@tldraw/sync-core 5.3.0-next.4123e97459a9 → 5.3.0-next.5cb71bb7e8fe

package/dist-cjs/lib/TLSyncRoom.js

@@ -109,14 +109,41 @@ class TLSyncRoom {
   storage;
   serializedSchema;
   documentTypes;
+  /**
+   * Record types served by the object-store lane. Object records ride the same wire messages
+   * as document records but are gated by the session's `objectAccess` instead of `isReadonly`,
+   * and are excluded from `documentTypes` so hosts can persist them in a separate lane.
+   */
+  objectTypes;
   presenceType;
   log;
   schema;
+  authorizeRecord;
   sessionIdleTimeout;
+  /**
+   * The authorizer registered for a record type, widened to the room's record union. Each entry in
+   * `authorizeRecord` is typed to its specific record; the cast here is the one place we can't
+   * statically correlate a runtime `typeName` with its record type, so it lives in the library
+   * rather than in every consumer.
+   */
+  authorizerFor(typeName) {
+    const authorize = this.authorizeRecord?.[typeName];
+    if (!authorize) return void 0;
+    return (args) => {
+      try {
+        return authorize(args);
+      } catch (e) {
+        this.log?.error?.("record authorizer threw; rejecting the write", e);
+        return null;
+      }
+    };
+  }
   constructor(opts) {
     this.schema = opts.schema;
     this.log = opts.log;
     this.onPresenceChange = opts.onPresenceChange;
+    this.onCommittedChanges = opts.onCommittedChanges;
+    this.authorizeRecord = opts.authorizeRecord;
     this.storage = opts.storage;
     this.sessionIdleTimeout = opts.clientTimeout ?? import_RoomSession.SESSION_IDLE_TIMEOUT;
     (0, import_utils.assert)(
@@ -124,8 +151,17 @@ class TLSyncRoom {
       "TLSyncRoom is supposed to run either on Cloudflare Workersor on a 18+ version of Node.js, which both support the native structuredClone API"
     );
     this.serializedSchema = JSON.parse(JSON.stringify(this.schema.serialize()));
+    this.objectTypes = new Set(opts.objectTypes ?? []);
+    for (const typeName of this.objectTypes) {
+      const type = (0, import_utils.getOwnProperty)(this.schema.types, typeName);
+      (0, import_utils.assert)(type, `TLSyncRoom: object type '${typeName}' is not registered in the schema`);
+      (0, import_utils.assert)(
+        type.scope === "document",
+        `TLSyncRoom: object type '${typeName}' must have scope 'document', got '${type.scope}'`
+      );
+    }
     this.documentTypes = new Set(
-      Object.values(this.schema.types).filter((t) => t.scope === "document").map((t) => t.typeName)
+      Object.values(this.schema.types).filter((t) => t.scope === "document" && !this.objectTypes.has(t.typeName)).map((t) => t.typeName)
     );
     const presenceTypes = new Set(
       Object.values(this.schema.types).filter((t) => t.scope === "presence")
@@ -136,6 +172,12 @@ class TLSyncRoom {
       );
     }
     this.presenceType = presenceTypes.values().next()?.value ?? null;
+    if (this.presenceType && this.authorizeRecord) {
+      (0, import_utils.assert)(
+        !(0, import_utils.getOwnProperty)(this.authorizeRecord, this.presenceType.typeName),
+        `TLSyncRoom: authorizeRecord['${this.presenceType.typeName}'] is a presence type; presence records are not authorized`
+      );
+    }
     const { documentClock } = this.storage.transaction((txn) => {
       this.schema.migrateStorage(txn);
     });
@@ -262,6 +304,7 @@ class TLSyncRoom {
       cancellationTime: Date.now(),
       meta: session.meta,
       isReadonly: session.isReadonly,
+      objectAccess: session.objectAccess,
       requiresLegacyRejection: session.requiresLegacyRejection,
       supportsStringAppend: session.supportsStringAppend
     });
@@ -353,7 +396,7 @@ class TLSyncRoom {
    * @internal
    */
   handleNewSession(opts) {
-    const { sessionId, socket, meta, isReadonly } = opts;
+    const { sessionId, socket, meta, isReadonly, objectAccess } = opts;
     const existing = this.sessions.get(sessionId);
     this.sessions.set(sessionId, {
       state: import_RoomSession.RoomSessionState.AwaitingConnectMessage,
@@ -363,6 +406,7 @@ class TLSyncRoom {
       sessionStartTime: Date.now(),
       meta,
       isReadonly: isReadonly ?? false,
+      objectAccess: objectAccess ?? "write",
       // this gets set later during handleConnectMessage
       requiresLegacyRejection: false,
       supportsStringAppend: true
@@ -382,6 +426,7 @@ class TLSyncRoom {
       socket,
       meta,
       isReadonly,
+      objectAccess,
       serializedSchema,
       presenceId,
       presenceRecord,
@@ -402,6 +447,7 @@ class TLSyncRoom {
       outstandingDataMessages: [],
       meta,
       isReadonly,
+      objectAccess: objectAccess ?? "write",
       requiresLegacyRejection,
       supportsStringAppend
     });
@@ -662,6 +708,7 @@ class TLSyncRoom {
         supportsStringAppend: session.supportsStringAppend,
         meta: session.meta,
         isReadonly: session.isReadonly,
+        objectAccess: session.objectAccess,
         requiresLegacyRejection: session.requiresLegacyRejection
       });
       this._unsafe_sendMessage(session.sessionId, msg);
@@ -706,7 +753,8 @@ class TLSyncRoom {
         schema: this.schema.serialize(),
         serverClock: txn.getClock(),
         diff: { ...presenceDiff.value, ...docDiff },
-        isReadonly: session.isReadonly
+        isReadonly: session.isReadonly,
+        objectAccess: session.objectAccess
       };
     });
     this.lastDocumentClock = documentClock;
@@ -740,13 +788,18 @@ class TLSyncRoom {
           (0, import_utils.exhaustiveSwitchError)(op[0]);
       }
     };
-    const addDocument = (storage, changes2, id, _state) => {
+    const addDocument = (storage, changes2, id, _state, authorize, prevDoc) => {
       const res = session ? this.schema.migratePersistedRecord(_state, session.serializedSchema, "up") : { type: "success", value: _state };
       if (res.type === "error") {
         throw new import_TLSyncClient.TLSyncError(res.reason, import_TLSyncClient.TLSyncErrorCloseEventReason.CLIENT_TOO_OLD);
       }
-      const { value: state } = res;
-      const doc = storage.get(id);
+      let { value: state } = res;
+      const doc = prevDoc !== void 0 ? prevDoc ?? void 0 : storage.get(id);
+      if (authorize) {
+        const result2 = authorize(doc ?? null, state);
+        if (!result2) return import_utils.Result.ok(void 0);
+        if (!doc) state = result2;
+      }
       if (doc) {
         const recordType = (0, import_utils.assertExists)((0, import_utils.getOwnProperty)(this.schema.types, doc.typeName));
         const diff = (0, import_recordDiff.diffAndValidateRecord)(doc, state, recordType);
@@ -762,8 +815,8 @@ class TLSyncRoom {
       }
       return import_utils.Result.ok(void 0);
     };
-    const patchDocument = (storage, changes2, id, patch) => {
-      const doc = storage.get(id);
+    const patchDocument = (storage, changes2, id, patch, authorize, prevDoc) => {
+      const doc = prevDoc ?? storage.get(id);
       if (!doc) return;
       const recordType = (0, import_utils.assertExists)((0, import_utils.getOwnProperty)(this.schema.types, doc.typeName));
       const downgraded = session ? this.schema.migratePersistedRecord(doc, session.serializedSchema, "down") : { type: "success", value: doc };
@@ -773,6 +826,7 @@ class TLSyncRoom {
       if (downgraded.value === doc) {
         const diff = (0, import_recordDiff.applyAndDiffRecord)(doc, patch, recordType, legacyAppendMode);
         if (diff) {
+          if (authorize && !authorize(doc, diff[1])) return;
           storage.set(id, diff[1]);
           propagateOp(changes2, id, [import_diff.RecordOpType.Patch, diff[0]], doc, diff[1]);
         }
@@ -784,6 +838,7 @@ class TLSyncRoom {
         }
         const diff = (0, import_recordDiff.diffAndValidateRecord)(doc, upgraded.value, recordType, legacyAppendMode);
         if (diff) {
+          if (authorize && !authorize(doc, upgraded.value)) return;
           storage.set(id, upgraded.value);
           propagateOp(changes2, id, [import_diff.RecordOpType.Patch, diff], doc, upgraded.value);
         }
@@ -818,21 +873,101 @@ class TLSyncRoom {
             }
           }
         }
-        if (message.diff && !session?.isReadonly) {
+        const canWrite = (typeName) => !session || (this.objectTypes.has(typeName) ? session.objectAccess !== "read" : !session.isReadonly);
+        if (message.diff) {
           for (const [id, op] of (0, import_utils.objectMapEntriesIterable)(message.diff)) {
             switch (op[0]) {
               case import_diff.RecordOpType.Put: {
-                if (!this.documentTypes.has(op[1].typeName)) {
+                if (!canWrite(op[1].typeName)) continue;
+                if (!this.documentTypes.has(op[1].typeName) && !this.objectTypes.has(op[1].typeName)) {
                   throw new import_TLSyncClient.TLSyncError(
                     "invalid record",
                     import_TLSyncClient.TLSyncErrorCloseEventReason.INVALID_RECORD
                   );
                 }
-                addDocument(txn, docChanges, id, op[1]);
+                const record = op[1];
+                const prevRecord = session ? txn.get(id) ?? null : void 0;
+                if (session && prevRecord && prevRecord.typeName !== record.typeName) {
+                  this.log?.warn?.(
+                    "skipping put that changes typeName",
+                    `${prevRecord.typeName} -> ${record.typeName}`,
+                    id,
+                    "session:",
+                    session.sessionId
+                  );
+                  continue;
+                }
+                let authorize;
+                if (session && this.authorizeRecord) {
+                  const authorizePut = this.authorizerFor(record.typeName);
+                  if (authorizePut) {
+                    authorize = (prevRec, next) => {
+                      const result2 = authorizePut(
+                        prevRec ? {
+                          session: {
+                            sessionId: session.sessionId,
+                            isReadonly: session.isReadonly,
+                            meta: session.meta
+                          },
+                          type: "update",
+                          prev: prevRec,
+                          next
+                        } : {
+                          session: {
+                            sessionId: session.sessionId,
+                            isReadonly: session.isReadonly,
+                            meta: session.meta
+                          },
+                          type: "create",
+                          prev: null,
+                          next
+                        }
+                      );
+                      if (!result2) {
+                        this.log?.warn?.(
+                          "authorizer vetoed put",
+                          record.typeName,
+                          id,
+                          "session:",
+                          session.sessionId
+                        );
+                        return null;
+                      }
+                      return prevRec ? next : result2;
+                    };
+                  }
+                }
+                addDocument(txn, docChanges, id, record, authorize, prevRecord);
                 break;
               }
               case import_diff.RecordOpType.Patch: {
-                patchDocument(txn, docChanges, id, op[1]);
+                const doc = txn.get(id);
+                if (!doc) continue;
+                if (!canWrite(doc.typeName)) continue;
+                const authorizePatch = session && this.authorizerFor(doc.typeName);
+                const authorize = authorizePatch ? (prev, next) => {
+                  const result2 = authorizePatch({
+                    session: {
+                      sessionId: session.sessionId,
+                      isReadonly: session.isReadonly,
+                      meta: session.meta
+                    },
+                    type: "update",
+                    prev,
+                    next
+                  });
+                  if (!result2) {
+                    this.log?.warn?.(
+                      "authorizer vetoed patch",
+                      doc.typeName,
+                      id,
+                      "session:",
+                      session.sessionId
+                    );
+                  }
+                  return result2;
+                } : void 0;
+                patchDocument(txn, docChanges, id, op[1], authorize, doc);
                 break;
               }
               case import_diff.RecordOpType.Remove: {
@@ -840,6 +975,27 @@ class TLSyncRoom {
                 if (!doc) {
                   continue;
                 }
+                if (!canWrite(doc.typeName)) continue;
+                const authorizeRemove = session && this.authorizerFor(doc.typeName);
+                if (authorizeRemove && !authorizeRemove({
+                  session: {
+                    sessionId: session.sessionId,
+                    isReadonly: session.isReadonly,
+                    meta: session.meta
+                  },
+                  type: "delete",
+                  prev: doc,
+                  next: null
+                })) {
+                  this.log?.warn?.(
+                    "authorizer vetoed delete",
+                    doc.typeName,
+                    id,
+                    "session:",
+                    session.sessionId
+                  );
+                  continue;
+                }
                 txn.delete(id);
                 propagateOp(docChanges, id, op, doc, void 0);
                 break;
@@ -914,6 +1070,16 @@ class TLSyncRoom {
         this.onPresenceChange?.();
       });
     }
+    if (result.docChanges.diffs && this.onCommittedChanges) {
+      const diff = result.docChanges.diffs.diff;
+      queueMicrotask(() => {
+        try {
+          this.onCommittedChanges?.({ diff, documentClock });
+        } catch (e) {
+          this.log?.error?.("onCommittedChanges threw", e);
+        }
+      });
+    }
   }
   /**
    * Handle the event when a client disconnects. Cleans up the session and