jinaga-server 2.3.4 → 2.4.0

package/replicator/index.ts

@@ -18,7 +18,7 @@ app.use(express.text());
 app.use(cors());
 
 const pgConnection = process.env.JINAGA_POSTGRESQL ||
-  'postgresql://dev:devpw@localhost:5432/replicator';
+  'postgresql://raasuser:raaspw@localhost:5432/raas';
 const { handler } = JinagaServer.create({
   pgStore: pgConnection
 });

package/replicator/package-lock.json

@@ -11,7 +11,7 @@
       "dependencies": {
         "cors": "^2.8.5",
         "express": "^4.18.1",
-        "pg": "^8.7.3"
+        "pg": "8.11"
       },
       "devDependencies": {
         "@types/cors": "^2.8.12",
@@ -530,21 +530,24 @@
       "integrity": "sha512-5DFkuoqlv1uYQKxy8omFBeJPQcdoE07Kv2sferDCrAq1ohOU+MSDswDIbnx3YAM60qIOnYa53wBhXW0EbMonrQ=="
     },
     "node_modules/pg": {
-      "version": "8.8.0",
-      "resolved": "https://registry.npmjs.org/pg/-/pg-8.8.0.tgz",
-      "integrity": "sha512-UXYN0ziKj+AeNNP7VDMwrehpACThH7LUl/p8TDFpEUuSejCUIwGSfxpHsPvtM6/WXFy6SU4E5RG4IJV/TZAGjw==",
+      "version": "8.11.0",
+      "resolved": "https://registry.npmjs.org/pg/-/pg-8.11.0.tgz",
+      "integrity": "sha512-meLUVPn2TWgJyLmy7el3fQQVwft4gU5NGyvV0XbD41iU9Jbg8lCH4zexhIkihDzVHJStlt6r088G6/fWeNjhXA==",
       "dependencies": {
         "buffer-writer": "2.0.0",
         "packet-reader": "1.0.0",
-        "pg-connection-string": "^2.5.0",
-        "pg-pool": "^3.5.2",
-        "pg-protocol": "^1.5.0",
+        "pg-connection-string": "^2.6.0",
+        "pg-pool": "^3.6.0",
+        "pg-protocol": "^1.6.0",
         "pg-types": "^2.1.0",
         "pgpass": "1.x"
       },
       "engines": {
         "node": ">= 8.0.0"
       },
+      "optionalDependencies": {
+        "pg-cloudflare": "^1.1.0"
+      },
       "peerDependencies": {
         "pg-native": ">=3.0.1"
       },
@@ -554,10 +557,16 @@
         }
       }
     },
+    "node_modules/pg-cloudflare": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/pg-cloudflare/-/pg-cloudflare-1.1.0.tgz",
+      "integrity": "sha512-tGM8/s6frwuAIyRcJ6nWcIvd3+3NmUKIs6OjviIm1HPPFEt5MzQDOTBQyhPWg/m0kCl95M6gA1JaIXtS8KovOA==",
+      "optional": true
+    },
     "node_modules/pg-connection-string": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.5.0.tgz",
-      "integrity": "sha512-r5o/V/ORTA6TmUnyWZR9nCj1klXCO2CEKNRlVuJptZe85QuhFayC7WeMic7ndayT5IRIR0S0xFxFi2ousartlQ=="
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.6.0.tgz",
+      "integrity": "sha512-x14ibktcwlHKoHxx9X3uTVW9zIGR41ZB6QNhHb21OPNdCCO3NaRnpJuwKIQSR4u+Yqjx4HCvy7Hh7VSy1U4dGg=="
     },
     "node_modules/pg-int8": {
       "version": "1.0.1",
@@ -568,17 +577,17 @@
       }
     },
     "node_modules/pg-pool": {
-      "version": "3.5.2",
-      "resolved": "https://registry.npmjs.org/pg-pool/-/pg-pool-3.5.2.tgz",
-      "integrity": "sha512-His3Fh17Z4eg7oANLob6ZvH8xIVen3phEZh2QuyrIl4dQSDVEabNducv6ysROKpDNPSD+12tONZVWfSgMvDD9w==",
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/pg-pool/-/pg-pool-3.6.0.tgz",
+      "integrity": "sha512-clFRf2ksqd+F497kWFyM21tMjeikn60oGDmqMT8UBrynEwVEX/5R5xd2sdvdo1cZCFlguORNpVuqxIj+aK4cfQ==",
       "peerDependencies": {
         "pg": ">=8.0"
       }
     },
     "node_modules/pg-protocol": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.5.0.tgz",
-      "integrity": "sha512-muRttij7H8TqRNu/DxrAJQITO4Ac7RmX3Klyr/9mJEOBeIpgnF8f9jAfRz5d3XwQZl5qBjF9gLsUtMPJE0vezQ=="
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.6.0.tgz",
+      "integrity": "sha512-M+PDm637OY5WM307051+bsDia5Xej6d9IR4GwJse1qA1DIhiKlksvrneZOYQq42OM+spubpcNYEo2FcKQrDk+Q=="
     },
     "node_modules/pg-types": {
       "version": "2.2.0",

package/replicator/package.json

@@ -17,7 +17,7 @@
   "dependencies": {
     "cors": "^2.8.5",
     "express": "^4.18.1",
-    "pg": "^8.7.3"
+    "pg": "8.11"
   },
   "devDependencies": {
     "@types/cors": "^2.8.12",

package/src/authorization/authorization-keystore.ts

@@ -2,29 +2,41 @@ import {
     Authorization,
     AuthorizationEngine,
     AuthorizationRules,
+    DistributionEngine,
+    DistributionRules,
     FactEnvelope,
     FactFeed,
     FactRecord,
     FactReference,
     Feed,
+    Forbidden,
     Query,
     Specification,
     Storage,
-    UserIdentity
+    UserIdentity,
+    buildFeeds,
+    factReferenceEquals
 } from "jinaga";
 
 import { Keystore } from "../keystore";
+import { distinct } from "../util/fn";
+import { DistributedFactCache } from "./distributed-fact-cache";
 
 export class AuthorizationKeystore implements Authorization {
     private authorizationEngine: AuthorizationEngine | null;
+    private distributionEngine: DistributionEngine | null;
+    private distributedFacts: DistributedFactCache = new DistributedFactCache();
 
     constructor(
         private store: Storage,
         private keystore: Keystore,
-        authorizationRules: AuthorizationRules | null
+        authorizationRules: AuthorizationRules | null,
+        distributionRules: DistributionRules | null
     ) {
         this.authorizationEngine = authorizationRules &&
             new AuthorizationEngine(authorizationRules, store);
+        this.distributionEngine = distributionRules &&
+            new DistributionEngine(distributionRules, store);
     }
 
     async getOrCreateUserFact(userIdentity: UserIdentity) {
@@ -39,20 +51,55 @@ export class AuthorizationKeystore implements Authorization {
         return userFact;
     }
 
-    query(userIdentity: UserIdentity, start: FactReference, query: Query) {
+    query(userIdentity: UserIdentity | null, start: FactReference, query: Query) {
         return this.store.query(start, query);
     }
 
-    read(userIdentity: UserIdentity, start: FactReference[], specification: Specification) {
-        return this.store.read(start, specification);
+    async read(userIdentity: UserIdentity | null, start: FactReference[], specification: Specification) {
+        if (this.distributionEngine) {
+            const userReference: FactReference | null = userIdentity
+                ? await this.keystore.getUserFact(userIdentity)
+                : null;
+            // Break the specification into feeds and check distribution.
+            const feeds = buildFeeds(specification);
+            const canDistribute = await this.distributionEngine.canDistributeToAll(feeds, start, userReference);
+            if (!canDistribute) {
+                throw new Forbidden("Unauthorized");
+            }
+        }
+        return await this.store.read(start, specification);
     }
 
-    feed(userIdentity: UserIdentity, feed: Feed, bookmark: string): Promise<FactFeed> {
-        return this.store.feed(feed, bookmark);
+    async feed(userIdentity: UserIdentity | null, feed: Feed, start: FactReference[], bookmark: string): Promise<FactFeed> {
+        if (this.distributionEngine) {
+            const userReference: FactReference | null = userIdentity
+                ? await this.keystore.getUserFact(userIdentity)
+                : null;
+            const canDistribute = await this.distributionEngine.canDistributeToAll([feed], start, userReference);
+            if (!canDistribute) {
+                throw new Forbidden("Unauthorized");
+            }
+            const factFeed = await this.store.feed(feed, start, bookmark);
+            const factReferences = factFeed.tuples
+                .flatMap(tuple => tuple.facts)
+                .filter((value, index, self) => self.findIndex(factReferenceEquals(value)) === index);
+            this.distributedFacts.add(factReferences, userReference);
+            return factFeed;
+        }
+        else {
+            return await this.store.feed(feed, start, bookmark);
+        }
     }
 
-    load(userIdentity: UserIdentity, references: FactReference[]) {
-        return this.store.load(references);
+    async load(userIdentity: UserIdentity, references: FactReference[]) {
+        if (this.distributionEngine) {
+            const userFact = userIdentity ? await this.keystore.getUserFact(userIdentity) : null;
+            const canDistribute = this.distributedFacts.includesAll(references, userFact);
+            if (!canDistribute) {
+                throw new Forbidden("Unauthorized");
+            }
+        }
+        return await this.store.load(references);
     }
 
     async save(userIdentity: UserIdentity | null, facts: FactRecord[]) {
@@ -75,4 +122,18 @@ export class AuthorizationKeystore implements Authorization {
             return authorizedFacts;
         }
     }
+
+    async verifyDistribution(userIdentity: UserIdentity | null, feeds: Feed[], start: FactReference[]): Promise<void> {
+        if (!this.distributionEngine) {
+            return;
+        }
+
+        const userReference: FactReference | null = userIdentity
+            ? await this.keystore.getUserFact(userIdentity)
+            : null;
+        const canDistribute = await this.distributionEngine.canDistributeToAll(feeds, start, userReference);
+        if (!canDistribute) {
+            throw new Forbidden("Unauthorized");
+        }
+    }
 }

package/src/authorization/distributed-fact-cache.ts

@@ -0,0 +1,34 @@
+import { FactReference, factReferenceEquals } from "jinaga";
+
+interface Batch {
+  factReferences: FactReference[];
+  userReference: FactReference | null;
+  createdAt: Date;
+}
+
+export class DistributedFactCache {
+  private batches: Batch[] = [];
+
+  add(factReferences: FactReference[], userReference: FactReference | null): void {
+    this.removeOldBatches();
+    this.batches.push({
+      factReferences,
+      userReference,
+      createdAt: new Date()
+    });
+  }
+
+  includesAll(references: FactReference[], userFact: FactReference | null): boolean {
+    this.removeOldBatches();
+    return references.every(reference =>
+      this.batches.some(batch =>
+        batch.factReferences.some(factReferenceEquals(reference)) &&
+        (batch.userReference === null || batch.userReference === userFact)));
+  }
+
+  removeOldBatches() {
+    const cutoff = new Date().getTime() - 1000 * 60 * 5;
+    this.batches = this.batches.filter(batch =>
+      batch.createdAt.getTime() > cutoff);
+  }
+}

package/src/http/feed-cache.ts

@@ -1,6 +1,14 @@
-import { Feed } from "jinaga";
+import { FactReference, Feed } from "jinaga";
+
+export interface FeedDefinition {
+    start: {
+        factReference: FactReference,
+        index: number
+    }[],
+    feed: Feed
+}
 
 export interface FeedCache {
-    storeFeed(feedHash: string, feed: Feed): Promise<void>;
-    getFeed(feedHash: string): Promise<Feed | undefined>;
+    storeFeed(feedHash: string, feedDefinition: FeedDefinition): Promise<void>;
+    getFeed(feedHash: string): Promise<FeedDefinition | undefined>;
 }

package/src/http/router.ts

@@ -1,14 +1,13 @@
 import { Handler, Router } from "express";
 import {
     Authorization,
-    buildFeeds,
-    computeObjectHash,
     Declaration,
     FactRecord,
     FactReference,
     Feed,
+    FeedResponse,
+    FeedsResponse,
     Forbidden,
-    fromDescriptiveString,
     LoadMessage,
     LoadResponse,
     ProfileMessage,
@@ -20,10 +19,12 @@ import {
     SpecificationParser,
     Trace,
     UserIdentity,
+    buildFeeds,
+    computeObjectHash,
+    fromDescriptiveString,
 } from "jinaga";
-import { FeedResponse, FeedsResponse } from "jinaga/dist/http/messages";
 
-import { FeedCache } from "./feed-cache";
+import { FeedCache, FeedDefinition } from "./feed-cache";
 
 interface ParsedQs { [key: string]: undefined | string | string[] | ParsedQs | ParsedQs[] }
 
@@ -43,8 +44,14 @@ function get<U>(method: ((req: RequestUser, params: { [key: string]: string }, q
                 }
             })
             .catch(error => {
-                Trace.error(error);
-                res.status(500).send(error.message);
+                if (error instanceof Forbidden) {
+                    res.type("text");
+                    res.status(403).send(error.message);
+                }
+                else {
+                    Trace.error(error);
+                    res.status(500).send(error.message);
+                }
                 next();
             });
     };
@@ -198,7 +205,7 @@ function postStringCreate(method: (user: RequestUser, message: string) => Promis
     };
 }
 
-function serializeUserIdentity(user: RequestUser) : UserIdentity | null {
+function serializeUserIdentity(user: RequestUser | null) : UserIdentity | null {
     if (!user) {
         return null;
     }
@@ -217,10 +224,12 @@ export interface RequestUser {
 export class HttpRouter {
     handler: Handler;
 
-    constructor(private authorization: Authorization, private feedCache: FeedCache) {
+    constructor(private authorization: Authorization, private feedCache: FeedCache, backwardCompatible: boolean) {
         const router = Router();
         router.get('/login', getAuthenticate(user => this.login(user)));
-        router.post('/query', post((user, queryMessage: QueryMessage) => this.query(user, queryMessage)));
+        if (backwardCompatible) {
+            router.post('/query', post((user, queryMessage: QueryMessage) => this.query(user, queryMessage)));
+        }
         router.post('/load', post((user, loadMessage: LoadMessage) => this.load(user, loadMessage)));
         router.post('/save', postCreate((user, saveMessage: SaveMessage) => this.save(user, saveMessage)));
 
@@ -243,7 +252,7 @@ export class HttpRouter {
         };
     }
 
-    private async query(user: RequestUser, queryMessage: QueryMessage) : Promise<QueryResponse> {
+    private async query(user: RequestUser | null, queryMessage: QueryMessage) : Promise<QueryResponse> {
         const userIdentity = serializeUserIdentity(user);
         const query = fromDescriptiveString(queryMessage.query);
         const result = await this.authorization.query(userIdentity, queryMessage.start, query);
@@ -260,12 +269,12 @@ export class HttpRouter {
         };
     }
 
-    private async save(user: RequestUser, saveMessage: SaveMessage) : Promise<void> {
+    private async save(user: RequestUser | null, saveMessage: SaveMessage) : Promise<void> {
         const userIdentity = serializeUserIdentity(user);
         await this.authorization.save(userIdentity, saveMessage.facts);
     }
 
-    private async read(user: RequestUser, input: string): Promise<any[]> {
+    private async read(user: RequestUser | null, input: string): Promise<any[]> {
         const knownFacts = await this.getKnownFacts(user);
         const parser = new SpecificationParser(input);
         parser.skipWhitespace();
@@ -278,7 +287,7 @@ export class HttpRouter {
         return extractResults(results);
     }
 
-    private async write(user: RequestUser, input: string): Promise<void> {
+    private async write(user: RequestUser | null, input: string): Promise<void> {
         const knownFacts = await this.getKnownFacts(user);
         const parser = new SpecificationParser(input);
         parser.skipWhitespace();
@@ -296,7 +305,7 @@ export class HttpRouter {
         await this.authorization.save(userIdentity, factRecords);
     }
 
-    private async feeds(user: RequestUser, input: string): Promise<FeedsResponse> {
+    private async feeds(user: RequestUser | null, input: string): Promise<FeedsResponse> {
         const knownFacts = await this.getKnownFacts(user);
         const parser = new SpecificationParser(input);
         parser.skipWhitespace();
@@ -304,35 +313,65 @@ export class HttpRouter {
         const specification = parser.parseSpecification();
         const start = this.selectStart(specification, declaration);
 
-        const feedDefinitions = buildFeeds(start, specification).map(feed => ({
-            hash: urlSafeHash(feed),
-            feed
-        }));
+        // Verify that the number of start facts equals the number of inputs
+        if (start.length !== specification.given.length) {
+            throw new Error(`The number of start facts (${start.length}) does not equal the number of inputs (${specification.given.length})`);
+        }
+        // Verify that the input type matches the start fact type
+        for (let i = 0; i < start.length; i++) {
+            if (start[i].type !== specification.given[i].type) {
+                throw new Error(`The type of start fact ${i} (${start[i].type}) does not match the type of input ${i} (${specification.given[i].type})`);
+            }
+        }
+
+        // Verify that I can distribute all feeds to the user.
+        const feeds = buildFeeds(specification);
+        const userIdentity = serializeUserIdentity(user);
+        await this.authorization.verifyDistribution(userIdentity, feeds, start);
+
+        const feedDefinitionsByHash = feeds.map(feed => {
+            const indexedStart = feed.inputs.map(input => ({
+                factReference: start[input.inputIndex],
+                index: input.inputIndex
+            }));
+            const feedDefinition: FeedDefinition = {
+                start: indexedStart,
+                feed
+            };
+            return {
+                hash: urlSafeHash(feed),
+                feedDefinition
+            };
+        });
         // Store all feeds in the cache.
-        for (const feedDefinition of feedDefinitions) {
-            await this.feedCache.storeFeed(feedDefinition.hash, feedDefinition.feed);
+        for (const d of feedDefinitionsByHash) {
+            await this.feedCache.storeFeed(d.hash, d.feedDefinition);
         }
 
         return {
-            feeds: feedDefinitions.map(f => f.hash)
+            feeds: feedDefinitionsByHash.map(f => f.hash)
         }
     }
 
-    private async feed(user: RequestUser, params: { [key: string]: string }, query: ParsedQs): Promise<FeedResponse | null> {
+    private async feed(user: RequestUser | null, params: { [key: string]: string }, query: ParsedQs): Promise<FeedResponse | null> {
         const feedHash = params["hash"];
         if (!feedHash) {
             return null;
         }
 
-        const feed = await this.feedCache.getFeed(feedHash);
-        if (!feed) {
+        const feedDefinition = await this.feedCache.getFeed(feedHash);
+        if (!feedDefinition) {
             return null;
         }
 
         const bookmark = query["b"] as string ?? "";
 
         const userIdentity = serializeUserIdentity(user);
-        const results = await this.authorization.feed(userIdentity, feed, bookmark);
+        const start = feedDefinition.start.reduce((start, input) => {
+            start[input.index] = input.factReference;
+            return start;
+        }, [] as FactReference[]);
+        const results = await this.authorization.feed(userIdentity, feedDefinition.feed, start, bookmark);
         // Return distinct fact references from all the tuples.
         const references = results.tuples.flatMap(t => t.facts).filter((value, index, self) =>
             self.findIndex(f => f.hash === value.hash && f.type === value.type) === index
@@ -344,7 +383,7 @@ export class HttpRouter {
         return response;
     }
 
-    private async getKnownFacts(user: RequestUser): Promise<Declaration> {
+    private async getKnownFacts(user: RequestUser | null): Promise<Declaration> {
         if (user) {
             const userFact = await this.authorization.getOrCreateUserFact({
                 provider: user.provider,

package/src/jinaga-server.ts

@@ -4,6 +4,7 @@ import {
     Authorization,
     AuthorizationNoOp,
     AuthorizationRules,
+    DistributionRules,
     FactManager,
     Jinaga,
     MemoryStore,
@@ -35,7 +36,8 @@ export type JinagaServerConfig = {
     pgKeystore?: string | Pool,
     pgKeystoreSchema?: string,
     model?: Model,
-    authorization?: (a: AuthorizationRules) => AuthorizationRules
+    authorization?: (a: AuthorizationRules) => AuthorizationRules,
+    distribution?: (d: DistributionRules) => DistributionRules,
 };
 
 export type JinagaServerInstance = {
@@ -59,9 +61,11 @@ export class JinagaServer {
         const fork = new PassThroughFork(store);
         const keystore = createKeystore(config, pools);
         const authorizationRules = config.authorization ? config.authorization(new AuthorizationRules(config.model)) : null;
-        const authorization = createAuthorization(authorizationRules, store, keystore);
+        const distributionRules = config.distribution ? config.distribution(new DistributionRules([])) : null;
+        const authorization = createAuthorization(authorizationRules, distributionRules, store, keystore);
         const feedCache = new MemoryFeedCache();
-        const router = new HttpRouter(authorization, feedCache);
+        // Retain backward compatibility until the user provides distribution rules.
+        const router = new HttpRouter(authorization, feedCache, distributionRules === null);
         const authentication = createAuthentication(store, keystore, authorizationRules);
         const network = new NetworkNoOp();
         const factManager = new FactManager(authentication, fork, source, store, network);
@@ -106,9 +110,9 @@ function createKeystore(config: JinagaServerConfig, pools: { [uri: string]: Pool
     }
 }
 
-function createAuthorization(authorizationRules: AuthorizationRules | null, store: Storage, keystore: Keystore | null): Authorization {
+function createAuthorization(authorizationRules: AuthorizationRules | null, distributionRules: DistributionRules | null, store: Storage, keystore: Keystore | null): Authorization {
     if (keystore) {
-        const authorization = new AuthorizationKeystore(store, keystore, authorizationRules);
+        const authorization = new AuthorizationKeystore(store, keystore, authorizationRules, distributionRules);
         return authorization;
     }
     else {

package/src/memory/memory-feed-cache.ts

@@ -1,15 +1,14 @@
-import { Feed } from "jinaga";
-import { FeedCache } from "../http/feed-cache";
+import { FeedCache, FeedDefinition } from "../http/feed-cache";
 
 export class MemoryFeedCache implements FeedCache {
-    private feeds: { [feedHash: string]: Feed } = {};
+    private feedDefinitions: { [feedHash: string]: FeedDefinition } = {};
 
-    storeFeed(feedHash: string, feed: Feed): Promise<void> {
-        this.feeds[feedHash] = feed;
+    storeFeed(feedHash: string, feedDefinition: FeedDefinition): Promise<void> {
+        this.feedDefinitions[feedHash] = feedDefinition;
         return Promise.resolve();
     }
 
-    getFeed(feedHash: string): Promise<Feed | undefined> {
-        return Promise.resolve(this.feeds[feedHash]);
+    getFeed(feedHash: string): Promise<FeedDefinition | undefined> {
+        return Promise.resolve(this.feedDefinitions[feedHash]);
     }
 }

package/src/postgres/postgres-store.ts

@@ -261,10 +261,10 @@ export class PostgresStore implements Storage {
         return composer.compose(resultSets, factRecords);
     }
 
-    async feed(feed: Feed, bookmark: string): Promise<FactFeed> {
+    async feed(feed: Feed, start: FactReference[], bookmark: string): Promise<FactFeed> {
         const factTypes: FactTypeMap = await this.loadFactTypesFromFeed(feed);
         const roleMap: RoleMap = await this.loadRolesFromFeed(feed, factTypes);
-        const sql = sqlFromFeed(feed, this.schema, bookmark, 100, factTypes, roleMap);
+        const sql = sqlFromFeed(feed, start, this.schema, bookmark, 100, factTypes, roleMap);
         if (!sql) {
             return {
                 tuples: [],

package/src/postgres/specification-result-sql.ts

@@ -222,7 +222,7 @@ class QueryDescription {
     }
 
     outputLength(): number {
-        return this.outputs.length;
+        return this.inputs.length + this.outputs.length;
     }
 
     generateResultSqlQuery(schema: string): SpecificationSqlQuery {

package/src/postgres/specification-sql.ts

@@ -228,7 +228,7 @@ class DescriptionBuilder {
         return true;
     }
 
-    buildDescription(feed: Feed): QueryDescription {
+    buildDescription(feed: Feed, start: FactReference[]): QueryDescription {
         const parameters: (string | number)[] = [];
         function addParameter(value: string | number) {
             parameters.push(value);
@@ -237,7 +237,7 @@ class DescriptionBuilder {
 
         // Allocate parameters for the inputs.
         const inputs: InputDescription[] = feed.inputs.map(input =>
-            this.buildInputDescription(feed, input, addParameter)
+            this.buildInputDescription(feed, input, start, addParameter)
         );
 
         // Allocate parameters for the edge roles.
@@ -266,7 +266,7 @@ class DescriptionBuilder {
         );
     }
 
-    private buildInputDescription(feed: Feed, input: FeedInputDescription, addParameter: (value: string | number) => number): InputDescription {
+    private buildInputDescription(feed: Feed, input: FeedInputDescription, start: FactReference[], addParameter: (value: string | number) => number): InputDescription {
         const fact = feed.facts.find(f => f.factIndex === input.factIndex);
         if (!fact) {
             throw new Error(`Fact not found: ${input.factIndex}`);
@@ -278,7 +278,7 @@ class DescriptionBuilder {
         }
 
         const factTypeParameter = addParameter(factTypeId);
-        const factHashParameter = addParameter(input.factHash);
+        const factHashParameter = addParameter(start[input.inputIndex].hash);
         return {
             factIndex: input.factIndex,
             factTypeParameter,
@@ -335,7 +335,18 @@ class DescriptionBuilder {
 }
 
 export function sqlFromSpecification(start: FactReference[], schema: string, bookmarks: string[], limit: number, specification: Specification, factTypes: Map<string, number>, roleMap: Map<number, Map<string, number>>): SpecificationSqlQuery[] {
-    const feeds = buildFeeds(start, specification);
+    // Verify that the number of start facts equals the number of inputs
+    if (start.length !== specification.given.length) {
+        throw new Error(`The number of start facts (${start.length}) does not equal the number of inputs (${specification.given.length})`);
+    }
+    // Verify that the input type matches the start fact type
+    for (let i = 0; i < start.length; i++) {
+        if (start[i].type !== specification.given[i].type) {
+            throw new Error(`The type of start fact ${i} (${start[i].type}) does not match the type of input ${i} (${specification.given[i].type})`);
+        }
+    }
+
+    const feeds = buildFeeds(specification);
     const descriptionBuilder = new DescriptionBuilder(factTypes, roleMap);
     const feedAndBookmark = feeds.map((feed, index) => ({
         feed,
@@ -344,19 +355,19 @@ export function sqlFromSpecification(start: FactReference[], schema: string, boo
     const satisfiableFeedsAndBookmarks = feedAndBookmark.filter(fb =>
         descriptionBuilder.isSatisfiable(fb.feed, fb.feed.edges));
     const sqlQueries = satisfiableFeedsAndBookmarks.map(fb => {
-        const description = descriptionBuilder.buildDescription(fb.feed);
+        const description = descriptionBuilder.buildDescription(fb.feed, start);
         const sql = description.generateSqlQuery(schema, fb.bookmark, limit);
         return sql;
     });
     return sqlQueries;
 }
 
-export function sqlFromFeed(feed: Feed, schema: string, bookmark: string, limit: number, factTypes: Map<string, number>, roleMap: Map<number, Map<string, number>>): SpecificationSqlQuery | null {
+export function sqlFromFeed(feed: Feed, start: FactReference[], schema: string, bookmark: string, limit: number, factTypes: Map<string, number>, roleMap: Map<number, Map<string, number>>): SpecificationSqlQuery | null {
     const descriptionBuilder = new DescriptionBuilder(factTypes, roleMap);
     if (!descriptionBuilder.isSatisfiable(feed, feed.edges)) {
         return null;
     }
-    const description = descriptionBuilder.buildDescription(feed);
+    const description = descriptionBuilder.buildDescription(feed, start);
     const sql = description.generateSqlQuery(schema, bookmark, limit);
     return sql;
 }

package/test/authorization/authorizationSpec.ts

@@ -167,7 +167,7 @@ function givenAuthorizationWithStorage(storage: MemoryStore) {
         .type('Like', j.for(likeUser))
         .type('Delete', j.for(deleteSender))
         ;
-    return new AuthorizationKeystore(storage, keystore, authorizationRules);
+    return new AuthorizationKeystore(storage, keystore, authorizationRules, null);
 }
 
 function givenOtherUser() {