@syncular/server 0.1.2 → 0.2.0

package/src/subscriptions/resolve.ts

@@ -1,357 +0,0 @@
-import {
-  collectScopeVars,
-  type ScopeValues,
-  type SyncSubscriptionRequest,
-} from '@syncular/core';
-import type { Kysely } from 'kysely';
-import type { ServerHandlerCollection } from '../handlers/collection';
-import type { SyncServerAuth } from '../handlers/types';
-import type { SyncCoreDb } from '../schema';
-import { createDefaultScopeCacheKey, type ScopeCacheBackend } from './cache';
-
-export class InvalidSubscriptionScopeError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = 'InvalidSubscriptionScopeError';
-  }
-}
-
-/**
- * Resolved subscription with effective scopes.
- */
-export interface ResolvedSubscription {
-  id: string;
-  table: string;
-  scopes: ScopeValues;
-  params: Record<string, unknown> | undefined;
-  cursor: number;
-  bootstrapState?: SyncSubscriptionRequest['bootstrapState'];
-  verifiedRoot?: string;
-  crdtStateVectors: SyncSubscriptionRequest['crdtStateVectors'];
-  status: 'active' | 'revoked';
-}
-
-/**
- * Intersect requested scopes with allowed scopes.
- *
- * For each key in requested:
- * - If allowed has the same key, intersect the values
- * - If allowed doesn't have the key, exclude it (no access)
- *
- * Returns only keys where there's intersection.
- */
-function intersectScopes(
-  requested: ScopeValues,
-  allowed: ScopeValues
-): ScopeValues {
-  const result: ScopeValues = {};
-
-  for (const [key, reqValues] of Object.entries(requested)) {
-    const allowedValues = allowed[key];
-    if (allowedValues === undefined) {
-      // No access to this scope key
-      continue;
-    }
-
-    const reqArray = Array.isArray(reqValues) ? reqValues : [reqValues];
-    const allowedArray = Array.isArray(allowedValues)
-      ? allowedValues
-      : [allowedValues];
-
-    // Wildcard: allowed '*' means "allow any requested values for this key".
-    if (allowedArray.includes('*')) {
-      result[key] = reqValues;
-      continue;
-    }
-    const allowedSet = new Set(allowedArray);
-
-    // Intersect
-    const intersection = reqArray.filter((v) => allowedSet.has(v));
-
-    if (intersection.length > 0) {
-      // Keep as array if original was array, otherwise single value
-      result[key] =
-        intersection.length === 1 && !Array.isArray(reqValues)
-          ? intersection[0]!
-          : intersection;
-    }
-  }
-
-  return result;
-}
-
-/**
- * Check if scopes are empty (no effective scope values).
- */
-function scopesEmpty(scopes: ScopeValues): boolean {
-  for (const value of Object.values(scopes)) {
-    const arr = Array.isArray(value) ? value : [value];
-    if (arr.length > 0) return false;
-  }
-  return true;
-}
-
-function validateScopeKeys(args: {
-  scopeValues: ScopeValues;
-  validScopeKeys: Set<string>;
-  source: string;
-  subscriptionId: string;
-  table: string;
-}): void {
-  for (const scopeKey of Object.keys(args.scopeValues)) {
-    if (args.validScopeKeys.has(scopeKey)) {
-      continue;
-    }
-    const expectedKeys =
-      args.validScopeKeys.size > 0
-        ? Array.from(args.validScopeKeys).sort().join(', ')
-        : '(none)';
-    throw new InvalidSubscriptionScopeError(
-      `Invalid scope key "${scopeKey}" in ${args.source} for subscription "${args.subscriptionId}" on table "${args.table}". Expected keys: ${expectedKeys}`
-    );
-  }
-}
-
-/**
- * Resolve effective scopes for subscriptions.
- *
- * For each subscription:
- * 1. Look up the table handler by subscription.table
- * 2. Call handler.resolveScopes() to get allowed scopes for this actor
- * 3. Intersect requested scopes with allowed scopes
- * 4. Mark as revoked if no effective scopes
- */
-export async function resolveEffectiveScopesForSubscriptions<
-  DB extends SyncCoreDb,
-  Auth extends SyncServerAuth,
->(args: {
-  db: Kysely<DB>;
-  auth: Auth;
-  subscriptions: SyncSubscriptionRequest[];
-  handlers: ServerHandlerCollection<DB, Auth>;
-  scopeCache?: ScopeCacheBackend;
-}): Promise<ResolvedSubscription[]> {
-  const out: ResolvedSubscription[] = [];
-  const seenIds = new Set<string>();
-  const requestScopeCache = new Map<string, ScopeValues | null>();
-
-  for (const sub of args.subscriptions) {
-    if (!sub.id || typeof sub.id !== 'string') {
-      throw new InvalidSubscriptionScopeError('Subscription id is required');
-    }
-    if (seenIds.has(sub.id)) {
-      throw new InvalidSubscriptionScopeError(
-        `Duplicate subscription id: ${sub.id}`
-      );
-    }
-    seenIds.add(sub.id);
-
-    if (!sub.table || typeof sub.table !== 'string') {
-      throw new InvalidSubscriptionScopeError(
-        `Subscription ${sub.id} requires a table name`
-      );
-    }
-
-    const handler = args.handlers.byTable.get(sub.table);
-    if (!handler) {
-      throw new InvalidSubscriptionScopeError(
-        `Unknown table: ${sub.table} for subscription ${sub.id}`
-      );
-    }
-
-    const validScopeKeys = collectScopeVars(handler.scopePatterns);
-    const requested = sub.scopes ?? {};
-    validateScopeKeys({
-      scopeValues: requested,
-      validScopeKeys,
-      source: 'requested scopes',
-      subscriptionId: sub.id,
-      table: sub.table,
-    });
-
-    // Resolve allowed scopes with request-local memoization first, then
-    // optional shared cache backend, then table handler.
-    const scopeCacheKey = createDefaultScopeCacheKey({
-      auth: args.auth,
-      table: sub.table,
-    });
-    let allowed: ScopeValues | null;
-    if (requestScopeCache.has(scopeCacheKey)) {
-      allowed = requestScopeCache.get(scopeCacheKey) ?? null;
-    } else {
-      let resolveFailed = false;
-
-      const loadAllowedScopes = async (): Promise<ScopeValues> => {
-        try {
-          return await handler.resolveScopes({
-            db: args.db,
-            actorId: args.auth.actorId,
-            auth: args.auth,
-          });
-        } catch (resolveErr) {
-          resolveFailed = true;
-          console.error(
-            `[resolveScopes] Failed for table ${sub.table}, subscription ${sub.id}:`,
-            resolveErr
-          );
-          throw resolveErr;
-        }
-      };
-
-      if (args.scopeCache?.getOrResolve) {
-        try {
-          allowed = await args.scopeCache.getOrResolve({
-            db: args.db,
-            auth: args.auth,
-            table: sub.table,
-            cacheKey: scopeCacheKey,
-            load: loadAllowedScopes,
-          });
-        } catch {
-          allowed = null;
-        }
-      } else {
-        allowed = null;
-        let sharedCacheHit = false;
-
-        if (args.scopeCache) {
-          try {
-            const cachedAllowed = await args.scopeCache.get({
-              db: args.db,
-              auth: args.auth,
-              table: sub.table,
-              cacheKey: scopeCacheKey,
-            });
-            if (cachedAllowed !== null) {
-              allowed = cachedAllowed;
-              sharedCacheHit = true;
-            }
-          } catch (cacheErr) {
-            console.error(
-              `[scopeCache.get] Failed for table ${sub.table}, subscription ${sub.id}:`,
-              cacheErr
-            );
-          }
-        }
-
-        if (!sharedCacheHit) {
-          try {
-            allowed = await loadAllowedScopes();
-          } catch {
-            allowed = null;
-          }
-
-          if (args.scopeCache && allowed !== null) {
-            try {
-              await args.scopeCache.set({
-                db: args.db,
-                auth: args.auth,
-                table: sub.table,
-                cacheKey: scopeCacheKey,
-                scopes: allowed,
-              });
-            } catch (cacheErr) {
-              console.error(
-                `[scopeCache.set] Failed for table ${sub.table}, subscription ${sub.id}:`,
-                cacheErr
-              );
-            }
-          }
-        }
-      }
-
-      if (resolveFailed) {
-        requestScopeCache.set(scopeCacheKey, null);
-        out.push({
-          id: sub.id,
-          table: sub.table,
-          scopes: {},
-          params: sub.params,
-          cursor: sub.cursor,
-          bootstrapState: sub.bootstrapState ?? null,
-          verifiedRoot: sub.verifiedRoot,
-          crdtStateVectors: sub.crdtStateVectors,
-          status: 'revoked',
-        });
-        continue;
-      }
-
-      requestScopeCache.set(scopeCacheKey, allowed);
-    }
-
-    if (!allowed) {
-      out.push({
-        id: sub.id,
-        table: sub.table,
-        scopes: {},
-        params: sub.params,
-        cursor: sub.cursor,
-        bootstrapState: sub.bootstrapState ?? null,
-        verifiedRoot: sub.verifiedRoot,
-        crdtStateVectors: sub.crdtStateVectors,
-        status: 'revoked',
-      });
-      continue;
-    }
-
-    validateScopeKeys({
-      scopeValues: allowed,
-      validScopeKeys,
-      source: 'resolveScopes() result',
-      subscriptionId: sub.id,
-      table: sub.table,
-    });
-
-    // Intersect with requested scopes
-    const effective = intersectScopes(requested, allowed);
-
-    // If a requested scope key lost all access after intersection,
-    // treat the subscription as revoked to avoid partially-scoped leaks.
-    const missingRequestedKey = Object.keys(requested).some(
-      (key) => !Object.hasOwn(effective, key)
-    );
-    if (missingRequestedKey) {
-      out.push({
-        id: sub.id,
-        table: sub.table,
-        scopes: {},
-        params: sub.params,
-        cursor: sub.cursor,
-        bootstrapState: sub.bootstrapState ?? null,
-        verifiedRoot: sub.verifiedRoot,
-        crdtStateVectors: sub.crdtStateVectors,
-        status: 'revoked',
-      });
-      continue;
-    }
-
-    if (scopesEmpty(effective)) {
-      out.push({
-        id: sub.id,
-        table: sub.table,
-        scopes: {},
-        params: sub.params,
-        cursor: sub.cursor,
-        bootstrapState: sub.bootstrapState ?? null,
-        verifiedRoot: sub.verifiedRoot,
-        crdtStateVectors: sub.crdtStateVectors,
-        status: 'revoked',
-      });
-      continue;
-    }
-
-    out.push({
-      id: sub.id,
-      table: sub.table,
-      scopes: effective,
-      params: sub.params,
-      cursor: sub.cursor,
-      bootstrapState: sub.bootstrapState ?? null,
-      verifiedRoot: sub.verifiedRoot,
-      crdtStateVectors: sub.crdtStateVectors,
-      status: 'active',
-    });
-  }
-
-  return out;
-}

package/src/sync.ts

@@ -1,111 +0,0 @@
-import type {
-  ColumnCodecDialect,
-  ColumnCodecSource,
-  ScopeDefinition,
-} from '@syncular/core';
-import { registerTableOrThrow } from '@syncular/core';
-import {
-  type CreateServerHandlerOptions,
-  createServerHandler,
-} from './handlers';
-import type { ServerTableHandler, SyncServerAuth } from './handlers/types';
-import type { SyncServerPushPlugin } from './plugins/types';
-import type { SyncCoreDb } from './schema';
-
-type SharedTableName<ServerDB, ClientDB> = keyof ServerDB &
-  keyof ClientDB &
-  string;
-
-export type ServerSyncHandlerOptionsForTable<
-  ServerDB extends SyncCoreDb,
-  ClientDB,
-  TableName extends SharedTableName<ServerDB, ClientDB>,
-  Auth extends SyncServerAuth,
-  ScopeDefs extends readonly ScopeDefinition[],
-> = Omit<
-  CreateServerHandlerOptions<ServerDB, ClientDB, TableName, Auth, ScopeDefs>,
-  'codecs' | 'codecDialect'
->;
-
-export interface ServerSyncConfig<
-  ServerDB extends SyncCoreDb = SyncCoreDb,
-  Auth extends SyncServerAuth = SyncServerAuth,
-> {
-  authenticate: (request: Request) => Promise<Auth | null> | Auth | null;
-  handlers: ServerTableHandler<ServerDB, Auth>[];
-  plugins?: SyncServerPushPlugin<ServerDB, Auth>[];
-}
-
-export interface DefineServerSyncOptions<Auth extends SyncServerAuth> {
-  authenticate: (request: Request) => Promise<Auth | null> | Auth | null;
-  codecs?: ColumnCodecSource;
-  codecDialect?: ColumnCodecDialect;
-}
-
-export interface ServerSyncBuilder<
-  ServerDB extends SyncCoreDb,
-  ClientDB,
-  ScopeDefs extends readonly ScopeDefinition[],
-  Auth extends SyncServerAuth,
-> extends ServerSyncConfig<ServerDB, Auth> {
-  addHandler<TableName extends SharedTableName<ServerDB, ClientDB>>(
-    options: ServerSyncHandlerOptionsForTable<
-      ServerDB,
-      ClientDB,
-      TableName,
-      Auth,
-      ScopeDefs
-    >
-  ): this;
-
-  addPushPlugin(plugin: SyncServerPushPlugin<ServerDB, Auth>): this;
-}
-
-export function defineServerSync<
-  ServerDB extends SyncCoreDb,
-  ClientDB,
-  ScopeDefs extends readonly ScopeDefinition[],
-  Auth extends SyncServerAuth,
->(
-  options: DefineServerSyncOptions<Auth>
-): ServerSyncBuilder<ServerDB, ClientDB, ScopeDefs, Auth> {
-  const handlers: ServerTableHandler<ServerDB, Auth>[] = [];
-  const plugins: SyncServerPushPlugin<ServerDB, Auth>[] = [];
-  const registeredTables = new Set<string>();
-
-  const sync: ServerSyncBuilder<ServerDB, ClientDB, ScopeDefs, Auth> = {
-    authenticate: options.authenticate,
-    handlers,
-    plugins,
-    addHandler<TableName extends SharedTableName<ServerDB, ClientDB>>(
-      handlerOptions: ServerSyncHandlerOptionsForTable<
-        ServerDB,
-        ClientDB,
-        TableName,
-        Auth,
-        ScopeDefs
-      >
-    ) {
-      registerTableOrThrow(
-        registeredTables,
-        handlerOptions.table,
-        (table) => `Server table handler already registered: ${table}`
-      );
-
-      handlers.push(
-        createServerHandler({
-          ...handlerOptions,
-          codecs: options.codecs,
-          codecDialect: options.codecDialect,
-        })
-      );
-      return sync;
-    },
-    addPushPlugin(plugin: SyncServerPushPlugin<ServerDB, Auth>) {
-      plugins.push(plugin);
-      return sync;
-    },
-  };
-
-  return sync;
-}