@sixb/core 0.1.20 → 0.1.21

package/src/events/execution.ts

@@ -1,6 +1,13 @@
 import { assertPrivileged, canViewEvent } from "../authorization"
 import { resolveRuntimeAuthorizationForProject } from "../execution/authorization"
-import { redactDomainEvent, resolvePropertyClearance } from "../objects/property-clearance"
+import {
+  type AuthorizedObjectReader,
+  readerClearance,
+  readerEventClearance,
+} from "../execution/authorized-object-reader"
+import type { EventSources } from "../execution/object-reader-clearance"
+import { redactDomainEvent } from "../objects/clearance-redaction"
+import type { PropertyClearance } from "../objects/property-clearance"
 import type { SixbRuntimeContext } from "../runtime/types"
 import type {
   EventsAppendInput,
@@ -11,12 +18,22 @@ import type {
 import type { StoredDomainEvent } from "./types"
 
 export interface EventsRuntime {
-  /** The event as this execution may read it: hidden events are `undefined`, others redacted. */
-  readable(event: StoredDomainEvent): StoredDomainEvent | undefined
+  /**
+   * The events this execution may read, in order: hidden events are dropped, the others redacted.
+   * Markings apply as they are now, with those of the versions an object event's values came from:
+   * the version a projection's event applied, and every marking a column declares for projected
+   * values that came from earlier versions.
+   */
+  visible(events: readonly StoredDomainEvent[]): Promise<readonly StoredDomainEvent[]>
   append(input: EventsAppendInput): Promise<readonly StoredDomainEvent[]>
   emit(input: EventsAppendInput, options: EventsEmitOptions): Promise<void>
   read(input?: EventsReadInput): Promise<readonly StoredDomainEvent[]>
   latestCursor(): Promise<string | undefined>
+  /**
+   * Deliver the events this execution may read as they are appended. A batch whose markings cannot
+   * be enforced, because the versions projections applied cannot be read, is dropped with a
+   * warning: read it again with `read({ afterCursor })`.
+   */
   subscribe(
     input: EventsSubscribeInput,
     handler: (events: readonly StoredDomainEvent[]) => unknown
@@ -25,27 +42,34 @@ export interface EventsRuntime {
 
 export function createEventsRuntime(runtime: SixbRuntimeContext): EventsRuntime {
   const authority = resolveRuntimeAuthorizationForProject(runtime)
-  const clearance =
-    authority.type === "principal"
-      ? resolvePropertyClearance(runtime.ontology, authority.context.clearances ?? new Set())
-      : undefined
-  const readable = (event: StoredDomainEvent): StoredDomainEvent | undefined => {
+  const visible = async (
+    events: readonly StoredDomainEvent[]
+  ): Promise<readonly StoredDomainEvent[]> => {
     switch (authority.type) {
       case "denied":
       case "delegated":
-        return undefined
-      case "principal":
-        if (!canViewEvent(authority.context, event)) return undefined
-        return clearance ? redactDomainEvent(event, clearance) : event
+        return []
       case "unrestricted":
-        return event
+        return events
+      case "principal": {
+        const viewable = events.filter((event) => canViewEvent(authority.context, event))
+        if (viewable.length === 0) return viewable
+
+        const clearance = await readerClearance(runtime.objectReader)
+        const clearanceFor = await eventClearances(runtime.objectReader, viewable, clearance)
+
+        return viewable.flatMap((event) => {
+          if (clearance && readsUnreadable(event, clearance)) return []
+
+          const redacting = clearanceFor(event)
+          return [redacting ? redactDomainEvent(event, redacting) : event]
+        })
+      }
     }
   }
-  const visibleEvents = (events: readonly StoredDomainEvent[]): readonly StoredDomainEvent[] =>
-    events.flatMap((event) => readable(event) ?? [])
 
   return {
-    readable,
+    visible,
     append: (input) => {
       assertPrivileged(runtime, "events.append")
       return runtime.events.append(input)
@@ -63,8 +87,7 @@ export function createEventsRuntime(runtime: SixbRuntimeContext): EventsRuntime
         case "unrestricted":
           break
       }
-      const events = await runtime.events.read(input)
-      return visibleEvents(events)
+      return visible(await runtime.events.read(input))
     },
     latestCursor: () => {
       switch (authority.type) {
@@ -85,10 +108,100 @@ export function createEventsRuntime(runtime: SixbRuntimeContext): EventsRuntime
         case "unrestricted":
           break
       }
-      return runtime.events.subscribe(input, (events) => {
-        const visible = visibleEvents(events)
-        if (visible.length > 0) return handler(visible)
+      return runtime.events.subscribe(input, async (events) => {
+        let shown: readonly StoredDomainEvent[]
+        try {
+          shown = await visible(events)
+        } catch (error) {
+          // Fail closed. Delivery is live and keeps no progress, and a handler error is not a
+          // negative acknowledgement, so the batch is dropped and reported rather than retried.
+          const message = error instanceof Error ? error.message : String(error)
+          console.warn(
+            `[Sixb] Dropped ${events.length} event(s) from cursor '${events[0]?.cursor}' of a subscription, whose markings could not be enforced: ${message}`
+          )
+          return
+        }
+
+        if (shown.length > 0) return handler(shown)
       })
     },
   }
 }
+
+/**
+ * The clearance each event is redacted with, resolved once per kind of event for the whole batch.
+ * An event that holds only values the current markings describe uses the reader's clearance.
+ */
+async function eventClearances(
+  reader: AuthorizedObjectReader,
+  events: readonly StoredDomainEvent[],
+  clearance: PropertyClearance | undefined
+): Promise<(event: StoredDomainEvent) => PropertyClearance | undefined> {
+  const kinds = new Map<string, EventSources>()
+  for (const event of events) {
+    const kind = eventSources(event)
+    if (kind) kinds.set(kind.key, kind.sources)
+  }
+
+  const resolved = await Promise.all(
+    [...kinds].map(
+      async ([key, sources]) => [key, await readerEventClearance(reader, sources)] as const
+    )
+  )
+  const byKind = new Map(resolved)
+
+  return (event) => {
+    const kind = eventSources(event)
+    return kind ? byKind.get(kind.key) : clearance
+  }
+}
+
+/**
+ * Where an object event's values came from, when the current markings do not describe them all.
+ *
+ * - A projection's event holds the values of the version it applied.
+ * - An update or a deletion also holds the values it replaced. An action's or a direct write's
+ *   record of an object holds the values projections had applied then. Both came from versions
+ *   applied before the event, which it does not name: they read like a version that cannot be read.
+ * - Only an object created by an action or a direct write holds nothing but its own values.
+ */
+function eventSources(
+  event: StoredDomainEvent
+): { readonly key: string; readonly sources: EventSources } | undefined {
+  if (event.topic !== "objects") return undefined
+
+  const objectTypeId = event.payload.objectTypeId
+  const earlier = event.type !== "object.created"
+
+  if (event.origin?.kind !== "projection") {
+    if (!earlier) return undefined
+    return { key: JSON.stringify([objectTypeId]), sources: { objectTypeId, earlier } }
+  }
+
+  const { projectionId, datasetId, datasetVersionId } = event.origin
+  const origin = { projectionId, datasetId, datasetVersionId, objectTypeId }
+  return {
+    key: JSON.stringify([objectTypeId, projectionId, datasetId, datasetVersionId, earlier]),
+    sources: { objectTypeId, origin, earlier },
+  }
+}
+
+/**
+ * Whether the event is about an object type or a link the reader cannot read: it reveals ids and
+ * keys, so it is not delivered, as for a type the reader has no view grant for.
+ */
+function readsUnreadable(event: StoredDomainEvent, clearance: PropertyClearance): boolean {
+  switch (event.topic) {
+    case "objects":
+    case "telemetry":
+      return clearance.unreadableType(event.payload.objectTypeId) !== undefined
+    case "links":
+      return (
+        clearance.unreadableType(event.payload.sourceTypeId) !== undefined ||
+        clearance.unreadableType(event.payload.targetTypeId) !== undefined ||
+        clearance.unreadableLink(event.payload.sourceTypeId, event.payload.linkId) !== undefined
+      )
+    default:
+      return false
+  }
+}