@spooky-sync/core 0.0.1-canary.332 → 0.0.1-canary.334

package/src/modules/auth/auth.session-recheck.test.ts

@@ -0,0 +1,140 @@
+import { describe, it, expect, vi } from 'vitest';
+import { AuthService, REFUSAL_RECHECK_MIN_MS } from './index';
+import {
+  createDatabaseEventSystem,
+  DatabaseEventTypes,
+} from '../../services/database/events/index';
+
+// The session is re-checked after every reconnect and after a statement the
+// server refused because of the session: a token refused on a socket's own
+// handshake used to leave the page on an anonymous `connected` socket while
+// it kept announcing the user.
+
+function jwt(claims: Record<string, unknown>): string {
+  return `header.${Buffer.from(JSON.stringify(claims)).toString('base64url')}.signature`;
+}
+
+const silentLogger = () =>
+  ({ debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn(), child: () => silentLogger() }) as any;
+
+const REFUSED = 'There was a problem with authentication: this session has ended, sign in again';
+
+function makeAuth() {
+  const token = jwt({ AC: 'account', ID: 'user:abc' });
+  const store = new Map<string, unknown>([['sp00ky_auth_token', token]]);
+  const persistence = {
+    get: vi.fn(async (k: string) => store.get(k) ?? null),
+    set: vi.fn(async (k: string, v: unknown) => void store.set(k, v)),
+    remove: vi.fn(async (k: string) => void store.delete(k)),
+  } as any;
+  const connected = new Set<() => void>();
+  const events = createDatabaseEventSystem();
+  let refuse = false;
+  const authenticate = vi.fn(async () => {
+    if (refuse) throw new Error(REFUSED);
+  });
+  const remote = {
+    query: vi.fn(async () => [{ id: 'user:abc' }]),
+    setAuthToken: vi.fn(),
+    whenConnected: vi.fn(async () => undefined),
+    subscribeConnection: (_event: 'connected', cb: () => void) => {
+      connected.add(cb);
+      return () => connected.delete(cb);
+    },
+    getEvents: () => events,
+    getClient: () => ({ authenticate, invalidate: vi.fn(async () => undefined) }),
+  } as any;
+  const auth = new AuthService({} as any, remote, persistence, silentLogger());
+  const settle = () => new Promise((r) => setTimeout(r, 0));
+  return {
+    auth,
+    authenticate,
+    store,
+    refuseFromNowOn: () => void (refuse = true),
+    reconnect: async () => {
+      for (const cb of connected) cb();
+      await settle();
+    },
+    statementFails: async (error: string) => {
+      events.emit(DatabaseEventTypes.RemoteQuery, {
+        query: 'RETURN fn::query::register($config)',
+        duration: 1,
+        success: false,
+        error,
+        timestamp: Date.now(),
+      });
+      await settle();
+    },
+  };
+}
+
+describe('AuthService session re-check', () => {
+  it('signs out when a reconnected socket can no longer use the token', async () => {
+    const t = makeAuth();
+    await t.auth.init();
+    expect(t.auth.isAuthenticated).toBe(true);
+
+    t.refuseFromNowOn();
+    await t.reconnect();
+
+    expect(t.authenticate).toHaveBeenCalledTimes(2);
+    expect(t.auth.isAuthenticated).toBe(false);
+    expect(t.store.get('sp00ky_auth_token')).toBeUndefined();
+  });
+
+  it('keeps a session the server still accepts after a reconnect', async () => {
+    const t = makeAuth();
+    await t.auth.init();
+    await t.reconnect();
+
+    expect(t.authenticate).toHaveBeenCalledTimes(2);
+    expect(t.auth.isAuthenticated).toBe(true);
+  });
+
+  it('signs out when a statement on an open socket is refused for the session', async () => {
+    const t = makeAuth();
+    await t.auth.init();
+
+    t.refuseFromNowOn();
+    await t.statementFails(`An error occurred: ${REFUSED}`);
+
+    expect(t.auth.isAuthenticated).toBe(false);
+  });
+
+  it('ignores statement errors that are not about the session', async () => {
+    const t = makeAuth();
+    await t.auth.init();
+    await t.statementFails('Found 3 for field `n`, but expected a string');
+    await t.statementFails('There was a problem with the underlying connection');
+
+    expect(t.authenticate).toHaveBeenCalledTimes(1);
+  });
+
+  it('re-checks once per window however many statements are refused', async () => {
+    vi.useFakeTimers({ toFake: ['Date'] });
+    try {
+      const t = makeAuth();
+      await t.auth.init();
+      await t.statementFails(REFUSED);
+      await t.statementFails(REFUSED);
+      expect(t.authenticate).toHaveBeenCalledTimes(2);
+
+      vi.setSystemTime(Date.now() + REFUSAL_RECHECK_MIN_MS);
+      await t.statementFails(REFUSED);
+      expect(t.authenticate).toHaveBeenCalledTimes(3);
+      expect(t.auth.isAuthenticated).toBe(true);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('does nothing for a signed-out page', async () => {
+    const t = makeAuth();
+    t.store.clear();
+    await t.auth.init();
+    await t.reconnect();
+    await t.statementFails(REFUSED);
+
+    expect(t.authenticate).not.toHaveBeenCalled();
+  });
+});

package/src/modules/auth/index.ts

@@ -9,7 +9,8 @@ import type { Logger } from '../../services/logger/index';
 export * from './events/index';
 import { AuthEventTypes, createAuthEventSystem } from './events/index';
 import type { PersistenceClient } from '../../types';
-import { classifySyncError } from '../../utils/error-classification';
+import { classifySyncError, isRefusedSessionError } from '../../utils/error-classification';
+import { DatabaseEventTypes } from '../../services/database/events/index';
 import { encodeRecordId } from '../../utils/index';
 import { RecordId } from 'surrealdb';
 import {
@@ -53,6 +54,13 @@ export type SignOutHook = (ctx: SignOutContext) => Promise<void> | void;
 /** Upper bound on the before-sign-out hooks, so a dead socket never holds a sign-out. */
 export const SIGN_OUT_HOOK_TIMEOUT_MS = 2_000;
 
+/**
+ * Floor between two session re-checks started by refused statements. A
+ * refused session fails every statement at once, and a check that keeps the
+ * session (the server was unreachable) must not be re-run by each of them.
+ */
+export const REFUSAL_RECHECK_MIN_MS = 30_000;
+
 // Helper to pretty print types
 type Prettify<T> = {
   [K in keyof T]: T[K];
@@ -111,6 +119,11 @@ export class AuthService<S extends SchemaStructure> {
   private stopping: Promise<void> | null = null;
   /** A token renewal in flight, which a stop waits out (see `renewImpersonation`). */
   private renewing: Promise<void> | null = null;
+  /** The session re-check in flight (see `watchSession`), shared by every trigger. */
+  private reverifying: Promise<void> | null = null;
+  /** When a refused statement last started a re-check. */
+  private lastRefusalCheckAt = Number.NEGATIVE_INFINITY;
+  private watchingSession = false;
   private impersonationTimers = new ImpersonationTimers({
     current: () => this.impersonation,
     renew: () => this.renewImpersonation(),
@@ -141,6 +154,60 @@ export class AuthService<S extends SchemaStructure> {
 
   async init() {
     await this.check();
+    this.watchSession();
+  }
+
+  /**
+   * Check the session again whenever the socket comes back, and whenever the
+   * server refuses a statement because of the session.
+   *
+   * The server judges a token only when a socket authenticates: the SDK
+   * replays `authenticate` on its own reconnects, `RemoteDatabaseService` on a
+   * socket it rebuilds. When the replay is refused (the app ended the session,
+   * say with a password reset) the SDK drops to an anonymous session, and the
+   * supervisor swallows the rebuild's error, so the socket reports `connected`
+   * while this service still announces the user. Every view registered from
+   * then on carried no identity: the page looked signed in and showed nothing
+   * of the user's. `check()` applies the token again and signs out when the
+   * server refuses it.
+   *
+   * A socket that never reconnects is ended by the app's session guard
+   * (`fn::sp00ky::session_live`) instead: its heartbeats stop finding rows,
+   * and the re-registration that follows is refused with "There was a problem
+   * with authentication", which starts a check here too.
+   */
+  private watchSession(): void {
+    if (this.watchingSession) return;
+    this.watchingSession = true;
+    this.remote.subscribeConnection('connected', () => this.reverify());
+    this.remote.getEvents().subscribe(DatabaseEventTypes.RemoteQuery, (event) => {
+      const { success, error } = event.payload;
+      if (success || !isRefusedSessionError(error ?? '')) return;
+      const now = Date.now();
+      if (now - this.lastRefusalCheckAt < REFUSAL_RECHECK_MIN_MS) return;
+      this.lastRefusalCheckAt = now;
+      this.reverify();
+    });
+  }
+
+  /** One `check()` for every trigger that lands while it runs. */
+  private reverify(): void {
+    if (!this.isAuthenticated || this.reverifying) return;
+    this.reverifying = (async () => {
+      // A rebuilt socket reports `connected` before its namespace and token
+      // are applied: check against the finished handshake.
+      await this.remote.whenConnected();
+      if (this.isAuthenticated) await this.check();
+    })()
+      .catch((error) => {
+        this.logger.warn(
+          { error, Category: 'sp00ky-client::AuthService::reverify' },
+          'Session re-check failed'
+        );
+      })
+      .finally(() => {
+        this.reverifying = null;
+      });
   }
 
   getAccessDefinition<Name extends keyof S['access']>(name: Name): AccessDefinition | undefined {

package/src/modules/devtools/index.ts

@@ -318,7 +318,9 @@ export class DevToolsService implements StreamUpdateReceiver {
         // the panel: is the server's set known, has a non-empty one been seen
         // this session, how many empty reads were ignored.
         membershipKnown: q.config.membershipKnown === true,
-        authoritative: q.config.membershipKnown === true,
+        // What the bindings' `isAuthoritative()` reads: the known set's rows
+        // are painted, not just the set read.
+        authoritative: q.answered === true,
         viewLost: q.viewLost === true,
         serverState: q.serverState ?? null,
         // Detailed per-phase processing-time breakdown (SSP sub-phases, local/

package/src/query/anon-query-isolation.integration.test.ts

@@ -58,14 +58,18 @@ function ownerGuard(): string {
 
 const sha256 = (text: string) => createHash('sha256').update(text).digest('hex');
 
-/** Just the `_00_query` block: the rest of the file needs tables and modules this test does not. */
+/**
+ * Just the session guard (its rule's user branch asks it) and the `_00_query`
+ * block: the rest of the file needs tables and modules this test does not.
+ */
 function queryTableSchema(): string {
   const meta = cliSource('meta_tables_remote.surql');
+  const guard = meta.indexOf('-- SPOOKY SESSION GUARD');
   const start = meta.indexOf('DEFINE TABLE OVERWRITE _00_query SCHEMALESS');
   const end = meta.indexOf('-- SPOOKY LIST REF');
-  if (start < 0 || end < start)
+  if (guard < 0 || start < guard || end < start)
     throw new Error('_00_query block not found in meta_tables_remote.surql');
-  return meta.slice(start, end);
+  return meta.slice(guard, meta.indexOf('-- SPOOKY INCANTATION')) + meta.slice(start, end);
 }
 
 const ACCESS = `

package/src/query/materialize.saga.test.ts

@@ -97,6 +97,79 @@ describe('materialize', () => {
   });
 });
 
+describe('materialize answers the query', () => {
+  const plan = { table: 'thing' } as any;
+  const byIds = { 'local.select': (e: any) => (e.plan.ids ?? []).map((id: any) => ({ id: `${id.table}:${id.id}` })) };
+  const authority = (out: { emitted: Array<{ type: string }> }) => out.emitted.filter((e) => e.type === 'query:authority');
+
+  it('a cached re-seed: rows first, then authority; the next render flips nothing', async () => {
+    // The bucket-switch window: a durable view was found, `records` is not
+    // painted yet. Authority comes from this render, after the rows.
+    const s = R.markDirty(['a'])(
+      buildState([buildEntry({ def: { hash: 'a', plan }, lifecycle: { phase: 'cached' }, remoteArray: [['thing:1', 1]] })])
+    );
+    const out = await runPure(materialize('a'), { state: s, handlers: byIds });
+    expect(out.state.queries.get('a')!.lifecycle).toMatchObject({ phase: 'cached', notified: true, answered: true });
+    expect(out.emitted).toEqual([
+      { type: 'query:records', hash: 'a', records: [{ id: 'thing:1' }] },
+      { type: 'query:authority', hash: 'a', known: true },
+    ]);
+    const again = await runPure(materialize('a'), { state: R.markDirty(['a'])(out.state), handlers: byIds });
+    expect(again.emitted).toEqual([]);
+  });
+
+  it('a known empty set answers without a rows emission', async () => {
+    const s = buildState([buildEntry({ def: { hash: 'a', plan }, lifecycle: { phase: 'live' }, remoteArray: [] })]);
+    const out = await runPure(materialize('a'), { state: s, handlers: byIds });
+    expect(out.emitted).toEqual([{ type: 'query:authority', hash: 'a', known: true }]);
+  });
+
+  it('a cold render never answers', async () => {
+    const s = buildState([buildEntry({ def: { hash: 'a', plan } })], R.reloadViews(new Map([['v', ['thing:1']]])));
+    const out = await runPure(materialize('a'), { state: s, handlers: { 'local.select': () => [{ id: 'thing:1' }] } });
+    expect(out.state.queries.get('a')!.lifecycle).toMatchObject({ notified: true, answered: false });
+    expect(authority(out)).toEqual([]);
+  });
+
+  it('a server set whose bodies are still downloading is not an answer yet', async () => {
+    const s = buildState(
+      [buildEntry({ def: { hash: 'a', plan }, lifecycle: { phase: 'live' }, remoteArray: [['thing:1', 1], ['thing:2', 1]] })],
+      R.setVersions([['thing:1', 1]])
+    );
+    const out = await runPure(materialize('a'), { state: s, handlers: byIds });
+    expect(out.state.queries.get('a')!.lifecycle.answered).toBe(false);
+    expect(authority(out)).toEqual([]);
+    const landed = await runPure(materialize('a'), { state: R.setVersions([['thing:2', 1]])(out.state), handlers: byIds });
+    expect(landed.state.queries.get('a')!.lifecycle.answered).toBe(true);
+    expect(authority(landed)).toEqual([{ type: 'query:authority', hash: 'a', known: true }]);
+  });
+
+  it('a membership replaced while the read was out does not answer: the next render does', async () => {
+    const s = buildState([buildEntry({ def: { hash: 'a', plan }, lifecycle: { phase: 'cached' }, remoteArray: [['thing:1', 1]] })]);
+    const out = await runPure(materialize('a'), {
+      state: s,
+      handlers: {
+        'local.select': (e: any, ctx) => {
+          ctx.state = R.rebindQuery('a', { id: new RecordId('_00_query', 'b'), lifecycle: { phase: 'cached', remote: 'unregistered', fetchDepth: 0, backgroundDepth: 0, notified: false, answered: false }, remoteArray: [['thing:2', 1]], localArray: [] })(ctx.state);
+          return byIds['local.select'](e);
+        },
+      },
+    });
+    expect(out.state.queries.get('a')!.lifecycle.answered).toBe(false);
+    expect(authority(out)).toEqual([]);
+  });
+
+  it('after a rebind, a new store that renders nothing clears what the old principal painted', async () => {
+    const s = buildState([buildEntry({ def: { hash: 'a', plan }, lifecycle: { phase: 'live', answered: true }, remoteArray: [['thing:1', 1]], records: [{ id: 'thing:1' }] })]);
+    const rebound = R.rebindQuery('a', { id: new RecordId('_00_query', 'b'), lifecycle: { phase: 'cached', remote: 'unregistered', fetchDepth: 0, backgroundDepth: 0, notified: false, answered: false }, remoteArray: [], localArray: [] })(s);
+    const out = await runPure(materialize('a'), { state: rebound, handlers: byIds });
+    expect(out.emitted).toEqual([
+      { type: 'query:records', hash: 'a', records: [] },
+      { type: 'query:authority', hash: 'a', known: true },
+    ]);
+  });
+});
+
 describe('streamUpdate', () => {
   it('takes the local id-set (dirtying the query) and records ingest timings; unknown hashes are ignored', async () => {
     const s = buildState([buildEntry({ def: { hash: 'a' } })]);

package/src/query/materialize.saga.ts

@@ -4,7 +4,8 @@ import type { Saga } from '../kernel/saga';
 import { fx } from '../kernel/effects';
 import type { QueryEntry } from '../state/client-state';
 import * as R from '../state/reducers';
-import { overlay, vouched } from '../state/selectors';
+import { needed, overlay, vouched } from '../state/selectors';
+import { isAnswered } from '../state/lifecycle';
 import type { Overlay } from '../state/selectors';
 import { isWindowed, materializeEffect, rowKey, rowsEqual, rowsFromResult } from './materialize';
 import { buildRenderIds, paintsCold, resolveMembership } from './render-set';
@@ -17,12 +18,15 @@ const NONE: ReadonlySet<string> = new Set();
  * only writer of `records`. Runs on the `mat:<hash>` dedupe lane whenever the
  * query is dirty. Before the server has answered (`cold`) only bodies some
  * durable view vouches for paint (see `paintsCold`).
+ *
+ * Also the only place a query becomes answered (see `QueryLifecycle`): the
+ * authority flip is emitted here, after the rows it vouches for.
  */
 export function* materialize(hash: QueryHash): Saga<void> {
-  const [entry, ov, known] = (yield fx.state.read((s) => {
+  const [entry, ov, known, complete] = (yield fx.state.read((s) => {
     const e = s.queries.get(hash);
-    return [e, overlay(s), e?.lifecycle.phase === 'cold' ? vouched(s) : NONE];
-  })) as [QueryEntry | undefined, Overlay, ReadonlySet<string>];
+    return [e, overlay(s), e?.lifecycle.phase === 'cold' ? vouched(s) : NONE, needed(s, hash).length === 0];
+  })) as [QueryEntry | undefined, Overlay, ReadonlySet<string>, boolean];
   if (!entry) return;
   const t0 = (yield fx.now()) as number;
   const isWindow = isWindowed(entry.def.surql);
@@ -54,10 +58,18 @@ export function* materialize(hash: QueryHash): Saga<void> {
   if (!current) return;
   const t1 = (yield fx.now()) as number;
   const changed = !rowsEqual(rows, current.records);
+  // These rows answer the query when they drew a known membership with no
+  // body of a server set still to download, and that membership is still
+  // the one in state. A server set applied, or a bucket switch, while the
+  // read was out dirtied the query again: the next render answers instead.
+  const answered =
+    complete && entry.lifecycle.phase !== 'cold' && current.lifecycle.phase !== 'cold' && current.remoteArray === entry.remoteArray;
   yield fx.state.update(
-    R.compose(R.setRecords(hash, rows, changed, t1 - t0), changed ? R.stampUpdated(hash, t1) : (s) => s)
+    R.compose(R.setRecords(hash, rows, changed, t1 - t0, answered), changed ? R.stampUpdated(hash, t1) : (s) => s)
   );
   if (changed) yield fx.emit({ type: 'query:records', hash, records: rows });
+  // After the rows: a subscriber told "known" must already hold them.
+  if (answered && !isAnswered(current.lifecycle)) yield fx.emit({ type: 'query:authority', hash, known: true });
 }
 
 /**

package/src/query/membership.saga.test.ts

@@ -72,7 +72,7 @@ describe('applyMembership', () => {
     expect(out.result).toBe('ignored');
     expect(out.state.queries.get('a')!).toMatchObject({ viewLostCount: 0, viewLostRetryAt: null });
   });
-  it('applied: commits, writes the view row, flips authority once, releases acked items, asks for bodies', async () => {
+  it('applied: commits, writes the view row, releases acked items, asks for bodies; authority waits for the render', async () => {
     const s = buildState(
       [buildEntry({ def: { hash: 'a', viewKey: 'vk' }, lifecycle: { phase: 'cold' }, subqueryRemoteArray: [['c:1', 1]] })],
       R.outboxReplace([buildOutboxItem({ id: 'm', recordId: 't:1', status: 'acked', ackedAt: 1 })])
@@ -81,7 +81,10 @@ describe('applyMembership', () => {
     expect(out.result).toBe('applied');
     expect(out.state.queries.get('a')!.lifecycle.phase).toBe('live');
     expect(out.state.outbox).toEqual([]);
-    expect(out.emitted).toEqual([{ type: 'query:authority', hash: 'a', known: true }]);
+    // The set is known, but no row of it is painted: `materialize` flips authority.
+    expect(out.emitted).toEqual([]);
+    expect(out.state.queries.get('a')!.lifecycle.answered).toBe(false);
+    expect(out.state.dirty.has('a')).toBe(true);
     expect(out.log.find((e) => e.kind === 'local.upsert')).toEqual({
       kind: 'local.upsert',
       table: '_00_view',

package/src/query/membership.saga.ts

@@ -10,7 +10,6 @@ import {
   backoffMs,
 } from '../kernel/constants';
 import type { ClientState, QueryEntry } from '../state/client-state';
-import { isAuthoritative } from '../state/lifecycle';
 import * as R from '../state/reducers';
 import { encodeRecordId } from '../utils/index';
 import { departedIds } from '../state/selectors';
@@ -88,10 +87,10 @@ export function* applyMembership(
     yield fx.timer.set(`view-lost:${hash}`, delay, { type: 'RecoverLostView', hash });
     return outcome;
   }
-  const wasAuthoritative = isAuthoritative(entry.lifecycle);
   yield fx.state.update(R.commitMembership(hash, remoteArray, meta?.present ?? true));
   yield* forgetDeparted(hash, departedIds(entry.remoteArray, remoteArray));
-  if (!wasAuthoritative) yield fx.emit({ type: 'query:authority', hash, known: true });
+  // No authority flip here: the set is known but its rows are not painted
+  // yet (bodies may still be on their way). `materialize` flips it once they are.
   const now = (yield fx.now()) as number;
   try {
     yield fx.local.upsert(

package/src/query/register.saga.test.ts

@@ -154,7 +154,8 @@ describe('registerRemote', () => {
     expect(req.sql.startsWith('fn::query::register($config);')).toBe(true);
     expect(req.vars.config).toMatchObject({ surql: entry.def.surql, ttl: '10m' });
     expect(out.dispatched).toEqual([{ type: 'FetchRows' }, { type: 'FetchRows' }, { type: 'SyncOutcome', ok: true }]);
-    expect(out.emitted).toContainEqual({ type: 'query:authority', hash: 'a', known: true });
+    // Authority follows the render of these rows, not the registration.
+    expect(out.emitted.some((ev) => ev.type === 'query:authority')).toBe(false);
   });
   it('a cold registration is foreground; a cached or live one is background', async () => {
     for (const [phase, background] of [['cold', 0], ['cached', 1], ['live', 1]] as const) {