@rebasepro/server-postgres 0.16.0 → 0.16.1-canary.g0d7af95

package/dist/websocket-BVgDVO-V.js

@@ -1,614 +0,0 @@
-import { createRequire as __createRequire } from "module";
-import process from "process";
-__createRequire(import.meta.url);
-import { c as __exportAll } from "./connection-BuZ97wsr.js";
-import { n as resolveClientListLimit, r as ANONYMOUS_USER_ID, t as ListLimitError } from "./data_driver-ULAyJEi9.js";
-import "./src-BBFsDaeA.js";
-import { ApiError, assertWriteRequestValid, extractUserFromToken, logger, resolveRequireAuth, safeCompare } from "@rebasepro/server";
-import { WebSocketServer } from "ws";
-import { inspect } from "util";
-//#region ../types/src/types/backend.ts
-/**
-* Type guard: does this admin support SQL operations?
-* @group Admin
-*/
-function isSQLAdmin(admin) {
-	return !!admin && typeof admin.executeSql === "function";
-}
-/**
-* Type guard: does this admin support schema management?
-* @group Admin
-*/
-function isSchemaAdmin(admin) {
-	return !!admin && (typeof admin.fetchUnmappedTables === "function" || typeof admin.fetchTableMetadata === "function");
-}
-//#endregion
-//#region src/websocket.ts
-var websocket_exports = /* @__PURE__ */ __exportAll({ createPostgresWebSocket: () => createPostgresWebSocket });
-/** Maximum messages per client per window */
-var WS_RATE_LIMIT = 2e3;
-/** Rate limit window in milliseconds (60 seconds) */
-var WS_RATE_WINDOW_MS = 6e4;
-/**
-* Channel frames get their own budget, because they are a different workload.
-*
-* 2000/minute is 33/second, which is generous for queries and subscriptions and
-* an order of magnitude below what the documented channel idiom asks for: the
-* capacity note in `docs/backend/realtime.md` uses 60 fps cursor movement as
-* its worked example, and the presence idiom re-`track()`s on every move, so
-* one client sustaining that sends ~120 frames/second — 7200 a minute. Sharing
-* one counter meant the cursor stream ate the query budget and then froze for
-* the rest of the window.
-*
-* The number is sized to that documented workload and nothing more; it is not
-* a considered product limit (see `docs/channel-authorization.md`).
-*/
-var WS_CHANNEL_RATE_LIMIT = 7200;
-/** Frames counted against the channel budget rather than the general one. */
-var CHANNEL_MESSAGE_TYPES = /* @__PURE__ */ new Set([
-	"join_channel",
-	"leave_channel",
-	"broadcast",
-	"presence_track",
-	"presence_untrack",
-	"presence_state",
-	"channel_history"
-]);
-/** Admin-only WebSocket message types */
-var ADMIN_ONLY_TYPES = /* @__PURE__ */ new Set([
-	"EXECUTE_SQL",
-	"FETCH_DATABASES",
-	"FETCH_ROLES",
-	"FETCH_UNMAPPED_TABLES",
-	"FETCH_TABLE_METADATA",
-	"FETCH_CURRENT_DATABASE",
-	"CREATE_BRANCH",
-	"DELETE_BRANCH",
-	"LIST_BRANCHES"
-]);
-/**
-* Recursively extract the deepest error message from an error's cause chain (e.g., Drizzle wrapping a PG error).
-*/
-function extractErrorMessage(error) {
-	if (!error) return "Unknown error";
-	if (error instanceof Error) {
-		if ("cause" in error && error.cause) return extractErrorMessage(error.cause);
-		return error.message;
-	}
-	if (typeof error === "object" && "message" in error && typeof error.message === "string") return error.message;
-	return String(error);
-}
-/**
-* Check if the current session belongs to an admin user.
-*/
-function isAdminSession(session) {
-	if (!session?.user) return false;
-	if (session.user.isAdmin) return true;
-	if (!session.user.roles) return false;
-	return session.user.roles.some((r) => r === "admin");
-}
-function createPostgresWebSocket(server, realtimeService, driver, authConfig, authAdapter) {
-	const clientSessions = /* @__PURE__ */ new Map();
-	const isProduction = process.env.NODE_ENV === "production";
-	/** Debug logger that is suppressed in production to prevent PII/data leaks */
-	const wsDebug = (...args) => {
-		if (!isProduction) console.debug(...args);
-	};
-	const wss = new WebSocketServer({ server });
-	wss.on("error", (err) => {
-		if (err.code === "EADDRINUSE") return;
-		logger.error("❌ [WebSocket Server] Error", { error: err });
-	});
-	const requireAuth = !!authAdapter || resolveRequireAuth(authConfig);
-	if (requireAuth && !authAdapter && !authConfig?.jwtSecret && !authConfig?.serviceKey) logger.warn("🔐 [WebSocket Server] Authentication is required but no adapter, jwtSecret or serviceKey is configured — no client can complete AUTH, so every realtime message will be refused with UNAUTHORIZED.");
-	wss.on("connection", (ws) => {
-		const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
-		wsDebug(`WebSocket client connected: ${clientId}`);
-		clientSessions.set(clientId, {
-			ws,
-			authenticated: !requireAuth,
-			messageCount: 0,
-			messageWindowStart: Date.now(),
-			channelMessageCount: 0,
-			channelWindowStart: Date.now()
-		});
-		realtimeService.addClient(clientId, ws);
-		ws.on("close", () => {
-			wsDebug(`WebSocket client disconnected: ${clientId}`);
-			clientSessions.delete(clientId);
-		});
-		ws.on("message", async (message) => {
-			let requestId;
-			try {
-				const { type, payload, requestId: reqId } = JSON.parse(message.toString());
-				requestId = reqId;
-				wsDebug(`[WS] ${clientId} → ${type}`, requestId ? `(${requestId})` : "");
-				const sendError = (errType, code, msg) => {
-					ws.send(JSON.stringify({
-						type: errType,
-						requestId,
-						payload: { error: {
-							message: msg,
-							code
-						} }
-					}));
-				};
-				if (type === "AUTHENTICATE") {
-					const { token } = payload || {};
-					if (!token) {
-						sendError("AUTH_ERROR", "INVALID_INPUT", "Token is required");
-						return;
-					}
-					let verifiedUser = null;
-					if (authAdapter) try {
-						const adapterUser = authAdapter.verifyToken ? await authAdapter.verifyToken(token) : await authAdapter.verifyRequest(new Request("http://localhost/_ws_auth", { headers: { Authorization: `Bearer ${token}` } }));
-						if (adapterUser) verifiedUser = {
-							uid: adapterUser.uid,
-							roles: adapterUser.roles,
-							isAdmin: adapterUser.isAdmin
-						};
-					} catch {}
-					else if (authConfig?.serviceKey && safeCompare(token, authConfig.serviceKey)) verifiedUser = {
-						uid: "service",
-						roles: ["admin"],
-						isAdmin: true
-					};
-					else {
-						const jwtPayload = extractUserFromToken(token);
-						if (jwtPayload) verifiedUser = {
-							uid: jwtPayload.uid,
-							roles: jwtPayload.roles ?? [],
-							isAdmin: (jwtPayload.roles ?? []).some((r) => r === "admin")
-						};
-					}
-					if (verifiedUser) {
-						const session = clientSessions.get(clientId);
-						if (session) {
-							session.user = verifiedUser;
-							session.authenticated = true;
-						}
-						wsDebug(`[WS] replying AUTH_SUCCESS for requestId ${requestId}`);
-						ws.send(JSON.stringify({
-							type: "AUTH_SUCCESS",
-							requestId,
-							payload: {
-								uid: verifiedUser.uid,
-								roles: verifiedUser.roles
-							}
-						}));
-						wsDebug(`🔐 [WebSocket Server] Client ${clientId} authenticated as ${verifiedUser.uid}`);
-					} else {
-						wsDebug(`[WS] replying AUTH_ERROR for requestId ${requestId} (invalid token)`);
-						sendError("AUTH_ERROR", "INVALID_TOKEN", "Invalid or expired token");
-					}
-					return;
-				}
-				if (requireAuth) {
-					if (!clientSessions.get(clientId)?.authenticated) {
-						sendError("ERROR", "UNAUTHORIZED", "Authentication required");
-						return;
-					}
-				}
-				{
-					const session = clientSessions.get(clientId);
-					if (session) {
-						const now = Date.now();
-						if (CHANNEL_MESSAGE_TYPES.has(type)) {
-							if (now - session.channelWindowStart > WS_RATE_WINDOW_MS) {
-								session.channelMessageCount = 0;
-								session.channelWindowStart = now;
-							}
-							session.channelMessageCount++;
-							if (session.channelMessageCount > WS_CHANNEL_RATE_LIMIT) {
-								sendError("ERROR", "RATE_LIMITED", "Too many channel messages. Please slow down.");
-								return;
-							}
-						} else {
-							if (now - session.messageWindowStart > WS_RATE_WINDOW_MS) {
-								session.messageCount = 0;
-								session.messageWindowStart = now;
-							}
-							session.messageCount++;
-							if (session.messageCount > WS_RATE_LIMIT) {
-								sendError("ERROR", "RATE_LIMITED", "Too many requests. Please slow down.");
-								return;
-							}
-						}
-					}
-				}
-				if (ADMIN_ONLY_TYPES.has(type)) {
-					if (!isAdminSession(clientSessions.get(clientId))) {
-						sendError("ERROR", "FORBIDDEN", "Admin access required for this operation");
-						return;
-					}
-				}
-				/**
-				* Apply the REST layer's write checks to a socket payload.
-				*
-				* Silent when the path names no registered collection: the
-				* driver decides what a path means, and refusing here would
-				* turn "unknown collection" into a validation error.
-				*/
-				const assertWriteRequest = (path, values) => {
-					if (!path || !values || typeof values !== "object") return;
-					const collection = driver.registry?.getCollectionByPath(path);
-					if (!collection) return;
-					assertWriteRequestValid(values, collection);
-				};
-				const getScopedDelegate = async () => {
-					const session = clientSessions.get(clientId);
-					if (typeof driver.withAuth === "function") try {
-						const userForAuth = session?.user ? {
-							uid: session.user.uid,
-							displayName: null,
-							email: null,
-							photoURL: null,
-							providerId: "websocket",
-							isAnonymous: false,
-							roles: session.user.roles ?? []
-						} : {
-							uid: ANONYMOUS_USER_ID,
-							displayName: null,
-							email: null,
-							photoURL: null,
-							providerId: "websocket",
-							isAnonymous: true,
-							roles: ["anon"]
-						};
-						return await driver.withAuth(userForAuth);
-					} catch (e) {
-						logger.error("Failed to create RLS scoped delegate for WS request", { error: e });
-						throw new Error("Internal authentication error");
-					}
-					return driver;
-				};
-				switch (type) {
-					case "FETCH_COLLECTION":
-						{
-							wsDebug("📋 [WebSocket Server] Processing FETCH_COLLECTION request");
-							const request = payload;
-							const rows = await (await getScopedDelegate()).fetchCollection({
-								...request,
-								limit: resolveClientListLimit(request.limit, { vectorSearch: !!request.vectorSearch })
-							});
-							wsDebug("📋 [WebSocket Server] FETCH_COLLECTION result - rows count:", rows.length);
-							const response = {
-								type: "FETCH_COLLECTION_SUCCESS",
-								payload: { rows },
-								requestId
-							};
-							wsDebug("📋 [WebSocket Server] Sending FETCH_COLLECTION_SUCCESS response");
-							ws.send(JSON.stringify(response));
-						}
-						break;
-					case "FETCH_ONE":
-						{
-							wsDebug("📄 [WebSocket Server] Processing FETCH_ENTITY request");
-							const request = payload;
-							const row = await (await getScopedDelegate()).fetchOne(request);
-							wsDebug("📄 [WebSocket Server] FETCH_ENTITY result:", row);
-							const response = {
-								type: "FETCH_ONE_SUCCESS",
-								payload: { row: row ?? null },
-								requestId
-							};
-							wsDebug("📄 [WebSocket Server] Sending FETCH_ENTITY_SUCCESS response");
-							ws.send(JSON.stringify(response));
-						}
-						break;
-					case "SAVE":
-						{
-							wsDebug("💾 [WebSocket Server] Processing SAVE_ENTITY request");
-							const request = payload;
-							wsDebug("💾 [WebSocket Server] Saving row with request:", inspect(request, {
-								depth: null,
-								colors: true
-							}));
-							assertWriteRequest(request.path, request.values);
-							const row = await (await getScopedDelegate()).save(request);
-							wsDebug("💾 [WebSocket Server] SAVE_ENTITY result:", inspect(row, {
-								depth: null,
-								colors: true
-							}));
-							const response = {
-								type: "SAVE_SUCCESS",
-								payload: { row },
-								requestId
-							};
-							wsDebug("💾 [WebSocket Server] Sending SAVE_ENTITY_SUCCESS response");
-							ws.send(JSON.stringify(response));
-						}
-						break;
-					case "DELETE":
-						{
-							wsDebug("🗑️ [WebSocket Server] Processing DELETE_ENTITY request");
-							const request = payload;
-							wsDebug("🗑️ [WebSocket Server] Deleting row:", request.row);
-							await (await getScopedDelegate()).delete(request);
-							wsDebug("🗑️ [WebSocket Server] DELETE_ENTITY completed successfully");
-							const response = {
-								type: "DELETE_SUCCESS",
-								payload: { success: true },
-								requestId
-							};
-							wsDebug("🗑️ [WebSocket Server] Sending DELETE_ENTITY_SUCCESS response");
-							ws.send(JSON.stringify(response));
-						}
-						break;
-					case "CHECK_UNIQUE_FIELD":
-						{
-							wsDebug("🔍 [WebSocket Server] Processing CHECK_UNIQUE_FIELD request");
-							const { path, name, value, id, collection } = payload;
-							const isUnique = await (await getScopedDelegate()).checkUniqueField(path, name, value, id, collection);
-							wsDebug("🔍 [WebSocket Server] CHECK_UNIQUE_FIELD result:", isUnique);
-							const response = {
-								type: "CHECK_UNIQUE_FIELD_SUCCESS",
-								payload: { isUnique },
-								requestId
-							};
-							wsDebug("🔍 [WebSocket Server] Sending CHECK_UNIQUE_FIELD_SUCCESS response");
-							ws.send(JSON.stringify(response));
-						}
-						break;
-					case "COUNT":
-						{
-							const request = payload;
-							const response = {
-								type: "COUNT_SUCCESS",
-								payload: { count: await (await getScopedDelegate()).count(request) },
-								requestId
-							};
-							ws.send(JSON.stringify(response));
-						}
-						break;
-					case "EXECUTE_SQL":
-						{
-							const { sql, options } = payload;
-							try {
-								const admin = (await getScopedDelegate()).admin;
-								if (!isSQLAdmin(admin)) {
-									sendError("ERROR", "NOT_SUPPORTED", "SQL execution is not available for this driver.");
-									break;
-								}
-								const result = await admin.executeSql(sql, options);
-								if (process.env.NODE_ENV !== "production") wsDebug(`⚡ [WebSocket Server] SQL executed. Returned ${Array.isArray(result) ? result.length : "non-array"} rows.`);
-								const auditSession = clientSessions.get(clientId);
-								logger.info("[SQL Audit] WebSocket SQL execution", {
-									sql: typeof sql === "string" ? sql.substring(0, 500) : String(sql),
-									database: options?.database,
-									role: options?.role,
-									paramCount: Array.isArray(options?.params) ? options.params.length : 0,
-									resultRows: Array.isArray(result) ? result.length : "unknown",
-									uid: auditSession?.user?.uid ?? "unknown",
-									roles: auditSession?.user?.roles ?? [],
-									isAdmin: auditSession?.user?.isAdmin ?? false,
-									requestId
-								});
-								const response = {
-									type: "EXECUTE_SQL_SUCCESS",
-									payload: { result },
-									requestId
-								};
-								ws.send(JSON.stringify(response));
-							} catch (sqlError) {
-								sendError("ERROR", "SQL_ERROR", extractErrorMessage(sqlError));
-							}
-						}
-						break;
-					case "FETCH_DATABASES":
-						{
-							wsDebug("📚 [WebSocket Server] Processing FETCH_DATABASES request");
-							const admin = (await getScopedDelegate()).admin;
-							let databases = [];
-							if (isSQLAdmin(admin) && admin.fetchAvailableDatabases) databases = await admin.fetchAvailableDatabases();
-							wsDebug(`📚 [WebSocket Server] Fetched ${databases.length} databases.`);
-							const response = {
-								type: "FETCH_DATABASES_SUCCESS",
-								payload: { databases },
-								requestId
-							};
-							ws.send(JSON.stringify(response));
-						}
-						break;
-					case "FETCH_ROLES":
-						{
-							wsDebug("👤 [WebSocket Server] Processing FETCH_ROLES request");
-							const admin = (await getScopedDelegate()).admin;
-							let roles = [];
-							if (isSQLAdmin(admin) && admin.fetchAvailableRoles) roles = await admin.fetchAvailableRoles();
-							wsDebug(`👤 [WebSocket Server] Fetched ${roles.length} roles.`);
-							const response = {
-								type: "FETCH_ROLES_SUCCESS",
-								payload: { roles },
-								requestId
-							};
-							ws.send(JSON.stringify(response));
-						}
-						break;
-					case "FETCH_APPLICATION_ROLES":
-						{
-							wsDebug("👤 [WebSocket Server] Processing FETCH_APPLICATION_ROLES request");
-							const admin = (await getScopedDelegate()).admin;
-							let roles = [];
-							if (isSQLAdmin(admin) && admin.fetchApplicationRoles) roles = await admin.fetchApplicationRoles();
-							wsDebug(`👤 [WebSocket Server] Fetched ${roles.length} application roles.`);
-							const response = {
-								type: "FETCH_APPLICATION_ROLES_SUCCESS",
-								payload: { roles },
-								requestId
-							};
-							ws.send(JSON.stringify(response));
-						}
-						break;
-					case "FETCH_CURRENT_DATABASE":
-						{
-							wsDebug("📚 [WebSocket Server] Processing FETCH_CURRENT_DATABASE request");
-							const admin = (await getScopedDelegate()).admin;
-							let database = void 0;
-							if (isSQLAdmin(admin) && admin.fetchCurrentDatabase) database = await admin.fetchCurrentDatabase();
-							const response = {
-								type: "FETCH_CURRENT_DATABASE_SUCCESS",
-								payload: { database },
-								requestId
-							};
-							ws.send(JSON.stringify(response));
-						}
-						break;
-					case "FETCH_UNMAPPED_TABLES":
-						{
-							wsDebug("📋 [WebSocket Server] Processing FETCH_UNMAPPED_TABLES request");
-							const admin = (await getScopedDelegate()).admin;
-							let tables = [];
-							if (isSchemaAdmin(admin) && admin.fetchUnmappedTables) tables = await admin.fetchUnmappedTables(payload?.mappedPaths);
-							wsDebug(`📋 [WebSocket Server] Fetched ${tables.length} unmapped tables.`);
-							const response = {
-								type: "FETCH_UNMAPPED_TABLES_SUCCESS",
-								payload: { tables },
-								requestId
-							};
-							ws.send(JSON.stringify(response));
-						}
-						break;
-					case "FETCH_TABLE_METADATA":
-						{
-							wsDebug("📋 [WebSocket Server] Processing FETCH_TABLE_METADATA request");
-							const { tableName } = payload;
-							const admin = (await getScopedDelegate()).admin;
-							let metadata;
-							if (isSchemaAdmin(admin) && admin.fetchTableMetadata) metadata = await admin.fetchTableMetadata(tableName);
-							wsDebug(`📋 [WebSocket Server] Fetched metadata for table '${tableName}'. (${metadata?.columns?.length ?? 0} columns)`);
-							const response = {
-								type: "FETCH_TABLE_METADATA_SUCCESS",
-								payload: { metadata },
-								requestId
-							};
-							ws.send(JSON.stringify(response));
-						}
-						break;
-					case "CREATE_BRANCH":
-						{
-							wsDebug("🌿 [WebSocket Server] Processing CREATE_BRANCH request");
-							const { name, options } = payload;
-							const delegate = await getScopedDelegate();
-							if (!delegate.admin?.createBranch) {
-								sendError("ERROR", "NOT_SUPPORTED", "Database branching is not available. Configure adminConnectionString.");
-								break;
-							}
-							const branch = await delegate.admin.createBranch(name, options);
-							wsDebug(`🌿 [WebSocket Server] Branch created: ${branch.name}`);
-							const response = {
-								type: "CREATE_BRANCH_SUCCESS",
-								payload: { branch },
-								requestId
-							};
-							ws.send(JSON.stringify(response));
-						}
-						break;
-					case "DELETE_BRANCH":
-						{
-							wsDebug("🗑️ [WebSocket Server] Processing DELETE_BRANCH request");
-							const { name: branchName } = payload;
-							const delegate = await getScopedDelegate();
-							if (!delegate.admin?.deleteBranch) {
-								sendError("ERROR", "NOT_SUPPORTED", "Database branching is not available.");
-								break;
-							}
-							await delegate.admin.deleteBranch(branchName);
-							wsDebug(`🗑️ [WebSocket Server] Branch deleted: ${branchName}`);
-							const response = {
-								type: "DELETE_BRANCH_SUCCESS",
-								payload: { success: true },
-								requestId
-							};
-							ws.send(JSON.stringify(response));
-						}
-						break;
-					case "LIST_BRANCHES":
-						{
-							wsDebug("🌿 [WebSocket Server] Processing LIST_BRANCHES request");
-							const delegate = await getScopedDelegate();
-							let branches = [];
-							if (delegate.admin?.listBranches) branches = await delegate.admin.listBranches();
-							wsDebug(`🌿 [WebSocket Server] Listed ${branches.length} branches.`);
-							const response = {
-								type: "LIST_BRANCHES_SUCCESS",
-								payload: { branches },
-								requestId
-							};
-							ws.send(JSON.stringify(response));
-						}
-						break;
-					case "subscribe_collection":
-					case "subscribe_one":
-					case "unsubscribe":
-					case "join_channel":
-					case "leave_channel":
-					case "broadcast":
-					case "presence_track":
-					case "presence_untrack":
-					case "presence_state":
-					case "channel_history": {
-						wsDebug("🔄 [WebSocket Server] Routing realtime message to RealtimeService:", type);
-						const session = clientSessions.get(clientId);
-						const authContext = session?.user ? {
-							uid: session.user.uid,
-							roles: session.user.roles ?? []
-						} : {
-							uid: ANONYMOUS_USER_ID,
-							roles: ["anon"]
-						};
-						await realtimeService.handleClientMessage(clientId, {
-							type,
-							payload,
-							subscriptionId: payload?.subscriptionId
-						}, authContext);
-						break;
-					}
-					default: logger.error("❌ [WebSocket Server] Unknown message type", { detail: type });
-				}
-			} catch (error) {
-				if (error instanceof ListLimitError) {
-					logger.warn(`[WebSocket Server] Refused a list read: ${error.message}`);
-					ws.send(JSON.stringify({
-						type: "ERROR",
-						requestId,
-						payload: { error: {
-							message: error.message,
-							code: "INVALID_LIMIT"
-						} }
-					}));
-					return;
-				}
-				if (error instanceof ApiError || error?.name === "ApiError") {
-					const apiError = error;
-					logger.warn(`[WebSocket Server] Refused a write: ${apiError.message}`);
-					ws.send(JSON.stringify({
-						type: "ERROR",
-						requestId,
-						payload: { error: {
-							message: apiError.message,
-							code: apiError.code
-						} }
-					}));
-					return;
-				}
-				logger.error("💥 [WebSocket Server] Error handling message", { error });
-				if (error instanceof Error) logger.error("Stack trace", { detail: error.stack });
-				const errorMessage = process.env.NODE_ENV === "production" ? "An unexpected error occurred" : extractErrorMessage(error);
-				const errorResponse = {
-					type: "ERROR",
-					requestId,
-					payload: { error: {
-						message: errorMessage,
-						code: "INTERNAL_ERROR"
-					} }
-				};
-				ws.send(JSON.stringify(errorResponse));
-			}
-		});
-	});
-}
-//#endregion
-export { websocket_exports as n, createPostgresWebSocket as t };
-
-//# sourceMappingURL=websocket-BVgDVO-V.js.map