@sproutboat/wire 0.12.2 → 0.13.1

package/src/pool.test.ts

@@ -0,0 +1,53 @@
+import { expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { frameOf } from "./broker";
+
+test("shared worker isolates tokens, state and replay IDs, and revokes only one session", async () => {
+  const root = mkdtempSync(join(tmpdir(),"sb-pool-test-"));
+  const child = Bun.spawn([process.execPath,join(import.meta.dir,"pool.ts"),"2"],{stdin:"pipe",stdout:"pipe",stderr:"inherit"});
+  const reader = child.stdout.getReader();
+  const decoder = new TextDecoder();
+  let buffered = "";
+  let sequence = 0;
+  async function command(id:string,op:string,args?:string[]) {
+    child.stdin.write(JSON.stringify({requestId:++sequence,id,op,args})+"\n");
+    while (!buffered.includes("\n")) {
+      const part=await reader.read();
+      if(part.done) throw new Error("worker exited");
+      buffered+=decoder.decode(part.value);
+    }
+    const index=buffered.indexOf("\n");
+    // SAFETY: this is the worker's acknowledgement, not a tenant reply.
+    const reply=JSON.parse(buffered.slice(0,index)) as {ok:boolean};
+    buffered=buffered.slice(index+1);
+    return reply;
+  }
+  async function request(port:number,token:string,op:string,id:number,value="") {
+    return new Promise<string>((resolve,reject)=>{
+      let bytes=Buffer.alloc(0);
+      void Bun.connect({hostname:"127.0.0.1",port,socket:{
+        open(socket){socket.write(frameOf(Buffer.from(token+"\n"+JSON.stringify({op,id,ns:"DATA",key:"key",value}))));},
+        data(socket,chunk){bytes=Buffer.concat([bytes,chunk]);if(bytes.length>=4&&bytes.length>=bytes.readUInt32LE(0)+4){resolve(bytes.subarray(4).toString());socket.end();}},
+        error(_socket,error){reject(error);},
+      }}).catch(reject);
+    });
+  }
+  const freePort=()=>{const s=Bun.listen({hostname:"127.0.0.1",port:0,socket:{data(){}}});const p=s.port!;s.stop(true);return p;};
+  try {
+    const binding=join(root,"bindings.json");writeFileSync(binding,JSON.stringify({kv:["DATA"]}));
+    const a=freePort();let b=freePort();while(b===a)b=freePort();
+    expect((await command("a","register",["--port",String(a),"--token","token-a","--db",join(root,"a.sqlite"),"--bindings",binding])).ok).toBe(true);
+    expect((await command("b","register",["--port",String(b),"--token","token-b","--db",join(root,"b.sqlite"),"--bindings",binding])).ok).toBe(true);
+    expect((await command("overflow","register",[])).ok).toBe(false);
+    expect(await request(a,"token-b","kv.get",2)).toContain("unauthorized");
+    await request(a,"token-a","kv.put",1,"A");
+    await request(b,"token-b","kv.put",1,"B");
+    expect(await request(a,"token-a","kv.get",2)).toContain('"value":"A"');
+    expect(await request(b,"token-b","kv.get",2)).toContain('"value":"B"');
+    expect((await command("a","remove")).ok).toBe(true);
+    expect(await request(b,"token-b","kv.get",3)).toContain('"value":"B"');
+    expect((await command("a","enable")).ok).toBe(false);
+  } finally {child.kill(9);await child.exited;reader.releaseLock();rmSync(root,{recursive:true,force:true});}
+},10_000);

package/src/pool.ts

@@ -0,0 +1,60 @@
+/** Trusted supervisor control travels over private stdio, never tenant TCP. */
+import { isString } from "./json";
+import { D1Pool } from "./d1-pool";
+import { startBroker } from "./broker";
+
+const sql = new D1Pool();
+// Reuse supervisor worker-death recovery for an unrecoverable SQL thread.
+// Keeping the process alive would leave sessions with permanently failed D1.
+sql.onFailure = (error) => {
+  console.error(`sproutboat broker: ${error.message}; revoking broker sessions`);
+  process.exit(1);
+};
+const sessions = new Map<string, ReturnType<typeof startBroker>>();
+const limit = Number(process.argv[2] ?? 64);
+if (!Number.isSafeInteger(limit) || limit < 1 || limit > 256)
+  throw new Error("invalid session limit");
+try {
+  for await (const line of console) {
+    let requestId = 0;
+    try {
+      // SAFETY: private stdin is owned by the trusted supervisor. Validate
+      // fields before allowing it to create a session or open any files.
+      const msg = JSON.parse(line) as {
+        requestId: number;
+        id: string;
+        op: string;
+        args?: string[];
+      };
+      requestId = msg.requestId;
+      if (!Number.isSafeInteger(requestId) || !isString(msg.id) || msg.id.length > 256)
+        throw new Error("invalid command");
+      if (msg.op === "register") {
+        if (sessions.has(msg.id)) throw new Error("session already registered");
+        if (sessions.size >= limit) throw new Error("broker session limit reached");
+        if (!Array.isArray(msg.args) || !msg.args.every(isString))
+          throw new Error("invalid session arguments");
+        sessions.set(msg.id, startBroker(msg.args, sql));
+      } else if (msg.op === "remove") {
+        sessions.get(msg.id)?.close();
+        sessions.delete(msg.id);
+      } else if (msg.op === "enable") {
+        const session = sessions.get(msg.id);
+        if (!session) throw new Error("unknown session");
+        session.enableDispatch();
+      } else throw new Error("unknown command");
+      console.log(JSON.stringify({ requestId, ok: true }));
+    } catch (error) {
+      console.log(
+        JSON.stringify({
+          requestId,
+          ok: false,
+          error: error instanceof Error ? error.message : String(error),
+        }),
+      );
+    }
+  }
+} finally {
+  for (const session of sessions.values()) session.close();
+  sql.close();
+}