@protobase/server 0.49.2 → 0.50.1

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.49.2";
+var version = "0.50.1";
 //#endregion
 export { version };

package/dist/realtime/channel-access.js

@@ -0,0 +1,61 @@
+import { isDatabaseError } from "../error-handler.js";
+import { writeTransaction } from "../transactions.js";
+import { callerSettings } from "../rest/caller-settings.js";
+import { sql } from "kysely";
+import { randomUUID } from "node:crypto";
+//#region src/realtime/channel-access.ts
+const insufficientPrivilege = "42501";
+/**
+* Supabase Realtime Authorization: the row security policies on `realtime.messages` decide what a caller may do on a
+* private channel's topic, as Supabase's Realtime checks them. Each check runs in a transaction of its own, under a
+* savepoint it rolls back, so nothing it inserts stays. It sets the caller's role and claims as `/api/sb/rest/v1` does,
+* and the topic, without its `realtime:` prefix, in `realtime.topic`, which `realtime.topic()` reads. A database
+* without `realtime.messages` allows nothing.
+*/
+const channelAccess = ({ db, statementTimeoutMs }) => {
+	const probe = (denied, run) => writeTransaction(db, statementTimeoutMs, async (trx) => {
+		const { rows } = await sql`select to_regclass('realtime.messages') is not null as found`.execute(trx);
+		if (!rows[0].found) return denied;
+		await sql`savepoint access_probe`.execute(trx);
+		const result = await run(trx);
+		await sql`rollback to savepoint access_probe`.execute(trx);
+		return result;
+	});
+	const actAs = (trx, caller, topic) => {
+		const settings = {
+			role: "none",
+			"request.jwt.claim.sub": "",
+			...callerSettings(caller),
+			"realtime.topic": topic
+		};
+		return sql`select ${sql.join(Object.entries(settings).map(([name, value]) => sql`set_config(${name}, ${value}, true)`))}`.execute(trx);
+	};
+	return {
+		/**
+		* Whether the caller may receive each extension's messages on the topic: as the connection's own role, which must
+		* own `realtime.messages` or bypass its policies, it inserts a message of each, then selects them as the caller.
+		*/
+		read: (caller, topic, extensions) => probe(/* @__PURE__ */ new Map(), async (trx) => {
+			const probes = extensions.map((extension) => ({
+				id: randomUUID(),
+				extension
+			}));
+			await sql`insert into realtime.messages (id, topic, extension, private)
+          select id, ${topic}, extension, true from jsonb_to_recordset(${JSON.stringify(probes)}::jsonb) as p(id uuid, extension text)`.execute(trx);
+			await actAs(trx, caller, topic);
+			const { rows } = await sql`select id::text as id from realtime.messages where id = any(${probes.map((probe) => probe.id)}::uuid[])`.execute(trx);
+			const seen = new Set(rows.map((row) => row.id));
+			return new Map(probes.map((probe) => [probe.extension, seen.has(probe.id)]));
+		}),
+		/** Whether the caller may send the extension's messages on the topic: whether it may insert one. */
+		write: (caller, topic, extension) => probe(false, async (trx) => {
+			await actAs(trx, caller, topic);
+			return sql`insert into realtime.messages (topic, extension, private) values (${topic}, ${extension}, true)`.execute(trx).then(() => true, (error) => {
+				if (isDatabaseError(error) && error.code === insufficientPrivilege) return false;
+				throw error;
+			});
+		})
+	};
+};
+//#endregion
+export { channelAccess };

package/dist/realtime/channel-gate.js

@@ -0,0 +1,46 @@
+import { isDatabaseError } from "../error-handler.js";
+//#region src/realtime/channel-gate.ts
+/** A public channel, which may do anything. */
+const publicGate = {
+	authorize: async () => void 0,
+	hears: () => true,
+	mayWrite: async () => true
+};
+/** Supabase's message for a refusal to read the topic, which it names without its `realtime:` prefix. */
+const readRefusalText = (topic, refusal) => refusal === "revoked" ? `You no longer have permission to read from this Channel topic: ${subTopic(topic)}` : `You do not have permissions to read from this Channel topic: ${subTopic(topic)}`;
+const subTopic = (topic) => topic.replace(/^realtime:/, "");
+/**
+* A private channel, as Supabase Realtime Authorization checks one: its reads of broadcasts, and of presence when it
+* listens to presence, are checked by `authorize`, and each write the first time the channel sends it after that, and
+* kept until its next token. A policy that fails, such as one calling a function that raises, allows nothing, and its
+* error goes to `report`.
+*/
+const privateGate = (access, topic, presence, report) => {
+	let reads = /* @__PURE__ */ new Map();
+	let writes = /* @__PURE__ */ new Map();
+	const denied = (nothing) => (error) => {
+		if (!isDatabaseError(error)) throw error;
+		report(error);
+		return nothing;
+	};
+	return {
+		authorize: async (caller) => {
+			const before = reads;
+			reads = await access.read(caller, subTopic(topic), presence ? ["broadcast", "presence"] : ["broadcast"]).catch(denied(/* @__PURE__ */ new Map()));
+			writes = /* @__PURE__ */ new Map();
+			if (![...reads.values()].some(Boolean)) return "denied";
+			if ([...before].some(([extension, allowed]) => allowed && !reads.get(extension))) return "revoked";
+		},
+		hears: (extension) => reads.get(extension) === true,
+		mayWrite: async (caller, extension) => {
+			const known = writes.get(extension);
+			if (known !== void 0) return known;
+			return access.write(caller, subTopic(topic), extension).then((allowed) => {
+				writes.set(extension, allowed);
+				return allowed;
+			}, denied(false));
+		}
+	};
+};
+//#endregion
+export { privateGate, publicGate, readRefusalText };

package/dist/realtime/realtime-app.js

@@ -1,10 +1,12 @@
 import { changeChecker } from "./change-checker.js";
 import { changeHub } from "./change-hub.js";
+import { channelAccess } from "./channel-access.js";
 import { realtimeRoutes } from "./realtime-routes.js";
 //#region src/realtime/realtime-app.ts
 /**
 * `/api/sb/realtime/v1`: the `postgres_changes` of the live resources, each checked under the subscriber's role, claims and
-* the tables' RLS policies before it is sent, and broadcasts and presence between the channels of the process.
+* the tables' RLS policies before it is sent, and broadcasts and presence between the channels of the process, on a
+* private channel as the policies on `realtime.messages` allow.
 */
 const realtimeApp = ({ deps, feed, upgradeWebSocket, caller, report }) => {
 	const live = deps.registry.entries.filter((entry) => entry.model.live);
@@ -19,11 +21,16 @@ const realtimeApp = ({ deps, feed, upgradeWebSocket, caller, report }) => {
 		entry: (resource) => live.find((entry) => entry.name === resource),
 		report
 	});
+	const access = channelAccess({
+		db: deps.db,
+		statementTimeoutMs: deps.statementTimeoutMs
+	});
 	return realtimeRoutes({
 		upgradeWebSocket,
 		caller,
 		live,
 		hub,
+		access,
 		report
 	});
 };

package/dist/realtime/realtime-routes.js

@@ -16,7 +16,7 @@ const keyRequest = (apikey, token) => new Request("http://realtime.invalid/", {
 * key is refused before the upgrade, with 401. A socket whose raw socket is not one of npm `ws`, such as Bun's own `ws`
 * shim's, is closed at once with 1011, since its unsent bytes cannot be counted (`realtimeLimits.maxUnsentBytes`).
 */
-const realtimeRoutes = ({ upgradeWebSocket, caller, live, hub, report }) => {
+const realtimeRoutes = ({ upgradeWebSocket, caller, live, hub, access, report }) => {
 	const app = new Hono();
 	const broadcasts = broadcastHub();
 	const presences = presenceHub();
@@ -45,6 +45,7 @@ const realtimeRoutes = ({ upgradeWebSocket, caller, live, hub, report }) => {
 					hub,
 					broadcasts,
 					presences,
+					access,
 					nextId,
 					report
 				});

package/dist/realtime/realtime-socket.js

@@ -4,6 +4,7 @@ import { fixedWindow, fixedWindows } from "./fixed-window.js";
 import { realtimeLimits } from "./realtime-limits.js";
 import { decodeMessage, encodeMessage, reply } from "./phoenix-message.js";
 import { decodeBroadcastPush, encodeBroadcast, fitsFrame } from "./broadcast-frame.js";
+import { privateGate, publicGate, readRefusalText } from "./channel-gate.js";
 import { randomUUID } from "node:crypto";
 import { Buffer } from "node:buffer";
 //#region src/realtime/realtime-socket.ts
@@ -26,7 +27,8 @@ const refusal = (error) => {
 * One WebSocket of `/api/sb/realtime/v1`, speaking Phoenix channels as realtime-js expects: heartbeats, channel joins with
 * `postgres_changes` bindings and an access token, token refreshes on an open channel, broadcasts with their `self`
 * and `ack` options, presence tracking, and leaves. A channel's token ends it when it expires, unless a newer one came
-* first. Messages are handled one at a time, in order. Private channels are refused for now.
+* first. Messages are handled one at a time, in order. A private channel joins, hears, broadcasts and tracks presence
+* only as the policies on `realtime.messages` allow (see `privateGate`), checked again at each new token.
 *
 * It holds a client to `realtimeLimits`: a push over a rate, a channel over the cap or a presence meta too big gets an
 * error reply where Supabase would close the channel, and is not relayed. Rates count per socket, presence per socket
@@ -35,7 +37,7 @@ const refusal = (error) => {
 * earlier messages wait. A close, the client's or the server's, leaves every channel, a join still checking its token
 * included, and drops whatever is still queued.
 */
-const realtimeSocket = ({ vsn, send, buffered, close, resolve, live, hub, broadcasts, presences, nextId, report, idleMs = 6e4, now = Date.now }) => {
+const realtimeSocket = ({ vsn, send, buffered, close, resolve, live, hub, broadcasts, presences, access, nextId, report, idleMs = 6e4, now = Date.now }) => {
 	const channels = /* @__PURE__ */ new Map();
 	let queue = Promise.resolve();
 	let queuedMessages = 0;
@@ -71,6 +73,7 @@ const realtimeSocket = ({ vsn, send, buffered, close, resolve, live, hub, broadc
 		payload
 	});
 	const hear = (topic, channel, event, payload) => {
+		if (!channel.gate.hears("broadcast")) return;
 		if (vsn === "2.0.0") return deliver(encodeBroadcast(topic, event, payload));
 		if (payload instanceof ArrayBuffer) return;
 		toChannel(topic, channel, "broadcast", {
@@ -109,12 +112,16 @@ const realtimeSocket = ({ vsn, send, buffered, close, resolve, live, hub, broadc
 		if (!channels.has(message.topic) && channels.size >= realtimeLimits.channelsPerSocket) return push(reply(message, "error", { reason: "ChannelRateLimitReached: Too many channels" }));
 		leave(message.topic);
 		const config = isRecord(message.payload.config) ? message.payload.config : {};
-		if (config.private === true) return push(reply(message, "error", { reason: "Not implemented: private channels" }));
 		const broadcast = isRecord(config.broadcast) ? config.broadcast : {};
 		const presence = isRecord(config.presence) ? config.presence : {};
+		const listens = presence.enabled === true;
+		const gate = config.private === true ? privateGate(access, message.topic, listens, report) : publicGate;
 		const caller = await resolve(tokenOf(message.payload)).catch(refusal);
 		if (!open) return;
 		if (typeof caller === "string") return push(reply(message, "error", { reason: caller }));
+		const refused = await gate.authorize(caller);
+		if (!open) return;
+		if (refused) return push(reply(message, "error", { reason: `Unauthorized: ${readRefusalText(message.topic, refused)}` }));
 		const parsed = parseBindings(config.postgres_changes, live, nextId);
 		if (typeof parsed === "string") return push(reply(message, "error", { reason: parsed }));
 		const { topic } = message;
@@ -123,10 +130,11 @@ const realtimeSocket = ({ vsn, send, buffered, close, resolve, live, hub, broadc
 			receive: (event, payload) => hear(topic, channel, event, payload)
 		};
 		const key = typeof presence.key === "string" && presence.key !== "" ? presence.key : randomUUID();
-		const listens = presence.enabled === true;
 		const seat = presences.join(topic, {
 			key,
-			listens,
+			get listens() {
+				return listens && gate.hears("presence");
+			},
 			receive: (diff) => toChannel(topic, channel, "presence_diff", diff)
 		});
 		const offBroadcast = broadcasts.join(topic, member);
@@ -138,6 +146,7 @@ const realtimeSocket = ({ vsn, send, buffered, close, resolve, live, hub, broadc
 		const channel = {
 			joinRef: message.joinRef,
 			caller,
+			gate,
 			ack: broadcast.ack === true,
 			member,
 			presence: seat,
@@ -150,7 +159,7 @@ const realtimeSocket = ({ vsn, send, buffered, close, resolve, live, hub, broadc
 		channels.set(topic, channel);
 		expireAt(topic, channel);
 		push(reply(message, "ok", { postgres_changes: parsed.replies }));
-		if (listens) toChannel(topic, channel, "presence_state", seat.state());
+		if (listens && gate.hears("presence")) toChannel(topic, channel, "presence_state", seat.state());
 		if (parsed.bindings.length > 0) toChannel(message.topic, channel, "system", {
 			extension: "postgres_changes",
 			status: "ok",
@@ -163,25 +172,37 @@ const realtimeSocket = ({ vsn, send, buffered, close, resolve, live, hub, broadc
 		const channel = channels.get(message.topic);
 		if (!channel) return;
 		if (typeof caller === "string") return end(message.topic, caller);
+		const refused = await channel.gate.authorize(caller);
+		if (channels.get(message.topic) !== channel) return;
+		if (refused) return end(message.topic, readRefusalText(message.topic, refused));
 		channel.caller = caller;
 		expireAt(message.topic, channel);
 	};
-	const sendBroadcast = (message, channel) => {
+	const sendBroadcast = async (message, channel) => {
 		const { event, payload } = message.payload;
 		if (!events()) return push(reply(message, "error", { reason: tooFast }));
 		if (typeof event !== "string") return push(reply(message, "error", { reason: "A broadcast needs an event" }));
 		if (!fitsFrame(message.topic) || !fitsFrame(event)) return push(reply(message, "error", { reason: "A broadcast topic and event are at most 255 bytes each" }));
+		const allowed = await channel.gate.mayWrite(channel.caller, "broadcast");
+		if (channels.get(message.topic) !== channel) return;
+		if (!allowed) return push(reply(message, "error", { error: "unauthorized" }));
 		if (!broadcasts.send(message.topic, channel.member, event, payload)) return push(reply(message, "error", { reason: `${tooFast} on this topic` }));
 		if (channel.ack) push(reply(message, "ok", {}));
 	};
-	const updatePresence = (message, channel) => {
+	const updatePresence = async (message, channel) => {
 		const { event, payload } = message.payload;
 		if (!events()) return push(reply(message, "error", { reason: tooFast }));
 		if (!presenceRate(message.topic)) return push(reply(message, "error", { reason: "Client presence rate limit exceeded" }));
-		if (event === "track" && isRecord(payload) && Buffer.byteLength(JSON.stringify(payload)) > realtimeLimits.maxPresenceBytes) return push(reply(message, "error", { reason: "Track message size exceeded" }));
-		if (event === "track" && isRecord(payload)) channel.presence.track(payload);
-		else if (event === "untrack") channel.presence.untrack();
-		else return push(reply(message, "error", { reason: "A presence message tracks an object or untracks" }));
+		if (event === "untrack") {
+			channel.presence.untrack();
+			return push(reply(message, "ok", {}));
+		}
+		if (event !== "track" || !isRecord(payload)) return push(reply(message, "error", { reason: "A presence message tracks an object or untracks" }));
+		if (Buffer.byteLength(JSON.stringify(payload)) > realtimeLimits.maxPresenceBytes) return push(reply(message, "error", { reason: "Track message size exceeded" }));
+		const allowed = await channel.gate.mayWrite(channel.caller, "presence");
+		if (channels.get(message.topic) !== channel) return;
+		if (!allowed) return push(reply(message, "error", {}));
+		channel.presence.track(payload);
 		push(reply(message, "ok", {}));
 	};
 	const handle = async (message) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.49.2",
+  "version": "0.50.1",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -40,9 +40,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.49.2",
-    "@protobase/query": "0.49.2",
-    "@protobase/schema": "0.49.2",
+    "@protobase/layout": "0.50.1",
+    "@protobase/query": "0.50.1",
+    "@protobase/schema": "0.50.1",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",