@syncular/server-hono 0.0.6-159 → 0.0.6-168

package/src/console/schema-errors.ts

@@ -0,0 +1,23 @@
+const BENIGN_CONSOLE_SCHEMA_ERROR_SUBSTRINGS = [
+  'driver has already been destroyed',
+];
+
+export function isBenignConsoleSchemaError(error: unknown): boolean {
+  const visited = new Set<Error>();
+  let current: unknown = error;
+
+  while (current instanceof Error && !visited.has(current)) {
+    visited.add(current);
+    const message = current.message.toLowerCase();
+    if (
+      BENIGN_CONSOLE_SCHEMA_ERROR_SUBSTRINGS.some((substring) =>
+        message.includes(substring)
+      )
+    ) {
+      return true;
+    }
+    current = current.cause;
+  }
+
+  return false;
+}

package/src/console/schemas.ts

@@ -286,7 +286,7 @@ export type ConsoleApiKeyBulkRevokeResponse = z.infer<
 
 export const ConsolePaginationQuerySchema = z.object({
   limit: z.coerce.number().int().min(1).max(100).default(50),
-  offset: z.coerce.number().int().min(0).default(0),
+  offset: z.coerce.number().int().min(0).max(10_000).default(0),
 });
 
 export const ConsolePartitionQuerySchema = z.object({

package/src/console/types.ts

@@ -84,6 +84,13 @@ export interface ConsoleMaintenanceOptions {
    * Default: 5000.
    */
   operationEventsMaxRows?: number;
+  /**
+   * Max rows to scan per source (commits/events) for `/timeline` requests.
+   * Prevents unbounded memory growth on large histories.
+   * Set to 0 to disable the guard.
+   * Default: 10000.
+   */
+  timelineScanMaxRows?: number;
 }
 
 export interface ConsoleBlobObject {
@@ -176,6 +183,31 @@ export interface CreateConsoleRoutesOptions<
      * Heartbeat interval in milliseconds. Default: 30000
      */
     heartbeatIntervalMs?: number;
+    /**
+     * Maximum inbound websocket message size in bytes.
+     * Messages above this limit are rejected and the connection is closed.
+     * Default: 1048576 (1 MiB)
+     */
+    maxMessageBytes?: number;
+    /**
+     * Maximum inbound websocket messages allowed per connection within one window.
+     * Set to 0 to disable rate limiting.
+     * Default: 120
+     */
+    maxMessagesPerWindow?: number;
+    /**
+     * Window size in milliseconds for inbound websocket message rate limiting.
+     * Ignored when maxMessagesPerWindow is 0.
+     * Default: 10000 (10s)
+     */
+    messageRateWindowMs?: number;
+    /**
+     * Optional list of allowed websocket origins.
+     * - undefined: allow all origins
+     * - '*': allow all origins
+     * - string[]: exact origin match (scheme + host + port)
+     */
+    allowedOrigins?: string[] | '*';
   };
   /**
    * Optional console schema readiness promise.

package/src/create-server.ts

@@ -21,6 +21,7 @@ import {
   createConsoleRoutes,
   createTokenAuthenticator,
 } from './console/routes';
+import { isBenignConsoleSchemaError } from './console/schema-errors';
 import type {
   ConsoleEventEmitter,
   ConsoleSharedOptions,
@@ -140,7 +141,12 @@ export function createSyncServer<
     : undefined;
   const consoleSchemaReady =
     isConsoleEnabled && dialect.ensureConsoleSchema
-      ? dialect.ensureConsoleSchema(db)
+      ? dialect.ensureConsoleSchema(db).catch((error) => {
+          if (isBenignConsoleSchemaError(error)) {
+            return;
+          }
+          throw error;
+        })
       : undefined;
 
   // Create sync routes
@@ -159,17 +165,9 @@ export function createSyncServer<
       ...routes,
       websocket: upgradeWebSocket
         ? {
+            ...routes?.websocket,
             enabled: true,
             upgradeWebSocket,
-            ...(routes?.websocket?.heartbeatIntervalMs !== undefined && {
-              heartbeatIntervalMs: routes.websocket.heartbeatIntervalMs,
-            }),
-            ...(routes?.websocket?.maxConnectionsTotal !== undefined && {
-              maxConnectionsTotal: routes.websocket.maxConnectionsTotal,
-            }),
-            ...(routes?.websocket?.maxConnectionsPerClient !== undefined && {
-              maxConnectionsPerClient: routes.websocket.maxConnectionsPerClient,
-            }),
           }
         : { enabled: false },
     },
@@ -196,6 +194,11 @@ export function createSyncServer<
       websocket: {
         enabled: true,
         upgradeWebSocket,
+        heartbeatIntervalMs: routes?.websocket?.heartbeatIntervalMs,
+        maxMessageBytes: routes?.websocket?.maxMessageBytes,
+        maxMessagesPerWindow: routes?.websocket?.maxMessagesPerWindow,
+        messageRateWindowMs: routes?.websocket?.messageRateWindowMs,
+        allowedOrigins: routes?.websocket?.allowedOrigins,
       },
     }),
   });

package/src/proxy/routes.ts

@@ -58,6 +58,16 @@ interface CreateProxyRoutesConfig<DB extends SyncCoreDb = SyncCoreDb> {
   maxConnections?: number;
   /** Idle connection timeout in ms (default: 30000) */
   idleTimeoutMs?: number;
+  /**
+   * Maximum inbound websocket message size in bytes.
+   * Default: 1 MiB.
+   */
+  maxMessageBytes?: number;
+  /**
+   * Optional list of allowed websocket origins.
+   * Use '*' to allow all origins.
+   */
+  allowedOrigins?: string[] | '*';
 }
 
 /**
@@ -90,6 +100,7 @@ export function createProxyRoutes<DB extends SyncCoreDb>(
   config: CreateProxyRoutesConfig<DB>
 ): Hono {
   const app = new Hono();
+  const maxMessageBytes = config.maxMessageBytes ?? 1024 * 1024;
 
   const manager = new ProxyConnectionManager({
     db: config.db,
@@ -104,6 +115,10 @@ export function createProxyRoutes<DB extends SyncCoreDb>(
 
   // WebSocket upgrade endpoint - using regular route since WebSocket doesn't fit OpenAPI well
   app.get('/', async (c) => {
+    if (!isWebSocketOriginAllowed(c, config.allowedOrigins)) {
+      return c.json({ error: 'FORBIDDEN_ORIGIN' }, 403);
+    }
+
     // Authenticate before upgrade
     const auth = await config.authenticate(c);
     if (!auth) {
@@ -132,10 +147,19 @@ export function createProxyRoutes<DB extends SyncCoreDb>(
 
       async onMessage(evt, ws) {
         try {
-          const data =
-            typeof evt.data === 'string'
-              ? evt.data
-              : new TextDecoder().decode(evt.data as ArrayBuffer);
+          const messageBytes = measureWebSocketMessageBytes(evt.data);
+          if (messageBytes > maxMessageBytes) {
+            ws.send(
+              JSON.stringify({
+                type: 'error',
+                error: `Message exceeds max size (${maxMessageBytes} bytes)`,
+              })
+            );
+            ws.close(1009, 'Message too large');
+            return;
+          }
+
+          const data = decodeWebSocketData(evt.data);
 
           const message = JSON.parse(data);
 
@@ -172,11 +196,7 @@ export function createProxyRoutes<DB extends SyncCoreDb>(
         } catch (err) {
           // Send error response if we can parse the message ID
           try {
-            const parsed = JSON.parse(
-              typeof evt.data === 'string'
-                ? evt.data
-                : new TextDecoder().decode(evt.data as ArrayBuffer)
-            );
+            const parsed = JSON.parse(decodeWebSocketData(evt.data));
             if (parsed.id) {
               ws.send(
                 JSON.stringify({
@@ -213,6 +233,50 @@ export function createProxyRoutes<DB extends SyncCoreDb>(
   return app;
 }
 
+function isWebSocketOriginAllowed(
+  c: Context,
+  allowedOrigins?: string[] | '*'
+): boolean {
+  if (!allowedOrigins) return true;
+  if (allowedOrigins === '*') return true;
+
+  const origin = c.req.header('origin');
+  if (!origin) return false;
+
+  try {
+    const normalizedOrigin = new URL(origin).origin;
+    return allowedOrigins.includes(normalizedOrigin);
+  } catch {
+    return false;
+  }
+}
+
+function measureWebSocketMessageBytes(data: unknown): number {
+  if (typeof data === 'string') {
+    return new TextEncoder().encode(data).byteLength;
+  }
+  if (data instanceof ArrayBuffer) {
+    return data.byteLength;
+  }
+  if (ArrayBuffer.isView(data)) {
+    return data.byteLength;
+  }
+  if (typeof Blob !== 'undefined' && data instanceof Blob) {
+    return data.size;
+  }
+  return new TextEncoder().encode(String(data)).byteLength;
+}
+
+function decodeWebSocketData(data: unknown): string {
+  if (typeof data === 'string') return data;
+  if (data instanceof ArrayBuffer) return new TextDecoder().decode(data);
+  if (ArrayBuffer.isView(data)) {
+    const view = data as Uint8Array;
+    return new TextDecoder().decode(view);
+  }
+  return String(data);
+}
+
 /**
  * Get the ProxyConnectionManager from a proxy routes instance.
  */