@zackbart/connecta 0.24.4 → 0.25.0

package/dist/routes/activity.js

@@ -1,5 +1,7 @@
+import { Duration, Effect } from "effect";
 import { InvalidActivityCursorError, } from "../activity.js";
-import { activityActorNamespace, authorize, privateJson, } from "./shared.js";
+import { authorized, refuse, serveOperator } from "./operator.js";
+import { activityActorNamespace, privateJson, } from "./shared.js";
 const ACTIVITY_LABEL_CONCURRENCY = 8;
 const ACTIVITY_LABEL_PAGE_BUDGET_MS = 1_500;
 const ACTIVITY_LABEL_MAX_LENGTH = 160;
@@ -11,162 +13,143 @@ function cleanActivityActorLabel(value) {
         return undefined;
     return Array.from(compact).slice(0, ACTIVITY_LABEL_MAX_LENGTH).join("");
 }
-async function boundedActivityActorLabel(hook, id, budgetMs) {
-    let timer;
-    try {
-        return await Promise.race([
-            Promise.resolve(hook(id))
-                .then(cleanActivityActorLabel)
-                .catch(() => undefined),
-            new Promise((resolve) => {
-                timer = setTimeout(resolve, budgetMs);
-            }),
-        ]);
-    }
-    catch {
-        return undefined;
-    }
-    finally {
-        if (timer !== undefined)
-            clearTimeout(timer);
-    }
+function actorKey(actor) {
+    return JSON.stringify([actor.kind, actor.namespace, actor.id]);
 }
 /**
- * Add display-only actor labels to one authorized activity page. Resolution is
- * best-effort, bounded, and read-time only: stored events retain stable ids and
- * a profile-provider outage falls back to those ids without failing the page.
+ * One lookup per distinct actor on the page, each against the single provider
+ * that owns the actor's directory. An actor no provider can claim unambiguously
+ * gets no lookup at all.
  */
-async function enrichActivityActorLabels(page, auth) {
+function labelLookups(page, auth) {
     const identities = new Map();
     for (const event of page.events) {
         if (!event.actor.id)
             continue;
-        identities.set(JSON.stringify([
-            event.actor.kind,
-            event.actor.namespace,
-            event.actor.id,
-        ]), {
+        identities.set(actorKey(event.actor), {
             kind: event.actor.kind,
             id: event.actor.id,
-            ...(event.actor.namespace
-                ? { namespace: event.actor.namespace }
-                : {}),
+            ...(event.actor.namespace ? { namespace: event.actor.namespace } : {}),
         });
     }
-    const queue = [...identities.entries()];
-    const labels = new Map();
-    let next = 0;
-    const deadline = Date.now() + ACTIVITY_LABEL_PAGE_BUDGET_MS;
-    const workers = Array.from({ length: Math.min(ACTIVITY_LABEL_CONCURRENCY, queue.length) }, async () => {
-        while (next < queue.length) {
-            const entry = queue[next++];
-            if (!entry)
-                return;
-            const [key, identity] = entry;
-            const sameKindProviders = auth
-                .map((provider, index) => ({ provider, index }))
-                .filter(({ provider }) => provider.kind === identity.kind);
-            const candidates = sameKindProviders.filter(({ provider }) => Boolean(provider.activityActorLabel));
-            const eligible = identity.namespace
-                ? candidates.filter(({ provider }) => activityActorNamespace(provider) === identity.namespace)
-                : (() => {
-                    const directoryKey = ({ provider, index, }) => {
-                        const namespace = activityActorNamespace(provider);
-                        return namespace === undefined
-                            ? `provider:${index}`
-                            : `namespace:${namespace}`;
-                    };
-                    // Every same-kind provider participates in the ambiguity check,
-                    // even if it cannot resolve labels. Otherwise a legacy ID owned
-                    // by a provider without a resolver could be disclosed to a
-                    // different provider that happens to have one.
-                    const directories = new Set(sameKindProviders.map(directoryKey));
-                    if (directories.size !== 1)
-                        return [];
-                    const [directory] = directories;
-                    return candidates.filter((candidate) => directoryKey(candidate) === directory);
-                })();
-            // One namespace is one directory. Use its first configured resolver so
-            // duplicate gate adapters over the same Clerk instance do not multiply
-            // the provider-level concurrency cap.
-            const provider = eligible[0]?.provider;
-            if (!provider)
-                continue;
-            const remaining = deadline - Date.now();
-            if (remaining <= 0)
-                return;
-            const label = await boundedActivityActorLabel(provider.activityActorLabel.bind(provider), identity.id, remaining);
+    const lookups = [];
+    for (const [key, identity] of identities) {
+        const sameKindProviders = auth
+            .map((provider, index) => ({ provider, index }))
+            .filter(({ provider }) => provider.kind === identity.kind);
+        const candidates = sameKindProviders.filter(({ provider }) => Boolean(provider.activityActorLabel));
+        const eligible = identity.namespace
+            ? candidates.filter(({ provider }) => activityActorNamespace(provider) === identity.namespace)
+            : (() => {
+                const directoryKey = ({ provider, index, }) => {
+                    const namespace = activityActorNamespace(provider);
+                    return namespace === undefined
+                        ? `provider:${index}`
+                        : `namespace:${namespace}`;
+                };
+                // Every same-kind provider participates in the ambiguity check,
+                // even if it cannot resolve labels. Otherwise a legacy ID owned
+                // by a provider without a resolver could be disclosed to a
+                // different provider that happens to have one.
+                const directories = new Set(sameKindProviders.map(directoryKey));
+                if (directories.size !== 1)
+                    return [];
+                const [directory] = directories;
+                return candidates.filter((candidate) => directoryKey(candidate) === directory);
+            })();
+        // One namespace is one directory. Use its first configured resolver so
+        // duplicate gate adapters over the same Clerk instance do not multiply
+        // the provider-level concurrency cap.
+        const provider = eligible[0]?.provider;
+        if (provider)
+            lookups.push({ key, id: identity.id, provider });
+    }
+    return lookups;
+}
+/**
+ * Add display-only actor labels to one authorized activity page. Resolution is
+ * best-effort, bounded, and read-time only: stored events retain stable ids and
+ * a profile-provider outage falls back to those ids without failing the page.
+ *
+ * At most eight lookups run at once, and the page waits for them for 1.5
+ * seconds in all: whatever has resolved by then is used, and the rest are
+ * abandoned, as they are when the reader leaves.
+ */
+function enrichActivityActorLabels(page, auth) {
+    return Effect.suspend(() => {
+        const labels = new Map();
+        const resolve = ({ key, id, provider }) => Effect.tryPromise(() => Promise.resolve(provider.activityActorLabel(id))).pipe(Effect.map(cleanActivityActorLabel), Effect.orElseSucceed(() => undefined), Effect.map((label) => {
             if (label)
                 labels.set(key, label);
+        }));
+        return Effect.forEach(labelLookups(page, auth), resolve, {
+            concurrency: ACTIVITY_LABEL_CONCURRENCY,
+            discard: true,
+        }).pipe(Effect.timeoutOption(Duration.millis(ACTIVITY_LABEL_PAGE_BUDGET_MS)), Effect.map(() => ({
+            ...page,
+            events: page.events.map((event) => {
+                const resolved = event.actor.id
+                    ? labels.get(actorKey(event.actor))
+                    : undefined;
+                // Never trust or echo a `label` supplied by storage. The persisted event
+                // schema has no label; only this authenticated read path may add one.
+                const actor = {
+                    kind: event.actor.kind,
+                    ...(event.actor.id ? { id: event.actor.id } : {}),
+                    ...(event.actor.namespace
+                        ? { namespace: event.actor.namespace }
+                        : {}),
+                };
+                return {
+                    ...event,
+                    actor: resolved ? { ...actor, label: resolved } : actor,
+                };
+            }),
+        })));
+    });
+}
+function activityRead(context) {
+    const { url, opts } = context;
+    return Effect.gen(function* () {
+        const authz = yield* authorized(context, false);
+        if (!authz.operator)
+            return yield* refuse("operator access required", 403);
+        if (opts.activityReadGate &&
+            !(yield* Effect.promise(async () => opts.activityReadGate(authz.actor)))) {
+            return yield* refuse("forbidden", 403);
         }
+        const list = opts.activity?.list?.bind(opts.activity);
+        if (!list)
+            return yield* refuse("activity history is not configured", 404);
+        const cursor = url.searchParams.get("cursor") ?? undefined;
+        if (cursor && cursor.length > 500)
+            return yield* refuse("invalid cursor", 400);
+        const requestedLimit = Number(url.searchParams.get("limit") ?? "50");
+        const limit = Number.isFinite(requestedLimit)
+            ? Math.min(100, Math.max(1, Math.trunc(requestedLimit)))
+            : 50;
+        return yield* Effect.tryPromise({
+            try: () => list({ ...(cursor !== undefined ? { cursor } : {}), limit }),
+            catch: (error) => error,
+        }).pipe(Effect.flatMap((page) => enrichActivityActorLabels(page, opts.auth)), Effect.map((page) => privateJson(page)), 
+        // A page too malformed to label or serialize is the store's failure,
+        // like any other.
+        Effect.catchDefect((defect) => Effect.fail(defect)), Effect.catch((error) => {
+            if (error instanceof InvalidActivityCursorError) {
+                return refuse(error.message, 400);
+            }
+            opts.logger.error("[connecta] activity read failed", error);
+            return refuse("activity history is temporarily unavailable", 503);
+        }));
     });
-    await Promise.all(workers);
-    return {
-        ...page,
-        events: page.events.map((event) => {
-            const resolved = event.actor.id
-                ? labels.get(JSON.stringify([
-                    event.actor.kind,
-                    event.actor.namespace,
-                    event.actor.id,
-                ]))
-                : undefined;
-            // Never trust or echo a `label` supplied by storage. The persisted event
-            // schema has no label; only this authenticated read path may add one.
-            const actor = {
-                kind: event.actor.kind,
-                ...(event.actor.id ? { id: event.actor.id } : {}),
-                ...(event.actor.namespace
-                    ? { namespace: event.actor.namespace }
-                    : {}),
-            };
-            return {
-                ...event,
-                actor: resolved ? { ...actor, label: resolved } : actor,
-            };
-        }),
-    };
 }
 export async function routeActivity(context) {
-    const { path, request, url, baseUrl, opts, runtimeContext } = context;
+    const { path, request } = context;
     if (path !== "/ui/activity")
         return null;
     if (request.method !== "GET") {
         return privateJson({ error: "method not allowed" }, { status: 405 });
     }
-    const authz = await authorize(request, baseUrl, opts.auth, runtimeContext, opts.identity, false);
-    if (!authz.ok)
-        return authz.response;
-    if (!authz.operator) {
-        return privateJson({ error: "operator access required" }, { status: 403 });
-    }
-    if (opts.activityReadGate &&
-        !(await opts.activityReadGate(authz.actor))) {
-        return privateJson({ error: "forbidden" }, { status: 403 });
-    }
-    if (!opts.activity?.list) {
-        return privateJson({ error: "activity history is not configured" }, { status: 404 });
-    }
-    const cursor = url.searchParams.get("cursor") ?? undefined;
-    if (cursor && cursor.length > 500) {
-        return privateJson({ error: "invalid cursor" }, { status: 400 });
-    }
-    const requestedLimit = Number(url.searchParams.get("limit") ?? "50");
-    const limit = Number.isFinite(requestedLimit)
-        ? Math.min(100, Math.max(1, Math.trunc(requestedLimit)))
-        : 50;
-    try {
-        const page = await opts.activity.list({
-            ...(cursor !== undefined ? { cursor } : {}),
-            limit,
-        });
-        return privateJson(await enrichActivityActorLabels(page, opts.auth));
-    }
-    catch (error) {
-        if (error instanceof InvalidActivityCursorError) {
-            return privateJson({ error: error.message }, { status: 400 });
-        }
-        opts.logger.error("[connecta] activity read failed", error);
-        return privateJson({ error: "activity history is temporarily unavailable" }, { status: 503 });
-    }
+    // A read: a reader who leaves stops the label lookups still queued.
+    return serveOperator(activityRead(context), request.signal);
 }