okengine 0.17.2 → 0.18.3

package/src/elements/store/live-default.test.ts

@@ -0,0 +1,136 @@
+/**
+ * Project-wide `store.live` default — real boot.
+ *
+ * `oke({ store: { live: true } })` flips NEW `store.schema.table()` posts to
+ * live-by-default: a resource mounted with `.all()` (no explicit `live: true`)
+ * gets a real `GET <path>/live` SSE route, and `store.schema.live(false)` opts
+ * a table out. The off-flag app keeps today's behavior — no live route.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { gate } from "../gate.ts";
+import { oke } from "../../kernel/app.ts";
+import { resetFlowSeq } from "../../kernel/flow.ts";
+import { on, resetBindings } from "../../kernel/on.ts";
+import { http } from "../../kernel/triggers.ts";
+import { createTestApp } from "../../test/create-test-app.ts";
+import { field, id, store } from "../store.ts";
+import { resetPendingResourceLive } from "../../kernel/resource-live.ts";
+import { z } from "zod";
+
+afterEach(() => {
+  resetBindings();
+  resetFlowSeq();
+  resetPendingResourceLive();
+});
+
+const tasks = store.schema.table(
+  "tasks",
+  {
+    id: field.text().primaryKey().defaultFn(id),
+    title: field.text().notNull(),
+  },
+  [store.schema.policy.owner("owner")],
+);
+
+const archive = store.schema.table(
+  "archive",
+  {
+    id: field.text().primaryKey().defaultFn(id),
+    label: field.text().notNull(),
+  },
+  [store.schema.policy.owner("owner"), store.schema.live(false)],
+);
+
+/**
+ * Mount the two CRUD resources. The `/tasks` resource's own `POST /tasks`
+ * create verb is used for the live-window write.
+ */
+function mountResource(db: ReturnType<typeof store.sql>) {
+  const tasksR = store.resource(db, tasks, {
+    in: z.object({ title: z.string() }),
+    out: z.object({ id: z.string(), title: z.string() }),
+  });
+  const archiveR = store.resource(db, archive, {
+    in: z.object({ label: z.string() }),
+    out: z.object({ id: z.string(), label: z.string() }),
+  });
+  on(http.resource("/tasks", tasksR.all()).gate(gate.public));
+  on(http.resource("/archive", archiveR.all()).gate(gate.public));
+}
+
+describe("project-wide store.live default — real boot", () => {
+  test("flag on: omitted live mounts GET /tasks/live; live(false) table gets no live route", async () => {
+    resetBindings();
+    resetFlowSeq();
+    resetPendingResourceLive();
+
+    const db = store.sql("app", { schema: { tasks, archive } });
+    mountResource(db);
+
+    const app = oke({
+      name: "live-default-app",
+      store: { live: true },
+      gate: { policies: [gate.public] },
+    });
+    Object.assign(app.$options as never, {
+      env: "test",
+      stores: [db],
+      unguardedHttp: "allow",
+    });
+    try {
+      await createTestApp(app, {
+        boot: {
+          stores: [db],
+          config: { drivers: { store: { sql: { test: "pglite" } } } },
+        },
+      });
+
+      // The pending resource live mount drained — GET /tasks/live streams 200.
+      const live = await app.fetch(new Request("http://localhost/tasks/live"));
+      expect(live.status).toBe(200);
+      expect(live.headers.get("content-type")).toMatch(/text\/event-stream/);
+      await live.body!.cancel();
+
+      // The archive table opted out via store.schema.live(false) — no /live route.
+      const archiveLive = await app.fetch(new Request("http://localhost/archive/live"));
+      expect(archiveLive.status).not.toBe(200);
+    } finally {
+      await app.stop();
+    }
+  });
+
+  test("flag off: omitted live stays today's behavior — no /live route", async () => {
+    resetBindings();
+    resetFlowSeq();
+    resetPendingResourceLive();
+
+    const db = store.sql("app", { schema: { tasks, archive } });
+    mountResource(db);
+
+    const app = oke({
+      name: "live-off-app",
+      gate: { policies: [gate.public] },
+    });
+    Object.assign(app.$options as never, {
+      env: "test",
+      stores: [db],
+      unguardedHttp: "allow",
+    });
+    try {
+      await createTestApp(app, {
+        boot: {
+          stores: [db],
+          config: { drivers: { store: { sql: { test: "pglite" } } } },
+        },
+      });
+
+      const live = await app.fetch(new Request("http://localhost/tasks/live"));
+      expect(live.status).not.toBe(200);
+      const archiveLive = await app.fetch(new Request("http://localhost/archive/live"));
+      expect(archiveLive.status).not.toBe(200);
+    } finally {
+      await app.stop();
+    }
+  });
+});

package/src/elements/store/live-http.test.ts

@@ -0,0 +1,160 @@
+/**
+ * Manual live query e2e — a hand-written flow on `.live(table)` streams
+ * classified CDC events through `liveQuery` over real pglite + RLS.
+ *
+ * Proves the full manual path: declaration (`http.get(...).live(tasks)`) →
+ * compiled Manifest (signal synthesis + guardrails, covered in
+ * extract.test.ts) → real boot (realtime bridge binds, CDC sink live) →
+ * hand-written flow body calls `liveQuery(fx, tasks, input)` → SSE frames
+ * carry only the subscriber's rows — cross-table writes (activity) never
+ * appear (see live-isolation.test.ts for the adversarial leg).
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { gate } from "../gate.ts";
+import { oke } from "../../kernel/app.ts";
+import { flow, resetFlowSeq } from "../../kernel/flow.ts";
+import { on, resetBindings } from "../../kernel/on.ts";
+import { http } from "../../kernel/triggers.ts";
+import { createTestApp } from "../../test/create-test-app.ts";
+import { field, id, store } from "../store.ts";
+import { liveQuery } from "./live-query.ts";
+
+afterEach(() => {
+  resetBindings();
+  resetFlowSeq();
+});
+
+const tasks = store.schema.table("tasks", {
+  id: field.text().primaryKey().defaultFn(id),
+  title: field.text().notNull(),
+  status: field.text().notNull(),
+});
+
+const activity = store.schema.table("activity", {
+  id: field.text().primaryKey().defaultFn(id),
+  label: field.text().notNull(),
+});
+
+/** Minimal stream reader — avoids DOM `ReadableStreamReadResult` / `readMany` lib skew. */
+type SseByteReader = {
+  read(): Promise<{ done: boolean; value?: Uint8Array }>;
+  cancel(): Promise<void>;
+};
+
+/**
+ * Drain SSE until a classified upsert frame appears, without dropping a
+ * late chunk via Promise.race (a timed-out `read()` must stay the pending
+ * one across loop iterations).
+ */
+async function readUntilUpsert(reader: SseByteReader, timeoutMs: number): Promise<string> {
+  const dec = new TextDecoder();
+  let body = "";
+  const deadline = Date.now() + timeoutMs;
+  let pending: Promise<{ done: boolean; value?: Uint8Array }> | undefined;
+  while (Date.now() < deadline && !body.includes('"kind":"upsert"')) {
+    pending ??= reader.read();
+    const remaining = Math.max(1, deadline - Date.now());
+    const step = await Promise.race([
+      pending.then((r) => ({ kind: "read" as const, r })),
+      new Promise<{ kind: "timeout" }>((resolve) =>
+        setTimeout(() => resolve({ kind: "timeout" }), Math.min(500, remaining)),
+      ),
+    ]);
+    if (step.kind === "timeout") continue;
+    pending = undefined;
+    if (step.r.done) break;
+    if (step.r.value) body += dec.decode(step.r.value, { stream: true });
+  }
+  return body;
+}
+
+describe("manual live flow (.live(table) + liveQuery) — real boot", () => {
+  // PGLite boot + CDC fan-out needs headroom over Bun's default 5s; one
+  // tasks insert yields a single classified upsert frame.
+  test("SSE frames carry classified task events; activity writes never surface", async () => {
+    resetBindings();
+    resetFlowSeq();
+
+    const db = store.sql("app", { schema: { tasks, activity } });
+
+    const tasksLive = on(
+      http.get("/tasks/live").public().live(tasks),
+      flow("tasks.live", {
+        in: { unknown: true },
+        effects: { reads: ["sql:app"] },
+        do: async (input, fx) =>
+          liveQuery(fx, tasks, input, {
+            filter: [tasks.status],
+            search: [tasks.title],
+            order: "all",
+          }),
+      }),
+    );
+    // A plain flow writing to BOTH tables — the keel `writeActivity` shape.
+    const createTask = on(
+      http.post("/tasks").public(),
+      flow("tasks.create", {
+        in: { title: { type: "string" }, status: { type: "string" } },
+        effects: { writes: ["sql:app"] },
+        do: async (input, fx) => {
+          const s = fx.store(db);
+          await s.insert(tasks).values({
+            title: String((input as { title: unknown }).title),
+            status: String((input as { status: unknown }).status),
+          });
+          await s.insert(activity).values({ label: "created task" });
+          return { ok: true };
+        },
+      }),
+    );
+
+    const app = oke({
+      name: "manual-live-app",
+      gate: { policies: [gate.public] },
+    }).adopt({ tasksLive, createTask });
+    Object.assign(app.$options, { env: "test", stores: [db], unguardedHttp: "allow" });
+    // PGLite boot (real app path) — the bridge binds on the pglite primary.
+    // Passed via boot.config: the createTestApp harness defaults to memory
+    // SQL unless boot.config.drivers.store.sql is set explicitly.
+    try {
+      await createTestApp(app, {
+        boot: {
+          stores: [db],
+          config: { drivers: { store: { sql: { test: "pglite" } } } },
+        },
+      });
+
+      // Subscribe to the manual live route and collect SSE frames.
+      const res = await app.fetch(new Request("http://localhost/tasks/live?status=eq.open"));
+      if (res.status !== 200) {
+        console.error("live route failed:", res.status, await res.text());
+      }
+      expect(res.status).toBe(200);
+      expect(res.headers.get("content-type")).toMatch(/text\/event-stream/);
+      const reader = res.body!.getReader();
+
+      // Write through the two-table flow — CDC flows globally, but only the
+      // tasks row (matching the ?status=eq.open window) reaches this stream.
+      const post = await app.fetch(
+        new Request("http://localhost/tasks", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ title: "hello", status: "open" }),
+        }),
+      );
+      expect(post.status).toBe(200);
+
+      const body = await readUntilUpsert(reader, 10_000);
+      await reader.cancel().catch(() => undefined);
+
+      expect(body).toContain("data:");
+      expect(body).toContain('"kind":"upsert"');
+      expect(body).toContain('"title":"hello"');
+      expect(body).not.toContain("created task");
+      expect(body).not.toContain('"kind":"revoked"');
+    } finally {
+      await app.stop();
+    }
+  }, 15_000);
+});

package/src/elements/store/live-isolation.test.ts

@@ -0,0 +1,291 @@
+/**
+ * Cross-table event-isolation gate (Realtime Round 2):
+ *
+ * CDC capture is GLOBAL — every committed write on every table enters the
+ * same sink → outbox → runtime ingest pipeline. This suite adversarially
+ * proves a subscriber's stream stays confined to its own table:
+ *
+ *  1. Two RLS tables: `tasks`-shaped (subscribed, with a query window) and
+ *     an `activity`-shaped table with NO live subscribers.
+ *  2. Interleaved concurrent writes across BOTH tables while the tasks
+ *     subscriber is live — direct sink dispatch AND batched outbox
+ *     redelivery (the plausible leak path).
+ *  3. Every delivered event must trace to a tasks-table row (id + payload),
+ *     never an activity id — including no `revoked` events masquerading a
+ *     cross-table leak. `checkFailures` must stay 0.
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { connectPglite } from "../../drivers/pglite.ts";
+import {
+  installOkeRlsHelpers,
+  ROW_PASSES_POLICIES_STATEMENTS as ROW_PASSES,
+  type RlsIdentity,
+} from "../../drivers/pg-rls.ts";
+import { CdcOutbox, CdcOutboxRunner, type OutboxRow } from "../../drivers/cdc-outbox.ts";
+import type { SqlConnection } from "../../drivers/types.ts";
+import { liveQueryRuntimeFromConn } from "./live-query-server.ts";
+import type { LiveQueryEvent } from "./live-query-runtime.ts";
+
+const ALICE: RlsIdentity = { gate: "member", userId: "alice", scopes: ["member"] };
+const TASKS = "oke_live_gate_tasks";
+const ACTIVITY = "oke_live_gate_activity";
+
+/** All delivered ids must belong to the tasks table, never activity. */
+function assertIsolation(delivered: readonly LiveQueryEvent[]): void {
+  for (const event of delivered) {
+    if (event.kind === "upsert") {
+      expect(TASK_EVENT_IDS.has(String((event.row as Record<string, unknown>).id))).toBe(true);
+    } else {
+      // revoked / delete — the id must still be a tasks id (a cross-table
+      // leak masquerading as revoked/delete must fail here).
+      expect(TASK_EVENT_IDS.has(String((event as { id: unknown }).id))).toBe(true);
+    }
+  }
+}
+
+/** The full task-id universe this suite ever writes. */
+const TASK_EVENT_IDS = new Set(["t1", "t2", "t3", "t4"]);
+/** Activity ids written adversarially — must never appear in any stream. */
+const ACTIVITY_EVENT_IDS = ["a1", "a2", "a3", "a4", "a5", "a6"];
+
+describe("cross-table live isolation (pglite, global CDC)", () => {
+  let conn: SqlConnection;
+
+  beforeAll(async () => {
+    conn = await connectPglite({ url: "memory://oke-live-isolation", role: "primary" });
+    await installOkeRlsHelpers((sql) => conn.exec(sql));
+    for (const stmt of ROW_PASSES) await conn.exec(stmt);
+    for (const table of [TASKS, ACTIVITY]) {
+      await conn.exec(`DROP TABLE IF EXISTS ${table}`);
+      await conn.exec(`CREATE TABLE ${table} (
+        id text PRIMARY KEY, owner text NOT NULL, status text NOT NULL)`);
+      await conn.exec(`GRANT SELECT, INSERT, UPDATE, DELETE ON ${table} TO oke_app`);
+      await conn.exec(`ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY`);
+      await conn.exec(`CREATE POLICY owner_all ON ${table} AS PERMISSIVE FOR ALL TO public
+        USING (owner = oke.user()) WITH CHECK (owner = oke.user())`);
+    }
+  }, 30_000);
+
+  afterAll(async () => {
+    await conn.close();
+  });
+
+  async function seed(table: string, id: string, owner: string, status: string): Promise<void> {
+    await conn.query(`INSERT INTO ${table} VALUES (?, ?, ?)`, [id, owner, status]);
+  }
+
+  test("interleaved concurrent multi-table writes — stream stays tasks-only", async () => {
+    const runtime = liveQueryRuntimeFromConn(conn);
+    const delivered: LiveQueryEvent[] = [];
+    const unsub = runtime.subscribe({
+      id: "sse-iso-tasks",
+      ref: "sql:app",
+      table: TASKS,
+      pkColumn: "id",
+      identity: ALICE,
+      whereSql: `status = 'open'`,
+      deliver(e) {
+        delivered.push(e);
+      },
+    });
+    try {
+      // Overlapping tick work: every write below lands while the subscriber
+      // is live and the shared ingest pipeline is busy on BOTH tables.
+      await seed(TASKS, "t1", "alice", "open");
+      await seed(ACTIVITY, "a1", "alice", "log");
+      await seed(TASKS, "t2", "alice", "open");
+      await seed(ACTIVITY, "a2", "alice", "log");
+      await seed(TASKS, "t3", "alice", "open");
+      await seed(ACTIVITY, "a3", "alice", "log");
+
+      // Concurrent interleave — tasks and activity CDC events hit the shared
+      // sink in the same ticks (Promise.all keeps them in-flight together).
+      await Promise.all([
+        conn.query(`UPDATE ${TASKS} SET status = 'done' WHERE id = 't2'`),
+        conn.query(`INSERT INTO ${ACTIVITY} VALUES ('a4', 'alice', 'log')`),
+        conn.query(`UPDATE ${TASKS} SET status = 'open' WHERE id = 't2'`),
+        conn.query(`INSERT INTO ${ACTIVITY} VALUES ('a5', 'alice', 'log')`),
+      ]);
+
+      // Feed every committed change through the shared runtime ingest —
+      // activity events ride the exact same pipeline as task events.
+      runtime.onCdc({
+        tableName: ACTIVITY,
+        op: "insert",
+        before: null,
+        after: { id: "a4", owner: "alice", status: "log" },
+      });
+      runtime.onCdc({
+        tableName: TASKS,
+        op: "update",
+        before: { id: "t2", owner: "alice", status: "done" },
+        after: { id: "t2", owner: "alice", status: "open" },
+      });
+      runtime.onCdc({
+        tableName: ACTIVITY,
+        op: "update",
+        before: { id: "a2", owner: "alice", status: "log" },
+        after: { id: "a2", owner: "alice", status: "log2" },
+      });
+      runtime.onCdc({
+        tableName: TASKS,
+        op: "delete",
+        before: { id: "t3", owner: "alice", status: "open" },
+        after: null,
+      });
+      runtime.onCdc({
+        tableName: ACTIVITY,
+        op: "delete",
+        before: { id: "a3", owner: "alice", status: "log" },
+        after: null,
+      });
+      runtime.onCdc({
+        tableName: ACTIVITY,
+        op: "insert",
+        before: null,
+        after: { id: "a6", owner: "alice", status: "log" },
+      });
+
+      // t1 exits the query window — commit the heap change first (mirror
+      // production ordering), then feed the CDC event.
+      await conn.query(`UPDATE ${TASKS} SET status = 'done' WHERE id = 't1'`);
+      runtime.onCdc({
+        tableName: TASKS,
+        op: "update",
+        before: { id: "t1", owner: "alice", status: "open" },
+        after: { id: "t1", owner: "alice", status: "done" },
+      });
+
+      await new Promise((r) => setTimeout(r, 80));
+      assertIsolation(delivered);
+      expect(delivered).toEqual([
+        // t2 done→open (after-image re-enters window) → upsert;
+        // t3 deleted → delete (ingest order);
+        // t1 open→done exits the window → revoked(reason query).
+        // Every activity event (a1–a6) absent — global CDC never leaks.
+        { kind: "upsert", row: { id: "t2", owner: "alice", status: "open" } },
+        { kind: "delete", id: "t3" },
+        { kind: "revoked", id: "t1", reason: "query" },
+      ]);
+      expect(runtime.metrics.checkFailures).toBe(0);
+    } finally {
+      unsub();
+    }
+  });
+
+  test("batched outbox redelivery with mixed tables — isolation survives replay", async () => {
+    const outbox = new CdcOutbox(conn);
+    await outbox.ensure();
+
+    const runtime = liveQueryRuntimeFromConn(conn);
+    const drainedEvents: LiveQueryEvent[] = [];
+    runtime.subscribe({
+      id: "sse-iso-poller",
+      ref: "sql:app",
+      table: TASKS,
+      pkColumn: "id",
+      identity: ALICE,
+      whereSql: `status = 'open'`,
+      deliver(e) {
+        drainedEvents.push(e);
+      },
+    });
+
+    // Another host committed these; a mixed batch (tasks + activity) drains
+    // back through the shared runtime in one runner tick. Fresh ids — the
+    // replay leg must not depend on test 1's rows.
+    await seed(TASKS, "t4", "alice", "open");
+    await seed(ACTIVITY, "b1", "alice", "log");
+    await outbox.append({
+      tableName: ACTIVITY,
+      op: "insert",
+      before: null,
+      after: { id: "b1", owner: "alice", status: "log" },
+    });
+    await outbox.append({
+      tableName: TASKS,
+      op: "insert",
+      before: null,
+      after: { id: "t4", owner: "alice", status: "open" },
+    });
+    await outbox.append({
+      tableName: ACTIVITY,
+      op: "update",
+      before: { id: "b1", owner: "alice", status: "log" },
+      after: { id: "b1", owner: "alice", status: "log2" },
+    });
+
+    let batches = 0;
+    const runner = new CdcOutboxRunner(
+      outbox,
+      async (rows: readonly OutboxRow[]) => {
+        batches += 1;
+        for (const row of rows) {
+          runtime.onCdc({
+            tableName: row.tableName,
+            op: row.op,
+            before: row.before,
+            after: row.after,
+            ...(Number.isFinite(row.seq) ? { seq: row.seq } : {}),
+            ...(row.mutationId !== undefined ? { mutationId: row.mutationId } : {}),
+          });
+        }
+      },
+      { intervalMs: 10_000 },
+    );
+    const drained = await runner.tick();
+    expect(drained).toBe(3);
+    expect(batches).toBe(1);
+    await new Promise((r) => setTimeout(r, 80));
+
+    // Mixed batch: exactly one tasks event survives classification; the two
+    // activity rows in the same batch never surface — no revoked, no upsert.
+    // The replayed task event carries the outbox seq (round-trip stamp).
+    expect(drainedEvents).toEqual([
+      { kind: "upsert", row: { id: "t4", owner: "alice", status: "open" }, seq: 2 },
+    ]);
+    assertIsolation(drainedEvents);
+    for (const id of ACTIVITY_EVENT_IDS) {
+      expect(drainedEvents.some((e) => JSON.stringify(e).includes(id))).toBe(false);
+    }
+    await runner.stop?.();
+  });
+
+  test("activity-table subscriber sees only activity rows (symmetry control)", async () => {
+    const runtime = liveQueryRuntimeFromConn(conn);
+    const delivered: LiveQueryEvent[] = [];
+    const unsub = runtime.subscribe({
+      id: "sse-iso-activity",
+      ref: "sql:app",
+      table: ACTIVITY,
+      pkColumn: "id",
+      identity: ALICE,
+      deliver(e) {
+        delivered.push(e);
+      },
+    });
+    try {
+      await seed(ACTIVITY, "a9", "alice", "log");
+      await seed(TASKS, "t9", "alice", "open");
+      runtime.onCdc({
+        tableName: ACTIVITY,
+        op: "insert",
+        before: null,
+        after: { id: "a9", owner: "alice", status: "log" },
+      });
+      runtime.onCdc({
+        tableName: TASKS,
+        op: "insert",
+        before: null,
+        after: { id: "t9", owner: "alice", status: "open" },
+      });
+      await new Promise((r) => setTimeout(r, 80));
+      expect(delivered).toEqual([
+        { kind: "upsert", row: { id: "a9", owner: "alice", status: "log" } },
+      ]);
+    } finally {
+      unsub();
+    }
+  });
+});