npm - @rocicorp/zero - Versions diffs - 0.26.0-canary.6 → 0.26.0-canary.7 - Mend

@rocicorp/zero 0.26.0-canary.6 → 0.26.0-canary.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (171) hide show

package/out/analyze-query/src/bin-transform.js CHANGED Viewed

@@ -36,7 +36,9 @@ const queryAst = transformAndHashQuery(
   "",
   rows[0].clientAST,
   permissions,
-  {},
+  {
+    decoded: {}
+  },
   rows[0].internal
 ).transformedAst;
 console.log("\n=== AST ===\n");

package/out/analyze-query/src/bin-transform.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"bin-transform.js","sources":["../../../../analyze-query/src/bin-transform.ts"],"sourcesContent":["import '../../shared/src/dotenv.ts';\n\nimport {consoleLogSink, LogContext} from '@rocicorp/logger';\nimport {astToZQL} from '../../ast-to-zql/src/ast-to-zql.ts';\nimport {formatOutput} from '../../ast-to-zql/src/format.ts';\nimport {must} from '../../shared/src/must.ts';\nimport {parseOptions} from '../../shared/src/options.ts';\nimport * as v from '../../shared/src/valita.ts';\nimport {transformAndHashQuery} from '../../zero-cache/src/auth/read-authorizer.ts';\nimport {\n appOptions,\n shardOptions,\n ZERO_ENV_VAR_PREFIX,\n} from '../../zero-cache/src/config/zero-config.ts';\nimport {loadSchemaAndPermissions} from '../../zero-cache/src/scripts/permissions.ts';\nimport {pgClient} from '../../zero-cache/src/types/pg.ts';\nimport {getShardID, upstreamSchema} from '../../zero-cache/src/types/shards.ts';\n\nconst options = {\n cvr: {db: v.string()},\n schema: {\n type: v.string().default('./schema.ts'),\n desc: ['Path to the schema file.'],\n },\n app: appOptions,\n shard: shardOptions,\n hash: {\n type: v.string().optional(),\n desc: ['Hash of the query to fetch the AST for.'],\n },\n};\n\nconst config = parseOptions(options, {envNamePrefix: ZERO_ENV_VAR_PREFIX});\n\nconst lc = new LogContext('debug', {}, consoleLogSink);\nconst {permissions} = await loadSchemaAndPermissions(config.schema);\n\nconst cvrDB = pgClient(lc, config.cvr.db);\n\nconst rows =\n await cvrDB`select \"clientAST\", \"internal\" from ${cvrDB(upstreamSchema(getShardID(config)) + '/cvr')}.\"queries\" where \"queryHash\" = ${must(\n config.hash,\n )} limit 1;`;\n\nconst queryAst = transformAndHashQuery(\n lc,\n '',\n rows[0].clientAST,\n permissions,\n {},\n rows[0].internal,\n).transformedAst;\n\n// oxlint-disable no-console\nconsole.log('\\n=== AST ===\\n');\nconsole.log(JSON.stringify(queryAst, null, 2));\nconsole.log('\\n=== ZQL ===\\n');\nconsole.log(await formatOutput(queryAst.table + astToZQL(queryAst)));\n// oxlint-enable no-console\n\nawait cvrDB.end();\n"],"names":["v.string"],"mappings":";;;;;;;;;;;;;AAkBA,MAAM,UAAU;AAAA,EACd,KAAK,EAAC,IAAIA,SAAS;AAAA,EACnB,QAAQ;AAAA,IACN,MAAMA,OAAE,EAAS,QAAQ,aAAa;AAAA,IACtC,MAAM,CAAC,0BAA0B;AAAA,EAAA;AAAA,EAEnC,KAAK;AAAA,EACL,OAAO;AAAA,EACP,MAAM;AAAA,IACJ,MAAMA,OAAE,EAAS,SAAA;AAAA,IACjB,MAAM,CAAC,yCAAyC;AAAA,EAAA;AAEpD;AAEA,MAAM,SAAS,aAAa,SAAS,EAAC,eAAe,qBAAoB;AAEzE,MAAM,KAAK,IAAI,WAAW,SAAS,CAAA,GAAI,cAAc;AACrD,MAAM,EAAC,YAAA,IAAe,MAAM,yBAAyB,OAAO,MAAM;AAElE,MAAM,QAAQ,SAAS,IAAI,OAAO,IAAI,EAAE;AAExC,MAAM,OACJ,MAAM,4CAA4C,MAAM,eAAe,WAAW,MAAM,CAAC,IAAI,MAAM,CAAC,kCAAkC;AAAA,EACpI,OAAO;AACT,CAAC;AAEH,MAAM,WAAW;AAAA,EACf;AAAA,EACA;AAAA,EACA,KAAK,CAAC,EAAE;AAAA,EACR;AAAA,EACA,CAAA;AAAA,~~EACA~~,KAAK,CAAC,EAAE;AACV,EAAE;AAGF,QAAQ,IAAI,iBAAiB;AAC7B,QAAQ,IAAI,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAC7C,QAAQ,IAAI,iBAAiB;AAC7B,QAAQ,IAAI,MAAM,aAAa,SAAS,QAAQ,SAAS,QAAQ,CAAC,CAAC;AAGnE,MAAM,MAAM,IAAA;"}
1	+ {"version":3,"file":"bin-transform.js","sources":["../../../../analyze-query/src/bin-transform.ts"],"sourcesContent":["import '../../shared/src/dotenv.ts';\n\nimport {consoleLogSink, LogContext} from '@rocicorp/logger';\nimport {astToZQL} from '../../ast-to-zql/src/ast-to-zql.ts';\nimport {formatOutput} from '../../ast-to-zql/src/format.ts';\nimport {must} from '../../shared/src/must.ts';\nimport {parseOptions} from '../../shared/src/options.ts';\nimport * as v from '../../shared/src/valita.ts';\nimport {transformAndHashQuery} from '../../zero-cache/src/auth/read-authorizer.ts';\nimport {\n appOptions,\n shardOptions,\n ZERO_ENV_VAR_PREFIX,\n} from '../../zero-cache/src/config/zero-config.ts';\nimport {loadSchemaAndPermissions} from '../../zero-cache/src/scripts/permissions.ts';\nimport {pgClient} from '../../zero-cache/src/types/pg.ts';\nimport {getShardID, upstreamSchema} from '../../zero-cache/src/types/shards.ts';\n\nconst options = {\n cvr: {db: v.string()},\n schema: {\n type: v.string().default('./schema.ts'),\n desc: ['Path to the schema file.'],\n },\n app: appOptions,\n shard: shardOptions,\n hash: {\n type: v.string().optional(),\n desc: ['Hash of the query to fetch the AST for.'],\n },\n};\n\nconst config = parseOptions(options, {envNamePrefix: ZERO_ENV_VAR_PREFIX});\n\nconst lc = new LogContext('debug', {}, consoleLogSink);\nconst {permissions} = await loadSchemaAndPermissions(config.schema);\n\nconst cvrDB = pgClient(lc, config.cvr.db);\n\nconst rows =\n await cvrDB`select \"clientAST\", \"internal\" from ${cvrDB(upstreamSchema(getShardID(config)) + '/cvr')}.\"queries\" where \"queryHash\" = ${must(\n config.hash,\n )} limit 1;`;\n\nconst queryAst = transformAndHashQuery(\n lc,\n '',\n rows[0].clientAST,\n permissions,\n {\n type: 'jwt',\n raw: '',\n decoded: {},\n },\n rows[0].internal,\n).transformedAst;\n\n// oxlint-disable no-console\nconsole.log('\\n=== AST ===\\n');\nconsole.log(JSON.stringify(queryAst, null, 2));\nconsole.log('\\n=== ZQL ===\\n');\nconsole.log(await formatOutput(queryAst.table + astToZQL(queryAst)));\n// oxlint-enable no-console\n\nawait cvrDB.end();\n"],"names":["v.string"],"mappings":";;;;;;;;;;;;;AAkBA,MAAM,UAAU;AAAA,EACd,KAAK,EAAC,IAAIA,SAAS;AAAA,EACnB,QAAQ;AAAA,IACN,MAAMA,OAAE,EAAS,QAAQ,aAAa;AAAA,IACtC,MAAM,CAAC,0BAA0B;AAAA,EAAA;AAAA,EAEnC,KAAK;AAAA,EACL,OAAO;AAAA,EACP,MAAM;AAAA,IACJ,MAAMA,OAAE,EAAS,SAAA;AAAA,IACjB,MAAM,CAAC,yCAAyC;AAAA,EAAA;AAEpD;AAEA,MAAM,SAAS,aAAa,SAAS,EAAC,eAAe,qBAAoB;AAEzE,MAAM,KAAK,IAAI,WAAW,SAAS,CAAA,GAAI,cAAc;AACrD,MAAM,EAAC,YAAA,IAAe,MAAM,yBAAyB,OAAO,MAAM;AAElE,MAAM,QAAQ,SAAS,IAAI,OAAO,IAAI,EAAE;AAExC,MAAM,OACJ,MAAM,4CAA4C,MAAM,eAAe,WAAW,MAAM,CAAC,IAAI,MAAM,CAAC,kCAAkC;AAAA,EACpI,OAAO;AACT,CAAC;AAEH,MAAM,WAAW;AAAA,EACf;AAAA,EACA;AAAA,EACA,KAAK,CAAC,EAAE;AAAA,EACR;AAAA,EACA;AAAA,IAGE,SAAS,CAAA;AAAA,EAAC;AAAA,EAEZ,KAAK,CAAC,EAAE;AACV,EAAE;AAGF,QAAQ,IAAI,iBAAiB;AAC7B,QAAQ,IAAI,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAC7C,QAAQ,IAAI,iBAAiB;AAC7B,QAAQ,IAAI,MAAM,aAAa,SAAS,QAAQ,SAAS,QAAQ,CAAC,CAAC;AAGnE,MAAM,MAAM,IAAA;"}

package/out/analyze-query/src/run-ast.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"run-ast.d.ts","sourceRoot":"","sources":["../../../../analyze-query/src/run-ast.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;~~AAMjD~~,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,kCAAkC,CAAC;AAErE,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,iDAAiD,CAAC;AACxF,OAAO,KAAK,EAAC,GAAG,EAAC,MAAM,gCAAgC,CAAC;AAExD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,0CAA0C,CAAC;AAG3E,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,+CAA+C,CAAC;AACrF,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,wBAAwB,CAAC;AAErD,MAAM,MAAM,aAAa,GAAG;IAC1B,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,oBAAoB,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC9C,EAAE,EAAE,QAAQ,CAAC;IACb,IAAI,EAAE,eAAe,CAAC;IACtB,WAAW,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC5C,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACxC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAClC,CAAC;AAEF,wBAAsB,MAAM,CAC1B,EAAE,EAAE,UAAU,EACd,YAAY,EAAE,YAAY,EAC1B,GAAG,EAAE,GAAG,EACR,aAAa,EAAE,OAAO,EACtB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,kBAAkB,CAAC,~~CA6F7B~~"}
1	+ {"version":3,"file":"run-ast.d.ts","sourceRoot":"","sources":["../../../../analyze-query/src/run-ast.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAOjD,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,kCAAkC,CAAC;AAErE,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,iDAAiD,CAAC;AACxF,OAAO,KAAK,EAAC,GAAG,EAAC,MAAM,gCAAgC,CAAC;AAExD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,0CAA0C,CAAC;AAG3E,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,+CAA+C,CAAC;AACrF,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,wBAAwB,CAAC;AAErD,MAAM,MAAM,aAAa,GAAG;IAC1B,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,oBAAoB,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC9C,EAAE,EAAE,QAAQ,CAAC;IACb,IAAI,EAAE,eAAe,CAAC;IACtB,WAAW,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC5C,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACxC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAClC,CAAC;AAEF,wBAAsB,MAAM,CAC1B,EAAE,EAAE,UAAU,EACd,YAAY,EAAE,YAAY,EAC1B,GAAG,EAAE,GAAG,EACR,aAAa,EAAE,OAAO,EACtB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,kBAAkB,CAAC,CA8F7B"}

package/out/analyze-query/src/run-ast.js CHANGED Viewed

@@ -33,6 +33,7 @@ async function runAst(lc, clientSchema, ast, isTransformed, options) {
         "No auth data provided. Permission rules will compare to `NULL` wherever an auth data field is referenced."
       );
     }
+    const auth = { decoded: authData };
     ast = transformAndHashQuery(
       lc,
       "clientGroupIDForAnalyze",
@@ -41,7 +42,7 @@ async function runAst(lc, clientSchema, ast, isTransformed, options) {
         permissions,
         "Permissions are required when applyPermissions is true"
       ),
-      authData,
+      auth,
       false
     ).transformedAst;
     result.afterPermissions = await formatOutput(ast.table + astToZQL(ast));

package/out/analyze-query/src/run-ast.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"run-ast.js","sources":["../../../../analyze-query/src/run-ast.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {astToZQL} from '../../ast-to-zql/src/ast-to-zql.ts';\nimport {formatOutput} from '../../ast-to-zql/src/format.ts';\nimport {assert} from '../../shared/src/asserts.ts';\nimport {must} from '../../shared/src/must.ts';\nimport {transformAndHashQuery} from '../../zero-cache/src/auth/read-authorizer.ts';\nimport type {LiteAndZqlSpec} from '../../zero-cache/src/db/specs.ts';\nimport {hydrate} from '../../zero-cache/src/services/view-syncer/pipeline-driver.ts';\nimport type {AnalyzeQueryResult} from '../../zero-protocol/src/analyze-query-result.ts';\nimport type {AST} from '../../zero-protocol/src/ast.ts';\nimport {mapAST} from '../../zero-protocol/src/ast.ts';\nimport type {ClientSchema} from '../../zero-protocol/src/client-schema.ts';\nimport type {Row} from '../../zero-protocol/src/data.ts';\nimport {hashOfAST} from '../../zero-protocol/src/query-hash.ts';\nimport type {PermissionsConfig} from '../../zero-schema/src/compiled-permissions.ts';\nimport type {NameMapper} from '../../zero-schema/src/name-mapper.ts';\nimport {\n buildPipeline,\n type BuilderDelegate,\n} from '../../zql/src/builder/builder.ts';\nimport type {Database} from '../../zqlite/src/db.ts';\n\nexport type RunAstOptions = {\n applyPermissions?: boolean \| undefined;\n authData?: string \| undefined;\n clientToServerMapper?: NameMapper \| undefined;\n db: Database;\n host: BuilderDelegate;\n permissions?: PermissionsConfig \| undefined;\n syncedRows?: boolean \| undefined;\n tableSpecs: Map<string, LiteAndZqlSpec>;\n vendedRows?: boolean \| undefined;\n};\n\nexport async function runAst(\n lc: LogContext,\n clientSchema: ClientSchema,\n ast: AST,\n isTransformed: boolean,\n options: RunAstOptions,\n): Promise<AnalyzeQueryResult> {\n const {clientToServerMapper, permissions, host} = options;\n const result: AnalyzeQueryResult = {\n warnings: [],\n syncedRows: undefined,\n syncedRowCount: 0,\n start: 0,\n end: 0,\n afterPermissions: undefined,\n readRows: undefined,\n readRowCountsByQuery: {},\n readRowCount: undefined,\n };\n\n if (!isTransformed) {\n // map the AST to server names if not already transformed\n ast = mapAST(ast, must(clientToServerMapper));\n }\n if (options.applyPermissions) {\n result.warnings.push(\n 'Permissions are deprecated and will be removed in an upcoming release. See: https://zero.rocicorp.dev/docs/auth.',\n );\n\n const authData = options.authData ? JSON.parse(options.authData) : {};\n if (!options.authData) {\n result.warnings.push(\n 'No auth data provided. Permission rules will compare to `NULL` wherever an auth data field is referenced.',\n );\n }\n ast = transformAndHashQuery(\n lc,\n 'clientGroupIDForAnalyze',\n ast,\n must(\n permissions,\n 'Permissions are required when applyPermissions is true',\n ),\n ~~authData~~,\n false,\n ).transformedAst;\n result.afterPermissions = await formatOutput(ast.table + astToZQL(ast));\n }\n const pipeline = buildPipeline(ast, host, 'query-id');\n\n const start = performance.now();\n\n let syncedRowCount = 0;\n const rowsByTable: Record<string, Row[]> = {};\n const seenByTable: Set<string> = new Set();\n for (const rowChange of hydrate(pipeline, hashOfAST(ast), clientSchema)) {\n if (rowChange === 'yield') {\n continue;\n }\n assert(rowChange.type === 'add');\n\n let rows: Row[] = rowsByTable[rowChange.table];\n const s = rowChange.table + '.' + JSON.stringify(rowChange.row);\n if (seenByTable.has(s)) {\n continue; // skip duplicates\n }\n syncedRowCount++;\n seenByTable.add(s);\n if (options.syncedRows) {\n if (!rows) {\n rows = [];\n rowsByTable[rowChange.table] = rows;\n }\n rows.push(rowChange.row);\n }\n }\n\n const end = performance.now();\n if (options.syncedRows) {\n result.syncedRows = rowsByTable;\n }\n result.start = start;\n result.end = end;\n\n // Always include the count of synced and vended rows.\n result.syncedRowCount = syncedRowCount;\n result.readRowCountsByQuery = host.debug?.getVendedRowCounts() ?? {};\n let readRowCount = 0;\n for (const c of Object.values(result.readRowCountsByQuery)) {\n for (const v of Object.values(c)) {\n readRowCount += v;\n }\n }\n result.readRowCount = readRowCount;\n\n if (options.vendedRows) {\n result.readRows = host.debug?.getVendedRows();\n }\n return result;\n}\n"],"names":[],"mappings":";;;;;;;;;~~AAkCA~~,eAAsB,OACpB,IACA,cACA,KACA,eACA,SAC6B;AAC7B,QAAM,EAAC,sBAAsB,aAAa,KAAA,IAAQ;AAClD,QAAM,SAA6B;AAAA,IACjC,UAAU,CAAA;AAAA,IACV,YAAY;AAAA,IACZ,gBAAgB;AAAA,IAChB,OAAO;AAAA,IACP,KAAK;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,sBAAsB,CAAA;AAAA,IACtB,cAAc;AAAA,EAAA;AAGhB,MAAI,CAAC,eAAe;AAElB,UAAM,OAAO,KAAK,KAAK,oBAAoB,CAAC;AAAA,EAC9C;AACA,MAAI,QAAQ,kBAAkB;AAC5B,WAAO,SAAS;AAAA,MACd;AAAA,IAAA;AAGF,UAAM,WAAW,QAAQ,WAAW,KAAK,MAAM,QAAQ,QAAQ,IAAI,CAAA;AACnE,QAAI,CAAC,QAAQ,UAAU;AACrB,aAAO,SAAS;AAAA,QACd;AAAA,MAAA;AAAA,IAEJ;AACA,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,MAAA;AAAA,MAEF;AAAA,MACA;AAAA,IAAA,EACA;AACF,WAAO,mBAAmB,MAAM,aAAa,IAAI,QAAQ,SAAS,GAAG,CAAC;AAAA,EACxE;AACA,QAAM,WAAW,cAAc,KAAK,MAAM,UAAU;AAEpD,QAAM,QAAQ,YAAY,IAAA;AAE1B,MAAI,iBAAiB;AACrB,QAAM,cAAqC,CAAA;AAC3C,QAAM,kCAA+B,IAAA;AACrC,aAAW,aAAa,QAAQ,UAAU,UAAU,GAAG,GAAG,YAAY,GAAG;AACvE,QAAI,cAAc,SAAS;AACzB;AAAA,IACF;AACA,WAAO,UAAU,SAAS,KAAK;AAE/B,QAAI,OAAc,YAAY,UAAU,KAAK;AAC7C,UAAM,IAAI,UAAU,QAAQ,MAAM,KAAK,UAAU,UAAU,GAAG;AAC9D,QAAI,YAAY,IAAI,CAAC,GAAG;AACtB;AAAA,IACF;AACA;AACA,gBAAY,IAAI,CAAC;AACjB,QAAI,QAAQ,YAAY;AACtB,UAAI,CAAC,MAAM;AACT,eAAO,CAAA;AACP,oBAAY,UAAU,KAAK,IAAI;AAAA,MACjC;AACA,WAAK,KAAK,UAAU,GAAG;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,MAAM,YAAY,IAAA;AACxB,MAAI,QAAQ,YAAY;AACtB,WAAO,aAAa;AAAA,EACtB;AACA,SAAO,QAAQ;AACf,SAAO,MAAM;AAGb,SAAO,iBAAiB;AACxB,SAAO,uBAAuB,KAAK,OAAO,mBAAA,KAAwB,CAAA;AAClE,MAAI,eAAe;AACnB,aAAW,KAAK,OAAO,OAAO,OAAO,oBAAoB,GAAG;AAC1D,eAAW,KAAK,OAAO,OAAO,CAAC,GAAG;AAChC,sBAAgB;AAAA,IAClB;AAAA,EACF;AACA,SAAO,eAAe;AAEtB,MAAI,QAAQ,YAAY;AACtB,WAAO,WAAW,KAAK,OAAO,cAAA;AAAA,EAChC;AACA,SAAO;AACT;"}
1	+ {"version":3,"file":"run-ast.js","sources":["../../../../analyze-query/src/run-ast.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {astToZQL} from '../../ast-to-zql/src/ast-to-zql.ts';\nimport {formatOutput} from '../../ast-to-zql/src/format.ts';\nimport {assert} from '../../shared/src/asserts.ts';\nimport {must} from '../../shared/src/must.ts';\nimport type {JWTAuth} from '../../zero-cache/src/auth/auth.ts';\nimport {transformAndHashQuery} from '../../zero-cache/src/auth/read-authorizer.ts';\nimport type {LiteAndZqlSpec} from '../../zero-cache/src/db/specs.ts';\nimport {hydrate} from '../../zero-cache/src/services/view-syncer/pipeline-driver.ts';\nimport type {AnalyzeQueryResult} from '../../zero-protocol/src/analyze-query-result.ts';\nimport type {AST} from '../../zero-protocol/src/ast.ts';\nimport {mapAST} from '../../zero-protocol/src/ast.ts';\nimport type {ClientSchema} from '../../zero-protocol/src/client-schema.ts';\nimport type {Row} from '../../zero-protocol/src/data.ts';\nimport {hashOfAST} from '../../zero-protocol/src/query-hash.ts';\nimport type {PermissionsConfig} from '../../zero-schema/src/compiled-permissions.ts';\nimport type {NameMapper} from '../../zero-schema/src/name-mapper.ts';\nimport {\n buildPipeline,\n type BuilderDelegate,\n} from '../../zql/src/builder/builder.ts';\nimport type {Database} from '../../zqlite/src/db.ts';\n\nexport type RunAstOptions = {\n applyPermissions?: boolean \| undefined;\n authData?: string \| undefined;\n clientToServerMapper?: NameMapper \| undefined;\n db: Database;\n host: BuilderDelegate;\n permissions?: PermissionsConfig \| undefined;\n syncedRows?: boolean \| undefined;\n tableSpecs: Map<string, LiteAndZqlSpec>;\n vendedRows?: boolean \| undefined;\n};\n\nexport async function runAst(\n lc: LogContext,\n clientSchema: ClientSchema,\n ast: AST,\n isTransformed: boolean,\n options: RunAstOptions,\n): Promise<AnalyzeQueryResult> {\n const {clientToServerMapper, permissions, host} = options;\n const result: AnalyzeQueryResult = {\n warnings: [],\n syncedRows: undefined,\n syncedRowCount: 0,\n start: 0,\n end: 0,\n afterPermissions: undefined,\n readRows: undefined,\n readRowCountsByQuery: {},\n readRowCount: undefined,\n };\n\n if (!isTransformed) {\n // map the AST to server names if not already transformed\n ast = mapAST(ast, must(clientToServerMapper));\n }\n if (options.applyPermissions) {\n result.warnings.push(\n 'Permissions are deprecated and will be removed in an upcoming release. See: https://zero.rocicorp.dev/docs/auth.',\n );\n\n const authData = options.authData ? JSON.parse(options.authData) : {};\n if (!options.authData) {\n result.warnings.push(\n 'No auth data provided. Permission rules will compare to `NULL` wherever an auth data field is referenced.',\n );\n }\n const auth: JWTAuth = {type: 'jwt', raw: '', decoded: authData};\n ast = transformAndHashQuery(\n lc,\n 'clientGroupIDForAnalyze',\n ast,\n must(\n permissions,\n 'Permissions are required when applyPermissions is true',\n ),\n auth,\n false,\n ).transformedAst;\n result.afterPermissions = await formatOutput(ast.table + astToZQL(ast));\n }\n const pipeline = buildPipeline(ast, host, 'query-id');\n\n const start = performance.now();\n\n let syncedRowCount = 0;\n const rowsByTable: Record<string, Row[]> = {};\n const seenByTable: Set<string> = new Set();\n for (const rowChange of hydrate(pipeline, hashOfAST(ast), clientSchema)) {\n if (rowChange === 'yield') {\n continue;\n }\n assert(rowChange.type === 'add');\n\n let rows: Row[] = rowsByTable[rowChange.table];\n const s = rowChange.table + '.' + JSON.stringify(rowChange.row);\n if (seenByTable.has(s)) {\n continue; // skip duplicates\n }\n syncedRowCount++;\n seenByTable.add(s);\n if (options.syncedRows) {\n if (!rows) {\n rows = [];\n rowsByTable[rowChange.table] = rows;\n }\n rows.push(rowChange.row);\n }\n }\n\n const end = performance.now();\n if (options.syncedRows) {\n result.syncedRows = rowsByTable;\n }\n result.start = start;\n result.end = end;\n\n // Always include the count of synced and vended rows.\n result.syncedRowCount = syncedRowCount;\n result.readRowCountsByQuery = host.debug?.getVendedRowCounts() ?? {};\n let readRowCount = 0;\n for (const c of Object.values(result.readRowCountsByQuery)) {\n for (const v of Object.values(c)) {\n readRowCount += v;\n }\n }\n result.readRowCount = readRowCount;\n\n if (options.vendedRows) {\n result.readRows = host.debug?.getVendedRows();\n }\n return result;\n}\n"],"names":[],"mappings":";;;;;;;;;AAmCA,eAAsB,OACpB,IACA,cACA,KACA,eACA,SAC6B;AAC7B,QAAM,EAAC,sBAAsB,aAAa,KAAA,IAAQ;AAClD,QAAM,SAA6B;AAAA,IACjC,UAAU,CAAA;AAAA,IACV,YAAY;AAAA,IACZ,gBAAgB;AAAA,IAChB,OAAO;AAAA,IACP,KAAK;AAAA,IACL,kBAAkB;AAAA,IAClB,UAAU;AAAA,IACV,sBAAsB,CAAA;AAAA,IACtB,cAAc;AAAA,EAAA;AAGhB,MAAI,CAAC,eAAe;AAElB,UAAM,OAAO,KAAK,KAAK,oBAAoB,CAAC;AAAA,EAC9C;AACA,MAAI,QAAQ,kBAAkB;AAC5B,WAAO,SAAS;AAAA,MACd;AAAA,IAAA;AAGF,UAAM,WAAW,QAAQ,WAAW,KAAK,MAAM,QAAQ,QAAQ,IAAI,CAAA;AACnE,QAAI,CAAC,QAAQ,UAAU;AACrB,aAAO,SAAS;AAAA,QACd;AAAA,MAAA;AAAA,IAEJ;AACA,UAAM,OAAgB,EAAuB,SAAS,SAAA;AACtD,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,MAAA;AAAA,MAEF;AAAA,MACA;AAAA,IAAA,EACA;AACF,WAAO,mBAAmB,MAAM,aAAa,IAAI,QAAQ,SAAS,GAAG,CAAC;AAAA,EACxE;AACA,QAAM,WAAW,cAAc,KAAK,MAAM,UAAU;AAEpD,QAAM,QAAQ,YAAY,IAAA;AAE1B,MAAI,iBAAiB;AACrB,QAAM,cAAqC,CAAA;AAC3C,QAAM,kCAA+B,IAAA;AACrC,aAAW,aAAa,QAAQ,UAAU,UAAU,GAAG,GAAG,YAAY,GAAG;AACvE,QAAI,cAAc,SAAS;AACzB;AAAA,IACF;AACA,WAAO,UAAU,SAAS,KAAK;AAE/B,QAAI,OAAc,YAAY,UAAU,KAAK;AAC7C,UAAM,IAAI,UAAU,QAAQ,MAAM,KAAK,UAAU,UAAU,GAAG;AAC9D,QAAI,YAAY,IAAI,CAAC,GAAG;AACtB;AAAA,IACF;AACA;AACA,gBAAY,IAAI,CAAC;AACjB,QAAI,QAAQ,YAAY;AACtB,UAAI,CAAC,MAAM;AACT,eAAO,CAAA;AACP,oBAAY,UAAU,KAAK,IAAI;AAAA,MACjC;AACA,WAAK,KAAK,UAAU,GAAG;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,MAAM,YAAY,IAAA;AACxB,MAAI,QAAQ,YAAY;AACtB,WAAO,aAAa;AAAA,EACtB;AACA,SAAO,QAAQ;AACf,SAAO,MAAM;AAGb,SAAO,iBAAiB;AACxB,SAAO,uBAAuB,KAAK,OAAO,mBAAA,KAAwB,CAAA;AAClE,MAAI,eAAe;AACnB,aAAW,KAAK,OAAO,OAAO,OAAO,oBAAoB,GAAG;AAC1D,eAAW,KAAK,OAAO,OAAO,CAAC,GAAG;AAChC,sBAAgB;AAAA,IAClB;AAAA,EACF;AACA,SAAO,eAAe;AAEtB,MAAI,QAAQ,YAAY;AACtB,WAAO,WAAW,KAAK,OAAO,cAAA;AAAA,EAChC;AACA,SAAO;AACT;"}

package/out/zero/package.json.js CHANGED Viewed

@@ -1,4 +1,4 @@
-const version = "0.26.0-canary.6";
+const version = "0.26.0-canary.7";
 const packageJson = {
   version
 };

package/out/zero-cache/src/auth/auth.d.ts ADDED Viewed

@@ -0,0 +1,45 @@
+import type { LogContext } from '@rocicorp/logger';
+import type { JWTPayload } from 'jose';
+import { type ErrorBody } from '../../../zero-protocol/src/error.ts';
+/** @deprecated JWT auth is deprecated */
+export type JWTAuth = {
+    readonly type: 'jwt';
+    readonly raw: string;
+    readonly decoded: JWTPayload;
+};
+export type OpaqueAuth = {
+    readonly type: 'opaque';
+    readonly raw: string;
+};
+export type Auth = OpaqueAuth | JWTAuth;
+export interface AuthSession {
+    /** Update the auth session with a new userID and token from the client */
+    update(userID: string, wireAuth: string | undefined): Promise<AuthUpdateResult>;
+    /** The revision of the auth state */
+    get revision(): number;
+    /** The auth state for the session */
+    get auth(): Auth | undefined;
+    /** Clear the auth session, removing any stored auth and allowing a new userID to be bound on the next update. */
+    clear(): void;
+}
+export type AuthUpdateResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly error: ErrorBody;
+};
+export type ValidateLegacyJWT = (token: string, ctx: {
+    readonly userID: string;
+}) => Promise<JWTAuth>;
+export declare class AuthSessionImpl implements AuthSession {
+    #private;
+    readonly id: string;
+    constructor(lc: LogContext, clientGroupID: string, validateLegacyJWT: ValidateLegacyJWT | undefined);
+    get auth(): Auth | undefined;
+    get revision(): number;
+    clear(): void;
+    update(userID: string, wireAuth: string | undefined): Promise<AuthUpdateResult>;
+}
+/** @deprecated used only in old JWT validation/rotation auth */
+export declare function pickToken(lc: LogContext, previousToken: Auth | undefined, newToken: Auth | undefined | null): Auth | undefined;
+//# sourceMappingURL=auth.d.ts.map

package/out/zero-cache/src/auth/auth.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,MAAM,CAAC;AAGrC,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,qCAAqC,CAAC;AAE7C,yCAAyC;AACzC,MAAM,MAAM,OAAO,GAAG;IACpB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,OAAO,CAAC;AAExC,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,MAAM,CACJ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAE7B,qCAAqC;IACrC,IAAI,QAAQ,IAAI,MAAM,CAAC;IAEvB,qCAAqC;IACrC,IAAI,IAAI,IAAI,IAAI,GAAG,SAAS,CAAC;IAE7B,iHAAiH;IACjH,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,MAAM,gBAAgB,GACxB;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;CACnB,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;CAC3B,CAAC;AAEN,MAAM,MAAM,iBAAiB,GAAG,CAC9B,KAAK,EAAE,MAAM,EACb,GAAG,EAAE;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAC,KAC3B,OAAO,CAAC,OAAO,CAAC,CAAC;AAgBtB,qBAAa,eAAgB,YAAW,WAAW;;IACjD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBAQlB,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,MAAM,EACrB,iBAAiB,EAAE,iBAAiB,GAAG,SAAS;IAOlD,IAAI,IAAI,IAAI,IAAI,GAAG,SAAS,CAE3B;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,KAAK,IAAI,IAAI;IAWP,MAAM,CACV,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAAC,gBAAgB,CAAC;CAoF7B;AAED,gEAAgE;AAChE,wBAAgB,SAAS,CACvB,EAAE,EAAE,UAAU,EACd,aAAa,EAAE,IAAI,GAAG,SAAS,EAC/B,QAAQ,EAAE,IAAI,GAAG,SAAS,GAAG,IAAI,oBAgFlC"}

package/out/zero-cache/src/auth/auth.js ADDED Viewed

@@ -0,0 +1,179 @@
+import { Unauthorized, AuthInvalidated } from "../../../zero-protocol/src/error-kind-enum.js";
+import { ZeroCache } from "../../../zero-protocol/src/error-origin-enum.js";
+import { isProtocolError, ProtocolError } from "../../../zero-protocol/src/error.js";
+function isProvidedAuth(wireAuth) {
+  return wireAuth !== void 0 && wireAuth !== "";
+}
+function authEquals(a, b) {
+  if (a === b) {
+    return true;
+  }
+  if (!a || !b) {
+    return false;
+  }
+  return a.type === b.type && a.raw === b.raw;
+}
+class AuthSessionImpl {
+  id;
+  #lc;
+  #validateLegacyJWT;
+  #auth = void 0;
+  #boundUserID;
+  #revision = 0;
+  constructor(lc, clientGroupID, validateLegacyJWT) {
+    this.id = clientGroupID;
+    this.#lc = lc;
+    this.#validateLegacyJWT = validateLegacyJWT;
+  }
+  get auth() {
+    return this.#auth;
+  }
+  get revision() {
+    return this.#revision;
+  }
+  clear() {
+    const lc = this.#lc.withContext(
+      "boundUserID",
+      this.#boundUserID ?? "unknown"
+    );
+    lc.debug?.(`Clearing auth session`);
+    this.#auth = void 0;
+    this.#boundUserID = void 0;
+    this.#revision = 0;
+  }
+  async update(userID, wireAuth) {
+    try {
+      const lc = this.#lc.withContext("newUserID", userID);
+      if (this.#boundUserID && this.#boundUserID !== userID) {
+        return {
+          ok: false,
+          error: {
+            kind: Unauthorized,
+            message: "Client groups are pinned to a single user. Connection userID does not match existing client group userID.",
+            origin: ZeroCache
+          }
+        };
+      }
+      const previousAuth = this.#auth;
+      const hasProvidedAuth = isProvidedAuth(wireAuth);
+      let nextAuth = previousAuth;
+      if (previousAuth) {
+        lc.debug?.(`Attempting to update auth from previous value`);
+      } else {
+        lc.debug?.(`Attempting to initialize auth`);
+      }
+      if (!hasProvidedAuth && previousAuth) {
+        return {
+          ok: false,
+          error: {
+            kind: Unauthorized,
+            message: "No token provided. An unauthenticated client cannot connect to an authenticated client group.",
+            origin: ZeroCache
+          }
+        };
+      }
+      if (!hasProvidedAuth) {
+        nextAuth = void 0;
+        lc.debug?.(`Cleared auth`);
+      } else if (this.#validateLegacyJWT !== void 0) {
+        const verifiedToken = await this.#validateLegacyJWT(wireAuth, { userID });
+        nextAuth = pickToken(this.#lc, this.#auth, verifiedToken);
+        lc.debug?.(`Updated auth with JWT`);
+      } else {
+        if (this.#auth?.type === "jwt") {
+          throw new Error(
+            "Cannot change auth type from legacy to opaque token"
+          );
+        }
+        nextAuth = {
+          type: "opaque",
+          raw: wireAuth
+        };
+        lc.debug?.(`Updated auth with opaque token`);
+      }
+      this.#auth = nextAuth;
+      this.#boundUserID ??= userID;
+      if (!authEquals(previousAuth, nextAuth)) {
+        this.#revision++;
+      }
+    } catch (e) {
+      if (isProtocolError(e)) {
+        return {
+          ok: false,
+          error: e.errorBody
+        };
+      }
+      return {
+        ok: false,
+        error: {
+          kind: AuthInvalidated,
+          message: `Failed to decode auth token: ${String(e)}`,
+          origin: ZeroCache
+        }
+      };
+    }
+    return { ok: true };
+  }
+}
+function pickToken(lc, previousToken, newToken) {
+  if (newToken === null) {
+    return void 0;
+  }
+  if (previousToken?.type && newToken?.type && previousToken?.type !== newToken?.type) {
+    throw new ProtocolError({
+      kind: Unauthorized,
+      message: "Token type cannot change. Client groups are pinned to a single token type.",
+      origin: ZeroCache
+    });
+  }
+  if (previousToken === void 0) {
+    lc.debug?.(`No previous token, using new token`);
+    return newToken;
+  }
+  if (newToken?.type === "opaque") {
+    return newToken;
+  }
+  if (previousToken.type === "opaque") {
+    throw new ProtocolError({
+      kind: Unauthorized,
+      message: "Token type cannot change from opaque to JWT. Client groups are pinned to a single token type.",
+      origin: ZeroCache
+    });
+  }
+  if (newToken) {
+    if (previousToken.decoded.sub !== newToken.decoded.sub) {
+      throw new ProtocolError({
+        kind: Unauthorized,
+        message: "The user id in the new token does not match the previous token. Client groups are pinned to a single user.",
+        origin: ZeroCache
+      });
+    }
+    if (previousToken.decoded.iat === void 0) {
+      lc.debug?.(`No issued at time for the existing token, using new token`);
+      return newToken;
+    }
+    if (newToken.decoded.iat === void 0) {
+      throw new ProtocolError({
+        kind: Unauthorized,
+        message: "The new token does not have an issued at time but the prior token does. Tokens for a client group must either all have issued at times or all not have issued at times",
+        origin: ZeroCache
+      });
+    }
+    if (previousToken.decoded.iat < newToken.decoded.iat) {
+      lc.debug?.(`New token is newer, using it`);
+      return newToken;
+    }
+    lc.debug?.(`New token is older or the same, using existing token`);
+    return previousToken;
+  }
+  throw new ProtocolError({
+    kind: Unauthorized,
+    message: "No token provided. An unauthenticated client cannot connect to an authenticated client group.",
+    origin: ZeroCache
+  });
+}
+export {
+  AuthSessionImpl,
+  pickToken
+};
+//# sourceMappingURL=auth.js.map

package/out/zero-cache/src/auth/auth.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"auth.js","sources":["../../../../../zero-cache/src/auth/auth.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {JWTPayload} from 'jose';\nimport {ErrorKind} from '../../../zero-protocol/src/error-kind.ts';\nimport {ErrorOrigin} from '../../../zero-protocol/src/error-origin.ts';\nimport {\n isProtocolError,\n ProtocolError,\n type ErrorBody,\n} from '../../../zero-protocol/src/error.ts';\n\n/** @deprecated JWT auth is deprecated */\nexport type JWTAuth = {\n readonly type: 'jwt';\n readonly raw: string;\n readonly decoded: JWTPayload;\n};\n\nexport type OpaqueAuth = {\n readonly type: 'opaque';\n readonly raw: string;\n};\n\nexport type Auth = OpaqueAuth | JWTAuth;\n\nexport interface AuthSession {\n /** Update the auth session with a new userID and token from the client */\n update(\n userID: string,\n wireAuth: string | undefined,\n ): Promise<AuthUpdateResult>;\n\n /** The revision of the auth state */\n get revision(): number;\n\n /** The auth state for the session */\n get auth(): Auth | undefined;\n\n /** Clear the auth session, removing any stored auth and allowing a new userID to be bound on the next update. */\n clear(): void;\n}\n\nexport type AuthUpdateResult =\n | {\n readonly ok: true;\n }\n | {\n readonly ok: false;\n readonly error: ErrorBody;\n };\n\nexport type ValidateLegacyJWT = (\n token: string,\n ctx: {readonly userID: string},\n) => Promise<JWTAuth>;\n\nfunction isProvidedAuth(wireAuth: string | undefined): wireAuth is string {\n return wireAuth !== undefined && wireAuth !== '';\n}\n\nfunction authEquals(a: Auth | null | undefined, b: Auth | null | undefined) {\n if (a === b) {\n return true;\n }\n if (!a || !b) {\n return false;\n }\n return a.type === b.type && a.raw === b.raw;\n}\n\nexport class AuthSessionImpl implements AuthSession {\n readonly id: string;\n readonly #lc: LogContext;\n readonly #validateLegacyJWT: ValidateLegacyJWT | undefined;\n #auth: Auth | undefined = undefined;\n #boundUserID: string | undefined;\n #revision = 0;\n\n constructor(\n lc: LogContext,\n clientGroupID: string,\n validateLegacyJWT: ValidateLegacyJWT | undefined,\n ) {\n this.id = clientGroupID;\n this.#lc = lc;\n this.#validateLegacyJWT = validateLegacyJWT;\n }\n\n get auth(): Auth | undefined {\n return this.#auth;\n }\n\n get revision(): number {\n return this.#revision;\n }\n\n clear(): void {\n const lc = this.#lc.withContext(\n 'boundUserID',\n this.#boundUserID ?? 'unknown',\n );\n lc.debug?.(`Clearing auth session`);\n this.#auth = undefined;\n this.#boundUserID = undefined;\n this.#revision = 0;\n }\n\n async update(\n userID: string,\n wireAuth: string | undefined,\n ): Promise<AuthUpdateResult> {\n try {\n const lc = this.#lc.withContext('newUserID', userID);\n\n // check if the auth update is trying to change the bound userID for this client group\n if (this.#boundUserID && this.#boundUserID !== userID) {\n return {\n ok: false,\n error: {\n kind: ErrorKind.Unauthorized,\n message:\n 'Client groups are pinned to a single user. Connection userID does not match existing client group userID.',\n origin: ErrorOrigin.ZeroCache,\n },\n };\n }\n\n const previousAuth = this.#auth;\n const hasProvidedAuth = isProvidedAuth(wireAuth);\n let nextAuth = previousAuth;\n\n if (previousAuth) {\n lc.debug?.(`Attempting to update auth from previous value`);\n } else {\n lc.debug?.(`Attempting to initialize auth`);\n }\n\n if (!hasProvidedAuth && previousAuth) {\n return {\n ok: false,\n error: {\n kind: ErrorKind.Unauthorized,\n message:\n 'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n origin: ErrorOrigin.ZeroCache,\n },\n };\n }\n\n if (!hasProvidedAuth) {\n nextAuth = undefined;\n lc.debug?.(`Cleared auth`);\n } else if (this.#validateLegacyJWT !== undefined) {\n const verifiedToken = await this.#validateLegacyJWT(wireAuth, {userID});\n nextAuth = pickToken(this.#lc, this.#auth, verifiedToken);\n lc.debug?.(`Updated auth with JWT`);\n } else {\n if (this.#auth?.type === 'jwt') {\n throw new Error(\n 'Cannot change auth type from legacy to opaque token',\n );\n }\n nextAuth = {\n type: 'opaque',\n raw: wireAuth,\n };\n lc.debug?.(`Updated auth with opaque token`);\n }\n\n this.#auth = nextAuth;\n this.#boundUserID ??= userID;\n\n if (!authEquals(previousAuth, nextAuth)) {\n this.#revision++;\n }\n } catch (e) {\n if (isProtocolError(e)) {\n return {\n ok: false,\n error: e.errorBody,\n };\n }\n return {\n ok: false,\n error: {\n kind: ErrorKind.AuthInvalidated,\n message: `Failed to decode auth token: ${String(e)}`,\n origin: ErrorOrigin.ZeroCache,\n },\n };\n }\n\n return {ok: true};\n }\n}\n\n/** @deprecated used only in old JWT validation/rotation auth */\nexport function pickToken(\n lc: LogContext,\n previousToken: Auth | undefined,\n newToken: Auth | undefined | null,\n) {\n if (newToken === null) {\n return undefined;\n }\n\n if (\n previousToken?.type &&\n newToken?.type &&\n previousToken?.type !== newToken?.type\n ) {\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'Token type cannot change. Client groups are pinned to a single token type.',\n origin: ErrorOrigin.ZeroCache,\n });\n }\n\n if (previousToken === undefined) {\n lc.debug?.(`No previous token, using new token`);\n return newToken;\n }\n\n if (newToken?.type === 'opaque') {\n return newToken;\n }\n\n if (previousToken.type === 'opaque') {\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'Token type cannot change from opaque to JWT. Client groups are pinned to a single token type.',\n origin: ErrorOrigin.ZeroCache,\n });\n }\n\n if (newToken) {\n if (previousToken.decoded.sub !== newToken.decoded.sub) {\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'The user id in the new token does not match the previous token. Client groups are pinned to a single user.',\n origin: ErrorOrigin.ZeroCache,\n });\n }\n\n if (previousToken.decoded.iat === undefined) {\n lc.debug?.(`No issued at time for the existing token, using new token`);\n // No issued at time for the existing token? We take the most recently received token.\n return newToken;\n }\n\n if (newToken.decoded.iat === undefined) {\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'The new token does not have an issued at time but the prior token does. Tokens for a client group must either all have issued at times or all not have issued at times',\n origin: ErrorOrigin.ZeroCache,\n });\n }\n\n // The new token is newer, so we take it.\n if (previousToken.decoded.iat < newToken.decoded.iat) {\n lc.debug?.(`New token is newer, using it`);\n return newToken;\n }\n\n // if the new token is older or the same, we keep the existing token.\n lc.debug?.(`New token is older or the same, using existing token`);\n return previousToken;\n }\n\n // previousToken !== undefined but newToken is undefined\n throw new ProtocolError({\n kind: ErrorKind.Unauthorized,\n message:\n 'No token provided. An unauthenticated client cannot connect to an authenticated client group.',\n origin: ErrorOrigin.ZeroCache,\n });\n}\n"],"names":["ErrorKind.Unauthorized","ErrorOrigin.ZeroCache","ErrorKind.AuthInvalidated"],"mappings":";;;AAuDA,SAAS,eAAe,UAAkD;AACxE,SAAO,aAAa,UAAa,aAAa;AAChD;AAEA,SAAS,WAAW,GAA4B,GAA4B;AAC1E,MAAI,MAAM,GAAG;AACX,WAAO;AAAA,EACT;AACA,MAAI,CAAC,KAAK,CAAC,GAAG;AACZ,WAAO;AAAA,EACT;AACA,SAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;AAC1C;AAEO,MAAM,gBAAuC;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACT,QAA0B;AAAA,EAC1B;AAAA,EACA,YAAY;AAAA,EAEZ,YACE,IACA,eACA,mBACA;AACA,SAAK,KAAK;AACV,SAAK,MAAM;AACX,SAAK,qBAAqB;AAAA,EAC5B;AAAA,EAEA,IAAI,OAAyB;AAC3B,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,WAAmB;AACrB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,QAAc;AACZ,UAAM,KAAK,KAAK,IAAI;AAAA,MAClB;AAAA,MACA,KAAK,gBAAgB;AAAA,IAAA;AAEvB,OAAG,QAAQ,uBAAuB;AAClC,SAAK,QAAQ;AACb,SAAK,eAAe;AACpB,SAAK,YAAY;AAAA,EACnB;AAAA,EAEA,MAAM,OACJ,QACA,UAC2B;AAC3B,QAAI;AACF,YAAM,KAAK,KAAK,IAAI,YAAY,aAAa,MAAM;AAGnD,UAAI,KAAK,gBAAgB,KAAK,iBAAiB,QAAQ;AACrD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,MAAMA;AAAAA,YACN,SACE;AAAA,YACF,QAAQC;AAAAA,UAAY;AAAA,QACtB;AAAA,MAEJ;AAEA,YAAM,eAAe,KAAK;AAC1B,YAAM,kBAAkB,eAAe,QAAQ;AAC/C,UAAI,WAAW;AAEf,UAAI,cAAc;AAChB,WAAG,QAAQ,+CAA+C;AAAA,MAC5D,OAAO;AACL,WAAG,QAAQ,+BAA+B;AAAA,MAC5C;AAEA,UAAI,CAAC,mBAAmB,cAAc;AACpC,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,MAAMD;AAAAA,YACN,SACE;AAAA,YACF,QAAQC;AAAAA,UAAY;AAAA,QACtB;AAAA,MAEJ;AAEA,UAAI,CAAC,iBAAiB;AACpB,mBAAW;AACX,WAAG,QAAQ,cAAc;AAAA,MAC3B,WAAW,KAAK,uBAAuB,QAAW;AAChD,cAAM,gBAAgB,MAAM,KAAK,mBAAmB,UAAU,EAAC,QAAO;AACtE,mBAAW,UAAU,KAAK,KAAK,KAAK,OAAO,aAAa;AACxD,WAAG,QAAQ,uBAAuB;AAAA,MACpC,OAAO;AACL,YAAI,KAAK,OAAO,SAAS,OAAO;AAC9B,gBAAM,IAAI;AAAA,YACR;AAAA,UAAA;AAAA,QAEJ;AACA,mBAAW;AAAA,UACT,MAAM;AAAA,UACN,KAAK;AAAA,QAAA;AAEP,WAAG,QAAQ,gCAAgC;AAAA,MAC7C;AAEA,WAAK,QAAQ;AACb,WAAK,iBAAiB;AAEtB,UAAI,CAAC,WAAW,cAAc,QAAQ,GAAG;AACvC,aAAK;AAAA,MACP;AAAA,IACF,SAAS,GAAG;AACV,UAAI,gBAAgB,CAAC,GAAG;AACtB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO,EAAE;AAAA,QAAA;AAAA,MAEb;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,MAAMC;AAAAA,UACN,SAAS,gCAAgC,OAAO,CAAC,CAAC;AAAA,UAClD,QAAQD;AAAAA,QAAY;AAAA,MACtB;AAAA,IAEJ;AAEA,WAAO,EAAC,IAAI,KAAA;AAAA,EACd;AACF;AAGO,SAAS,UACd,IACA,eACA,UACA;AACA,MAAI,aAAa,MAAM;AACrB,WAAO;AAAA,EACT;AAEA,MACE,eAAe,QACf,UAAU,QACV,eAAe,SAAS,UAAU,MAClC;AACA,UAAM,IAAI,cAAc;AAAA,MACtB,MAAMD;AAAAA,MACN,SACE;AAAA,MACF,QAAQC;AAAAA,IAAY,CACrB;AAAA,EACH;AAEA,MAAI,kBAAkB,QAAW;AAC/B,OAAG,QAAQ,oCAAoC;AAC/C,WAAO;AAAA,EACT;AAEA,MAAI,UAAU,SAAS,UAAU;AAC/B,WAAO;AAAA,EACT;AAEA,MAAI,cAAc,SAAS,UAAU;AACnC,UAAM,IAAI,cAAc;AAAA,MACtB,MAAMD;AAAAA,MACN,SACE;AAAA,MACF,QAAQC;AAAAA,IAAY,CACrB;AAAA,EACH;AAEA,MAAI,UAAU;AACZ,QAAI,cAAc,QAAQ,QAAQ,SAAS,QAAQ,KAAK;AACtD,YAAM,IAAI,cAAc;AAAA,QACtB,MAAMD;AAAAA,QACN,SACE;AAAA,QACF,QAAQC;AAAAA,MAAY,CACrB;AAAA,IACH;AAEA,QAAI,cAAc,QAAQ,QAAQ,QAAW;AAC3C,SAAG,QAAQ,2DAA2D;AAEtE,aAAO;AAAA,IACT;AAEA,QAAI,SAAS,QAAQ,QAAQ,QAAW;AACtC,YAAM,IAAI,cAAc;AAAA,QACtB,MAAMD;AAAAA,QACN,SACE;AAAA,QACF,QAAQC;AAAAA,MAAY,CACrB;AAAA,IACH;AAGA,QAAI,cAAc,QAAQ,MAAM,SAAS,QAAQ,KAAK;AACpD,SAAG,QAAQ,8BAA8B;AACzC,aAAO;AAAA,IACT;AAGA,OAAG,QAAQ,sDAAsD;AACjE,WAAO;AAAA,EACT;AAGA,QAAM,IAAI,cAAc;AAAA,IACtB,MAAMD;AAAAA,IACN,SACE;AAAA,IACF,QAAQC;AAAAA,EAAY,CACrB;AACH;"}

package/out/zero-cache/src/auth/read-authorizer.d.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 import type { LogContext } from '@rocicorp/logger';
-import type { JWTPayload } from 'jose';
 import type { AST } from '../../../zero-protocol/src/ast.ts';
 import type { PermissionsConfig } from '../../../zero-schema/src/compiled-permissions.ts';
+import type { JWTAuth } from './auth.ts';
 export type TransformedAndHashed = {
     id: string;
     transformedAst: AST;
@@ -16,9 +16,9 @@ export type TransformedAndHashed = {
  * would be excluded without running the query.
  * E.g., the user is trying to query a table that is not readable.
  */
-export declare function transformAndHashQuery(lc: LogContext, id: string, query: AST, permissionRules: PermissionsConfig, authData: JWTPayload | undefined, internalQuery: boolean | null | undefined): TransformedAndHashed;
+export declare function transformAndHashQuery(lc: LogContext, id: string, query: AST, permissionRules: PermissionsConfig, auth: JWTAuth | undefined, internalQuery: boolean | null | undefined): TransformedAndHashed;
 /**
  * For a given AST, apply the read-auth rules and bind static auth data.
  */
-export declare function transformQuery(lc: LogContext, query: AST, permissionRules: PermissionsConfig, authData: JWTPayload | undefined): AST;
+export declare function transformQuery(lc: LogContext, query: AST, permissionRules: PermissionsConfig, auth: JWTAuth | undefined): AST;
 //# sourceMappingURL=read-authorizer.d.ts.map

package/out/zero-cache/src/auth/read-authorizer.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"read-authorizer.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/read-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;~~AACjD~~,OAAO,KAAK,EAAC,~~UAAU~~,~~EAAC~~,MAAM,~~MAAM~~,CAAC;~~AAErC~~,OAAO,KAAK,EAAC,~~GAAG~~,~~EAAY~~,MAAM,~~mCAAmC~~,CAAC;~~AAEtE~~,OAAO,KAAK,EAAC,~~iBAAiB~~,EAAC,MAAM,~~kDAAkD~~,CAAC;~~AAIxF~~,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,GAAG,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AACF;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,GAAG,EACV,eAAe,EAAE,iBAAiB,EAClC,~~QAAQ~~,EAAE,~~UAAU~~,GAAG,SAAS,~~EAChC~~,aAAa,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GACxC,oBAAoB,CAStB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,GAAG,EACV,eAAe,EAAE,iBAAiB,EAClC,~~QAAQ~~,EAAE,~~UAAU~~,GAAG,SAAS,~~GAC/B~~,GAAG,CASL"}
1	+ {"version":3,"file":"read-authorizer.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/auth/read-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,EAAC,GAAG,EAAY,MAAM,mCAAmC,CAAC;AAEtE,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,kDAAkD,CAAC;AAGxF,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,WAAW,CAAC;AAEvC,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,GAAG,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AACF;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,GAAG,EACV,eAAe,EAAE,iBAAiB,EAClC,IAAI,EAAE,OAAO,GAAG,SAAS,EACzB,aAAa,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,GACxC,oBAAoB,CAStB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,GAAG,EACV,eAAe,EAAE,iBAAiB,EAClC,IAAI,EAAE,OAAO,GAAG,SAAS,GACxB,GAAG,CASL"}

package/out/zero-cache/src/auth/read-authorizer.js CHANGED Viewed

@@ -1,22 +1,22 @@
 import { hashOfAST } from "../../../zero-protocol/src/query-hash.js";
 import { bindStaticParameters } from "../../../zql/src/builder/builder.js";
 import { simplifyCondition } from "../../../zql/src/query/expression.js";
-function transformAndHashQuery(lc, id, query, permissionRules, authData, internalQuery) {
-  const transformed = internalQuery ? query : transformQuery(lc, query, permissionRules, authData);
+function transformAndHashQuery(lc, id, query, permissionRules, auth, internalQuery) {
+  const transformed = internalQuery ? query : transformQuery(lc, query, permissionRules, auth);
   return {
     id,
     transformedAst: transformed,
     transformationHash: hashOfAST(transformed)
   };
 }
-function transformQuery(lc, query, permissionRules, authData) {
+function transformQuery(lc, query, permissionRules, auth) {
   const queryWithPermissions = transformQueryInternal(
     lc,
     query,
     permissionRules
   );
   return bindStaticParameters(queryWithPermissions, {
-    authData
+    authData: auth ? auth.decoded : {}
   });
 }
 function transformQueryInternal(lc, query, permissionRules) {

package/out/zero-cache/src/auth/read-authorizer.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"read-authorizer.js","sources":["../../../../../zero-cache/src/auth/read-authorizer.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {~~JWTPayload} from 'jose';\nimport type {~~JSONValue} from '../../../shared/src/json.ts';\nimport type {AST, Condition} from '../../../zero-protocol/src/ast.ts';\nimport {hashOfAST} from '../../../zero-protocol/src/query-hash.ts';\nimport type {PermissionsConfig} from '../../../zero-schema/src/compiled-permissions.ts';\nimport {bindStaticParameters} from '../../../zql/src/builder/builder.ts';\nimport {simplifyCondition} from '../../../zql/src/query/expression.ts';\n\nexport type TransformedAndHashed = {\n id: string;\n transformedAst: AST;\n transformationHash: string;\n};\n/*\n Adds permission rules to the given query so it only returns rows that the\n * user is allowed to read.\n \n If the returned query is `undefined` that means that user cannot run\n * the query at all. This is only the case if we can infer that all rows\n * would be excluded without running the query.\n * E.g., the user is trying to query a table that is not readable.\n /\nexport function transformAndHashQuery(\n lc: LogContext,\n id: string,\n query: AST,\n permissionRules: PermissionsConfig,\n ~~authData~~: ~~JWTPayload~~ \| undefined,\n internalQuery: boolean \| null \| undefined,\n): TransformedAndHashed {\n const transformed = internalQuery\n ? query // application permissions do not apply to internal queries\n : transformQuery(lc, query, permissionRules, ~~authData~~);\n return {\n id,\n transformedAst: transformed,\n transformationHash: hashOfAST(transformed),\n };\n}\n\n/\n For a given AST, apply the read-auth rules and bind static auth data.\n */\nexport function transformQuery(\n lc: LogContext,\n query: AST,\n permissionRules: PermissionsConfig,\n ~~authData~~: ~~JWTPayload~~ \| undefined,\n): AST {\n const queryWithPermissions = transformQueryInternal(\n lc,\n query,\n permissionRules,\n );\n return bindStaticParameters(queryWithPermissions, {\n authData: ~~authData~~ as Record<string, JSONValue~~>,\~~n });\n}\n\nfunction transformQueryInternal(\n lc: LogContext,\n query: AST,\n permissionRules: PermissionsConfig,\n): AST {\n let rowSelectRules = permissionRules?.tables?.[query.table]?.row?.select;\n\n if (!rowSelectRules \|\| rowSelectRules.length === 0) {\n // If there are no rules, we default to not allowing any rows to be selected.\n lc.warn?.(\n \"No permission rules found for table '\" +\n query.table +\n \"'. No rows will be returned. Use ANYONE_CAN to allow all users to access all rows.\",\n );\n rowSelectRules = [\n [\n 'allow',\n {\n type: 'or',\n conditions: [],\n },\n ],\n ];\n }\n\n const updatedWhere = addRulesToWhere(\n query.where\n ? transformCondition(lc, query.where, permissionRules)\n : undefined,\n rowSelectRules,\n );\n return {\n ...query,\n where: simplifyCondition(updatedWhere),\n related: query.related?.map(sq => {\n const subquery = transformQueryInternal(lc, sq.subquery, permissionRules);\n return {\n ...sq,\n subquery,\n };\n }),\n };\n}\n\nfunction addRulesToWhere(\n where: Condition \| undefined,\n rowSelectRules: ['allow', Condition][],\n): Condition {\n return {\n type: 'and',\n conditions: [\n ...(where ? [where] : []),\n {\n type: 'or',\n conditions: rowSelectRules.map(([_, condition]) => condition),\n },\n ],\n };\n}\n\n// We must augment conditions so we do not provide an oracle to users.\n// E.g.,\n// `issue.whereExists('secret', s => s.where('value', 'sdf'))`\n// Not applying read policies to subqueries in the where position\n// would allow users to infer the existence of rows, and their contents,\n// that they cannot read.\nfunction transformCondition(\n lc: LogContext,\n cond: Condition,\n auth: PermissionsConfig,\n): Condition {\n switch (cond.type) {\n case 'simple':\n return cond;\n case 'and':\n case 'or':\n return {\n ...cond,\n conditions: cond.conditions.map(c => transformCondition(lc, c, auth)),\n };\n case 'correlatedSubquery': {\n const query = transformQueryInternal(lc, cond.related.subquery, auth);\n return {\n ...cond,\n related: {\n ...cond.related,\n subquery: query,\n },\n };\n }\n case 'scalarSubquery': {\n const query = transformQueryInternal(lc, cond.subquery, auth);\n return {\n ...cond,\n subquery: query,\n };\n }\n }\n}\n"],"names":[],"mappings":";;;AAuBO,SAAS,sBACd,IACA,IACA,OACA,iBACA,~~UACA~~,eACsB;AACtB,QAAM,cAAc,gBAChB,QACA,eAAe,IAAI,OAAO,iBAAiB,~~QAAQ~~;~~AACvD~~,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB;AAAA,IAChB,oBAAoB,UAAU,WAAW;AAAA,EAAA;AAE7C;AAKO,SAAS,eACd,IACA,OACA,iBACA,~~UACK~~;AACL,QAAM,uBAAuB;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEF,SAAO,qBAAqB,sBAAsB;AAAA,IAChD;AAAA,~~EAAA~~,~~CACD~~;AACH;AAEA,SAAS,uBACP,IACA,OACA,iBACK;AACL,MAAI,iBAAiB,iBAAiB,SAAS,MAAM,KAAK,GAAG,KAAK;AAElE,MAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG;AAElD,OAAG;AAAA,MACD,0CACE,MAAM,QACN;AAAA,IAAA;AAEJ,qBAAiB;AAAA,MACf;AAAA,QACE;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,YAAY,CAAA;AAAA,QAAC;AAAA,MACf;AAAA,IACF;AAAA,EAEJ;AAEA,QAAM,eAAe;AAAA,IACnB,MAAM,QACF,mBAAmB,IAAI,MAAM,OAAO,eAAe,IACnD;AAAA,IACJ;AAAA,EAAA;AAEF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,kBAAkB,YAAY;AAAA,IACrC,SAAS,MAAM,SAAS,IAAI,CAAA,OAAM;AAChC,YAAM,WAAW,uBAAuB,IAAI,GAAG,UAAU,eAAe;AACxE,aAAO;AAAA,QACL,GAAG;AAAA,QACH;AAAA,MAAA;AAAA,IAEJ,CAAC;AAAA,EAAA;AAEL;AAEA,SAAS,gBACP,OACA,gBACW;AACX,SAAO;AAAA,IACL,MAAM;AAAA,IACN,YAAY;AAAA,MACV,GAAI,QAAQ,CAAC,KAAK,IAAI,CAAA;AAAA,MACtB;AAAA,QACE,MAAM;AAAA,QACN,YAAY,eAAe,IAAI,CAAC,CAAC,GAAG,SAAS,MAAM,SAAS;AAAA,MAAA;AAAA,IAC9D;AAAA,EACF;AAEJ;AAQA,SAAS,mBACP,IACA,MACA,MACW;AACX,UAAQ,KAAK,MAAA;AAAA,IACX,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,QACL,GAAG;AAAA,QACH,YAAY,KAAK,WAAW,IAAI,OAAK,mBAAmB,IAAI,GAAG,IAAI,CAAC;AAAA,MAAA;AAAA,IAExE,KAAK,sBAAsB;AACzB,YAAM,QAAQ,uBAAuB,IAAI,KAAK,QAAQ,UAAU,IAAI;AACpE,aAAO;AAAA,QACL,GAAG;AAAA,QACH,SAAS;AAAA,UACP,GAAG,KAAK;AAAA,UACR,UAAU;AAAA,QAAA;AAAA,MACZ;AAAA,IAEJ;AAAA,IACA,KAAK,kBAAkB;AACrB,YAAM,QAAQ,uBAAuB,IAAI,KAAK,UAAU,IAAI;AAC5D,aAAO;AAAA,QACL,GAAG;AAAA,QACH,UAAU;AAAA,MAAA;AAAA,IAEd;AAAA,EAAA;AAEJ;"}
1	+ {"version":3,"file":"read-authorizer.js","sources":["../../../../../zero-cache/src/auth/read-authorizer.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport type {JSONValue} from '../../../shared/src/json.ts';\nimport type {AST, Condition} from '../../../zero-protocol/src/ast.ts';\nimport {hashOfAST} from '../../../zero-protocol/src/query-hash.ts';\nimport type {PermissionsConfig} from '../../../zero-schema/src/compiled-permissions.ts';\nimport {bindStaticParameters} from '../../../zql/src/builder/builder.ts';\nimport {simplifyCondition} from '../../../zql/src/query/expression.ts';\nimport type {JWTAuth} from './auth.ts';\n\nexport type TransformedAndHashed = {\n id: string;\n transformedAst: AST;\n transformationHash: string;\n};\n/*\n Adds permission rules to the given query so it only returns rows that the\n * user is allowed to read.\n \n If the returned query is `undefined` that means that user cannot run\n * the query at all. This is only the case if we can infer that all rows\n * would be excluded without running the query.\n * E.g., the user is trying to query a table that is not readable.\n /\nexport function transformAndHashQuery(\n lc: LogContext,\n id: string,\n query: AST,\n permissionRules: PermissionsConfig,\n auth: JWTAuth \| undefined,\n internalQuery: boolean \| null \| undefined,\n): TransformedAndHashed {\n const transformed = internalQuery\n ? query // application permissions do not apply to internal queries\n : transformQuery(lc, query, permissionRules, auth);\n return {\n id,\n transformedAst: transformed,\n transformationHash: hashOfAST(transformed),\n };\n}\n\n/\n For a given AST, apply the read-auth rules and bind static auth data.\n */\nexport function transformQuery(\n lc: LogContext,\n query: AST,\n permissionRules: PermissionsConfig,\n auth: JWTAuth \| undefined,\n): AST {\n const queryWithPermissions = transformQueryInternal(\n lc,\n query,\n permissionRules,\n );\n return bindStaticParameters(queryWithPermissions, {\n authData: auth ? (auth.decoded as Record<string, JSONValue>) : {},\n });\n}\n\nfunction transformQueryInternal(\n lc: LogContext,\n query: AST,\n permissionRules: PermissionsConfig,\n): AST {\n let rowSelectRules = permissionRules?.tables?.[query.table]?.row?.select;\n\n if (!rowSelectRules \|\| rowSelectRules.length === 0) {\n // If there are no rules, we default to not allowing any rows to be selected.\n lc.warn?.(\n \"No permission rules found for table '\" +\n query.table +\n \"'. No rows will be returned. Use ANYONE_CAN to allow all users to access all rows.\",\n );\n rowSelectRules = [\n [\n 'allow',\n {\n type: 'or',\n conditions: [],\n },\n ],\n ];\n }\n\n const updatedWhere = addRulesToWhere(\n query.where\n ? transformCondition(lc, query.where, permissionRules)\n : undefined,\n rowSelectRules,\n );\n return {\n ...query,\n where: simplifyCondition(updatedWhere),\n related: query.related?.map(sq => {\n const subquery = transformQueryInternal(lc, sq.subquery, permissionRules);\n return {\n ...sq,\n subquery,\n };\n }),\n };\n}\n\nfunction addRulesToWhere(\n where: Condition \| undefined,\n rowSelectRules: ['allow', Condition][],\n): Condition {\n return {\n type: 'and',\n conditions: [\n ...(where ? [where] : []),\n {\n type: 'or',\n conditions: rowSelectRules.map(([_, condition]) => condition),\n },\n ],\n };\n}\n\n// We must augment conditions so we do not provide an oracle to users.\n// E.g.,\n// `issue.whereExists('secret', s => s.where('value', 'sdf'))`\n// Not applying read policies to subqueries in the where position\n// would allow users to infer the existence of rows, and their contents,\n// that they cannot read.\nfunction transformCondition(\n lc: LogContext,\n cond: Condition,\n auth: PermissionsConfig,\n): Condition {\n switch (cond.type) {\n case 'simple':\n return cond;\n case 'and':\n case 'or':\n return {\n ...cond,\n conditions: cond.conditions.map(c => transformCondition(lc, c, auth)),\n };\n case 'correlatedSubquery': {\n const query = transformQueryInternal(lc, cond.related.subquery, auth);\n return {\n ...cond,\n related: {\n ...cond.related,\n subquery: query,\n },\n };\n }\n case 'scalarSubquery': {\n const query = transformQueryInternal(lc, cond.subquery, auth);\n return {\n ...cond,\n subquery: query,\n };\n }\n }\n}\n"],"names":[],"mappings":";;;AAuBO,SAAS,sBACd,IACA,IACA,OACA,iBACA,MACA,eACsB;AACtB,QAAM,cAAc,gBAChB,QACA,eAAe,IAAI,OAAO,iBAAiB,IAAI;AACnD,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB;AAAA,IAChB,oBAAoB,UAAU,WAAW;AAAA,EAAA;AAE7C;AAKO,SAAS,eACd,IACA,OACA,iBACA,MACK;AACL,QAAM,uBAAuB;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEF,SAAO,qBAAqB,sBAAsB;AAAA,IAChD,UAAU,OAAQ,KAAK,UAAwC,CAAA;AAAA,EAAC,CACjE;AACH;AAEA,SAAS,uBACP,IACA,OACA,iBACK;AACL,MAAI,iBAAiB,iBAAiB,SAAS,MAAM,KAAK,GAAG,KAAK;AAElE,MAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG;AAElD,OAAG;AAAA,MACD,0CACE,MAAM,QACN;AAAA,IAAA;AAEJ,qBAAiB;AAAA,MACf;AAAA,QACE;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,YAAY,CAAA;AAAA,QAAC;AAAA,MACf;AAAA,IACF;AAAA,EAEJ;AAEA,QAAM,eAAe;AAAA,IACnB,MAAM,QACF,mBAAmB,IAAI,MAAM,OAAO,eAAe,IACnD;AAAA,IACJ;AAAA,EAAA;AAEF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,kBAAkB,YAAY;AAAA,IACrC,SAAS,MAAM,SAAS,IAAI,CAAA,OAAM;AAChC,YAAM,WAAW,uBAAuB,IAAI,GAAG,UAAU,eAAe;AACxE,aAAO;AAAA,QACL,GAAG;AAAA,QACH;AAAA,MAAA;AAAA,IAEJ,CAAC;AAAA,EAAA;AAEL;AAEA,SAAS,gBACP,OACA,gBACW;AACX,SAAO;AAAA,IACL,MAAM;AAAA,IACN,YAAY;AAAA,MACV,GAAI,QAAQ,CAAC,KAAK,IAAI,CAAA;AAAA,MACtB;AAAA,QACE,MAAM;AAAA,QACN,YAAY,eAAe,IAAI,CAAC,CAAC,GAAG,SAAS,MAAM,SAAS;AAAA,MAAA;AAAA,IAC9D;AAAA,EACF;AAEJ;AAQA,SAAS,mBACP,IACA,MACA,MACW;AACX,UAAQ,KAAK,MAAA;AAAA,IACX,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,QACL,GAAG;AAAA,QACH,YAAY,KAAK,WAAW,IAAI,OAAK,mBAAmB,IAAI,GAAG,IAAI,CAAC;AAAA,MAAA;AAAA,IAExE,KAAK,sBAAsB;AACzB,YAAM,QAAQ,uBAAuB,IAAI,KAAK,QAAQ,UAAU,IAAI;AACpE,aAAO;AAAA,QACL,GAAG;AAAA,QACH,SAAS;AAAA,UACP,GAAG,KAAK;AAAA,UACR,UAAU;AAAA,QAAA;AAAA,MACZ;AAAA,IAEJ;AAAA,IACA,KAAK,kBAAkB;AACrB,YAAM,QAAQ,uBAAuB,IAAI,KAAK,UAAU,IAAI;AAC5D,aAAO;AAAA,QACL,GAAG;AAAA,QACH,UAAU;AAAA,MAAA;AAAA,IAEd;AAAA,EAAA;AAEJ;"}

package/out/zero-cache/src/config/zero-config.d.ts CHANGED Viewed

@@ -353,6 +353,10 @@ export declare const zeroOptions: {
             type: v.Type<number>;
             desc: string[];
         };
+        backPressureLimitHeapProportion: {
+            type: v.Type<number>;
+            desc: string[];
+        };
     };
     taskID: {
         type: v.Optional<string>;

package/out/zero-cache/src/config/zero-config.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"zero-config.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/config/zero-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC;AASnD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAC,SAAS,EAAC,MAAM,kCAAkC,CAAC;AAEhE,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C,eAAO,MAAM,UAAU;;;;;;;;;CA+CtB,CAAC;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;CAwBxB,CAAC;AAEF,QAAA,MAAM,cAAc;;;;;;;;;CAmBnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAE3D,QAAA,MAAM,oBAAoB;;;;;;;;;CAczB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5D,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDhB,CAAC;AAuGF,kBAAkB;AAClB,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAKpD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;IAwCtB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAGlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuHlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA6ChB,kBAAkB;;;;;;QASlB,kBAAkB~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAsRpB~~,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgEnB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAIpD,wBAAgB,aAAa,CAC3B,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,UAAU,CAaZ;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,oBAAoB,CAItB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,GAAG,SAAS,GACpD,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,EACnD,QAAQ,EAAE,MAAM,GAAG,SAAS,WAwC7B;AAYD,wBAAgB,kBAAkB,SAEjC"}
1	+ {"version":3,"file":"zero-config.d.ts","sourceRoot":"","sources":["../../../../../zero-cache/src/config/zero-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,CAAC,MAAM,+BAA+B,CAAC;AASnD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAC,SAAS,EAAC,MAAM,kCAAkC,CAAC;AAEhE,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C,eAAO,MAAM,UAAU;;;;;;;;;CA+CtB,CAAC;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;CAwBxB,CAAC;AAEF,QAAA,MAAM,cAAc;;;;;;;;;CAmBnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAE3D,QAAA,MAAM,oBAAoB;;;;;;;;;CAczB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAE5D,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDhB,CAAC;AAuGF,kBAAkB;AAClB,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAKpD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;IAwCtB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAGlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuHlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA6ChB,kBAAkB;;;;;;QASlB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8SpB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgEnB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,WAAW,CAAC,CAAC;AAIpD,wBAAgB,aAAa,CAC3B,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,UAAU,CAaZ;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,GAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAM,GAC7C,oBAAoB,CAItB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,GAAG,SAAS,GACpD,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,EACnD,QAAQ,EAAE,MAAM,GAAG,SAAS,WAwC7B;AAYD,wBAAgB,kBAAkB,SAEjC"}

package/out/zero-cache/src/config/zero-config.js CHANGED Viewed

@@ -472,6 +472,29 @@ const zeroOptions = {
         `is received during this interval, the delay will be canceled and the takeover will happen`,
         `immediately, since the incoming request indicates that the task is registered as a target.`
       ]
+    },
+    backPressureLimitHeapProportion: {
+      type: number().default(0.04),
+      desc: [
+        `The percentage of {bold --max-old-space-size} to use as a buffer for absorbing replication`,
+        `stream spikes. When the estimated amount of queued data exceeds this threshold, back pressure`,
+        `is applied to the replication stream, delaying downstream sync as a result.`,
+        ``,
+        `The threshold was determined empirically with load testing. Higher thresholds have resulted`,
+        `in OOMs. Note also that the byte-counting logic in the queue is strictly an underestimate of`,
+        `actual memory usage (but importantly, proportionally correct), so the queue is actually`,
+        `using more than what this proportion suggests.`,
+        ``,
+        `This parameter is exported as an emergency knob to reduce the size of the buffer in the`,
+        `event that the server OOMs from back pressure. Resist the urge to {italic increase} this`,
+        `proportion, as it is mainly useful for absorbing periodic spikes and does not meaningfully`,
+        `affect steady-state replication throughput; the latter is determined by other factors such`,
+        `as object serialization and PG throughput`,
+        ``,
+        `In other words, the back pressure limit does not constrain replication throughput;`,
+        `rather, it protects the system when the upstream throughput exceeds the downstream`,
+        `throughput.`
+      ]
     }
   },
   taskID: {