@spooky-sync/core 0.0.1-canary.217 → 0.0.1-canary.218

package/dist/index.d.ts

@@ -57,8 +57,37 @@ declare class RemoteDatabaseService extends AbstractDatabaseService {
    * racing two sockets. Cleared on settle, so a later call always reconnects.
    */
   private connecting;
+  /**
+   * The token to re-authenticate a freshly opened socket with, kept current by
+   * {@link setAuthToken}.
+   *
+   * `config.token` is fixed at construction and most apps never set it: they
+   * sign in later, which authenticates the socket that happens to be open at
+   * the time. That is enough for the SDK's OWN reconnects (it replays
+   * `version`/`use`/`authenticate` itself), but not for the supervisor's revive
+   * loop, which builds a socket from scratch. Without this the revived socket
+   * came back UNAUTHENTICATED and stayed that way for the life of the page,
+   * while the client's `currentUserId` — restored from local storage — kept
+   * reporting the user as signed in.
+   *
+   * The visible damage is silent and total: `fn::query::register` sends
+   * `<string>($auth.id OR '')`, so every view registered afterwards is stamped
+   * with an empty identity, and every `$auth.id` predicate in it resolves
+   * false. Public tables keep returning rows while everything owned by the user
+   * returns nothing, on a page that still looks signed in.
+   */
+  private authToken;
   constructor(config: Sp00kyConfig<any>['database'], logger: Logger$1);
   getConfig(): Sp00kyConfig<any>['database'];
+  /**
+   * Record the token every future connect should authenticate with, or `null`
+   * on sign-out. See {@link authToken}.
+   *
+   * Does not touch the CURRENT socket: callers authenticate that themselves
+   * (sign-in and session restore both already do). This only makes the next
+   * from-scratch connect reproduce that state.
+   */
+  setAuthToken(token: string | null): void;
   /** Resolved reconnect tunables; the supervisor reads its own knobs here. */
   getReconnectConfig(): Required<ReconnectConfig>;
   /** Current transport state as reported by the SDK. */

package/dist/index.js

@@ -1004,6 +1004,26 @@ var RemoteDatabaseService = class extends AbstractDatabaseService {
 	* racing two sockets. Cleared on settle, so a later call always reconnects.
 	*/
 	connecting = null;
+	/**
+	* The token to re-authenticate a freshly opened socket with, kept current by
+	* {@link setAuthToken}.
+	*
+	* `config.token` is fixed at construction and most apps never set it: they
+	* sign in later, which authenticates the socket that happens to be open at
+	* the time. That is enough for the SDK's OWN reconnects (it replays
+	* `version`/`use`/`authenticate` itself), but not for the supervisor's revive
+	* loop, which builds a socket from scratch. Without this the revived socket
+	* came back UNAUTHENTICATED and stayed that way for the life of the page,
+	* while the client's `currentUserId` — restored from local storage — kept
+	* reporting the user as signed in.
+	*
+	* The visible damage is silent and total: `fn::query::register` sends
+	* `<string>($auth.id OR '')`, so every view registered afterwards is stamped
+	* with an empty identity, and every `$auth.id` predicate in it resolves
+	* false. Public tables keep returning rows while everything owned by the user
+	* returns nothing, on a page that still looks signed in.
+	*/
+	authToken = null;
 	constructor(config, logger) {
 		const events = createDatabaseEventSystem();
 		super(new Surreal({ engines: applyDiagnostics(createRemoteEngines(), ({ key, type, phase, ...other }) => {
@@ -1023,6 +1043,17 @@ var RemoteDatabaseService = class extends AbstractDatabaseService {
 	getConfig() {
 		return this.config;
 	}
+	/**
+	* Record the token every future connect should authenticate with, or `null`
+	* on sign-out. See {@link authToken}.
+	*
+	* Does not touch the CURRENT socket: callers authenticate that themselves
+	* (sign-in and session restore both already do). This only makes the next
+	* from-scratch connect reproduce that state.
+	*/
+	setAuthToken(token) {
+		this.authToken = token;
+	}
 	/** Resolved reconnect tunables; the supervisor reads its own knobs here. */
 	getReconnectConfig() {
 		return this.reconnectConfig;
@@ -1069,7 +1100,8 @@ var RemoteDatabaseService = class extends AbstractDatabaseService {
 		return this.connecting;
 	}
 	async doConnect() {
-		const { endpoint, token, namespace, database } = this.getConfig();
+		const { endpoint, namespace, database } = this.getConfig();
+		const token = this.authToken ?? this.getConfig().token;
 		if (endpoint) {
 			this.logger.info({
 				endpoint,
@@ -7632,8 +7664,8 @@ function selfAllowlistedVariant(flag, userId) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.217";
-const WASM_VERSION = "0.0.1-canary.217";
+const CORE_VERSION = "0.0.1-canary.218";
+const WASM_VERSION = "0.0.1-canary.218";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class DevToolsService {
 	eventsHistory = [];
@@ -8254,6 +8286,7 @@ var AuthService = class {
 		const { access, userId } = decodeTokenClaims(token);
 		if (!userId) return null;
 		this.token = token;
+		this.remote.setAuthToken(token);
 		this.currentUser = { id: userId };
 		this.isAuthenticated = true;
 		this.access = access ?? this.defaultAccessName();
@@ -8278,6 +8311,7 @@ var AuthService = class {
 				this.notifyListeners();
 				return;
 			}
+			this.remote.setAuthToken(token);
 			await this.remote.getClient().authenticate(token);
 			const result = await this.remote.query("SELECT * FROM ONLY $auth.id");
 			const items = Array.isArray(result) && Array.isArray(result[0]) ? result[0] : result;
@@ -8326,6 +8360,7 @@ var AuthService = class {
 	*/
 	async signOut() {
 		this.token = null;
+		this.remote.setAuthToken(null);
 		this.currentUser = null;
 		this.isAuthenticated = false;
 		this.access = null;
@@ -8337,6 +8372,7 @@ var AuthService = class {
 	}
 	async setSession(token, user) {
 		this.token = token;
+		this.remote.setAuthToken(token);
 		this.currentUser = user;
 		this.isAuthenticated = true;
 		this.access = decodeAccessFromToken(token) ?? this.defaultAccessName();
@@ -12644,7 +12680,7 @@ var Sp00kyClient = class {
 		return new TabsCoordinator({
 			tabId,
 			fingerprint: computeTabsFingerprint({
-				coreVersion: "0.0.1-canary.217",
+				coreVersion: "0.0.1-canary.218",
 				schemaHash: hash53(this.config.schemaSurql),
 				endpoint: this.config.database.endpoint ?? "",
 				namespace: this.config.database.namespace,
@@ -13055,6 +13091,7 @@ var Sp00kyClient = class {
 		return this.appReleases.release(app, options);
 	}
 	authenticate(token) {
+		this.remote.setAuthToken(token);
 		return this.remote.getClient().authenticate(token);
 	}
 	/**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.217",
+  "version": "0.0.1-canary.218",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -60,8 +60,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.217",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.217",
+    "@spooky-sync/query-builder": "0.0.1-canary.218",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.218",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.0.3",
     "blurhash": "^2.0.5",

package/src/modules/auth/auth.local-first.test.ts

@@ -22,7 +22,11 @@ function makeAuth(opts: { token?: string | null; query?: any; authenticate?: any
   } as any;
   const remote = {
     query: opts.query ?? vi.fn(async () => [[]]),
-    getClient: () => ({ authenticate: opts.authenticate ?? vi.fn(async () => undefined) }),
+    setAuthToken: vi.fn(),
+    getClient: () => ({
+      authenticate: opts.authenticate ?? vi.fn(async () => undefined),
+      invalidate: vi.fn(async () => undefined),
+    }),
   } as any;
   return { auth: new AuthService({} as any, remote, persistence, silentLogger()), remote, persistence, store };
 }
@@ -99,3 +103,39 @@ describe('check() error handling', () => {
     expect(store.get('sp00ky_auth_token')).toBeUndefined();
   });
 });
+
+// The transport authenticates a NEW socket from the token it was handed, not
+// from the one the app passed at construction (most apps pass none and sign in
+// later). If sign-in never reaches it, the supervisor's revive loop rebuilds a
+// socket that comes back anonymous and stays that way for the life of the page,
+// while `currentUser` — restored from local storage — keeps the UI signed in.
+// Every view registered after that carries `auth_id = ''`, so `$auth.id`
+// predicates resolve false and the user's own rows silently vanish.
+describe('auth token reaches the transport', () => {
+  it('hands the token to the transport when restoring from cache', async () => {
+    const token = jwt({ AC: 'account', ID: 'user:abc' });
+    const { auth, remote } = makeAuth({ token });
+
+    await auth.restoreSessionFromToken();
+
+    expect(remote.setAuthToken).toHaveBeenCalledWith(token);
+  });
+
+  it('hands the token to the transport on check()', async () => {
+    const token = jwt({ AC: 'account', ID: 'user:abc' });
+    const { auth, remote } = makeAuth({ token });
+
+    await auth.check();
+
+    expect(remote.setAuthToken).toHaveBeenCalledWith(token);
+  });
+
+  it('clears it on sign-out so a revived socket does not come back as the old user', async () => {
+    const { auth, remote } = makeAuth({ token: jwt({ AC: 'account', ID: 'user:abc' }) });
+    await auth.restoreSessionFromToken();
+
+    await auth.signOut();
+
+    expect(remote.setAuthToken).toHaveBeenLastCalledWith(null);
+  });
+});

package/src/modules/auth/index.ts

@@ -153,6 +153,11 @@ export class AuthService<S extends SchemaStructure> {
     if (!userId) return null;
 
     this.token = token;
+    // Hand it to the transport too, so a socket rebuilt from scratch later
+    // (the supervisor's revive loop) comes back authenticated. Without this the
+    // page kept reporting this user while its session was anonymous, and every
+    // view registered afterwards was stamped with an empty identity.
+    this.remote.setAuthToken(token);
     // Only the id: the full row is not in the token. It lands from the local
     // cache when the app's own `user` query paints, and is replaced wholesale
     // by `check()` once the server answers.
@@ -187,7 +192,10 @@ export class AuthService<S extends SchemaStructure> {
         return;
       }
 
-      // Authenticate with the token
+      // Authenticate with the token, and record it for future connects so a
+      // socket rebuilt from scratch reproduces this identity (see
+      // `RemoteDatabaseService.setAuthToken`).
+      this.remote.setAuthToken(token);
       await this.remote.getClient().authenticate(token);
 
       // Verify the session by fetching the full user record using $auth.id
@@ -259,6 +267,7 @@ export class AuthService<S extends SchemaStructure> {
    */
   async signOut() {
     this.token = null;
+    this.remote.setAuthToken(null);
     this.currentUser = null;
     this.isAuthenticated = false;
     this.access = null;
@@ -276,6 +285,7 @@ export class AuthService<S extends SchemaStructure> {
 
   private async setSession(token: string, user: any) {
     this.token = token;
+    this.remote.setAuthToken(token);
     this.currentUser = user;
     this.isAuthenticated = true;
     // Resolve the access-method name (e.g. "account") for in-browser SSP

package/src/services/database/remote.ts

@@ -40,6 +40,26 @@ export class RemoteDatabaseService extends AbstractDatabaseService {
    * racing two sockets. Cleared on settle, so a later call always reconnects.
    */
   private connecting: Promise<void> | null = null;
+  /**
+   * The token to re-authenticate a freshly opened socket with, kept current by
+   * {@link setAuthToken}.
+   *
+   * `config.token` is fixed at construction and most apps never set it: they
+   * sign in later, which authenticates the socket that happens to be open at
+   * the time. That is enough for the SDK's OWN reconnects (it replays
+   * `version`/`use`/`authenticate` itself), but not for the supervisor's revive
+   * loop, which builds a socket from scratch. Without this the revived socket
+   * came back UNAUTHENTICATED and stayed that way for the life of the page,
+   * while the client's `currentUserId` — restored from local storage — kept
+   * reporting the user as signed in.
+   *
+   * The visible damage is silent and total: `fn::query::register` sends
+   * `<string>($auth.id OR '')`, so every view registered afterwards is stamped
+   * with an empty identity, and every `$auth.id` predicate in it resolves
+   * false. Public tables keep returning rows while everything owned by the user
+   * returns nothing, on a page that still looks signed in.
+   */
+  private authToken: string | null = null;
 
   constructor(config: Sp00kyConfig<any>['database'], logger: Logger) {
     const events = createDatabaseEventSystem();
@@ -76,6 +96,18 @@ export class RemoteDatabaseService extends AbstractDatabaseService {
     return this.config;
   }
 
+  /**
+   * Record the token every future connect should authenticate with, or `null`
+   * on sign-out. See {@link authToken}.
+   *
+   * Does not touch the CURRENT socket: callers authenticate that themselves
+   * (sign-in and session restore both already do). This only makes the next
+   * from-scratch connect reproduce that state.
+   */
+  setAuthToken(token: string | null): void {
+    this.authToken = token;
+  }
+
   /** Resolved reconnect tunables; the supervisor reads its own knobs here. */
   getReconnectConfig(): Required<ReconnectConfig> {
     return this.reconnectConfig;
@@ -130,7 +162,10 @@ export class RemoteDatabaseService extends AbstractDatabaseService {
   }
 
   private async doConnect(): Promise<void> {
-    const { endpoint, token, namespace, database } = this.getConfig();
+    const { endpoint, namespace, database } = this.getConfig();
+    // The live token wins over the constructor-time one: this connect may be
+    // the supervisor rebuilding a socket long after sign-in. See `authToken`.
+    const token = this.authToken ?? this.getConfig().token;
     if (endpoint) {
       this.logger.info(
         {

package/src/sp00ky.ts

@@ -1304,6 +1304,10 @@ export class Sp00kyClient<S extends SchemaStructure> {
   }
 
   authenticate(token: string) {
+    // Record it before authenticating, so a socket the supervisor rebuilds
+    // later comes back as this identity rather than anonymous. See
+    // `RemoteDatabaseService.setAuthToken`.
+    this.remote.setAuthToken(token);
     return this.remote.getClient().authenticate(token);
   }