@sanity/sdk 2.20.1 → 2.21.0

package/src/document/reducers.test.ts

@@ -4,6 +4,7 @@ import {parse} from 'groq-js'
 import {Subject} from 'rxjs'
 import {describe, expect, it} from 'vitest'
 
+import {UNVERIFIED_REVISION_RETENTION_TIME} from './documentConstants'
 import {type DocumentEvent} from './events'
 import {type RemoteDocument} from './listen'
 import {type DocumentSet} from './processMutations'
@@ -556,6 +557,118 @@ describe('cleanupOutgoingTransaction', () => {
   })
 })
 
+describe('document state retention between ack and echo', () => {
+  const docId = 'doc1'
+  const justNow = new Date().toISOString()
+  const longAgo = new Date(Date.now() - UNVERIFIED_REVISION_RETENTION_TIME - 1000).toISOString()
+
+  const outgoing: NonNullable<SyncTransactionState['outgoing']> = {
+    transactionId: 'txnOut',
+    actions: [
+      {
+        type: 'document.edit',
+        documentId: docId,
+        documentType: 'book',
+        liveEdit: true,
+        patches: [{set: {foo: 'changed'}}],
+      },
+    ],
+    disableBatching: false,
+    batchedTransactionIds: ['txnOut'],
+    outgoingActions: [],
+    outgoingMutations: [],
+    base: {},
+    working: {},
+    previous: {},
+    previousRevs: {},
+    timestamp: justNow,
+  }
+
+  const unverifiedRevision = (timestamp: string) => ({
+    txnOut: {transactionId: 'txnOut', documentId: docId, previousRev: 'txn0', timestamp},
+  })
+
+  const stateAfterAck = (timestamp: string): SyncTransactionState => ({
+    queued: [],
+    applied: [],
+    outgoing,
+    grants,
+    documentStates: {
+      [docId]: {
+        id: docId,
+        // the UI unsubscribed before the ack arrived, so the transaction's
+        // own subscription id is the only one left
+        subscriptions: ['txnOut'],
+        local: {...exampleDoc, _id: docId, foo: 'changed'},
+        remote: {...exampleDoc, _id: docId, foo: 'old'},
+        unverifiedRevisions: unverifiedRevision(timestamp),
+        recentOwnTransactionIds: ['txnOut'],
+      },
+    },
+  })
+
+  it('keeps echo-recognition memory alive through cleanup so a late echo still labels "local"', () => {
+    // the HTTP ack arrives and cleans up the outgoing transaction's
+    // subscription. previously this deleted the whole DocumentState
+    // immediately, before the listener echo had a chance to arrive
+    const afterCleanup = cleanupOutgoingTransaction(stateAfterAck(justNow))
+    expect(afterCleanup.outgoing).toBeUndefined()
+
+    const docStateAfterCleanup = afterCleanup.documentStates[docId]
+    expect(docStateAfterCleanup).toBeDefined()
+    expect(docStateAfterCleanup?.subscriptions).toEqual([])
+    expect(docStateAfterCleanup?.unverifiedRevisions?.['txnOut']).toBeDefined()
+
+    // now the echo finally arrives over the shared listener
+    const events = new Subject<DocumentEvent>()
+    const received: DocumentEvent[] = []
+    events.subscribe((e) => received.push(e))
+
+    const echo: RemoteDocument = {
+      type: 'mutation',
+      documentId: docId,
+      document: {...exampleDoc, _id: docId, foo: 'changed'},
+      revision: 'txnOut',
+      previousRev: 'txn0',
+      timestamp: new Date().toISOString(),
+      mutations: [{patch: {id: docId, set: {foo: 'changed'}}}],
+    }
+
+    const afterEcho = applyRemoteDocument(afterCleanup, echo, events)
+
+    const remotePatchesEvents = received.filter((e) => e.type === 'remote-patches')
+    expect(remotePatchesEvents).toHaveLength(1)
+    expect(remotePatchesEvents[0]).toMatchObject({origin: 'local', transactionId: 'txnOut'})
+
+    // the echo verified the revision and nothing was subscribed any more, so
+    // the now fully-idle document state can finally be evicted
+    expect(afterEcho.documentStates[docId]).toBeUndefined()
+  })
+
+  it('stops waiting for an echo that is older than the retention time', () => {
+    // an accepted transaction whose operations all no-op server-side never
+    // produces an echo, so the wait has to expire or the document (and its
+    // listener) would be pinned for the lifetime of the store
+    const afterCleanup = cleanupOutgoingTransaction(stateAfterAck(longAgo))
+    expect(afterCleanup.documentStates[docId]).toBeUndefined()
+  })
+
+  it('does not extend the wait on `recentOwnTransactionIds` alone', () => {
+    const state = stateAfterAck(justNow)
+    const documentState = state.documentStates[docId]!
+    const withoutUnverifiedRevisions: SyncTransactionState = {
+      ...state,
+      documentStates: {
+        [docId]: {...documentState, unverifiedRevisions: {}, recentOwnTransactionIds: ['txnOut']},
+      },
+    }
+
+    expect(
+      cleanupOutgoingTransaction(withoutUnverifiedRevisions).documentStates[docId],
+    ).toBeUndefined()
+  })
+})
+
 describe('revertOutgoingTransaction', () => {
   it('reverts the outgoing transaction and updates documentStates by removing unverified revisions', () => {
     const draftId = getDraftId(DocumentId('doc1'))
@@ -686,6 +799,117 @@ describe('revertOutgoingTransaction', () => {
     // transaction id is gone from its subscriptions
     expect(newState.documentStates[pubId]?.subscriptions).toEqual(['sub-ui'])
   })
+
+  it('evicts a document left with no subscribers once its unverified revision is discarded', () => {
+    const docId = 'doc1'
+    const state: SyncTransactionState = {
+      queued: [],
+      applied: [],
+      outgoing: {
+        transactionId: 'txnOut',
+        actions: [
+          {
+            type: 'document.edit',
+            documentId: docId,
+            documentType: 'book',
+            liveEdit: true,
+            patches: [{set: {foo: 'changed'}}],
+          },
+        ],
+        disableBatching: false,
+        batchedTransactionIds: ['txnOut'],
+        outgoingActions: [],
+        outgoingMutations: [],
+        base: {},
+        working: {},
+        previous: {},
+        previousRevs: {},
+        timestamp: new Date().toISOString(),
+      },
+      grants,
+      documentStates: {
+        // the reverted transaction was this document's last subscriber, so the
+        // revision discarded below is the only thing keeping it around
+        [docId]: {
+          id: docId,
+          subscriptions: [],
+          local: {...exampleDoc, _id: docId, foo: 'changed'},
+          remote: {...exampleDoc, _id: docId, foo: 'old'},
+          unverifiedRevisions: {
+            txnOut: {
+              transactionId: 'txnOut',
+              documentId: docId,
+              previousRev: 'txn0',
+              timestamp: new Date().toISOString(),
+            },
+          },
+        },
+      },
+    }
+
+    expect(revertOutgoingTransaction(state).documentStates[docId]).toBeUndefined()
+  })
+
+  it('leaves `local` intact for a document still waiting on its own acked transaction', () => {
+    const revertedId = 'doc-reverted'
+    const retainedId = 'doc-retained'
+    const state: SyncTransactionState = {
+      queued: [],
+      applied: [],
+      outgoing: {
+        transactionId: 'txnOut',
+        actions: [
+          {
+            type: 'document.edit',
+            documentId: revertedId,
+            documentType: 'book',
+            liveEdit: true,
+            patches: [{set: {foo: 'changed'}}],
+          },
+        ],
+        disableBatching: false,
+        batchedTransactionIds: ['txnOut'],
+        outgoingActions: [],
+        outgoingMutations: [],
+        base: {},
+        working: {},
+        previous: {},
+        previousRevs: {},
+        timestamp: new Date().toISOString(),
+      },
+      grants,
+      documentStates: {
+        [revertedId]: {
+          id: revertedId,
+          subscriptions: ['txnOut'],
+          local: {...exampleDoc, _id: revertedId, foo: 'changed'},
+          remote: {...exampleDoc, _id: revertedId, foo: 'old'},
+        },
+        // unrelated to the reverted batch: acked, unsubscribed, and still
+        // waiting on the echo that will settle its optimistic value
+        [retainedId]: {
+          id: retainedId,
+          subscriptions: [],
+          local: {...exampleDoc, _id: retainedId, foo: 'acked'},
+          remote: {...exampleDoc, _id: retainedId, foo: 'old'},
+          unverifiedRevisions: {
+            txnAcked: {
+              transactionId: 'txnAcked',
+              documentId: retainedId,
+              previousRev: 'txn0',
+              timestamp: new Date().toISOString(),
+            },
+          },
+        },
+      },
+    }
+
+    const newState = revertOutgoingTransaction(state)
+    // the reverted document's only subscriber was the batch itself, so
+    // unregistering it evicts the state
+    expect(newState.documentStates[revertedId]).toBeUndefined()
+    expect(newState.documentStates[retainedId]?.local).toMatchObject({foo: 'acked'})
+  })
 })
 
 describe('applyRemoteDocument', () => {

package/src/document/reducers.ts

@@ -8,7 +8,7 @@ import {insecureRandomId} from '../utils/ids'
 import {isDeepEqual, omitProperty} from '../utils/object'
 import {setCleanupTimeout} from '../utils/setCleanupTimeout'
 import {type Action} from './actions'
-import {DOCUMENT_STATE_CLEAR_DELAY} from './documentConstants'
+import {DOCUMENT_STATE_CLEAR_DELAY, UNVERIFIED_REVISION_RETENTION_TIME} from './documentConstants'
 import {type DocumentState, type DocumentStoreState} from './documentStore'
 import {type RemoteDocument} from './listen'
 import {ActionError, processActions} from './processActions/processActions'
@@ -401,7 +401,13 @@ export function cleanupOutgoingTransaction(prev: SyncTransactionState): SyncTran
     }
   }
 
-  return {...next, outgoing: undefined}
+  // every ack is also when a previously retained document's echo may have
+  // stopped being expected, so re-make that eviction decision here
+  return {
+    ...next,
+    outgoing: undefined,
+    documentStates: evictOrphanedDocumentStates(next.documentStates),
+  }
 }
 
 export function revertOutgoingTransaction(prev: SyncTransactionState): SyncTransactionState {
@@ -446,20 +452,38 @@ export function revertOutgoingTransaction(prev: SyncTransactionState): SyncTrans
     ...base,
     applied: nextApplied,
     outgoing: undefined,
-    documentStates: Object.fromEntries(
-      Object.entries(base.documentStates)
-        .filter((e): e is [string, DocumentState] => !!e[1])
-        .map(([documentId, {unverifiedRevisions = {}, local, ...documentState}]) => {
-          const next: DocumentState = {
-            ...documentState,
-            local: documentId in working ? working[documentId] : local,
-            unverifiedRevisions:
-              prev.outgoing && prev.outgoing.transactionId in unverifiedRevisions
-                ? omitProperty(unverifiedRevisions, prev.outgoing.transactionId)
-                : unverifiedRevisions,
-          }
-          return [documentId, next] as const
-        }),
+    // discarding the outgoing transaction drops its echo-recognition memory,
+    // which can leave a document that was only being kept alive for that echo
+    // with nothing left to wait for, so sweep afterwards
+    documentStates: evictOrphanedDocumentStates(
+      Object.fromEntries(
+        Object.entries(base.documentStates)
+          .filter((e): e is [string, DocumentState] => !!e[1])
+          .map(([documentId, documentState]) => {
+            const {unverifiedRevisions = {}} = documentState
+            const next: DocumentState = {
+              ...documentState,
+              unverifiedRevisions:
+                prev.outgoing && prev.outgoing.transactionId in unverifiedRevisions
+                  ? omitProperty(unverifiedRevisions, prev.outgoing.transactionId)
+                  : unverifiedRevisions,
+            }
+
+            // a document with no subscribers that is still waiting on the echo
+            // of a different, already acked transaction of its own is not
+            // represented in `working` (only `applied` transactions are
+            // re-applied above), so rebuilding its `local` from `remote` would
+            // drop that transaction's effect. leave it for the echo to resolve
+            if (!next.subscriptions.length && isAwaitingOwnEcho(next)) {
+              return [documentId, next] as const
+            }
+
+            return [
+              documentId,
+              {...next, local: documentId in working ? working[documentId] : next.local},
+            ] as const
+          }),
+      ),
     ),
   }
 }
@@ -579,7 +603,7 @@ export function applyRemoteDocument(
 
     return {
       ...prev,
-      documentStates: {
+      documentStates: evictOrphanedDocumentStates({
         ...prev.documentStates,
         [documentId]: {
           ...prevDocState,
@@ -588,7 +612,7 @@ export function applyRemoteDocument(
           local,
           unverifiedRevisions,
         },
-      },
+      }),
     }
   }
 
@@ -645,7 +669,7 @@ export function applyRemoteDocument(
   return {
     ...prev,
     applied: nextApplied,
-    documentStates: {
+    documentStates: evictOrphanedDocumentStates({
       ...prev.documentStates,
       [documentId]: {
         ...prevDocState,
@@ -654,7 +678,7 @@ export function applyRemoteDocument(
         local,
         unverifiedRevisions,
       },
-    },
+    }),
   }
 }
 
@@ -685,22 +709,81 @@ export function removeSubscriptionIdFromDocument(
   subscriptionId: string,
 ): SyncTransactionState {
   const prevDocState = prev.documentStates?.[documentId]
-  const prevSubscriptions = prevDocState?.subscriptions ?? []
-  const subscriptions = prevSubscriptions.filter((id) => id !== subscriptionId)
-
   if (!prevDocState) return prev
-  if (!subscriptions.length) {
+
+  const subscriptions = prevDocState.subscriptions.filter((id) => id !== subscriptionId)
+
+  // a document with no subscribers left is normally evicted below, but if a
+  // transaction was just submitted for it, its echo-recognition memory
+  // (`unverifiedRevisions`) is still waiting on the listener echo.
+  // `cleanupOutgoingTransaction` removes the outgoing transaction's own
+  // subscription right at HTTP ack, before the echo arrives, so deleting the
+  // state here would lose that memory and make the echo mislabel as
+  // `origin: 'remote'` (or, worse, get skipped outright). keep the state
+  // alive, unsubscribed, until the echo verifies or the wait expires
+  if (!subscriptions.length && !isAwaitingOwnEcho(prevDocState)) {
     return {...prev, documentStates: omitProperty(prev.documentStates, documentId)}
   }
+
   return {
     ...prev,
     documentStates: {
       ...prev.documentStates,
-      [documentId]: {...prevDocState, subscriptions: subscriptions},
+      [documentId]: {...prevDocState, subscriptions},
     },
   }
 }
 
+/**
+ * Whether this document still expects the listener echo of one of its own
+ * submitted transactions. That expectation is the only reason a document state
+ * with no subscribers is kept around.
+ *
+ * Revisions stop counting after `UNVERIFIED_REVISION_RETENTION_TIME` because an
+ * echo is not guaranteed to arrive at all: Content Lake records no transaction
+ * when every operation resolves to a no-op (e.g. a keyed path that no longer
+ * exists), while the client bumps `_rev` regardless and so tracks a revision
+ * for it. Without the expiry, such a document (and the listener keyed off its
+ * state) would be pinned for the lifetime of the store.
+ *
+ * `recentOwnTransactionIds` deliberately does not extend the wait: it is capped
+ * rather than drained, so honoring it would keep every edited document alive.
+ */
+function isAwaitingOwnEcho(documentState: DocumentState): boolean {
+  const expiresAfter = Date.now() - UNVERIFIED_REVISION_RETENTION_TIME
+  return Object.values(documentState.unverifiedRevisions ?? {}).some(
+    (revision) => !!revision && new Date(revision.timestamp).getTime() > expiresAfter,
+  )
+}
+
+/**
+ * Removes every document state that has no subscribers left and no own
+ * transaction still awaiting its echo.
+ *
+ * This is a sweep rather than a decision made where the last subscriber leaves
+ * because `removeSubscriptionIdFromDocument` defers that eviction while an echo
+ * is in flight, and both halves of the condition can change without a
+ * subscriber going anywhere: the echo can verify, be dropped by a sync, be
+ * discarded by a revert, or simply never arrive. Every reducer that can settle
+ * an in-flight transaction sweeps, so the deferred decision is always re-made.
+ *
+ * Note this can evict the very document whose remote event is being processed,
+ * which synchronously unsubscribes that document's listener from inside its own
+ * emission (see `subscribeToSubscriptionsAndListenToDocuments`).
+ */
+function evictOrphanedDocumentStates(
+  documentStates: SyncTransactionState['documentStates'],
+): SyncTransactionState['documentStates'] {
+  let next = documentStates
+  for (const [documentId, documentState] of Object.entries(documentStates)) {
+    if (!documentState) continue
+    if (documentState.subscriptions.length) continue
+    if (isAwaitingOwnEcho(documentState)) continue
+    next = omitProperty(next, documentId)
+  }
+  return next
+}
+
 export function manageSubscriberIds(
   {state}: StoreContext<SyncTransactionState>,
   handles: DocumentHandleLike[],

package/src/document/submissionErrors.test.ts

@@ -0,0 +1,63 @@
+import {ClientError, CorsOriginError, ServerError} from '@sanity/client'
+import {describe, expect, it} from 'vitest'
+
+import {classifySubmissionError} from './submissionErrors'
+
+const clientError = (statusCode: number, body: unknown = {}) =>
+  new ClientError({statusCode, headers: {}, body})
+
+describe('classifySubmissionError', () => {
+  it('retries an expired or missing session', () => {
+    expect(
+      classifySubmissionError(
+        clientError(401, {statusCode: 401, error: 'Unauthorized', message: 'Session not found'}),
+      ),
+    ).toBe('retry')
+  })
+
+  it('retries server errors, timeouts, rate limits and network failures', () => {
+    expect(classifySubmissionError(new ServerError({statusCode: 503, headers: {}, body: {}}))).toBe(
+      'retry',
+    )
+    expect(classifySubmissionError(clientError(408))).toBe('retry')
+    expect(classifySubmissionError(clientError(429))).toBe('retry')
+    expect(classifySubmissionError(new Error('Request error while attempting to reach'))).toBe(
+      'retry',
+    )
+    expect(classifySubmissionError('not an error')).toBe('retry')
+  })
+
+  it('retries a transaction that hit contention while committing', () => {
+    expect(
+      classifySubmissionError(
+        clientError(409, {
+          error: {type: 'transactionConflictError', description: 'transaction conflict'},
+        }),
+      ),
+    ).toBe('retry')
+  })
+
+  it('treats an already recorded transaction ID as an ack', () => {
+    expect(
+      classifySubmissionError(
+        clientError(409, {
+          error: {type: 'transactionAlreadyExistsError', description: 'already exists'},
+        }),
+      ),
+    ).toBe('accepted')
+  })
+
+  it('reverts transactions the server rejected', () => {
+    for (const statusCode of [400, 402, 403, 404, 410, 412, 413, 422]) {
+      expect(classifySubmissionError(clientError(statusCode))).toBe('revert')
+    }
+    expect(
+      classifySubmissionError(
+        clientError(409, {
+          error: {type: 'documentRevisionIDDoesNotMatchError', description: 'revision mismatch'},
+        }),
+      ),
+    ).toBe('revert')
+    expect(classifySubmissionError(new CorsOriginError({projectId: 'p'}))).toBe('revert')
+  })
+})

package/src/document/submissionErrors.ts

@@ -0,0 +1,51 @@
+import {ClientError, CorsOriginError} from '@sanity/client'
+
+/**
+ * What the document store does with an outgoing transaction whose submission
+ * failed.
+ *
+ * - `retry`: the failure is about the connection, the credentials or
+ *   contention on the server, not the transaction. Keep the transaction and
+ *   its optimistic local state, and submit it again.
+ * - `accepted`: the server already recorded this transaction ID, so an earlier
+ *   attempt was committed even though its response never arrived.
+ * - `revert`: the server rejected the transaction itself. Submitting it again
+ *   cannot succeed, so drop it and rebuild local state from the server copy.
+ *
+ * @internal
+ */
+export type SubmissionErrorClass = 'retry' | 'accepted' | 'revert'
+
+// Mirrors Studio's `TERMINAL_COMMIT_STATUSES` (checkoutPair.ts) without 401. A
+// 401 rejects the credentials (usually an expired session), not the
+// transaction, so the same transaction succeeds once the user re-authenticates.
+const REJECTED_TRANSACTION_STATUS_CODES = new Set([400, 402, 403, 404, 409, 410, 412, 413, 422])
+
+function getErrorType(error: ClientError): unknown {
+  const details: unknown = error.details
+  if (details && typeof details === 'object' && 'type' in details) return details.type
+  return undefined
+}
+
+/**
+ * Classifies a failed transaction submission. Unknown failures (network
+ * errors, timeouts, 5xx and 429 responses, and anything that is not a
+ * `ClientError`) default to `retry`: wrongly retrying a rejected transaction
+ * leaves the document visibly unsynced with the edits still on screen, while
+ * wrongly reverting a transient failure silently discards the user's work.
+ *
+ * @internal
+ */
+export function classifySubmissionError(error: unknown): SubmissionErrorClass {
+  if (error instanceof CorsOriginError) return 'revert'
+  if (!(error instanceof ClientError)) return 'retry'
+  if (error.statusCode === 409) {
+    const errorType = getErrorType(error)
+    if (errorType === 'transactionAlreadyExistsError') return 'accepted'
+    // contention while committing, not a verdict on the transaction; the
+    // server rolled it back, so the same transaction ID is safe to resend
+    if (errorType === 'transactionConflictError') return 'retry'
+  }
+  if (REJECTED_TRANSACTION_STATUS_CODES.has(error.statusCode)) return 'revert'
+  return 'retry'
+}