jinaga-server 3.5.4 → 3.6.0

package/integration-test/jinaga-test/subscription-late-auth.test.js

@@ -0,0 +1,245 @@
+const request = require('supertest');
+const { buildModel, User } = require('jinaga');
+const { createSubscriptionApp, asUser, randomSuffix } = require('./subscription-helpers');
+
+class Company {
+  static Type = "LateAuth.Company";
+  type = Company.Type;
+  constructor(creator, identifier) {
+    this.creator = creator;
+    this.identifier = identifier;
+  }
+}
+
+class Office {
+  static Type = "LateAuth.Office";
+  type = Office.Type;
+  constructor(company, name) {
+    this.company = company;
+    this.name = name;
+  }
+}
+
+class Administrator {
+  static Type = "LateAuth.Administrator";
+  type = Administrator.Type;
+  constructor(company, user, createdAt) {
+    this.company = company;
+    this.user = user;
+    this.createdAt = createdAt;
+  }
+}
+
+const model = buildModel(b => b
+  .type(User)
+  .type(Company, m => m.predecessor("creator", User))
+  .type(Office, m => m.predecessor("company", Company))
+  .type(Administrator, m => m
+    .predecessor("company", Company)
+    .predecessor("user", User))
+);
+
+function authorization(a) {
+  return a
+    .any(User)
+    .any(Company)
+    .any(Office)
+    .any(Administrator);
+}
+
+function distribution(d) {
+  return d
+    .share(model.given(Company).match((c, facts) =>
+      facts.ofType(Office).join(o => o.company, c)
+    ))
+    .with(model.given(Company).match((c, facts) =>
+      facts.ofType(Administrator)
+        .join(a => a.company, c)
+        .selectMany(a => facts.ofType(User).join(u => u, a.user))
+    ));
+}
+
+function officeSpecText(companyHash) {
+  // The `p1` label name mirrors what `model.given(Company)` produces
+  // so the distribution engine can lift the rule's path conditions onto
+  // the subscription's given during intersectForSubscribe.
+  return `let p1: ${Company.Type} = #${companyHash}\n` +
+    `(p1: ${Company.Type}) {\n` +
+    `    o: ${Office.Type} [\n` +
+    `        o->company: ${Company.Type} = p1\n` +
+    `    ]\n` +
+    `} => o`;
+}
+
+jest.setTimeout(30000);
+
+describe('Subscription late-auth recovery', () => {
+  let app, withSession, close;
+
+  beforeEach(async () => {
+    ({ app, withSession, close } = await createSubscriptionApp({
+      model, authorization, distribution
+    }));
+  });
+
+  afterEach(async () => {
+    if (close) await close();
+  });
+
+  it('accepts the subscription with an empty page when the subscriber is not yet authorized', async () => {
+    const { companyHash } = await asUser(withSession, 'creator-1-' + randomSuffix(), async (creatorJ) => {
+      const { userFact: creatorFact } = await creatorJ.login();
+      const company = await creatorJ.fact(new Company(creatorFact, 'Acme-' + randomSuffix()));
+      await creatorJ.fact(new Office(company, 'HQ'));
+      return { companyHash: creatorJ.hash(company) };
+    });
+
+    const subscriberId = 'subscriber-1-' + randomSuffix();
+    await asUser(withSession, subscriberId, async (j) => { await j.login(); });
+
+    // POST /feeds must NOT 403: distribution rule denies the subscriber,
+    // but the server intersects the spec so the subscription can be
+    // activated once the authorizing fact arrives.
+    const feedsResponse = await request(app)
+      .post('/feeds')
+      .set('Content-Type', 'text/plain')
+      .set('x-test-user-id', subscriberId)
+      .send(officeSpecText(companyHash));
+
+    expect(feedsResponse.status).toBe(200);
+    const { feeds } = JSON.parse(feedsResponse.text);
+    expect(Array.isArray(feeds)).toBe(true);
+    expect(feeds.length).toBeGreaterThan(0);
+
+    // Polling the cached hash returns an empty page — the pre-existing
+    // Office is hidden until the lifted auth condition is satisfied.
+    const pollResponse = await request(app)
+      .get(`/feeds/${feeds[0]}`)
+      .set('x-test-user-id', subscriberId);
+
+    expect(pollResponse.status).toBe(200);
+    const body = JSON.parse(pollResponse.text);
+    const officeRefs = (body.references || []).filter(r => r.type === Office.Type);
+    expect(officeRefs).toHaveLength(0);
+  });
+
+  it('surfaces existing offices once the authorizing fact arrives', async () => {
+    let companyValue;
+    let creatorFactValue;
+    const creatorId = 'creator-2-' + randomSuffix();
+    const { companyHash, officeHash } = await asUser(withSession, creatorId, async (creatorJ) => {
+      const { userFact: creatorFact } = await creatorJ.login();
+      creatorFactValue = creatorFact;
+      const company = await creatorJ.fact(new Company(creatorFact, 'Acme-' + randomSuffix()));
+      companyValue = company;
+      const office = await creatorJ.fact(new Office(company, 'HQ'));
+      return {
+        companyHash: creatorJ.hash(company),
+        officeHash: creatorJ.hash(office)
+      };
+    });
+
+    const subscriberId = 'subscriber-2-' + randomSuffix();
+    const subscriberFact = await asUser(withSession, subscriberId, async (j) => {
+      const { userFact } = await j.login();
+      return userFact;
+    });
+
+    // Subscribe BEFORE the authorizing fact exists so the cached hash is
+    // an intersected (lifted) spec — feedPreVerified will then serve it.
+    const feedsResponse = await request(app)
+      .post('/feeds')
+      .set('Content-Type', 'text/plain')
+      .set('x-test-user-id', subscriberId)
+      .send(officeSpecText(companyHash));
+    expect(feedsResponse.status).toBe(200);
+    const { feeds } = JSON.parse(feedsResponse.text);
+    const feedHash = feeds[0];
+
+    // Initial poll: empty (lifted condition not yet satisfied).
+    const firstPoll = await request(app)
+      .get(`/feeds/${feedHash}`)
+      .set('x-test-user-id', subscriberId);
+    expect(firstPoll.status).toBe(200);
+    const firstBody = JSON.parse(firstPoll.text);
+    expect((firstBody.references || []).filter(r => r.type === Office.Type)).toHaveLength(0);
+
+    // Creator grants the subscriber the Administrator role.
+    await asUser(withSession, creatorId, async (creatorJ) => {
+      await creatorJ.fact(new Administrator(companyValue, subscriberFact, new Date('2026-05-27')));
+    });
+
+    // Re-poll without propagating the prior bookmark. The intersected
+    // spec is 2-given, and the bookmark-extended SQL path currently
+    // generates a WHERE constraint on the second given without a
+    // corresponding JOIN (a separate PostgresStore bug). Re-querying
+    // from the beginning sidesteps that and still validates the
+    // contract — the office surfaces once the lifted condition holds.
+    const secondPoll = await request(app)
+      .get(`/feeds/${feedHash}`)
+      .set('x-test-user-id', subscriberId);
+    expect(secondPoll.status).toBe(200);
+    const secondBody = JSON.parse(secondPoll.text);
+    const officeRefs = (secondBody.references || []).filter(r => r.type === Office.Type);
+    expect(officeRefs.map(r => r.hash)).toContain(officeHash);
+  });
+
+  it('does not let a different authenticated user reuse an intersected feed hash', async () => {
+    let companyValue;
+    const creatorId = 'creator-3-' + randomSuffix();
+    const { companyHash } = await asUser(withSession, creatorId, async (creatorJ) => {
+      const { userFact: creatorFact } = await creatorJ.login();
+      const company = await creatorJ.fact(new Company(creatorFact, 'Acme-' + randomSuffix()));
+      companyValue = company;
+      await creatorJ.fact(new Office(company, 'HQ'));
+      return { companyHash: creatorJ.hash(company) };
+    });
+
+    const aliceId = 'alice-3-' + randomSuffix();
+    const aliceFact = await asUser(withSession, aliceId, async (j) => {
+      const { userFact } = await j.login();
+      return userFact;
+    });
+
+    // Mallory must exist in the keystore for the polling auth path to
+    // resolve her user fact during the distribution check.
+    const malloryId = 'mallory-3-' + randomSuffix();
+    await asUser(withSession, malloryId, async (j) => { await j.login(); });
+
+    // Alice subscribes while NOT yet an admin so the cached hash is the
+    // intersected (Alice-owned) spec.
+    const feedsResponse = await request(app)
+      .post('/feeds')
+      .set('Content-Type', 'text/plain')
+      .set('x-test-user-id', aliceId)
+      .send(officeSpecText(companyHash));
+    const { feeds } = JSON.parse(feedsResponse.text);
+    const intersectedHash = feeds[0];
+
+    // Now grant Alice the Administrator role so her intersected spec
+    // actually produces rows.
+    await asUser(withSession, creatorId, async (creatorJ) => {
+      await creatorJ.fact(new Administrator(companyValue, aliceFact, new Date('2026-05-27')));
+    });
+
+    // Alice can read her own intersected feed and sees the office.
+    const alicePoll = await request(app)
+      .get(`/feeds/${intersectedHash}`)
+      .set('x-test-user-id', aliceId);
+    expect(alicePoll.status).toBe(200);
+    const aliceBody = JSON.parse(alicePoll.text);
+    expect((aliceBody.references || []).some(r => r.type === Office.Type)).toBe(true);
+
+    // Mallory polls the same hash. The router routes her through the
+    // normal distribution check (cached owner is Alice, not Mallory),
+    // which denies her — the polling path returns an empty page rather
+    // than leaking Alice's data.
+    const malloryPoll = await request(app)
+      .get(`/feeds/${intersectedHash}`)
+      .set('x-test-user-id', malloryId);
+    expect(malloryPoll.status).toBe(200);
+    const malloryBody = JSON.parse(malloryPoll.text);
+    const malloryOffices = (malloryBody.references || []).filter(r => r.type === Office.Type);
+    expect(malloryOffices).toHaveLength(0);
+  });
+});

package/integration-test/jinaga-test/subscription-no-rule.test.js

@@ -0,0 +1,137 @@
+const request = require('supertest');
+const { buildModel, User } = require('jinaga');
+const { createSubscriptionApp, asUser, randomSuffix } = require('./subscription-helpers');
+
+// Validates the "keep subscriptions alive across distribution failures"
+// contract: when no distribution rule covers the requested spec, the
+// /feeds endpoint accepts the subscription and polling returns an empty
+// page rather than 403. /read still 403s because reads are one-shot.
+
+class Company {
+  static Type = "NoRule.Company";
+  type = Company.Type;
+  constructor(creator, identifier) {
+    this.creator = creator;
+    this.identifier = identifier;
+  }
+}
+
+class Office {
+  static Type = "NoRule.Office";
+  type = Office.Type;
+  constructor(company, name) {
+    this.company = company;
+    this.name = name;
+  }
+}
+
+class Administrator {
+  static Type = "NoRule.Administrator";
+  type = Administrator.Type;
+  constructor(company, user, createdAt) {
+    this.company = company;
+    this.user = user;
+    this.createdAt = createdAt;
+  }
+}
+
+const model = buildModel(b => b
+  .type(User)
+  .type(Company, m => m.predecessor("creator", User))
+  .type(Office, m => m.predecessor("company", Company))
+  .type(Administrator, m => m
+    .predecessor("company", Company)
+    .predecessor("user", User))
+);
+
+function authorization(a) {
+  return a
+    .any(User)
+    .any(Company)
+    .any(Office)
+    .any(Administrator);
+}
+
+// Distribution covers Office only. Administrator queries fall outside
+// any rule.
+function distribution(d) {
+  return d
+    .share(model.given(Company).match((c, facts) =>
+      facts.ofType(Office).join(o => o.company, c)
+    ))
+    .with(model.given(Company).match((c, facts) =>
+      facts.ofType(Administrator)
+        .join(a => a.company, c)
+        .selectMany(a => facts.ofType(User).join(u => u, a.user))
+    ));
+}
+
+function administratorSpecText(companyHash) {
+  return `let p1: ${Company.Type} = #${companyHash}\n` +
+    `(p1: ${Company.Type}) {\n` +
+    `    a: ${Administrator.Type} [\n` +
+    `        a->company: ${Company.Type} = p1\n` +
+    `    ]\n` +
+    `} => a`;
+}
+
+describe('Subscription when no distribution rule applies', () => {
+  let app, withSession, close;
+  let companyHash;
+  let subscriberId;
+
+  beforeEach(async () => {
+    ({ app, withSession, close } = await createSubscriptionApp({
+      model, authorization, distribution
+    }));
+
+    const creatorId = 'creator-norule-' + randomSuffix();
+    ({ companyHash } = await asUser(withSession, creatorId, async (creatorJ) => {
+      const { userFact: creatorFact } = await creatorJ.login();
+      const company = await creatorJ.fact(new Company(creatorFact, 'Acme-' + randomSuffix()));
+      return { companyHash: creatorJ.hash(company) };
+    }));
+
+    subscriberId = 'subscriber-norule-' + randomSuffix();
+    await asUser(withSession, subscriberId, async (j) => { await j.login(); });
+  });
+
+  afterEach(async () => {
+    if (close) await close();
+  });
+
+  it('accepts /feeds and returns an empty page on poll', async () => {
+    // No rule covers Administrator. intersectForSubscribe also has
+    // nothing to intersect against. The contract is: /feeds succeeds,
+    // polling returns an empty page so the client keeps waiting.
+    const feedsResponse = await request(app)
+      .post('/feeds')
+      .set('Content-Type', 'text/plain')
+      .set('x-test-user-id', subscriberId)
+      .send(administratorSpecText(companyHash));
+
+    expect(feedsResponse.status).toBe(200);
+    const { feeds } = JSON.parse(feedsResponse.text);
+    expect(Array.isArray(feeds)).toBe(true);
+    expect(feeds.length).toBeGreaterThan(0);
+
+    const pollResponse = await request(app)
+      .get(`/feeds/${feeds[0]}`)
+      .set('x-test-user-id', subscriberId);
+    expect(pollResponse.status).toBe(200);
+    const body = JSON.parse(pollResponse.text);
+    expect(body.references || []).toEqual([]);
+  });
+
+  it('still returns 403 from /read for the same spec', async () => {
+    // Reads are one-shot — there is no "wait until authorized later"
+    // semantic, so Forbidden propagates as 403.
+    const readResponse = await request(app)
+      .post('/read')
+      .set('Content-Type', 'text/plain')
+      .set('x-test-user-id', subscriberId)
+      .send(administratorSpecText(companyHash));
+
+    expect(readResponse.status).toBe(403);
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jinaga-server",
-  "version": "3.5.4",
+  "version": "3.6.0",
   "description": "Data management for web and mobile applications.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -49,7 +49,7 @@
   "dependencies": {
     "csv-stringify": "^6.6.0",
     "express": "^4.21.2",
-    "jinaga": "^6.7.14",
+    "jinaga": "^6.8.0",
     "pg": "^8.13.1"
   }
 }

package/src/authorization/authorization-keystore.ts

@@ -17,10 +17,43 @@ import {
     factReferenceEquals
 } from "jinaga";
 
+export interface DistributionIntersectionBranch {
+    start: FactReference[];
+    specification: Specification;
+}
+
+export type DistributionBranchesResult =
+    | { type: "success"; branches: DistributionIntersectionBranch[] }
+    | { type: "denied"; reason: string };
+
+export type FeedResult =
+    | { type: "success"; feed: FactFeed }
+    | { type: "denied"; reason: string };
+
+export interface SubscriptionAuthorizer {
+    verifyDistributionOrIntersect(
+        userIdentity: UserIdentity | null,
+        specification: Specification,
+        namedStart: ReferencesByName
+    ): Promise<DistributionBranchesResult>;
+    feedPreVerified(
+        userIdentity: UserIdentity | null,
+        specification: Specification,
+        start: FactReference[],
+        bookmark: string
+    ): Promise<FactFeed>;
+    feedWithDistribution(
+        userIdentity: UserIdentity | null,
+        specification: Specification,
+        start: FactReference[],
+        bookmark: string
+    ): Promise<FeedResult>;
+}
+
 import { Keystore } from "../keystore";
 import { DistributedFactCache } from "./distributed-fact-cache";
 
-export class AuthorizationKeystore implements Authorization {
+export class AuthorizationKeystore implements Authorization, SubscriptionAuthorizer {
     private authorizationEngine: AuthorizationEngine | null;
     private distributionEngine: DistributionEngine | null;
     private distributedFacts: DistributedFactCache = new DistributedFactCache();
@@ -70,6 +103,14 @@ export class AuthorizationKeystore implements Authorization {
     }
 
     async feed(userIdentity: UserIdentity | null, specification: Specification, start: FactReference[], bookmark: string): Promise<FactFeed> {
+        const result = await this.feedWithDistribution(userIdentity, specification, start, bookmark);
+        if (result.type === "denied") {
+            throw new Forbidden(result.reason);
+        }
+        return result.feed;
+    }
+
+    async feedWithDistribution(userIdentity: UserIdentity | null, specification: Specification, start: FactReference[], bookmark: string): Promise<FeedResult> {
         if (this.distributionEngine) {
             const userReference: FactReference | null = userIdentity
                 ? await this.keystore.getUserFact(userIdentity)
@@ -80,18 +121,35 @@ export class AuthorizationKeystore implements Authorization {
             }), {} as ReferencesByName);
             const canDistribute = await this.distributionEngine.canDistributeToAll([specification], namedStart, userReference);
             if (canDistribute.type === "failure") {
-                throw new Forbidden(canDistribute.reason);
+                return { type: "denied", reason: canDistribute.reason };
             }
             const factFeed = await this.store.feed(specification, start, bookmark);
             const factReferences = factFeed.tuples
                 .flatMap(tuple => tuple.facts)
                 .filter((value, index, self) => self.findIndex(factReferenceEquals(value)) === index);
             this.distributedFacts.add(factReferences, userReference);
-            return factFeed;
+            return { type: "success", feed: factFeed };
         }
-        else {
-            return await this.store.feed(specification, start, bookmark);
+        return { type: "success", feed: await this.store.feed(specification, start, bookmark) };
+    }
+
+    async feedPreVerified(userIdentity: UserIdentity | null, specification: Specification, start: FactReference[], bookmark: string): Promise<FactFeed> {
+        // Caller has already established that this feed is safe to serve
+        // (e.g. produced by intersectForSubscribe — the spec lifts its own
+        // authorization condition into the matches and therefore self-
+        // filters). Skip the redundant per-query distribution check, but
+        // keep tracking the returned references so /load stays consistent.
+        const factFeed = await this.store.feed(specification, start, bookmark);
+        if (this.distributionEngine) {
+            const userReference: FactReference | null = userIdentity
+                ? await this.keystore.getUserFact(userIdentity)
+                : null;
+            const factReferences = factFeed.tuples
+                .flatMap(tuple => tuple.facts)
+                .filter((value, index, self) => self.findIndex(factReferenceEquals(value)) === index);
+            this.distributedFacts.add(factReferences, userReference);
         }
+        return factFeed;
     }
 
     async load(userIdentity: UserIdentity, references: FactReference[]) {
@@ -165,4 +223,28 @@ export class AuthorizationKeystore implements Authorization {
             throw new Forbidden(canDistribute.reason);
         }
     }
+
+    async verifyDistributionOrIntersect(
+        userIdentity: UserIdentity | null,
+        specification: Specification,
+        namedStart: ReferencesByName
+    ): Promise<DistributionBranchesResult> {
+        const start = specification.given.map(g => namedStart[g.label.name]);
+        if (!this.distributionEngine) {
+            return { type: "success", branches: [{ start, specification }] };
+        }
+        const userReference: FactReference | null = userIdentity
+            ? await this.keystore.getUserFact(userIdentity)
+            : null;
+        const targetFeeds = buildFeeds(specification);
+        const canDistribute = await this.distributionEngine.canDistributeToAll(targetFeeds, namedStart, userReference);
+        if (canDistribute.type === "success") {
+            return { type: "success", branches: [{ start, specification }] };
+        }
+        const result = await this.distributionEngine.intersectForSubscribe(start, specification, userReference);
+        if (!result.intersected) {
+            return { type: "denied", reason: canDistribute.reason };
+        }
+        return { type: "success", branches: result.branches };
+    }
 }