@protobase/server 0.59.3 → 0.60.1

package/dist/calls/calls-access.js

@@ -1,25 +1,46 @@
+import { forbidden } from "../problem.js";
 //#region src/calls/calls-access.ts
-const checkMember = ({ call, member }) => {
-	if (typeof call !== "string" || call.length === 0) throw new TypeError("calls.join needs the call, a non-empty string");
+/** The largest message of a member's socket: a description, with room to spare. */
+const maxMessageBytes = 307200;
+const checkMember = ({ record, member }) => {
+	if (typeof record?.resource !== "string" || record.resource.length === 0) throw new TypeError("calls.join needs the record, { resource, key }");
 	if (typeof member !== "string" || member.length === 0) throw new TypeError("calls.join needs the member, a non-empty string");
 };
-const loadBackend = async (settings) => {
-	if (settings.kind === "livekit") return (await import("./livekit/livekit-session.js")).liveKitBackend(settings);
-	return (await import("./peer/peer-backend.js")).peerBackend(settings);
-};
+const withoutCalls = () => Promise.reject(/* @__PURE__ */ new Error("This app has no calls: configure calls: { backend } in protobase.config.ts"));
 /**
-* Calls as a function sees them: each member's socket goes through the relay to the configured plugin, made once, at
-* the first join, so an app without calls loads none of their code.
+* Calls as a function sees them, for the caller `caller` gives: a public function's resolves only once it is asked
+* for, and rejects without a valid token. An app without calls loads none of their code.
 */
-const callsAccess = (options) => {
-	let backend;
-	return { join: async (member) => {
-		if (!options) throw new Error("This app has no calls: configure calls: { backend } in protobase.config.ts");
-		checkMember(member);
-		backend ??= loadBackend(options.backend);
-		const [{ memberRelay }, plugin] = await Promise.all([import("./member-relay.js"), backend]);
-		return memberRelay(plugin, member);
-	} };
+const callsAccess = (service, caller) => {
+	if (!service) return {
+		join: withoutCalls,
+		remove: withoutCalls,
+		of: withoutCalls
+	};
+	return {
+		join: async (member) => {
+			checkMember(member);
+			const { session, records } = await caller();
+			if (session.anonymous || session.user.id === "") throw forbidden("call-needs-user", "Sign in to join a call");
+			const { resource, key } = member.record;
+			const record = service.recordOf(resource, key);
+			const mayRead = () => records.get(resource, key);
+			await mayRead();
+			return {
+				...await (await service.runtime()).relay(record, member.member, {
+					publish: member.publish,
+					...member.hears && { hears: member.hears }
+				}),
+				maxMessageBytes,
+				recheck: async () => {
+					await mayRead();
+					await member.recheck?.();
+				}
+			};
+		},
+		remove: async (call, member) => (await service.runtime()).remove(call, member),
+		of: async ({ resource, key }) => (await service.runtime()).of(service.recordOf(resource, key))
+	};
 };
 //#endregion
 export { callsAccess };

package/dist/calls/calls-options.d.ts

@@ -16,17 +16,25 @@ export type CallIceServer = {
 };
 /**
  * No media server: each member's browser sends its media to every other member's, and Protobase passes their offers,
- * answers and candidates between them. For small calls; members meet only on the same process.
+ * answers and candidates between them. For small calls: at most `maxMembers`, 8 by default.
  */
 export type PeerBackend = {
   kind: 'peer';
   iceServers?: CallIceServer[];
+  maxMembers?: number;
 };
 /** The media plugin a call's members send and receive their media through. */
 export type CallBackend = LiveKitBackend | PeerBackend;
 /** Calls: the media plugin behind them. Without `calls`, an app loads none of the calls code. */
 export type CallsOptions = {
   backend: CallBackend;
+  /** How long a call lasts at most, in minutes, 240 by default: then it ends, whoever is still in it. */
+  maxMinutes?: number;
+  /**
+   * `'one'`, the default, when one process serves the app. `'many'` when several serve it behind one address: the
+   * members' signaling then goes between the processes through the `calls` schema.
+   */
+  processes?: 'one' | 'many';
 };
 /** The options, or an error naming what is wrong with them: the backend's kind and each of its settings. */
 export declare const checkCallsOptions: (options: CallsOptions) => CallsOptions;

package/dist/calls/calls-options.js

@@ -1,11 +1,19 @@
-//#region src/calls/calls-options.ts
+/** The most members a call of these options admits; a LiveKit call has no limit of Protobase's. */
+const maxMembersOf = (backend) => backend.kind === "peer" ? backend.maxMembers ?? 8 : Number.POSITIVE_INFINITY;
 const nonEmpty = (value) => typeof value === "string" && value.length > 0;
+const positiveInteger = (value) => Number.isInteger(value) && value > 0;
+const checkShared = (options) => {
+	if (options.maxMinutes !== void 0 && !positiveInteger(options.maxMinutes)) throw new Error(`calls.maxMinutes must be a whole number of minutes of at least 1, not ${String(options.maxMinutes)}`);
+	if (options.processes !== void 0 && options.processes !== "one" && options.processes !== "many") throw new Error(`calls.processes must be 'one' or 'many', not ${JSON.stringify(options.processes)}`);
+};
 /** The options, or an error naming what is wrong with them: the backend's kind and each of its settings. */
 const checkCallsOptions = (options) => {
 	const backend = options?.backend;
+	if (backend?.kind === "peer" || backend?.kind === "livekit") checkShared(options);
 	if (backend?.kind === "peer") {
 		const servers = backend.iceServers;
 		if (servers !== void 0 && (!Array.isArray(servers) || servers.some((server) => !Array.isArray(server?.urls) || !server.urls.every(nonEmpty)))) throw new Error("calls.backend.iceServers must be a list of { urls: string[], username?, credential? }");
+		if (backend.maxMembers !== void 0 && !(positiveInteger(backend.maxMembers) && backend.maxMembers >= 2)) throw new Error(`calls.backend.maxMembers must be a whole number of at least 2, not ${String(backend.maxMembers)}`);
 		return options;
 	}
 	if (backend?.kind !== "livekit") throw new Error(`calls.backend.kind must be 'livekit' or 'peer', not ${JSON.stringify(backend?.kind)}`);
@@ -18,4 +26,4 @@ const checkCallsOptions = (options) => {
 	return options;
 };
 //#endregion
-export { checkCallsOptions };
+export { checkCallsOptions, maxMembersOf };

package/dist/calls/calls-runtime.d.ts

@@ -0,0 +1,33 @@
+import { CallsOptions } from "./calls-options.js";
+import { SocketEvents } from "../functions/function-socket.js";
+import { CallRights } from "./call-member.js";
+import { CallRecord } from "./call-store.js";
+import { CallItem } from "./call-reads.js";
+import { CallStore } from "./calls-store.js";
+import { Db } from "@protobase/query";
+//#region src/calls/calls-runtime.d.ts
+export type CallsRuntimeInput = {
+  db: Db;
+  timeoutMs: number;
+  options: CallsOptions;
+  report: (error: unknown) => void;
+  /** Memory in tests; the `calls` schema otherwise. */
+  store?: CallStore;
+};
+/**
+ * An app's calls on this process: the members it serves, through the configured plugin, and the records whose calls
+ * its pages follow. While it serves a member or a page, it reads them every second and, every five, marks its members
+ * as served and sweeps every call, whichever process served it; with neither, it runs no timer.
+ */
+export declare const callsRuntime: ({ db, timeoutMs, options, report, store }: CallsRuntimeInput) => {
+  /** The events of the member's socket, relayed to the plugin: they come into the record's call at their `join`. */
+  relay: (record: CallRecord, member: string, rights: CallRights) => Promise<SocketEvents>;
+  /** Removes the member from the call, and only from it: whether they were in it. */
+  remove: (call: string, member: string) => Promise<boolean>;
+  /** The record's latest calls, newest first, once every call that should have ended has. */
+  of: (record: CallRecord) => Promise<CallItem[]>;
+  /** Tells `listener` the record's calls now and whenever they change, until the returned function is called. */
+  watch: (record: CallRecord, listener: (items: CallItem[]) => void) => Promise<() => undefined>;
+};
+export type CallsRuntime = ReturnType<typeof callsRuntime>;
+//#endregion

package/dist/calls/calls-runtime.js

@@ -0,0 +1,94 @@
+import { maxMembersOf } from "./calls-options.js";
+import { callHub } from "./call-hub.js";
+import { recordId } from "./call-reads.js";
+import { callWatch } from "./call-watch.js";
+import { sqlCallStore } from "./calls-store.js";
+import { memberRelay } from "./member-relay.js";
+//#region src/calls/calls-runtime.ts
+/** How often the calls this process serves, and the records its pages follow, are read. */
+const readEveryMs = 1e3;
+/** Every how many reads the process tells its members' records it still serves them, and sweeps every call. */
+const beatEvery = 5;
+const loadBackend = async (settings) => {
+	if (settings.kind === "livekit") return (await import("./livekit/livekit-session.js")).liveKitBackend(settings);
+	return (await import("./peer/peer-backend.js")).peerBackend(settings);
+};
+/**
+* An app's calls on this process: the members it serves, through the configured plugin, and the records whose calls
+* its pages follow. While it serves a member or a page, it reads them every second and, every five, marks its members
+* as served and sweeps every call, whichever process served it; with neither, it runs no timer.
+*/
+const callsRuntime = ({ db, timeoutMs, options, report, store = sqlCallStore(db, timeoutMs) }) => {
+	const hub = callHub({
+		store,
+		manyProcesses: options.processes === "many",
+		report
+	});
+	const watch = callWatch(store);
+	const maxMembers = maxMembersOf(options.backend);
+	const maxMinutes = options.maxMinutes ?? 240;
+	let backend;
+	let timer;
+	let reads = 0;
+	const busy = () => hub.size > 0 || watch.size > 0;
+	const tick = async () => {
+		reads++;
+		if (reads % beatEvery === 0) {
+			await hub.beat();
+			await store.sweep();
+		}
+		await hub.refreshAll();
+		await watch.read();
+	};
+	const schedule = () => {
+		if (timer || !busy()) return;
+		timer = setTimeout(() => {
+			tick().catch(report).finally(() => {
+				timer = void 0;
+				schedule();
+			});
+		}, readEveryMs);
+		timer.unref?.();
+	};
+	const door = { admit: async (input, link) => {
+		const admitted = await hub.admit(input, link);
+		schedule();
+		return admitted;
+	} };
+	return {
+		/** The events of the member's socket, relayed to the plugin: they come into the record's call at their `join`. */
+		relay: async (record, member, rights) => {
+			backend ??= loadBackend(options.backend);
+			return memberRelay({
+				door,
+				backend: await backend,
+				record,
+				member,
+				rights,
+				maxMembers,
+				maxMinutes,
+				report
+			});
+		},
+		/** Removes the member from the call, and only from it: whether they were in it. */
+		remove: async (call, member) => {
+			const removed = await store.remove(call, member);
+			await hub.refresh([call]);
+			return removed;
+		},
+		/** The record's latest calls, newest first, once every call that should have ended has. */
+		of: async (record) => {
+			await store.sweep();
+			return (await store.recordCalls([record])).get(recordId(record)) ?? [];
+		},
+		/** Tells `listener` the record's calls now and whenever they change, until the returned function is called. */
+		watch: async (record, listener) => {
+			await store.sweep();
+			const stop = await watch.add(record, listener);
+			schedule();
+			return stop;
+		}
+	};
+};
+//#endregion
+export { callsRuntime };

package/dist/calls/calls-service-type.d.ts

@@ -0,0 +1,11 @@
+import { CallRecordKey } from "./call-member.js";
+import { CallRecord } from "./call-store.js";
+import { CallsRuntime } from "./calls-runtime.js";
+//#region src/calls/calls-service-type.d.ts
+/** An app's calls as its functions and routes reach them: loaded at their first use, and the stored form of a record's key. */
+export type CallsService = {
+  runtime: () => Promise<CallsRuntime>;
+  /** The resource and encoded key of a record a function names; a 404 problem for an unknown resource. */
+  recordOf: (resource: string, key: CallRecordKey) => CallRecord;
+};
+//#endregion

package/dist/calls/calls-service.js

@@ -0,0 +1,27 @@
+import { toolKey } from "../assistant/records.js";
+import { encodeKey } from "@protobase/schema/internal";
+//#region src/calls/calls-service.ts
+/** An app's calls over its resources: the runtime loaded at the first use, so an app that never calls loads none of it. */
+const callsService = (deps, options) => {
+	let runtime;
+	return {
+		runtime: () => runtime ??= import("./calls-runtime.js").then(({ callsRuntime }) => {
+			const { db, statementTimeoutMs, report } = deps();
+			return callsRuntime({
+				db,
+				timeoutMs: statementTimeoutMs,
+				options,
+				report
+			});
+		}),
+		recordOf: (resource, key) => {
+			const found = toolKey(deps(), resource, key);
+			return {
+				resource: found.entry.name,
+				key: encodeKey(found.key)
+			};
+		}
+	};
+};
+//#endregion
+export { callsService };

package/dist/calls/calls-sql.d.ts

@@ -0,0 +1,7 @@
+import { Db } from "@protobase/query";
+//#region src/calls/calls-sql.d.ts
+/** The SQL that adds the `calls` schema and its tables, `undefined` when they are there. They are never dropped. */
+export declare const callsMigration: (db: Db) => Promise<"create schema if not exists \"calls\";\n\ncreate table if not exists \"calls\".\"calls\" (\n  \"id\" uuid primary key,\n  \"resource\" text not null,\n  \"record_key\" text not null,\n  \"started_by\" text not null,\n  \"started_at\" timestamptz not null,\n  \"ends_at\" timestamptz not null,\n  \"ended_at\" timestamptz\n);\ncreate unique index if not exists \"calls_live\" on \"calls\".\"calls\" (\"resource\", \"record_key\") where \"ended_at\" is null;\ncreate index if not exists \"calls_record\" on \"calls\".\"calls\" (\"resource\", \"record_key\", \"started_at\");\n\ncreate table if not exists \"calls\".\"members\" (\n  \"id\" bigint generated always as identity primary key,\n  \"call_id\" uuid not null references \"calls\".\"calls\" (\"id\") on delete cascade,\n  \"member\" text not null,\n  \"process\" uuid not null,\n  \"tracks\" jsonb not null,\n  \"joined_at\" timestamptz not null,\n  \"seen_at\" timestamptz not null,\n  \"left_at\" timestamptz,\n  \"removed_at\" timestamptz\n);\ncreate unique index if not exists \"members_present\" on \"calls\".\"members\" (\"call_id\", \"member\") where \"left_at\" is null;\ncreate index if not exists \"members_call\" on \"calls\".\"members\" (\"call_id\", \"member\");\ncreate index if not exists \"members_seen\" on \"calls\".\"members\" (\"seen_at\") where \"left_at\" is null;\n\ncreate table if not exists \"calls\".\"signals\" (\n  \"id\" bigint generated always as identity primary key,\n  \"process\" uuid not null,\n  \"call_id\" uuid not null,\n  \"to_member\" text not null,\n  \"from_member\" text not null,\n  \"body\" json not null,\n  \"at\" timestamptz not null\n);\ncreate index if not exists \"signals_process\" on \"calls\".\"signals\" (\"process\", \"id\");\ncreate index if not exists \"signals_at\" on \"calls\".\"signals\" (\"at\");;" | undefined>;
+/** Refuses to go on while the app has `calls` and the database lacks their tables; the project's migrations add them. */
+export declare const checkCalls: (db: Db, calls: unknown) => Promise<void>;
+//#endregion

package/dist/calls/calls-sql.js

@@ -0,0 +1,66 @@
+import { migrationCommand } from "../changes/capture-schema.js";
+import { sql } from "kysely";
+//#region src/calls/calls-sql.ts
+/**
+* - `calls`: a call on a record, by resource and encoded key: who started it, when, the latest it may end, and when it
+*   ended (NULL while it goes on). A record has at most one call going on. Its id is random, so it is unique beyond
+*   the app too, as the room of a media server other apps share.
+* - `members`: a member's time in a call, from their join until they left or were removed; the process that serves
+*   them and when it last heard of them. A removal of someone not in the call is a row that starts and ends at once.
+* - `signals`: with several processes, a member's description or candidate for a member another process serves,
+*   taken out by that process as it reads it, and deleted after a minute when no process did.
+*/
+const callsSchemaSql = `create schema if not exists "calls";
+
+create table if not exists "calls"."calls" (
+  "id" uuid primary key,
+  "resource" text not null,
+  "record_key" text not null,
+  "started_by" text not null,
+  "started_at" timestamptz not null,
+  "ends_at" timestamptz not null,
+  "ended_at" timestamptz
+);
+create unique index if not exists "calls_live" on "calls"."calls" ("resource", "record_key") where "ended_at" is null;
+create index if not exists "calls_record" on "calls"."calls" ("resource", "record_key", "started_at");
+
+create table if not exists "calls"."members" (
+  "id" bigint generated always as identity primary key,
+  "call_id" uuid not null references "calls"."calls" ("id") on delete cascade,
+  "member" text not null,
+  "process" uuid not null,
+  "tracks" jsonb not null,
+  "joined_at" timestamptz not null,
+  "seen_at" timestamptz not null,
+  "left_at" timestamptz,
+  "removed_at" timestamptz
+);
+create unique index if not exists "members_present" on "calls"."members" ("call_id", "member") where "left_at" is null;
+create index if not exists "members_call" on "calls"."members" ("call_id", "member");
+create index if not exists "members_seen" on "calls"."members" ("seen_at") where "left_at" is null;
+
+create table if not exists "calls"."signals" (
+  "id" bigint generated always as identity primary key,
+  "process" uuid not null,
+  "call_id" uuid not null,
+  "to_member" text not null,
+  "from_member" text not null,
+  "body" json not null,
+  "at" timestamptz not null
+);
+create index if not exists "signals_process" on "calls"."signals" ("process", "id");
+create index if not exists "signals_at" on "calls"."signals" ("at");`;
+const hasCallsTables = async (db) => (await sql`select to_regclass('calls.calls') is not null and to_regclass('calls.members') is not null and to_regclass('calls.signals') is not null as found`.execute(db)).rows[0].found;
+/** The SQL that adds the `calls` schema and its tables, `undefined` when they are there. They are never dropped. */
+const callsMigration = async (db) => {
+	if (await hasCallsTables(db)) return void 0;
+	return `${callsSchemaSql};`;
+};
+/** Refuses to go on while the app has `calls` and the database lacks their tables; the project's migrations add them. */
+const checkCalls = async (db, calls) => {
+	if (!calls) return;
+	if (await hasCallsTables(db)) return;
+	throw new Error(`The calls schema is missing, and calls keep their records in it. Write it as a migration with \`${migrationCommand}\`, apply it with the project's migrations, then start again.`);
+};
+//#endregion
+export { callsMigration, callsSchemaSql, checkCalls };

package/dist/calls/calls-store.d.ts

@@ -0,0 +1,23 @@
+import { Admission, AdmitInput, CallRecord } from "./call-store.js";
+import { CallItem, RosterMember } from "./call-reads.js";
+import { StoredSignal } from "./call-signals-sql.js";
+import { CallRemoteTrack } from "@protobase/schema/internal";
+import { Db } from "@protobase/query";
+//#region src/calls/calls-store.d.ts
+/** Where calls, their members and the signals between processes are kept: the `calls` schema, or memory in tests. */
+export type CallStore = {
+  admit: (input: AdmitInput) => Promise<Admission>;
+  leave: (row: string, process: string) => Promise<void>;
+  remove: (call: string, member: string) => Promise<boolean>;
+  setTracks: (row: string, process: string, tracks: CallRemoteTrack[]) => Promise<void>;
+  heartbeat: (process: string, rows: readonly string[]) => Promise<void>;
+  sweep: () => Promise<void>;
+  rosters: (calls: readonly string[]) => Promise<Map<string, {
+    ended: boolean;
+    members: RosterMember[];
+  }>>;
+  recordCalls: (records: readonly CallRecord[]) => Promise<Map<string, CallItem[]>>;
+  writeSignal: (signal: Omit<StoredSignal, 'id'>) => Promise<void>;
+  takeSignals: (process: string, limit: number) => Promise<StoredSignal[]>;
+};
+//#endregion

package/dist/calls/calls-store.js

@@ -0,0 +1,20 @@
+import { recordCalls, rosters } from "./call-reads.js";
+import { takeSignals, writeSignal } from "./call-signals-sql.js";
+import { admit, heartbeat, leave, remove, setTracks } from "./call-store.js";
+import { sweepCalls } from "./call-sweep.js";
+//#region src/calls/calls-store.ts
+/** The `calls` schema of the app's database; writes under the API's statement timeout. */
+const sqlCallStore = (db, timeoutMs) => ({
+	admit: (input) => admit(db, timeoutMs, input),
+	leave: (row, process) => leave(db, timeoutMs, row, process),
+	remove: (call, member) => remove(db, timeoutMs, call, member),
+	setTracks: (row, process, tracks) => setTracks(db, row, process, tracks),
+	heartbeat: (process, rows) => heartbeat(db, process, rows),
+	sweep: () => sweepCalls(db, timeoutMs),
+	rosters: (calls) => rosters(db, calls),
+	recordCalls: (records) => recordCalls(db, records),
+	writeSignal: (signal) => writeSignal(db, signal),
+	takeSignals: (process, limit) => takeSignals(db, process, limit)
+});
+//#endregion
+export { sqlCallStore };

package/dist/calls/client-message.js

@@ -42,6 +42,7 @@ const message = z.discriminatedUnion("type", [
 	z.strictObject({ type: z.literal("join") }),
 	z.strictObject({
 		type: z.literal("resume"),
+		call: id,
 		participant: id,
 		offer: sdp.optional(),
 		answer: sdp.optional(),

package/dist/calls/close-codes.js

@@ -0,0 +1,17 @@
+import { resumeCloseCode } from "./media-backend.js";
+//#region src/calls/close-codes.ts
+const lostCodes = /* @__PURE__ */ new Set([
+	1001,
+	1005,
+	1006,
+	1012,
+	resumeCloseCode
+]);
+/**
+* How a member's socket ended, by its close code: lost, so the browser may resume within the grace, or left. Every
+* other code is left, the server's 1008 and 1011 among them, so a check that refused the caller or could not run ends
+* their time in the call at once.
+*/
+const memberEnd = (code) => lostCodes.has(code) ? "lost" : "left";
+//#endregion
+export { memberEnd };

package/dist/calls/livekit/livekit-session.js

@@ -116,6 +116,7 @@ const liveKitSession = (backend, member, link, deps) => {
 				signal.keepAlive(join.pingInterval || resumePing.interval, join.pingTimeout || resumePing.timeout);
 				toBrowser({
 					type: "joined",
+					call: member.call,
 					mode: "sfu",
 					participant: join.participant.sid,
 					iceServers: join.iceServers.map((server) => ({

package/dist/calls/member-relay.js

@@ -1,35 +1,87 @@
+import { memberEnd } from "./close-codes.js";
 import { parseClientMessage } from "./client-message.js";
 //#region src/calls/member-relay.ts
-/** The close code of a socket whose caller Protobase refused at a recheck: the member leaves the call too. */
+/** The close code of a socket whose caller Protobase refused: the member leaves the call too. */
 const refusedCloseCode = 1008;
-const mayPublish = (member, tracks) => member.publish === true || Array.isArray(member.publish) && tracks.every((track) => member.publish.includes(track.source));
+const mayPublish = (rights, tracks) => rights.publish === true || Array.isArray(rights.publish) && tracks.every((track) => rights.publish.includes(track.source));
+const refusals = {
+	removed: "You were removed from this call",
+	full: "This call is full",
+	ended: "This call has ended"
+};
 /**
-* One member's socket, relayed to the call's media plugin: the relay reads and checks the browser's messages, refuses a
-* publish the member may not make, opens the member's session at their `join` or `resume` and tells it how the socket
-* ended. The plugin only ever sees well-formed messages of a member Protobase admitted.
+* One member's socket, relayed to the call's media plugin: the relay reads and checks the browser's messages, lets
+* the member into the record's call at their `join` or `resume`, or tells them why not, refuses a publish the member
+* may not make, and tells the call and the plugin how the socket ended. The plugin only ever sees well-formed messages
+* of a member Protobase let in.
 */
-const memberRelay = (backend, member) => {
+const memberRelay = ({ door, backend, record, member, rights, maxMembers, maxMinutes, report }) => {
 	let browser;
 	let session;
+	let inCall;
 	let finished = false;
-	const send = (message) => void browser.send(JSON.stringify(message));
+	let rejoining = false;
+	const send = (message) => {
+		if (message.type === "left" && message.reason === "rejoin") rejoining = true;
+		browser.send(JSON.stringify(message));
+	};
+	const end = (how) => {
+		session?.end(how);
+		if (!inCall) return;
+		if (how === "left") return void inCall.leave().catch(report);
+		inCall.detach();
+	};
 	const close = (code, reason) => {
 		if (finished) return;
 		finished = true;
-		session?.end(code === 1e3 || code === refusedCloseCode ? "left" : "lost");
+		end(rejoining ? "lost" : memberEnd(code));
 		browser.close(code, reason);
 	};
-	const relay = async (message) => {
-		if (message.type === "join" || message.type === "resume") {
-			if (session) return close(refusedCloseCode, "The call session already started");
-			session = backend.open(member, {
-				send,
-				close
+	const enter = async (message) => {
+		if (session) return close(refusedCloseCode, "The call session already started");
+		const resume = message.type === "resume" ? {
+			call: message.call,
+			tracks: message.tracks.map((track) => ({
+				sid: track.sid,
+				member,
+				kind: track.kind,
+				source: track.source,
+				muted: false
+			}))
+		} : void 0;
+		const admitted = await door.admit({
+			record,
+			member,
+			maxMembers,
+			maxMinutes,
+			...resume && { resume }
+		}, {
+			send,
+			close
+		});
+		if ("refused" in admitted) {
+			send({
+				type: "left",
+				reason: admitted.refused
 			});
-			return session.receive(message);
+			return close(refusedCloseCode, refusals[admitted.refused]);
 		}
+		inCall = admitted;
+		session = backend.open({
+			...rights,
+			call: admitted.call,
+			member
+		}, {
+			send,
+			close
+		}, admitted.room);
+		await session.receive(message);
+		await admitted.listen(session.roster ?? (() => {}));
+	};
+	const relay = async (message) => {
+		if (message.type === "join" || message.type === "resume") return enter(message);
 		if (!session) return close(refusedCloseCode, "Join or resume the call first");
-		if (message.type === "publish" && !mayPublish(member, message.tracks)) return send({
+		if (message.type === "publish" && !mayPublish(rights, message.tracks)) return send({
 			type: "publish-refused",
 			reason: "The member may not publish these tracks"
 		});
@@ -48,7 +100,7 @@ const memberRelay = (backend, member) => {
 		onClose: (code) => {
 			if (finished) return;
 			finished = true;
-			session?.end(code === refusedCloseCode ? "left" : "lost");
+			end(rejoining ? "lost" : memberEnd(code));
 		}
 	};
 };