@protobase/server 0.55.9 → 0.55.10

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.55.9";
+var version = "0.55.10";
 //#endregion
 export { version };

package/dist/realtime/bounded-runner.js

@@ -0,0 +1,31 @@
+//#region src/realtime/bounded-runner.ts
+/**
+* Runs at most `concurrent` tasks at once, with at most `waiting` more in line; a task beyond those is refused rather
+* than queued, so the work never holds more than `concurrent` of what it uses, such as pooled connections.
+*/
+const boundedRunner = (concurrent, waiting) => {
+	let running = 0;
+	const line = [];
+	const next = () => {
+		running -= 1;
+		line.shift()?.();
+	};
+	return { 
+	/** The task's result, or `refused` when the line is full. */
+run: async (task) => {
+		if (running >= concurrent) {
+			if (line.length >= waiting) return { refused: true };
+			await new Promise((resolve) => line.push(resolve));
+		}
+		running += 1;
+		return task().then((value) => (next(), {
+			refused: false,
+			value
+		}), (error) => {
+			next();
+			throw error;
+		});
+	} };
+};
+//#endregion
+export { boundedRunner };

package/dist/realtime/change-checker.js

@@ -1,7 +1,10 @@
-import { readTransaction } from "../transactions.js";
+import { snapshotReadTransaction } from "../transactions.js";
 import { quoteIdent, tableSql } from "../changes/capture-sql.js";
 import { callerSettings } from "../rest/caller-settings.js";
 import { filterSql } from "./change-filter.js";
+import { filterChunks } from "./filter-chunks.js";
+import { evaluateFilters } from "./filter-evaluation.js";
+import { attempt } from "./savepoint-attempt.js";
 import { decodeKey, encodeKey } from "@protobase/schema/internal";
 import { sql } from "kysely";
 //#region src/realtime/change-checker.ts
@@ -16,18 +19,35 @@ const keyRows = (entry, keys) => {
 };
 const listed = (alias, columns) => sql.raw(columns.map((column) => `${alias}.${quoteIdent(column)}`).join(", "));
 const keyTexts = (alias, entry) => sql.raw(keyColumns(entry).map((column, index) => `${alias}.${quoteIdent(column)}::text as "k${index}"`).join(", "));
-const filterColumns = (alias, filters) => filters.length === 0 ? sql`` : sql`, ${sql.join(filters.map((conditions, index) => sql`${filterSql(alias, conditions)} as ${sql.ref(`f${index}`)}`))}`;
-const seen = (entry, filters, rows) => new Map(rows.map((row) => [encodeKey(keyColumns(entry).map((_, index) => row[`k${index}`])), {
+const filterColumns = (alias, filters, indexes) => indexes.length === 0 ? sql`` : sql`, ${sql.join(indexes.map((index) => sql`${filterSql(alias, filters[index])} as ${sql.ref(`f${index}`)}`))}`;
+const keyOf = (entry, row) => encodeKey(keyColumns(entry).map((_, index) => row[`k${index}`]));
+const seen = (entry, filters, rows) => new Map(rows.map((row) => [keyOf(entry, row), {
 	record: row.record ?? {},
 	oldRecord: row.old_record,
-	matches: filters.map((_, index) => row[`f${index}`] === true)
+	matches: filters.map(() => false)
 }]));
+const merge = (entry, into, rows, indexes) => {
+	for (const row of rows) {
+		const found = into.get(keyOf(entry, row));
+		if (found) for (const index of indexes) found.matches[index] = row[`f${index}`] === true;
+	}
+};
+const nothing = (columns = []) => ({
+	columns,
+	rows: /* @__PURE__ */ new Map(),
+	deleted: /* @__PURE__ */ new Map(),
+	failed: /* @__PURE__ */ new Set()
+});
 /**
-* Checks which changes callers may see, for every group in one read-only transaction: per group it sets the role and
-* claims as `/api/sb/rest/v1` does, then reads the current rows by key, so the table's RLS policies decide, and evaluates
-* each filter in Postgres, as the column's type compares. The transaction holds one pooled connection only while it
-* runs. A group whose check fails is checked again in a transaction of its own, so it costs only its own callers the
-* batch.
+* Checks which changes callers may see, for every group in one read-only transaction that reads one snapshot: per group
+* it sets the role and claims as `/api/sb/rest/v1` does, then reads the current rows by key, so the table's RLS policies
+* decide, and evaluates each filter in Postgres, as the column's type compares, at most `filterChunkLimits` filters per
+* query. The transaction holds one pooled connection only while it runs.
+*
+* Each query runs in a savepoint. A resource whose rows cannot be read even without filters, such as after a REVOKE,
+* shows its group nothing of that resource; a filter Postgres refuses fails alone (`ResourceView.failed`), found by
+* halving its chunk. Any other error, such as a lost connection, fails the transaction: each group is then checked
+* again in a transaction of its own, so it costs only its own callers the batch.
 */
 const changeChecker = ({ db, statementTimeoutMs, report }) => {
 	const columnCache = /* @__PURE__ */ new Map();
@@ -40,28 +60,59 @@ const changeChecker = ({ db, statementTimeoutMs, report }) => {
 		columnCache.set(`${entry.name}\0${role}`, rows);
 		return rows;
 	};
-	const view = async (trx, role, check) => {
-		const columns = await columnsOf(trx, check.entry, role);
-		const names = columns.map((column) => column.name);
-		if (!keyColumns(check.entry).every((column) => names.includes(column))) return {
-			columns,
-			rows: /* @__PURE__ */ new Map(),
-			deleted: /* @__PURE__ */ new Map()
-		};
+	const read = async (trx, names, check, indexes) => {
 		const table = sql.raw(tableSql(check.entry.model));
 		const key = listed("t", keyColumns(check.entry));
-		const rows = check.keys.length === 0 ? [] : (await sql`select ${keyTexts("t", check.entry)}, (select to_jsonb(v) from (select ${listed("t", names)}) v) as record,
-              (select to_jsonb(v) from (select ${key}) v) as old_record${filterColumns("t", check.filters)}
-              from ${table} t where (${key}) in (select ${listed("k", keyColumns(check.entry))} from jsonb_populate_recordset(null::${table}, ${keyRows(check.entry, check.keys)}::jsonb) k)`.execute(trx)).rows;
-		const deleted = check.deleted.length === 0 ? [] : (await sql`select ${keyTexts("k", check.entry)}, (select to_jsonb(v) from (select ${listed("k", keyColumns(check.entry))}) v) as old_record${filterColumns("k", check.filters)}
-              from jsonb_populate_recordset(null::${table}, ${keyRows(check.entry, check.deleted)}::jsonb) k`.execute(trx)).rows;
+		return {
+			rows: check.keys.length === 0 ? [] : (await sql`select ${keyTexts("t", check.entry)}, (select to_jsonb(v) from (select ${listed("t", names)}) v) as record,
+              (select to_jsonb(v) from (select ${key}) v) as old_record${filterColumns("t", check.filters, indexes)}
+              from ${table} t where (${key}) in (select ${listed("k", keyColumns(check.entry))} from jsonb_populate_recordset(null::${table}, ${keyRows(check.entry, check.keys)}::jsonb) k)`.execute(trx)).rows,
+			deleted: check.deleted.length === 0 ? [] : (await sql`select ${keyTexts("k", check.entry)}, (select to_jsonb(v) from (select ${listed("k", keyColumns(check.entry))}) v) as old_record${filterColumns("k", check.filters, indexes)}
+              from jsonb_populate_recordset(null::${table}, ${keyRows(check.entry, check.deleted)}::jsonb) k`.execute(trx)).rows
+		};
+	};
+	const view = async (trx, role, check) => {
+		const cacheKey = `${check.entry.name}\0${role}`;
+		let columns = await columnsOf(trx, check.entry, role);
+		const keyed = () => keyColumns(check.entry).every((column) => columns.some(({ name }) => name === column));
+		if (!keyed()) return nothing(columns);
+		const [first = [], ...rest] = filterChunks(check.filters);
+		let base = await attempt(trx, "change_check", () => read(trx, columns.map(({ name }) => name), check, first));
+		const failedFirst = base.ok ? void 0 : first;
+		if (!base.ok) {
+			columnCache.delete(cacheKey);
+			columns = await columnsOf(trx, check.entry, role);
+			if (!keyed()) return nothing(columns);
+			base = await attempt(trx, "change_check", () => read(trx, columns.map(({ name }) => name), check, []));
+		}
+		if (!base.ok) {
+			columnCache.delete(cacheKey);
+			report(base.error);
+			return nothing(columns);
+		}
+		const names = columns.map(({ name }) => name);
+		const rows = seen(check.entry, check.filters, base.value.rows);
+		const deleted = seen(check.entry, check.filters, base.value.deleted);
+		if (failedFirst === void 0) {
+			merge(check.entry, rows, base.value.rows, first);
+			merge(check.entry, deleted, base.value.deleted, first);
+		}
+		const failed = await evaluateFilters(rest, async (indexes) => {
+			const result = await attempt(trx, "change_check", () => read(trx, names, check, indexes));
+			if (result.ok) {
+				merge(check.entry, rows, result.value.rows, indexes);
+				merge(check.entry, deleted, result.value.deleted, indexes);
+			}
+			return result;
+		}, failedFirst);
 		return {
 			columns,
-			rows: seen(check.entry, check.filters, rows),
-			deleted: seen(check.entry, check.filters, deleted)
+			rows,
+			deleted,
+			failed
 		};
 	};
-	const checkGroups = (groups) => readTransaction(db, statementTimeoutMs, async (trx) => {
+	const checkGroups = (groups) => snapshotReadTransaction(db, statementTimeoutMs, async (trx) => {
 		const views = [];
 		for (const group of groups) {
 			const settings = {
@@ -77,22 +128,18 @@ const changeChecker = ({ db, statementTimeoutMs, report }) => {
 		}
 		return views;
 	});
-	const nothing = (group) => group.resources.map(() => ({
-		columns: [],
-		rows: /* @__PURE__ */ new Map(),
-		deleted: /* @__PURE__ */ new Map()
-	}));
+	const nothingOf = (group) => group.resources.map(() => nothing());
 	return async (groups) => {
 		if (groups.length === 0) return [];
 		return checkGroups(groups).catch(async (error) => {
 			if (groups.length === 1) {
 				report(error);
-				return [nothing(groups[0])];
+				return [nothingOf(groups[0])];
 			}
 			const views = [];
 			for (const group of groups) views.push(await checkGroups([group]).then((checked) => checked[0], (failed) => {
 				report(failed);
-				return nothing(group);
+				return nothingOf(group);
 			}));
 			return views;
 		});

package/dist/realtime/change-filter.js

@@ -79,10 +79,12 @@ const condition = (segment) => {
 		};
 	}
 	if (operator === "is" && !isKeyword.has(value)) return "invalid value for is filter: must be null, true, false, or unknown";
+	const unquoted = unquote(value);
+	if ((operator === "like" || operator === "ilike") && /(?:^|[^\\])(?:\\\\)*\\$/.test(unquoted)) return `invalid filter "${trimmed}": a like pattern must not end with an escape character`;
 	return {
 		column,
 		operator,
-		value: unquote(value),
+		value: unquoted,
 		negate
 	};
 };
@@ -92,6 +94,8 @@ const parseFilter = (filter) => {
 	const parsed = segments(filter.trim()).map(condition);
 	return parsed.find((item) => typeof item === "string") ?? parsed;
 };
+/** The bind parameters a filter's conditions take: one each, but none for `is`. */
+const filterParameters = (conditions) => conditions.filter((item) => item.operator !== "is").length;
 const conditionSql = (alias, { column, operator, value, negate }) => {
 	const target = sql.raw(`${alias}.${quoteIdent(column)}`);
 	const test = operator === "is" ? sql`${target} is ${sql.raw(value)}` : operator === "in" ? sql`${target} = any(${value})` : sql`${target} ${sql.raw(operators[operator])} ${value}`;
@@ -103,4 +107,4 @@ const conditionSql = (alias, { column, operator, value, negate }) => {
 */
 const filterSql = (alias, conditions) => conditions.length === 0 ? sql`true` : sql`coalesce(${sql.join(conditions.map((item) => conditionSql(alias, item)), sql` and `)}, false)`;
 //#endregion
-export { filterSql, parseFilter };
+export { filterParameters, filterSql, parseFilter };

package/dist/realtime/change-hub.js

@@ -1,15 +1,19 @@
 import { callerSettings } from "../rest/caller-settings.js";
 import { changePayload, eventOf } from "./change-payload.js";
 //#region src/realtime/change-hub.ts
+/** Why a channel ends when Postgres refuses its filter at a check: it names that filter only. */
+const failedFilterText = (filter) => `Unable to listen to changes with the filter "${filter}": the database refused it`;
 const unique = (items) => [...new Set(items)];
 const watches = (binding, entry) => binding.entries.includes(entry);
 const groupChecks = (sinks, changes) => unique(changes.map((change) => change.entry)).map((entry) => {
 	const bindings = sinks.flatMap((sink) => sink.bindings).filter((binding) => watches(binding, entry));
 	const of = changes.filter((change) => change.entry === entry);
+	const filters = [...new Map(bindings.filter((binding) => binding.conditions.length > 0).map((binding) => [binding.filter, binding.conditions])).entries()];
 	return {
 		entry,
 		bindings,
-		filters: [...new Map(bindings.filter((binding) => binding.conditions.length > 0).map((binding) => [binding.filter, binding.conditions])).entries()],
+		filters,
+		filterIndex: new Map(filters.map(([filter], index) => [filter, index])),
 		keys: unique(of.filter((change) => change.type !== "DELETE").map((change) => change.notice.key)),
 		deleted: unique(of.filter((change) => change.type === "DELETE").map((change) => change.notice.key))
 	};
@@ -18,7 +22,7 @@ const groupChecks = (sinks, changes) => unique(changes.map((change) => change.en
 * Where the open sockets of a process hear of changes: it follows the notice feed while any channel listens, and
 * checks each batch of notices for all channels at once, one batch at a time, so Realtime holds at most one pooled
 * connection per process, and only while a check runs. Channels whose callers have the same role and claims, such as a
-* user's tabs, are checked as one.
+* user's tabs, are checked as one. A channel one of whose filters Postgres refuses is removed and ended.
 */
 const changeHub = ({ feed, check, entry, report }) => {
 	const sinks = /* @__PURE__ */ new Set();
@@ -59,13 +63,31 @@ const changeHub = ({ feed, check, entry, report }) => {
 			const view = views[groupIndex][resourceIndex];
 			const row = (type === "DELETE" ? view.deleted : view.rows).get(notice.key);
 			if (!row) return;
-			const { filters } = checks[resourceIndex];
+			const { filterIndex } = checks[resourceIndex];
 			for (const sink of members) {
 				if (!sinks.has(sink)) continue;
-				const ids = sink.bindings.filter((binding) => watches(binding, changed) && (binding.event === "*" || binding.event === type)).filter((binding) => binding.conditions.length === 0 || row.matches[filters.findIndex(([filter]) => filter === binding.filter)]).map((binding) => binding.id);
+				const ids = sink.bindings.filter((binding) => watches(binding, changed) && (binding.event === "*" || binding.event === type)).filter((binding) => binding.conditions.length === 0 || row.matches[filterIndex.get(binding.filter)]).map((binding) => binding.id);
 				if (ids.length > 0) sink.send(changePayload(changed, notice, type, view.columns, row, ids));
 			}
 		});
+		planned.forEach(({ members, checks }, groupIndex) => {
+			checks.forEach(({ entry: checked, filters }, resourceIndex) => {
+				for (const index of views[groupIndex][resourceIndex].failed) {
+					const [filter] = filters[index];
+					for (const sink of members) {
+						if (!sinks.has(sink) || !sink.bindings.some((binding) => watches(binding, checked) && binding.filter === filter)) continue;
+						remove(sink);
+						sink.fail(failedFilterText(filter));
+					}
+				}
+			});
+		});
+	};
+	const remove = (sink) => {
+		sinks.delete(sink);
+		if (sinks.size > 0 || !subscription) return;
+		subscription.then((subscribed) => subscribed?.stop());
+		subscription = void 0;
 	};
 	const run = async () => {
 		running = true;
@@ -88,13 +110,8 @@ add: (sink) => {
 			report(error);
 			subscription = void 0;
 		});
-		return () => {
-			sinks.delete(sink);
-			if (sinks.size > 0 || !subscription) return;
-			subscription.then((subscribed) => subscribed?.stop());
-			subscription = void 0;
-		};
+		return () => remove(sink);
 	} };
 };
 //#endregion
-export { changeHub };
+export { changeHub, failedFilterText };

package/dist/realtime/filter-check.js

@@ -0,0 +1,70 @@
+import { readTransaction } from "../transactions.js";
+import { tableSql } from "../changes/capture-sql.js";
+import { isDatabaseError } from "../error-handler.js";
+import { callerSettings } from "../rest/caller-settings.js";
+import { filterSql } from "./change-filter.js";
+import { fitsOneQuery } from "./filter-chunks.js";
+import { isStatementError } from "./savepoint-attempt.js";
+import { boundedRunner } from "./bounded-runner.js";
+import { sql } from "kysely";
+//#region src/realtime/filter-check.ts
+/** Why a join or token refresh is refused when Postgres refuses one of its filters: it names the channel's own only. */
+const refusedFiltersText = (filters) => `Unable to subscribe to changes with given parameters: the database refused the filters [${filters.join(", ")}]`;
+const busyText = "Too many joins are being checked; try again";
+const regexOperators = {
+	match: "~",
+	imatch: "~*"
+};
+const collations = async (trx, entry, columns) => {
+	const { rows } = await sql`select a.attname as name, quote_ident(n.nspname) || '.' || quote_ident(c.collname) as collation
+    from pg_attribute a join pg_collation c on c.oid = a.attcollation join pg_namespace n on n.oid = c.collnamespace
+    where a.attrelid = to_regclass(${tableSql(entry.model)}) and a.attname = any(${[...columns]}) and not a.attisdropped`.execute(trx);
+	return new Map(rows.map((row) => [row.name, row.collation]));
+};
+const validate = async (trx, entry, bindings) => {
+	await sql`select ${sql.join(bindings.map((binding) => filterSql("t", binding.conditions)))} from ${sql.raw(tableSql(entry.model))} t where false`.execute(trx);
+	const patterns = bindings.flatMap((binding) => binding.conditions).filter((condition) => condition.operator === "match" || condition.operator === "imatch");
+	if (patterns.length === 0) return;
+	const collated = await collations(trx, entry, [...new Set(patterns.map((condition) => condition.column))]);
+	const probes = patterns.map(({ column, operator, value }) => {
+		const collation = collated.get(column);
+		const subject = collation === void 0 ? sql`''::text` : sql`''::text collate ${sql.raw(collation)}`;
+		return sql`${subject} ${sql.raw(regexOperators[operator])} ${value}`;
+	});
+	await sql`select ${sql.join(probes)}`.execute(trx);
+};
+/**
+* Whether Postgres takes the filters of a channel's bindings under `caller`, as Supabase checks them at join: the
+* refusal text when it does not, so that a filter that would fail a check never joins the callers it would be checked
+* with. One check runs at a time per process, and a few more wait, so joins never take the pooled connections that
+* deliver changes; a join beyond those is refused.
+*/
+const filterCheck = ({ db, statementTimeoutMs }) => {
+	const runner = boundedRunner(1, 32);
+	return async (caller, bindings) => {
+		const filtered = bindings.filter((binding) => binding.conditions.length > 0);
+		if (filtered.length === 0) return;
+		const filters = [...new Set(filtered.map((binding) => binding.filter))];
+		if (!filtered.every((binding) => fitsOneQuery(binding.conditions))) return refusedFiltersText(filters);
+		const settings = {
+			role: "none",
+			"request.jwt.claim.sub": "",
+			...callerSettings(caller)
+		};
+		const entries = [...new Set(filtered.flatMap((binding) => binding.entries))];
+		const checked = await runner.run(() => readTransaction(db, statementTimeoutMs, async (trx) => {
+			for (const entry of entries) await validate(trx, entry, filtered.filter((binding) => binding.entries.includes(entry)));
+			return true;
+		}, settings)).catch((error) => {
+			if (isStatementError(error) || isDatabaseError(error) && error.code === "57014") return {
+				refused: false,
+				value: false
+			};
+			throw error;
+		});
+		if (checked.refused) return busyText;
+		return checked.value ? void 0 : refusedFiltersText(filters);
+	};
+};
+//#endregion
+export { busyText, filterCheck, refusedFiltersText };

package/dist/realtime/filter-chunks.js

@@ -0,0 +1,35 @@
+import { filterParameters } from "./change-filter.js";
+//#region src/realtime/filter-chunks.ts
+/**
+* How many filters one query evaluates: one column each, well under Postgres's 1664 target-list entries with the key
+* columns and records beside them, and their bind parameters under the protocol's 65535 with the key list's one.
+*/
+const filterChunkLimits = {
+	columns: 1e3,
+	parameters: 6e4
+};
+/**
+* The filters split, in order, into runs of indexes that each fit one query. A filter that alone takes more
+* parameters than one query may hold throws: joins refuse it first (`fitsOneQuery`).
+*/
+const filterChunks = (filters, limits = filterChunkLimits) => {
+	const chunks = [];
+	let current = [];
+	let parameters = 0;
+	filters.forEach((conditions, index) => {
+		const needed = filterParameters(conditions);
+		if (needed > limits.parameters) throw new Error(`A filter of ${needed} parameters does not fit one query`);
+		if (current.length === limits.columns || parameters + needed > limits.parameters) {
+			chunks.push(current);
+			current = [];
+			parameters = 0;
+		}
+		current.push(index);
+		parameters += needed;
+	});
+	return current.length > 0 ? [...chunks, current] : chunks;
+};
+/** Whether a filter fits one query, so that a group's check can evaluate it. */
+const fitsOneQuery = (conditions) => filterParameters(conditions) <= filterChunkLimits.parameters;
+//#endregion
+export { filterChunkLimits, filterChunks, fitsOneQuery };

package/dist/realtime/filter-evaluation.js

@@ -0,0 +1,27 @@
+//#region src/realtime/filter-evaluation.ts
+/**
+* Evaluates the filters by index, a chunk per query (`read`), and returns the indexes of those Postgres refused. A
+* chunk that fails is halved, and each half tried again, down to the single filters that fail alone, so one bad
+* filter costs about two queries per halving and the others of its chunk are still evaluated. `failedFirst` is a
+* chunk already known to fail.
+*/
+const evaluateFilters = async (chunks, read, failedFirst) => {
+	const failed = /* @__PURE__ */ new Set();
+	const narrow = async (indexes) => {
+		if (indexes.length === 1) {
+			failed.add(indexes[0]);
+			return;
+		}
+		const middle = Math.ceil(indexes.length / 2);
+		await tryChunk(indexes.slice(0, middle));
+		await tryChunk(indexes.slice(middle));
+	};
+	const tryChunk = async (indexes) => {
+		if (!(await read(indexes)).ok) await narrow(indexes);
+	};
+	if (failedFirst && failedFirst.length > 0) await narrow(failedFirst);
+	for (const chunk of chunks) await tryChunk(chunk);
+	return failed;
+};
+//#endregion
+export { evaluateFilters };

package/dist/realtime/realtime-app.js

@@ -2,6 +2,7 @@ import { broadcastHub } from "./broadcast-hub.js";
 import { changeChecker } from "./change-checker.js";
 import { changeHub } from "./change-hub.js";
 import { channelAccess } from "./channel-access.js";
+import { filterCheck } from "./filter-check.js";
 import { databaseBroadcasts } from "./database-broadcasts.js";
 import { presenceHub } from "./presence-hub.js";
 import { realtimeRoutes } from "./realtime-routes.js";
@@ -40,6 +41,10 @@ const realtimeApp = ({ deps, feed, upgradeWebSocket, caller, report, options })
 		entry: (resource) => live.find((entry) => entry.name === resource),
 		report
 	});
+	const checkFilters = filterCheck({
+		db: deps.db,
+		statementTimeoutMs: deps.statementTimeoutMs
+	});
 	const access = channelAccess({
 		db: deps.db,
 		statementTimeoutMs: deps.statementTimeoutMs
@@ -56,6 +61,7 @@ const realtimeApp = ({ deps, feed, upgradeWebSocket, caller, report, options })
 		caller,
 		live,
 		hub,
+		checkFilters,
 		broadcasts,
 		presences,
 		database: { follow: () => {

package/dist/realtime/realtime-routes.js

@@ -17,7 +17,7 @@ const keyRequest = (apikey, token) => new Request("http://realtime.invalid/", {
 * `POST /api/sb/realtime/v1/api/broadcast` sends to the same channels without a socket (see `broadcastApi`), and so
 * does the database (see `databaseBroadcasts`).
 */
-const realtimeRoutes = ({ upgradeWebSocket, caller, live, hub, broadcasts, presences, database, access, report }) => {
+const realtimeRoutes = ({ upgradeWebSocket, caller, live, hub, checkFilters, broadcasts, presences, database, access, report }) => {
 	const app = new Hono();
 	let lastId = 0;
 	const nextId = () => ++lastId;
@@ -54,6 +54,7 @@ const realtimeRoutes = ({ upgradeWebSocket, caller, live, hub, broadcasts, prese
 					resolve: (token) => caller(keyRequest(apikey, token)),
 					live,
 					hub,
+					checkFilters,
 					broadcasts,
 					presences,
 					access,

package/dist/realtime/realtime-socket.js

@@ -1,7 +1,9 @@
 import { HttpProblem } from "../problem.js";
 import { fixedWindow, fixedWindows } from "./fixed-window.js";
 import { realtimeLimits } from "./realtime-limits.js";
+import { callerSettings } from "../rest/caller-settings.js";
 import { parseBindings } from "./postgres-changes.js";
+import "./filter-check.js";
 import { decodeBroadcastPush, encodeBroadcast, fitsFrame } from "./broadcast-frame.js";
 import { decodeMessage, encodeMessage, reply } from "./phoenix-message.js";
 import { privateGate, publicGate, readRefusalText } from "./channel-gate.js";
@@ -37,7 +39,7 @@ const refusal = (error) => {
 * earlier messages wait. A close, the client's or the server's, leaves every channel, a join still checking its token
 * included, and drops whatever is still queued.
 */
-const realtimeSocket = ({ vsn, send, buffered, close, resolve, live, hub, broadcasts, presences, access, nextId, report, idleMs = 6e4, now = Date.now }) => {
+const realtimeSocket = ({ vsn, send, buffered, close, resolve, live, hub, checkFilters, broadcasts, presences, access, nextId, report, idleMs = 6e4, now = Date.now }) => {
 	const channels = /* @__PURE__ */ new Map();
 	let queue = Promise.resolve();
 	let queuedMessages = 0;
@@ -127,6 +129,9 @@ const realtimeSocket = ({ vsn, send, buffered, close, resolve, live, hub, broadc
 		if (!open) return;
 		const parsed = parseBindings(config.postgres_changes, live, nextId);
 		if (typeof parsed === "string") return push(reply(message, "error", { reason: parsed }));
+		const refusedFilters = await checkFilters(caller, parsed.bindings);
+		if (!open) return;
+		if (refusedFilters !== void 0) return push(reply(message, "error", { reason: refusedFilters }));
 		const { topic } = message;
 		const member = {
 			self: broadcast.self === true,
@@ -146,11 +151,13 @@ const realtimeSocket = ({ vsn, send, buffered, close, resolve, live, hub, broadc
 		const offChanges = parsed.bindings.length > 0 ? hub.add({
 			caller: () => channel.caller,
 			bindings: parsed.bindings,
-			send: (payload) => toChannel(topic, channel, "postgres_changes", payload)
+			send: (payload) => toChannel(topic, channel, "postgres_changes", payload),
+			fail: (reason) => channels.get(topic) === channel && end(topic, reason)
 		}) : () => {};
 		const channel = {
 			joinRef: message.joinRef,
 			caller,
+			bindings: parsed.bindings,
 			gate,
 			ack: broadcast.ack === true,
 			member,
@@ -180,8 +187,13 @@ const realtimeSocket = ({ vsn, send, buffered, close, resolve, live, hub, broadc
 		const refused = await channel.gate.authorize(caller);
 		if (channels.get(message.topic) !== channel) return;
 		if (refused) return end(message.topic, readRefusalText(message.topic, refused));
+		const changed = JSON.stringify(callerSettings(caller)) !== JSON.stringify(callerSettings(channel.caller));
 		channel.caller = caller;
 		expireAt(message.topic, channel);
+		if (!changed) return;
+		const refusedFilters = await checkFilters(caller, channel.bindings);
+		if (channels.get(message.topic) !== channel || refusedFilters === void 0 || refusedFilters === "Too many joins are being checked; try again") return;
+		end(message.topic, refusedFilters);
 	};
 	const sendBroadcast = async (message, channel) => {
 		const { event, payload } = message.payload;

package/dist/realtime/savepoint-attempt.js

@@ -0,0 +1,39 @@
+import { isDatabaseError } from "../error-handler.js";
+import { sql } from "kysely";
+//#region src/realtime/savepoint-attempt.ts
+const transient = /* @__PURE__ */ new Set([
+	"08",
+	"25",
+	"40",
+	"53",
+	"57",
+	"58",
+	"XX"
+]);
+/** Whether Postgres refused the statement itself, such as a value its column's type does not take. */
+const isStatementError = (error) => isDatabaseError(error) && !transient.has(error.code.slice(0, 2));
+/**
+* Runs `run` inside the savepoint `name` of `trx`: when Postgres refuses one of its statements, the transaction goes
+* back to the savepoint, keeping the settings made before it, and the error is returned. Any other error is thrown.
+*/
+const attempt = async (trx, name, run) => {
+	await sql`savepoint ${sql.id(name)}`.execute(trx);
+	try {
+		const value = await run();
+		await sql`release savepoint ${sql.id(name)}`.execute(trx);
+		return {
+			ok: true,
+			value
+		};
+	} catch (error) {
+		if (!isStatementError(error)) throw error;
+		await sql`rollback to savepoint ${sql.id(name)}`.execute(trx);
+		await sql`release savepoint ${sql.id(name)}`.execute(trx);
+		return {
+			ok: false,
+			error
+		};
+	}
+};
+//#endregion
+export { attempt, isStatementError };

package/dist/transactions.js

@@ -17,5 +17,10 @@ const readTransaction = (db, timeoutMs, run, settings = {}) => writeTransaction(
 	await sql`set transaction read only`.execute(trx);
 	return run(trx);
 }, settings);
+/** A read-only transaction whose statements all read one snapshot (REPEATABLE READ), cancelled after `timeoutMs` each. */
+const snapshotReadTransaction = (db, timeoutMs, run) => db.transaction().setIsolationLevel("repeatable read").setAccessMode("read only").execute(async (trx) => {
+	await sql`select set_config('statement_timeout', ${String(timeoutMs)}, true)`.execute(trx);
+	return run(trx);
+});
 //#endregion
-export { readTransaction, writeTransaction };
+export { readTransaction, snapshotReadTransaction, writeTransaction };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.55.9",
+  "version": "0.55.10",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -40,9 +40,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.55.9",
-    "@protobase/query": "0.55.9",
-    "@protobase/schema": "0.55.9",
+    "@protobase/layout": "0.55.10",
+    "@protobase/query": "0.55.10",
+    "@protobase/schema": "0.55.10",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",