@spacelr/sdk 0.9.2 → 0.10.0

package/dist/index.mjs

@@ -614,6 +614,57 @@ var PERMANENT_STREAM_ACK_ERRORS = /* @__PURE__ */ new Set([
   "Not a member of this project",
   "Subscribe denied"
 ]);
+function isWhereScalar(value) {
+  const t = typeof value;
+  return t === "string" || t === "number" || t === "boolean";
+}
+function isWhereOperator(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const keys = Object.keys(value);
+  if (keys.length !== 1) return false;
+  const op = keys[0];
+  if (op !== "in" && op !== "array-contains-any") return false;
+  const candidates = value[op];
+  return Array.isArray(candidates) && candidates.every(isWhereScalar);
+}
+var WHERE_PATH_ABSENT = /* @__PURE__ */ Symbol("where-path-absent");
+var WHERE_PATH_UNRESOLVABLE = /* @__PURE__ */ Symbol("where-path-unresolvable");
+var RESERVED_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var MAX_WHERE_PATH_SEGMENTS = 16;
+function resolveWherePath(document2, key) {
+  const segments = key.split(".");
+  if (segments.length > MAX_WHERE_PATH_SEGMENTS) return WHERE_PATH_ABSENT;
+  let cur = document2;
+  for (const segment of segments) {
+    if (RESERVED_PATH_SEGMENTS.has(segment)) return WHERE_PATH_ABSENT;
+    if (cur === null || cur === void 0) return WHERE_PATH_ABSENT;
+    if (Array.isArray(cur)) return WHERE_PATH_UNRESOLVABLE;
+    if (typeof cur !== "object") return WHERE_PATH_ABSENT;
+    if (!Object.prototype.hasOwnProperty.call(cur, segment)) {
+      return WHERE_PATH_ABSENT;
+    }
+    cur = cur[segment];
+  }
+  return cur === void 0 ? WHERE_PATH_ABSENT : cur;
+}
+function whereValueMatches(actual, expected) {
+  if (actual === WHERE_PATH_ABSENT || actual === WHERE_PATH_UNRESOLVABLE) {
+    return false;
+  }
+  if (isWhereOperator(expected)) {
+    if ("in" in expected) {
+      if (Array.isArray(actual)) return false;
+      return expected.in.includes(actual);
+    }
+    if (!Array.isArray(actual)) return false;
+    const candidates = expected["array-contains-any"];
+    return actual.some((el) => candidates.includes(el));
+  }
+  if (Array.isArray(actual)) return actual.includes(expected);
+  return actual === expected;
+}
 var RealtimeClient = class {
   constructor(config) {
     this.socket = null;
@@ -1002,12 +1053,7 @@ var RealtimeClient = class {
     if (!where) return false;
     if (!event.document) return false;
     for (const [key, value] of Object.entries(where)) {
-      const docValue = event.document[key];
-      if (Array.isArray(docValue)) {
-        if (!docValue.includes(value)) {
-          return false;
-        }
-      } else if (docValue !== value) {
+      if (!whereValueMatches(resolveWherePath(event.document, key), value)) {
         return false;
       }
     }
@@ -2968,10 +3014,14 @@ var FunctionsModule = class {
    * `config.apiUrl` (which already carries the `/api/v1` prefix).
    *
    * Auth defaults, based on `invokeMode` semantics:
-   *  - webhook:       pass `secret` → Authorization is NOT attached
-   *  - authenticated: pass nothing  → Authorization IS attached (from token manager)
-   *  - public:        pass nothing  → Authorization is attached if logged in, else omitted
-   *  - hybrid:        pass both `secret` and `authenticated: true`
+   *  - webhook:                 pass `secret` → Authorization is NOT attached
+   *  - authenticated:           pass nothing  → Authorization IS attached (from token manager);
+   *                             caller must be a member of the target project
+   *  - public:                  pass nothing  → Authorization is attached if logged in, else omitted
+   *  - hybrid:                  pass both `secret` and `authenticated: true`; JWT path
+   *                             requires project membership like `authenticated`
+   *  - platform-authenticated:  pass nothing  → Authorization IS attached (from token manager);
+   *                             any signed-in user is accepted, still just attaches the bearer token
    *
    * To force a specific behaviour, set `authenticated` explicitly — it wins
    * over the `secret`-based default.