@spooky-sync/core 0.0.1-canary.304 → 0.0.1-canary.306

package/dist/index.js

@@ -2178,8 +2178,8 @@ function trimHistory(history, cap) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.304";
-const WASM_VERSION = "0.0.1-canary.304";
+const CORE_VERSION = "0.0.1-canary.306";
+const WASM_VERSION = "0.0.1-canary.306";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class DevToolsService {
 	version = CORE_VERSION;
@@ -6935,19 +6935,25 @@ function* rebindQueries() {
 //#region src/boot/auth-flip.saga.ts
 /**
 * The signed-in principal changed (sign-in, sign-out, boot verification).
-* Identity first (routing and `$auth` for the local SSP), then the bucket,
-* then the salt if the principal really changed, then the verified user row.
+* Identity first (routing and `$auth` for the local SSP), then the salt if
+* the principal really changed, then the bucket, then the verified user row.
+*
+* The salt goes before the bucket because the switch re-keys every active
+* query (`rebindQueries`) from the salt it finds. A query's remote id hashes
+* the salt but not the principal, so re-keyed under the old salt it named the
+* view the previous principal still held, and the SSP refused it as another
+* identity's (409 `auth_mismatch`) until that view's TTL ran out. On whitepawn
+* every impersonation start, stop and token lapse refused a tab's queries for
+* the 10 minutes of that TTL, each refusal a failed sync round, so the rail
+* read "Can't reach the server" the whole time.
 */
 function* authFlip(env, userId) {
 	const authId = yield fx.service("auth.sessionAuthId");
 	const access = yield fx.service("auth.access");
 	yield fx.state.update(setIdentity({ userId }));
 	yield fx.service("ssp.setSessionAuth", authId, access);
-	const target = bucketIdForUser(userId);
-	yield fx.service("hint.write", target);
-	yield fx.state.update(setIdentity({ pendingBucket: target }));
-	yield* bucketSwitch(env, target, (yield fx.service("local.currentBucketId")) === target ? null : yield fx.service("local.beginSwitch"));
-	if (authId !== (yield fx.state.read((s) => s.saltUserId))) {
+	const resalted = authId !== (yield fx.state.read((s) => s.saltUserId));
+	if (resalted) {
 		const salt = yield fx.id("salt");
 		yield fx.state.update(setIdentity({
 			sessionId: salt,
@@ -6955,6 +6961,15 @@ function* authFlip(env, userId) {
 		}));
 		yield fx.service("crdt.setSessionId", salt);
 	}
+	const target = bucketIdForUser(userId);
+	yield fx.service("hint.write", target);
+	yield fx.state.update(setIdentity({ pendingBucket: target }));
+	const current = yield fx.service("local.currentBucketId");
+	yield* bucketSwitch(env, target, current === target ? null : yield fx.service("local.beginSwitch"));
+	if (resalted && current === target) {
+		yield* rebindQueries();
+		yield fx.dispatch({ type: "EnsureRegistered" });
+	}
 	yield* persistVerifiedUser(env);
 }
 /**
@@ -14588,7 +14603,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.304",
+			coreVersion: "0.0.1-canary.306",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.304",
+  "version": "0.0.1-canary.306",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -75,8 +75,8 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.304",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.304",
+    "@spooky-sync/query-builder": "0.0.1-canary.306",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.306",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.0.3",
     "blurhash": "^2.0.5",

package/src/boot/auth-flip.saga.test.ts

@@ -6,11 +6,13 @@ import { buildEntry, buildState } from '../testing/build';
 import * as R from '../state/reducers';
 import { defaultEnv } from '../query/env';
 import { authFlip, persistVerifiedUser } from './auth-flip.saga';
+import { queryHashInput } from '../query/hash';
+import { sha256Hex } from '../utils/sha256';
 
 const env = defaultEnv({ tables: [{ name: 'user', columns: { id: {}, email_verified: {} } }] } as any);
 
 describe('authFlip', () => {
-  it('sets identity and $auth before the bucket work, writes the hint, switches, rotates the salt for a new principal, persists the user row', async () => {
+  it('sets identity and $auth, rotates the salt for a new principal before the bucket work, writes the hint, switches, persists the user row', async () => {
     const released: string[] = [];
     const svc = fakeServices({
       'auth.sessionAuthId': () => 'user:abc',
@@ -27,14 +29,65 @@ describe('authFlip', () => {
       handlers: { service: svc.handler, 'local.query': () => [], 'local.execute': () => undefined, 'ssp.ingest': () => undefined },
     });
     const names = svc.names();
-    expect(names.slice(0, 5)).toEqual(['auth.sessionAuthId', 'auth.access', 'ssp.setSessionAuth', 'hint.write', 'local.currentBucketId']);
-    expect(svc.calls[3]).toEqual(['hint.write', ['abc']]);
+    expect(names.slice(0, 6)).toEqual(['auth.sessionAuthId', 'auth.access', 'ssp.setSessionAuth', 'crdt.setSessionId', 'hint.write', 'local.currentBucketId']);
+    expect(svc.calls[3]).toEqual(['crdt.setSessionId', ['salt-1']]);
+    expect(svc.calls[4]).toEqual(['hint.write', ['abc']]);
     expect(names).toContain('local.switchStore');
-    expect(names).toContain('crdt.setSessionId');
     expect(released).toEqual(['gate']);
     expect(out.state).toMatchObject({ userId: 'user:abc', saltUserId: 'user:abc', sessionId: 'salt-1', bucketId: 'abc' });
     expect(out.state.versions.get('user:abc')).toBe(1);
   });
+  it("re-keys active queries under the new principal's salt, so no remote id names the previous principal's view", async () => {
+    const svc = fakeServices({
+      'auth.sessionAuthId': () => 'user:target',
+      'auth.access': () => 'account',
+      'local.currentBucketId': () => 'admin',
+      'local.beginSwitch': () => () => undefined,
+      'local.usesSurqlSchema': () => false,
+      'auth.token': () => 'jwt',
+      'auth.currentUser': () => null,
+    });
+    const def = { surql: 'SELECT * FROM notification', params: {} };
+    const before = await sha256Hex(queryHashInput(def, 'admin-salt'));
+    const state = R.putQuery(
+      buildEntry({ def: { hash: 'q', ...def, id: new RecordId('_00_query', before) }, lifecycle: { phase: 'live', remote: 'registered' } })
+    )({ ...buildState(), sessionId: 'admin-salt', saltUserId: 'user:admin', bucketId: 'admin' });
+    const out = await runPure(authFlip(env, 'user:target'), {
+      state,
+      handlers: {
+        service: svc.handler,
+        'local.getById': () => null,
+        'ssp.register': () => ({ localArray: [], timings: {} }),
+        'local.query': () => [],
+      },
+    });
+    const id = String(out.state.queries.get('q')!.def.id.id);
+    expect(out.state.sessionId).toBe('salt-1');
+    expect(id).toBe(await sha256Hex(queryHashInput(def, 'salt-1')));
+    expect(id).not.toBe(before);
+  });
+  it('a new principal on the same bucket still re-keys its queries', async () => {
+    const svc = fakeServices({
+      'auth.sessionAuthId': () => 'user:b',
+      'auth.access': () => 'account',
+      'local.currentBucketId': () => 'anon',
+      'auth.currentUser': () => null,
+    });
+    const def = { surql: 'SELECT * FROM thing', params: {} };
+    const state = R.putQuery(buildEntry({ def: { hash: 'q', ...def }, lifecycle: { phase: 'live', remote: 'registered' } }))({
+      ...buildState(),
+      sessionId: 'old',
+      saltUserId: 'user:a',
+      bucketId: 'anon',
+    });
+    const out = await runPure(authFlip(env, null), {
+      state,
+      handlers: { service: svc.handler, 'local.getById': () => null, 'ssp.register': () => ({ localArray: [], timings: {} }) },
+    });
+    expect(svc.names()).not.toContain('local.switchStore');
+    expect(String(out.state.queries.get('q')!.def.id.id)).toBe(await sha256Hex(queryHashInput(def, 'salt-1')));
+    expect(out.dispatched.map((d) => d.type)).toContain('EnsureRegistered');
+  });
   it('same principal on the same bucket: no switch, no salt rotation', async () => {
     const svc = fakeServices({
       'auth.sessionAuthId': () => 'user:abc',

package/src/boot/auth-flip.saga.ts

@@ -8,29 +8,44 @@ import { columnsFor } from '../query/env';
 import * as sql from '../query/sql';
 import { encodeRecordId } from '../utils/index';
 import { cleanRecord } from '../utils/parser';
-import { bucketSwitch } from './bucket-switch.saga';
+import { bucketSwitch, rebindQueries } from './bucket-switch.saga';
 
 /**
  * The signed-in principal changed (sign-in, sign-out, boot verification).
- * Identity first (routing and `$auth` for the local SSP), then the bucket,
- * then the salt if the principal really changed, then the verified user row.
+ * Identity first (routing and `$auth` for the local SSP), then the salt if
+ * the principal really changed, then the bucket, then the verified user row.
+ *
+ * The salt goes before the bucket because the switch re-keys every active
+ * query (`rebindQueries`) from the salt it finds. A query's remote id hashes
+ * the salt but not the principal, so re-keyed under the old salt it named the
+ * view the previous principal still held, and the SSP refused it as another
+ * identity's (409 `auth_mismatch`) until that view's TTL ran out. On whitepawn
+ * every impersonation start, stop and token lapse refused a tab's queries for
+ * the 10 minutes of that TTL, each refusal a failed sync round, so the rail
+ * read "Can't reach the server" the whole time.
  */
 export function* authFlip(env: SagaEnv, userId: string | null): Saga<void> {
   const authId = (yield fx.service('auth.sessionAuthId')) as string | null;
   const access = (yield fx.service('auth.access')) as string | null;
   yield fx.state.update(R.setIdentity({ userId }));
   yield fx.service('ssp.setSessionAuth', authId, access);
+  const saltUserId = (yield fx.state.read((s) => s.saltUserId)) as string | null;
+  const resalted = authId !== saltUserId;
+  if (resalted) {
+    const salt = (yield fx.id('salt')) as string;
+    yield fx.state.update(R.setIdentity({ sessionId: salt, saltUserId: authId }));
+    yield fx.service('crdt.setSessionId', salt);
+  }
   const target = bucketIdForUser(userId);
   yield fx.service('hint.write', target);
   yield fx.state.update(R.setIdentity({ pendingBucket: target }));
   const current = (yield fx.service('local.currentBucketId')) as string;
   const release = current === target ? null : ((yield fx.service('local.beginSwitch')) as () => void);
   yield* bucketSwitch(env, target, release);
-  const saltUserId = (yield fx.state.read((s) => s.saltUserId)) as string | null;
-  if (authId !== saltUserId) {
-    const salt = (yield fx.id('salt')) as string;
-    yield fx.state.update(R.setIdentity({ sessionId: salt, saltUserId: authId }));
-    yield fx.service('crdt.setSessionId', salt);
+  // No switch means nothing re-keyed the queries under the new salt.
+  if (resalted && current === target) {
+    yield* rebindQueries();
+    yield fx.dispatch({ type: 'EnsureRegistered' });
   }
   yield* persistVerifiedUser(env);
 }