@spooky-sync/core 0.0.1-canary.320 → 0.0.1-canary.321

package/src/client/services.test.ts

@@ -25,16 +25,25 @@ describe('reload salt', () => {
 
   it('a salt left on the way out is taken once, by the same principal', () => {
     leaveReloadSalt('s1', 'user:a');
-    expect(takeReloadSalt('user:a')).toBe('s1');
+    expect(takeReloadSalt('user:a')).toEqual({ salt: 's1', sessionIds: [] });
     // Taken, not read: a tab duplicated from this page finds nothing.
     expect(takeReloadSalt('user:a')).toBeNull();
   });
 
+  it("the page's socket session ids travel with the salt", () => {
+    // The reloaded page's views keep edges stamped by these sockets, and the
+    // anonymous LIVE only hears sessions it knows.
+    leaveReloadSalt('s1', null, ['sid-1', 'sid-2']);
+    expect(takeReloadSalt(null)).toEqual({ salt: 's1', sessionIds: ['sid-1', 'sid-2'] });
+    (g.sessionStorage as MemoryStorage).setItem('sp00ky:salt', JSON.stringify({ salt: 's2', authId: null, sessionIds: ['ok', 7, null] }));
+    expect(takeReloadSalt(null)).toEqual({ salt: 's2', sessionIds: ['ok'] });
+  });
+
   it('another principal, or none, mints a fresh salt', () => {
     leaveReloadSalt('s1', 'user:a');
     expect(takeReloadSalt('user:b')).toBeNull();
     leaveReloadSalt('s2', null);
-    expect(takeReloadSalt(null)).toBe('s2');
+    expect(takeReloadSalt(null)?.salt).toBe('s2');
     leaveReloadSalt('s3', null);
     expect(takeReloadSalt('user:a')).toBeNull();
   });

package/src/client/services.ts

@@ -28,7 +28,7 @@ import type { RuntimeEvent } from '../kernel/events';
 import type { ServiceCalls } from '../kernel/effects';
 import { encodeRecordId } from '../utils/index';
 import { sha256Hex } from '../utils/sha256';
-import { leaveViewsBeacon } from '../query/sql';
+import { leaveViewsBeacon, listRefLive } from '../query/sql';
 import { hashOfEdge, rowOfEdge } from '../utils/edges';
 import { mintMutationId } from '../mutation/mutation-id';
 import { BucketHandle, bucketContentToBlob } from './bucket-handle';
@@ -63,23 +63,32 @@ const RELOAD_SALT_KEY = 'sp00ky:salt';
  * (which copies sessionStorage) mints its own salt rather than sharing this
  * tab's remote views.
  */
-export function takeReloadSalt(authId: string | null): string | null {
+export function takeReloadSalt(authId: string | null): { salt: string; sessionIds: string[] } | null {
   try {
     if (typeof sessionStorage === 'undefined') return null;
     const raw = sessionStorage.getItem(RELOAD_SALT_KEY);
     if (raw === null) return null;
     sessionStorage.removeItem(RELOAD_SALT_KEY);
-    const left = JSON.parse(raw) as { salt?: unknown; authId?: unknown };
-    return typeof left.salt === 'string' && left.salt !== '' && (left.authId ?? null) === authId ? left.salt : null;
+    const left = JSON.parse(raw) as { salt?: unknown; authId?: unknown; sessionIds?: unknown };
+    if (typeof left.salt !== 'string' || left.salt === '' || (left.authId ?? null) !== authId) return null;
+    const sessionIds = Array.isArray(left.sessionIds) ? left.sessionIds.filter((sid): sid is string => typeof sid === 'string') : [];
+    return { salt: left.salt, sessionIds };
   } catch {
     return null;
   }
 }
 
-/** Leave this page's salt for the next page in this tab; see {@link takeReloadSalt}. */
-export function leaveReloadSalt(salt: string, authId: string | null): void {
+/**
+ * Leave this page's salt for the next page in this tab; see {@link takeReloadSalt}.
+ *
+ * The session ids of this page's sockets go with it. The views the next page
+ * re-registers keep the edges this page's sockets stamped, and the anonymous
+ * LIVE only hears edges stamped by a session it knows (see `listRefLive`).
+ */
+export function leaveReloadSalt(salt: string, authId: string | null, sessionIds: ReadonlyArray<string> = []): void {
   try {
-    if (typeof sessionStorage !== 'undefined') sessionStorage.setItem(RELOAD_SALT_KEY, JSON.stringify({ salt, authId }));
+    if (typeof sessionStorage !== 'undefined')
+      sessionStorage.setItem(RELOAD_SALT_KEY, JSON.stringify({ salt, authId, sessionIds }));
   } catch {
     /* private-mode storage errors: the next page mints a fresh salt */
   }
@@ -255,8 +264,13 @@ export function createAdapters<S extends SchemaStructure>(config: Sp00kyConfig<S
   const services: ServiceCalls = {
     'hint.read': readBootBucketHint,
     'hint.write': writeBootBucketHint,
-    'salt.take': takeReloadSalt,
-    'salt.leave': leaveReloadSalt,
+    'salt.take': (authId) => {
+      const left = takeReloadSalt(authId);
+      if (!left) return null;
+      s.remote.adoptSessionIds(left.sessionIds);
+      return left.salt;
+    },
+    'salt.leave': (salt, authId) => leaveReloadSalt(salt, authId, s.remote.sessionIds()),
     'local.connect': (bucketId) => s.local.connect(bucketId),
     'local.switchStore': (bucketId) => s.local.switchStore(bucketId),
     'local.beginSwitch': () => s.local.beginSwitch(),
@@ -354,8 +368,8 @@ export function createAdapters<S extends SchemaStructure>(config: Sp00kyConfig<S
         // trip. The clause is only ever added, never relied on: a server that
         // ignores it, or a row the session cannot read, simply yields no
         // inline row and the fetch path takes over.
-        const join = config.liveInlineBodies ? ' FETCH out' : '';
-        const [uuid] = await s.remote.query<[Uuid]>(`LIVE SELECT * FROM ${table}${join}`);
+        const stmt = listRefLive(table, { inlineBodies: config.liveInlineBodies === true, sessionIds: s.remote.sessionIds() });
+        const [uuid] = await s.remote.query<[Uuid]>(stmt.sql, stmt.vars);
         const live = await s.remote.getClient().liveOf(uuid);
         live.subscribe((message) => {
           if (message.action === 'KILLED') return;

package/src/live/index.test.ts

@@ -215,7 +215,7 @@ describe('createLiveFeed', () => {
     expect(sent).not.toBeNull();
     expect(reg.sql).toBe(sent!.sql);
     expect(reg.vars).toEqual(sent!.vars);
-    expect(reg.sql).toContain('FROM _00_list_ref_user_alice');
+    expect(reg.sql).toContain('FROM $in->_00_list_ref_user_alice');
     expect((reg.vars!.config as any).params.user).toBeInstanceOf(RecordId);
     expect(sub.key).toBe(local.result);
     expect(await queryKey({ surql: input.surql, params: input.params }, 'sess')).toBe(local.result);
@@ -375,6 +375,29 @@ describe('createLiveFeed', () => {
     await feed.close();
   });
 
+  it("an anonymous feed's LIVE hears only its own sockets, earlier ones included after a reconnect", async () => {
+    const fake = new FakeSurreal();
+    let sid = 0;
+    const answer = fake.answer.bind(fake);
+    fake.answer = (sql, vars) =>
+      sql === 'RETURN <string>session::id()' ? [`sid-${++sid}`] : answer(sql, vars);
+    const feed = feedWith(fake, { token: undefined });
+    const sub = feed.subscribe({ surql: 'SELECT * FROM notification;' }, { onSet: () => {} });
+    await sub.ready;
+    fake.fire('disconnected');
+    fake.fire('connected');
+    await tick(60);
+    const lives = fake.calls.filter((c) => c.sql.startsWith('LIVE SELECT'));
+    expect(lives.map((c) => c.sql)).toEqual([
+      'LIVE SELECT * FROM _00_list_ref_anon WHERE clientId = <string>session::id() OR clientId IN $sids FETCH out',
+      'LIVE SELECT * FROM _00_list_ref_anon WHERE clientId = <string>session::id() OR clientId IN $sids FETCH out',
+    ]);
+    // The view was registered on the first socket and is not re-registered,
+    // so its edges keep naming `sid-1`: the second LIVE must still hear them.
+    expect(lives[1].vars).toEqual({ sids: ['sid-1'] });
+    await feed.close();
+  });
+
   it('heartbeats and re-registers a view the server reclaimed', async () => {
     vi.useFakeTimers({ shouldAdvanceTime: true });
     try {

package/src/live/index.ts

@@ -13,7 +13,8 @@
  *   params, ttl }`, key = sha256(JSON.stringify({ surql, params, sessionId })));
  * - bodies with `SELECT * FROM $ids`;
  * - one `LIVE SELECT * FROM <the user's _00_list_ref table> FETCH out` per
- *   feed, so a changed row usually arrives inline with its edge; an edge whose
+ *   feed (on the shared anon table, filtered to the feed's own edges; see
+ *   `listRefLive`), so a changed row usually arrives inline with its edge; an edge whose
  *   `out` is a bare id (a server that ignores FETCH) costs a body read, one
  *   whose `out` is null (unreadable or deleted row) a membership re-read;
  * - `fn::query::heartbeat` at half the ttl, re-registering a reclaimed view;
@@ -30,6 +31,7 @@ import {
   bodySelect,
   heartbeatBatch,
   heartbeatRowGone,
+  listRefLive,
   registerSelect,
   registerVars,
   singleSnapshotSelect,
@@ -201,6 +203,7 @@ const FLUSH_MS = 10;
 const FETCH_BATCH_MS = 15;
 const REREAD_MS = 50;
 const RELEASE_TIMEOUT_MS = 2_000;
+const MAX_SOCKETS = 16;
 
 interface Edge {
   rid: RecordId;
@@ -381,6 +384,8 @@ class Feed implements LiveFeed {
   private liveStarting: Promise<boolean> | null = null;
   private readonly subs = new Map<string, SubState>();
   private readonly sessionId: string;
+  /** `session::id()` of every socket this feed has had, oldest first. */
+  private sockets: string[] = [];
   private readonly ttl: string;
   private readonly timeoutMs: number;
   private isClosed = false;
@@ -498,10 +503,27 @@ class Feed implements LiveFeed {
       );
     }
     this.db = db;
+    void this.noteSession();
+  }
+
+  /**
+   * Remember the `session::id()` of the socket now open. Views are registered
+   * once and not again after a reconnect, so their edges keep naming the socket
+   * that registered them; the anonymous LIVE has to keep hearing those.
+   */
+  private async noteSession(): Promise<void> {
+    try {
+      const [sid] = await this.q('RETURN <string>session::id()');
+      if (typeof sid !== 'string' || this.sockets.includes(sid)) return;
+      this.sockets = [...this.sockets, sid].slice(-MAX_SOCKETS);
+    } catch {
+      // The socket now open is matched by `session::id()` itself.
+    }
   }
 
   /** After a reconnect: LIVE again, then re-read every view (events in the gap are lost). */
   private async recover(): Promise<void> {
+    void this.noteSession();
     try {
       await this.ensureLive();
       for (const sub of this.subs.values()) if (sub.loaded) this.scheduleReread(sub);
@@ -557,14 +579,18 @@ class Feed implements LiveFeed {
     if (!this.liveStarting) {
       this.liveStarting = (async () => {
         try {
+          const live = (inlineBodies: boolean) =>
+            listRefLive(this.table!, { inlineBodies, sessionIds: this.sockets });
           let id: unknown;
           try {
-            [id] = await this.q(`LIVE SELECT * FROM ${this.table} FETCH out`);
+            const { sql, vars } = live(true);
+            [id] = await this.q(sql, vars);
           } catch (error) {
             // A server that refuses FETCH on LIVE still has the doorbell:
             // bare-id edges fall back to a body read in `onLive`.
             this.report(error);
-            [id] = await this.q(`LIVE SELECT * FROM ${this.table}`);
+            const { sql, vars } = live(false);
+            [id] = await this.q(sql, vars);
           }
           const stream = await this.db!.liveOf(id as never);
           const off = stream.subscribe((message) => this.onLive(message));

package/src/modules/ref-tables.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest';
 import { RecordId } from 'surrealdb';
-import { ANON_USER_ID, bucketIdForUser, listRefTableFor, sanitizeUserId } from './ref-tables';
+import { ANON_LIST_REF_TABLE, ANON_USER_ID, bucketIdForUser, listRefTableFor, sanitizeUserId } from './ref-tables';
 
 describe('listRefTableFor', () => {
   it('returns global table in single mode regardless of user', () => {
@@ -36,6 +36,8 @@ describe('listRefTableFor', () => {
   it('routes the anon sentinel to the shared anon table in both modes', () => {
     expect(listRefTableFor('dedicated', ANON_USER_ID)).toBe('_00_list_ref_anon');
     expect(listRefTableFor('single', ANON_USER_ID)).toBe('_00_list_ref_anon');
+    // The LIVE builder keys its per-session filter off this constant.
+    expect(ANON_LIST_REF_TABLE).toBe('_00_list_ref_anon');
     // A real user whose id sanitizes to "anon" still carries the user: prefix,
     // so it never collides with the bare sentinel.
     expect(listRefTableFor('dedicated', 'user:anon')).toBe(

package/src/modules/ref-tables.ts

@@ -22,6 +22,9 @@ export type RefMode = 'single' | 'dedicated';
  */
 export const ANON_USER_ID = 'anon';
 
+/** The one `_00_list_ref` table every signed-out session shares. */
+export const ANON_LIST_REF_TABLE = '_00_list_ref_anon';
+
 /**
  * Default ref-storage mode for this client build. Mirrors the SSP's
  * default (`RefMode::Dedicated`) so cross-session sync works out of the
@@ -81,7 +84,7 @@ export function listRefTableFor(mode: RefMode, userId: unknown): string {
   // Anonymous clients (flag-enabled) share one dedicated table in both modes —
   // checked before the mode split so it never lands on the per-user or the
   // auth-gated global table. Matches `ssp_protocol::list_ref_table_for`.
-  if (userId === ANON_USER_ID) return '_00_list_ref_anon';
+  if (userId === ANON_USER_ID) return ANON_LIST_REF_TABLE;
   if (mode === 'single') return '_00_list_ref';
   const uid = sanitizeUserId(userId);
   return uid ? `_00_list_ref_user_${uid}` : '_00_list_ref';

package/src/pure.ts

@@ -16,6 +16,7 @@ export * from './query/sql';
 export { queryHashInput, viewKeyInput, type QueryKeyInput } from './query/hash';
 // `_00_list_ref` table naming and user-id sanitizing (mirrors ssp-protocol).
 export {
+  ANON_LIST_REF_TABLE,
   ANON_USER_ID,
   DEFAULT_REF_MODE,
   bucketIdForUser,

package/src/query/anon-query-isolation.integration.test.ts

@@ -0,0 +1,337 @@
+import { Socket } from 'node:net';
+import { createHash, randomUUID } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { afterEach, beforeAll, beforeEach, describe, expect, it } from 'vitest';
+import { RecordId, Surreal } from 'surrealdb';
+import { liveEndpoint } from '../live/index';
+import {
+  heartbeatBatch,
+  heartbeatRowGone,
+  leaveViewsBeacon,
+  queryRowCountBatchSelect,
+  queryRowCountSelect,
+} from './sql';
+
+/**
+ * Every signed-out visitor shares the one `anon` identity, so `_00_query`
+ * tells their views apart by session: an anonymous row answers only to the
+ * sessions in its `subscribers`. A second visitor must not be able to list,
+ * read, rewrite, plant or delete the first one's view, while the first keeps
+ * its heartbeat and its registration read-back, also after a reconnect.
+ *
+ * Runs the shipped `_00_query` block and `fn::query::*` functions from
+ * `apps/cli/src` against a real SurrealDB, because the guarantee is the
+ * engine's evaluation of the table and field permissions. Boot one first, e.g.:
+ *   docker run -d --name spooky-surreal-it -p 18011:8000 \
+ *     surrealdb/surrealdb:v3.1.5 start --user root --pass root --allow-all memory
+ *
+ * Override the endpoint with SURREAL_IT_ENDPOINT. Skips if unreachable.
+ */
+const endpoint = liveEndpoint(process.env.SURREAL_IT_ENDPOINT ?? 'ws://127.0.0.1:18011');
+const NS = 'it';
+
+const cliSource = (file: string) =>
+  readFileSync(fileURLToPath(new URL(`../../../../apps/cli/src/${file}`, import.meta.url)), 'utf8');
+
+/** Just the `_00_query` block: the rest of the file needs tables and modules this test does not. */
+function queryTableSchema(): string {
+  const meta = cliSource('meta_tables_remote.surql');
+  const start = meta.indexOf('DEFINE TABLE OVERWRITE _00_query SCHEMALESS');
+  const end = meta.indexOf('-- SPOOKY LIST REF');
+  if (start < 0 || end < start)
+    throw new Error('_00_query block not found in meta_tables_remote.surql');
+  return meta.slice(start, end);
+}
+
+const ACCESS = `
+DEFINE TABLE OVERWRITE user SCHEMALESS PERMISSIONS FOR select WHERE id = $auth.id;
+DEFINE ACCESS OVERWRITE account ON DATABASE TYPE RECORD
+  SIGNUP (CREATE user SET name = $name)
+  SIGNIN (SELECT * FROM user WHERE name = $name)
+  DURATION FOR TOKEN 1h, FOR SESSION 1h;
+`;
+
+/** What the SSP writes, as root, when a session registers a view (`node.rs`, cold path). */
+const SSP_REGISTER = `
+UPSERT $id SET clientId = $sid, auth_id = $owner, surql = 'SELECT * FROM item',
+  params = { auth: { id: $authParam }, access: '' }, ttl = 1h, lastActiveAt = time::now(),
+  rowCount = 3, state = 'ready',
+  subscribers = array::append(
+    array::filter(subscribers ?? [], |$s| <string>$s.id != $sid AND <datetime>$s.seenAt + 1h > time::now()),
+    { id: $sid, seenAt: time::now() })`;
+
+/** A `_00_query:<sha256>` id, the shape the client mints (and the pagehide beacon accepts). */
+const viewId = () =>
+  new RecordId('_00_query', createHash('sha256').update(randomUUID()).digest('hex'));
+
+describe('anonymous _00_query isolation (real SurrealDB)', () => {
+  let root: Surreal;
+  let database = '';
+  let reachable = false;
+  const open: Surreal[] = [];
+
+  // A plain TCP probe: the SDK never rejects a connect to a refused port.
+  beforeAll(async () => {
+    const url = new URL(endpoint);
+    reachable = await new Promise<boolean>((resolve) => {
+      const socket = new Socket();
+      const done = (ok: boolean) => {
+        socket.destroy();
+        resolve(ok);
+      };
+      socket.setTimeout(1_000, () => done(false));
+      socket.once('error', () => done(false));
+      socket.connect(Number(url.port || 80), url.hostname, () => done(true));
+    });
+  });
+
+  beforeEach(async () => {
+    if (!reachable) return;
+    database = `anon_query_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+    root = new Surreal();
+    await root.connect(endpoint, { reconnect: false });
+    await root.signin({ username: 'root', password: 'root' });
+    await root.use({ namespace: NS, database });
+    await root.query(ACCESS);
+    await root.query(queryTableSchema());
+    await root.query(cliSource('functions_remote.surql'));
+  });
+
+  afterEach(async () => {
+    if (!reachable) return;
+    for (const db of open.splice(0)) await db.close().catch(() => undefined);
+    await root.query(`REMOVE DATABASE ${database}`).catch(() => undefined);
+    await root.close();
+  });
+
+  /** A signed-out socket and its `session::id()`. */
+  async function guest(): Promise<[Surreal, string]> {
+    const db = new Surreal();
+    open.push(db);
+    await db.connect(endpoint, { reconnect: false });
+    await db.use({ namespace: NS, database });
+    const [sid] = (await db.query('RETURN <string>session::id()')) as [string];
+    return [db, sid];
+  }
+
+  /** A signed-in socket, its `session::id()`, `$auth.id` and access token. */
+  async function member(name: string): Promise<[Surreal, string, string, string]> {
+    const db = new Surreal();
+    open.push(db);
+    await db.connect(endpoint, { reconnect: false });
+    await db.use({ namespace: NS, database });
+    const tokens = (await db.signup({
+      namespace: NS,
+      database,
+      access: 'account',
+      variables: { name },
+    })) as string | { access: string };
+    const [sid, authId] = (await db.query(
+      'RETURN <string>session::id(); RETURN <string>$auth.id'
+    )) as [string, string];
+    return [db, sid, authId, typeof tokens === 'string' ? tokens : tokens.access];
+  }
+
+  /** `beaconSql`'s request: a fresh HTTP session, Bearer token only when signed in. */
+  async function beacon(sql: string, token?: string): Promise<void> {
+    const url = new URL(endpoint);
+    url.protocol = url.protocol === 'wss:' ? 'https:' : 'http:';
+    url.pathname = url.pathname.replace(/\/rpc\/?$/, '') + '/sql';
+    const headers: Record<string, string> = {
+      Accept: 'application/json',
+      'Content-Type': 'text/plain',
+      'surreal-ns': NS,
+      'surreal-db': database,
+    };
+    if (token) headers.Authorization = `Bearer ${token}`;
+    const res = await fetch(url, { method: 'POST', headers, body: sql });
+    expect(res.ok).toBe(true);
+  }
+
+  const register = (id: RecordId<string>, sid: string, owner = 'anon') =>
+    root.query(SSP_REGISTER, { id, sid, owner, authParam: owner === 'anon' ? '' : owner });
+  const row = async (id: RecordId<string>) =>
+    ((await root.query('SELECT * FROM ONLY $id', { id })) as [Record<string, any> | undefined])[0];
+  const count = async () =>
+    ((await root.query('SELECT VALUE id FROM _00_query')) as [unknown[]])[0].length;
+
+  /** The client's register read-back, as `registerSelect` sends it after `fn::query::register`. */
+  const readBack = async (db: Surreal, id: RecordId<string>) =>
+    ((await db.query(queryRowCountSelect(), { in: id })) as [unknown])[0] ?? null;
+  /** The client's lifecycle tick: did the heartbeat find the row? */
+  const heartbeatFound = async (db: Surreal, id: RecordId<string>) => {
+    const beat = heartbeatBatch([id]);
+    const [result] = (await db.query(beat.sql, beat.vars)) as [unknown];
+    return !heartbeatRowGone(result);
+  };
+
+  it("a second guest cannot list, read, rewrite, release or delete the first guest's view", async (ctx) => {
+    if (!reachable) ctx.skip();
+    const [a, sidA] = await guest();
+    const [b, sidB] = await guest();
+    const qa = viewId();
+    await register(qa, sidA);
+    const before = await row(qa);
+
+    expect(await b.query('SELECT id, surql FROM _00_query')).toEqual([[]]);
+    expect(await readBack(b, qa)).toBeNull();
+    // The membership batch read. 3.0.x answers a hidden row with an empty
+    // object, which the client skips for want of an `id`.
+    const [batch] = (await b.query(queryRowCountBatchSelect(), { ins: [qa] })) as [
+      Array<{ id?: unknown }>,
+    ];
+    expect(batch.filter((r) => r?.id)).toEqual([]);
+
+    expect(
+      await b.query(`UPDATE $id SET surql = 'SELECT * FROM secret', ttl = 1000w`, { id: qa })
+    ).toEqual([[]]);
+    expect(await heartbeatFound(b, qa)).toBe(false);
+    expect(await b.query('RETURN fn::query::unsubscribe($id)', { id: qa })).toEqual([
+      { released: false, remaining: 0 },
+    ]);
+    // Session ids are not secret (they ride on `_00_list_ref_anon`), so naming
+    // the owner's must not help, over the socket or over the beacon's HTTP path.
+    await b.query('RETURN fn::query::leave($id, [$sid])', { id: qa, sid: sidA });
+    await beacon(leaveViewsBeacon([qa], [sidA])!);
+    await b.query('DELETE $id', { id: qa });
+
+    expect(await row(qa)).toEqual(before);
+    expect(await count()).toBe(1);
+    // ...and the owner never noticed.
+    expect(await readBack(a, qa)).toEqual({ rowCount: 3, state: 'ready' });
+    expect(sidB).not.toBe(sidA);
+  });
+
+  it('no caller can plant a row, so nothing the SSP re-registers at boot comes from a client', async (ctx) => {
+    if (!reachable) ctx.skip();
+    const [g, sidG] = await guest();
+    const [u, , authU] = await member('alice');
+    const planted = (sid: string, owner: string) =>
+      `SET auth_id = '${owner}', surql = 'SELECT * FROM item', params = {}, ttl = 1h,
+           subscribers = [{ id: '${sid}', seenAt: time::now() }]`;
+
+    await g.query(`CREATE _00_query:g1 ${planted(sidG, 'anon')}`);
+    await g.query(`UPSERT _00_query:g2 ${planted(sidG, 'anon')}`);
+    await g.query(
+      `INSERT INTO _00_query { id: 'g3', auth_id: 'anon', ttl: 1h, subscribers: [{ id: '${sidG}' }] }`
+    );
+    await u.query(`CREATE _00_query:u1 ${planted('x', authU)}`);
+    await u.query(`UPSERT _00_query:u2 ${planted('x', authU)}`);
+    expect(await count()).toBe(0);
+  });
+
+  it('the owner cannot rewrite what the SSP trusts on its own row either', async (ctx) => {
+    if (!reachable) ctx.skip();
+    const [g, sidG] = await guest();
+    const [u, sidU, authU] = await member('alice');
+    const qg = viewId();
+    const qu = viewId();
+    await register(qg, sidG);
+    await register(qu, sidU, authU);
+    // One field per statement: a write the table rule rejects as a whole would
+    // hide whether the field itself is locked. `params.auth.id` is the identity
+    // the SSP injects into permission predicates when it rebuilds the view at
+    // boot, `surql` skips the allowlist there, and turning a user's row into an
+    // anonymous one would publish its edges to the world-readable anon table.
+    const tampers = (owner: string): Record<string, string> => ({
+      surql: `surql = 'SELECT * FROM secret'`,
+      params: `params = { auth: { id: 'user:victim' }, access: 'account' }`,
+      ttl: 'ttl = 1000w',
+      auth_id: `auth_id = '${owner === 'anon' ? 'user:victim' : 'anon'}'`,
+      clientId: `clientId = 'forged'`,
+      rowCount: 'rowCount = 0',
+      state: `state = 'materializing'`,
+      lastActiveAt: 'lastActiveAt = time::now() + 1000w',
+    });
+
+    for (const [db, id, owner] of [
+      [g, qg, 'anon'],
+      [u, qu, authU],
+    ] as const) {
+      for (const [field, set] of Object.entries(tampers(owner))) {
+        const before = await row(id);
+        await db.query(`UPDATE $id SET ${set}`, { id });
+        expect((await row(id))?.[field], `${owner} ${field}`).toEqual(before?.[field]);
+      }
+    }
+  });
+
+  it('the owning guest keeps its heartbeat and read-back, and after a reconnect gets them back by registering again', async (ctx) => {
+    if (!reachable) ctx.skip();
+    const [a, sidA] = await guest();
+    const [b] = await guest();
+    const qa = viewId();
+    await register(qa, sidA);
+
+    expect(await readBack(a, qa)).toEqual({ rowCount: 3, state: 'ready' });
+    const [batch] = (await a.query(queryRowCountBatchSelect(), { ins: [qa] })) as [
+      Array<{ id?: unknown; rowCount?: number }>,
+    ];
+    expect(batch.map((r) => r.rowCount)).toEqual([3]);
+    const stamped = (await row(qa))?.lastActiveAt;
+    expect(await heartbeatFound(a, qa)).toBe(true);
+    expect((await row(qa))?.lastActiveAt).not.toEqual(stamped);
+
+    // A reconnect is a new session. Until it registers again its heartbeat
+    // finds nothing, which the client reads as a reclaimed view and
+    // re-registers; the SSP's registration then adds the new session.
+    await a.close();
+    const [a2, sidA2] = await guest();
+    expect(await heartbeatFound(a2, qa)).toBe(false);
+    expect(await readBack(a2, qa)).toBeNull();
+    await register(qa, sidA2);
+    expect(await heartbeatFound(a2, qa)).toBe(true);
+    expect(await readBack(a2, qa)).toEqual({ rowCount: 3, state: 'ready' });
+    expect((await row(qa))?.subscribers.map((s: { id: string }) => s.id)).toEqual([sidA, sidA2]);
+
+    // The bystander is still out.
+    expect(await heartbeatFound(b, qa)).toBe(false);
+    expect(await readBack(b, qa)).toBeNull();
+  });
+
+  it('the owning guest can still release its view', async (ctx) => {
+    if (!reachable) ctx.skip();
+    const [a, sidA] = await guest();
+    const qa = viewId();
+    await register(qa, sidA);
+    expect(await a.query('RETURN fn::query::unsubscribe($id)', { id: qa })).toEqual([
+      { released: true, remaining: 0 },
+    ]);
+    expect(await row(qa)).toBeUndefined();
+  });
+
+  it("a signed-in user's views are untouched: other tabs share them, the pagehide leave still pulls the expiry in", async (ctx) => {
+    if (!reachable) ctx.skip();
+    const [u, sidU, authU, token] = await member('alice');
+    const [bob] = await member('bob');
+    const [g] = await guest();
+    const qu = viewId();
+    await register(qu, sidU, authU);
+
+    // A second tab of the same user is not a subscriber yet and still gets in.
+    const tab2 = new Surreal();
+    open.push(tab2);
+    await tab2.connect(endpoint, { reconnect: false });
+    await tab2.use({ namespace: NS, database });
+    await tab2.authenticate(token);
+    expect(await heartbeatFound(tab2, qu)).toBe(true);
+    expect(await readBack(tab2, qu)).toEqual({ rowCount: 3, state: 'ready' });
+
+    expect(await heartbeatFound(bob, qu)).toBe(false);
+    expect(await readBack(g, qu)).toBeNull();
+
+    // The beacon names both tabs' sessions over a fresh HTTP session.
+    const [sid2] = (await tab2.query('RETURN <string>session::id()')) as [string];
+    await beacon(leaveViewsBeacon([qu], [sidU, sid2])!, token);
+    const [left] = (await root.query(
+      'SELECT VALUE duration::secs((lastActiveAt + ttl) - time::now()) FROM ONLY $id',
+      {
+        id: qu,
+      }
+    )) as [number];
+    expect(left).toBeGreaterThan(0);
+    expect(left).toBeLessThanOrEqual(60);
+    expect((await row(qu))?.subscribers).toEqual([]);
+  });
+});