@volter/teams 0.2.55 → 0.2.56

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.55",
+  "version": "0.2.56",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/published-events.mjs

@@ -12,6 +12,16 @@ const stmt = (sql, ...params) => ({sql, params});
 const batches = (list, size = 90) => Array.from({length: Math.ceil(list.length / size)}, (_, at) => list.slice(at * size, (at + 1) * size));
 const holes = list => list.map(() => '?').join(',');
 const EVENT_REPLAY_BATCH = 32;
+// A publication is written about four times: the event, its resource's snapshot, its idempotent answer, and a
+// webhook delivery. Past the host's maximum a write does not fail, it resets the server under every machine's link:
+// an event that would not fit under the limit beside a mebibyte kept for retention is refused, and writes nothing.
+const EVENT_COPIES = 4, EVENT_RESERVE = 1024 * 1024;
+async function eventHeadroomSpent(api, res, bytes) {
+  const usage = await api.storageUsage?.();
+  if (!usage || usage.used + bytes * EVENT_COPIES + EVENT_RESERVE < usage.limit) return false;
+  res._auditRecord = null; res._idempotencyRecord = null;
+  return true;
+}
 const fail = (status,code,message) => {throw Object.assign(new Error(message),{status,code});};
 const text = (value,label) => {if(typeof value!=='string'||!value||value.length>256||/[\x00-\x1f]/.test(value))fail(400,'invalid_request',`${label} must be a nonempty string of at most 256 characters`);return value;};
 const eventOf = row => ({id:row.id,org:row.team_id,at:row.created_at,actor:JSON.parse(row.actor_json),kind:row.kind,resource:{kind:row.resource_kind,id:row.resource_id},data:JSON.parse(row.data_json)});
@@ -93,8 +103,10 @@ export async function publishedEventRoute(ctx) {
     if(body.actor!=null){exact(body.actor,['session']);if(body.actor.session!=null){text(body.actor.session,'actor.session');if(!body.actor.session.startsWith('session:'))fail(400,'invalid_request','actor.session must name a session');actor.session=body.actor.session;}}
     const source=await api.store.one(OWN_SOURCE,[auth.team_id,publication[1],auth.principal_id,sourceMachine(auth)]);
     if(!source)fail(404,'not_found','event source not found');
+    const spent=await eventHeadroomSpent(api,res,Buffer.byteLength(JSON.stringify(body.data)));
     const old=await api.store.one('SELECT * FROM org_events WHERE id=?',[body.id]);
     if(old){if(old.team_id!==auth.team_id||old.source_id!==publication[1]||old.kind!==body.kind||old.resource_id!==body.resource.id||old.source_revision!==body.revision||canonicalJson(JSON.parse(old.data_json))!==canonicalJson(body.data)||canonicalJson(JSON.parse(old.actor_json))!==canonicalJson(actor))fail(409,'idempotency_conflict','event id already names another event');send(res,200,result(api,auth,eventOf(old)),requestId);return true;}
+    if(spent){res.setHeader('Retry-After','60');throw Object.assign(new Error('event deferred while Teams storage is full'),{status:507,code:'storage_full',retryable:true});}
     const now=api.clock.nowMs(),guards=[...authorityGuards(auth,now),{sql:OWN_SOURCE,params:[auth.team_id,publication[1],auth.principal_id,sourceMachine(auth)],status:403,code:'forbidden',message:'event source authority changed'},
       {sql:'SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM event_resources WHERE team_id=? AND source_id=? AND resource_kind=? AND resource_id=? AND source_revision>=?)',params:[auth.team_id,publication[1],body.resource.kind,body.resource.id,body.revision],status:409,code:'revision_mismatch',message:'resource publication is older than its current snapshot'}];
     const event={id:body.id,org:auth.team_id,at:now,actor,kind:body.kind,resource:body.resource,data:body.data},response=result(api,auth,event);