deepspace 0.18.0 → 0.19.1

package/dist/server.js

@@ -915,6 +915,33 @@ function buildCronContext(env, ownerUserId, roomId = "default") {
   return { records, integrations, ownerUserId };
 }
 
+// src/server/utils/app-role.ts
+async function resolveAppRole(env, userId) {
+  if (userId === env.OWNER_USER_ID) return "admin";
+  const stub = env.RECORD_ROOMS.get(env.RECORD_ROOMS.idFromName(`app:${env.DEEPSPACE_APP_ID}`));
+  try {
+    const res = await stub.fetch(
+      new Request("https://internal/api/tools/execute", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-User-Id": env.OWNER_USER_ID,
+          "X-App-Action": "true"
+        },
+        body: JSON.stringify({
+          tool: "records.get",
+          params: { collection: "users", recordId: userId }
+        })
+      })
+    );
+    const json = await res.json();
+    const role = json.data?.record?.data?.role;
+    return json.success && (role === "admin" || role === "member") ? role : "viewer";
+  } catch {
+    return "viewer";
+  }
+}
+
 // src/server/utils/ai.ts
 import { createAnthropic } from "@ai-sdk/anthropic";
 import { createOpenAI } from "@ai-sdk/openai";
@@ -1930,7 +1957,30 @@ function splitStatements(sql) {
   return sql.split(";").map((s) => s.trim()).filter((s) => s.length > 0);
 }
 
+// src/shared/room-identity-headers.ts
+var BASE64URL = /^[A-Za-z0-9_-]*$/;
+function decodeRoomIdentityHeader(value) {
+  if (value === null || !BASE64URL.test(value) || value.length % 4 === 1) return void 0;
+  const base64 = value.replaceAll("-", "+").replaceAll("_", "/").padEnd(value.length + (4 - value.length % 4) % 4, "=");
+  try {
+    const binary = atob(base64);
+    const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    return void 0;
+  }
+}
+
 // src/server/rooms/base-room.ts
+function connectionAttachmentFromRequest(request) {
+  return {
+    userId: decodeRoomIdentityHeader(request.headers.get("x-user-id")) || `anon-${crypto.randomUUID()}`,
+    userName: decodeRoomIdentityHeader(request.headers.get("x-user-name")) || "Anonymous",
+    userEmail: decodeRoomIdentityHeader(request.headers.get("x-user-email")) || "",
+    userImageUrl: decodeRoomIdentityHeader(request.headers.get("x-user-image-url")),
+    role: decodeRoomIdentityHeader(request.headers.get("x-user-role"))
+  };
+}
 var BaseRoom = class {
   state;
   env;
@@ -1939,9 +1989,7 @@ var BaseRoom = class {
     this.state = state;
     this.env = env ?? {};
     this.sql = state.storage.sql;
-    this.state.setWebSocketAutoResponse(
-      new WebSocketRequestResponsePair("ping", "pong")
-    );
+    this.state.setWebSocketAutoResponse(new WebSocketRequestResponsePair("ping", "pong"));
   }
   // ==========================================================================
   // HTTP Entry Point
@@ -1991,22 +2039,11 @@ var BaseRoom = class {
   // ==========================================================================
   // WebSocket Connection
   // ==========================================================================
-  async handleWebSocketUpgrade(_request, url) {
-    const userId = url.searchParams.get("userId") || void 0;
-    const userName = url.searchParams.get("userName") || "Anonymous";
-    const userEmail = url.searchParams.get("userEmail") || "";
-    const userImageUrl = url.searchParams.get("userImageUrl") || void 0;
+  async handleWebSocketUpgrade(request, _url) {
     const pair = new WebSocketPair();
     const [client, server] = Object.values(pair);
     this.state.acceptWebSocket(server);
-    const role = url.searchParams.get("role") || void 0;
-    const attachment = {
-      userId: userId ?? `anon-${crypto.randomUUID()}`,
-      userName,
-      userEmail,
-      userImageUrl,
-      role
-    };
+    const attachment = connectionAttachmentFromRequest(request);
     const augmented = await this.onConnect(server, attachment) ?? attachment;
     server.serializeAttachment(augmented);
     return new Response(null, { status: 101, webSocket: client });
@@ -2304,7 +2341,7 @@ function dataToColumnValues(data, columns) {
   const values = {};
   for (const col of columns) {
     if (col.expression || col.readonly) continue;
-    const val = data[col.id] ?? data[col.name];
+    const val = data[col.name];
     if (val !== void 0) {
       values[col.id] = coerceValue(val, col.storage, col.interpretation);
     }
@@ -2453,6 +2490,15 @@ function checkFieldPermissions(schema, role, newData, existingData) {
   }
   return null;
 }
+function checkUnclaimedOwnerTransition(schema, role, nextData, userId) {
+  const permissions = getRolePermissions(schema, role);
+  if (permissions.update !== "unclaimed-or-own" || !schema.ownerField) return null;
+  const nextOwner = nextData[schema.ownerField];
+  if (nextOwner === void 0 || nextOwner === null || nextOwner === "" || nextOwner === userId) {
+    return null;
+  }
+  return `Role '${role}' can set '${schema.ownerField}' only to their own user id or leave it unclaimed`;
+}
 var SYSTEM_MANAGED_COLUMNS = /* @__PURE__ */ new Set([
   "email",
   "name",
@@ -2496,7 +2542,7 @@ function lintSchema(schema) {
   if (schema.ownerField) {
     const col = schema.columns.find((c) => c.name === schema.ownerField);
     const spoofableRoles = Object.entries(schema.permissions).filter(
-      ([role, permissions]) => role !== "owner" && role !== "admin" && permissions.create === true
+      ([role, permissions]) => role !== "owner" && role !== "admin" && permissions.create === true && permissions.update !== "unclaimed-or-own"
     ).map(([role]) => role);
     if (col && !col.userBound && spoofableRoles.length > 0) {
       warnings.push(
@@ -2836,6 +2882,14 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
     return { success: false, error: `Schema not registered for collection: ${collection}` };
   }
   const columns = getResolvedColumns(schema);
+  for (const col of columns) {
+    if (col.id !== col.name && Object.hasOwn(data, col.id)) {
+      return {
+        success: false,
+        error: `FIELD ERROR: physical column id '${col.id}' is not a writable field; use '${col.name}'`
+      };
+    }
+  }
   const existing = getRecord(ctx.sql, collection, recordId, schema);
   const isUpdate = existing !== null;
   const mergedData = isUpdate ? { ...existing.data, ...data } : { ...data };
@@ -2898,10 +2952,6 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
           error: `UPDATE DENIED: role=${userRole}, collection=${collection}`
         };
       }
-      const fieldError = checkFieldPermissions(schema, userRole, finalData, existing.data);
-      if (fieldError) {
-        return { success: false, error: `FIELD ERROR: ${fieldError}` };
-      }
     } else {
       if (!canCreate(schema, userRole)) {
         return {
@@ -2910,6 +2960,19 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
         };
       }
     }
+    const fieldError = checkFieldPermissions(
+      schema,
+      userRole,
+      data,
+      isUpdate ? existing.data : void 0
+    );
+    if (fieldError) {
+      return { success: false, error: `FIELD ERROR: ${fieldError}` };
+    }
+    const ownerError = checkUnclaimedOwnerTransition(schema, userRole, finalData, userId);
+    if (ownerError) {
+      return { success: false, error: `FIELD ERROR: ${ownerError}` };
+    }
   }
   const colValues = dataToColumnValues(finalData, columns);
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -3162,11 +3225,17 @@ function handleYjsJoin(ctx, ws, attachment, payload) {
 }
 function handleYjsLeave(ctx, ws, attachment, payload) {
   const { collection, recordId, fieldName } = payload;
+  const docKey = getYjsDocKey(collection, recordId, fieldName);
+  const clientId = attachment.awarenessClientIds?.[docKey];
+  if (clientId !== void 0) {
+    broadcastAwarenessClientRemoval(ctx, docKey, clientId);
+    delete attachment.awarenessClientIds[docKey];
+  }
   attachment.yjsSubscriptions = attachment.yjsSubscriptions.filter(
     (s) => !(s.collection === collection && s.recordId === recordId && s.fieldName === fieldName)
   );
   ws.serializeAttachment(attachment);
-  unloadYjsDocIfUnused(ctx, getYjsDocKey(collection, recordId, fieldName), ws);
+  unloadYjsDocIfUnused(ctx, docKey, ws);
 }
 function handleYjsBinaryMessage(ctx, ws, attachment, data) {
   const decoder = createDecoder(data);
@@ -3178,12 +3247,13 @@ function handleYjsBinaryMessage(ctx, ws, attachment, data) {
     const parsed2 = parseYjsDocKey(docKey2);
     if (!parsed2) return;
     if (!hasYjsSubscription(attachment, parsed2)) return;
-    if (attachment.awarenessClientId == null) {
+    if (attachment.awarenessClientIds?.[docKey2] === void 0) {
       try {
         const pd = createDecoder(payload);
         const count = readVarUint(pd);
         if (count > 0) {
-          attachment.awarenessClientId = readVarUint(pd);
+          attachment.awarenessClientIds ??= {};
+          attachment.awarenessClientIds[docKey2] = readVarUint(pd);
           ws.serializeAttachment(attachment);
         }
       } catch {
@@ -3265,18 +3335,21 @@ function broadcastAwareness(ctx, docKey, payload, excludeWs) {
   }
 }
 function broadcastAwarenessRemoval(ctx, attachment) {
-  const clientId = attachment.awarenessClientId;
-  if (clientId == null || attachment.yjsSubscriptions.length === 0) return;
+  if (!attachment.awarenessClientIds) return;
+  for (const sub of attachment.yjsSubscriptions) {
+    const docKey = getYjsDocKey(sub.collection, sub.recordId, sub.fieldName);
+    const clientId = attachment.awarenessClientIds[docKey];
+    if (clientId !== void 0) broadcastAwarenessClientRemoval(ctx, docKey, clientId);
+  }
+}
+function broadcastAwarenessClientRemoval(ctx, docKey, clientId) {
   const payloadEncoder = createEncoder();
   writeVarUint(payloadEncoder, 1);
   writeVarUint(payloadEncoder, clientId);
   writeVarUint(payloadEncoder, 16777215);
   writeVarUint8Array(payloadEncoder, new TextEncoder().encode("null"));
   const removalPayload = toUint8Array(payloadEncoder);
-  for (const sub of attachment.yjsSubscriptions) {
-    const docKey = getYjsDocKey(sub.collection, sub.recordId, sub.fieldName);
-    broadcastAwareness(ctx, docKey, removalPayload, null);
-  }
+  broadcastAwareness(ctx, docKey, removalPayload, null);
 }
 function handleYjsDisconnect(ctx, ws, attachment) {
   broadcastAwarenessRemoval(ctx, attachment);
@@ -3553,6 +3626,7 @@ function getAllUserRecords(sql, schemaRegistry) {
     const r = row;
     return {
       recordId: r._row_id,
+      createdBy: r._created_by,
       data: columns.length > 0 ? rowToUserRecord(r, columns) : {
         email: r.col_email || "",
         name: r.col_name || "",
@@ -3614,12 +3688,28 @@ async function registerUser(sql, userId, name, email, imageUrl, isAdmin, default
   );
   return { id: userId, email, name, imageUrl, role, createdAt: now, lastSeenAt: now };
 }
-function handleUserList(ctx, ws, _attachment) {
-  const userRecords = getAllUserRecords(ctx.sql, ctx.schemaRegistry);
-  const users = userRecords.map((r) => ({
-    id: r.recordId,
-    ...r.data
-  }));
+function handleUserList(ctx, ws, attachment) {
+  const schema = ctx.schemaRegistry.get("users");
+  const permissionContext = ctx.getPermissionContext();
+  const visibleRecords = attachment.userId.startsWith("anon-") || !schema ? [] : getAllUserRecords(ctx.sql, ctx.schemaRegistry).filter(
+    (record) => canRead(
+      schema,
+      attachment.role,
+      record,
+      attachment.userId,
+      permissionContext
+    )
+  );
+  const users = visibleRecords.map((record) => {
+    if (attachment.role === "admin") return { id: record.recordId, ...record.data };
+    const { name, imageUrl, role } = record.data;
+    return {
+      id: record.recordId,
+      name,
+      ...imageUrl ? { imageUrl } : {},
+      role
+    };
+  });
   ctx.send(ws, { type: MSG.USER_LIST, payload: { users } });
 }
 function handleUserUpdate(ctx, _ws, attachment, payload) {
@@ -3648,24 +3738,18 @@ async function handleSetRole(ctx, ws, attachment, payload) {
     now,
     payload.userId
   );
-  if (attachment.userId === payload.userId) {
-    attachment.role = payload.role;
-    ws.serializeAttachment(attachment);
-  }
-  const userRecords = getAllUserRecords(ctx.sql, ctx.schemaRegistry);
-  const users = userRecords.map((r) => ({
-    id: r.recordId,
-    ...r.data
-  }));
   for (const otherWs of ctx.state.getWebSockets()) {
     const otherAttachment = otherWs.deserializeAttachment();
     if (!otherAttachment) continue;
-    if (otherAttachment.userId === payload.userId && otherWs !== ws) {
-      otherAttachment.role = payload.role;
-      otherWs.serializeAttachment(otherAttachment);
+    if (otherAttachment.userId === payload.userId) {
+      try {
+        otherWs.close(1008, "role-changed");
+      } catch {
+      }
+      continue;
     }
     if (otherAttachment.role === "admin") {
-      ctx.send(otherWs, { type: MSG.USER_LIST, payload: { users } });
+      handleUserList(ctx, otherWs, otherAttachment);
     }
   }
 }
@@ -4536,6 +4620,7 @@ var RecordRoom = class extends BaseRoom {
       sql: this.sql,
       state: this.state,
       schemaRegistry: this.schemaRegistry,
+      getPermissionContext: () => this.getPermissionContext(),
       send: (ws, msg) => this.send(ws, msg)
     };
   }
@@ -5086,6 +5171,13 @@ var CanvasRoom = class extends BaseRoom {
 };
 
 // src/server/rooms/presence-room.ts
+var MAX_PRESENCE_STATE_BYTES = 16 * 1024;
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function stateSize(state) {
+  return new TextEncoder().encode(JSON.stringify(state)).byteLength;
+}
 var PresenceRoom = class extends BaseRoom {
   peers = /* @__PURE__ */ new Map();
   peerSockets = /* @__PURE__ */ new Map();
@@ -5107,8 +5199,6 @@ var PresenceRoom = class extends BaseRoom {
       const recovered = {
         userId: att.userId,
         userName: att.userName,
-        userEmail: att.userEmail,
-        userImageUrl: att.userImageUrl,
         joinedAt,
         state: {}
       };
@@ -5125,8 +5215,6 @@ var PresenceRoom = class extends BaseRoom {
     const peer = {
       userId: user.userId,
       userName: user.userName,
-      userEmail: user.userEmail,
-      userImageUrl: user.userImageUrl,
       joinedAt: now,
       state: {}
     };
@@ -5154,15 +5242,28 @@ var PresenceRoom = class extends BaseRoom {
           peer = {
             userId: user.userId,
             userName: user.userName,
-            userEmail: user.userEmail,
-            userImageUrl: user.userImageUrl,
             joinedAt,
             state: {}
           };
           this.peers.set(user.userId, peer);
           this.peerSockets.set(user.userId, ws);
         }
-        peer.state = { ...peer.state, ...payload };
+        if (!isPlainObject(payload)) {
+          this.sendTo(ws, {
+            type: MSG.ERROR,
+            payload: { error: "Presence state must be an object" }
+          });
+          return;
+        }
+        const nextState = { ...peer.state, ...payload };
+        if (stateSize(nextState) > MAX_PRESENCE_STATE_BYTES) {
+          this.sendTo(ws, {
+            type: MSG.ERROR,
+            payload: { error: "Presence state exceeds 16 KiB" }
+          });
+          return;
+        }
+        peer.state = nextState;
         this.peers.set(user.userId, peer);
         this.broadcast(
           {
@@ -5174,7 +5275,10 @@ var PresenceRoom = class extends BaseRoom {
         break;
       }
       default:
-        this.sendTo(ws, { type: MSG.ERROR, payload: { error: `Unknown presence message type: ${type}` } });
+        this.sendTo(ws, {
+          type: MSG.ERROR,
+          payload: { error: `Unknown presence message type: ${type}` }
+        });
     }
   }
   onDisconnect(ws, user) {
@@ -5618,6 +5722,9 @@ var JobRoom = class extends BaseRoom {
   retentionMs;
   snapshotLimit;
   retryBackoffMs;
+  authorizeWrite;
+  authorizeRead;
+  broadcastQueue = Promise.resolve();
   /** In-flight jobs in this isolate; lets same-isolate JOB_CANCEL fire the signal. */
   inFlight = /* @__PURE__ */ new Map();
   /** Set by `ctx.continue` inside `executeJob`; reset before every run. */
@@ -5628,6 +5735,8 @@ var JobRoom = class extends BaseRoom {
     this.retentionMs = Math.max(0, config.retentionMs ?? DEFAULT_RETENTION_MS);
     this.snapshotLimit = Math.max(1, config.snapshotLimit ?? DEFAULT_SNAPSHOT_LIMIT);
     this.retryBackoffMs = Math.max(0, config.retryBackoffMs ?? 1e3);
+    this.authorizeWrite = config.authorizeWrite ?? ((user) => user.role === ROLES.MEMBER || user.role === ROLES.ADMIN);
+    this.authorizeRead = config.authorizeRead ?? this.authorizeWrite;
   }
   ensureInitialized() {
     if (this.initialized) return;
@@ -5668,14 +5777,31 @@ var JobRoom = class extends BaseRoom {
     this.ensureInitialized();
     return super.fetch(request);
   }
-  onConnect(ws, user) {
+  async onConnect(ws, user) {
     this.ensureInitialized();
-    this.sendTo(ws, serverBuild.jobSnapshot(this.getRecentJobs(this.snapshotLimit)));
-    return user;
+    const { canRead: canRead2, canWrite } = await this.resolveAccess(user);
+    this.sendTo(ws, { type: MSG.AUTH, payload: { canWrite } });
+    this.sendTo(ws, serverBuild.jobSnapshot(canRead2 ? this.getRecentJobs(this.snapshotLimit) : []));
+    return { ...user, canWrite };
   }
   async onMessage(ws, user, message) {
     this.ensureInitialized();
     const { type, payload } = message;
+    if (type === MSG.JOB_ENQUEUE || type === MSG.JOB_CANCEL || type === MSG.JOB_RETRY) {
+      const attachment = user;
+      const { canWrite } = await this.resolveAccess(user);
+      if (attachment.canWrite !== canWrite) {
+        attachment.canWrite = canWrite;
+        ws.serializeAttachment(attachment);
+        this.sendTo(ws, { type: MSG.AUTH, payload: { canWrite } });
+      } else if (!canWrite) {
+        this.sendTo(ws, { type: MSG.AUTH, payload: { canWrite: false } });
+      }
+      if (!canWrite) {
+        this.sendTo(ws, serverBuild.error("Write access denied: job queue requires member access"));
+        return;
+      }
+    }
     switch (type) {
       case MSG.JOB_ENQUEUE: {
         const requestId = String(payload.requestId ?? "");
@@ -6018,6 +6144,29 @@ var JobRoom = class extends BaseRoom {
     const row = this.sql.exec(`SELECT status FROM jobs WHERE id = ?`, jobId).toArray()[0];
     return row?.status ?? null;
   }
+  /** Reauthorize every live event so role revocation does not leave a stale reader. */
+  broadcast(message, exclude) {
+    this.broadcastQueue = this.broadcastQueue.then(async () => {
+      await Promise.all(
+        this.getWebSockets().map(async (ws) => {
+          if (ws === exclude) return;
+          try {
+            const user = this.getAttachment(ws);
+            if (!user) return;
+            if (await this.authorizeRead(user)) this.sendTo(ws, message);
+          } catch {
+          }
+        })
+      );
+    });
+    this.state.waitUntil(this.broadcastQueue);
+  }
+  async resolveAccess(user) {
+    const canRead2 = await this.authorizeRead(user);
+    if (!canRead2) return { canRead: false, canWrite: false };
+    const canWrite = this.authorizeRead === this.authorizeWrite || await this.authorizeWrite(user);
+    return { canRead: true, canWrite };
+  }
   // ==========================================================================
   // Scheduling / recovery / pruning
   // ==========================================================================
@@ -7674,6 +7823,7 @@ export {
   capToolResultSize,
   captureScreenshot,
   checkFieldPermissions,
+  checkUnclaimedOwnerTransition,
   coerceValue,
   collectionTableName,
   columnId,
@@ -7742,6 +7892,7 @@ export {
   registryStub,
   requireSubscription,
   resolveAppName,
+  resolveAppRole,
   resolveColumn,
   rowToData,
   runMigrations,