@spooky-sync/core 0.0.1-canary.305 → 0.0.1-canary.307

package/dist/index.js

@@ -555,11 +555,11 @@ function classifySyncError(error) {
 //#endregion
 //#region src/utils/index.ts
 const encodeRecordId = (recordId) => {
-	return `${recordId.table.toString()}:${recordId.id}`;
+	return `${recordId.table.name}:${recordId.id}`;
 };
 const extractTablePart = (id) => {
 	if (typeof id === "string") return id.split(":")[0];
-	return id.table.toString();
+	return id.table.name;
 };
 const parseRecordIdString = (id) => {
 	const [table, ...idParts] = id.split(":");
@@ -1308,9 +1308,9 @@ function parseStoredRecordId(id) {
 }
 /** Stable `table:id` string for an id read from the store, escaping removed. */
 const storedIdString = (id) => {
-	if (id instanceof RecordId$1) return `${id.table}:${String(id.id)}`;
+	if (id instanceof RecordId$1) return `${id.table.name}:${String(id.id)}`;
 	const rid = parseStoredRecordId(String(id));
-	return `${rid.table}:${rid.id}`;
+	return `${rid.table.name}:${rid.id}`;
 };
 /** Timestamp prefix of a v1/v2 mutation id, or `null` for a legacy numeric id. */
 function createdAtFromId(id) {
@@ -2178,8 +2178,8 @@ function trimHistory(history, cap) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.305";
-const WASM_VERSION = "0.0.1-canary.305";
+const CORE_VERSION = "0.0.1-canary.307";
+const WASM_VERSION = "0.0.1-canary.307";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class DevToolsService {
 	version = CORE_VERSION;
@@ -6087,7 +6087,7 @@ function* landChunk(env, requested, rows, versions, state, epoch) {
 		const rid = row?.id;
 		if (!rid || typeof rid !== "object") continue;
 		const id = encodeRecordId(rid);
-		const table = String(rid.table);
+		const table = rid.table.name;
 		const version = versions.get(id) ?? 0;
 		const columns = env.schema.tables.find((t) => t.name === table)?.columns;
 		const cleaned = columns ? cleanRecord(columns, row) : row;
@@ -6935,19 +6935,25 @@ function* rebindQueries() {
 //#region src/boot/auth-flip.saga.ts
 /**
 * The signed-in principal changed (sign-in, sign-out, boot verification).
-* Identity first (routing and `$auth` for the local SSP), then the bucket,
-* then the salt if the principal really changed, then the verified user row.
+* Identity first (routing and `$auth` for the local SSP), then the salt if
+* the principal really changed, then the bucket, then the verified user row.
+*
+* The salt goes before the bucket because the switch re-keys every active
+* query (`rebindQueries`) from the salt it finds. A query's remote id hashes
+* the salt but not the principal, so re-keyed under the old salt it named the
+* view the previous principal still held, and the SSP refused it as another
+* identity's (409 `auth_mismatch`) until that view's TTL ran out. On whitepawn
+* every impersonation start, stop and token lapse refused a tab's queries for
+* the 10 minutes of that TTL, each refusal a failed sync round, so the rail
+* read "Can't reach the server" the whole time.
 */
 function* authFlip(env, userId) {
 	const authId = yield fx.service("auth.sessionAuthId");
 	const access = yield fx.service("auth.access");
 	yield fx.state.update(setIdentity({ userId }));
 	yield fx.service("ssp.setSessionAuth", authId, access);
-	const target = bucketIdForUser(userId);
-	yield fx.service("hint.write", target);
-	yield fx.state.update(setIdentity({ pendingBucket: target }));
-	yield* bucketSwitch(env, target, (yield fx.service("local.currentBucketId")) === target ? null : yield fx.service("local.beginSwitch"));
-	if (authId !== (yield fx.state.read((s) => s.saltUserId))) {
+	const resalted = authId !== (yield fx.state.read((s) => s.saltUserId));
+	if (resalted) {
 		const salt = yield fx.id("salt");
 		yield fx.state.update(setIdentity({
 			sessionId: salt,
@@ -6955,6 +6961,15 @@ function* authFlip(env, userId) {
 		}));
 		yield fx.service("crdt.setSessionId", salt);
 	}
+	const target = bucketIdForUser(userId);
+	yield fx.service("hint.write", target);
+	yield fx.state.update(setIdentity({ pendingBucket: target }));
+	const current = yield fx.service("local.currentBucketId");
+	yield* bucketSwitch(env, target, current === target ? null : yield fx.service("local.beginSwitch"));
+	if (resalted && current === target) {
+		yield* rebindQueries();
+		yield fx.dispatch({ type: "EnsureRegistered" });
+	}
 	yield* persistVerifiedUser(env);
 }
 /**
@@ -6966,7 +6981,7 @@ function* persistVerifiedUser(env) {
 	const row = yield fx.service("auth.currentUser");
 	if (!row || !(row.id instanceof RecordId$1) || Object.keys(row).length <= 1) return;
 	const rid = row.id;
-	const table = String(rid.table);
+	const table = rid.table.name;
 	const columns = columnsFor(env, table);
 	if (!columns) return;
 	const id = encodeRecordId(rid);
@@ -14588,7 +14603,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.305",
+			coreVersion: "0.0.1-canary.307",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,

package/dist/worker-edges.js

@@ -265,7 +265,7 @@ function parseValue(name, column, value) {
 //#endregion
 //#region src/utils/index.ts
 const encodeRecordId = (recordId) => {
-	return `${recordId.table.toString()}:${recordId.id}`;
+	return `${recordId.table.name}:${recordId.id}`;
 };
 const parseRecordIdString = (id) => {
 	const [table, ...idParts] = id.split(":");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spooky-sync/core",
-  "version": "0.0.1-canary.305",
+  "version": "0.0.1-canary.307",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -75,15 +75,15 @@
     }
   },
   "dependencies": {
-    "@spooky-sync/query-builder": "0.0.1-canary.305",
-    "@spooky-sync/ssp-wasm": "0.0.1-canary.305",
+    "@spooky-sync/query-builder": "0.0.1-canary.307",
+    "@spooky-sync/ssp-wasm": "0.0.1-canary.307",
     "@sqlite.org/sqlite-wasm": "3.53.0-build1",
     "@surrealdb/wasm": "^3.0.3",
     "blurhash": "^2.0.5",
     "fast-json-patch": "^3.1.1",
     "loro-crdt": "^1.5.6",
     "pino": "^10.1.0",
-    "surrealdb": "2.0.3"
+    "surrealdb": "2.1.0"
   },
   "devDependencies": {
     "@types/node": "^22.5.2",

package/src/boot/auth-flip.saga.test.ts

@@ -6,11 +6,13 @@ import { buildEntry, buildState } from '../testing/build';
 import * as R from '../state/reducers';
 import { defaultEnv } from '../query/env';
 import { authFlip, persistVerifiedUser } from './auth-flip.saga';
+import { queryHashInput } from '../query/hash';
+import { sha256Hex } from '../utils/sha256';
 
 const env = defaultEnv({ tables: [{ name: 'user', columns: { id: {}, email_verified: {} } }] } as any);
 
 describe('authFlip', () => {
-  it('sets identity and $auth before the bucket work, writes the hint, switches, rotates the salt for a new principal, persists the user row', async () => {
+  it('sets identity and $auth, rotates the salt for a new principal before the bucket work, writes the hint, switches, persists the user row', async () => {
     const released: string[] = [];
     const svc = fakeServices({
       'auth.sessionAuthId': () => 'user:abc',
@@ -27,14 +29,65 @@ describe('authFlip', () => {
       handlers: { service: svc.handler, 'local.query': () => [], 'local.execute': () => undefined, 'ssp.ingest': () => undefined },
     });
     const names = svc.names();
-    expect(names.slice(0, 5)).toEqual(['auth.sessionAuthId', 'auth.access', 'ssp.setSessionAuth', 'hint.write', 'local.currentBucketId']);
-    expect(svc.calls[3]).toEqual(['hint.write', ['abc']]);
+    expect(names.slice(0, 6)).toEqual(['auth.sessionAuthId', 'auth.access', 'ssp.setSessionAuth', 'crdt.setSessionId', 'hint.write', 'local.currentBucketId']);
+    expect(svc.calls[3]).toEqual(['crdt.setSessionId', ['salt-1']]);
+    expect(svc.calls[4]).toEqual(['hint.write', ['abc']]);
     expect(names).toContain('local.switchStore');
-    expect(names).toContain('crdt.setSessionId');
     expect(released).toEqual(['gate']);
     expect(out.state).toMatchObject({ userId: 'user:abc', saltUserId: 'user:abc', sessionId: 'salt-1', bucketId: 'abc' });
     expect(out.state.versions.get('user:abc')).toBe(1);
   });
+  it("re-keys active queries under the new principal's salt, so no remote id names the previous principal's view", async () => {
+    const svc = fakeServices({
+      'auth.sessionAuthId': () => 'user:target',
+      'auth.access': () => 'account',
+      'local.currentBucketId': () => 'admin',
+      'local.beginSwitch': () => () => undefined,
+      'local.usesSurqlSchema': () => false,
+      'auth.token': () => 'jwt',
+      'auth.currentUser': () => null,
+    });
+    const def = { surql: 'SELECT * FROM notification', params: {} };
+    const before = await sha256Hex(queryHashInput(def, 'admin-salt'));
+    const state = R.putQuery(
+      buildEntry({ def: { hash: 'q', ...def, id: new RecordId('_00_query', before) }, lifecycle: { phase: 'live', remote: 'registered' } })
+    )({ ...buildState(), sessionId: 'admin-salt', saltUserId: 'user:admin', bucketId: 'admin' });
+    const out = await runPure(authFlip(env, 'user:target'), {
+      state,
+      handlers: {
+        service: svc.handler,
+        'local.getById': () => null,
+        'ssp.register': () => ({ localArray: [], timings: {} }),
+        'local.query': () => [],
+      },
+    });
+    const id = String(out.state.queries.get('q')!.def.id.id);
+    expect(out.state.sessionId).toBe('salt-1');
+    expect(id).toBe(await sha256Hex(queryHashInput(def, 'salt-1')));
+    expect(id).not.toBe(before);
+  });
+  it('a new principal on the same bucket still re-keys its queries', async () => {
+    const svc = fakeServices({
+      'auth.sessionAuthId': () => 'user:b',
+      'auth.access': () => 'account',
+      'local.currentBucketId': () => 'anon',
+      'auth.currentUser': () => null,
+    });
+    const def = { surql: 'SELECT * FROM thing', params: {} };
+    const state = R.putQuery(buildEntry({ def: { hash: 'q', ...def }, lifecycle: { phase: 'live', remote: 'registered' } }))({
+      ...buildState(),
+      sessionId: 'old',
+      saltUserId: 'user:a',
+      bucketId: 'anon',
+    });
+    const out = await runPure(authFlip(env, null), {
+      state,
+      handlers: { service: svc.handler, 'local.getById': () => null, 'ssp.register': () => ({ localArray: [], timings: {} }) },
+    });
+    expect(svc.names()).not.toContain('local.switchStore');
+    expect(String(out.state.queries.get('q')!.def.id.id)).toBe(await sha256Hex(queryHashInput(def, 'salt-1')));
+    expect(out.dispatched.map((d) => d.type)).toContain('EnsureRegistered');
+  });
   it('same principal on the same bucket: no switch, no salt rotation', async () => {
     const svc = fakeServices({
       'auth.sessionAuthId': () => 'user:abc',

package/src/boot/auth-flip.saga.ts

@@ -8,29 +8,44 @@ import { columnsFor } from '../query/env';
 import * as sql from '../query/sql';
 import { encodeRecordId } from '../utils/index';
 import { cleanRecord } from '../utils/parser';
-import { bucketSwitch } from './bucket-switch.saga';
+import { bucketSwitch, rebindQueries } from './bucket-switch.saga';
 
 /**
  * The signed-in principal changed (sign-in, sign-out, boot verification).
- * Identity first (routing and `$auth` for the local SSP), then the bucket,
- * then the salt if the principal really changed, then the verified user row.
+ * Identity first (routing and `$auth` for the local SSP), then the salt if
+ * the principal really changed, then the bucket, then the verified user row.
+ *
+ * The salt goes before the bucket because the switch re-keys every active
+ * query (`rebindQueries`) from the salt it finds. A query's remote id hashes
+ * the salt but not the principal, so re-keyed under the old salt it named the
+ * view the previous principal still held, and the SSP refused it as another
+ * identity's (409 `auth_mismatch`) until that view's TTL ran out. On whitepawn
+ * every impersonation start, stop and token lapse refused a tab's queries for
+ * the 10 minutes of that TTL, each refusal a failed sync round, so the rail
+ * read "Can't reach the server" the whole time.
  */
 export function* authFlip(env: SagaEnv, userId: string | null): Saga<void> {
   const authId = (yield fx.service('auth.sessionAuthId')) as string | null;
   const access = (yield fx.service('auth.access')) as string | null;
   yield fx.state.update(R.setIdentity({ userId }));
   yield fx.service('ssp.setSessionAuth', authId, access);
+  const saltUserId = (yield fx.state.read((s) => s.saltUserId)) as string | null;
+  const resalted = authId !== saltUserId;
+  if (resalted) {
+    const salt = (yield fx.id('salt')) as string;
+    yield fx.state.update(R.setIdentity({ sessionId: salt, saltUserId: authId }));
+    yield fx.service('crdt.setSessionId', salt);
+  }
   const target = bucketIdForUser(userId);
   yield fx.service('hint.write', target);
   yield fx.state.update(R.setIdentity({ pendingBucket: target }));
   const current = (yield fx.service('local.currentBucketId')) as string;
   const release = current === target ? null : ((yield fx.service('local.beginSwitch')) as () => void);
   yield* bucketSwitch(env, target, release);
-  const saltUserId = (yield fx.state.read((s) => s.saltUserId)) as string | null;
-  if (authId !== saltUserId) {
-    const salt = (yield fx.id('salt')) as string;
-    yield fx.state.update(R.setIdentity({ sessionId: salt, saltUserId: authId }));
-    yield fx.service('crdt.setSessionId', salt);
+  // No switch means nothing re-keyed the queries under the new salt.
+  if (resalted && current === target) {
+    yield* rebindQueries();
+    yield fx.dispatch({ type: 'EnsureRegistered' });
   }
   yield* persistVerifiedUser(env);
 }
@@ -44,7 +59,7 @@ export function* persistVerifiedUser(env: SagaEnv): Saga<void> {
   const row = (yield fx.service('auth.currentUser')) as Record<string, unknown> | null;
   if (!row || !(row.id instanceof RecordId) || Object.keys(row).length <= 1) return;
   const rid = row.id as RecordId<string>;
-  const table = String(rid.table);
+  const table = rid.table.name;
   const columns = columnsFor(env, table);
   if (!columns) return;
   const id = encodeRecordId(rid);

package/src/mutation/rows.ts

@@ -53,9 +53,9 @@ export function parseStoredRecordId(id: string): RecordId<string> {
 
 /** Stable `table:id` string for an id read from the store, escaping removed. */
 export const storedIdString = (id: unknown): string => {
-  if (id instanceof RecordId) return `${id.table}:${String(id.id)}`;
+  if (id instanceof RecordId) return `${id.table.name}:${String(id.id)}`;
   const rid = parseStoredRecordId(String(id));
-  return `${rid.table}:${rid.id}`;
+  return `${rid.table.name}:${rid.id}`;
 };
 
 /** Timestamp prefix of a v1/v2 mutation id, or `null` for a legacy numeric id. */

package/src/query/fetch.saga.ts

@@ -82,7 +82,7 @@ export function* landChunk(
     const rid = row?.id as RecordId<string> | undefined;
     if (!rid || typeof rid !== 'object') continue;
     const id = encodeRecordId(rid);
-    const table = String(rid.table);
+    const table = rid.table.name;
     const version = versions.get(id) ?? 0;
     const columns = env.schema.tables.find((t) => t.name === table)?.columns;
     const cleaned = columns ? cleanRecord(columns, row) : row;

package/src/utils/index.ts

@@ -19,7 +19,7 @@ export const compareRecordIds = (
 };
 
 export const encodeRecordId = (recordId: RecordId<string>): string => {
-  return `${recordId.table.toString()}:${recordId.id}`;
+  return `${recordId.table.name}:${recordId.id}`;
 };
 
 export const extractIdPart = (id: string | RecordId<string>): string => {
@@ -39,7 +39,7 @@ export const extractTablePart = (id: string | RecordId<string>): string => {
   if (typeof id === 'string') {
     return id.split(':')[0];
   }
-  return id.table.toString();
+  return id.table.name;
 };
 
 export const parseRecordIdString = (id: string): RecordId<string> => {
@@ -76,7 +76,7 @@ export function decodeFromSp00ky<S extends SchemaStructure, T extends TableNames
     const relation = schema.relationships.find((r) => r.from === tableName && r.field === field);
     if ((column.recordId || relation) && encoded[field] !== null && encoded[field] !== undefined) {
       if (encoded[field] instanceof RecordId) {
-        encoded[field] = `${encoded[field].table.toString()}:${encoded[field].id}`;
+        encoded[field] = `${encoded[field].table.name}:${encoded[field].id}`;
       } else if (
         relation &&
         (encoded[field] instanceof Object || Array.isArray(encoded[field]))

package/src/utils/utils.test.ts

@@ -105,7 +105,7 @@ describe('parseRecordIdString', () => {
 
   it('parses id containing colons', () => {
     const rid = parseRecordIdString('table:part1:part2');
-    expect(rid.table.toString()).toBe('table');
+    expect(rid.table.name).toBe('table');
     expect(rid.id).toBe('part1:part2');
   });
 });