@rebasepro/server-postgres 0.12.0 → 0.12.1-canary.g009ed95

package/dist/websocket-B2LsrINK.js

@@ -0,0 +1,530 @@
+import { createRequire as __createRequire } from "module";
+import process from "process";
+__createRequire(import.meta.url);
+import { c as __exportAll } from "./connection-BuZ97wsr.js";
+import "./src-DoU9yPqq.js";
+import { t as ANONYMOUS_USER_ID } from "./policy-CeA1JcxP.js";
+import { extractUserFromToken, logger, resolveRequireAuth, safeCompare } from "@rebasepro/server";
+import { WebSocketServer } from "ws";
+import { inspect } from "util";
+//#region ../types/src/types/backend.ts
+/**
+* Type guard: does this admin support SQL operations?
+* @group Admin
+*/
+function isSQLAdmin(admin) {
+	return !!admin && typeof admin.executeSql === "function";
+}
+/**
+* Type guard: does this admin support schema management?
+* @group Admin
+*/
+function isSchemaAdmin(admin) {
+	return !!admin && (typeof admin.fetchUnmappedTables === "function" || typeof admin.fetchTableMetadata === "function");
+}
+//#endregion
+//#region src/websocket.ts
+var websocket_exports = /* @__PURE__ */ __exportAll({ createPostgresWebSocket: () => createPostgresWebSocket });
+/** Maximum messages per client per window */
+var WS_RATE_LIMIT = 2e3;
+/** Rate limit window in milliseconds (60 seconds) */
+var WS_RATE_WINDOW_MS = 6e4;
+/** Admin-only WebSocket message types */
+var ADMIN_ONLY_TYPES = /* @__PURE__ */ new Set([
+	"EXECUTE_SQL",
+	"FETCH_DATABASES",
+	"FETCH_ROLES",
+	"FETCH_UNMAPPED_TABLES",
+	"FETCH_TABLE_METADATA",
+	"FETCH_CURRENT_DATABASE",
+	"CREATE_BRANCH",
+	"DELETE_BRANCH",
+	"LIST_BRANCHES"
+]);
+/**
+* Recursively extract the deepest error message from an error's cause chain (e.g., Drizzle wrapping a PG error).
+*/
+function extractErrorMessage(error) {
+	if (!error) return "Unknown error";
+	if (error instanceof Error) {
+		if ("cause" in error && error.cause) return extractErrorMessage(error.cause);
+		return error.message;
+	}
+	if (typeof error === "object" && "message" in error && typeof error.message === "string") return error.message;
+	return String(error);
+}
+/**
+* Check if the current session belongs to an admin user.
+*/
+function isAdminSession(session) {
+	if (!session?.user) return false;
+	if (session.user.isAdmin) return true;
+	if (!session.user.roles) return false;
+	return session.user.roles.some((r) => r === "admin");
+}
+function createPostgresWebSocket(server, realtimeService, driver, authConfig, authAdapter) {
+	const clientSessions = /* @__PURE__ */ new Map();
+	const isProduction = process.env.NODE_ENV === "production";
+	/** Debug logger that is suppressed in production to prevent PII/data leaks */
+	const wsDebug = (...args) => {
+		if (!isProduction) console.debug(...args);
+	};
+	const wss = new WebSocketServer({ server });
+	wss.on("error", (err) => {
+		if (err.code === "EADDRINUSE") return;
+		logger.error("❌ [WebSocket Server] Error", { error: err });
+	});
+	const requireAuth = !!authAdapter || resolveRequireAuth(authConfig);
+	if (requireAuth && !authAdapter && !authConfig?.jwtSecret && !authConfig?.serviceKey) logger.warn("🔐 [WebSocket Server] Authentication is required but no adapter, jwtSecret or serviceKey is configured — no client can complete AUTH, so every realtime message will be refused with UNAUTHORIZED.");
+	wss.on("connection", (ws) => {
+		const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
+		wsDebug(`WebSocket client connected: ${clientId}`);
+		clientSessions.set(clientId, {
+			ws,
+			authenticated: !requireAuth,
+			messageCount: 0,
+			messageWindowStart: Date.now()
+		});
+		realtimeService.addClient(clientId, ws);
+		ws.on("close", () => {
+			wsDebug(`WebSocket client disconnected: ${clientId}`);
+			clientSessions.delete(clientId);
+		});
+		ws.on("message", async (message) => {
+			let requestId;
+			try {
+				const { type, payload, requestId: reqId } = JSON.parse(message.toString());
+				requestId = reqId;
+				wsDebug(`[WS] ${clientId} → ${type}`, requestId ? `(${requestId})` : "");
+				const sendError = (errType, code, msg) => {
+					ws.send(JSON.stringify({
+						type: errType,
+						requestId,
+						payload: { error: {
+							message: msg,
+							code
+						} }
+					}));
+				};
+				if (type === "AUTHENTICATE") {
+					const { token } = payload || {};
+					if (!token) {
+						sendError("AUTH_ERROR", "INVALID_INPUT", "Token is required");
+						return;
+					}
+					let verifiedUser = null;
+					if (authAdapter) try {
+						const adapterUser = authAdapter.verifyToken ? await authAdapter.verifyToken(token) : await authAdapter.verifyRequest(new Request("http://localhost/_ws_auth", { headers: { Authorization: `Bearer ${token}` } }));
+						if (adapterUser) verifiedUser = {
+							uid: adapterUser.uid,
+							roles: adapterUser.roles,
+							isAdmin: adapterUser.isAdmin
+						};
+					} catch {}
+					else if (authConfig?.serviceKey && safeCompare(token, authConfig.serviceKey)) verifiedUser = {
+						uid: "service",
+						roles: ["admin"],
+						isAdmin: true
+					};
+					else {
+						const jwtPayload = extractUserFromToken(token);
+						if (jwtPayload) verifiedUser = {
+							uid: jwtPayload.uid,
+							roles: jwtPayload.roles ?? [],
+							isAdmin: (jwtPayload.roles ?? []).some((r) => r === "admin")
+						};
+					}
+					if (verifiedUser) {
+						const session = clientSessions.get(clientId);
+						if (session) {
+							session.user = verifiedUser;
+							session.authenticated = true;
+						}
+						wsDebug(`[WS] replying AUTH_SUCCESS for requestId ${requestId}`);
+						ws.send(JSON.stringify({
+							type: "AUTH_SUCCESS",
+							requestId,
+							payload: {
+								uid: verifiedUser.uid,
+								roles: verifiedUser.roles
+							}
+						}));
+						wsDebug(`🔐 [WebSocket Server] Client ${clientId} authenticated as ${verifiedUser.uid}`);
+					} else {
+						wsDebug(`[WS] replying AUTH_ERROR for requestId ${requestId} (invalid token)`);
+						sendError("AUTH_ERROR", "INVALID_TOKEN", "Invalid or expired token");
+					}
+					return;
+				}
+				if (requireAuth) {
+					if (!clientSessions.get(clientId)?.authenticated) {
+						sendError("ERROR", "UNAUTHORIZED", "Authentication required");
+						return;
+					}
+				}
+				{
+					const session = clientSessions.get(clientId);
+					if (session) {
+						const now = Date.now();
+						if (now - session.messageWindowStart > WS_RATE_WINDOW_MS) {
+							session.messageCount = 0;
+							session.messageWindowStart = now;
+						}
+						session.messageCount++;
+						if (session.messageCount > WS_RATE_LIMIT) {
+							sendError("ERROR", "RATE_LIMITED", "Too many requests. Please slow down.");
+							return;
+						}
+					}
+				}
+				if (ADMIN_ONLY_TYPES.has(type)) {
+					if (!isAdminSession(clientSessions.get(clientId))) {
+						sendError("ERROR", "FORBIDDEN", "Admin access required for this operation");
+						return;
+					}
+				}
+				const getScopedDelegate = async () => {
+					const session = clientSessions.get(clientId);
+					if (typeof driver.withAuth === "function") try {
+						const userForAuth = session?.user ? {
+							uid: session.user.uid,
+							displayName: null,
+							email: null,
+							photoURL: null,
+							providerId: "websocket",
+							isAnonymous: false,
+							roles: session.user.roles ?? []
+						} : {
+							uid: ANONYMOUS_USER_ID,
+							displayName: null,
+							email: null,
+							photoURL: null,
+							providerId: "websocket",
+							isAnonymous: true,
+							roles: ["anon"]
+						};
+						return await driver.withAuth(userForAuth);
+					} catch (e) {
+						logger.error("Failed to create RLS scoped delegate for WS request", { error: e });
+						throw new Error("Internal authentication error");
+					}
+					return driver;
+				};
+				switch (type) {
+					case "FETCH_COLLECTION":
+						{
+							wsDebug("📋 [WebSocket Server] Processing FETCH_COLLECTION request");
+							const request = payload;
+							const rows = await (await getScopedDelegate()).fetchCollection(request);
+							wsDebug("📋 [WebSocket Server] FETCH_COLLECTION result - rows count:", rows.length);
+							const response = {
+								type: "FETCH_COLLECTION_SUCCESS",
+								payload: { rows },
+								requestId
+							};
+							wsDebug("📋 [WebSocket Server] Sending FETCH_COLLECTION_SUCCESS response");
+							ws.send(JSON.stringify(response));
+						}
+						break;
+					case "FETCH_ONE":
+						{
+							wsDebug("📄 [WebSocket Server] Processing FETCH_ENTITY request");
+							const request = payload;
+							const row = await (await getScopedDelegate()).fetchOne(request);
+							wsDebug("📄 [WebSocket Server] FETCH_ENTITY result:", row);
+							const response = {
+								type: "FETCH_ONE_SUCCESS",
+								payload: { row: row ?? null },
+								requestId
+							};
+							wsDebug("📄 [WebSocket Server] Sending FETCH_ENTITY_SUCCESS response");
+							ws.send(JSON.stringify(response));
+						}
+						break;
+					case "SAVE":
+						{
+							wsDebug("💾 [WebSocket Server] Processing SAVE_ENTITY request");
+							const request = payload;
+							wsDebug("💾 [WebSocket Server] Saving row with request:", inspect(request, {
+								depth: null,
+								colors: true
+							}));
+							const row = await (await getScopedDelegate()).save(request);
+							wsDebug("💾 [WebSocket Server] SAVE_ENTITY result:", inspect(row, {
+								depth: null,
+								colors: true
+							}));
+							const response = {
+								type: "SAVE_SUCCESS",
+								payload: { row },
+								requestId
+							};
+							wsDebug("💾 [WebSocket Server] Sending SAVE_ENTITY_SUCCESS response");
+							ws.send(JSON.stringify(response));
+						}
+						break;
+					case "DELETE":
+						{
+							wsDebug("🗑️ [WebSocket Server] Processing DELETE_ENTITY request");
+							const request = payload;
+							wsDebug("🗑️ [WebSocket Server] Deleting row:", request.row);
+							await (await getScopedDelegate()).delete(request);
+							wsDebug("🗑️ [WebSocket Server] DELETE_ENTITY completed successfully");
+							const response = {
+								type: "DELETE_SUCCESS",
+								payload: { success: true },
+								requestId
+							};
+							wsDebug("🗑️ [WebSocket Server] Sending DELETE_ENTITY_SUCCESS response");
+							ws.send(JSON.stringify(response));
+						}
+						break;
+					case "CHECK_UNIQUE_FIELD":
+						{
+							wsDebug("🔍 [WebSocket Server] Processing CHECK_UNIQUE_FIELD request");
+							const { path, name, value, id, collection } = payload;
+							const isUnique = await (await getScopedDelegate()).checkUniqueField(path, name, value, id, collection);
+							wsDebug("🔍 [WebSocket Server] CHECK_UNIQUE_FIELD result:", isUnique);
+							const response = {
+								type: "CHECK_UNIQUE_FIELD_SUCCESS",
+								payload: { isUnique },
+								requestId
+							};
+							wsDebug("🔍 [WebSocket Server] Sending CHECK_UNIQUE_FIELD_SUCCESS response");
+							ws.send(JSON.stringify(response));
+						}
+						break;
+					case "COUNT":
+						{
+							const request = payload;
+							const response = {
+								type: "COUNT_SUCCESS",
+								payload: { count: await (await getScopedDelegate()).count(request) },
+								requestId
+							};
+							ws.send(JSON.stringify(response));
+						}
+						break;
+					case "EXECUTE_SQL":
+						{
+							const { sql, options } = payload;
+							try {
+								const admin = (await getScopedDelegate()).admin;
+								if (!isSQLAdmin(admin)) {
+									sendError("ERROR", "NOT_SUPPORTED", "SQL execution is not available for this driver.");
+									break;
+								}
+								const result = await admin.executeSql(sql, options);
+								if (process.env.NODE_ENV !== "production") wsDebug(`⚡ [WebSocket Server] SQL executed. Returned ${Array.isArray(result) ? result.length : "non-array"} rows.`);
+								const auditSession = clientSessions.get(clientId);
+								console.log("[SQL Audit] WebSocket SQL execution", JSON.stringify({
+									sql: typeof sql === "string" ? sql.substring(0, 500) : sql,
+									options,
+									resultRows: Array.isArray(result) ? result.length : "unknown",
+									uid: auditSession?.user?.uid ?? "unknown",
+									roles: auditSession?.user?.roles ?? [],
+									isAdmin: auditSession?.user?.isAdmin ?? false
+								}));
+								const response = {
+									type: "EXECUTE_SQL_SUCCESS",
+									payload: { result },
+									requestId
+								};
+								ws.send(JSON.stringify(response));
+							} catch (sqlError) {
+								sendError("ERROR", "SQL_ERROR", extractErrorMessage(sqlError));
+							}
+						}
+						break;
+					case "FETCH_DATABASES":
+						{
+							wsDebug("📚 [WebSocket Server] Processing FETCH_DATABASES request");
+							const admin = (await getScopedDelegate()).admin;
+							let databases = [];
+							if (isSQLAdmin(admin) && admin.fetchAvailableDatabases) databases = await admin.fetchAvailableDatabases();
+							wsDebug(`📚 [WebSocket Server] Fetched ${databases.length} databases.`);
+							const response = {
+								type: "FETCH_DATABASES_SUCCESS",
+								payload: { databases },
+								requestId
+							};
+							ws.send(JSON.stringify(response));
+						}
+						break;
+					case "FETCH_ROLES":
+						{
+							wsDebug("👤 [WebSocket Server] Processing FETCH_ROLES request");
+							const admin = (await getScopedDelegate()).admin;
+							let roles = [];
+							if (isSQLAdmin(admin) && admin.fetchAvailableRoles) roles = await admin.fetchAvailableRoles();
+							wsDebug(`👤 [WebSocket Server] Fetched ${roles.length} roles.`);
+							const response = {
+								type: "FETCH_ROLES_SUCCESS",
+								payload: { roles },
+								requestId
+							};
+							ws.send(JSON.stringify(response));
+						}
+						break;
+					case "FETCH_APPLICATION_ROLES":
+						{
+							wsDebug("👤 [WebSocket Server] Processing FETCH_APPLICATION_ROLES request");
+							const admin = (await getScopedDelegate()).admin;
+							let roles = [];
+							if (isSQLAdmin(admin) && admin.fetchApplicationRoles) roles = await admin.fetchApplicationRoles();
+							wsDebug(`👤 [WebSocket Server] Fetched ${roles.length} application roles.`);
+							const response = {
+								type: "FETCH_APPLICATION_ROLES_SUCCESS",
+								payload: { roles },
+								requestId
+							};
+							ws.send(JSON.stringify(response));
+						}
+						break;
+					case "FETCH_CURRENT_DATABASE":
+						{
+							wsDebug("📚 [WebSocket Server] Processing FETCH_CURRENT_DATABASE request");
+							const admin = (await getScopedDelegate()).admin;
+							let database = void 0;
+							if (isSQLAdmin(admin) && admin.fetchCurrentDatabase) database = await admin.fetchCurrentDatabase();
+							const response = {
+								type: "FETCH_CURRENT_DATABASE_SUCCESS",
+								payload: { database },
+								requestId
+							};
+							ws.send(JSON.stringify(response));
+						}
+						break;
+					case "FETCH_UNMAPPED_TABLES":
+						{
+							wsDebug("📋 [WebSocket Server] Processing FETCH_UNMAPPED_TABLES request");
+							const admin = (await getScopedDelegate()).admin;
+							let tables = [];
+							if (isSchemaAdmin(admin) && admin.fetchUnmappedTables) tables = await admin.fetchUnmappedTables(payload?.mappedPaths);
+							wsDebug(`📋 [WebSocket Server] Fetched ${tables.length} unmapped tables.`);
+							const response = {
+								type: "FETCH_UNMAPPED_TABLES_SUCCESS",
+								payload: { tables },
+								requestId
+							};
+							ws.send(JSON.stringify(response));
+						}
+						break;
+					case "FETCH_TABLE_METADATA":
+						{
+							wsDebug("📋 [WebSocket Server] Processing FETCH_TABLE_METADATA request");
+							const { tableName } = payload;
+							const admin = (await getScopedDelegate()).admin;
+							let metadata;
+							if (isSchemaAdmin(admin) && admin.fetchTableMetadata) metadata = await admin.fetchTableMetadata(tableName);
+							wsDebug(`📋 [WebSocket Server] Fetched metadata for table '${tableName}'. (${metadata?.columns?.length ?? 0} columns)`);
+							const response = {
+								type: "FETCH_TABLE_METADATA_SUCCESS",
+								payload: { metadata },
+								requestId
+							};
+							ws.send(JSON.stringify(response));
+						}
+						break;
+					case "CREATE_BRANCH":
+						{
+							wsDebug("🌿 [WebSocket Server] Processing CREATE_BRANCH request");
+							const { name, options } = payload;
+							const delegate = await getScopedDelegate();
+							if (!delegate.admin?.createBranch) {
+								sendError("ERROR", "NOT_SUPPORTED", "Database branching is not available. Configure adminConnectionString.");
+								break;
+							}
+							const branch = await delegate.admin.createBranch(name, options);
+							wsDebug(`🌿 [WebSocket Server] Branch created: ${branch.name}`);
+							const response = {
+								type: "CREATE_BRANCH_SUCCESS",
+								payload: { branch },
+								requestId
+							};
+							ws.send(JSON.stringify(response));
+						}
+						break;
+					case "DELETE_BRANCH":
+						{
+							wsDebug("🗑️ [WebSocket Server] Processing DELETE_BRANCH request");
+							const { name: branchName } = payload;
+							const delegate = await getScopedDelegate();
+							if (!delegate.admin?.deleteBranch) {
+								sendError("ERROR", "NOT_SUPPORTED", "Database branching is not available.");
+								break;
+							}
+							await delegate.admin.deleteBranch(branchName);
+							wsDebug(`🗑️ [WebSocket Server] Branch deleted: ${branchName}`);
+							const response = {
+								type: "DELETE_BRANCH_SUCCESS",
+								payload: { success: true },
+								requestId
+							};
+							ws.send(JSON.stringify(response));
+						}
+						break;
+					case "LIST_BRANCHES":
+						{
+							wsDebug("🌿 [WebSocket Server] Processing LIST_BRANCHES request");
+							const delegate = await getScopedDelegate();
+							let branches = [];
+							if (delegate.admin?.listBranches) branches = await delegate.admin.listBranches();
+							wsDebug(`🌿 [WebSocket Server] Listed ${branches.length} branches.`);
+							const response = {
+								type: "LIST_BRANCHES_SUCCESS",
+								payload: { branches },
+								requestId
+							};
+							ws.send(JSON.stringify(response));
+						}
+						break;
+					case "subscribe_collection":
+					case "subscribe_one":
+					case "unsubscribe":
+					case "join_channel":
+					case "leave_channel":
+					case "broadcast":
+					case "presence_track":
+					case "presence_untrack":
+					case "presence_state":
+					case "channel_history": {
+						wsDebug("🔄 [WebSocket Server] Routing realtime message to RealtimeService:", type);
+						const session = clientSessions.get(clientId);
+						const authContext = session?.user ? {
+							uid: session.user.uid,
+							roles: session.user.roles ?? []
+						} : {
+							uid: ANONYMOUS_USER_ID,
+							roles: ["anon"]
+						};
+						await realtimeService.handleClientMessage(clientId, {
+							type,
+							payload,
+							subscriptionId: payload?.subscriptionId
+						}, authContext);
+						break;
+					}
+					default: logger.error("❌ [WebSocket Server] Unknown message type", { detail: type });
+				}
+			} catch (error) {
+				logger.error("💥 [WebSocket Server] Error handling message", { error });
+				if (error instanceof Error) logger.error("Stack trace", { detail: error.stack });
+				const errorMessage = process.env.NODE_ENV === "production" ? "An unexpected error occurred" : extractErrorMessage(error);
+				const errorResponse = {
+					type: "ERROR",
+					requestId,
+					payload: { error: {
+						message: errorMessage,
+						code: "INTERNAL_ERROR"
+					} }
+				};
+				ws.send(JSON.stringify(errorResponse));
+			}
+		});
+	});
+}
+//#endregion
+export { websocket_exports as n, createPostgresWebSocket as t };
+
+//# sourceMappingURL=websocket-B2LsrINK.js.map