@tldraw/sync-core 5.3.0-internal.fba91ed55f6c → 5.3.0-next.030bf6014f04

package/src/lib/TLSyncRoom.ts

@@ -155,8 +155,10 @@ export interface RoomSnapshot {
  */
 export type TLRecordAuthorizer<Rec extends UnknownRecord, SessionMeta> = (
 	args: {
-		/** The session performing the write, including its host-provided `meta` (e.g. the authenticated user id). */
-		session: { sessionId: string; meta: SessionMeta }
+		/** The session performing the write: its host-provided `meta` (e.g. the authenticated user
+		 *  id) and the canvas-lane `isReadonly` state, for hosts whose object-lane policy follows
+		 *  canvas access. */
+		session: { sessionId: string; isReadonly: boolean; meta: SessionMeta }
 	} & (
 		| { type: 'create'; prev: null; next: Rec }
 		| { type: 'update'; prev: Rec; next: Rec }
@@ -1181,7 +1183,10 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 			changes: ActualChanges,
 			id: string,
 			_state: R,
-			authorize?: (prev: R | null, next: R) => R | null
+			authorize?: (prev: R | null, next: R) => R | null,
+			// The existing document if the caller already fetched it; `null` for fetched-and-absent,
+			// `undefined` for not fetched. Saves a second SELECT + JSON.parse on the push hot path.
+			prevDoc?: R | null
 		): Result<void, void> => {
 			const res = session
 				? this.schema.migratePersistedRecord(_state, session.serializedSchema, 'up')
@@ -1192,7 +1197,8 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 			let { value: state } = res
 
 			// Get the existing document, if any
-			const doc = storage.get(id) as R | undefined
+			const doc =
+				prevDoc !== undefined ? (prevDoc ?? undefined) : (storage.get(id) as R | undefined)
 
 			// Authorize on the up-migrated record; on create the authorizer's return is stored as-is,
 			// so no later migration can clobber stamped fields.
@@ -1229,10 +1235,12 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 			changes: ActualChanges,
 			id: string,
 			patch: ObjectDiff,
-			authorize?: (prev: R, next: R) => R | null
+			authorize?: (prev: R, next: R) => R | null,
+			// The existing document if the caller already fetched it (see `addDocument`).
+			prevDoc?: R
 		) => {
 			// if it was already deleted, there's no need to apply the patch
-			const doc = storage.get(id) as R | undefined
+			const doc = prevDoc ?? (storage.get(id) as R | undefined)
 			if (!doc) return
 
 			const recordType = assertExists(getOwnProperty(this.schema.types, doc.typeName))
@@ -1343,38 +1351,51 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 									)
 								}
 								const record = op[1]
+								// A put must not change the record's typeName. Two reasons, and the first
+								// applies whether or not authorizers are configured: the write gate above
+								// keyed off the *incoming* typeName, so a swap between lanes (document <->
+								// object) would let a session denied on one lane write through the other by
+								// relabeling an existing record. The second is that the authorizer lookup
+								// also keys off the incoming typeName while the replace path validates
+								// against the stored one, so a swap would consult the wrong authorizer (or
+								// none). Skip it like a veto; the client self-corrects.
+								// `undefined` (no session) means the guard didn't fetch, so addDocument will.
+								const prevRecord = session ? ((txn.get(id) as R | undefined) ?? null) : undefined
+								if (session && prevRecord && prevRecord.typeName !== record.typeName) {
+									this.log?.warn?.(
+										'skipping put that changes typeName',
+										`${prevRecord.typeName} -> ${record.typeName}`,
+										id,
+										'session:',
+										session.sessionId
+									)
+									continue
+								}
 								// Per-type authorizer: stamp/veto the write from the session's identity.
 								// Client pushes only; runs inside `addDocument`, on the up-migrated record.
 								let authorize: ((prev: R | null, next: R) => R | null) | undefined
 								if (session && this.authorizeRecord) {
-									const prev = (txn.get(id) as R | undefined) ?? null
-									// A put must not change the record's typeName: the authorizer lookup keys
-									// off the incoming typeName while the replace path validates against the
-									// stored one, so a swap would consult the wrong authorizer (or none).
-									// Skip it like a veto; the client self-corrects.
-									if (prev && prev.typeName !== record.typeName) {
-										this.log?.warn?.(
-											'skipping put that changes typeName',
-											`${prev.typeName} -> ${record.typeName}`,
-											id,
-											'session:',
-											session.sessionId
-										)
-										continue
-									}
 									const authorizePut = this.authorizerFor(record.typeName)
 									if (authorizePut) {
 										authorize = (prevRec, next) => {
 											const result = authorizePut(
 												prevRec
 													? {
-															session: { sessionId: session.sessionId, meta: session.meta },
+															session: {
+																sessionId: session.sessionId,
+																isReadonly: session.isReadonly,
+																meta: session.meta,
+															},
 															type: 'update',
 															prev: prevRec,
 															next,
 														}
 													: {
-															session: { sessionId: session.sessionId, meta: session.meta },
+															session: {
+																sessionId: session.sessionId,
+																isReadonly: session.isReadonly,
+																meta: session.meta,
+															},
 															type: 'create',
 															prev: null,
 															next,
@@ -1395,7 +1416,8 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 										}
 									}
 								}
-								addDocument(txn, docChanges, id, record, authorize)
+								// The guard above already fetched this, so don't hit storage again.
+								addDocument(txn, docChanges, id, record, authorize, prevRecord)
 								break
 							}
 							case RecordOpType.Patch: {
@@ -1409,7 +1431,11 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 								const authorize = authorizePatch
 									? (prev: R, next: R) => {
 											const result = authorizePatch({
-												session: { sessionId: session.sessionId, meta: session.meta },
+												session: {
+													sessionId: session.sessionId,
+													isReadonly: session.isReadonly,
+													meta: session.meta,
+												},
 												type: 'update',
 												prev,
 												next,
@@ -1426,8 +1452,9 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 											return result
 										}
 									: undefined
-								// Try to patch the document. If it fails, stop here.
-								patchDocument(txn, docChanges, id, op[1], authorize)
+								// Try to patch the document. If it fails, stop here. The write gate above
+								// already fetched the record, so pass it through.
+								patchDocument(txn, docChanges, id, op[1], authorize, doc)
 								break
 							}
 							case RecordOpType.Remove: {
@@ -1443,7 +1470,11 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 								if (
 									authorizeRemove &&
 									!authorizeRemove({
-										session: { sessionId: session.sessionId, meta: session.meta },
+										session: {
+											sessionId: session.sessionId,
+											isReadonly: session.isReadonly,
+											meta: session.meta,
+										},
 										type: 'delete',
 										prev: doc,
 										next: null,

package/src/lib/TLSyncStorage.ts

@@ -92,6 +92,13 @@ export interface TLSyncStorage<R extends UnknownRecord> {
 	 * `RoomSnapshot['documents']` so a lane can be persisted and re-seeded via a merged snapshot.
 	 */
 	getObjectsSnapshot?(): RoomSnapshot['documents']
+
+	/**
+	 * The same entries for the given ids, for callers that need a handful of records rather than the
+	 * whole (parsed) lane. Ids with no object-lane record are omitted — document-lane ids included —
+	 * and duplicates yield one entry.
+	 */
+	getObjectsByIds?(ids: Iterable<string>): RoomSnapshot['documents']
 }
 
 /**

package/src/test/objectStore.test.ts

@@ -85,7 +85,7 @@ function makeRoom(
 		onCommittedChanges?(args: { diff: any; documentClock: number }): void
 		authorizeRecord?: {
 			[typeName: string]: (args: {
-				session: { sessionId: string; meta: any }
+				session: { sessionId: string; isReadonly: boolean; meta: any }
 				type: 'create' | 'update' | 'delete'
 				prev: any
 				next: any
@@ -436,6 +436,26 @@ describe('object store lane', () => {
 		const storedNote = (storage: InMemorySyncStorage<R>, id: string) =>
 			storage.getObjectsSnapshot().find((d) => d.state.id === id)?.state as any
 
+		it('exposes the session isReadonly flag to the authorizer', () => {
+			const authorize = vi.fn(({ next }: any) => next)
+			const { room } = withNote(authorize)
+			// a canvas-readonly session can still write the object lane (objectAccess defaults to
+			// 'write'), which is exactly why authorizers need to see isReadonly independently
+			connectSession(room, 'reader', { isReadonly: true, meta: { userId: 'u' } })
+
+			const note = Note.create({ text: 'x' })
+			push(room, 'reader', { [note.id]: [RecordOpType.Put, note] })
+
+			expect(authorize.mock.calls[0][0].session.isReadonly).toBe(true)
+
+			authorize.mockClear()
+			connectSession(room, 'writer', { isReadonly: false, meta: { userId: 'u' } })
+			const note2 = Note.create({ text: 'y' })
+			push(room, 'writer', { [note2.id]: [RecordOpType.Put, note2] })
+
+			expect(authorize.mock.calls[0][0].session.isReadonly).toBe(false)
+		})
+
 		it('stamps a created record from the session, overriding the client value', () => {
 			const { room, storage } = withNote(authorizeNote)
 			const socket = connectSession(room, 'alice', { meta: { userId: 'user-alice' } })
@@ -561,6 +581,35 @@ describe('object store lane', () => {
 			expect(storedNote(storage, note.id)?.typeName).toBe('note')
 		})
 
+		// The typeName guard must not depend on authorizers being configured: the write gate keys
+		// off the *incoming* typeName, so relabeling an existing object-lane record as a document
+		// type would otherwise let an objectAccess:'read' session write through the document lane.
+		it('vetoes a typeName swap even with no authorizeRecord configured', () => {
+			const note = Note.create({ text: 'by:user-alice' })
+			const { room, storage } = makeRoom({
+				objectTypes: ['note'],
+				snapshot: {
+					documents: [{ state: note, lastChangedClock: 0 }],
+					clock: 0,
+					documentClock: 0,
+					schema: schema.serialize(),
+				},
+			})
+			// denied on the object lane, but allowed on the document lane
+			const socket = connectSession(room, 'mallory', {
+				objectAccess: 'read',
+				meta: { userId: 'user-mallory' },
+			})
+
+			push(room, 'mallory', {
+				[note.id]: [RecordOpType.Put, { id: note.id, typeName: 'doc', title: 'swapped' } as any],
+			})
+
+			expect(lastPushResult(socket)).toMatchObject({ action: 'discard' })
+			expect(storedNote(storage, note.id)?.typeName).toBe('note')
+			expect(storedNote(storage, note.id)?.text).toBe('by:user-alice')
+		})
+
 		it('vetoes a put over an existing record that changes an immutable field', () => {
 			const { room, storage, note } = seededWithNote(authorizeNote)
 			const socket = connectSession(room, 'mallory', { meta: { userId: 'user-mallory' } })

package/src/test/storageContractSuite.ts

@@ -128,6 +128,28 @@ export function registerStorageContractTests(factory: StorageContractFactory) {
 				})
 			})
 
+			it('returns targeted object-lane entries by id from getObjectsByIds', () => {
+				const storage = createPartitioned(makeContractSnapshot(contractRecords))
+				const newPage = makePage('lane')
+				storage.transaction((txn) => txn.set(newPage.id, newPage))
+
+				const pageId = contractRecords[1].id
+				const entries = storage.getObjectsByIds!([newPage.id, pageId])
+				expect(entries.map((d) => d.state.id).sort()).toEqual([newPage.id, pageId].sort())
+				// same entry shape as getObjectsSnapshot: state + lastChangedClock
+				const laneEntry = entries.find((d) => d.state.id === newPage.id)!
+				expect(laneEntry.state).toEqual(newPage)
+				expect(laneEntry.lastChangedClock).toBe(storage.getClock())
+
+				// unknown ids and document-lane ids are omitted; duplicates yield one entry
+				expect(storage.getObjectsByIds!(['page:nope', TLDOCUMENT_ID])).toEqual([])
+				expect(storage.getObjectsByIds!([newPage.id, newPage.id]).length).toBe(1)
+
+				// a deleted record stops being returned
+				storage.transaction((txn) => txn.delete(newPage.id))
+				expect(storage.getObjectsByIds!([newPage.id])).toEqual([])
+			})
+
 			it('round-trips through a merged snapshot (persist lanes separately, re-seed together)', () => {
 				const storage = createPartitioned(makeContractSnapshot(contractRecords))
 				const merged = {