@tldraw/sync-core 5.5.0-canary.d0d1c4dfcd91 → 5.5.0-canary.d112bdaa69ee

package/src/lib/TLSyncClient.ts

@@ -122,6 +122,8 @@ export const TLSyncErrorCloseEventReason = {
 	RATE_LIMITED: 'RATE_LIMITED',
 	/** Room has reached maximum capacity */
 	ROOM_FULL: 'ROOM_FULL',
+	/** A single message exceeded the size the server will assemble */
+	MESSAGE_TOO_LARGE: 'MESSAGE_TOO_LARGE',
 } as const
 
 /**

package/src/lib/TLSyncRoom.ts

@@ -88,6 +88,29 @@ export const DATA_MESSAGE_DEBOUNCE_INTERVAL = 1000 / 60
 
 const timeSince = (time: number) => Date.now() - time
 
+// WebSocket close frames cap the reason at 123 UTF-8 bytes; a longer one makes `close()` throw
+const MAX_CLOSE_REASON_BYTES = 123
+const closeReasonEncoder = new TextEncoder()
+
+const truncatedSuffix = (droppedBytes: number) => `... (+${droppedBytes} bytes)`
+
+function truncateCloseReason(reason: string) {
+	const totalBytes = closeReasonEncoder.encode(reason).length
+	if (totalBytes <= MAX_CLOSE_REASON_BYTES) return reason
+	// the dropped count can't have more digits than the total, so reserving room for it always fits
+	const budget = MAX_CLOSE_REASON_BYTES - truncatedSuffix(totalBytes).length
+	let out = ''
+	let outBytes = 0
+	// step by code point so a multi-byte character is never cut in half
+	for (const char of reason) {
+		const charBytes = closeReasonEncoder.encode(char).length
+		if (outBytes + charBytes > budget) break
+		out += char
+		outBytes += charBytes
+	}
+	return out + truncatedSuffix(totalBytes - outBytes)
+}
+
 /**
  * Snapshot of a room's complete state that can be persisted and restored.
  * Contains all documents, tombstones, and metadata needed to reconstruct the room.
@@ -559,7 +582,8 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 
 		try {
 			if (fatalReason) {
-				session.socket.close(TLSyncErrorCloseEventCode, fatalReason)
+				// the session is already gone, so a throwing close() would leave its socket open
+				session.socket.close(TLSyncErrorCloseEventCode, truncateCloseReason(fatalReason))
 			} else {
 				session.socket.close()
 			}
@@ -941,7 +965,8 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 	 * Sends appropriate error messages before closing the connection.
 	 *
 	 * @param sessionId - The session to reject
-	 * @param fatalReason - The reason for rejection (optional)
+	 * @param fatalReason - The reason for rejection (optional). WebSocket close reasons are capped
+	 * at 123 UTF-8 bytes, so a longer reason is truncated and ends with `... (+N bytes)`.
 	 * @example
 	 * ```ts
 	 * // Reject due to version mismatch
@@ -998,6 +1023,10 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 
 	private forceAllReconnect() {
 		for (const session of this.sessions.values()) {
+			// Only connected clients hold state at a clock we can no longer diff from. A session
+			// mid-handshake gets hydrated from its own lastServerClock in the same transaction, so
+			// removing it would close its socket and then re-add it as Connected (resurrected).
+			if (session.state !== RoomSessionState.Connected) continue
 			this.removeSession(session.sessionId)
 		}
 	}
@@ -1091,7 +1120,7 @@ export class TLSyncRoom<R extends UnknownRecord, SessionMeta> {
 
 		const requiresDownMigrations = migrations.value.length > 0
 
-		const connect = async (msg: Extract<TLSocketServerSentEvent<R>, { type: 'connect' }>) => {
+		const connect = (msg: Extract<TLSocketServerSentEvent<R>, { type: 'connect' }>) => {
 			this.sessions.set(session.sessionId, {
 				state: RoomSessionState.Connected,
 				sessionId: session.sessionId,

package/src/lib/chunk.test.ts

@@ -1,5 +1,11 @@
 import { assert } from 'tldraw'
-import { JsonChunkAssembler, chunk } from './chunk'
+import {
+	JsonChunkAssembler,
+	MAX_ASSEMBLED_MESSAGE_CHARS,
+	MAX_CHUNK_COUNT,
+	MessageTooLargeError,
+	chunk,
+} from './chunk'
 
 describe('chunk (CH1–CH3)', () => {
 	describe('size boundary (CH1)', () => {
@@ -403,4 +409,51 @@ describe('JsonChunkAssembler (CH4–CH8)', () => {
 			})
 		})
 	})
+
+	describe('assembly bounds (CH10)', () => {
+		it('[CH10] rejects a first chunk declaring more than MAX_CHUNK_COUNT chunks', () => {
+			const unchunker = new JsonChunkAssembler()
+
+			const result = unchunker.handleMessage(`${MAX_CHUNK_COUNT}_{"a":`)
+			expect(result).toMatchObject({
+				error: expect.objectContaining({ message: `Too many chunks: ${MAX_CHUNK_COUNT + 1}` }),
+			})
+			expect(unchunker.state).toBe('idle')
+		})
+
+		it('[CH10] accepts a declared count at the limit', () => {
+			const unchunker = new JsonChunkAssembler()
+
+			expect(unchunker.handleMessage(`${MAX_CHUNK_COUNT - 1}_{"a":`)).toBeNull()
+			expect(unchunker.state).not.toBe('idle')
+		})
+
+		it('[CH10] rejects an assembly once its accumulated bodies pass MAX_ASSEMBLED_MESSAGE_CHARS', () => {
+			const unchunker = new JsonChunkAssembler()
+			// A chunk stream that never sends its final chunk. Before CH10 this accumulated
+			// without limit for as long as the sender kept sending.
+			const body = 'x'.repeat(1024 * 1024)
+			const chunksNeeded = Math.ceil(MAX_ASSEMBLED_MESSAGE_CHARS / body.length) + 1
+
+			let result = null
+			for (let i = 0; i < chunksNeeded; i++) {
+				result = unchunker.handleMessage(`${chunksNeeded - i}_${body}`)
+				if (result) break
+			}
+
+			expect(result).toMatchObject({ error: expect.any(MessageTooLargeError) })
+			expect(unchunker.state).toBe('idle')
+		})
+
+		it('[CH10] leaves the assembler usable after rejecting an oversized assembly', () => {
+			const unchunker = new JsonChunkAssembler()
+			const body = 'x'.repeat(1024 * 1024)
+			const chunksNeeded = Math.ceil(MAX_ASSEMBLED_MESSAGE_CHARS / body.length) + 1
+			for (let i = 0; i < chunksNeeded; i++) {
+				if (unchunker.handleMessage(`${chunksNeeded - i}_${body}`)) break
+			}
+
+			expect(unchunker.handleMessage('{"test": true}')).toMatchObject({ data: { test: true } })
+		})
+	})
 })

package/src/lib/chunk.ts

@@ -8,6 +8,35 @@ const MAX_BYTES_PER_CHAR = 4
 // in the (admittedly impossible) worst case, the max size is 1/4 of a megabyte
 const MAX_SAFE_MESSAGE_SIZE = MAX_CLIENT_SENT_MESSAGE_SIZE_BYTES / MAX_BYTES_PER_CHAR
 
+// JsonChunkAssembler holds every chunk of a message until the last one arrives, and the sender
+// decides how many that is — the count is just a prefix on the first chunk. Nothing in the
+// protocol obliges a sender to ever send the last chunk, so without a ceiling a single connection
+// can make the receiver hold an arbitrarily large buffer for as long as the socket stays open.
+//
+// The cap counts UTF-16 code units, which is what a JS string costs in memory: 16M of them is the
+// 32MB of retained string data a room can afford to hold per session and stay inside a Durable
+// Object's 128MB instance limit with room for the document itself. It is far above anything
+// chunk() produces for a real document push. The character cap is the real bound; the chunk-count
+// cap only rejects an absurd declared count on arrival instead of waiting for the characters to
+// accumulate, and is loose enough not to constrain a sender that chunks more finely than the
+// default.
+export const MAX_ASSEMBLED_MESSAGE_CHARS = 16 * 1024 * 1024
+export const MAX_CHUNK_COUNT = 100_000
+
+/**
+ * Thrown when a message would exceed MAX_ASSEMBLED_MESSAGE_CHARS, on either side of the wire.
+ * Distinct from the other assembly errors because it is fatal: retrying sends the same
+ * oversized message, so the session is rejected rather than reset.
+ *
+ * @internal
+ */
+export class MessageTooLargeError extends Error {
+	constructor(chars: number) {
+		super(`Message too large: ${chars} characters, max ${MAX_ASSEMBLED_MESSAGE_CHARS}`)
+		this.name = 'MessageTooLargeError'
+	}
+}
+
 /**
  * Splits a string into smaller chunks suitable for transmission over WebSockets.
  * This function ensures messages don't exceed size limits imposed by platforms like Cloudflare Workers (1MB max).
@@ -100,6 +129,7 @@ export class JsonChunkAssembler {
 		| {
 				chunksReceived: string[]
 				totalChunks: number
+				charsReceived: number
 		  } = 'idle'
 
 	/**
@@ -110,7 +140,8 @@ export class JsonChunkAssembler {
 	 * @param msg - The message to process, either JSON or chunk format
 	 * @returns Result object with data/stringified on success, error object on failure, or null for incomplete chunks
 	 * 	- `\{ data: object, stringified: string \}` - Successfully parsed complete message
-	 * 	- `\{ error: Error \}` - Parse error or invalid chunk sequence
+	 * 	- `\{ error: Error \}` - Parse error, invalid chunk sequence, or a message exceeding
+	 * 	  MAX_ASSEMBLED_MESSAGE_CHARS / MAX_CHUNK_COUNT
 	 * 	- `null` - Chunk received but more chunks expected
 	 *
 	 * @example
@@ -144,17 +175,30 @@ export class JsonChunkAssembler {
 			const data = match[2]
 
 			if (this.state === 'idle') {
+				const totalChunks = numChunksRemaining + 1
+				if (totalChunks > MAX_CHUNK_COUNT) {
+					// Nothing has been buffered yet, so the state is already idle.
+					return { error: new Error(`Too many chunks: ${totalChunks}`) }
+				}
 				this.state = {
 					chunksReceived: [data],
-					totalChunks: numChunksRemaining + 1,
+					totalChunks,
+					charsReceived: data.length,
 				}
 			} else {
 				this.state.chunksReceived.push(data)
+				this.state.charsReceived += data.length
 				if (numChunksRemaining !== this.state.totalChunks - this.state.chunksReceived.length) {
 					this.state = 'idle'
 					return { error: new Error(`Chunks received in wrong order`) }
 				}
 			}
+			if (this.state.charsReceived > MAX_ASSEMBLED_MESSAGE_CHARS) {
+				// Drop what was buffered rather than keeping it until the socket closes.
+				const charsReceived = this.state.charsReceived
+				this.state = 'idle'
+				return { error: new MessageTooLargeError(charsReceived) }
+			}
 			if (this.state.chunksReceived.length === this.state.totalChunks) {
 				try {
 					const stringified = this.state.chunksReceived.join('')

package/src/test/TLSocketRoom.test.ts

@@ -21,6 +21,7 @@ import {
 	ZERO_INDEX_KEY,
 } from 'tldraw'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { MAX_ASSEMBLED_MESSAGE_CHARS } from '../lib/chunk'
 import { RecordOpType } from '../lib/diff'
 import { DEFAULT_INITIAL_SNAPSHOT, InMemorySyncStorage } from '../lib/InMemorySyncStorage'
 import { getTlsyncProtocolVersion } from '../lib/protocol'
@@ -210,6 +211,45 @@ describe('28. TLSocketRoom (SR)', () => {
 			consoleSpy.mockRestore()
 		})
 
+		it('[SR3] the default logger also reaches TLSyncRoom, so authorizer failures are reported', () => {
+			const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+			try {
+				const room = new TLSocketRoom({
+					authorizeRecord: {
+						page: () => {
+							throw new Error('authorizer exploded')
+						},
+					},
+				})
+				const socket = createMockSocket()
+				connectSession(room, 'test-session', socket)
+
+				const pageId = PageRecordType.createId('new-page')
+				room.handleSocketMessage(
+					'test-session',
+					JSON.stringify({
+						type: 'push',
+						clientClock: 1,
+						diff: {
+							[pageId]: [
+								RecordOpType.Put,
+								PageRecordType.create({ id: pageId, name: 'New Page', index: 'a2' as any }),
+							],
+						},
+					})
+				)
+
+				// the authorizer threw, and the host heard about it without passing a logger
+				expect(room.getRecord(pageId)).toBeUndefined()
+				expect(consoleSpy).toHaveBeenCalledWith(
+					'record authorizer threw; rejecting the write',
+					expect.objectContaining({ message: 'authorizer exploded' })
+				)
+			} finally {
+				consoleSpy.mockRestore()
+			}
+		})
+
 		it('[SR3] uses custom logger when provided', () => {
 			const mockLog: TLSyncLog = {
 				warn: vi.fn(),
@@ -353,6 +393,29 @@ describe('28. TLSocketRoom (SR)', () => {
 			expect(room.getSessions()[0].isConnected).toBe(false)
 		})
 
+		it('[SR5] rejects the session when an assembly exceeds the size cap', () => {
+			const log: TLSyncLog = { warn: vi.fn(), error: vi.fn() }
+			const room = new TLSocketRoom({ log })
+			const socket = createMockSocket()
+			connectSession(room, 'test-session', socket)
+
+			// A chunk stream that never sends its last chunk. Unlike the other assembly errors
+			// this one is fatal: a reconnecting client would re-send the same oversized message.
+			const body = 'x'.repeat(1024 * 1024)
+			const chunksNeeded = Math.ceil(MAX_ASSEMBLED_MESSAGE_CHARS / body.length) + 1
+			for (let i = 0; i < chunksNeeded; i++) {
+				room.handleSocketMessage('test-session', `${chunksNeeded - i}_${body}`)
+				if ((log.error as any).mock.calls.length) break
+			}
+
+			expect(log.error).toHaveBeenCalledWith('Error assembling message', expect.anything())
+			expect(socket.close).toHaveBeenCalledWith(
+				TLSyncErrorCloseEventCode,
+				TLSyncErrorCloseEventReason.MESSAGE_TOO_LARGE
+			)
+			expect(room.getSessions()).toHaveLength(0)
+		})
+
 		it('[SR5] rejects the session with UNKNOWN_ERROR when message handling throws', () => {
 			const log: TLSyncLog = { warn: vi.fn(), error: vi.fn() }
 			const room = new TLSocketRoom({ log })

package/src/test/TLSyncRoom.test.ts

@@ -1019,6 +1019,52 @@ describe('23. Connect handshake (HS)', () => {
 		expect(room.sessions.get('current-client-session')?.state).toBe(RoomSessionState.Connected)
 		expect(socket.__lastMessage?.type).toBe('connect')
 	})
+
+	it('[RC5][HS6] a wipeAll during a handshake closes connected sessions but hydrates the connecting one', async () => {
+		const { room, storage } = makeRoom()
+		const socketA = connectSession(room, 'a')
+		const removed = vi.fn()
+		room.events.on('session_removed', removed)
+
+		// 'b' has opened its socket but not yet sent its connect message
+		const socketB = makeSocket()
+		room.handleNewSession({ sessionId: 'b', socket: socketB, meta: undefined, isReadonly: false })
+
+		// the room hasn't seen this change yet because the storage notifies on a microtask
+		const newPage = makePage('wipe_page', 'Wipe Page')
+		storage.transaction((txn) => {
+			txn.set(newPage.id, newPage)
+		})
+		storage.tombstoneHistoryStartsAtClock.set(storage.getClock())
+
+		// the handshake's own transaction runs broadcastChanges first and hits the wipeAll
+		room.handleMessage('b', {
+			type: 'connect',
+			connectRequestId: 'connect-b',
+			lastServerClock: 0,
+			protocolVersion: getTlsyncProtocolVersion(),
+			schema: room.serializedSchema,
+		} satisfies TLConnectRequest)
+
+		expect(socketA.close).toHaveBeenCalled()
+		expect(room.sessions.has('a')).toBe(false)
+
+		expect(socketB.close).not.toHaveBeenCalled()
+		expect(room.sessions.get('b')?.state).toBe(RoomSessionState.Connected)
+		expect(socketB.__messages).toHaveLength(1)
+		const connectMessage = socketB.__lastMessage as Extract<
+			TLSocketServerSentEvent<any>,
+			{ type: 'connect' }
+		>
+		expect(connectMessage.type).toBe('connect')
+		expect(connectMessage.hydrationType).toBe('wipe_all')
+		expect(connectMessage.diff[newPage.id]).toEqual(['put', newPage])
+
+		await Promise.resolve()
+		await Promise.resolve()
+		expect(removed.mock.calls.map(([e]) => e.sessionId)).toEqual(['a'])
+		expect(room.sessions.has('b')).toBe(true)
+	})
 })
 
 describe('24. Push handling (RP)', () => {
@@ -2340,6 +2386,31 @@ describe('26. Session lifecycle (SES)', () => {
 		expect(room.sessions.size).toBe(0)
 	})
 
+	it('[SES4] a reason longer than 123 UTF-8 bytes is truncated on a code-point boundary with a dropped-bytes suffix', () => {
+		const { room } = makeRoom()
+
+		const exact = connectSession(room, 'exact')
+		room.rejectSession('exact', 'x'.repeat(123))
+		expect(exact.close).toHaveBeenCalledWith(TLSyncErrorCloseEventCode, 'x'.repeat(123))
+
+		// '... (+200 bytes)' reserves 16 bytes, leaving 107 for the reason
+		const ascii = connectSession(room, 'ascii')
+		room.rejectSession('ascii', 'x'.repeat(200))
+		expect(ascii.close).toHaveBeenCalledWith(
+			TLSyncErrorCloseEventCode,
+			'x'.repeat(107) + '... (+93 bytes)'
+		)
+
+		// 161 bytes in, 107 to fill: 1 + 26 × 4 = 105, and a 27th 4-byte character is dropped whole
+		const emoji = connectSession(room, 'emoji')
+		room.rejectSession('emoji', 'x' + '\u{1F600}'.repeat(40))
+		expect(emoji.close).toHaveBeenCalledWith(
+			TLSyncErrorCloseEventCode,
+			'x' + '\u{1F600}'.repeat(26) + '... (+56 bytes)'
+		)
+		expect(room.sessions.size).toBe(0)
+	})
+
 	it('[HS2][SES5] sets supportsStringAppend to false for protocol version 7', () => {
 		const { room } = makeRoom()
 		connectSession(room, 'v7-session', { protocolVersion: 7 })

package/src/test/objectStore.test.ts

@@ -8,6 +8,7 @@ import {
 	TLSocketServerSentEvent,
 	getTlsyncProtocolVersion,
 } from '../lib/protocol'
+import { TLSocketRoom } from '../lib/TLSocketRoom'
 import { TLSyncErrorCloseEventCode, TLSyncErrorCloseEventReason } from '../lib/TLSyncClient'
 import { RoomSnapshot, TLRoomSocket, TLSyncRoom } from '../lib/TLSyncRoom'
 
@@ -354,6 +355,40 @@ describe('object store lane', () => {
 			const connectMsg = late.__messages.find((m: any) => m.type === 'connect') as any
 			expect(Object.keys(connectMsg.diff).sort()).toEqual([doc.id, note.id].sort())
 		})
+
+		it('[US1][US3] updateStore sees and can delete object-lane records', async () => {
+			// eslint-disable-next-line @typescript-eslint/no-deprecated
+			const socketRoom = new TLSocketRoom<R, void>({
+				schema,
+				storage: new InMemorySyncStorage<R>({
+					snapshot: { documents: [], clock: 0, documentClock: 0, schema: schema.serialize() },
+					objectTypes: ['note'],
+				}),
+				objectTypes: ['note'],
+			})
+			disposables.push(() => socketRoom.close())
+			const doc = Doc.create({ title: 'canvas' })
+			const note = Note.create({ text: 'annotation' })
+			socketRoom.storage.transaction((txn) => {
+				txn.set(doc.id, doc)
+				txn.set(note.id, note)
+			})
+
+			// the update context reads both lanes, not just the document snapshot
+			// eslint-disable-next-line @typescript-eslint/no-deprecated
+			await socketRoom.updateStore((store) => {
+				expect(store.get(note.id)).toEqual(note)
+				expect(
+					store
+						.getAll()
+						.map((r) => r.id)
+						.sort()
+				).toEqual([doc.id, note.id].sort())
+				store.delete(note.id)
+			})
+			expect(socketRoom.getRecord(note.id)).toBeUndefined()
+			expect(socketRoom.getRecord(doc.id)).toEqual(doc)
+		})
 	})
 
 	describe('connect message', () => {