deepspace 0.19.0 → 0.19.2

package/dist/worker.d.ts

@@ -1000,7 +1000,7 @@ interface RolePermissions {
     create: boolean;
     update: PermissionLevel;
     delete: PermissionLevel;
-    /** If set, only these columns can be updated by this role. */
+    /** If set, only these caller-supplied columns can be created or updated by this role. */
     writableFields?: string[];
 }
 interface CollectionSchema {
@@ -1238,7 +1238,7 @@ declare function canDelete(schema: CollectionSchema, role: string, record: {
     createdBy: string;
     recordId?: string;
 }, userId: string, ctx?: PermissionContext): boolean;
-/** Check if a field update violates writableFields restrictions. */
+/** Check if a caller-supplied field write violates writableFields restrictions. */
 declare function checkFieldPermissions(schema: CollectionSchema, role: string, newData: Record<string, unknown>, existingData?: Record<string, unknown>): string | null;
 /**
  * `unclaimed-or-own` lets a client claim an empty owner field, but never lets
@@ -1678,6 +1678,8 @@ interface JobRoomConfig {
     retryBackoffMs?: number;
     /** Re-check whether a connected user may mutate the queue. Defaults to member/admin roles. */
     authorizeWrite?: (user: UserAttachment) => boolean | Promise<boolean>;
+    /** Re-check whether a connected user may observe the queue. Defaults to authorizeWrite. */
+    authorizeRead?: (user: UserAttachment) => boolean | Promise<boolean>;
 }
 interface JobAttachment extends UserAttachment {
     canWrite: boolean;
@@ -1689,6 +1691,8 @@ declare abstract class JobRoom<E = Record<string, unknown>, P = unknown, R = unk
     private readonly snapshotLimit;
     private readonly retryBackoffMs;
     private readonly authorizeWrite;
+    private readonly authorizeRead;
+    private broadcastQueue;
     /** In-flight jobs in this isolate; lets same-isolate JOB_CANCEL fire the signal. */
     private readonly inFlight;
     /** Set by `ctx.continue` inside `executeJob`; reset before every run. */
@@ -1742,6 +1746,9 @@ declare abstract class JobRoom<E = Record<string, unknown>, P = unknown, R = unk
     private executeJob;
     private makeContext;
     private readStatus;
+    /** Reauthorize every live event so role revocation does not leave a stale reader. */
+    protected broadcast(message: ServerMessage, exclude?: WebSocket): void;
+    private resolveAccess;
     private scheduleNextAlarm;
     private recoverStuckRunning;
     private pruneExpired;

package/dist/worker.js

@@ -1318,10 +1318,6 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
           error: `UPDATE DENIED: role=${userRole}, collection=${collection}`
         };
       }
-      const fieldError = checkFieldPermissions(schema, userRole, finalData, existing.data);
-      if (fieldError) {
-        return { success: false, error: `FIELD ERROR: ${fieldError}` };
-      }
     } else {
       if (!canCreate(schema, userRole)) {
         return {
@@ -1330,6 +1326,15 @@ function putRecord(ctx, collection, recordId, data, userId, userRole, skipUserRb
         };
       }
     }
+    const fieldError = checkFieldPermissions(
+      schema,
+      userRole,
+      data,
+      isUpdate ? existing.data : void 0
+    );
+    if (fieldError) {
+      return { success: false, error: `FIELD ERROR: ${fieldError}` };
+    }
     const ownerError = checkUnclaimedOwnerTransition(schema, userRole, finalData, userId);
     if (ownerError) {
       return { success: false, error: `FIELD ERROR: ${ownerError}` };
@@ -1987,6 +1992,7 @@ function getAllUserRecords(sql, schemaRegistry) {
     const r = row;
     return {
       recordId: r._row_id,
+      createdBy: r._created_by,
       data: columns.length > 0 ? rowToUserRecord(r, columns) : {
         email: r.col_email || "",
         name: r.col_name || "",
@@ -2048,12 +2054,28 @@ async function registerUser(sql, userId, name, email, imageUrl, isAdmin, default
   );
   return { id: userId, email, name, imageUrl, role, createdAt: now, lastSeenAt: now };
 }
-function handleUserList(ctx, ws, _attachment) {
-  const userRecords = getAllUserRecords(ctx.sql, ctx.schemaRegistry);
-  const users = userRecords.map((r) => ({
-    id: r.recordId,
-    ...r.data
-  }));
+function handleUserList(ctx, ws, attachment) {
+  const schema = ctx.schemaRegistry.get("users");
+  const permissionContext = ctx.getPermissionContext();
+  const visibleRecords = attachment.userId.startsWith("anon-") || !schema ? [] : getAllUserRecords(ctx.sql, ctx.schemaRegistry).filter(
+    (record) => canRead(
+      schema,
+      attachment.role,
+      record,
+      attachment.userId,
+      permissionContext
+    )
+  );
+  const users = visibleRecords.map((record) => {
+    if (attachment.role === "admin") return { id: record.recordId, ...record.data };
+    const { name, imageUrl, role } = record.data;
+    return {
+      id: record.recordId,
+      name,
+      ...imageUrl ? { imageUrl } : {},
+      role
+    };
+  });
   ctx.send(ws, { type: MSG.USER_LIST, payload: { users } });
 }
 function handleUserUpdate(ctx, _ws, attachment, payload) {
@@ -2082,11 +2104,6 @@ async function handleSetRole(ctx, ws, attachment, payload) {
     now,
     payload.userId
   );
-  const userRecords = getAllUserRecords(ctx.sql, ctx.schemaRegistry);
-  const users = userRecords.map((r) => ({
-    id: r.recordId,
-    ...r.data
-  }));
   for (const otherWs of ctx.state.getWebSockets()) {
     const otherAttachment = otherWs.deserializeAttachment();
     if (!otherAttachment) continue;
@@ -2098,7 +2115,7 @@ async function handleSetRole(ctx, ws, attachment, payload) {
       continue;
     }
     if (otherAttachment.role === "admin") {
-      ctx.send(otherWs, { type: MSG.USER_LIST, payload: { users } });
+      handleUserList(ctx, otherWs, otherAttachment);
     }
   }
 }
@@ -3077,6 +3094,7 @@ var RecordRoom = class extends BaseRoom {
       sql: this.sql,
       state: this.state,
       schemaRegistry: this.schemaRegistry,
+      getPermissionContext: () => this.getPermissionContext(),
       send: (ws, msg) => this.send(ws, msg)
     };
   }
@@ -4179,6 +4197,8 @@ var JobRoom = class extends BaseRoom {
   snapshotLimit;
   retryBackoffMs;
   authorizeWrite;
+  authorizeRead;
+  broadcastQueue = Promise.resolve();
   /** In-flight jobs in this isolate; lets same-isolate JOB_CANCEL fire the signal. */
   inFlight = /* @__PURE__ */ new Map();
   /** Set by `ctx.continue` inside `executeJob`; reset before every run. */
@@ -4190,6 +4210,7 @@ var JobRoom = class extends BaseRoom {
     this.snapshotLimit = Math.max(1, config.snapshotLimit ?? DEFAULT_SNAPSHOT_LIMIT);
     this.retryBackoffMs = Math.max(0, config.retryBackoffMs ?? 1e3);
     this.authorizeWrite = config.authorizeWrite ?? ((user) => user.role === ROLES.MEMBER || user.role === ROLES.ADMIN);
+    this.authorizeRead = config.authorizeRead ?? this.authorizeWrite;
   }
   ensureInitialized() {
     if (this.initialized) return;
@@ -4232,9 +4253,9 @@ var JobRoom = class extends BaseRoom {
   }
   async onConnect(ws, user) {
     this.ensureInitialized();
-    const canWrite = await this.authorizeWrite(user);
+    const { canRead: canRead2, canWrite } = await this.resolveAccess(user);
     this.sendTo(ws, { type: MSG.AUTH, payload: { canWrite } });
-    this.sendTo(ws, serverBuild.jobSnapshot(this.getRecentJobs(this.snapshotLimit)));
+    this.sendTo(ws, serverBuild.jobSnapshot(canRead2 ? this.getRecentJobs(this.snapshotLimit) : []));
     return { ...user, canWrite };
   }
   async onMessage(ws, user, message) {
@@ -4242,7 +4263,7 @@ var JobRoom = class extends BaseRoom {
     const { type, payload } = message;
     if (type === MSG.JOB_ENQUEUE || type === MSG.JOB_CANCEL || type === MSG.JOB_RETRY) {
       const attachment = user;
-      const canWrite = await this.authorizeWrite(user);
+      const { canWrite } = await this.resolveAccess(user);
       if (attachment.canWrite !== canWrite) {
         attachment.canWrite = canWrite;
         ws.serializeAttachment(attachment);
@@ -4597,6 +4618,29 @@ var JobRoom = class extends BaseRoom {
     const row = this.sql.exec(`SELECT status FROM jobs WHERE id = ?`, jobId).toArray()[0];
     return row?.status ?? null;
   }
+  /** Reauthorize every live event so role revocation does not leave a stale reader. */
+  broadcast(message, exclude) {
+    this.broadcastQueue = this.broadcastQueue.then(async () => {
+      await Promise.all(
+        this.getWebSockets().map(async (ws) => {
+          if (ws === exclude) return;
+          try {
+            const user = this.getAttachment(ws);
+            if (!user) return;
+            if (await this.authorizeRead(user)) this.sendTo(ws, message);
+          } catch {
+          }
+        })
+      );
+    });
+    this.state.waitUntil(this.broadcastQueue);
+  }
+  async resolveAccess(user) {
+    const canRead2 = await this.authorizeRead(user);
+    if (!canRead2) return { canRead: false, canWrite: false };
+    const canWrite = this.authorizeRead === this.authorizeWrite || await this.authorizeWrite(user);
+    return { canRead: true, canWrite };
+  }
   // ==========================================================================
   // Scheduling / recovery / pruning
   // ==========================================================================