@syncular/server-hono 0.0.6-125 → 0.0.6-135

package/src/console/live-auth.ts

@@ -0,0 +1,39 @@
+export function parseBearerToken(
+  authHeader: string | null | undefined
+): string | null {
+  const value = authHeader?.trim();
+  if (!value?.startsWith('Bearer ')) {
+    return null;
+  }
+  const token = value.slice(7).trim();
+  return token.length > 0 ? token : null;
+}
+
+export function parseWebSocketAuthToken(data: string): string | null {
+  try {
+    const parsed = JSON.parse(data);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+      return null;
+    }
+    const payload = parsed as Record<string, unknown>;
+    if (payload.type !== 'auth' || typeof payload.token !== 'string') {
+      return null;
+    }
+    const token = payload.token.trim();
+    return token.length > 0 ? token : null;
+  } catch {
+    return null;
+  }
+}
+
+export function closeUnauthenticatedSocket(ws: {
+  send: (data: string) => void;
+  close: (code?: number, reason?: string) => void;
+}): void {
+  try {
+    ws.send(JSON.stringify({ type: 'error', message: 'UNAUTHENTICATED' }));
+  } catch {
+    // ignore send errors
+  }
+  ws.close(4001, 'Unauthenticated');
+}

package/src/console/routes.ts

@@ -30,6 +30,11 @@ import { cors } from 'hono/cors';
 import { describeRoute, resolver, validator as zValidator } from 'hono-openapi';
 import { type Generated, type Kysely, type Selectable, sql } from 'kysely';
 import { z } from 'zod';
+import {
+  closeUnauthenticatedSocket,
+  parseBearerToken,
+  parseWebSocketAuthToken,
+} from './live-auth';
 import {
   type ApiKeyType,
   ApiKeyTypeSchema,
@@ -414,8 +419,12 @@ export function createConsoleRoutes<
   DB extends SyncCoreDb,
   Auth extends SyncServerAuth,
   F extends SqlFamily = SqlFamily,
->(options: CreateConsoleRoutesOptions<DB, Auth, F>): Hono {
-  const routes = new Hono();
+>(
+  options: CreateConsoleRoutesOptions<DB, Auth, F>
+): Hono<{ Variables: { consoleAuth: ConsoleAuthResult } }> {
+  const routes = new Hono<{
+    Variables: { consoleAuth: ConsoleAuthResult };
+  }>();
 
   routes.onError((error, context) => {
     const message =
@@ -592,14 +601,22 @@ export function createConsoleRoutes<
     await next();
   });
 
-  // Auth middleware
-  const requireAuth = async (c: Context): Promise<ConsoleAuthResult | null> => {
+  // Route auth middleware. Keep /events/live exempt to preserve websocket
+  // message-based auth handshake fallback when no Authorization header is sent.
+  routes.use('*', async (c, next) => {
+    if (c.req.method === 'OPTIONS' || c.req.path.endsWith('/events/live')) {
+      await next();
+      return;
+    }
+
     const auth = await options.authenticate(c);
     if (!auth) {
-      return null;
+      return c.json({ error: 'UNAUTHENTICATED' }, 401);
     }
-    return auth;
-  };
+
+    c.set('consoleAuth', auth);
+    await next();
+  });
 
   const requestEventSelectColumns = [
     'event_id',
@@ -961,8 +978,6 @@ export function createConsoleRoutes<
     }),
     zValidator('query', ConsolePartitionQuerySchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
       const { partitionId } = c.req.valid('query');
 
       const stats: SyncStats = await readSyncStats(options.db, {
@@ -971,7 +986,7 @@ export function createConsoleRoutes<
 
       logSyncEvent({
         event: 'console.stats',
-        consoleUserId: auth.consoleUserId,
+        consoleUserId: c.var.consoleAuth.consoleUserId,
       });
 
       return c.json(stats, 200);
@@ -1006,9 +1021,6 @@ export function createConsoleRoutes<
     }),
     zValidator('query', TimeseriesQuerySchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const { interval, range, partitionId } = c.req.valid('query');
 
       const rangeMs = rangeToMs(range);
@@ -1205,9 +1217,6 @@ export function createConsoleRoutes<
     }),
     zValidator('query', LatencyQuerySchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const { range, partitionId } = c.req.valid('query');
 
       const rangeMs = rangeToMs(range);
@@ -1321,9 +1330,6 @@ export function createConsoleRoutes<
     }),
     zValidator('query', ConsoleTimelineQuerySchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const {
         limit,
         offset,
@@ -1553,9 +1559,6 @@ export function createConsoleRoutes<
     }),
     zValidator('query', ConsolePartitionedPaginationQuerySchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const { limit, offset, partitionId } = c.req.valid('query');
 
       let query = db
@@ -1651,9 +1654,6 @@ export function createConsoleRoutes<
     zValidator('param', commitSeqParamSchema),
     zValidator('query', commitDetailQuerySchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const { seq } = c.req.valid('param');
       const { partitionId } = c.req.valid('query');
 
@@ -1772,9 +1772,6 @@ export function createConsoleRoutes<
     }),
     zValidator('query', ConsolePartitionedPaginationQuerySchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const { limit, offset, partitionId } = c.req.valid('query');
 
       let clientsQuery = db
@@ -1940,9 +1937,6 @@ export function createConsoleRoutes<
       },
     }),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const items: ConsoleHandler[] = options.handlers.map((handler) => ({
         table: handler.table,
         dependsOn: handler.dependsOn,
@@ -1983,9 +1977,6 @@ export function createConsoleRoutes<
     }),
     zValidator('query', ConsoleOperationsQuerySchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const { limit, offset, operationType, partitionId } =
         c.req.valid('query');
 
@@ -2055,9 +2046,6 @@ export function createConsoleRoutes<
       },
     }),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const watermarkCommitSeq = await computePruneWatermarkCommitSeq(
         options.db,
         options.prune
@@ -2106,9 +2094,6 @@ export function createConsoleRoutes<
       },
     }),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const watermarkCommitSeq = await computePruneWatermarkCommitSeq(
         options.db,
         options.prune
@@ -2121,13 +2106,13 @@ export function createConsoleRoutes<
 
       logSyncEvent({
         event: 'console.prune',
-        consoleUserId: auth.consoleUserId,
+        consoleUserId: c.var.consoleAuth.consoleUserId,
         deletedCommits,
         watermarkCommitSeq,
       });
       await recordOperationEvent({
         operationType: 'prune',
-        consoleUserId: auth.consoleUserId,
+        consoleUserId: c.var.consoleAuth.consoleUserId,
         requestPayload: {
           watermarkCommitSeq,
           keepNewestCommits: options.prune?.keepNewestCommits ?? null,
@@ -2167,9 +2152,6 @@ export function createConsoleRoutes<
       },
     }),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const fullHistoryHours = options.compact?.fullHistoryHours ?? 24 * 7;
 
       const deletedChanges = await compactChanges(options.db, {
@@ -2179,13 +2161,13 @@ export function createConsoleRoutes<
 
       logSyncEvent({
         event: 'console.compact',
-        consoleUserId: auth.consoleUserId,
+        consoleUserId: c.var.consoleAuth.consoleUserId,
         deletedChanges,
         fullHistoryHours,
       });
       await recordOperationEvent({
         operationType: 'compact',
-        consoleUserId: auth.consoleUserId,
+        consoleUserId: c.var.consoleAuth.consoleUserId,
         requestPayload: { fullHistoryHours },
         resultPayload: { deletedChanges },
       });
@@ -2243,9 +2225,6 @@ export function createConsoleRoutes<
     }),
     zValidator('json', NotifyDataChangeRequestSchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const body = c.req.valid('json');
 
       const result = await notifyExternalDataChange({
@@ -2257,14 +2236,14 @@ export function createConsoleRoutes<
 
       logSyncEvent({
         event: 'console.notify_data_change',
-        consoleUserId: auth.consoleUserId,
+        consoleUserId: c.var.consoleAuth.consoleUserId,
         tables: body.tables,
         commitSeq: result.commitSeq,
         deletedChunks: result.deletedChunks,
       });
       await recordOperationEvent({
         operationType: 'notify_data_change',
-        consoleUserId: auth.consoleUserId,
+        consoleUserId: c.var.consoleAuth.consoleUserId,
         partitionId: body.partitionId ?? null,
         requestPayload: {
           tables: body.tables,
@@ -2315,9 +2294,6 @@ export function createConsoleRoutes<
     zValidator('param', clientIdParamSchema),
     zValidator('query', evictClientQuerySchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const { id: clientId } = c.req.valid('param');
       const { partitionId } = c.req.valid('query');
 
@@ -2335,13 +2311,13 @@ export function createConsoleRoutes<
 
       logSyncEvent({
         event: 'console.evict_client',
-        consoleUserId: auth.consoleUserId,
+        consoleUserId: c.var.consoleAuth.consoleUserId,
         clientId,
         evicted,
       });
       await recordOperationEvent({
         operationType: 'evict_client',
-        consoleUserId: auth.consoleUserId,
+        consoleUserId: c.var.consoleAuth.consoleUserId,
         partitionId: partitionId ?? null,
         targetClientId: clientId,
         requestPayload: { clientId, partitionId: partitionId ?? null },
@@ -2383,9 +2359,6 @@ export function createConsoleRoutes<
     }),
     zValidator('query', eventsQuerySchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const {
         limit,
         offset,
@@ -2488,18 +2461,10 @@ export function createConsoleRoutes<
         heartbeatInterval: ReturnType<typeof setInterval> | null;
         authTimeout: ReturnType<typeof setTimeout> | null;
         isAuthenticated: boolean;
+        startAuthenticatedSession: (() => void) | null;
       }
     >();
 
-    const closeUnauthenticated = (ws: WebSocketLike) => {
-      try {
-        ws.send(JSON.stringify({ type: 'error', message: 'UNAUTHENTICATED' }));
-      } catch {
-        // ignore send errors
-      }
-      ws.close(4001, 'Unauthenticated');
-    };
-
     const cleanup = (ws: WebSocketLike) => {
       const state = wsState.get(ws);
       if (!state) return;
@@ -2553,16 +2518,18 @@ export function createConsoleRoutes<
 
         return {
           onOpen(_event, ws) {
-            const state = {
-              listener: null,
-              heartbeatInterval: null,
-              authTimeout: null,
-              isAuthenticated: false,
-            } as {
+            const state: {
               listener: ConsoleEventListener | null;
               heartbeatInterval: ReturnType<typeof setInterval> | null;
               authTimeout: ReturnType<typeof setTimeout> | null;
               isAuthenticated: boolean;
+              startAuthenticatedSession: (() => void) | null;
+            } = {
+              listener: null,
+              heartbeatInterval: null,
+              authTimeout: null,
+              isAuthenticated: false,
+              startAuthenticatedSession: null,
             };
             wsState.set(ws, state);
 
@@ -2629,6 +2596,7 @@ export function createConsoleRoutes<
               }, heartbeatIntervalMs);
               state.heartbeatInterval = heartbeatInterval;
             };
+            state.startAuthenticatedSession = startAuthenticatedSession;
 
             if (initialAuth) {
               startAuthenticatedSession();
@@ -2640,7 +2608,7 @@ export function createConsoleRoutes<
               if (!current || current.isAuthenticated) {
                 return;
               }
-              closeUnauthenticated(ws);
+              closeUnauthenticatedSocket(ws);
               cleanup(ws);
             }, 5_000);
           },
@@ -2651,30 +2619,15 @@ export function createConsoleRoutes<
             }
 
             if (typeof event.data !== 'string') {
-              closeUnauthenticated(ws);
+              closeUnauthenticatedSocket(ws);
               cleanup(ws);
               return;
             }
 
-            let token = '';
-            try {
-              const parsed = JSON.parse(event.data) as {
-                type?: unknown;
-                token?: unknown;
-              };
-              if (
-                parsed.type === 'auth' &&
-                typeof parsed.token === 'string' &&
-                parsed.token.trim().length > 0
-              ) {
-                token = parsed.token;
-              }
-            } catch {
-              // Ignore parse errors and close as unauthenticated below.
-            }
+            const token = parseWebSocketAuthToken(event.data);
 
             if (!token) {
-              closeUnauthenticated(ws);
+              closeUnauthenticatedSocket(ws);
               cleanup(ws);
               return;
             }
@@ -2685,71 +2638,11 @@ export function createConsoleRoutes<
               return;
             }
             if (!auth) {
-              closeUnauthenticated(ws);
+              closeUnauthenticatedSocket(ws);
               cleanup(ws);
               return;
             }
-
-            currentState.isAuthenticated = true;
-            if (currentState.authTimeout) {
-              clearTimeout(currentState.authTimeout);
-              currentState.authTimeout = null;
-            }
-
-            const listener: ConsoleEventListener = (liveEvent) => {
-              if (partitionId) {
-                const eventPartitionId = liveEvent.data.partitionId;
-                if (
-                  typeof eventPartitionId !== 'string' ||
-                  eventPartitionId !== partitionId
-                ) {
-                  return;
-                }
-              }
-              try {
-                ws.send(JSON.stringify(liveEvent));
-              } catch {
-                // Connection closed
-              }
-            };
-
-            emitter.addListener(listener);
-            currentState.listener = listener;
-
-            ws.send(
-              JSON.stringify({
-                type: 'connected',
-                timestamp: new Date().toISOString(),
-              })
-            );
-
-            const replayEvents = emitter.replay({
-              since: replaySince,
-              limit: replayLimit,
-              partitionId,
-            });
-            for (const replayEvent of replayEvents) {
-              try {
-                ws.send(JSON.stringify(replayEvent));
-              } catch {
-                // Connection closed
-                break;
-              }
-            }
-
-            const heartbeatInterval = setInterval(() => {
-              try {
-                ws.send(
-                  JSON.stringify({
-                    type: 'heartbeat',
-                    timestamp: new Date().toISOString(),
-                  })
-                );
-              } catch {
-                clearInterval(heartbeatInterval);
-              }
-            }, heartbeatIntervalMs);
-            currentState.heartbeatInterval = heartbeatInterval;
+            currentState.startAuthenticatedSession?.();
           },
           onClose(_event, ws) {
             cleanup(ws);
@@ -2803,9 +2696,6 @@ export function createConsoleRoutes<
     zValidator('param', eventIdParamSchema),
     zValidator('query', eventDetailQuerySchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const { id: eventId } = c.req.valid('param');
       const { partitionId } = c.req.valid('query');
 
@@ -2869,9 +2759,6 @@ export function createConsoleRoutes<
     zValidator('param', eventIdParamSchema),
     zValidator('query', eventDetailQuerySchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const { id: eventId } = c.req.valid('param');
       const { partitionId } = c.req.valid('query');
 
@@ -2957,9 +2844,6 @@ export function createConsoleRoutes<
       },
     }),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const res = await db.deleteFrom('sync_request_events').executeTakeFirst();
 
       const deletedCount = Number(res?.numDeletedRows ?? 0);
@@ -2967,7 +2851,7 @@ export function createConsoleRoutes<
 
       logSyncEvent({
         event: 'console.clear_events',
-        consoleUserId: auth.consoleUserId,
+        consoleUserId: c.var.consoleAuth.consoleUserId,
         deletedCount,
         payloadDeletedCount,
       });
@@ -3004,15 +2888,12 @@ export function createConsoleRoutes<
       },
     }),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const pruneResult = await runEventsPrune();
       const deletedCount = pruneResult.totalDeleted;
 
       logSyncEvent({
         event: 'console.prune_events',
-        consoleUserId: auth.consoleUserId,
+        consoleUserId: c.var.consoleAuth.consoleUserId,
         deletedCount,
         requestEventsDeleted: pruneResult.requestEventsDeleted,
         operationEventsDeleted: pruneResult.operationEventsDeleted,
@@ -3054,9 +2935,6 @@ export function createConsoleRoutes<
     }),
     zValidator('query', apiKeysQuerySchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const {
         limit,
         offset,
@@ -3190,9 +3068,6 @@ export function createConsoleRoutes<
     }),
     zValidator('json', ConsoleApiKeyCreateRequestSchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const body = c.req.valid('json');
 
       // Generate key components
@@ -3232,7 +3107,7 @@ export function createConsoleRoutes<
 
       logSyncEvent({
         event: 'console.create_api_key',
-        consoleUserId: auth.consoleUserId,
+        consoleUserId: c.var.consoleAuth.consoleUserId,
         keyId,
         keyType: body.keyType,
       });
@@ -3291,9 +3166,6 @@ export function createConsoleRoutes<
     }),
     zValidator('param', apiKeyIdParamSchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const { id: keyId } = c.req.valid('param');
 
       const row = await db
@@ -3362,9 +3234,6 @@ export function createConsoleRoutes<
     }),
     zValidator('param', apiKeyIdParamSchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const { id: keyId } = c.req.valid('param');
       const now = new Date().toISOString();
 
@@ -3379,7 +3248,7 @@ export function createConsoleRoutes<
 
       logSyncEvent({
         event: 'console.revoke_api_key',
-        consoleUserId: auth.consoleUserId,
+        consoleUserId: c.var.consoleAuth.consoleUserId,
         keyId,
         revoked,
       });
@@ -3422,9 +3291,6 @@ export function createConsoleRoutes<
     }),
     zValidator('json', ConsoleApiKeyBulkRevokeRequestSchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const body = c.req.valid('json');
       const keyIds = [...new Set(body.keyIds.map((keyId) => keyId.trim()))]
         .filter((keyId) => keyId.length > 0)
@@ -3487,7 +3353,7 @@ export function createConsoleRoutes<
 
       logSyncEvent({
         event: 'console.bulk_revoke_api_keys',
-        consoleUserId: auth.consoleUserId,
+        consoleUserId: c.var.consoleAuth.consoleUserId,
         requestedCount: response.requestedCount,
         revokedCount: response.revokedCount,
         alreadyRevokedCount: response.alreadyRevokedCount,
@@ -3532,9 +3398,6 @@ export function createConsoleRoutes<
     }),
     zValidator('param', apiKeyIdParamSchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const { id: keyId } = c.req.valid('param');
       const now = new Date().toISOString();
 
@@ -3582,7 +3445,7 @@ export function createConsoleRoutes<
 
       logSyncEvent({
         event: 'console.stage_rotate_api_key',
-        consoleUserId: auth.consoleUserId,
+        consoleUserId: c.var.consoleAuth.consoleUserId,
         oldKeyId: keyId,
         newKeyId,
       });
@@ -3643,9 +3506,6 @@ export function createConsoleRoutes<
     }),
     zValidator('param', apiKeyIdParamSchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       const { id: keyId } = c.req.valid('param');
       const now = new Date().toISOString();
 
@@ -3703,7 +3563,7 @@ export function createConsoleRoutes<
 
       logSyncEvent({
         event: 'console.rotate_api_key',
-        consoleUserId: auth.consoleUserId,
+        consoleUserId: c.var.consoleAuth.consoleUserId,
         oldKeyId: keyId,
         newKeyId,
       });
@@ -3759,9 +3619,6 @@ export function createConsoleRoutes<
     }),
     zValidator('query', ConsoleBlobListQuerySchema),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       if (!bucket) {
         return c.json({ error: 'BLOB_STORAGE_NOT_CONFIGURED' }, 501);
       }
@@ -3813,9 +3670,6 @@ export function createConsoleRoutes<
       },
     }),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       if (!bucket) {
         return c.json({ error: 'BLOB_STORAGE_NOT_CONFIGURED' }, 501);
       }
@@ -3868,9 +3722,6 @@ export function createConsoleRoutes<
       },
     }),
     async (c) => {
-      const auth = await requireAuth(c);
-      if (!auth) return c.json({ error: 'UNAUTHENTICATED' }, 401);
-
       if (!bucket) {
         return c.json({ error: 'BLOB_STORAGE_NOT_CONFIGURED' }, 501);
       }
@@ -3923,12 +3774,9 @@ export function createTokenAuthenticator(
   return async (c: Context) => {
     if (!expectedToken) return null;
 
-    const authHeader = c.req.header('Authorization')?.trim();
-    if (authHeader?.startsWith('Bearer ')) {
-      const bearerToken = authHeader.slice(7).trim();
-      if (bearerToken === expectedToken) {
-        return { consoleUserId: 'token' };
-      }
+    const bearerToken = parseBearerToken(c.req.header('Authorization'));
+    if (bearerToken === expectedToken) {
+      return { consoleUserId: 'token' };
     }
 
     return null;