@rocicorp/zero 0.0.0-202410031711

package/out/zero-cache/src/services/limiter/sliding-window-limiter.js

@@ -0,0 +1,130 @@
+import { assert } from '../../../../shared/src/asserts.js';
+/**
+ * The limiter is a sliding window rate limiter that allows a maximum
+ * number of mutations per window.
+ *
+ * The window is divided into two parts: the prev window and the next window.
+ * The prev window is the part of the window that has already passed, and the
+ * next window is the part of the window that is still in the future.
+ *
+ * The limiter keeps track of the number of mutations in each window. When the
+ * current time moves completely past the next window, the limiter creates new
+ * windows (this only happens if the limiter is not called for a long time).
+ * When the current time moves completely into the next window, the
+ * limiter rotates the windows.
+ *
+ * Case 1: need new windows
+ * |----|----|
+ *             |----| (sliding window)
+ *
+ * Case 2: rotate windows
+ * |----|----|
+ *      |----| (sliding window)
+ *
+ * or
+ *
+ * |----|----|
+ *         |----| (sliding window)
+ *
+ * The leading edge of the sliding window is current time.
+ *
+ * The limiter increments the count for the prev window if the current time is
+ * in the prior window. Otherwise, it increments the count for the next
+ * window.
+ *
+ * The limiter computes the total mutations by: taking the number of mutation in the next window and
+ * adding the number of mutation from the prev window, weighted by
+ * the fraction of the window that has passed. The total mutations must be less
+ * than the maximum number of mutations allowed per window.
+ *
+ * |----|----|
+ *    |----| (sliding window)
+ * ^-- the sliding window covers 25% of the prior window. Only 25% of that window's count counts.
+ * The entirety of the next window's count counts.
+ */
+export class SlidingWindowLimiter {
+    #windowSizeMs;
+    #maxMutations;
+    #priorWindow;
+    #nextWindow;
+    constructor(windowSizeMs, maxMutations) {
+        this.#windowSizeMs = windowSizeMs;
+        this.#maxMutations = maxMutations;
+        [this.#priorWindow, this.#nextWindow] = this.#newWindows();
+    }
+    canDo() {
+        const now = Date.now();
+        // If the current sliding window is completely past the next window, we need new windows.
+        if (now - this.#windowSizeMs >
+            this.#nextWindow.start + this.#windowSizeMs) {
+            [this.#priorWindow, this.#nextWindow] = this.#newWindows();
+        }
+        // Has the current sliding window moved completely into the next window?
+        // Then rotate the windows.
+        if (now - this.#windowSizeMs >= this.#nextWindow.start) {
+            this.#rotateWindows();
+        }
+        // If "now" in the prior or next window? Increment the count for the correct window.
+        if (now < this.#nextWindow.start) {
+            this.#priorWindow.count++;
+        }
+        else {
+            this.#nextWindow.count++;
+        }
+        // Now compute the total mutations in the current window.
+        // Weighted by the fraction of the window that has passed.
+        const totalCalls = this.totalCallsForTime(now);
+        return totalCalls <= this.#maxMutations;
+    }
+    totalCallsForTime(now) {
+        let fraction;
+        if (now < this.#priorWindow.start + this.#windowSizeMs) {
+            fraction = 1;
+        }
+        else {
+            fraction =
+                (this.#priorWindow.start +
+                    (this.#windowSizeMs - 1) -
+                    (now - this.#windowSizeMs)) /
+                    this.#windowSizeMs;
+        }
+        if (fraction < 0) {
+            fraction = 0;
+        }
+        assert(fraction <= 1, 'The past cannot contribute more than the a full window.');
+        const totalCalls = this.#priorWindow.count * fraction + this.#nextWindow.count;
+        return totalCalls;
+    }
+    get priorWindow() {
+        return this.#priorWindow;
+    }
+    get nextWindow() {
+        return this.#nextWindow;
+    }
+    /**
+     * If there were no mutations in over `windowSizeMs` we need new windows.
+     */
+    #newWindows() {
+        const now = Date.now();
+        const start = now - (now % this.#windowSizeMs);
+        return [
+            {
+                // clamp to a `windowSizeMs` boundary to start the prior window.
+                start,
+                count: 0,
+            },
+            {
+                start: start + this.#windowSizeMs,
+                count: 0,
+            },
+        ];
+    }
+    #rotateWindows() {
+        this.#priorWindow = this.#nextWindow;
+        this.#nextWindow = {
+            start: this.#priorWindow.start + this.#windowSizeMs,
+            count: 0,
+        };
+    }
+}
+//# sourceMappingURL=sliding-window-limiter.js.map

package/out/zero-cache/src/services/limiter/sliding-window-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sliding-window-limiter.js","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/limiter/sliding-window-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,MAAM,EAAC,MAAM,uBAAuB,CAAC;AAO7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,OAAO,oBAAoB;IACtB,aAAa,CAAS;IACtB,aAAa,CAAS;IAE/B,YAAY,CAAS;IACrB,WAAW,CAAS;IAEpB,YAAY,YAAoB,EAAE,YAAoB;QACpD,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAElC,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7D,CAAC;IAED,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,yFAAyF;QACzF,IACE,GAAG,GAAG,IAAI,CAAC,aAAa;YACxB,IAAI,CAAC,WAAW,CAAC,KAAK,GAAG,IAAI,CAAC,aAAa,EAC3C,CAAC;YACD,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7D,CAAC;QAED,wEAAwE;QACxE,2BAA2B;QAC3B,IAAI,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACvD,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,CAAC;QAED,oFAAoF;QACpF,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC;QAED,yDAAyD;QACzD,0DAA0D;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,UAAU,IAAI,IAAI,CAAC,aAAa,CAAC;IAC1C,CAAC;IAED,iBAAiB,CAAC,GAAW;QAC3B,IAAI,QAAgB,CAAC;QACrB,IAAI,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACvD,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,QAAQ;gBACN,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK;oBACtB,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;oBACxB,CAAC,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;oBAC7B,IAAI,CAAC,aAAa,CAAC;QACvB,CAAC;QACD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC;QACD,MAAM,CACJ,QAAQ,IAAI,CAAC,EACb,yDAAyD,CAC1D,CAAC;QACF,MAAM,UAAU,GACd,IAAI,CAAC,YAAY,CAAC,KAAK,GAAG,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAC9D,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,WAAW;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/C,OAAO;YACL;gBACE,gEAAgE;gBAChE,KAAK;gBACL,KAAK,EAAE,CAAC;aACT;YACD;gBACE,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC,aAAa;gBACjC,KAAK,EAAE,CAAC;aACT;SACF,CAAC;IACJ,CAAC;IAED,cAAc;QACZ,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG;YACjB,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,GAAG,IAAI,CAAC,aAAa;YACnD,KAAK,EAAE,CAAC;SACT,CAAC;IACJ,CAAC;CACF"}

package/out/zero-cache/src/services/mutagen/mutagen.d.ts

@@ -0,0 +1,24 @@
+import type { LogContext } from '@rocicorp/logger';
+import type { JWTPayload } from 'jose';
+import postgres from 'postgres';
+import { type CreateOp, type Mutation, type SetOp } from '../../../../zero-protocol/src/push.js';
+import { type ZeroConfig } from '../../config/zero-config.js';
+import type { PostgresDB } from '../../types/pg.js';
+import type { Service } from '../service.js';
+import { type WriteAuthorizer } from './write-authorizer.js';
+export type MutationError = string;
+export interface Mutagen {
+    processMutation(mutation: Mutation, authData: JWTPayload): Promise<MutationError | undefined>;
+}
+export declare class MutagenService implements Mutagen, Service {
+    #private;
+    readonly id: string;
+    constructor(lc: LogContext, shardID: string, clientGroupID: string, upstream: PostgresDB, config: ZeroConfig);
+    processMutation(mutation: Mutation, authData: JWTPayload): Promise<MutationError | undefined>;
+    run(): Promise<void>;
+    stop(): Promise<void>;
+}
+export declare function processMutation(lc: LogContext | undefined, authData: JWTPayload, db: PostgresDB, shardID: string, clientGroupID: string, mutation: Mutation, writeAuthorizer: WriteAuthorizer, onTxStart?: () => void): Promise<MutationError | undefined>;
+export declare function getCreateSQL(tx: postgres.TransactionSql, create: CreateOp): postgres.PendingQuery<postgres.Row[]>;
+export declare function getSetSQL(tx: postgres.TransactionSql, set: SetOp): postgres.PendingQuery<postgres.Row[]>;
+//# sourceMappingURL=mutagen.d.ts.map

package/out/zero-cache/src/services/mutagen/mutagen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutagen.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/mutagen/mutagen.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AACrC,OAAO,QAAQ,MAAM,UAAU,CAAC;AAIhC,OAAO,EAGL,KAAK,QAAQ,EAEb,KAAK,QAAQ,EACb,KAAK,KAAK,EAEX,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAC,KAAK,UAAU,EAAC,MAAM,6BAA6B,CAAC;AAE5D,OAAO,KAAK,EAAC,UAAU,EAAsB,MAAM,mBAAmB,CAAC;AACvE,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAsB,KAAK,eAAe,EAAC,MAAM,uBAAuB,CAAC;AAKhF,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAEnC,MAAM,WAAW,OAAO;IACtB,eAAe,CACb,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,UAAU,GACnB,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;CACvC;AAED,qBAAa,cAAe,YAAW,OAAO,EAAE,OAAO;;IACrD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBAUlB,EAAE,EAAE,UAAU,EACd,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,UAAU,EACpB,MAAM,EAAE,UAAU;IA2BpB,eAAe,CACb,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,UAAU,GACnB,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAerC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAIpB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAItB;AAID,wBAAsB,eAAe,CACnC,EAAE,EAAE,UAAU,GAAG,SAAS,EAC1B,QAAQ,EAAE,UAAU,EACpB,EAAE,EAAE,UAAU,EACd,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,QAAQ,EAClB,eAAe,EAAE,eAAe,EAChC,SAAS,CAAC,EAAE,MAAM,IAAI,GACrB,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAmGpC;AAsED,wBAAgB,YAAY,CAC1B,EAAE,EAAE,QAAQ,CAAC,cAAc,EAC3B,MAAM,EAAE,QAAQ,GACf,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAUvC;AAED,wBAAgB,SAAS,CACvB,EAAE,EAAE,QAAQ,CAAC,cAAc,EAC3B,GAAG,EAAE,KAAK,GACT,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CASvC"}

package/out/zero-cache/src/services/mutagen/mutagen.js

@@ -0,0 +1,247 @@
+import { PG_SERIALIZATION_FAILURE } from '@drdgvhbh/postgres-error-codes';
+import { resolver } from '@rocicorp/resolver';
+import postgres from 'postgres';
+import { assert, unreachable } from '../../../../shared/src/asserts.js';
+import { Mode } from '../../../../zero-cache/src/db/transaction-pool.js';
+import { ErrorKind } from '../../../../zero-protocol/src/mod.js';
+import { MutationType, } from '../../../../zero-protocol/src/push.js';
+import { Database } from '../../../../zqlite/src/db.js';
+import {} from '../../config/zero-config.js';
+import { ErrorForClient } from '../../types/error-for-client.js';
+import { WriteAuthorizerImpl } from './write-authorizer.js';
+import { SlidingWindowLimiter } from '../limiter/sliding-window-limiter.js';
+export class MutagenService {
+    id;
+    #lc;
+    #upstream;
+    #shardID;
+    #stopped = resolver();
+    #replica;
+    #writeAuthorizer;
+    #limiter;
+    constructor(lc, shardID, clientGroupID, upstream, config) {
+        this.id = clientGroupID;
+        this.#lc = lc
+            .withContext('component', 'Mutagen')
+            .withContext('serviceID', this.id);
+        this.#upstream = upstream;
+        this.#shardID = shardID;
+        this.#replica = new Database(this.#lc, config.replicaDbFile, {
+            readonly: true,
+            fileMustExist: true,
+        });
+        this.#writeAuthorizer = new WriteAuthorizerImpl(this.#lc, config, this.#replica, clientGroupID);
+        if (config.rateLimit) {
+            this.#limiter = new SlidingWindowLimiter(config.rateLimit.mutationTransactions.windowMs, config.rateLimit.mutationTransactions.max);
+        }
+    }
+    processMutation(mutation, authData) {
+        if (this.#limiter?.canDo() === false) {
+            return Promise.resolve('Rate limit exceeded');
+        }
+        return processMutation(this.#lc, authData, this.#upstream, this.#shardID, this.id, mutation, this.#writeAuthorizer);
+    }
+    run() {
+        return this.#stopped.promise;
+    }
+    stop() {
+        this.#stopped.resolve();
+        return Promise.resolve();
+    }
+}
+const MAX_SERIALIZATION_ATTEMPTS = 2;
+export async function processMutation(lc, authData, db, shardID, clientGroupID, mutation, writeAuthorizer, onTxStart) {
+    assert(mutation.type === MutationType.CRUD, 'Only CRUD mutations are supported');
+    lc = lc?.withContext('mutationID', mutation.id);
+    lc = lc?.withContext('processMutation');
+    lc?.debug?.('Process mutation start', mutation);
+    let result;
+    const start = Date.now();
+    try {
+        // Mutations can fail for a variety of reasons:
+        //
+        // - application error
+        // - network/db error
+        // - zero bug
+        //
+        // For application errors what we want is to re-run the mutation in
+        // "error mode", which skips the actual mutation and just updates the
+        // lastMutationID. Then return the error to the app.
+        //
+        // However, it's hard to tell the difference between application errors
+        // and the other types.
+        //
+        // A reasonable policy ends up being to just retry every mutation once
+        // in error mode. If the error mode mutation succeeds then we assume it
+        // was an application error and return the error to the app. Otherwise,
+        // we know it was something internal and we log it.
+        //
+        // This is not 100% correct - there are theoretical cases where we
+        // return an internal error to the app that shouldn't have been. But it
+        // would have to be a crazy coincidence: we'd have to have a network
+        // error on the first attempt that resolves by the second attempt.
+        //
+        // One might ask why not try/catch just the calls to the mutators and
+        // consider those application errors. That is actually what we do in
+        // Replicache:
+        //
+        // https://github.com/rocicorp/todo-row-versioning/blob/9a0a79dc2d2de32c4fac61b5d1634bd9a9e66b7c/server/src/push.ts#L131
+        //
+        // We don't do it here because:
+        //
+        // 1. It's still not perfect. It's hard to isolate SQL errors in
+        //    mutators due to app developer mistakes from SQL errors due to
+        //    Zero mistakes.
+        // 2. It's not possible to do this with the pg library we're using in
+        //    Zero anyway: https://github.com/porsager/postgres/issues/455.
+        //
+        // Personally I think this simple retry policy is nice.
+        let errorMode = false;
+        for (let i = 0; i < MAX_SERIALIZATION_ATTEMPTS; i++) {
+            try {
+                await db.begin(Mode.SERIALIZABLE, tx => {
+                    onTxStart?.();
+                    return processMutationWithTx(tx, authData, shardID, clientGroupID, mutation, errorMode, writeAuthorizer);
+                });
+                if (errorMode) {
+                    lc?.debug?.('Ran mutation successfully in error mode');
+                }
+                break;
+            }
+            catch (e) {
+                if (e instanceof MutationAlreadyProcessedError) {
+                    lc?.debug?.(e.message);
+                    return undefined;
+                }
+                if (e instanceof ErrorForClient || errorMode) {
+                    lc?.error?.('Process mutation error', e);
+                    throw e;
+                }
+                if (e instanceof postgres.PostgresError &&
+                    e.code === PG_SERIALIZATION_FAILURE) {
+                    lc?.info?.(i < MAX_SERIALIZATION_ATTEMPTS ? `Retrying` : '', e);
+                    continue; // Retry up to MAX_SERIALIZATION_ATTEMPTS.
+                }
+                result = String(e);
+                if (errorMode) {
+                    break;
+                }
+                lc?.error?.('Got error running mutation, re-running in error mode', e);
+                errorMode = true;
+                i--;
+            }
+        }
+    }
+    finally {
+        lc?.debug?.('Process mutation complete in', Date.now() - start);
+    }
+    return result;
+}
+async function processMutationWithTx(tx, authData, shardID, clientGroupID, mutation, errorMode, authorizer) {
+    const tasks = [];
+    if (!errorMode) {
+        const { ops } = mutation.args[0];
+        for (const [i, op] of ops.entries()) {
+            if (tasks.length !== i) {
+                // Some mutation was not allowed. No need to visit the rest.
+                break;
+            }
+            switch (op.op) {
+                case 'create':
+                    if (authorizer.canInsert(authData, op)) {
+                        tasks.push(() => getCreateSQL(tx, op).execute());
+                    }
+                    break;
+                case 'set':
+                    if (authorizer.canUpsert(authData, op)) {
+                        tasks.push(() => getSetSQL(tx, op).execute());
+                    }
+                    break;
+                case 'update':
+                    if (authorizer.canUpdate(authData, op)) {
+                        tasks.push(() => getUpdateSQL(tx, op).execute());
+                    }
+                    break;
+                case 'delete':
+                    if (authorizer.canDelete(authData, op)) {
+                        tasks.push(() => getDeleteSQL(tx, op).execute());
+                    }
+                    break;
+                default:
+                    unreachable(op);
+            }
+        }
+        // If not all mutations are allowed, don't do any of them.
+        // This is to prevent partial application of mutations.
+        if (tasks.length < ops.length) {
+            tasks.length = 0; // Clear all tasks.
+        }
+    }
+    // Confirm the mutation even though it may have been blocked by the authorizer.
+    // Authorizer blocking a mutation is not an error but the correct result of the mutation.
+    tasks.unshift(() => incrementLastMutationID(tx, shardID, clientGroupID, mutation.clientID, mutation.id));
+    // Note: An error thrown from any Promise aborts the entire transaction.
+    await Promise.all(tasks.map(task => task()));
+}
+export function getCreateSQL(tx, create) {
+    const table = create.entityType;
+    const { id, value } = create;
+    const valueWithIdColumns = {
+        ...value,
+        ...id,
+    };
+    return tx `INSERT INTO ${tx(table)} ${tx(valueWithIdColumns)}`;
+}
+export function getSetSQL(tx, set) {
+    const table = set.entityType;
+    const { id, value } = set;
+    return tx `
+    INSERT INTO ${tx(table)} ${tx({ ...value, ...id })}
+    ON CONFLICT (${tx(Object.keys(id))})
+    DO UPDATE SET ${tx(value)}
+  `;
+}
+function getUpdateSQL(tx, update) {
+    const table = update.entityType;
+    const { id, partialValue } = update;
+    return tx `UPDATE ${tx(table)} SET ${tx(partialValue)} WHERE ${tx(id)}`;
+}
+function getDeleteSQL(tx, deleteOp) {
+    const table = deleteOp.entityType;
+    const { id } = deleteOp;
+    const conditions = [];
+    for (const [key, value] of Object.entries(id)) {
+        if (conditions.length > 0) {
+            conditions.push(tx `AND`);
+        }
+        conditions.push(tx `${tx(key)} = ${value}`);
+    }
+    return tx `DELETE FROM ${tx(table)} WHERE ${conditions}`;
+}
+async function incrementLastMutationID(tx, shardID, clientGroupID, clientID, receivedMutationID) {
+    const [{ lastMutationID }] = await tx `
+    INSERT INTO zero.clients as current ("shardID", "clientGroupID", "clientID", "lastMutationID")
+    VALUES (${shardID}, ${clientGroupID}, ${clientID}, ${1})
+    ON CONFLICT ("shardID", "clientGroupID", "clientID")
+    DO UPDATE SET "lastMutationID" = current."lastMutationID" + 1
+    RETURNING "lastMutationID"
+  `;
+    // ABORT if the resulting lastMutationID is not equal to the receivedMutationID.
+    if (receivedMutationID < lastMutationID) {
+        throw new MutationAlreadyProcessedError(clientID, receivedMutationID, lastMutationID);
+    }
+    else if (receivedMutationID > lastMutationID) {
+        throw new ErrorForClient([
+            'error',
+            ErrorKind.InvalidPush,
+            `Push contains unexpected mutation id ${receivedMutationID} for client ${clientID}. Expected mutation id ${lastMutationID.toString()}.`,
+        ]);
+    }
+}
+class MutationAlreadyProcessedError extends Error {
+    constructor(clientID, received, actual) {
+        super(`Ignoring mutation from ${clientID} with ID ${received} as it was already processed. Expected: ${actual}`);
+        assert(received < actual);
+    }
+}
+//# sourceMappingURL=mutagen.js.map

package/out/zero-cache/src/services/mutagen/mutagen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutagen.js","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/mutagen/mutagen.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,wBAAwB,EAAC,MAAM,gCAAgC,CAAC;AAExE,OAAO,EAAC,QAAQ,EAAC,MAAM,oBAAoB,CAAC;AAE5C,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAC,MAAM,EAAE,WAAW,EAAC,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAC,IAAI,EAAC,MAAM,uCAAuC,CAAC;AAC3D,OAAO,EAAC,SAAS,EAAC,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,YAAY,GAOb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAC,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAiB,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAC,cAAc,EAAC,MAAM,iCAAiC,CAAC;AAG/D,OAAO,EAAC,mBAAmB,EAAuB,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAC,oBAAoB,EAAC,MAAM,sCAAsC,CAAC;AAa1E,MAAM,OAAO,cAAc;IAChB,EAAE,CAAS;IACX,GAAG,CAAa;IAChB,SAAS,CAAa;IACtB,QAAQ,CAAS;IACjB,QAAQ,GAAG,QAAQ,EAAE,CAAC;IACtB,QAAQ,CAAW;IACnB,gBAAgB,CAAkB;IAClC,QAAQ,CAAmC;IAEpD,YACE,EAAc,EACd,OAAe,EACf,aAAqB,EACrB,QAAoB,EACpB,MAAkB;QAElB,IAAI,CAAC,EAAE,GAAG,aAAa,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,EAAE;aACV,WAAW,CAAC,WAAW,EAAE,SAAS,CAAC;aACnC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,EAAE;YAC3D,QAAQ,EAAE,IAAI;YACd,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,IAAI,mBAAmB,CAC7C,IAAI,CAAC,GAAG,EACR,MAAM,EACN,IAAI,CAAC,QAAQ,EACb,aAAa,CACd,CAAC;QAEF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,GAAG,IAAI,oBAAoB,CACtC,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,EAC9C,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,GAAG,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,eAAe,CACb,QAAkB,EAClB,QAAoB;QAEpB,IAAI,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,eAAe,CACpB,IAAI,CAAC,GAAG,EACR,QAAQ,EACR,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,EAAE,EACP,QAAQ,EACR,IAAI,CAAC,gBAAgB,CACtB,CAAC;IACJ,CAAC;IAED,GAAG;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,IAAI;QACF,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAErC,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAA0B,EAC1B,QAAoB,EACpB,EAAc,EACd,OAAe,EACf,aAAqB,EACrB,QAAkB,EAClB,eAAgC,EAChC,SAAsB;IAEtB,MAAM,CACJ,QAAQ,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,EACnC,mCAAmC,CACpC,CAAC;IACF,EAAE,GAAG,EAAE,EAAE,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChD,EAAE,GAAG,EAAE,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAC;IACxC,EAAE,EAAE,KAAK,EAAE,CAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC;IAEhD,IAAI,MAAiC,CAAC;IAEtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,+CAA+C;QAC/C,EAAE;QACF,sBAAsB;QACtB,qBAAqB;QACrB,aAAa;QACb,EAAE;QACF,mEAAmE;QACnE,qEAAqE;QACrE,oDAAoD;QACpD,EAAE;QACF,uEAAuE;QACvE,uBAAuB;QACvB,EAAE;QACF,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,mDAAmD;QACnD,EAAE;QACF,kEAAkE;QAClE,uEAAuE;QACvE,oEAAoE;QACpE,kEAAkE;QAClE,EAAE;QACF,qEAAqE;QACrE,oEAAoE;QACpE,cAAc;QACd,EAAE;QACF,wHAAwH;QACxH,EAAE;QACF,+BAA+B;QAC/B,EAAE;QACF,gEAAgE;QAChE,mEAAmE;QACnE,oBAAoB;QACpB,qEAAqE;QACrE,mEAAmE;QACnE,EAAE;QACF,uDAAuD;QACvD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,0BAA0B,EAAE,CAAC,EAAE,EAAE,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE;oBACrC,SAAS,EAAE,EAAE,CAAC;oBACd,OAAO,qBAAqB,CAC1B,EAAE,EACF,QAAQ,EACR,OAAO,EACP,aAAa,EACb,QAAQ,EACR,SAAS,EACT,eAAe,CAChB,CAAC;gBACJ,CAAC,CAAC,CAAC;gBACH,IAAI,SAAS,EAAE,CAAC;oBACd,EAAE,EAAE,KAAK,EAAE,CAAC,yCAAyC,CAAC,CAAC;gBACzD,CAAC;gBACD,MAAM;YACR,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,6BAA6B,EAAE,CAAC;oBAC/C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;oBACvB,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,IAAI,CAAC,YAAY,cAAc,IAAI,SAAS,EAAE,CAAC;oBAC7C,EAAE,EAAE,KAAK,EAAE,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC;oBACzC,MAAM,CAAC,CAAC;gBACV,CAAC;gBACD,IACE,CAAC,YAAY,QAAQ,CAAC,aAAa;oBACnC,CAAC,CAAC,IAAI,KAAK,wBAAwB,EACnC,CAAC;oBACD,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,0BAA0B,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;oBAChE,SAAS,CAAC,0CAA0C;gBACtD,CAAC;gBACD,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACnB,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM;gBACR,CAAC;gBACD,EAAE,EAAE,KAAK,EAAE,CAAC,sDAAsD,EAAE,CAAC,CAAC,CAAC;gBACvE,SAAS,GAAG,IAAI,CAAC;gBACjB,CAAC,EAAE,CAAC;YACN,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,EAAE,KAAK,EAAE,CAAC,8BAA8B,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,EAAuB,EACvB,QAAoB,EACpB,OAAe,EACf,aAAqB,EACrB,QAAsB,EACtB,SAAkB,EAClB,UAA2B;IAE3B,MAAM,KAAK,GAA+B,EAAE,CAAC;IAE7C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,EAAC,GAAG,EAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE/B,KAAK,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,4DAA4D;gBAC5D,MAAM;YACR,CAAC;YACD,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;gBACd,KAAK,QAAQ;oBACX,IAAI,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;wBACvC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;oBACnD,CAAC;oBACD,MAAM;gBACR,KAAK,KAAK;oBACR,IAAI,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;wBACvC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;oBAChD,CAAC;oBACD,MAAM;gBACR,KAAK,QAAQ;oBACX,IAAI,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;wBACvC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;oBACnD,CAAC;oBACD,MAAM;gBACR,KAAK,QAAQ;oBACX,IAAI,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;wBACvC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;oBACnD,CAAC;oBACD,MAAM;gBACR;oBACE,WAAW,CAAC,EAAE,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,0DAA0D;QAC1D,uDAAuD;QACvD,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC9B,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,mBAAmB;QACvC,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,yFAAyF;IACzF,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CACjB,uBAAuB,CACrB,EAAE,EACF,OAAO,EACP,aAAa,EACb,QAAQ,CAAC,QAAQ,EACjB,QAAQ,CAAC,EAAE,CACZ,CACF,CAAC;IAEF,wEAAwE;IACxE,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,EAA2B,EAC3B,MAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC;IAChC,MAAM,EAAC,EAAE,EAAE,KAAK,EAAC,GAAG,MAAM,CAAC;IAE3B,MAAM,kBAAkB,GAAG;QACzB,GAAG,KAAK;QACR,GAAG,EAAE;KACN,CAAC;IAEF,OAAO,EAAE,CAAA,eAAe,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,EAA2B,EAC3B,GAAU;IAEV,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;IAC7B,MAAM,EAAC,EAAE,EAAE,KAAK,EAAC,GAAG,GAAG,CAAC;IAExB,OAAO,EAAE,CAAA;kBACO,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAC,GAAG,KAAK,EAAE,GAAG,EAAE,EAAC,CAAC;mBACjC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAClB,EAAE,CAAC,KAAK,CAAC;GAC1B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,EAA2B,EAC3B,MAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC;IAChC,MAAM,EAAC,EAAE,EAAE,YAAY,EAAC,GAAG,MAAM,CAAC;IAElC,OAAO,EAAE,CAAA,UAAU,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,YAAY,CACnB,EAA2B,EAC3B,QAAkB;IAElB,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC;IAClC,MAAM,EAAC,EAAE,EAAC,GAAG,QAAQ,CAAC;IAEtB,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,CAAC,EAAE,CAAA,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,EAAE,CAAA,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,CAAA,eAAe,EAAE,CAAC,KAAK,CAAC,UAAU,UAAU,EAAE,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,EAAuB,EACvB,OAAe,EACf,aAAqB,EACrB,QAAgB,EAChB,kBAA0B;IAE1B,MAAM,CAAC,EAAC,cAAc,EAAC,CAAC,GAAG,MAAM,EAAE,CAA4B;;cAEnD,OAAO,KAAK,aAAa,KAAK,QAAQ,KAAK,CAAC;;;;GAIvD,CAAC;IAEF,gFAAgF;IAChF,IAAI,kBAAkB,GAAG,cAAc,EAAE,CAAC;QACxC,MAAM,IAAI,6BAA6B,CACrC,QAAQ,EACR,kBAAkB,EAClB,cAAc,CACf,CAAC;IACJ,CAAC;SAAM,IAAI,kBAAkB,GAAG,cAAc,EAAE,CAAC;QAC/C,MAAM,IAAI,cAAc,CAAC;YACvB,OAAO;YACP,SAAS,CAAC,WAAW;YACrB,wCAAwC,kBAAkB,eAAe,QAAQ,0BAA0B,cAAc,CAAC,QAAQ,EAAE,GAAG;SACxI,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,6BAA8B,SAAQ,KAAK;IAC/C,YAAY,QAAgB,EAAE,QAAgB,EAAE,MAAc;QAC5D,KAAK,CACH,0BAA0B,QAAQ,YAAY,QAAQ,2CAA2C,MAAM,EAAE,CAC1G,CAAC;QACF,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/out/zero-cache/src/services/mutagen/write-authorizer.d.ts

@@ -0,0 +1,20 @@
+import { LogContext } from '@rocicorp/logger';
+import type { JWTPayload } from 'jose';
+import type { CreateOp, DeleteOp, SetOp, UpdateOp } from '../../../../zero-protocol/src/mod.js';
+import { Database } from '../../../../zqlite/src/db.js';
+import type { ZeroConfig } from '../../config/zero-config.js';
+export interface WriteAuthorizer {
+    canInsert(authData: JWTPayload, op: CreateOp): boolean;
+    canUpdate(authData: JWTPayload, op: UpdateOp): boolean;
+    canDelete(authData: JWTPayload, op: DeleteOp): boolean;
+    canUpsert(authData: JWTPayload, op: SetOp): boolean;
+}
+export declare class WriteAuthorizerImpl {
+    #private;
+    constructor(lc: LogContext, config: ZeroConfig, replica: Database, cgID: string);
+    canInsert(authData: JWTPayload, op: CreateOp): boolean;
+    canUpdate(authData: JWTPayload, op: UpdateOp): boolean;
+    canDelete(authData: JWTPayload, op: DeleteOp): boolean;
+    canUpsert(authData: JWTPayload, op: SetOp): boolean;
+}
+//# sourceMappingURL=write-authorizer.d.ts.map

package/out/zero-cache/src/services/mutagen/write-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-authorizer.d.ts","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/mutagen/write-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAOrC,OAAO,KAAK,EAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAC,MAAM,eAAe,CAAC;AAIvE,OAAO,EAAC,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AAI1C,OAAO,KAAK,EAGV,UAAU,EACX,MAAM,6BAA6B,CAAC;AAQrC,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC;IACvD,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC;IACvD,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC;IACvD,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC;CACrD;AAED,qBAAa,mBAAmB;;gBAU5B,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,QAAQ,EACjB,IAAI,EAAE,MAAM;IAqBd,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ;IAI5C,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ;IAI5C,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ;IAI5C,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK;CA0L1C"}

package/out/zero-cache/src/services/mutagen/write-authorizer.js

@@ -0,0 +1,187 @@
+import { LogContext } from '@rocicorp/logger';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { pid } from 'node:process';
+import { assert } from '../../../../shared/src/asserts.js';
+import { randInt } from '../../../../shared/src/rand.js';
+import { buildPipeline } from '../../../../zql/src/zql/builder/builder.js';
+import { Database } from '../../../../zqlite/src/db.js';
+import { compile, sql } from '../../../../zqlite/src/internal/sql.js';
+import { StatementCache } from '../../../../zqlite/src/internal/statement-cache.js';
+import { TableSource } from '../../../../zqlite/src/table-source.js';
+import { listTables } from '../../db/lite-tables.js';
+import { mapLiteDataTypeToZqlSchemaValue } from '../../types/lite.js';
+import { DatabaseStorage } from '../view-syncer/database-storage.js';
+import { normalize } from '../view-syncer/pipeline-driver.js';
+import { MissingParameterError } from '../../../../zql/src/zql/builder/error.js';
+export class WriteAuthorizerImpl {
+    #authorizationConfig;
+    #replica;
+    #builderDelegate;
+    #tableSpecs;
+    #tables = new Map();
+    #statementCache;
+    #lc;
+    constructor(lc, config, replica, cgID) {
+        this.#lc = lc.withContext('class', 'WriteAuthorizerImpl');
+        this.#authorizationConfig = config.authorization ?? {};
+        this.#replica = replica;
+        const tmpDir = config.storageDbTmpDir ?? tmpdir();
+        const writeAuthzStorage = DatabaseStorage.create(lc, path.join(tmpDir, `mutagen-${pid}-${randInt(1000000, 9999999)}`));
+        const cgStorage = writeAuthzStorage.createClientGroupStorage(cgID);
+        this.#builderDelegate = {
+            getSource: name => this.#getSource(name),
+            createStorage: () => cgStorage.createStorage(),
+        };
+        this.#tableSpecs = new Map(listTables(replica).map(spec => [spec.name, normalize(spec)]));
+        this.#statementCache = new StatementCache(replica);
+    }
+    canInsert(authData, op) {
+        return this.#timedCanDo('insert', authData, op);
+    }
+    canUpdate(authData, op) {
+        return this.#timedCanDo('update', authData, op);
+    }
+    canDelete(authData, op) {
+        return this.#timedCanDo('delete', authData, op);
+    }
+    canUpsert(authData, op) {
+        const preMutationRow = this.#getPreMutationRow(op);
+        if (preMutationRow) {
+            return this.canUpdate(authData, {
+                op: 'update',
+                entityType: op.entityType,
+                id: op.id,
+                partialValue: op.value,
+            });
+        }
+        return this.canInsert(authData, {
+            op: 'create',
+            entityType: op.entityType,
+            id: op.id,
+            value: op.value,
+        });
+    }
+    #getSource(tableName) {
+        let source = this.#tables.get(tableName);
+        if (source) {
+            return source;
+        }
+        const tableSpec = this.#tableSpecs.get(tableName);
+        if (!tableSpec) {
+            throw new Error(`Table ${tableName} not found`);
+        }
+        const { columns, primaryKey } = tableSpec;
+        assert(primaryKey.length);
+        source = new TableSource(this.#replica, tableName, Object.fromEntries(Object.entries(columns).map(([name, { dataType }]) => [
+            name,
+            mapLiteDataTypeToZqlSchemaValue(dataType),
+        ])), [primaryKey[0], ...primaryKey.slice(1)]);
+        this.#tables.set(tableName, source);
+        return source;
+    }
+    #timedCanDo(action, authData, op) {
+        const start = performance.now();
+        try {
+            const ret = this.#canDo(action, authData, op);
+            return ret;
+        }
+        finally {
+            this.#lc.info?.('action:', action, 'duration:', performance.now() - start, 'entityType:', op.entityType, 'id:', op.id);
+        }
+    }
+    /**
+     * Evaluation order is from static to dynamic, broad to specific.
+     * table -> column -> row -> cell.
+     *
+     * If any step fails, the entire operation is denied.
+     *
+     * That is, table rules supersede column rules, which supersede row rules,
+     *
+     * All steps must allow for the operation to be allowed.
+     */
+    #canDo(action, authData, op) {
+        const rules = this.#authorizationConfig[op.entityType];
+        if (!rules) {
+            return true;
+        }
+        const tableRules = rules.table;
+        if (tableRules &&
+            !this.#passesPolicy(tableRules[action], authData, undefined)) {
+            return false;
+        }
+        const columnRules = rules.column;
+        if (columnRules) {
+            for (const rule of Object.values(columnRules)) {
+                if (!this.#passesPolicy(rule[action], authData, undefined)) {
+                    return false;
+                }
+            }
+        }
+        let preMutationRow;
+        if (op.op !== 'create') {
+            preMutationRow = this.#getPreMutationRow(op);
+        }
+        const rowRules = rules.row;
+        if (rowRules &&
+            !this.#passesPolicy(rowRules[action], authData, preMutationRow)) {
+            return false;
+        }
+        const cellRules = rules.cell;
+        if (cellRules) {
+            for (const rule of Object.values(cellRules)) {
+                if (!this.#passesPolicy(rule[action], authData, preMutationRow)) {
+                    return false;
+                }
+            }
+        }
+        return true;
+    }
+    #getPreMutationRow(op) {
+        return this.#statementCache.use(compile(sql `SELECT * FROM ${sql.ident(op.entityType)} WHERE id = ?`), stmt => stmt.statement.get(op.id.id));
+    }
+    #passesPolicy(policy, authData, preMutationRow) {
+        if (!policy) {
+            return true;
+        }
+        for (const [_, rule] of policy) {
+            try {
+                const input = buildPipeline(rule, this.#builderDelegate, {
+                    authData: authData,
+                    preMutationRow,
+                });
+                try {
+                    const res = input.fetch({});
+                    for (const _ of res) {
+                        // if any row is returned at all, the
+                        // rule passes.
+                        return true;
+                    }
+                }
+                finally {
+                    input.destroy();
+                }
+            }
+            catch (e) {
+                if (!(e instanceof MissingParameterError)) {
+                    throw e;
+                }
+                // Authorization rules may refer to parameters
+                // that are missing due to the current login context not having
+                // those values. E.g., referring to a claim that user does not have.
+                // In that case, the rule is not applicable. This is ok since
+                // all rules can only `allow` or `skip`. If we supported
+                // `deny` rules this would not work.
+                //
+                // The way to support `deny` would be to allow `null` and `undefined`
+                // into ZQL pipelines. Right now `where` clauses cannot take `null`
+                // or `undefined` values for two reasons:
+                // 1. We do not have `IS` and `IS NOT` operators in ZQL yet.
+                // 2. Our predicates do not compare `NULL` and `UNDEFINED` the same way SQL would.
+            }
+        }
+        // no rows returned by any rules? The policy fails.
+        return false;
+    }
+}
+//# sourceMappingURL=write-authorizer.js.map

package/out/zero-cache/src/services/mutagen/write-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-authorizer.js","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/mutagen/write-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAC,MAAM,EAAC,MAAM,SAAS,CAAC;AAC/B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAC,GAAG,EAAC,MAAM,cAAc,CAAC;AACjC,OAAO,EAAC,MAAM,EAAC,MAAM,uBAAuB,CAAC;AAE7C,OAAO,EAAC,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAG3C,OAAO,EAAC,aAAa,EAAC,MAAM,gCAAgC,CAAC;AAE7D,OAAO,EAAC,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAC,OAAO,EAAE,GAAG,EAAC,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAC,cAAc,EAAC,MAAM,wCAAwC,CAAC;AACtE,OAAO,EAAC,WAAW,EAAC,MAAM,4BAA4B,CAAC;AAMvD,OAAO,EAAC,UAAU,EAAC,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAC,+BAA+B,EAAC,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAC,eAAe,EAAC,MAAM,oCAAoC,CAAC;AAEnE,OAAO,EAAC,SAAS,EAAC,MAAM,mCAAmC,CAAC;AAC5D,OAAO,EAAC,qBAAqB,EAAC,MAAM,0CAA0C,CAAC;AAS/E,MAAM,OAAO,mBAAmB;IACrB,oBAAoB,CAAsB;IAC1C,QAAQ,CAAW;IACnB,gBAAgB,CAAkB;IAClC,WAAW,CAAmC;IAC9C,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IACzC,eAAe,CAAiB;IAChC,GAAG,CAAa;IAEzB,YACE,EAAc,EACd,MAAkB,EAClB,OAAiB,EACjB,IAAY;QAEZ,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAC1D,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,IAAI,MAAM,EAAE,CAAC;QAClD,MAAM,iBAAiB,GAAG,eAAe,CAAC,MAAM,CAC9C,EAAE,EACF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CACjE,CAAC;QACF,MAAM,SAAS,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,gBAAgB,GAAG;YACtB,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACxC,aAAa,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE;SAC/C,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CACxB,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAC9D,CAAC;QACF,IAAI,CAAC,eAAe,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,SAAS,CAAC,QAAoB,EAAE,EAAY;QAC1C,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,SAAS,CAAC,QAAoB,EAAE,EAAY;QAC1C,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,SAAS,CAAC,QAAoB,EAAE,EAAY;QAC1C,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,SAAS,CAAC,QAAoB,EAAE,EAAS;QACvC,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE;gBAC9B,EAAE,EAAE,QAAQ;gBACZ,UAAU,EAAE,EAAE,CAAC,UAAU;gBACzB,EAAE,EAAE,EAAE,CAAC,EAAE;gBACT,YAAY,EAAE,EAAE,CAAC,KAAK;aACvB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE;YAC9B,EAAE,EAAE,QAAQ;YACZ,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,KAAK,EAAE,EAAE,CAAC,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,SAAS,SAAS,YAAY,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,EAAC,OAAO,EAAE,UAAU,EAAC,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,GAAG,IAAI,WAAW,CACtB,IAAI,CAAC,QAAQ,EACb,SAAS,EACT,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAC,QAAQ,EAAC,CAAC,EAAE,EAAE,CAAC;YAClD,IAAI;YACJ,+BAA+B,CAAC,QAAQ,CAAC;SAC1C,CAAC,CACH,EACD,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CACxC,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAEpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,WAAW,CACT,MAAS,EACT,QAAoB,EACpB,EAAkB;QAElB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9C,OAAO,GAAG,CAAC;QACb,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CACb,SAAS,EACT,MAAM,EACN,WAAW,EACX,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,EACzB,aAAa,EACb,EAAE,CAAC,UAAU,EACb,KAAK,EACL,EAAE,CAAC,EAAE,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CACJ,MAAS,EACT,QAAoB,EACpB,EAAkB;QAElB,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;QAC/B,IACE,UAAU;YACV,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,EAC5D,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC;QACjC,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;oBAC3D,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,cAA+B,CAAC;QACpC,IAAI,EAAE,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACvB,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC;QAC3B,IACE,QAAQ;YACR,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,EAC/D,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;QAC7B,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC;oBAChE,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kBAAkB,CAAC,EAA+B;QAChD,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAC7B,OAAO,CAAC,GAAG,CAAA,iBAAiB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EACpE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAkB,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CACtD,CAAC;IACJ,CAAC;IAED,aAAa,CACX,MAA0B,EAC1B,QAAoB,EACpB,cAA+B;QAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE;oBACvD,QAAQ,EAAE,QAAqC;oBAC/C,cAAc;iBACf,CAAC,CAAC;gBACH,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC5B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;wBACpB,qCAAqC;wBACrC,eAAe;wBACf,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;wBAAS,CAAC;oBACT,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,CAAC,CAAC,YAAY,qBAAqB,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,CAAC;gBACV,CAAC;gBAED,8CAA8C;gBAC9C,+DAA+D;gBAC/D,oEAAoE;gBACpE,6DAA6D;gBAC7D,wDAAwD;gBACxD,oCAAoC;gBACpC,EAAE;gBACF,qEAAqE;gBACrE,mEAAmE;gBACnE,yCAAyC;gBACzC,4DAA4D;gBAC5D,kFAAkF;YACpF,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}