@rebasepro/server-mongo 0.14.0 → 0.14.1

package/src/services/MongoRealtimeService.ts

@@ -29,6 +29,22 @@ export interface SubscriptionAuthContext {
     roles: string[];
 }
 
+/**
+ * The query half of a subscription config — everything except who is watching.
+ *
+ * Spread into the re-fetch rather than re-listed field by field. Re-listing is
+ * how `logical` and `offset` went missing twice on this path: the type declares
+ * them, every boundary accepted them, and each hand-written list quietly named
+ * a subset. A function that removes the two non-query fields cannot fall behind
+ * the type the way a list of the other nine can.
+ */
+const queryOf = <T extends { clientId: string; authContext?: SubscriptionAuthContext }>(
+    config: T
+): Omit<T, "clientId" | "authContext"> => {
+    const { clientId: _clientId, authContext: _authContext, ...query } = config;
+    return query;
+};
+
 interface Subscription {
     type: "collection" | "single";
     /**
@@ -40,6 +56,22 @@ interface Subscription {
     config: (CollectionSubscriptionConfig | SingleSubscriptionConfig) & { authContext?: SubscriptionAuthContext };
     changeStream?: ChangeStream;
     callback?: (data: any) => void;
+    /**
+     * How many deliveries have been started for this subscription, and the
+     * highest that has already reached the callback.
+     *
+     * Every delivery here is a re-fetch, and three independent things start one
+     * for the same subscription: the initial fetch, the change stream, and
+     * `notifyUpdate` after a save. They overlap, and a fetch that started
+     * earlier can finish later — at which point the callback replaces the
+     * client's whole list with the state before the change. Nothing corrects it
+     * until something else happens to that collection.
+     *
+     * A counter taken before the await and checked after it is what makes the
+     * last *started* delivery the last *delivered* one.
+     */
+    started: number;
+    delivered: number;
 }
 
 /**
@@ -66,6 +98,35 @@ export class MongoRealtimeService implements RealtimeProvider {
         return path.replace(/\//g, "_");
     }
 
+    /**
+     * Claim a delivery slot for a subscription, before doing the work.
+     *
+     * Returns the check to run immediately before calling the callback. It
+     * refuses in three cases, all of which used to deliver:
+     *
+     * - **Out of order.** A newer fetch has already delivered, so this one is
+     *   stale — the client would go back to the state before the change.
+     * - **Unsubscribed.** The subscription was cancelled while the fetch was in
+     *   flight, and its callback belongs to a client that stopped listening.
+     * - **Re-subscribed.** `subscribeToCollection` unsubscribes first, so the
+     *   same id can name a *different* subscription by the time a fetch lands —
+     *   with a different filter, and a different caller's rows.
+     *
+     * Synchronous deliveries claim a slot too. A `delete` notification with no
+     * fetch behind it is the newest thing known about the row, so it must also
+     * be the thing that closes the door on an older fetch still in flight —
+     * otherwise the deleted row reappears a moment after it vanished.
+     */
+    private beginDelivery(subscriptionId: string, subscription: Subscription): () => boolean {
+        const seq = ++subscription.started;
+        return () => {
+            if (this.subscriptions.get(subscriptionId) !== subscription) return false;
+            if (seq <= subscription.delivered) return false;
+            subscription.delivered = seq;
+            return true;
+        };
+    }
+
     /**
      * Subscribe to collection changes
      */
@@ -100,19 +161,21 @@ export class MongoRealtimeService implements RealtimeProvider {
                 type: "collection",
                 config,
                 changeStream,
-                callback
+                callback,
+                started: 0,
+                delivered: 0
             };
 
             this.subscriptions.set(subscriptionId, subscription);
 
             // Fetch initial data
-            this.fetchAndNotifyCollection(subscriptionId, config, callback);
+            this.fetchAndNotifyCollection(subscriptionId, subscription);
 
             // Listen for changes
             changeStream.on("change", async (change: ChangeStreamDocument) => {
                 // Re-fetch the entire collection when any change happens
                 // This is simpler and ensures consistent sorting/filtering
-                await this.fetchAndNotifyCollection(subscriptionId, config, callback);
+                await this.fetchAndNotifyCollection(subscriptionId, subscription);
             });
 
             changeStream.on("error", (error: Error) => {
@@ -127,13 +190,15 @@ export class MongoRealtimeService implements RealtimeProvider {
             const subscription: Subscription = {
                 type: "collection",
                 config,
-                callback
+                callback,
+                started: 0,
+                delivered: 0
             };
 
             this.subscriptions.set(subscriptionId, subscription);
 
             // Fetch initial data
-            this.fetchAndNotifyCollection(subscriptionId, config, callback);
+            this.fetchAndNotifyCollection(subscriptionId, subscription);
         }
     }
 
@@ -142,9 +207,11 @@ export class MongoRealtimeService implements RealtimeProvider {
      */
     private async fetchAndNotifyCollection(
         subscriptionId: string,
-        config: CollectionSubscriptionConfig & { authContext?: SubscriptionAuthContext },
-        callback?: (rows: Record<string, unknown>[]) => void
+        subscription: Subscription
     ): Promise<void> {
+        const config = subscription.config as CollectionSubscriptionConfig & { authContext?: SubscriptionAuthContext };
+        const callback = subscription.callback;
+        const canDeliver = this.beginDelivery(subscriptionId, subscription);
         try {
             const registryCollection = this.driver?.registry?.getCollectionByPath(config.path);
             // One path, authenticated or not. The `else` branch used to reach
@@ -155,18 +222,17 @@ export class MongoRealtimeService implements RealtimeProvider {
             // against the anonymous uid, and a rule that needs a real one
             // matches nothing.
             const driver = await this.scopedDriver(config.authContext);
+            // The stored config forwarded whole. Re-listing its fields here is
+            // how `logical` and `offset` went missing a second time, one layer
+            // below where they went missing the first time: the subscription
+            // carried them and the re-fetch did not ask for them.
             const rows = await driver.fetchCollection({
-                path: config.path,
-                collection: registryCollection,
+                ...queryOf(config),
                 filter: config.filter as FilterValues<string> | undefined,
-                orderBy: config.orderBy,
-                order: config.order,
-                limit: config.limit,
-                startAfter: config.startAfter,
-                searchString: config.searchString
+                collection: registryCollection
             });
 
-            if (callback) {
+            if (callback && canDeliver()) {
                 callback(rows);
             }
         } catch (error) {
@@ -226,22 +292,28 @@ roles: authContext?.roles ?? [] } as User;
                 type: "single",
                 config,
                 changeStream,
-                callback
+                callback,
+                started: 0,
+                delivered: 0
             };
 
             this.subscriptions.set(subscriptionId, subscription);
 
             // Fetch initial data
-            this.fetchAndNotifyOne(subscriptionId, config, callback);
+            this.fetchAndNotifyOne(subscriptionId, subscription);
 
             // Listen for changes
             changeStream.on("change", async (change: ChangeStreamDocument) => {
                 if (change.operationType === "delete") {
-                    if (callback) {
+                    // Claims a slot like any other delivery: the deletion is the
+                    // newest fact about this row, so an older fetch still in
+                    // flight must not put it back.
+                    const canDeliver = this.beginDelivery(subscriptionId, subscription);
+                    if (callback && canDeliver()) {
                         callback(null);
                     }
                 } else {
-                    await this.fetchAndNotifyOne(subscriptionId, config, callback);
+                    await this.fetchAndNotifyOne(subscriptionId, subscription);
                 }
             });
 
@@ -255,13 +327,15 @@ roles: authContext?.roles ?? [] } as User;
             const subscription: Subscription = {
                 type: "single",
                 config,
-                callback
+                callback,
+                started: 0,
+                delivered: 0
             };
 
             this.subscriptions.set(subscriptionId, subscription);
 
             // Fetch initial data
-            this.fetchAndNotifyOne(subscriptionId, config, callback);
+            this.fetchAndNotifyOne(subscriptionId, subscription);
         }
     }
 
@@ -270,9 +344,11 @@ roles: authContext?.roles ?? [] } as User;
      */
     private async fetchAndNotifyOne(
         subscriptionId: string,
-        config: SingleSubscriptionConfig & { authContext?: SubscriptionAuthContext },
-        callback?: (row: Record<string, unknown> | null) => void
+        subscription: Subscription
     ): Promise<void> {
+        const config = subscription.config as SingleSubscriptionConfig & { authContext?: SubscriptionAuthContext };
+        const callback = subscription.callback;
+        const canDeliver = this.beginDelivery(subscriptionId, subscription);
         try {
             const registryCollection = this.driver?.registry?.getCollectionByPath(config.path);
             const driver = await this.scopedDriver(config.authContext);
@@ -282,7 +358,7 @@ roles: authContext?.roles ?? [] } as User;
                 collection: registryCollection
             });
 
-            if (callback) {
+            if (callback && canDeliver()) {
                 callback(row || null);
             }
         } catch (error) {
@@ -319,21 +395,24 @@ roles: authContext?.roles ?? [] } as User;
                 const config = subscription.config as SingleSubscriptionConfig & { authContext?: SubscriptionAuthContext };
                 if (config.path === path && config.id.toString() === id) {
                     if (row === null) {
-                        // A deletion carries no row to authorize.
-                        subscription.callback?.(null);
+                        // A deletion carries no row to authorize — but it still
+                        // claims a delivery slot, so a re-fetch already in
+                        // flight cannot land after it and resurrect the row.
+                        const canDeliver = this.beginDelivery(subscriptionId, subscription);
+                        if (canDeliver()) subscription.callback?.(null);
                     } else {
                         // Re-fetched through the subscriber's own driver rather
                         // than pushed verbatim: `notifyUpdate` runs after every
                         // save, and handing it the row as written broadcast any
                         // document to whoever happened to be watching its id.
-                        await this.fetchAndNotifyOne(subscriptionId, config, subscription.callback);
+                        await this.fetchAndNotifyOne(subscriptionId, subscription);
                     }
                 }
             } else if (subscription.type === "collection") {
                 const config = subscription.config as CollectionSubscriptionConfig & { authContext?: SubscriptionAuthContext };
                 if (config.path === path) {
                     // Re-fetch the collection to get updated data
-                    await this.fetchAndNotifyCollection(subscriptionId, config, subscription.callback);
+                    await this.fetchAndNotifyCollection(subscriptionId, subscription);
                 }
             }
         }
@@ -429,11 +508,20 @@ roles: (_authContext.roles ?? []).map(String) } : undefined;
                         clientId,
                         path: message.payload?.path,
                         filter: message.payload?.filter,
+                        // `logical` and `offset` were absent from this list, so
+                        // an `or(...)` subscription was pushed every row the
+                        // caller's policies allowed and a subscription to page
+                        // two was pushed page one. The client has been sending
+                        // both since it stopped stringifying `offset` into
+                        // `startAfter`; nothing here read them.
+                        logical: message.payload?.logical,
+                        offset: message.payload?.offset,
                         orderBy: message.payload?.orderBy,
                         order: message.payload?.order,
                         limit: boundedLimit,
                         startAfter: message.payload?.startAfter,
                         searchString: message.payload?.searchString,
+                        searchExplain: message.payload?.searchExplain,
                         authContext
                     },
                     (rows) => {

package/src/websocket.ts

@@ -2,7 +2,7 @@ import { RealtimeProvider, DataDriver, FetchCollectionProps, FetchOneProps, Save
 import { WebSocketServer, WebSocket } from "ws";
 import { Server } from "http";
 import { inspect } from "util";
-import { extractUserFromToken, resolveRequireAuth } from "@rebasepro/server";
+import { extractUserFromToken, resolveRequireAuth, assertWriteRequestValid, ApiError } from "@rebasepro/server";
 import type { RebaseAuthConfig } from "@rebasepro/server";
 import { MongoRealtimeService } from "./services/MongoRealtimeService";
 import { MongoDriver } from "./services/MongoDriver";
@@ -216,6 +216,14 @@ roles: verifiedUser.roles } }));
                     }
                 }
 
+                /** @see the Postgres socket — same rule, same reason. */
+                const assertWriteRequest = (path: string | undefined, values: unknown): void => {
+                    if (!path || !values || typeof values !== "object") return;
+                    const collection = driver.registry?.getCollectionByPath(path);
+                    if (!collection) return;
+                    assertWriteRequestValid(values as Record<string, unknown>, collection);
+                };
+
                 const getScopedDelegate = async (): Promise<DataDriver> => {
                     const session = clientSessions.get(clientId);
                     if (session?.user && isDriverWithAuth(driver)) {
@@ -259,6 +267,11 @@ requestId }));
                     }
                     case "SAVE": {
                         const request: SaveProps = payload;
+                        // The REST layer's write checks, at this boundary too —
+                        // the socket is a second way in, and it used to be the
+                        // unchecked one. Collection from the registry by path,
+                        // never from the client's `request.collection`.
+                        assertWriteRequest(request.path, request.values as Record<string, unknown>);
                         const delegate = await getScopedDelegate();
                         const row = await delegate.save(request);
                         ws.send(JSON.stringify({ type: "SAVE_SUCCESS",
@@ -352,6 +365,17 @@ roles: session.user.roles ?? [] } : undefined;
                         logger.error("❌ [WebSocket Server] Unknown message type", { detail: type });
                 }
             } catch (error: unknown) {
+                // A refused write keeps its message: it is the only thing that
+                // tells the caller what to send instead, and the generic branch
+                // below drops it in production.
+                if (error instanceof ApiError || (error as Error)?.name === "ApiError") {
+                    const apiError = error as ApiError;
+                    ws.send(JSON.stringify({ type: "ERROR",
+requestId,
+payload: { error: { message: apiError.message,
+code: apiError.code } } }));
+                    return;
+                }
                 const errorMessage = process.env.NODE_ENV === "production" ? "An unexpected error occurred" : (error instanceof Error ? error.message : "An unexpected error occurred");
                 ws.send(JSON.stringify({ type: "ERROR",
 requestId,

package/dist/websocket-Bs54-gR-.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"websocket-Bs54-gR-.js","names":[],"sources":["../src/websocket.ts"],"sourcesContent":["import { RealtimeProvider, DataDriver, FetchCollectionProps, FetchOneProps, SaveProps, DeleteProps, TableMetadata, DatabaseAdmin, isSchemaAdmin, isDocumentAdmin, User, AuthAdapter } from \"@rebasepro/types\";\nimport { WebSocketServer, WebSocket } from \"ws\";\nimport { Server } from \"http\";\nimport { inspect } from \"util\";\nimport { extractUserFromToken, resolveRequireAuth } from \"@rebasepro/server\";\nimport type { RebaseAuthConfig } from \"@rebasepro/server\";\nimport { MongoRealtimeService } from \"./services/MongoRealtimeService\";\nimport { MongoDriver } from \"./services/MongoDriver\";\nimport { logger } from \"@rebasepro/server\";\n\ninterface DriverWithAuth extends DataDriver {\n    withAuth(user: Record<string, unknown>): Promise<DataDriver>;\n}\n\nfunction isDriverWithAuth(driver: DataDriver): driver is DriverWithAuth {\n    return \"withAuth\" in driver && typeof (driver as Record<string, unknown>).withAuth === \"function\";\n}\n\n/**\n * Normalized user identity for WebSocket sessions — the same shape the Postgres\n * socket keeps, because an `AuthAdapter` user is not an access-token payload.\n */\ninterface WsUserIdentity {\n    uid: string;\n    email?: string;\n    displayName?: string;\n    photoURL?: string;\n    roles: string[];\n    isAdmin: boolean;\n}\n\ninterface ClientSession {\n    ws: WebSocket;\n    user?: WsUserIdentity;\n    authenticated: boolean;\n    messageCount: number;\n    messageWindowStart: number;\n}\n\nconst WS_RATE_LIMIT = 2000;\nconst WS_RATE_WINDOW_MS = 60_000;\n\nconst ADMIN_ONLY_TYPES = new Set([\n    \"EXECUTE_SQL\",\n    \"FETCH_DATABASES\",\n    \"FETCH_ROLES\",\n    \"FETCH_UNMAPPED_TABLES\",\n    \"FETCH_TABLE_METADATA\",\n    \"FETCH_CURRENT_DATABASE\",\n    \"CREATE_BRANCH\",\n    \"DELETE_BRANCH\",\n    \"LIST_BRANCHES\"\n]);\n\nfunction isAdminSession(session: ClientSession | undefined): boolean {\n    if (!session?.user) return false;\n    // The adapter's own answer first; a role *named* `admin` is only the\n    // fallback for the built-in JWT path.\n    if (session.user.isAdmin) return true;\n    return (session.user.roles ?? []).some((r) => r === \"admin\");\n}\n\nexport function createMongoWebSocket(\n    server: Server,\n    realtimeService: MongoRealtimeService,\n    driver: MongoDriver,\n    authConfig?: RebaseAuthConfig,\n    admin?: DatabaseAdmin,\n    authAdapter?: AuthAdapter\n) {\n    // Scoped to this factory invocation rather than the module, so sessions do\n    // not leak across hot reloads or a second server on the same process — the\n    // Postgres socket keeps it here for the same reason.\n    const clientSessions = new Map<string, ClientSession>();\n\n    const isProduction = process.env.NODE_ENV === \"production\";\n    const wsDebug = (...args: unknown[]) => { if (!isProduction) console.debug(...args); };\n    const wss = new WebSocketServer({ server });\n\n    wss.on(\"error\", (err: NodeJS.ErrnoException) => {\n        if (err.code === \"EADDRINUSE\") return;\n        logger.error(\"❌ [WebSocket Server] Error\", { error: err });\n    });\n\n    // The same predicate the HTTP data routes use, from the same function. See\n    // `resolveRequireAuth` for what this socket's local copy got wrong — most\n    // importantly that a `false` here does not skip a check, it marks every\n    // session `authenticated` at connect time.\n    const requireAuth = !!authAdapter || resolveRequireAuth(authConfig);\n\n    if (requireAuth && !authAdapter && !authConfig?.jwtSecret) {\n        logger.warn(\n            \"🔐 [WebSocket Server] Authentication is required but no adapter or jwtSecret is \" +\n            \"configured — no client can complete AUTH, so every realtime message will be refused.\"\n        );\n    }\n\n    wss.on(\"connection\", (ws) => {\n        const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;\n        wsDebug(`WebSocket client connected: ${clientId}`);\n\n        clientSessions.set(clientId, { ws,\nauthenticated: !requireAuth,\nmessageCount: 0,\nmessageWindowStart: Date.now() });\n        realtimeService.addClient(clientId, ws);\n\n        ws.on(\"close\", () => {\n            wsDebug(`WebSocket client disconnected: ${clientId}`);\n            clientSessions.delete(clientId);\n        });\n\n        ws.on(\"message\", async (message) => {\n            let requestId: string | undefined;\n            try {\n                const { type, payload, requestId: reqId } = JSON.parse(message.toString());\n                requestId = reqId;\n\n                wsDebug(`[WS] ${clientId} → ${type}`, requestId ? `(${requestId})` : \"\");\n\n                const sendError = (errType: \"ERROR\" | \"AUTH_ERROR\", code: string, msg: string) => {\n                    ws.send(JSON.stringify({ type: errType,\nrequestId,\npayload: { error: { message: msg,\ncode } } }));\n                };\n\n                if (type === \"AUTHENTICATE\") {\n                    const { token } = payload || {};\n                    if (!token) {\n                        sendError(\"AUTH_ERROR\", \"INVALID_INPUT\", \"Token is required\");\n                        return;\n                    }\n\n                    // The adapter verifies when one is configured, exactly as the\n                    // HTTP routes do; the built-in JWT path is the fallback.\n                    let verifiedUser: WsUserIdentity | null = null;\n\n                    if (authAdapter) {\n                        try {\n                            const adapterUser = authAdapter.verifyToken\n                                ? await authAdapter.verifyToken(token)\n                                : await authAdapter.verifyRequest(new Request(\"http://localhost/_ws_auth\", {\n                                    headers: { Authorization: `Bearer ${token}` }\n                                }));\n                            if (adapterUser) {\n                                verifiedUser = {\n                                    uid: adapterUser.uid,\n                                    email: adapterUser.email,\n                                    roles: adapterUser.roles ?? [],\n                                    isAdmin: !!adapterUser.isAdmin\n                                };\n                            }\n                        } catch {\n                            // Adapter threw — treat as invalid token\n                        }\n                    } else {\n                        const jwtPayload = extractUserFromToken(token);\n                        if (jwtPayload) {\n                            verifiedUser = {\n                                uid: jwtPayload.uid,\n                                email: jwtPayload.email,\n                                displayName: jwtPayload.displayName,\n                                photoURL: jwtPayload.photoURL,\n                                roles: jwtPayload.roles ?? [],\n                                isAdmin: (jwtPayload.roles ?? []).some((r: string) => r === \"admin\")\n                            };\n                        }\n                    }\n\n                    if (verifiedUser) {\n                        const session = clientSessions.get(clientId);\n                        if (session) {\n                            session.user = verifiedUser;\n                            session.authenticated = true;\n                        }\n                        ws.send(JSON.stringify({ type: \"AUTH_SUCCESS\",\nrequestId,\npayload: { uid: verifiedUser.uid,\nroles: verifiedUser.roles } }));\n                    } else {\n                        sendError(\"AUTH_ERROR\", \"INVALID_TOKEN\", \"Invalid or expired token\");\n                    }\n                    return;\n                }\n\n                if (requireAuth) {\n                    const session = clientSessions.get(clientId);\n                    if (!session?.authenticated) {\n                        sendError(\"ERROR\", \"UNAUTHORIZED\", \"Authentication required\");\n                        return;\n                    }\n                }\n\n                {\n                    const session = clientSessions.get(clientId);\n                    if (session) {\n                        const now = Date.now();\n                        if (now - session.messageWindowStart > WS_RATE_WINDOW_MS) {\n                            session.messageCount = 0;\n                            session.messageWindowStart = now;\n                        }\n                        session.messageCount++;\n                        if (session.messageCount > WS_RATE_LIMIT) {\n                            sendError(\"ERROR\", \"RATE_LIMITED\", \"Too many requests. Please slow down.\");\n                            return;\n                        }\n                    }\n                }\n\n                if (ADMIN_ONLY_TYPES.has(type)) {\n                    const session = clientSessions.get(clientId);\n                    if (!isAdminSession(session)) {\n                        sendError(\"ERROR\", \"FORBIDDEN\", \"Admin access required for this operation\");\n                        return;\n                    }\n                }\n\n                const getScopedDelegate = async (): Promise<DataDriver> => {\n                    const session = clientSessions.get(clientId);\n                    if (session?.user && isDriverWithAuth(driver)) {\n                        try {\n                            const userForAuth: User = {\n                                uid: session.user.uid,\n                                email: session.user.email ?? \"\",\n                                displayName: session.user.displayName ?? \"\",\n                                photoURL: session.user.photoURL ?? \"\",\n                                providerId: \"jwt\",\n                                isAnonymous: false,\n                                roles: session.user.roles ?? []\n                            };\n                            return await driver.withAuth(userForAuth);\n                        } catch (e) {\n                            logger.error(\"Failed to create authenticated delegate for WS request\", { error: e });\n                            return driver;\n                        }\n                    }\n                    return driver;\n                };\n\n                switch (type) {\n                    case \"FETCH_COLLECTION\": {\n                        const request: FetchCollectionProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const rows = await delegate.fetchCollection(request);\n                        ws.send(JSON.stringify({ type: \"FETCH_COLLECTION_SUCCESS\",\npayload: { rows },\nrequestId }));\n                        break;\n                    }\n                    case \"FETCH_ONE\": {\n                        const request: FetchOneProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const row = await delegate.fetchOne(request);\n                        ws.send(JSON.stringify({ type: \"FETCH_ONE_SUCCESS\",\npayload: { row },\nrequestId }));\n                        break;\n                    }\n                    case \"SAVE\": {\n                        const request: SaveProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const row = await delegate.save(request);\n                        ws.send(JSON.stringify({ type: \"SAVE_SUCCESS\",\npayload: { row },\nrequestId }));\n                        break;\n                    }\n                    case \"DELETE\": {\n                        const request: DeleteProps = payload;\n                        const delegate = await getScopedDelegate();\n                        await delegate.delete(request);\n                        ws.send(JSON.stringify({ type: \"DELETE_SUCCESS\",\npayload: { success: true },\nrequestId }));\n                        break;\n                    }\n                    case \"CHECK_UNIQUE_FIELD\": {\n                        const { path, name, value, id, collection } = payload;\n                        const delegate = await getScopedDelegate();\n                        const isUnique = await delegate.checkUniqueField(path, name, value, id, collection);\n                        ws.send(JSON.stringify({ type: \"CHECK_UNIQUE_FIELD_SUCCESS\",\npayload: { isUnique },\nrequestId }));\n                        break;\n                    }\n                    case \"COUNT\": {\n                        const request: FetchCollectionProps = payload;\n                        const delegate = await getScopedDelegate();\n                        const count = await delegate.count!(request);\n                        ws.send(JSON.stringify({ type: \"COUNT_SUCCESS\",\npayload: { count },\nrequestId }));\n                        break;\n                    }\n                    case \"EXECUTE_SQL\": {\n                        const { sql, options } = payload;\n                        if (admin && isDocumentAdmin(admin) && admin.executeAggregate) {\n                            const result = await admin.executeAggregate(sql as Record<string, unknown>[]);\n                            ws.send(JSON.stringify({ type: \"EXECUTE_SQL_SUCCESS\",\npayload: { result },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"ERROR\",\nrequestId,\npayload: { error: { message: \"SQL execution not supported for this driver\",\ncode: \"NOT_SUPPORTED\" } } }));\n                        }\n                        break;\n                    }\n                    case \"FETCH_UNMAPPED_TABLES\": {\n                        if (admin && isSchemaAdmin(admin)) {\n                            const tables = await admin.fetchUnmappedTables?.(payload?.mappedPaths) || [];\n                            ws.send(JSON.stringify({ type: \"FETCH_UNMAPPED_TABLES_SUCCESS\",\npayload: { tables },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"FETCH_UNMAPPED_TABLES_SUCCESS\",\npayload: { tables: [] },\nrequestId }));\n                        }\n                        break;\n                    }\n                    case \"FETCH_TABLE_METADATA\": {\n                        const { tableName } = payload;\n                        if (admin && isSchemaAdmin(admin)) {\n                            const metadata = await admin.fetchTableMetadata?.(tableName);\n                            ws.send(JSON.stringify({ type: \"FETCH_TABLE_METADATA_SUCCESS\",\npayload: { metadata },\nrequestId }));\n                        } else {\n                            ws.send(JSON.stringify({ type: \"FETCH_TABLE_METADATA_SUCCESS\",\npayload: { metadata: null },\nrequestId }));\n                        }\n                        break;\n                    }\n                    case \"subscribe_collection\":\n                    case \"subscribe_one\":\n                    case \"unsubscribe\": {\n                        const session = clientSessions.get(clientId);\n                        const authContext = session?.user ? { uid: session.user.uid,\nroles: session.user.roles ?? [] } : undefined;\n                        await realtimeService.handleClientMessage(clientId, {\n                            type,\n                            payload,\n                            subscriptionId: payload?.subscriptionId\n                        }, authContext);\n                        break;\n                    }\n                    default:\n                        logger.error(\"❌ [WebSocket Server] Unknown message type\", { detail: type });\n                }\n            } catch (error: unknown) {\n                const errorMessage = process.env.NODE_ENV === \"production\" ? \"An unexpected error occurred\" : (error instanceof Error ? error.message : \"An unexpected error occurred\");\n                ws.send(JSON.stringify({ type: \"ERROR\",\nrequestId,\npayload: { error: { message: errorMessage,\ncode: \"INTERNAL_ERROR\" } } }));\n            }\n        });\n    });\n}\n"],"mappings":";;;;AAcA,SAAS,iBAAiB,QAA8C;CACpE,OAAO,cAAc,UAAU,OAAQ,OAAmC,aAAa;AAC3F;AAuBA,IAAM,gBAAgB;AACtB,IAAM,oBAAoB;AAE1B,IAAM,mCAAmB,IAAI,IAAI;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ,CAAC;AAED,SAAS,eAAe,SAA6C;CACjE,IAAI,CAAC,SAAS,MAAM,OAAO;CAG3B,IAAI,QAAQ,KAAK,SAAS,OAAO;CACjC,QAAQ,QAAQ,KAAK,SAAS,CAAC,EAAA,CAAG,MAAM,MAAM,MAAM,OAAO;AAC/D;AAEA,SAAgB,qBACZ,QACA,iBACA,QACA,YACA,OACA,aACF;CAIE,MAAM,iCAAiB,IAAI,IAA2B;CAEtD,MAAM,eAAA,QAAA,IAAA,aAAwC;CAC9C,MAAM,WAAW,GAAG,SAAoB;EAAE,IAAI,CAAC,cAAc,QAAQ,MAAM,GAAG,IAAI;CAAG;CACrF,MAAM,MAAM,IAAI,gBAAgB,EAAE,OAAO,CAAC;CAE1C,IAAI,GAAG,UAAU,QAA+B;EAC5C,IAAI,IAAI,SAAS,cAAc;EAC/B,OAAO,MAAM,8BAA8B,EAAE,OAAO,IAAI,CAAC;CAC7D,CAAC;CAMD,MAAM,cAAc,CAAC,CAAC,eAAe,mBAAmB,UAAU;CAElE,IAAI,eAAe,CAAC,eAAe,CAAC,YAAY,WAC5C,OAAO,KACH,sKAEJ;CAGJ,IAAI,GAAG,eAAe,OAAO;EACzB,MAAM,WAAW,UAAU,KAAK,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC;EAClF,QAAQ,+BAA+B,UAAU;EAEjD,eAAe,IAAI,UAAU;GAAE;GACvC,eAAe,CAAC;GAChB,cAAc;GACd,oBAAoB,KAAK,IAAI;EAAE,CAAC;EACxB,gBAAgB,UAAU,UAAU,EAAE;EAEtC,GAAG,GAAG,eAAe;GACjB,QAAQ,kCAAkC,UAAU;GACpD,eAAe,OAAO,QAAQ;EAClC,CAAC;EAED,GAAG,GAAG,WAAW,OAAO,YAAY;GAChC,IAAI;GACJ,IAAI;IACA,MAAM,EAAE,MAAM,SAAS,WAAW,UAAU,KAAK,MAAM,QAAQ,SAAS,CAAC;IACzE,YAAY;IAEZ,QAAQ,QAAQ,SAAS,KAAK,QAAQ,YAAY,IAAI,UAAU,KAAK,EAAE;IAEvE,MAAM,aAAa,SAAiC,MAAc,QAAgB;KAC9E,GAAG,KAAK,KAAK,UAAU;MAAE,MAAM;MACnD;MACA,SAAS,EAAE,OAAO;OAAE,SAAS;OAC7B;MAAK,EAAE;KAAE,CAAC,CAAC;IACK;IAEA,IAAI,SAAS,gBAAgB;KACzB,MAAM,EAAE,UAAU,WAAW,CAAC;KAC9B,IAAI,CAAC,OAAO;MACR,UAAU,cAAc,iBAAiB,mBAAmB;MAC5D;KACJ;KAIA,IAAI,eAAsC;KAE1C,IAAI,aACA,IAAI;MACA,MAAM,cAAc,YAAY,cAC1B,MAAM,YAAY,YAAY,KAAK,IACnC,MAAM,YAAY,cAAc,IAAI,QAAQ,6BAA6B,EACvE,SAAS,EAAE,eAAe,UAAU,QAAQ,EAChD,CAAC,CAAC;MACN,IAAI,aACA,eAAe;OACX,KAAK,YAAY;OACjB,OAAO,YAAY;OACnB,OAAO,YAAY,SAAS,CAAC;OAC7B,SAAS,CAAC,CAAC,YAAY;MAC3B;KAER,QAAQ,CAER;UACG;MACH,MAAM,aAAa,qBAAqB,KAAK;MAC7C,IAAI,YACA,eAAe;OACX,KAAK,WAAW;OAChB,OAAO,WAAW;OAClB,aAAa,WAAW;OACxB,UAAU,WAAW;OACrB,OAAO,WAAW,SAAS,CAAC;OAC5B,UAAU,WAAW,SAAS,CAAC,EAAA,CAAG,MAAM,MAAc,MAAM,OAAO;MACvE;KAER;KAEA,IAAI,cAAc;MACd,MAAM,UAAU,eAAe,IAAI,QAAQ;MAC3C,IAAI,SAAS;OACT,QAAQ,OAAO;OACf,QAAQ,gBAAgB;MAC5B;MACA,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD;OACA,SAAS;QAAE,KAAK,aAAa;QAC7B,OAAO,aAAa;OAAM;MAAE,CAAC,CAAC;KACV,OACI,UAAU,cAAc,iBAAiB,0BAA0B;KAEvE;IACJ;IAEA,IAAI;SAEI,CADY,eAAe,IAAI,QAC9B,CAAA,EAAS,eAAe;MACzB,UAAU,SAAS,gBAAgB,yBAAyB;MAC5D;KACJ;;IAGJ;KACI,MAAM,UAAU,eAAe,IAAI,QAAQ;KAC3C,IAAI,SAAS;MACT,MAAM,MAAM,KAAK,IAAI;MACrB,IAAI,MAAM,QAAQ,qBAAqB,mBAAmB;OACtD,QAAQ,eAAe;OACvB,QAAQ,qBAAqB;MACjC;MACA,QAAQ;MACR,IAAI,QAAQ,eAAe,eAAe;OACtC,UAAU,SAAS,gBAAgB,sCAAsC;OACzE;MACJ;KACJ;IACJ;IAEA,IAAI,iBAAiB,IAAI,IAAI;SAErB,CAAC,eADW,eAAe,IAAI,QACf,CAAO,GAAG;MAC1B,UAAU,SAAS,aAAa,0CAA0C;MAC1E;KACJ;;IAGJ,MAAM,oBAAoB,YAAiC;KACvD,MAAM,UAAU,eAAe,IAAI,QAAQ;KAC3C,IAAI,SAAS,QAAQ,iBAAiB,MAAM,GACxC,IAAI;MACA,MAAM,cAAoB;OACtB,KAAK,QAAQ,KAAK;OAClB,OAAO,QAAQ,KAAK,SAAS;OAC7B,aAAa,QAAQ,KAAK,eAAe;OACzC,UAAU,QAAQ,KAAK,YAAY;OACnC,YAAY;OACZ,aAAa;OACb,OAAO,QAAQ,KAAK,SAAS,CAAC;MAClC;MACA,OAAO,MAAM,OAAO,SAAS,WAAW;KAC5C,SAAS,GAAG;MACR,OAAO,MAAM,0DAA0D,EAAE,OAAO,EAAE,CAAC;MACnF,OAAO;KACX;KAEJ,OAAO;IACX;IAEA,QAAQ,MAAR;KACI,KAAK,oBAAoB;MACrB,MAAM,UAAgC;MAEtC,MAAM,OAAO,OAAM,MADI,kBAAkB,EAAA,CACb,gBAAgB,OAAO;MACnD,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,KAAK;OAChB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,aAAa;MACd,MAAM,UAAyB;MAE/B,MAAM,MAAM,OAAM,MADK,kBAAkB,EAAA,CACd,SAAS,OAAO;MAC3C,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,IAAI;OACf;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,QAAQ;MACT,MAAM,UAAqB;MAE3B,MAAM,MAAM,OAAM,MADK,kBAAkB,EAAA,CACd,KAAK,OAAO;MACvC,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,IAAI;OACf;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,UAAU;MACX,MAAM,UAAuB;MAE7B,OAAM,MADiB,kBAAkB,EAAA,CAC1B,OAAO,OAAO;MAC7B,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,SAAS,KAAK;OACzB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,sBAAsB;MACvB,MAAM,EAAE,MAAM,MAAM,OAAO,IAAI,eAAe;MAE9C,MAAM,WAAW,OAAM,MADA,kBAAkB,EAAA,CACT,iBAAiB,MAAM,MAAM,OAAO,IAAI,UAAU;MAClF,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,SAAS;OACpB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,SAAS;MACV,MAAM,UAAgC;MAEtC,MAAM,QAAQ,OAAM,MADG,kBAAkB,EAAA,CACZ,MAAO,OAAO;MAC3C,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OACvD,SAAS,EAAE,MAAM;OACjB;MAAU,CAAC,CAAC;MACY;KACJ;KACA,KAAK,eAAe;MAChB,MAAM,EAAE,KAAK,YAAY;MACzB,IAAI,SAAS,gBAAgB,KAAK,KAAK,MAAM,kBAAkB;OAC3D,MAAM,SAAS,MAAM,MAAM,iBAAiB,GAAgC;OAC5E,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,OAAO;QAClB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D;OACA,SAAS,EAAE,OAAO;QAAE,SAAS;QAC7B,MAAM;OAAgB,EAAE;MAAE,CAAC,CAAC;MAEJ;KACJ;KACA,KAAK;MACD,IAAI,SAAS,cAAc,KAAK,GAAG;OAC/B,MAAM,SAAS,MAAM,MAAM,sBAAsB,SAAS,WAAW,KAAK,CAAC;OAC3E,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,OAAO;QAClB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D,SAAS,EAAE,QAAQ,CAAC,EAAE;OACtB;MAAU,CAAC,CAAC;MAEY;KAEJ,KAAK,wBAAwB;MACzB,MAAM,EAAE,cAAc;MACtB,IAAI,SAAS,cAAc,KAAK,GAAG;OAC/B,MAAM,WAAW,MAAM,MAAM,qBAAqB,SAAS;OAC3D,GAAG,KAAK,KAAK,UAAU;QAAE,MAAM;QAC3D,SAAS,EAAE,SAAS;QACpB;OAAU,CAAC,CAAC;MACY,OACI,GAAG,KAAK,KAAK,UAAU;OAAE,MAAM;OAC3D,SAAS,EAAE,UAAU,KAAK;OAC1B;MAAU,CAAC,CAAC;MAEY;KACJ;KACA,KAAK;KACL,KAAK;KACL,KAAK,eAAe;MAChB,MAAM,UAAU,eAAe,IAAI,QAAQ;MAC3C,MAAM,cAAc,SAAS,OAAO;OAAE,KAAK,QAAQ,KAAK;OAChF,OAAO,QAAQ,KAAK,SAAS,CAAC;MAAE,IAAI,KAAA;MACZ,MAAM,gBAAgB,oBAAoB,UAAU;OAChD;OACA;OACA,gBAAgB,SAAS;MAC7B,GAAG,WAAW;MACd;KACJ;KACA,SACI,OAAO,MAAM,6CAA6C,EAAE,QAAQ,KAAK,CAAC;IAClF;GACJ,SAAS,OAAgB;IACrB,MAAM,eAAA,QAAA,IAAA,aAAwC,eAAe,iCAAkC,iBAAiB,QAAQ,MAAM,UAAU;IACxI,GAAG,KAAK,KAAK,UAAU;KAAE,MAAM;KAC/C;KACA,SAAS,EAAE,OAAO;MAAE,SAAS;MAC7B,MAAM;KAAiB,EAAE;IAAE,CAAC,CAAC;GACjB;EACJ,CAAC;CACL,CAAC;AACL"}