@powersync/service-core 1.13.4 → 1.15.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +61 -0
- package/LICENSE +3 -3
- package/dist/api/api-metrics.js +5 -0
- package/dist/api/api-metrics.js.map +1 -1
- package/dist/api/diagnostics.js +31 -1
- package/dist/api/diagnostics.js.map +1 -1
- package/dist/auth/KeyStore.d.ts +19 -0
- package/dist/auth/KeyStore.js +16 -4
- package/dist/auth/KeyStore.js.map +1 -1
- package/dist/auth/RemoteJWKSCollector.d.ts +3 -0
- package/dist/auth/RemoteJWKSCollector.js +3 -1
- package/dist/auth/RemoteJWKSCollector.js.map +1 -1
- package/dist/auth/StaticSupabaseKeyCollector.d.ts +2 -1
- package/dist/auth/StaticSupabaseKeyCollector.js +1 -1
- package/dist/auth/StaticSupabaseKeyCollector.js.map +1 -1
- package/dist/auth/utils.d.ts +19 -0
- package/dist/auth/utils.js +106 -3
- package/dist/auth/utils.js.map +1 -1
- package/dist/entry/commands/compact-action.js +10 -1
- package/dist/entry/commands/compact-action.js.map +1 -1
- package/dist/metrics/open-telemetry/util.d.ts +0 -3
- package/dist/metrics/open-telemetry/util.js +19 -12
- package/dist/metrics/open-telemetry/util.js.map +1 -1
- package/dist/replication/AbstractReplicator.js +2 -2
- package/dist/replication/AbstractReplicator.js.map +1 -1
- package/dist/routes/compression.d.ts +19 -0
- package/dist/routes/compression.js +70 -0
- package/dist/routes/compression.js.map +1 -0
- package/dist/routes/configure-fastify.d.ts +40 -5
- package/dist/routes/configure-fastify.js +2 -1
- package/dist/routes/configure-fastify.js.map +1 -1
- package/dist/routes/endpoints/socket-route.js +25 -17
- package/dist/routes/endpoints/socket-route.js.map +1 -1
- package/dist/routes/endpoints/sync-rules.js +1 -27
- package/dist/routes/endpoints/sync-rules.js.map +1 -1
- package/dist/routes/endpoints/sync-stream.d.ts +80 -10
- package/dist/routes/endpoints/sync-stream.js +29 -11
- package/dist/routes/endpoints/sync-stream.js.map +1 -1
- package/dist/routes/route-register.d.ts +4 -0
- package/dist/routes/route-register.js +29 -15
- package/dist/routes/route-register.js.map +1 -1
- package/dist/storage/BucketStorage.d.ts +1 -1
- package/dist/storage/BucketStorage.js.map +1 -1
- package/dist/storage/BucketStorageBatch.d.ts +16 -6
- package/dist/storage/BucketStorageBatch.js.map +1 -1
- package/dist/storage/ChecksumCache.d.ts +4 -19
- package/dist/storage/ChecksumCache.js +4 -0
- package/dist/storage/ChecksumCache.js.map +1 -1
- package/dist/storage/ReplicationEventPayload.d.ts +2 -2
- package/dist/storage/SourceEntity.d.ts +5 -4
- package/dist/storage/SourceTable.d.ts +22 -20
- package/dist/storage/SourceTable.js +34 -30
- package/dist/storage/SourceTable.js.map +1 -1
- package/dist/storage/SyncRulesBucketStorage.d.ts +19 -4
- package/dist/storage/SyncRulesBucketStorage.js.map +1 -1
- package/dist/sync/BucketChecksumState.d.ts +41 -11
- package/dist/sync/BucketChecksumState.js +155 -19
- package/dist/sync/BucketChecksumState.js.map +1 -1
- package/dist/sync/RequestTracker.d.ts +7 -1
- package/dist/sync/RequestTracker.js +22 -2
- package/dist/sync/RequestTracker.js.map +1 -1
- package/dist/sync/sync.d.ts +3 -3
- package/dist/sync/sync.js +23 -42
- package/dist/sync/sync.js.map +1 -1
- package/dist/sync/util.d.ts +3 -1
- package/dist/sync/util.js +30 -2
- package/dist/sync/util.js.map +1 -1
- package/dist/util/config/compound-config-collector.js +23 -0
- package/dist/util/config/compound-config-collector.js.map +1 -1
- package/dist/util/lsn.d.ts +4 -0
- package/dist/util/lsn.js +11 -0
- package/dist/util/lsn.js.map +1 -0
- package/dist/util/protocol-types.d.ts +153 -9
- package/dist/util/protocol-types.js +41 -6
- package/dist/util/protocol-types.js.map +1 -1
- package/dist/util/util-index.d.ts +1 -0
- package/dist/util/util-index.js +1 -0
- package/dist/util/util-index.js.map +1 -1
- package/dist/util/utils.d.ts +18 -3
- package/dist/util/utils.js +33 -9
- package/dist/util/utils.js.map +1 -1
- package/package.json +16 -14
- package/src/api/api-metrics.ts +6 -0
- package/src/api/diagnostics.ts +33 -1
- package/src/auth/KeyStore.ts +28 -4
- package/src/auth/RemoteJWKSCollector.ts +5 -2
- package/src/auth/StaticSupabaseKeyCollector.ts +1 -1
- package/src/auth/utils.ts +123 -3
- package/src/entry/commands/compact-action.ts +9 -1
- package/src/metrics/open-telemetry/util.ts +23 -19
- package/src/replication/AbstractReplicator.ts +2 -2
- package/src/routes/compression.ts +75 -0
- package/src/routes/configure-fastify.ts +3 -1
- package/src/routes/endpoints/socket-route.ts +25 -16
- package/src/routes/endpoints/sync-rules.ts +1 -28
- package/src/routes/endpoints/sync-stream.ts +37 -26
- package/src/routes/route-register.ts +41 -15
- package/src/storage/BucketStorage.ts +2 -2
- package/src/storage/BucketStorageBatch.ts +23 -6
- package/src/storage/ChecksumCache.ts +8 -22
- package/src/storage/ReplicationEventPayload.ts +2 -2
- package/src/storage/SourceEntity.ts +5 -5
- package/src/storage/SourceTable.ts +48 -34
- package/src/storage/SyncRulesBucketStorage.ts +26 -7
- package/src/sync/BucketChecksumState.ts +194 -31
- package/src/sync/RequestTracker.ts +27 -2
- package/src/sync/sync.ts +53 -51
- package/src/sync/util.ts +32 -3
- package/src/util/config/compound-config-collector.ts +24 -0
- package/src/util/lsn.ts +8 -0
- package/src/util/protocol-types.ts +138 -10
- package/src/util/util-index.ts +1 -0
- package/src/util/utils.ts +59 -12
- package/test/src/auth.test.ts +323 -1
- package/test/src/checksum_cache.test.ts +6 -8
- package/test/src/routes/mocks.ts +59 -0
- package/test/src/routes/stream.test.ts +84 -0
- package/test/src/sync/BucketChecksumState.test.ts +375 -76
- package/tsconfig.tsbuildinfo +1 -1
|
@@ -6,9 +6,44 @@ export const BucketRequest = t.object({
|
|
|
6
6
|
*/
|
|
7
7
|
after: t.string
|
|
8
8
|
});
|
|
9
|
+
/**
|
|
10
|
+
* A sync steam that a client has expressed interest in by explicitly opening it on the client side.
|
|
11
|
+
*/
|
|
12
|
+
export const RequestedStreamSubscription = t.object({
|
|
13
|
+
/**
|
|
14
|
+
* The defined name of the stream as it appears in sync stream definitions.
|
|
15
|
+
*/
|
|
16
|
+
stream: t.string,
|
|
17
|
+
/**
|
|
18
|
+
* An optional dictionary of parameters to pass to this specific stream.
|
|
19
|
+
*/
|
|
20
|
+
parameters: t.record(t.any).optional(),
|
|
21
|
+
/**
|
|
22
|
+
* Set when the client wishes to re-assign a different priority to this stream.
|
|
23
|
+
*
|
|
24
|
+
* Streams and sync rules can also assign a default priority, but clients are allowed to override those. This can be
|
|
25
|
+
* useful when the priority for partial syncs depends on e.g. the current page opened in a client.
|
|
26
|
+
*/
|
|
27
|
+
override_priority: t.union(t.number, t.Null)
|
|
28
|
+
});
|
|
29
|
+
/**
|
|
30
|
+
* An overview of all subscribed streams as part of a streaming sync request.
|
|
31
|
+
*/
|
|
32
|
+
export const StreamSubscriptionRequest = t.object({
|
|
33
|
+
/**
|
|
34
|
+
* Whether to sync default streams.
|
|
35
|
+
*
|
|
36
|
+
* When disabled, only explicitly-opened subscriptions are included.
|
|
37
|
+
*/
|
|
38
|
+
include_defaults: t.boolean.optional(),
|
|
39
|
+
/**
|
|
40
|
+
* An array of sync streams the client has opened explicitly.
|
|
41
|
+
*/
|
|
42
|
+
subscriptions: t.array(RequestedStreamSubscription)
|
|
43
|
+
});
|
|
9
44
|
export const StreamingSyncRequest = t.object({
|
|
10
45
|
/**
|
|
11
|
-
* Existing bucket states.
|
|
46
|
+
* Existing client-side bucket states.
|
|
12
47
|
*/
|
|
13
48
|
buckets: t.array(BucketRequest).optional(),
|
|
14
49
|
/**
|
|
@@ -23,10 +58,6 @@ export const StreamingSyncRequest = t.object({
|
|
|
23
58
|
* True to keep `data` as a string, instead of nested JSON.
|
|
24
59
|
*/
|
|
25
60
|
raw_data: t.boolean.optional(),
|
|
26
|
-
/**
|
|
27
|
-
* Data is received in a serialized BSON Buffer
|
|
28
|
-
*/
|
|
29
|
-
binary_data: t.boolean.optional(),
|
|
30
61
|
/**
|
|
31
62
|
* Client parameters to be passed to the sync rules.
|
|
32
63
|
*/
|
|
@@ -34,6 +65,10 @@ export const StreamingSyncRequest = t.object({
|
|
|
34
65
|
/**
|
|
35
66
|
* Unique client id.
|
|
36
67
|
*/
|
|
37
|
-
client_id: t.string.optional()
|
|
68
|
+
client_id: t.string.optional(),
|
|
69
|
+
/**
|
|
70
|
+
* If the client is aware of streams, an array of streams the client has opened.
|
|
71
|
+
*/
|
|
72
|
+
streams: StreamSubscriptionRequest.optional()
|
|
38
73
|
});
|
|
39
74
|
//# sourceMappingURL=protocol-types.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"protocol-types.js","sourceRoot":"","sources":["../../src/util/protocol-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,UAAU,CAAC;AAI9B,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM;IAEd;;OAEG;IACH,KAAK,EAAE,CAAC,CAAC,MAAM;CAChB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,
|
|
1
|
+
{"version":3,"file":"protocol-types.js","sourceRoot":"","sources":["../../src/util/protocol-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,UAAU,CAAC;AAI9B,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM;IAEd;;OAEG;IACH,KAAK,EAAE,CAAC,CAAC,MAAM;CAChB,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD;;OAEG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB;;OAEG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtC;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;CAC7C,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE;IAEtC;;OAEG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;CACpD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C;;OAEG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAE1C;;OAEG;IACH,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IAElC;;OAEG;IACH,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE;IAEtC;;OAEG;IACH,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE;IAE9B;;OAEG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAEtC;;OAEG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;IAE9B;;OAEG;IACH,OAAO,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC"}
|
package/dist/util/util-index.js
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"util-index.js","sourceRoot":"","sources":["../../src/util/util-index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAE7B,cAAc,aAAa,CAAC;AAC5B,cAAc,uCAAuC,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAElC,cAAc,yCAAyC,CAAC;AACxD,cAAc,qDAAqD,CAAC;AACpE,cAAc,uDAAuD,CAAC;AACtE,cAAc,yDAAyD,CAAC;AAExE,cAAc,yDAAyD,CAAC;AACxE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,yDAAyD,CAAC;AACxE,cAAc,uCAAuC,CAAC;AACtD,cAAc,4CAA4C,CAAC"}
|
|
1
|
+
{"version":3,"file":"util-index.js","sourceRoot":"","sources":["../../src/util/util-index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAE7B,cAAc,aAAa,CAAC;AAC5B,cAAc,uCAAuC,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAElC,cAAc,yCAAyC,CAAC;AACxD,cAAc,qDAAqD,CAAC;AACpE,cAAc,uDAAuD,CAAC;AACtE,cAAc,yDAAyD,CAAC;AAExE,cAAc,yDAAyD,CAAC;AACxE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,yDAAyD,CAAC;AACxE,cAAc,uCAAuC,CAAC;AACtD,cAAc,4CAA4C,CAAC"}
|
package/dist/util/utils.d.ts
CHANGED
|
@@ -2,8 +2,21 @@ import * as sync_rules from '@powersync/service-sync-rules';
|
|
|
2
2
|
import * as bson from 'bson';
|
|
3
3
|
import { BucketChecksum, ProtocolOpId, OplogEntry } from './protocol-types.js';
|
|
4
4
|
import * as storage from '../storage/storage-index.js';
|
|
5
|
-
import { PartialChecksum } from '../storage/ChecksumCache.js';
|
|
6
5
|
export type ChecksumMap = Map<string, BucketChecksum>;
|
|
6
|
+
/**
|
|
7
|
+
* A partial checksum can never be used on its own - must always be combined with a full BucketChecksum.
|
|
8
|
+
*/
|
|
9
|
+
export interface PartialChecksum {
|
|
10
|
+
bucket: string;
|
|
11
|
+
/**
|
|
12
|
+
* 32-bit unsigned hash.
|
|
13
|
+
*/
|
|
14
|
+
partialChecksum: number;
|
|
15
|
+
/**
|
|
16
|
+
* Count of operations - informational only.
|
|
17
|
+
*/
|
|
18
|
+
partialCount: number;
|
|
19
|
+
}
|
|
7
20
|
/**
|
|
8
21
|
* op_id as used internally, for individual operations and checkpoints.
|
|
9
22
|
*
|
|
@@ -24,7 +37,9 @@ export declare function checksumsDiff(previous: ChecksumMap, current: ChecksumMa
|
|
|
24
37
|
removedBuckets: string[];
|
|
25
38
|
};
|
|
26
39
|
export declare function addChecksums(a: number, b: number): number;
|
|
27
|
-
export declare function
|
|
40
|
+
export declare function isPartialChecksum(c: PartialChecksum | BucketChecksum): c is PartialChecksum;
|
|
41
|
+
export declare function addBucketChecksums(a: BucketChecksum, b: PartialChecksum | BucketChecksum | null): BucketChecksum;
|
|
42
|
+
export declare function addPartialChecksums(bucket: string, a: BucketChecksum | null, b: PartialChecksum | BucketChecksum | null): PartialChecksum | BucketChecksum;
|
|
28
43
|
export declare function getUuidReplicaIdentityBson(tuple: sync_rules.ToastableSqliteRow, columns: storage.ColumnDescriptor[]): bson.UUID;
|
|
29
44
|
export declare function uuidForRowBson(row: sync_rules.SqliteRow): bson.UUID;
|
|
30
45
|
export declare function hasToastedValues(row: sync_rules.ToastableSqliteRow): boolean;
|
|
@@ -33,7 +48,7 @@ export declare function hasToastedValues(row: sync_rules.ToastableSqliteRow): bo
|
|
|
33
48
|
*
|
|
34
49
|
* If we don't store data, we assume we always have a complete row.
|
|
35
50
|
*/
|
|
36
|
-
export declare function isCompleteRow(storeData: boolean, row: sync_rules.ToastableSqliteRow): row is sync_rules.
|
|
51
|
+
export declare function isCompleteRow(storeData: boolean, row: sync_rules.ToastableSqliteRow): row is sync_rules.SqliteInputRow;
|
|
37
52
|
/**
|
|
38
53
|
* Reduce a bucket to the final state as stored on the client.
|
|
39
54
|
*
|
package/dist/util/utils.js
CHANGED
|
@@ -59,22 +59,46 @@ export function checksumsDiff(previous, current) {
|
|
|
59
59
|
export function addChecksums(a, b) {
|
|
60
60
|
return (a + b) & 0xffffffff;
|
|
61
61
|
}
|
|
62
|
+
export function isPartialChecksum(c) {
|
|
63
|
+
return 'partialChecksum' in c;
|
|
64
|
+
}
|
|
62
65
|
export function addBucketChecksums(a, b) {
|
|
63
|
-
|
|
64
|
-
|
|
66
|
+
const checksum = addPartialChecksums(a.bucket, a, b);
|
|
67
|
+
if (isPartialChecksum(checksum)) {
|
|
68
|
+
// Should not happen since a != null
|
|
69
|
+
throw new ServiceAssertionError('Expected full checksum');
|
|
65
70
|
}
|
|
66
|
-
|
|
71
|
+
return checksum;
|
|
72
|
+
}
|
|
73
|
+
export function addPartialChecksums(bucket, a, b) {
|
|
74
|
+
if (a != null && b != null) {
|
|
75
|
+
if (!isPartialChecksum(b)) {
|
|
76
|
+
// Replaces preState
|
|
77
|
+
return b;
|
|
78
|
+
}
|
|
79
|
+
// merge
|
|
67
80
|
return {
|
|
68
|
-
bucket
|
|
69
|
-
|
|
70
|
-
|
|
81
|
+
bucket,
|
|
82
|
+
checksum: addChecksums(a.checksum, b.partialChecksum),
|
|
83
|
+
count: a.count + b.partialCount
|
|
71
84
|
};
|
|
72
85
|
}
|
|
86
|
+
else if (a != null) {
|
|
87
|
+
return {
|
|
88
|
+
bucket,
|
|
89
|
+
checksum: a.checksum,
|
|
90
|
+
count: a.count
|
|
91
|
+
};
|
|
92
|
+
}
|
|
93
|
+
else if (b != null) {
|
|
94
|
+
return b;
|
|
95
|
+
}
|
|
73
96
|
else {
|
|
97
|
+
// No data found (may still have a previously-cached checksum).
|
|
74
98
|
return {
|
|
75
|
-
bucket
|
|
76
|
-
|
|
77
|
-
|
|
99
|
+
bucket,
|
|
100
|
+
partialChecksum: 0,
|
|
101
|
+
partialCount: 0
|
|
78
102
|
};
|
|
79
103
|
}
|
|
80
104
|
}
|
package/dist/util/utils.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/util/utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/util/utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAK7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AA2B1E,MAAM,CAAC,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAEnE,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,EAAU,EAAE,IAAY;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC7B,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,UAAU,SAAS,EAAE,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC7B,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAgB;IACrD,6EAA6E;IAC7E,6CAA6C;IAC7C,IAAI,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,EAAE,KAAK,OAAO,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAqB,EAAE,OAAoB;IACvE,mBAAmB;IACnB,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAElD,KAAK,IAAI,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YACd,QAAQ;YACR,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACjE,UAAU;gBACV,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,cAAc,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC;QAC5C,cAAc,EAAE,CAAC,GAAG,QAAQ,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAmC;IACnE,OAAO,iBAAiB,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,CAAiB,EAAE,CAA0C;IAC9F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,oCAAoC;QACpC,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,CAAwB,EACxB,CAA0C;IAE1C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1B,oBAAoB;YACpB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,QAAQ;QACR,OAAO;YACL,MAAM;YACN,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,eAAe,CAAC;YACrD,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,YAAY;SAChC,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,OAAO;YACL,MAAM;YACN,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;SAAM,CAAC;QACN,+DAA+D;QAC/D,OAAO;YACL,MAAM;YACN,eAAe,EAAE,CAAC;YAClB,YAAY,EAAE,CAAC;SAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAoC,EACpC,OAAmC;IAEnC,IAAI,MAAM,GAAwB,EAAE,CAAC;IACrC,KAAK,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAAoC,EACpC,OAAmC;IAEnC,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACxB,gDAAgD;QAChD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE1D,OAAO,cAAc,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAyB;IACtD,+EAA+E;IAC/E,4EAA4E;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAkC;IACjE,KAAK,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAkB,EAClB,GAAkC;IAElC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,gDAAgD;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,UAAwB;IACnD,IAAI,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACvB,IAAI,EAAE,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,QAAQ,EAAE,CAAC;gBACb,aAAa,GAAG,YAAY,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAkB,CAAC,CAAC;YAC3E,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC;aAAM,IAAI,EAAE,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,QAAQ,EAAE,CAAC;gBACb,aAAa,GAAG,YAAY,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAkB,CAAC,CAAC;YAC3E,CAAC;YACD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,aAAa,GAAG,YAAY,CAAC,aAAa,EAAE,EAAE,CAAC,QAAkB,CAAC,CAAC;QACrE,CAAC;aAAM,IAAI,EAAE,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC;YAC5B,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,aAAa,GAAG,EAAE,CAAC,QAAkB,CAAC;QACxC,CAAC;aAAM,IAAI,EAAE,CAAC,EAAE,IAAI,MAAM,EAAE,CAAC;YAC3B,aAAa,GAAG,YAAY,CAAC,aAAa,EAAE,EAAE,CAAC,QAAkB,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAI,UAAU,GAAiB;QAC7B,wDAAwD;QACxD,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE;QACpD,GAAG,IAAI;KACR,CAAC;IAEF,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,MAAiD;IAC/E,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,IAAI,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QACxB,+CAA+C;QAC/C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,OAAO,KAAK,IAAI,QAAQ,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,OAAO,KAAK,IAAI,QAAQ,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,OAAO,KAAK,IAAI,QAAQ,EAAE,CAAC;YACpC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACvB,CAAC;aAAM,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;YACvC,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
|
package/package.json
CHANGED
|
@@ -5,17 +5,17 @@
|
|
|
5
5
|
"publishConfig": {
|
|
6
6
|
"access": "public"
|
|
7
7
|
},
|
|
8
|
-
"version": "1.
|
|
8
|
+
"version": "1.15.0",
|
|
9
9
|
"main": "dist/index.js",
|
|
10
|
-
"license": "FSL-1.1-
|
|
10
|
+
"license": "FSL-1.1-ALv2",
|
|
11
11
|
"type": "module",
|
|
12
12
|
"dependencies": {
|
|
13
13
|
"@js-sdsl/ordered-set": "^4.4.2",
|
|
14
|
-
"@opentelemetry/api": "
|
|
15
|
-
"@opentelemetry/exporter-metrics-otlp-http": "^0.
|
|
16
|
-
"@opentelemetry/exporter-prometheus": "^0.
|
|
17
|
-
"@opentelemetry/resources": "^
|
|
18
|
-
"@opentelemetry/sdk-metrics": "
|
|
14
|
+
"@opentelemetry/api": "^1.9.0",
|
|
15
|
+
"@opentelemetry/exporter-metrics-otlp-http": "^0.203.0",
|
|
16
|
+
"@opentelemetry/exporter-prometheus": "^0.203.0",
|
|
17
|
+
"@opentelemetry/resources": "^2.0.1",
|
|
18
|
+
"@opentelemetry/sdk-metrics": "^2.0.1",
|
|
19
19
|
"async": "^3.2.4",
|
|
20
20
|
"async-mutex": "^0.5.0",
|
|
21
21
|
"bson": "^6.10.3",
|
|
@@ -26,23 +26,25 @@
|
|
|
26
26
|
"jose": "^4.15.1",
|
|
27
27
|
"lodash": "^4.17.21",
|
|
28
28
|
"lru-cache": "^10.2.2",
|
|
29
|
+
"negotiator": "^1.0.0",
|
|
29
30
|
"node-fetch": "^3.3.2",
|
|
30
31
|
"ts-codec": "^1.3.0",
|
|
31
32
|
"uri-js": "^4.4.1",
|
|
32
33
|
"uuid": "^11.1.0",
|
|
33
34
|
"winston": "^3.13.0",
|
|
34
35
|
"yaml": "^2.3.2",
|
|
35
|
-
"@powersync/
|
|
36
|
-
"@powersync/service-
|
|
37
|
-
"@powersync/service-
|
|
38
|
-
"@powersync/service-
|
|
39
|
-
"@powersync/
|
|
36
|
+
"@powersync/service-jsonbig": "0.17.11",
|
|
37
|
+
"@powersync/service-rsocket-router": "0.2.0",
|
|
38
|
+
"@powersync/service-sync-rules": "0.29.0",
|
|
39
|
+
"@powersync/service-types": "0.13.0",
|
|
40
|
+
"@powersync/lib-services-framework": "0.7.3"
|
|
40
41
|
},
|
|
41
42
|
"devDependencies": {
|
|
42
43
|
"@types/async": "^3.2.24",
|
|
44
|
+
"@types/negotiator": "^0.6.4",
|
|
43
45
|
"@types/lodash": "^4.17.5",
|
|
44
|
-
"fastify": "4.
|
|
45
|
-
"fastify-plugin": "^
|
|
46
|
+
"fastify": "^5.4.0",
|
|
47
|
+
"fastify-plugin": "^5.0.1"
|
|
46
48
|
},
|
|
47
49
|
"scripts": {
|
|
48
50
|
"build": "tsc -b",
|
package/src/api/api-metrics.ts
CHANGED
|
@@ -12,6 +12,12 @@ export function createCoreAPIMetrics(engine: MetricsEngine): void {
|
|
|
12
12
|
unit: 'bytes'
|
|
13
13
|
});
|
|
14
14
|
|
|
15
|
+
engine.createCounter({
|
|
16
|
+
name: APIMetric.DATA_SENT_BYTES,
|
|
17
|
+
description: 'Size of data sent to clients, after compression if applicable',
|
|
18
|
+
unit: 'bytes'
|
|
19
|
+
});
|
|
20
|
+
|
|
15
21
|
engine.createCounter({
|
|
16
22
|
name: APIMetric.OPERATIONS_SYNCED,
|
|
17
23
|
description: 'Number of operations synced'
|
package/src/api/diagnostics.ts
CHANGED
|
@@ -105,7 +105,7 @@ export async function getSyncRulesStatus(
|
|
|
105
105
|
const source: SourceTableInterface = {
|
|
106
106
|
connectionTag: tag,
|
|
107
107
|
schema: pattern.schema,
|
|
108
|
-
|
|
108
|
+
name: pattern.tablePattern
|
|
109
109
|
};
|
|
110
110
|
const syncData = rules.tableSyncsData(source);
|
|
111
111
|
const syncParameters = rules.tableSyncsParameters(source);
|
|
@@ -134,6 +134,38 @@ export async function getSyncRulesStatus(
|
|
|
134
134
|
})
|
|
135
135
|
);
|
|
136
136
|
|
|
137
|
+
if (live_status && status?.active) {
|
|
138
|
+
// Check replication lag for active sync rules.
|
|
139
|
+
// Right now we exclude mysql, since it we don't have consistent keepalives for it.
|
|
140
|
+
if (sync_rules.last_checkpoint_ts == null && sync_rules.last_keepalive_ts == null) {
|
|
141
|
+
errors.push({
|
|
142
|
+
level: 'warning',
|
|
143
|
+
message: 'No checkpoint found, cannot calculate replication lag'
|
|
144
|
+
});
|
|
145
|
+
} else {
|
|
146
|
+
const lastTime = Math.max(
|
|
147
|
+
sync_rules.last_checkpoint_ts?.getTime() ?? 0,
|
|
148
|
+
sync_rules.last_keepalive_ts?.getTime() ?? 0
|
|
149
|
+
);
|
|
150
|
+
const lagSeconds = Math.round((Date.now() - lastTime) / 1000);
|
|
151
|
+
// On idle instances, keepalive messages are only persisted every 60 seconds.
|
|
152
|
+
// So we use 5 minutes as a threshold for warnings, and 15 minutes for critical.
|
|
153
|
+
// The replication lag metric should give a more granular value, but that is not available directly
|
|
154
|
+
// in the API containers used for diagnostics, and this should give a good enough indication.
|
|
155
|
+
if (lagSeconds > 15 * 60) {
|
|
156
|
+
errors.push({
|
|
157
|
+
level: 'fatal',
|
|
158
|
+
message: `No replicated commit in more than ${lagSeconds}s`
|
|
159
|
+
});
|
|
160
|
+
} else if (lagSeconds > 5 * 60) {
|
|
161
|
+
errors.push({
|
|
162
|
+
level: 'warning',
|
|
163
|
+
message: `No replicated commit in more than ${lagSeconds}s`
|
|
164
|
+
});
|
|
165
|
+
}
|
|
166
|
+
}
|
|
167
|
+
}
|
|
168
|
+
|
|
137
169
|
return {
|
|
138
170
|
content: include_content ? sync_rules.sync_rules_content : undefined,
|
|
139
171
|
connections: [
|
package/src/auth/KeyStore.ts
CHANGED
|
@@ -4,7 +4,7 @@ import secs from '../util/secs.js';
|
|
|
4
4
|
import { JwtPayload } from './JwtPayload.js';
|
|
5
5
|
import { KeyCollector } from './KeyCollector.js';
|
|
6
6
|
import { KeyOptions, KeySpec, SUPPORTED_ALGORITHMS } from './KeySpec.js';
|
|
7
|
-
import { mapAuthError } from './utils.js';
|
|
7
|
+
import { debugKeyNotFound, mapAuthError, SupabaseAuthDetails, tokenDebugDetails } from './utils.js';
|
|
8
8
|
|
|
9
9
|
/**
|
|
10
10
|
* KeyStore to get keys and verify tokens.
|
|
@@ -39,6 +39,29 @@ export class KeyStore<Collector extends KeyCollector = KeyCollector> {
|
|
|
39
39
|
*/
|
|
40
40
|
collector: Collector;
|
|
41
41
|
|
|
42
|
+
/**
|
|
43
|
+
* For debug purposes only.
|
|
44
|
+
*
|
|
45
|
+
* This is very Supabase-specific, but we need the info on this level. For example,
|
|
46
|
+
* we want to detect cases where a Supabase token is used, but Supabase auth is not enabled
|
|
47
|
+
* (no Supabase collector configured).
|
|
48
|
+
*/
|
|
49
|
+
supabaseAuthDebug: {
|
|
50
|
+
/**
|
|
51
|
+
* This can be populated without jwksEnabled, but not the other way around.
|
|
52
|
+
*/
|
|
53
|
+
jwksDetails: SupabaseAuthDetails | null;
|
|
54
|
+
jwksEnabled: boolean;
|
|
55
|
+
/**
|
|
56
|
+
* This can be enabled without jwksDetails populated.
|
|
57
|
+
*/
|
|
58
|
+
sharedSecretEnabled: boolean;
|
|
59
|
+
} = {
|
|
60
|
+
jwksDetails: null,
|
|
61
|
+
jwksEnabled: false,
|
|
62
|
+
sharedSecretEnabled: false
|
|
63
|
+
};
|
|
64
|
+
|
|
42
65
|
constructor(collector: Collector) {
|
|
43
66
|
this.collector = collector;
|
|
44
67
|
}
|
|
@@ -131,7 +154,7 @@ export class KeyStore<Collector extends KeyCollector = KeyCollector> {
|
|
|
131
154
|
if (!key.matchesAlgorithm(header.alg)) {
|
|
132
155
|
throw new AuthorizationError(ErrorCode.PSYNC_S2101, `Unexpected token algorithm ${header.alg}`, {
|
|
133
156
|
configurationDetails: `Key kid: ${key.source.kid}, alg: ${key.source.alg}, kty: ${key.source.kty}`
|
|
134
|
-
//
|
|
157
|
+
// tokenDetails automatically populated higher up the stack
|
|
135
158
|
});
|
|
136
159
|
}
|
|
137
160
|
return key;
|
|
@@ -165,12 +188,13 @@ export class KeyStore<Collector extends KeyCollector = KeyCollector> {
|
|
|
165
188
|
logger.error(`Failed to refresh keys`, e);
|
|
166
189
|
});
|
|
167
190
|
|
|
191
|
+
const details = debugKeyNotFound(this, keys, token);
|
|
192
|
+
|
|
168
193
|
throw new AuthorizationError(
|
|
169
194
|
ErrorCode.PSYNC_S2101,
|
|
170
195
|
'Could not find an appropriate key in the keystore. The key is missing or no key matched the token KID',
|
|
171
196
|
{
|
|
172
|
-
|
|
173
|
-
// tokenDetails automatically populated later
|
|
197
|
+
...details
|
|
174
198
|
}
|
|
175
199
|
);
|
|
176
200
|
}
|
|
@@ -12,10 +12,11 @@ import {
|
|
|
12
12
|
ServiceError
|
|
13
13
|
} from '@powersync/lib-services-framework';
|
|
14
14
|
import { KeyCollector, KeyResult } from './KeyCollector.js';
|
|
15
|
-
import { KeySpec } from './KeySpec.js';
|
|
15
|
+
import { KeyOptions, KeySpec } from './KeySpec.js';
|
|
16
16
|
|
|
17
17
|
export type RemoteJWKSCollectorOptions = {
|
|
18
18
|
lookupOptions?: LookupOptions;
|
|
19
|
+
keyOptions?: KeyOptions;
|
|
19
20
|
};
|
|
20
21
|
|
|
21
22
|
/**
|
|
@@ -24,6 +25,7 @@ export type RemoteJWKSCollectorOptions = {
|
|
|
24
25
|
export class RemoteJWKSCollector implements KeyCollector {
|
|
25
26
|
private url: URL;
|
|
26
27
|
private agent: http.Agent;
|
|
28
|
+
private keyOptions: KeyOptions;
|
|
27
29
|
|
|
28
30
|
constructor(
|
|
29
31
|
url: string,
|
|
@@ -34,6 +36,7 @@ export class RemoteJWKSCollector implements KeyCollector {
|
|
|
34
36
|
} catch (e: any) {
|
|
35
37
|
throw new ServiceError(ErrorCode.PSYNC_S3102, `Invalid jwks_uri: ${JSON.stringify(url)} Details: ${e.message}`);
|
|
36
38
|
}
|
|
39
|
+
this.keyOptions = options?.keyOptions ?? {};
|
|
37
40
|
|
|
38
41
|
// We do support http here for self-hosting use cases.
|
|
39
42
|
// Management service restricts this to https for hosted versions.
|
|
@@ -123,7 +126,7 @@ export class RemoteJWKSCollector implements KeyCollector {
|
|
|
123
126
|
}
|
|
124
127
|
}
|
|
125
128
|
|
|
126
|
-
const key = await KeySpec.importKey(keyData);
|
|
129
|
+
const key = await KeySpec.importKey(keyData, this.keyOptions);
|
|
127
130
|
keys.push(key);
|
|
128
131
|
}
|
|
129
132
|
|
|
@@ -2,7 +2,7 @@ import * as jose from 'jose';
|
|
|
2
2
|
import { KeySpec, KeyOptions } from './KeySpec.js';
|
|
3
3
|
import { KeyCollector, KeyResult } from './KeyCollector.js';
|
|
4
4
|
|
|
5
|
-
const SUPABASE_KEY_OPTIONS: KeyOptions = {
|
|
5
|
+
export const SUPABASE_KEY_OPTIONS: KeyOptions = {
|
|
6
6
|
requiresAudience: ['authenticated'],
|
|
7
7
|
maxLifetimeSeconds: 86400 * 7 + 1200 // 1 week + 20 minutes margin
|
|
8
8
|
};
|
package/src/auth/utils.ts
CHANGED
|
@@ -1,5 +1,9 @@
|
|
|
1
1
|
import { AuthorizationError, ErrorCode } from '@powersync/lib-services-framework';
|
|
2
2
|
import * as jose from 'jose';
|
|
3
|
+
import * as urijs from 'uri-js';
|
|
4
|
+
import * as uuid from 'uuid';
|
|
5
|
+
import { KeySpec } from './KeySpec.js';
|
|
6
|
+
import { KeyStore } from './KeyStore.js';
|
|
3
7
|
|
|
4
8
|
export function mapJoseError(error: jose.errors.JOSEError, token: string): AuthorizationError {
|
|
5
9
|
const tokenDetails = tokenDebugDetails(token);
|
|
@@ -61,15 +65,28 @@ export function mapAuthConfigError(error: any): AuthorizationError {
|
|
|
61
65
|
* We use this to add details to our logs. We don't log the entire token, since it may for example
|
|
62
66
|
* a password incorrectly used as a token.
|
|
63
67
|
*/
|
|
64
|
-
function tokenDebugDetails(token: string): string {
|
|
68
|
+
export function tokenDebugDetails(token: string): string {
|
|
69
|
+
return parseTokenDebug(token).description;
|
|
70
|
+
}
|
|
71
|
+
|
|
72
|
+
function parseTokenDebug(token: string) {
|
|
65
73
|
try {
|
|
66
74
|
// For valid tokens, we return the header and payload
|
|
67
75
|
const header = jose.decodeProtectedHeader(token);
|
|
68
76
|
const payload = jose.decodeJwt(token);
|
|
69
|
-
|
|
77
|
+
const isSupabase = typeof payload.iss == 'string' && payload.iss.includes('supabase.co');
|
|
78
|
+
const isSharedSecret = isSupabase && header.alg === 'HS256';
|
|
79
|
+
|
|
80
|
+
return {
|
|
81
|
+
header,
|
|
82
|
+
payload,
|
|
83
|
+
isSupabase,
|
|
84
|
+
isSharedSecret: isSharedSecret,
|
|
85
|
+
description: `<header: ${JSON.stringify(header)} payload: ${JSON.stringify(payload)}>`
|
|
86
|
+
};
|
|
70
87
|
} catch (e) {
|
|
71
88
|
// Token fails to parse. Return some details.
|
|
72
|
-
return invalidTokenDetails(token);
|
|
89
|
+
return { description: invalidTokenDetails(token) };
|
|
73
90
|
}
|
|
74
91
|
}
|
|
75
92
|
|
|
@@ -100,3 +117,106 @@ function invalidTokenDetails(token: string): string {
|
|
|
100
117
|
|
|
101
118
|
return `<invalid JWT, length=${token.length}>`;
|
|
102
119
|
}
|
|
120
|
+
|
|
121
|
+
export interface SupabaseAuthDetails {
|
|
122
|
+
projectId: string;
|
|
123
|
+
url: string;
|
|
124
|
+
hostname: string;
|
|
125
|
+
}
|
|
126
|
+
|
|
127
|
+
export function getSupabaseJwksUrl(connection: any): SupabaseAuthDetails | null {
|
|
128
|
+
if (connection == null) {
|
|
129
|
+
return null;
|
|
130
|
+
} else if (connection.type != 'postgresql') {
|
|
131
|
+
return null;
|
|
132
|
+
}
|
|
133
|
+
|
|
134
|
+
let hostname: string | undefined = connection.hostname;
|
|
135
|
+
if (hostname == null && typeof connection.uri == 'string') {
|
|
136
|
+
hostname = urijs.parse(connection.uri).host;
|
|
137
|
+
}
|
|
138
|
+
if (hostname == null) {
|
|
139
|
+
return null;
|
|
140
|
+
}
|
|
141
|
+
|
|
142
|
+
const match = /db.(\w+).supabase.co/.exec(hostname);
|
|
143
|
+
if (match == null) {
|
|
144
|
+
return null;
|
|
145
|
+
}
|
|
146
|
+
const projectId = match[1];
|
|
147
|
+
|
|
148
|
+
return { projectId, hostname, url: `https://${projectId}.supabase.co/auth/v1/.well-known/jwks.json` };
|
|
149
|
+
}
|
|
150
|
+
|
|
151
|
+
export function debugKeyNotFound(
|
|
152
|
+
keyStore: KeyStore,
|
|
153
|
+
keys: KeySpec[],
|
|
154
|
+
token: string
|
|
155
|
+
): { configurationDetails: string; tokenDetails: string } {
|
|
156
|
+
const knownKeys = keys.map((key) => key.description).join(', ');
|
|
157
|
+
const td = parseTokenDebug(token);
|
|
158
|
+
const tokenDetails = td.description;
|
|
159
|
+
const configuredSupabase = keyStore.supabaseAuthDebug;
|
|
160
|
+
|
|
161
|
+
// Cases to check:
|
|
162
|
+
// 1. Is Supabase token, but supabase auth not enabled.
|
|
163
|
+
// 2. Is Supabase HS256 token, but no secret configured.
|
|
164
|
+
// 3. Is Supabase singing key token, but no Supabase signing keys configured.
|
|
165
|
+
// 4. Supabase project id mismatch.
|
|
166
|
+
|
|
167
|
+
if (td.isSharedSecret) {
|
|
168
|
+
// Supabase HS256 token
|
|
169
|
+
// UUID: HS256 (Shared Secret)
|
|
170
|
+
// Other: Legacy HS256 (Shared Secret)
|
|
171
|
+
// Not a big difference between the two other than terminology used on Supabase.
|
|
172
|
+
const isLegacy = uuid.validate(td.header.kid) ? false : true;
|
|
173
|
+
const addMessage =
|
|
174
|
+
configuredSupabase.jwksEnabled && !isLegacy
|
|
175
|
+
? ' Use asymmetric keys on Supabase (RSA or ECC) to allow automatic key retrieval.'
|
|
176
|
+
: '';
|
|
177
|
+
if (!configuredSupabase.sharedSecretEnabled) {
|
|
178
|
+
return {
|
|
179
|
+
configurationDetails: `Token is a Supabase ${isLegacy ? 'Legacy ' : ''}HS256 (Shared Secret) token, but Supabase JWT secret is not configured.${addMessage}`,
|
|
180
|
+
tokenDetails
|
|
181
|
+
};
|
|
182
|
+
} else {
|
|
183
|
+
return {
|
|
184
|
+
// This is an educated guess
|
|
185
|
+
configurationDetails: `Token is a Supabase ${isLegacy ? 'Legacy ' : ''}HS256 (Shared Secret) token, but configured Supabase JWT secret does not match.${addMessage}`,
|
|
186
|
+
tokenDetails
|
|
187
|
+
};
|
|
188
|
+
}
|
|
189
|
+
} else if (td.isSupabase) {
|
|
190
|
+
// Supabase JWT Signing Keys
|
|
191
|
+
if (!configuredSupabase.jwksEnabled) {
|
|
192
|
+
if (configuredSupabase.jwksDetails != null) {
|
|
193
|
+
return {
|
|
194
|
+
configurationDetails: `Token uses Supabase JWT Signing Keys, but Supabase Auth is not enabled`,
|
|
195
|
+
tokenDetails
|
|
196
|
+
};
|
|
197
|
+
} else {
|
|
198
|
+
return {
|
|
199
|
+
configurationDetails: `Token uses Supabase JWT Signing Keys, but no Supabase connection is configured`,
|
|
200
|
+
tokenDetails
|
|
201
|
+
};
|
|
202
|
+
}
|
|
203
|
+
} else if (configuredSupabase.jwksDetails != null) {
|
|
204
|
+
const configuredProjectId = configuredSupabase.jwksDetails.projectId;
|
|
205
|
+
const issuer = td.payload.iss as string; // Is a string since since isSupabase is true
|
|
206
|
+
if (!issuer.includes(configuredProjectId)) {
|
|
207
|
+
return {
|
|
208
|
+
configurationDetails: `Supabase project id mismatch. Expected project: ${configuredProjectId}, got issuer: ${issuer}`,
|
|
209
|
+
tokenDetails
|
|
210
|
+
};
|
|
211
|
+
} else {
|
|
212
|
+
// Project id matches, but no matching keys found
|
|
213
|
+
return {
|
|
214
|
+
configurationDetails: `Supabase signing keys configured, but no matching keys found. Known keys: ${knownKeys}`,
|
|
215
|
+
tokenDetails
|
|
216
|
+
};
|
|
217
|
+
}
|
|
218
|
+
}
|
|
219
|
+
}
|
|
220
|
+
|
|
221
|
+
return { configurationDetails: `Known keys: ${knownKeys}`, tokenDetails: tokenDebugDetails(token) };
|
|
222
|
+
}
|
|
@@ -59,7 +59,15 @@ export function registerCompactAction(program: Command) {
|
|
|
59
59
|
return;
|
|
60
60
|
}
|
|
61
61
|
logger.info('Performing compaction...');
|
|
62
|
-
|
|
62
|
+
if (buckets != null) {
|
|
63
|
+
await active.compact({
|
|
64
|
+
memoryLimitMB: COMPACT_MEMORY_LIMIT_MB,
|
|
65
|
+
compactBuckets: buckets,
|
|
66
|
+
compactParameterData: false
|
|
67
|
+
});
|
|
68
|
+
} else {
|
|
69
|
+
await active.compact({ memoryLimitMB: COMPACT_MEMORY_LIMIT_MB, compactParameterData: true });
|
|
70
|
+
}
|
|
63
71
|
logger.info('Successfully compacted storage.');
|
|
64
72
|
} catch (e) {
|
|
65
73
|
logger.error(`Failed to compact: ${e.toString()}`);
|