
-      const uploadDb = createRequestDatabase(sql, {
-        role: config.dbRole,
-        serviceRole: config.dbServiceRole,
-        claimsJson: JSON.stringify(callerClaims)
-      });
-      try {
-        const refusal = await refuseUnlessAuthorized(uploadDb.client, spec, requestId, makeRoleResolver(uploadDb.client));
-        if (refusal) {
-          await uploadDb.commit();
-          return refusal;
-        }
+    const uploadDb = createRequestDatabase(sql, {
+      role: config.dbRole,
+      serviceRole: config.dbServiceRole,
+      claimsJson: JSON.stringify(callerClaims ?? {})
+    });
+    try {
+      const refusal = await refuseUnlessAuthorized(uploadDb.client, spec, requestId, makeRoleResolver(uploadDb.client));
+      if (refusal) {
         await uploadDb.commit();
-      } catch (err) {
-        await uploadDb.rollback(err);
-        throw err;
+        return refusal;
       }
+      await uploadDb.commit();
+    } catch (err) {
+      await uploadDb.rollback(err);
+      throw err;
     }
     const grant = grantFor(target?.entry, {
       userId: typeof callerClaims?.sub === "string" ? callerClaims.sub : null,
@@ -3242,11 +3240,18 @@ async function createApp(opts) {
       claimsJson: JSON.stringify(claims ?? {})
     });
     const rolesOfCaller = makeRoleResolver(db.client);
-    if (claims) {
-      const refusal = await refuseUnlessAuthorized(db.client, spec, requestId, rolesOfCaller);
-      if (refusal) return refusal;
+    let dispatched = false;
+    const settleBeforeRefusal = /* @__PURE__ */ __name(async () => {
+      if (dispatched) return;
+      await db.rollback(new Error("request refused before dispatch"));
+    }, "settleBeforeRefusal");
+    const refusal = await refuseUnlessAuthorized(db.client, spec, requestId, rolesOfCaller);
+    if (refusal) {
+      await settleBeforeRefusal();
+      return refusal;
     }
     if (claims && spec.verifiedEmail && claims.email_verified !== true) {
+      await settleBeforeRefusal();
       return envelope("email_not_verified", "A verified email address is required", 403, requestId);
     }
     let parsedBody;
@@ -3255,6 +3260,7 @@ async function createApp(opts) {
     if (req.method !== "GET" && req.method !== "HEAD") {
       const declared = Number(req.headers.get("content-length") ?? "");
       if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+        await settleBeforeRefusal();
         return new Response(JSON.stringify({
           error: "payload_too_large",
           error_description: `Request body exceeds ${MAX_BODY_BYTES} bytes`,
@@ -3267,6 +3273,7 @@ async function createApp(opts) {
       }
       const buf = await req.arrayBuffer().catch(() => null);
       if (buf && buf.byteLength > MAX_BODY_BYTES) {
+        await settleBeforeRefusal();
         return new Response(JSON.stringify({
           error: "payload_too_large",
           error_description: `Request body exceeds ${MAX_BODY_BYTES} bytes`,
@@ -3302,6 +3309,7 @@ async function createApp(opts) {
         ...JSON_HEADERS
       };
       if (attest.nextChallenge) headers["x-palbase-attest-challenge"] = attest.nextChallenge;
+      await settleBeforeRefusal();
       return new Response(JSON.stringify({
         error: attest.reason,
         error_description: "This endpoint requires a verified app instance",
@@ -3316,6 +3324,7 @@ async function createApp(opts) {
     attestChallengeOut = attest.nextChallenge;
     const retryAfter = limiter.check(meta.options?.rateLimit, RateLimiter.key(hit.entry.id, userId, req.headers), Date.now());
     if (retryAfter !== null) {
+      await settleBeforeRefusal();
       return new Response(JSON.stringify({
         error: "too_many_requests",
         error_description: "Rate limit exceeded for this endpoint",
@@ -3347,6 +3356,7 @@ async function createApp(opts) {
           readParsedBody();
           const r = p.schema.safeParse(parsedBody);
           if (!r.success) {
+            await settleBeforeRefusal();
             return envelope("bad_request", "Request body failed validation", 400, requestId, {
               data: {
                 fields: fieldErrors(r.error)
@@ -3359,6 +3369,7 @@ async function createApp(opts) {
         case "query": {
           const r = p.schema.safeParse(Object.fromEntries(url.searchParams));
           if (!r.success) {
+            await settleBeforeRefusal();
             return envelope("bad_request", "Query parameters failed validation", 400, requestId, {
               data: {
                 fields: fieldErrors(r.error)
@@ -3379,6 +3390,7 @@ async function createApp(opts) {
           }
           const r = p.schema.safeParse(headersFor(raw, p.schema));
           if (!r.success) {
+            await settleBeforeRefusal();
             return envelope("bad_request", "Request headers failed validation", 400, requestId, {
               data: {
                 fields: fieldErrors(r.error)
@@ -3411,17 +3423,20 @@ async function createApp(opts) {
           break;
         case "uploadedObject": {
           if (uploadSecret === "" || !verifySignature(req.headers.get(SIGNATURE_HEADER) ?? "", uploadSecret)) {
+            await settleBeforeRefusal();
             return envelope("unauthorized", "This endpoint accepts uploads through storage, not directly", 401, requestId);
           }
           readParsedBody();
           const envelopeIn = parsedBody;
           if (!envelopeIn?.uploadedObject) {
+            await settleBeforeRefusal();
             return envelope("bad_request", "the completion call carried no uploaded object", 400, requestId);
           }
           const uploadId = envelopeIn.uploadedObject.uploadId;
           if (typeof uploadId === "string" && uploadId !== "") {
             const already = completions.recall(uploadId);
             if (already) {
+              await settleBeforeRefusal();
               return new Response(already.body, {
                 status: already.status,
                 headers: already.contentType ? {
@@ -3471,6 +3486,7 @@ async function createApp(opts) {
           args[p.index] = void 0;
       }
     }
+    dispatched = true;
     try {
       const services = buildServices(db);
       if (meta.options?.sseConfig !== void 0) {
@@ -3663,4 +3679,4 @@ export {
   installEgressFence,
   createApp
 };
-//# sourceMappingURL=chunk-AZJIKCOR.js.map
+//# sourceMappingURL=chunk-DCDHAKF3.js.map