anchordb-angular 1.4.0 → 1.4.1

package/CHANGELOG.md

@@ -5,6 +5,70 @@ All notable changes to the `anchordb` packages.
 This project follows [semantic versioning](https://semver.org/). While the version is `0.x`, minor
 releases may contain breaking changes.
 
+## 1.4.1
+
+**Security: `anchordb-sync-server` now keeps users apart.** Up to 1.4.0 the server checked the
+identity `authenticate` returned and then dropped it: every user pulled every user's documents and
+could change or delete any of them by id. Every version before 1.4.1 is affected. Found by the
+expense-tracker team.
+
+### Fixed
+
+- **Each document belongs to a scope**, `user:<id>` for the user who created it, and a user reads and
+  changes only their own. `authenticate` may return a user id, as before, or
+  `{ userId, scopes }` to give a user further scopes (shared books, from 1.5.0).
+- **Refusals reveal nothing.** Someone else's document is answered exactly as one that does not
+  exist: `rejected` with `code: 404`.
+- **Retry answers and unique checks are per user.** Remembered answers are keyed by user as well as
+  `clientId`, so one user can't read back another's. Unique indexes are checked within the user's
+  documents; `{ global: true }` on a unique index checks across everyone (for usernames, say).
+- **Fails closed.** Calling `handlePush`/`handlePull` yourself on a server with `authenticate` and no
+  caller is refused with 401. The Express, Next.js and NestJS adapters pass the caller for you.
+- **A server with no `authenticate` warns at startup**, since every caller then shares every
+  document. Pass `singleUser: true` if that is what you want; it becomes required in 1.5.0.
+
+### New
+
+- **`adoptUnscoped(options, { assignScope })`.** Documents written before 1.4.1 have no scope, and a
+  server with `authenticate` hides them from everyone until this one-time command assigns them, for
+  example `assignScope: (collection, doc) => doc.userId ? "user:" + doc.userId : null`. Each one it
+  assigns is sent to its owner's phones again. It is safe to run twice, and two processes running it
+  at once don't assign anything twice. A server that only one person used can assign everything to
+  that person: `() => "user:<their id>"`.
+- **Epoch.** Every response carries an `epoch` (default `"2"` with `authenticate`; set `epoch` to
+  change it). When a phone sees a new one, it deletes its synced copy and pulls again, keeping its
+  unsent changes (`sync:reset` event). That clears out other users' documents that phones pulled from
+  1.4.0 servers.
+- **Protocol version 2.** A server with `authenticate` answers phones built with an older anchordb
+  `426 Update the app`, since they ignore the epoch. `legacyClients: "allow"` serves them for a
+  transition period. They are still kept apart, but they keep whatever they already pulled.
+- **Pull limit** capped at 1000 changes (`maxPullLimit`).
+- **Each pulled change carries its `scope`**, and the phone records it with the document.
+
+### Changed on the phone (`anchordb`)
+
+- A change refused with 404 is parked, as before, and the phone now also deletes its copy of that
+  document — so another user's document that was edited offline doesn't stay on the phone. A
+  refused insert keeps the user's new document.
+- **A document deleted on the user's other phone** now comes back as a conflict marked
+  `deleted: true` with `document: null`, and goes through the conflict strategy: `server-wins`
+  accepts the delete; `last-write-wins` keeps a newer local edit and brings the document back;
+  `client-wins` always brings it back; `field-level` falls back to last-write-wins. A custom
+  `resolver` receives `remote: null`, and returns null to accept the delete. The `conflict` event
+  gains `remoteDeleted` and `resolvedDeleted`.
+
+### Upgrading — in this order
+
+1. **Upgrade the server** to `anchordb-sync-server@1.4.1`.
+2. **Run `adoptUnscoped`** once with an `assignScope` that knows whose each document is. Until you
+   do, those documents are hidden from everyone. Nothing is ever deleted on the server.
+3. **Ship a new app build** with `anchordb@1.4.1`. On its first sync it starts over once, because of
+   the new epoch, and its unsent changes are kept.
+
+App builds that use an anchordb version before 1.4.1 **stop syncing** (426) until users install the
+update, unless the server sets `legacyClients: "allow"`. A server without `authenticate` is unchanged:
+it still serves everyone everything, and still accepts old phones.
+
 ## 1.4.0
 
 **Transactions, migrations, recovery, TTL indexes, encryption, a test kit — and guides that ship in the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anchordb-angular",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "license": "MIT",
   "type": "module",
   "sideEffects": false,
@@ -35,7 +35,7 @@
   "dependencies": {
     "@capacitor-community/sqlite": ">=6",
     "@capacitor/core": ">=6",
-    "anchordb": "^1.4.0"
+    "anchordb": "^1.4.1"
   },
   "devDependencies": {
     "rimraf": "^6.0.1"