orez-sync-cf-host 0.5.28 → 0.5.30

package/README.md

@@ -7,9 +7,10 @@ from `src/harness-worker.ts`. Consumers provide a JSON Zero schema, application
 DDL/seed initializer, normalized-claims authenticator, mutator registry, and an
 optional row-visibility hook.
 
-The Worker authenticates at the consumer edge, forwards only normalized claims
-to a per-namespace Durable Object, and never logs tokens, mutation arguments, or
-row contents. Pull runs `engine_handle_pull` inside `transactionSync`; push runs
+The Worker authenticates at the consumer edge and forwards normalized claims
+inside the binding request body, where request-header observability cannot record
+them. It never logs tokens, mutation arguments, or row contents. Pull runs
+`engine_handle_pull` inside `transactionSync`; push runs
 Rust `push_validate`/`preflight`/`finalize`/`record_app_error` steps around the
 registered asynchronous TypeScript mutator inside `ctx.storage.transaction`.
 Every SQL cursor is materialized before an await. Mutators may await only their

package/dist/host.d.ts

@@ -2,7 +2,8 @@ import { DurableObject } from 'cloudflare:workers';
 import type { SyncHostConfig, SyncHostEnv } from './types.js';
 /**
  * Create the consumer-facing Worker router. Authentication happens here; the
- * Durable Object receives only normalized claims over a binding-private header.
+ * Durable Object receives normalized claims inside the binding request body so
+ * observability systems cannot record them as request-header metadata.
  */
 export declare function createSyncWorker<Env extends SyncHostEnv>(config: SyncHostConfig<Env>): ExportedHandler<Env>;
 export interface SyncDurableObjectConstructor<Env extends SyncHostEnv> {

package/dist/host.js

@@ -6,7 +6,6 @@ import { decodeSqlParams, SqlStorageDirect, SqlStorageMutatorTransaction, SqlSto
 import { isMutationApplicationError } from './types.js';
 import { engine_apply_snapshot_changes, engine_apply_snapshot_page, engine_apply_upstream, engine_assemble_push_response, engine_begin_snapshot_generation, engine_finalize, engine_finalize_snapshot_generation, engine_handle_pull, engine_handle_query_pull, engine_init_query_schema, engine_init_schema, engine_invalidate, engine_memory_bytes, engine_preflight, engine_prune, engine_push_validate, engine_read_snapshot_progress, engine_record_app_error, engine_state, engine_version, } from './wasm.js';
 import { IngestBreakerError, IngestCircuitBreaker, retryDelayMs, shouldRetryDelegatedPush, } from './write-safeguards.js';
-const CLAIMS_HEADER = 'x-orez-sync-claims';
 const NAMESPACE_HEADER = 'x-orez-sync-namespace';
 const UPSTREAM_PATH_HEADER = 'x-orez-sync-upstream-path';
 const DEFAULT_SNAPSHOT_PAGE_ROWS = 2_000;
@@ -89,19 +88,38 @@ function routeAfterNamespace(pathname) {
     const [, , ...parts] = pathname.split('/');
     return `/${parts.join('/')}`;
 }
-function claimsFromRequest(request) {
-    const encoded = request.headers.get(CLAIMS_HEADER);
-    if (!encoded)
-        return null;
-    try {
-        const value = JSON.parse(decodeURIComponent(encoded));
-        return value && typeof value.userID === 'string' && value.userID.length > 0
-            ? value
-            : null;
+function jsonBodyRequest(request, headers, body) {
+    headers.delete('content-encoding');
+    headers.delete('content-length');
+    headers.set('content-type', 'application/json');
+    return new Request(request.url, {
+        method: request.method,
+        headers,
+        body: JSON.stringify(body),
+    });
+}
+async function forwardedSyncRequest(request) {
+    const value = await requestObject(request);
+    const claims = value.claims;
+    const body = value.body;
+    const userID = claims && typeof claims === 'object' && !Array.isArray(claims)
+        ? claims.userID
+        : null;
+    if (!claims ||
+        typeof claims !== 'object' ||
+        Array.isArray(claims) ||
+        typeof userID !== 'string' ||
+        userID.length === 0) {
+        throw requestError('missing normalized claims', 401);
     }
-    catch {
-        return null;
+    if (!body || typeof body !== 'object' || Array.isArray(body)) {
+        throw requestError('request body must be a JSON object');
     }
+    const headers = new Headers(request.headers);
+    return {
+        claims: claims,
+        request: jsonBodyRequest(request, headers, body),
+    };
 }
 async function namespaceHash(namespace) {
     const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(namespace));
@@ -124,7 +142,8 @@ function socketCloseQuietly(socket, code, reason) {
 }
 /**
  * Create the consumer-facing Worker router. Authentication happens here; the
- * Durable Object receives only normalized claims over a binding-private header.
+ * Durable Object receives normalized claims inside the binding request body so
+ * observability systems cannot record them as request-header metadata.
  */
 export function createSyncWorker(config) {
     validateSyncHostConfig(config);
@@ -153,14 +172,22 @@ export function createSyncWorker(config) {
                     return json({ error: 'forbidden' }, 403);
             }
             const headers = new Headers(request.headers);
-            headers.delete(CLAIMS_HEADER);
             headers.delete(NAMESPACE_HEADER);
             headers.delete(UPSTREAM_PATH_HEADER);
+            let forwardedBody = null;
             if (!isAdmin && route !== '/wake' && route !== '/notify') {
                 const claims = await config.authenticate(request, env);
                 if (!claims)
                     return json({ error: 'missing authentication' }, 401);
-                headers.set(CLAIMS_HEADER, encodeURIComponent(JSON.stringify(claims)));
+                if ((route === '/pull' || route === '/push') && request.method === 'POST') {
+                    try {
+                        const body = await requestObject(request);
+                        forwardedBody = { claims, body };
+                    }
+                    catch (error) {
+                        return json(errorBody(error), statusOf(error));
+                    }
+                }
             }
             headers.set(NAMESPACE_HEADER, await namespaceHash(namespace));
             if (config.upstream) {
@@ -172,7 +199,9 @@ export function createSyncWorker(config) {
                 }
                 headers.set(UPSTREAM_PATH_HEADER, namespacePath.replace(/\/$/, ''));
             }
-            const forwarded = new Request(request, { headers });
+            const forwarded = forwardedBody
+                ? jsonBodyRequest(request, headers, forwardedBody)
+                : new Request(request, { headers });
             const id = env.SYNC_DO.idFromName(namespace);
             return env.SYNC_DO.get(id).fetch(forwarded);
         },
@@ -1028,7 +1057,6 @@ export function createSyncDurableObject(config) {
                         return json(plan.response);
                     const endpoint = new URL(`${upstreamPath ?? ''}${config.mutateUrl}`, config.mutateOrigin ?? 'https://upstream.invalid');
                     const headers = new Headers(request.headers);
-                    headers.delete(CLAIMS_HEADER);
                     headers.delete(NAMESPACE_HEADER);
                     headers.delete(UPSTREAM_PATH_HEADER);
                     headers.set('host', endpoint.host);
@@ -1440,35 +1468,25 @@ export function createSyncDurableObject(config) {
                     return json(errorBody(error), statusOf(error));
                 }
             }
-            const claims = claimsFromRequest(request);
-            if (!claims)
-                return json({ error: 'missing normalized claims' }, 401);
-            if (route === '/pull' && request.method === 'POST') {
+            if ((route === '/pull' || route === '/push') && request.method === 'POST') {
+                let forwarded;
                 try {
-                    await this.#ingest(upstreamPath);
+                    forwarded = await forwardedSyncRequest(request);
                 }
                 catch (error) {
-                    // Workerd requires a forwarded request body to be consumed even when
-                    // ingest fails before the pull handler parses it.
-                    await request.arrayBuffer();
                     return json(errorBody(error), statusOf(error));
                 }
-                return this.#pull(request, claims, namespace);
-            }
-            if (route === '/push' && request.method === 'POST') {
-                // A push may be the first request for a fresh namespace. DATA's
-                // /changes call is also its schema-provisioning barrier, so complete it
-                // before delegating the mutation to APP. Pull already enforces this
-                // ordering above; skipping it here let APP race half-created tables and
-                // surface a terminal, bodyless 500 to Zero.
+                // pull and push both establish the upstream schema and snapshot barrier.
                 try {
                     await this.#ingest(upstreamPath);
                 }
                 catch (error) {
-                    await request.arrayBuffer();
                     return json(errorBody(error), statusOf(error));
                 }
-                return this.#push(request, claims, namespace, upstreamPath);
+                if (route === '/pull') {
+                    return this.#pull(forwarded.request, forwarded.claims, namespace);
+                }
+                return this.#push(forwarded.request, forwarded.claims, namespace, upstreamPath);
             }
             return json({ error: 'not found' }, 404);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orez-sync-cf-host",
-  "version": "0.5.28",
+  "version": "0.5.30",
   "type": "module",
   "exports": {
     ".": {