@steve31415/baselib 3.47.0 → 3.47.1

package/dist/hub/notify.d.ts

@@ -45,6 +45,10 @@ export declare class HubNotifyBatch {
     private readonly notifier;
     private readonly hints;
     constructor(notifier: HubNotifier);
+    /** Coalesced per (user, kind), as design §5.3 says, except `notification`,
+     *  whose payloads differ in meaning: only exact duplicates of those fold.
+     *  A folded `work` keeps the first hint's ref (refs are optional pickup
+     *  shortcuts; the daemon re-reads its queue either way). */
     add(hint: AppHint): void;
     /** Send every distinct hint (concurrently, each within the notifier's
      *  bound) and empty the batch. Never throws. */

package/dist/hub/notify.js

@@ -81,6 +81,8 @@ export class HubNotifier {
                 body: JSON.stringify({ ...hint, app: this.app }),
                 signal: AbortSignal.timeout(this.timeoutMs),
             });
+            // An unread body holds the connection until garbage collection.
+            await res.body?.cancel().catch(() => { });
             if (res.status === 202)
                 return null;
             // 400/401/403/413: the hint or the grant is wrong, not the network.
@@ -97,8 +99,12 @@ export class HubNotifyBatch {
     constructor(notifier) {
         this.notifier = notifier;
     }
+    /** Coalesced per (user, kind), as design §5.3 says, except `notification`,
+     *  whose payloads differ in meaning: only exact duplicates of those fold.
+     *  A folded `work` keeps the first hint's ref (refs are optional pickup
+     *  shortcuts; the daemon re-reads its queue either way). */
     add(hint) {
-        const key = JSON.stringify([hint.user, hint.kind, hint.ref ?? null, hint.payload ?? null]);
+        const key = hint.kind === 'notification' ? JSON.stringify([hint.user, hint.kind, hint.ref ?? null, hint.payload ?? null]) : JSON.stringify([hint.user, hint.kind]);
         if (!this.hints.has(key))
             this.hints.set(key, hint);
     }

package/dist/hub/server.d.ts

@@ -21,6 +21,15 @@ export declare const DAEMON_LOOKBACK_MAX_MS = 60000;
 /** 401s per client address per minute on the token path before further
  *  tokens from it are refused without a database lookup. */
 export declare const TOKEN_FAILURES_PER_MIN = 20;
+/** Cross-copy publishes in flight at once; past it a publish is dropped (a
+ *  lost hint is tolerated) so a slow database cannot queue publishes ahead
+ *  of the token lookups that share the pool. */
+export declare const HUB_PUBLISHES_IN_FLIGHT_MAX = 16;
+/** The largest frame a browser may send (its frames are `connect` and `ping`). */
+export declare const HUB_SOCKET_MAX_PAYLOAD = 4096;
+/** A socket that has sent nothing (clients ping every 30 s) for this long is
+ *  closed: a half-dead socket would otherwise hold a slot for an hour. */
+export declare const HUB_SOCKET_IDLE_MS = 180000;
 export interface HubOptions {
     pool: pg.Pool;
     logger: Logger;
@@ -40,6 +49,13 @@ export interface HubOptions {
      *  origins (local development and Playwright). */
     allowLocalOrigins?: boolean;
     upgradeWebSocket: UpgradeWebSocket;
+    /** The upgrader's `ws` server (`createNodeWebSocket(...).wss`): the hub
+     *  caps its incoming frame size (ws's default is 100 MiB). */
+    webSocketServer?: {
+        options: {
+            maxPayload?: number;
+        };
+    };
     /** Passed through to requireIdentity (authUrl, whoamiFetch, verifyClient,
      *  rateLimitPerMin…). The hub admits invited users for sockets. */
     identity?: Partial<Omit<RequireIdentityOptions, 'audience' | 'grants' | 'logger' | 'userAccess'>>;
@@ -47,6 +63,11 @@ export interface HubOptions {
     bridge?: Partial<Pick<DbBroadcastBridgeOptions, 'heartbeatMs' | 'heartbeatTimeoutMs' | 'reconnectDelaysMs'>>;
     /** Monotonic milliseconds (tests). */
     now?: () => number;
+    /** Tests: the idle-socket limit and sweep interval. */
+    socketIdle?: {
+        idleMs: number;
+        sweepMs: number;
+    };
 }
 export interface Hub {
     /** Start the cross-copy bridge. Call before the server accepts

package/dist/hub/server.js

@@ -58,7 +58,18 @@ export const DAEMON_LOOKBACK_MAX_MS = 60_000;
 /** 401s per client address per minute on the token path before further
  *  tokens from it are refused without a database lookup. */
 export const TOKEN_FAILURES_PER_MIN = 20;
+/** Cross-copy publishes in flight at once; past it a publish is dropped (a
+ *  lost hint is tolerated) so a slow database cannot queue publishes ahead
+ *  of the token lookups that share the pool. */
+export const HUB_PUBLISHES_IN_FLIGHT_MAX = 16;
+/** The largest frame a browser may send (its frames are `connect` and `ping`). */
+export const HUB_SOCKET_MAX_PAYLOAD = 4096;
+/** A socket that has sent nothing (clients ping every 30 s) for this long is
+ *  closed: a half-dead socket would otherwise hold a slot for an hour. */
+export const HUB_SOCKET_IDLE_MS = 180_000;
+const HUB_SOCKET_SWEEP_MS = 30_000;
 const TOKEN_FORMAT = /^hubt_[A-Za-z0-9_-]{43}$/;
+const WEBSOCKET_KEY = /^[+/0-9A-Za-z]{22}==$/;
 const TOKEN_HASH_FORMAT = /^[0-9a-f]{64}$/;
 const DAEMON_ID_FORMAT = /^[A-Za-z0-9_-]{8,64}$/;
 export function createHub(app, opts) {
@@ -74,6 +85,8 @@ export function createHub(app, opts) {
         userAccess: 'invited',
     });
     const serviceAccount = new RegExp(`^([a-z][a-z0-9-]*)-svc@${escapeRegExp(opts.serviceAccountDomain)}$`);
+    if (opts.webSocketServer)
+        opts.webSocketServer.options.maxPayload = HUB_SOCKET_MAX_PAYLOAD;
     // app → user → sockets
     const sockets = new Map();
     const waits = new Map();
@@ -82,6 +95,8 @@ export function createHub(app, opts) {
     // when the bridge last recovered: hints sent while it was deaf are unknowable
     let lastBlanketAt = -Infinity;
     const publishes = new Set();
+    let droppedPublishes = 0;
+    let lastDropWarnAt = -Infinity;
     const tokenFailures = new FailureCounter(TOKEN_FAILURES_PER_MIN);
     let stopping = false;
     const bridge = new DbBroadcastBridge({
@@ -141,6 +156,15 @@ export function createHub(app, opts) {
                 waiter.finish(workResponse());
     }
     function publish(hint) {
+        if (publishes.size >= HUB_PUBLISHES_IN_FLIGHT_MAX) {
+            droppedPublishes++;
+            if (now() - lastDropWarnAt >= 10_000) {
+                lastDropWarnAt = now();
+                logger.warn('hub publishes dropped', { dropped: droppedPublishes, inFlight: publishes.size });
+                droppedPublishes = 0;
+            }
+            return;
+        }
         const p = withinMs(bridge.notify({ hint }), HUB_PUBLISH_TIMEOUT_MS, 'hub publish')
             .catch((error) => {
             logger.warn('hub publish failed', { app: hint.app, kind: hint.kind, error: serializeError(error) });
@@ -184,6 +208,8 @@ export function createHub(app, opts) {
         return c.body(null, 202);
     });
     app.post('/api/register-daemon', identity, async (c) => {
+        if (stopping)
+            return c.json({ error: 'hub restarting' }, 503);
         const caller = callerApp(c);
         if (!caller)
             return c.json({ error: 'app service accounts only' }, 403);
@@ -228,6 +254,9 @@ export function createHub(app, opts) {
     /** Resolves the waiting app: from a daemon hub token, or (no token) from
      *  `?app=` for a granted service caller. Cookies are refused (review B1). */
     const daemonAuth = createMiddleware(async (c, next) => {
+        // The lookback and the wait both count from arrival, before the token
+        // lookup or identity check, whose time would otherwise open a gap.
+        c.set('hubArrivedAt', now());
         const token = c.req.header('x-hub-token');
         if (token === undefined) {
             const { admitted, response } = await runIdentity(c);
@@ -280,13 +309,16 @@ export function createHub(app, opts) {
         if (stopping)
             return c.body(null, 204);
         // A work hint between the daemon's direct request and this wait being
-        // parked would otherwise be lost to the 30 s timer (review S2).
-        const t = now();
+        // parked would otherwise be lost to the 30 s timer (review S2). The
+        // daemon's lookbackMs covers from its direct request's start to its
+        // arrival here; this copy has seen every hint since arrival.
+        const since = c.var.hubArrivedAt - lookbackMs;
         const last = lastWork.get(appName);
-        if (lookbackMs > 0 && last && t - last.at <= lookbackMs)
+        if (last && last.at >= since)
             return workResponse(last.ref);
-        if (lookbackMs > 0 && t - lastBlanketAt <= lookbackMs)
+        if (lastBlanketAt >= since)
             return workResponse();
+        const remainingMs = Math.max(0, waitSeconds * 1000 - (now() - c.var.hubArrivedAt));
         return new Promise((resolve) => {
             let set = waits.get(appName);
             if (!set)
@@ -306,7 +338,7 @@ export function createHub(app, opts) {
                 },
             };
             const onAbort = () => waiter.finish(new Response(null, { status: 204 }));
-            const timer = setTimeout(() => waiter.finish(new Response(null, { status: 204 })), waitSeconds * 1000);
+            const timer = setTimeout(() => waiter.finish(new Response(null, { status: 204 })), remainingMs);
             waiters.add(waiter);
             if (signal.aborted)
                 onAbort();
@@ -322,6 +354,15 @@ export function createHub(app, opts) {
         const appName = c.req.query('app');
         if (!isAppName(appName))
             return c.json({ error: 'app required' }, 400);
+        // Only a well-formed handshake may reach the upgrader: @hono/node-ws
+        // keeps the request of an upgrade that ws aborts (a bad key or version)
+        // for the life of the process.
+        const version = c.req.header('sec-websocket-version');
+        if ((c.req.header('upgrade') ?? '').toLowerCase() !== 'websocket' ||
+            !WEBSOCKET_KEY.test(c.req.header('sec-websocket-key') ?? '') ||
+            (version !== '13' && version !== '8')) {
+            return c.json({ error: 'websocket handshake required' }, 400);
+        }
         if (!originAllowed(c.req.header('origin'), appName, opts)) {
             logger.warn('hub socket origin refused', { app: appName, origin: c.req.header('origin') ?? null });
             return c.json({ error: 'origin not allowed' }, 403);
@@ -332,6 +373,12 @@ export function createHub(app, opts) {
         const { admitted, response } = await runIdentity(c);
         if (!admitted)
             refusals.set(c, response?.status ?? 401);
+        // The client may have gone while its identity was checked; the upgrader
+        // would then keep its request forever (as above). Nothing awaits between
+        // this check and the upgrade.
+        const incoming = c.env?.incoming;
+        if (incoming?.socket && !(incoming.socket.readable && incoming.socket.writable))
+            return c.body(null, 400); // no one reads it
         await next();
     });
     app.get('/api/ws', originCheck, socketIdentity, opts.upgradeWebSocket((c) => {
@@ -367,7 +414,7 @@ export function createHub(app, opts) {
                         ws.close(4403, 'user identity required');
                     return;
                 }
-                socket = { ws, app: appName, user };
+                socket = { ws, app: appName, user, lastHeardAt: now() };
                 let users = sockets.get(appName);
                 if (!users)
                     sockets.set(appName, (users = new Map()));
@@ -379,6 +426,7 @@ export function createHub(app, opts) {
             onMessage: (evt, ws) => {
                 if (!socket)
                     return;
+                socket.lastHeardAt = now();
                 let message;
                 try {
                     message = JSON.parse(String(evt.data));
@@ -397,10 +445,34 @@ export function createHub(app, opts) {
             onError: remove,
         };
     }));
+    const idle = opts.socketIdle ?? { idleMs: HUB_SOCKET_IDLE_MS, sweepMs: HUB_SOCKET_SWEEP_MS };
+    let sweeper;
+    function sweepIdleSockets() {
+        const t = now();
+        for (const users of sockets.values()) {
+            for (const set of users.values()) {
+                for (const socket of set) {
+                    if (t - socket.lastHeardAt < idle.idleMs)
+                        continue;
+                    try {
+                        socket.ws.close(4408, 'idle');
+                    }
+                    catch {
+                        // already closing
+                    }
+                }
+            }
+        }
+    }
     return {
-        start: () => bridge.start(),
+        async start() {
+            sweeper = setInterval(sweepIdleSockets, idle.sweepMs);
+            sweeper.unref?.();
+            await bridge.start();
+        },
         async stop() {
             stopping = true;
+            clearInterval(sweeper);
             for (const users of sockets.values()) {
                 for (const set of users.values()) {
                     for (const socket of set) {
@@ -417,7 +489,9 @@ export function createHub(app, opts) {
             for (const set of waits.values())
                 for (const waiter of [...set])
                     waiter.finish(new Response(null, { status: 204 }));
-            await Promise.allSettled([...publishes]);
+            // A notify racing shutdown may add a publish while these settle.
+            while (publishes.size > 0)
+                await Promise.allSettled([...publishes]);
             await bridge.stop();
         },
         stats() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steve31415/baselib",
-  "version": "3.47.0",
+  "version": "3.47.1",
   "description": "Plasticine new-world shared platform library: logging, auth, service-to-service auth, db, HTTP, sync, app updates",
   "type": "module",
   "license": "MIT",