@sanity/sdk 2.19.0 → 2.20.0

package/src/document/documentStore.test.ts

@@ -1,6 +1,7 @@
 import {
   type BaseActionOptions,
   type BaseMutationOptions,
+  ClientError,
   type FilteredResponseQueryOptions,
   type ListenEvent,
   type MultipleActionResult,
@@ -17,7 +18,18 @@ import {diffValue} from '@sanity/diff-patch'
 import {DocumentId, getDraftId, getPublishedId} from '@sanity/id-utils'
 import {type Mutation, type SanityDocument} from '@sanity/types'
 import {evaluate, parse} from 'groq-js'
-import {delay, first, firstValueFrom, from, Observable, of, ReplaySubject, Subject} from 'rxjs'
+import {
+  defer,
+  delay,
+  first,
+  firstValueFrom,
+  from,
+  Observable,
+  of,
+  ReplaySubject,
+  Subject,
+  throwError,
+} from 'rxjs'
 import {afterEach, beforeEach, expect, it, vi} from 'vitest'
 
 import {getClientState} from '../client/clientStore'
@@ -917,6 +929,89 @@ it('does not send credentials with the dataset ACL request', async () => {
   expect(aclCall![0]).not.toHaveProperty('withCredentials')
 })
 
+it('retries transient dataset ACL fetch failures instead of failing fatally', async () => {
+  const datasetAcl = [{filter: 'true', permissions: ['read', 'update', 'create', 'history']}]
+
+  // the first attempt fails like a dropped connection; subsequent attempts succeed
+  let aclAttempts = 0
+  client.observable.request = vi.fn().mockReturnValue(
+    defer(() => {
+      aclAttempts++
+      if (aclAttempts === 1) return throwError(() => new Error('socket hang up'))
+      return of(datasetAcl)
+    }),
+  )
+
+  const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
+  const result = await resolvePermissions(instance, {actions: [createDocument(doc)]})
+
+  expect(result).toEqual({allowed: true})
+  expect(aclAttempts).toBe(2)
+
+  // the store never entered the fatal error state
+  const documentState = getDocumentState(instance, doc)
+  expect(() => documentState.getCurrent()).not.toThrow()
+})
+
+it('does not retry dataset ACL fetch failures caused by 4xx client errors', async () => {
+  const forbidden = new ClientError({
+    statusCode: 403,
+    headers: {},
+    body: {error: 'Forbidden', message: 'Session does not have access to this dataset'},
+  })
+
+  let aclAttempts = 0
+  client.observable.request = vi.fn().mockReturnValue(
+    defer(() => {
+      aclAttempts++
+      return throwError(() => forbidden)
+    }),
+  )
+
+  const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
+  const documentState = getDocumentState(instance, doc)
+  const unsubscribe = documentState.subscribe()
+
+  // the error is fatal: it surfaces through the store instead of being retried
+  await vi.waitFor(() => {
+    expect(() => documentState.getCurrent()).toThrow(
+      'Forbidden - Session does not have access to this dataset',
+    )
+  })
+  expect(aclAttempts).toBe(1)
+
+  unsubscribe()
+})
+
+it('retries dataset ACL fetch failures caused by 429 rate-limit errors', async () => {
+  const rateLimited = new ClientError({
+    statusCode: 429,
+    headers: {},
+    body: {error: 'Too Many Requests', message: 'Rate limit exceeded'},
+  })
+  const datasetAcl = [{filter: 'true', permissions: ['read', 'update', 'create', 'history']}]
+
+  // the first attempt is rate limited; subsequent attempts succeed
+  let aclAttempts = 0
+  client.observable.request = vi.fn().mockReturnValue(
+    defer(() => {
+      aclAttempts++
+      if (aclAttempts === 1) return throwError(() => rateLimited)
+      return of(datasetAcl)
+    }),
+  )
+
+  const doc = createDocumentHandle({documentId: crypto.randomUUID(), documentType: 'article'})
+  const result = await resolvePermissions(instance, {actions: [createDocument(doc)]})
+
+  expect(result).toEqual({allowed: true})
+  expect(aclAttempts).toBe(2)
+
+  // the store never entered the fatal error state
+  const documentState = getDocumentState(instance, doc)
+  expect(() => documentState.getCurrent()).not.toThrow()
+})
+
 it('fetches ACL for MediaLibraryResource', async () => {
   const mediaLibraryInstance = createSanityInstance({
     projectId: 'p',
@@ -1250,6 +1345,8 @@ vi.mock('./documentConstants.ts', async (importOriginal) => {
     DOCUMENT_STATE_CLEAR_DELAY: 25,
     OUT_OF_SYNC_RETRY_BASE_DELAY: 0,
     OUT_OF_SYNC_RETRY_MAX_DELAY: 0,
+    ACL_RETRY_BASE_DELAY: 0,
+    ACL_RETRY_MAX_DELAY: 0,
   }
 })
 

package/src/document/documentStore.ts

@@ -1,4 +1,4 @@
-import {type Action, type Mutation} from '@sanity/client'
+import {type Action, ClientError, CorsOriginError, type Mutation} from '@sanity/client'
 import {DocumentId, getDraftId, getPublishedId, getVersionId} from '@sanity/id-utils'
 import {jsonMatch} from '@sanity/json-match'
 import {type SanityDocument} from 'groq'
@@ -48,6 +48,8 @@ import {createStateSourceAction, type StateSource} from '../store/createStateSou
 import {defineStore, type StoreContext} from '../store/defineStore'
 import {type DocumentAction} from './actions'
 import {
+  ACL_RETRY_BASE_DELAY,
+  ACL_RETRY_MAX_DELAY,
   API_VERSION,
   INITIAL_OUTGOING_THROTTLE_TIME,
   OUT_OF_SYNC_RETRY_BASE_DELAY,
@@ -562,10 +564,39 @@ const subscribeToClientAndFetchDatasetAcl = ({
   return getClientState(instance, clientOptions)
     .observable.pipe(
       switchMap((client) =>
-        client.observable.request<DatasetAcl>({
-          uri,
-          tag: 'acl.get',
-        }),
+        client.observable
+          .request<DatasetAcl>({
+            uri,
+            tag: 'acl.get',
+          })
+          .pipe(
+            retry({
+              delay: (error, retryCount) => {
+                // 4xx responses and CORS misconfigurations are not transient —
+                // the server will keep rejecting the request, so rethrow to
+                // surface them as a fatal store error. 408 (request timeout)
+                // and 429 (rate limit) are the exceptions: they resolve on
+                // their own, so they are retried like network errors
+                const isTransientClientError =
+                  error instanceof ClientError &&
+                  (error.statusCode === 408 || error.statusCode === 429)
+                if (
+                  (error instanceof ClientError && !isTransientClientError) ||
+                  error instanceof CorsOriginError
+                ) {
+                  return throwError(() => error)
+                }
+                // network errors (no status code), 408/429 responses, and 5xx
+                // responses are retried with exponential backoff so a transient
+                // failure during startup doesn't permanently brick the store
+                const backoff = Math.min(
+                  ACL_RETRY_BASE_DELAY * 2 ** (retryCount - 1),
+                  ACL_RETRY_MAX_DELAY,
+                )
+                return timer(backoff)
+              },
+            }),
+          ),
       ),
       tap((datasetAcl) => state.set('setGrants', {grants: createGrantsLookup(datasetAcl)})),
     )

package/src/document/patchOperations.test.ts

@@ -565,6 +565,33 @@ describe('diffMatchPatch', () => {
     expect(output).toEqual(input)
   })
 
+  it('applies the patch when its offsets miss a multi-byte boundary', () => {
+    // `\u00f8` is two bytes, so this patch's offsets land inside it and the byte
+    // walk overshoots. The default is to throw, which escapes the rebase loop in
+    // `reducers.ts` and kills the whole outgoing-actions pipeline: the instance
+    // then silently stops writing every document. The patch itself is fine and
+    // still applies.
+    const input = {foo: 'abcdefg\u00f8'}
+    const patch = '@@ -9,1 +9,2 @@\n \u00f8\n+!\n'
+
+    expect(() => diffMatchPatch(input, {foo: patch})).not.toThrow()
+    expect(diffMatchPatch(input, {foo: patch})).toEqual({foo: 'abcdefg\u00f8!'})
+  })
+
+  it('still patches the other properties in the same mutation', () => {
+    const input = {multibyte: 'abcdefg\u00f8', ascii: 'the quick brown fox'}
+
+    const output = diffMatchPatch(input, {
+      multibyte: '@@ -9,1 +9,2 @@\n \u00f8\n+!\n',
+      ascii: '@@ -13,7 +13,7 @@\n own \n-fox\n+cat\n',
+    })
+
+    expect(output).toEqual({
+      multibyte: 'abcdefg\u00f8!',
+      ascii: 'the quick brown cat',
+    })
+  })
+
   it('applies a diff-match-patch that makes no changes', () => {
     const input = {foo: 'unchanged'}
     const patch = '@@ -1,9 +1,9 @@\n unchanged\n'

package/src/document/patchOperations.ts

@@ -617,7 +617,16 @@ export function diffMatchPatch(
         )
       }
 
-      const [nextValue] = applyPatches(parsePatch(dmp), value)
+      // Offsets arrive as UTF-8 byte positions and can overshoot when they
+      // land inside a multi-byte character, which happens once the string a
+      // patch was computed against has diverged. The default is to throw, and
+      // that throw escapes the rebase loop in `reducers.ts`, kills the
+      // outgoing-actions pipeline, and leaves the instance silently dropping
+      // every write. Clamping to the nearest index applies the patch instead,
+      // which is what the Studio and the Portable Text editor already do.
+      const [nextValue] = applyPatches(parsePatch(dmp), value, {
+        allowExceedingIndices: true,
+      })
       return {path, value: nextValue}
     })
     .reduce((acc, {path, value}) => setDeep(acc, path, value), input)

package/src/document/permissions.test.ts

@@ -266,7 +266,9 @@ describe('calculatePermissions', () => {
       _createdAt: '2025-01-01T00:00:00.000Z',
       _updatedAt: '2025-01-01T00:00:00.000Z',
       _rev: 'rev-1',
-      _system: {createdBy},
+      // Content Lake sets `_system.createdBy` on canvas documents; the public
+      // `DocumentSystem` type doesn't declare it, so the literal needs a cast.
+      _system: {createdBy} as SanityDocument['_system'],
     })
 
     const editAction: DocumentAction = {

package/src/document/reducers.test.ts

@@ -632,6 +632,60 @@ describe('revertOutgoingTransaction', () => {
     const docState = newState.documentStates[draftId]
     expect(docState?.unverifiedRevisions && docState.unverifiedRevisions['txnOut']).toBeUndefined()
   })
+
+  it('unregisters the reverted batch subscription ids, making documents with no other subscribers evictable', () => {
+    const draftId = getDraftId(DocumentId('doc1'))
+    const pubId = getPublishedId(DocumentId('doc1'))
+    const state: SyncTransactionState = {
+      queued: [],
+      applied: [],
+      outgoing: {
+        transactionId: 'txnRevert',
+        actions: [
+          {
+            type: 'document.edit',
+            documentId: 'doc1',
+            documentType: 'book',
+            patches: [{set: {foo: 'changed'}}],
+          },
+        ],
+        disableBatching: false,
+        batchedTransactionIds: ['txnRevert'],
+        outgoingActions: [],
+        outgoingMutations: [],
+        base: {},
+        working: {},
+        previous: {},
+        previousRevs: {},
+        timestamp: '2025-02-06T00:04:30.000Z',
+      },
+      grants,
+      documentStates: {
+        // only subscriber is the reverted transaction itself
+        [draftId]: {
+          id: draftId,
+          subscriptions: ['txnRevert'],
+          local: {...exampleDoc, _id: draftId, foo: 'changed', _rev: 'rev2'},
+          remote: {...exampleDoc, _id: draftId, foo: 'old', _rev: 'rev1'},
+        },
+        // also has a UI subscriber, so it should survive with only the
+        // transaction subscription removed
+        [pubId]: {
+          id: pubId,
+          subscriptions: ['txnRevert', 'sub-ui'],
+          local: {...exampleDoc, _id: pubId, foo: 'pub', _rev: 'revPub'},
+          remote: {...exampleDoc, _id: pubId, foo: 'pub', _rev: 'revPub'},
+        },
+      },
+    }
+    const newState = revertOutgoingTransaction(state)
+    expect(newState.outgoing).toBeUndefined()
+    // no subscribers remain, so the document state is evicted entirely
+    expect(newState.documentStates[draftId]).toBeUndefined()
+    // the UI subscription keeps the other document alive, but the reverted
+    // transaction id is gone from its subscriptions
+    expect(newState.documentStates[pubId]?.subscriptions).toEqual(['sub-ui'])
+  })
 })
 
 describe('applyRemoteDocument', () => {
@@ -1124,6 +1178,85 @@ describe('applyRemoteDocument', () => {
     })
   })
 
+  describe('rebase over multi-byte text', () => {
+    it('does not kill the pipeline when a plain edit rebases onto multi-byte text', () => {
+      // The reported production failure: a byte-offset throw from
+      // `@sanity/diff-match-patch` is a plain `Error`, and `createMutationApplier`
+      // only converts to `ActionError` when `preserveOperations` is set. So for an
+      // ordinary `editDocument` it escapes this rebase loop, reaches the rxjs
+      // subscription, and the outgoing-actions pipeline for the whole instance
+      // dies. Every later write is then dropped silently, for every document.
+      const docId = getDraftId(DocumentId('doc1'))
+      const originalDoc: SanityDocument = {
+        ...exampleDoc,
+        _id: docId,
+        _rev: 'rev1',
+        title: 'abcdefg\u00f8',
+      }
+      const locallyEditedDoc: SanityDocument = {
+        ...originalDoc,
+        title: 'abcdefg\u00f8!',
+        _rev: 'txnLocal',
+      }
+
+      const appliedTransaction: AppliedTransaction = {
+        transactionId: 'txnLocal',
+        actions: [
+          {
+            type: 'document.edit',
+            documentId: 'doc1',
+            documentType: 'author',
+            patches: [{diffMatchPatch: {title: '@@ -9,1 +9,2 @@\n \u00f8\n+!\n'}}],
+          },
+        ],
+        previous: {[docId]: originalDoc},
+        base: {[docId]: originalDoc},
+        working: {[docId]: locallyEditedDoc},
+        previousRevs: {[docId]: 'rev1'},
+        timestamp: '2025-02-06T00:16:00.000Z',
+        outgoingActions: [],
+        outgoingMutations: [],
+      }
+
+      const initialState: SyncTransactionState = {
+        queued: [],
+        applied: [appliedTransaction],
+        outgoing: undefined,
+        grants,
+        documentStates: {
+          [docId]: {
+            id: docId,
+            subscriptions: ['sub1'],
+            local: locallyEditedDoc,
+            remote: originalDoc,
+            unverifiedRevisions: {},
+          },
+        },
+      }
+
+      // someone else changed the same field, so the local patch is rebased onto
+      // a base its byte offsets were not computed against
+      const remoteDoc: SanityDocument = {
+        ...originalDoc,
+        title: '\u00f8\u00f8\u00f8\u00f8\u00f8\u00f8',
+        _rev: 'txnForeign',
+      }
+      const remote: RemoteDocument = {
+        type: 'mutation',
+        documentId: docId,
+        document: remoteDoc,
+        revision: 'txnForeign',
+        previousRev: 'rev1',
+        timestamp: '2025-02-06T00:17:00.000Z',
+        mutations: [{patch: {id: docId, set: {title: '\u00f8\u00f8\u00f8\u00f8\u00f8\u00f8'}}}],
+      }
+
+      const events = new Subject<DocumentEvent>()
+
+      expect(() => applyRemoteDocument(initialState, remote, events)).not.toThrow()
+    })
+  })
+
   describe('rebase with preserved operations', () => {
     it('skips a preserved-operations transaction that fails to re-apply and emits rebase-error', () => {
       const docId = getDraftId(DocumentId('doc1'))

package/src/document/reducers.ts

@@ -406,8 +406,23 @@ export function cleanupOutgoingTransaction(prev: SyncTransactionState): SyncTran
 
 export function revertOutgoingTransaction(prev: SyncTransactionState): SyncTransactionState {
   if (!prev.grants) return prev
+
+  // unregister the reverted batch's transaction-held subscriptions, symmetric
+  // with `cleanupOutgoingTransaction` on ack and `removeQueuedTransaction` on
+  // apply failure. without this, a reverted document's subscription IDs are
+  // never released and it can never be evicted
+  let base = prev
+  if (prev.outgoing) {
+    const ids = getDocumentIdsFromHandleLikes(prev.outgoing.actions)
+    for (const transactionId of prev.outgoing.batchedTransactionIds) {
+      for (const documentId of ids) {
+        base = removeSubscriptionIdFromDocument(base, documentId, transactionId)
+      }
+    }
+  }
+
   let working = Object.fromEntries(
-    Object.entries(prev.documentStates).map(([documentId, documentState]) => [
+    Object.entries(base.documentStates).map(([documentId, documentState]) => [
       documentId,
       documentState?.remote,
     ]),
@@ -428,11 +443,11 @@ export function revertOutgoingTransaction(prev: SyncTransactionState): SyncTrans
   }
 
   return {
-    ...prev,
+    ...base,
     applied: nextApplied,
     outgoing: undefined,
     documentStates: Object.fromEntries(
-      Object.entries(prev.documentStates)
+      Object.entries(base.documentStates)
         .filter((e): e is [string, DocumentState] => !!e[1])
         .map(([documentId, {unverifiedRevisions = {}, local, ...documentState}]) => {
           const next: DocumentState = {

package/src/projection/projectionStore.test.ts

@@ -6,14 +6,6 @@ import {createStoreInstance} from '../store/createStoreInstance'
 import {projectionStore} from './projectionStore'
 import {subscribeToStateAndFetchBatches} from './subscribeToStateAndFetchBatches'
 
-// Mock the module with a factory function
-vi.mock('../common/createLiveEventSubscriber', () => {
-  const mockLiveSubscriber = vi.fn()
-  return {
-    createLiveEventSubscriber: vi.fn(() => mockLiveSubscriber),
-  }
-})
-
 vi.mock('./subscribeToStateAndFetchBatches')
 
 describe('projectionStore', () => {