discovery-media-player 0.1.153 → 0.1.154

package/docs/HOST-CONTRACT.md

@@ -25,7 +25,7 @@ need.
    it the same day, and remove it when the release lands.
 6. **Describe what you do — including what you think is trivial.** Not *"report deviations"*: you
    cannot know what one is, because that would mean knowing this page better than we do. ⚠️ The
-   over-specified sentence in [the `tts-cache` section](#four-things-that-will-bite) stood for
+   over-specified sentence in [the `tts-cache` section](#what-will-bite) stood for
    weeks, and it took a host mentioning its own naming **as a curiosity** for anyone to look. Its
    own account of it, on 27/08: *"je ne l'ai décrite que parce que je citais `preview-fr-v2` comme
    une curiosité, sans savoir que c'était un écart. Si j'avais su que votre page l'interdisait, je
@@ -745,7 +745,7 @@ The rule underneath, safer than the list: **never fall back on a refusal of *acc
 back on an inability to *reach*.** And "do not fall back" applies to what you **offer** — an
 "Open ↗" button left in place is falling back one second later.
 
-## Four things that will bite
+## What will bite
 
 **Your document-opening doors reappear.** A host has more than one place that opens a file, and new
 ones get written. Keep the list and hunt it periodically — and note that **your search criteria
@@ -893,6 +893,32 @@ cannot. Setting the number spares you that reasoning entirely.
 but *did you measure exactly what fails*. Two true statements about the same instance can describe
 different responses.
 
+**⚠️ The ceiling on your requests is set by the role that OPENS the connection, not the one they run
+as.** A host measured this and it is invisible from our side. Their `authenticator` role carries a
+`statement_timeout`; PostgREST's `SET ROLE` does **not** reset it, so code running as `service_role`
+inherits it — while `service_role` itself shows no setting at all, so nothing our code can read
+suggests a limit exists. At that host every request we issue is capped at 8 seconds, and a lock
+waited on for longer than that fails. Your paginated `selectAll`, a batched retention sweep, a
+`count` on a large table: each is one statement, so each gets the whole budget and no more,
+whatever the batch size.
+
+Our own client abort no longer sits at that same value, deliberately. Two timers set to the same
+number do not produce a wrong answer here — both routes fall back to `null`, and a bench proves it —
+but they make the *cause* undecidable: when our abort wins the race, the server's `57014` never
+reaches us and "too slow" becomes indistinguishable from "the network died".
+
+**⚠️ And `safeupdate` refuses an unrestricted write even under `service_role` — read that backwards.**
+The same host has it preloaded on `authenticator`: a `DELETE` or `UPDATE` with no restricting clause
+is rejected outright, and the error message does not name `safeupdate`, so the refusal arrives
+without its reason. They paid for that once, on one of our functions.
+
+The trap is not the refusal. **`safeupdate` is the net.** At a host that has it, an unfiltered write
+fails loudly; at a host that does not — and nothing in this contract requires it — the very same
+line succeeds and empties the table. The defect is therefore silent exactly where it is severe. A
+guard in this repository now refuses any `DELETE`, `PATCH` or `PUT` we write without a restricting
+predicate, and it counts `?select=…` as a projection rather than a filter, because that is the shape
+that survives a review.
+
 ## What you can see and we cannot
 
 **Read this only if you run this player somewhere.** If you are evaluating it, skip to Versioning —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "discovery-media-player",
-  "version": "0.1.153",
+  "version": "0.1.154",
   "description": "Self-hosted document viewer: per-recipient tracked links, reading analytics, live presentation. The core knows nothing about the application hosting it — everything it borrows arrives through an injected context.",
   "keywords": [
     "pdf-viewer",

package/server/retention.js

@@ -455,6 +455,16 @@ function tick() {
 // pas une opinion sur ce qu'un hôte peut avoir.
 const BORNE_RESTE = 5000;
 
+// ⚠️ DOUZE SECONDES, ET LE NOMBRE VIENT D'ÉVITER UNE ÉGALITÉ, PAS D'UN GOÛT. Il valait 8000 — très
+// exactement le `statement_timeout` qu'un hôte a mesuré sur son rôle `authenticator`. Deux minuteries
+// réglées sur la même valeur ne rendent pas un résultat faux ici (les deux voies retombent sur
+// `null`, un banc l'éprouve), mais elles rendent la CAUSE indécidable : quand notre abandon gagne la
+// course, le `57014` du serveur ne nous parvient jamais, et « la requête était trop lente » devient
+// indistinguable de « le réseau est tombé ». Un plafond client strictement AU-DESSUS des plafonds
+// serveur courants laisse le serveur expliquer son refus. C'est la règle de la marge sur le SUJET,
+// appliquée à du code de production plutôt qu'à un banc.
+const DELAI_LECTURE = 12000;
+
 const SONDES_RESTE = [
   ["sessionsIp", "commercial_doc_sessions", "session_id", "ip"],
   ["sessionsUa", "commercial_doc_sessions", "session_id", "ua"],
@@ -543,7 +553,7 @@ async function resteApres(chemin, cle, dernier) {
   if (dernier == null) return true;
   try {
     const suite = await PLAYER.db.request(
-      `${chemin}&${cle}=gt.${enc(String(dernier))}&order=${cle}.asc&limit=1`, { timeoutMs: 8000 });
+      `${chemin}&${cle}=gt.${enc(String(dernier))}&order=${cle}.asc&limit=1`, { timeoutMs: DELAI_LECTURE });
     // Pas de réponse analysable ⇒ on ne sait pas ⇒ « au moins ». Se tromper vers le minorant ne
     // fait que sous-estimer ; se tromper vers l'exactitude fait conclure.
     return !Array.isArray(suite) || suite.length > 0;
@@ -596,7 +606,7 @@ async function compterBorne(chemin, cle) {
     // ⚠️ ET L'ORDRE N'EST PAS DÉCORATIF : sans lui, « la dernière ligne reçue » ne désigne aucune
     // frontière, et le curseur de la sonde ne voudrait rien dire.
     const lignes = await PLAYER.db.request(
-      `${chemin}&order=${cle}.asc&limit=${BORNE_RESTE + 1}`, { timeoutMs: 8000 });
+      `${chemin}&order=${cle}.asc&limit=${BORNE_RESTE + 1}`, { timeoutMs: DELAI_LECTURE });
     if (!Array.isArray(lignes)) return compte(null, false, VOIE_BORNEE);
     // Notre propre borne atteinte : la preuve est dans la ligne excédentaire, rien à demander.
     if (lignes.length > BORNE_RESTE) return compte(BORNE_RESTE, true, VOIE_BORNEE);