prostgles-server 4.2.642 → 4.2.644

package/lib/DboBuilder/DboBuilder.ts

@@ -29,6 +29,7 @@ import {
   getCanExecute,
   getConstraints,
   getSerializedClientErrorFromPGError,
+  TX_KEY,
 } from "./dboBuilderUtils";
 import { prepareShortestJoinPaths } from "./joins/prepareShortestJoinPaths";
 import { cacheDBTypes, runSQL } from "./runSql/runSQL";
@@ -304,10 +305,14 @@ export class DboBuilder {
     });
 
     if (this.prostgles.opts.transactions) {
-      const txKey = "tx";
+      if (this.dboMap.has(TX_KEY)) {
+        throw new Error(
+          `Transaction key ${JSON.stringify(TX_KEY)} clashes with an existing table or view name`,
+        );
+      }
 
       //@ts-ignore
-      this.dbo[txKey] = <R, TH extends DbTxTableHandlers & Pick<DBHandlerServer, "sql">>(
+      this.dbo[TX_KEY] = <R, TH extends DbTxTableHandlers & Pick<DBHandlerServer, "sql">>(
         cb: TxCB<Promise<R>, TH>,
       ) => this.getTX(cb);
     }

package/lib/DboBuilder/ViewHandler/ViewHandler.ts

@@ -25,7 +25,7 @@ import { getColumns } from "../getColumns";
 import type { Graph } from "../joins/shortestPath";
 import { count } from "./count";
 import { find, type Param3 } from "./find";
-import { getDbHandlerWithAbort } from "./getDbHandlerWithAbort";
+import { getAbortSignalKeys } from "./getDbHandlerWithAbort";
 import { getInfo } from "./getInfo";
 import { parseFieldFilter } from "./parseFieldFilter";
 import { size } from "./size";
@@ -121,20 +121,21 @@ export class ViewHandler {
   };
 
   abortRemoteQuery = (abortSignalId: string, localParams: LocalParams) => {
-    const sid = this.dboBuilder.prostgles.authHandler.getSIDNoError(localParams.clientReq);
-    if (!sid) {
-      throw new Error(
-        "Cannot get SID from client request. Ensure that the client is authenticated before using abortable queries.",
-      );
-    }
-    const abortableQuery = this.activeQueries.get(abortSignalId);
-    if (!abortableQuery || abortableQuery.sid !== sid) {
+    const abortSignalKeys = getAbortSignalKeys(
+      this.dboBuilder.prostgles,
+      { abortSignalId },
+      localParams,
+    );
+
+    const abortableQuery = this.activeQueries.get(abortSignalKeys.abortSignalKey);
+    if (!abortableQuery) {
       throw new Error(
         `No active query found with abortSignalId ${abortSignalId}. Ensure that the query was initiated with the correct abortSignalId.`,
       );
     }
+    this.abortRequests.add(abortSignalKeys.abortSignalKey);
     abortableQuery.abort();
-    this.abortRequests.delete(abortSignalId);
+    this.abortRequests.delete(abortSignalKeys.abortSignalKey);
   };
 
   activeQueries = new Map<
@@ -148,7 +149,6 @@ export class ViewHandler {
     }
   >();
   abortRequests = new Set<string>();
-  getDbHandlerWithAbort = getDbHandlerWithAbort.bind(this);
 
   _log = ({
     command,

package/lib/DboBuilder/ViewHandler/count.ts

@@ -9,6 +9,7 @@ import {
 import type { ViewHandler } from "./ViewHandler";
 import { getReturnTypeQuery } from "./getReturnTypeQuery";
 import type { Param3 } from "./find";
+import { getDbHandlerWithAbort } from "./getDbHandlerWithAbort";
 
 export async function count(
   this: ViewHandler,
@@ -59,7 +60,7 @@ export async function count(
         return queryToReturn as unknown[];
       }
 
-      const handler = this.getDbHandlerWithAbort(localParams, {
+      const handler = getDbHandlerWithAbort(this, localParams, {
         abortSignal: selectParams?.abortSignal,
         abortSignalId: param3?.abortSignalId,
       });

package/lib/DboBuilder/ViewHandler/find.ts

@@ -13,6 +13,7 @@ import { getSelectQuery } from "../QueryBuilder/getSelectQuery";
 import { getReturnTypeQuery } from "./getReturnTypeQuery";
 import { validateSelectParams } from "./validateSelectParams";
 import type { ViewHandler } from "./ViewHandler";
+import { getDbHandlerWithAbort } from "./getDbHandlerWithAbort";
 
 export type Param3 = {
   abortSignalId?: string;
@@ -102,7 +103,7 @@ export const find = async function (
 
     const query = queryWithRLS;
     const isOneOrNone = returnType === "row" || returnType === "value";
-    const dbHandler = this.getDbHandlerWithAbort(localParams, {
+    const dbHandler = getDbHandlerWithAbort(this, localParams, {
       abortSignal,
       abortSignalId: param3?.abortSignalId,
     });

package/lib/DboBuilder/ViewHandler/getDbHandlerWithAbort.ts

@@ -2,12 +2,16 @@ import type { DB } from "../../initProstgles";
 import { QUERY_ID_PREFIX, type LocalParams } from "../DboBuilder";
 import type { ViewHandler } from "./ViewHandler";
 import type pgPromise from "pg-promise";
+import { getServerSideUserId } from "../../Auth/utils/serverSideRequest";
+import type { Prostgles } from "../../Prostgles";
 
-export function getDbHandlerWithAbort(
-  this: ViewHandler,
+type Params = { abortSignal: AbortSignal | undefined; abortSignalId: string | undefined };
+
+export const getDbHandlerWithAbort = (
+  viewHandler: ViewHandler,
   localParams: LocalParams | undefined,
-  params: { abortSignal: AbortSignal | undefined; abortSignalId: string | undefined },
-): Pick<DB | pgPromise.ITask<{}>, "any" | "one" | "many" | "manyOrNone" | "none" | "oneOrNone"> {
+  params: Params,
+): Pick<DB | pgPromise.ITask<{}>, "any" | "one" | "many" | "manyOrNone" | "none" | "oneOrNone"> => {
   if (params.abortSignal && params.abortSignalId) {
     throw new Error("Cannot provide both abortSignal and abortSignalId");
   }
@@ -16,28 +20,29 @@ export function getDbHandlerWithAbort(
     throw new Error("Query aborted before execution");
   }
 
-  const abortSignal =
-    params.abortSignal ?? AbortSignal.timeout(localParams?.clientReq ? 7_000 : 120_000);
-  const abortSignalId = params.abortSignalId ?? crypto.randomUUID();
-
-  if (this.activeQueries.has(abortSignalId)) {
-    throw new Error(
-      `A query with abortSignalId ${params.abortSignalId} is already active. Ensure that each query has a unique abortSignalId.`,
-    );
+  if (params.abortSignal !== undefined && !(params.abortSignal instanceof AbortSignal)) {
+    throw new Error("abortSignal must be an instance of AbortSignal");
   }
-  const handler = this.getTransaction(localParams)?.t ?? this.db;
-  const { adminClient } = this.dboBuilder.prostgles;
+
+  const { clientReq } = localParams ?? {};
+  const abortSignal = params.abortSignal ?? AbortSignal.timeout(clientReq ? 7_000 : 120_000);
+  const { prostgles } = viewHandler.dboBuilder;
+  const handler = viewHandler.getTransaction(localParams)?.t ?? viewHandler.db;
+  const { adminClient } = prostgles;
   if (!adminClient) {
     throw new Error(
       "adminClient not available. Ensure prostgles.adminClient is initialized before using abortable queries.",
     );
   }
-  const sid = this.dboBuilder.prostgles.authHandler.getSIDNoError(localParams?.clientReq);
-  if (!sid && localParams?.clientReq) {
+
+  const signalKeys = getAbortSignalKeys(prostgles, params, localParams);
+  const { abortSignalKey } = signalKeys;
+  if (viewHandler.activeQueries.has(abortSignalKey)) {
     throw new Error(
-      "Cannot get SID from client request. Ensure that the client is authenticated before using abortable queries.",
+      `A query with abortSignalId ${params.abortSignalId} is already active. Ensure that each query has a unique abortSignalId.`,
     );
   }
+
   const withAbortQuery = <Args extends unknown[], R extends Promise<any>>(
     func: (query: string, ...args: Args) => R,
   ) => {
@@ -52,16 +57,17 @@ export function getDbHandlerWithAbort(
       }
 
       const abort = () => {
-        void this._log({
-          data: { query, abortSignalId },
+        void viewHandler._log({
+          data: { query, abortSignalId: signalKeys.abortSignalId },
           command: "abort",
           localParams,
-          duration: Date.now() - (this.activeQueries.get(abortSignalId)?.start ?? Date.now()),
+          duration:
+            Date.now() - (viewHandler.activeQueries.get(abortSignalKey)?.start ?? Date.now()),
           error: new Error("Query aborted"),
         });
         /** Only terminate if there is exactly one matching query with a query id prefix */
 
-        this.abortRequests.delete(abortSignalId);
+        viewHandler.abortRequests.delete(abortSignalKey);
         void adminClient
           .query(
             `
@@ -71,17 +77,18 @@ export function getDbHandlerWithAbort(
             `,
             [`${queryIdPrefix}%`],
           )
-          .catch((err) => {
+          .catch((_err) => {
             // ignore error
           });
       };
 
-      if (this.abortRequests.has(abortSignalId)) {
-        this.abortRequests.delete(abortSignalId);
-        throw new Error(`Abort requested`);
+      if (viewHandler.abortRequests.has(abortSignalKey)) {
+        viewHandler.abortRequests.delete(abortSignalKey);
+        throw new Error("Abort already requested");
       }
 
-      this.activeQueries.set(abortSignalId, {
+      const sid = prostgles.authHandler.getSIDNoError(clientReq);
+      viewHandler.activeQueries.set(abortSignalKey, {
         query,
         start: Date.now(),
         sid,
@@ -91,8 +98,8 @@ export function getDbHandlerWithAbort(
       abortSignal.addEventListener("abort", abort);
       return func(query, ...args).finally(() => {
         abortSignal.removeEventListener("abort", abort);
-        this.activeQueries.delete(abortSignalId);
-        this.abortRequests.delete(abortSignalId);
+        viewHandler.activeQueries.delete(abortSignalKey);
+        viewHandler.abortRequests.delete(abortSignalKey);
       });
     };
   };
@@ -105,4 +112,40 @@ export function getDbHandlerWithAbort(
     none: withAbortQuery(handler.none.bind(handler)),
     many: withAbortQuery(handler.many.bind(handler)),
   };
-}
+};
+
+export const getAbortSignalKeys = (
+  prostgles: Prostgles,
+  params: Pick<Params, "abortSignalId">,
+  localParams: LocalParams | undefined,
+) => {
+  const clientIdentifier = (() => {
+    const { clientReq } = localParams ?? {};
+    if (!clientReq) {
+      if (params.abortSignalId !== undefined) {
+        throw new Error(
+          "abortSignalId must not be provided for local requests. Use abortSignal instead.",
+        );
+      }
+      return ["<local-request>", "local"];
+    }
+    const sid = prostgles.authHandler.getSIDNoError(clientReq);
+    if (sid) return [sid, "sid"];
+    const userId = getServerSideUserId(prostgles, clientReq);
+    if (userId) return [userId, "userId"];
+    throw new Error(
+      "Cannot get SID or userId from client request. Ensure that the client is authenticated before using abortable queries.",
+    );
+  })();
+  const abortSignalId = params.abortSignalId ?? crypto.randomUUID();
+
+  const MAX_LENGTH = 36;
+  if (abortSignalId.length > MAX_LENGTH) {
+    throw new Error(`abortSignalId length must not exceed ${MAX_LENGTH} characters`);
+  }
+  const abortSignalKey = JSON.stringify([...clientIdentifier, abortSignalId]);
+  return {
+    abortSignalId,
+    abortSignalKey,
+  };
+};

package/lib/DboBuilder/ViewHandler/size.ts

@@ -9,6 +9,7 @@ import {
 import type { ViewHandler } from "./ViewHandler";
 import { getReturnTypeQuery } from "./getReturnTypeQuery";
 import type { Param3 } from "./find";
+import { getDbHandlerWithAbort } from "./getDbHandlerWithAbort";
 export async function size(
   this: ViewHandler,
   _filter?: Filter,
@@ -62,7 +63,7 @@ export async function size(
         return queryToReturn as unknown[];
       }
 
-      const handler = this.getDbHandlerWithAbort(localParams, {
+      const handler = getDbHandlerWithAbort(this, localParams, {
         abortSignal: selectParams?.abortSignal,
         abortSignalId: param3?.abortSignalId,
       });

package/lib/DboBuilder/dboBuilderUtils.ts

@@ -203,3 +203,5 @@ export const withUserRLS = (
   const queryId = crypto.randomUUID();
   return [QUERY_ID_PREFIX + queryId, firstQuery, query].filter(Boolean).join("\n");
 };
+
+export const TX_KEY = "tx" as const;

package/lib/PublishParser/PublishParser.ts

@@ -129,10 +129,11 @@ export class PublishParser {
               };
               return unrestrictedCtx;
             }
-            const { clientDb } = await publishParams.getClientDBHandlers(undefined);
+            const { clientDb, withClientDbTx } = await publishParams.getClientDBHandlers(undefined);
             const { clientInfo, clientReq, tables } = publishParams;
             const restrictedCtx: RestrictedFunctionContext<void, SessionUser, unknown> = {
               dbo: clientDb,
+              withClientDbTx,
               user,
               clientInfo,
               clientReq,

package/lib/PublishParser/defineServerFunction.ts

@@ -11,6 +11,7 @@ import type { SessionUser } from "../Auth/AuthTypes";
 import type { DBOFullyTyped, DBOFullyTypedClient } from "../DBSchemaBuilder/DBSchemaBuilder";
 import type { DB } from "../initProstgles";
 import type { PublishParams } from "./publishTypesAndUtils";
+import type { ClientHandlers } from "../WebsocketAPI/getClientHandlers";
 
 type FunctionContextBase<S, SUser extends SessionUser, Context> = Pick<
   PublishParams<S, SUser>,
@@ -30,6 +31,7 @@ export type RestrictedFunctionContext<
   Context = undefined,
 > = FunctionContextBase<S, SUser, Context> & {
   dbo: DBOFullyTypedClient<S>;
+  withClientDbTx: ClientHandlers<S>["withClientDbTx"];
 };
 
 export type UnrestrictedFunctionContext<
@@ -55,11 +57,7 @@ export type ServerFunctionDefinition = {
 };
 
 declare const serverFunctionContext: unique symbol;
-export type ServerFunctionContextMarker<
-  S,
-  SUser extends SessionUser,
-  Context = undefined,
-> = {
+export type ServerFunctionContextMarker<S, SUser extends SessionUser, Context = undefined> = {
   [serverFunctionContext]?: [S, SUser, [Context] extends [undefined] ? never : Context];
 };
 

package/lib/PublishParser/getPublishedTableNames.ts

@@ -2,12 +2,13 @@ import { isObject } from "prostgles-types";
 import type { PublishParser } from "./PublishParser";
 import { type PublishObject } from "./PublishParser";
 import { getFileVersionTableName, isFileVersionTable } from "../StorageClient/fileVersionUtils";
+import { TX_KEY } from "../DboBuilder/dboBuilderUtils";
 
 export const getPublishedTableNames = (
   publishParserInstance: PublishParser,
   publishObject: PublishObject,
 ) => {
-  const txKey = !publishParserInstance.prostgles.opts.transactions ? "" : "tx";
+  const txKey = !publishParserInstance.prostgles.opts.transactions ? "" : TX_KEY;
   if (txKey && txKey in publishObject) {
     throw new Error(
       `Transactions key ${JSON.stringify(txKey)} collides with a published table name`,

package/lib/PublishParser/publishTypesAndUtils.ts

@@ -127,7 +127,7 @@ export type AfterEachTsTrigger<R, DBX, Context = undefined, InputDataType = R> =
         localParams: undefined | LocalParams;
         context: Context;
       },
-  ) => Promise<void>;
+  ) => MaybePromise<void>;
 };
 
 export type ValidateRowsArgsCommon<R = AnyObject, DBX = DBHandlerServer> = {

package/lib/StorageClient/StorageClientTypes.ts

@@ -1,3 +1,4 @@
+import type { MaybePromise } from "prostgles-types";
 import type * as stream from "stream";
 
 export type LocalUploadedFileDetails = {
@@ -22,9 +23,9 @@ export type UploadFileOptions = {
   onProgress?: (bytesUploaded: number) => void;
 };
 export type StorageClientBase<T> = {
-  upload: (file: UploadFileOptions) => Promise<T>;
-  downloadAsStream: (name: string) => Promise<stream.Readable>;
-  delete: (fileName: string) => Promise<void>;
+  upload: (file: UploadFileOptions) => MaybePromise<T>;
+  downloadAsStream: (name: string) => MaybePromise<stream.Readable>;
+  delete: (fileName: string) => MaybePromise<void>;
 };
 export type LocalStorageClient = StorageClientBase<LocalUploadedFileDetails> & {
   type: "local";
@@ -32,6 +33,6 @@ export type LocalStorageClient = StorageClientBase<LocalUploadedFileDetails> & {
 };
 export type CloudStorageClient = StorageClientBase<CloudUploadedFileDetails> & {
   type: "cloud";
-  getSignedUrlForDownload: (fileName: string, expiresInSeconds: number) => Promise<string>;
+  getSignedUrlForDownload: (fileName: string, expiresInSeconds: number) => MaybePromise<string>;
 };
 export type StorageClient = LocalStorageClient | CloudStorageClient;

package/lib/WebsocketAPI/getClientHandlers.ts

@@ -1,4 +1,5 @@
 import {
+  getAllowedTableMethods,
   getKeys,
   type AnyObject,
   type ClientSchema,
@@ -8,6 +9,7 @@ import {
 } from "prostgles-types";
 import type { AuthClientRequest } from "../Auth/AuthTypes";
 import type { DBOFullyTypedClient } from "../DBSchemaBuilder/DBSchemaBuilder";
+import type { DbTxTableHandlers } from "../DboBuilder/DboBuilderTypes";
 import type { Prostgles } from "../Prostgles";
 import type { ServerFunctionDefinition } from "../PublishParser/defineServerFunction";
 import type { PermissionScope } from "../PublishParser/publishTypesAndUtils";
@@ -17,6 +19,11 @@ import { getClientSchema } from "./getClientSchema";
 export type ClientHandlers<S = void> = {
   clientSql: SQLHandler;
   clientDb: DBOFullyTypedClient<S>;
+  /**
+   * Runs permission-checked table operations in a transaction. Requires transactions: true.
+   * Caught table request errors also roll back the transaction.
+   */
+  withClientDbTx: <R>(callback: (clientDb: DBOFullyTypedClient<S>) => R | Promise<R>) => Promise<R>;
   clientMethods: Record<string, ServerFunctionDefinition>;
   clientSchema: ClientSchema;
 };
@@ -27,47 +34,74 @@ export const getClientHandlers = async <S = void>(
 ): Promise<ClientHandlers<S>> => {
   prostgles.checkNotDestroyed();
   const clientSchema =
-    clientReq.socket?.prostgles?.get(prostgles.appId) ??
+    (scope ? undefined : clientReq.socket?.prostgles?.get(prostgles.appId)) ??
     (await getClientSchema.bind(prostgles)(clientReq, scope));
+
   const sqlHandler: SQLHandler | undefined = ((
     query: string,
     params?: unknown,
     options?: SQLOptions,
   ) => runClientSqlRequest.bind(prostgles)({ query, params, options }, clientReq)) as SQLHandler;
-  const tableHandlers = Object.fromEntries(
-    prostgles.dboBuilder.tablesOrViews!.map((table) => {
-      const methods = [...tableMethods];
-      const handlers = Object.fromEntries(
-        methods.map((command) => {
-          const method = (param1: unknown, param2: unknown, param3: unknown) =>
-            runClientRequest.bind(prostgles)(
-              { command, tableName: table.name, param1, param2, param3 },
-              clientReq,
-              scope,
-            );
-          return [command, method];
-        }),
-      );
-      return [table.name, handlers];
-    }),
-  );
 
-  const txNotAllowed: {} = {
-    tx: () => {
-      throw new Error("Transactions are not allowed in client handlers");
-    },
-  };
+  const getTableHandlers = (
+    transactionHandlers?: DbTxTableHandlers,
+    onRequestError?: (error: unknown) => void,
+  ) =>
+    Object.fromEntries(
+      clientSchema.tableSchema.map((table) => {
+        const allowedMethods = getAllowedTableMethods(table);
+        const methods = tableMethods.filter((command) => allowedMethods.includes(command));
+        const handlers = Object.fromEntries(
+          methods.map((command) => {
+            const method = (param1: unknown, param2: unknown, param3: unknown) =>
+              runClientRequest
+                .bind(prostgles)(
+                  { command, tableName: table.name, param1, param2, param3 },
+                  clientReq,
+                  scope,
+                  transactionHandlers,
+                )
+                .catch((error: unknown) => {
+                  onRequestError?.(error);
+                  throw error;
+                });
+            return [command, method];
+          }),
+        );
+        return [table.name, handlers];
+      }),
+    );
+
   const clientSql = ((query: string, params?: AnyObject, options?: SQLOptions) => {
     if (scope && !scope.allowSql) {
-      throw new Error("SQL is dissallowed by PermissionScope");
+      throw new Error("SQL is disallowed by PermissionScope");
     }
 
     return sqlHandler(query, params, options);
   }) as SQLHandler;
-  const clientDb = {
-    ...tableHandlers,
-    ...txNotAllowed,
-  } as DBOFullyTypedClient<S>;
+
+  const clientDb = getTableHandlers() as unknown as DBOFullyTypedClient<S>;
+
+  const withClientDbTx: ClientHandlers<S>["withClientDbTx"] = async (callback) => {
+    prostgles.checkNotDestroyed();
+    if (!prostgles.opts.transactions) {
+      throw new Error("Transactions are not enabled");
+    }
+    return prostgles.dboBuilder.getTX(async (transactionHandlers) => {
+      /**
+       * runClientRequest throws authorization errors.
+       * Prevent cached authorization errors from committing the transaction.
+       */
+      let failure: { error: unknown } | undefined;
+      const result = await callback({
+        ...getTableHandlers(transactionHandlers, (error) => {
+          failure ??= { error };
+        }),
+      } as unknown as DBOFullyTypedClient<S>);
+      if (failure) throw failure.error;
+      return result;
+    });
+  };
 
   const clientMethods: Record<string, ServerFunctionDefinition> = Object.fromEntries(
     clientSchema.methods.map(({ name, input, description, output }) => {
@@ -81,7 +115,7 @@ export const getClientHandlers = async <S = void>(
     }),
   );
 
-  return { clientDb, clientSql, clientMethods, clientSchema };
+  return { clientDb, clientSql, clientMethods, clientSchema, withClientDbTx };
 };
 
 const tableMethods = getKeys({

package/lib/index.ts

@@ -3,6 +3,7 @@ import type { SessionUser } from "./Auth/AuthTypes";
 import type { InitResult, OnReadyCallbackBasic } from "./initProstgles";
 import { Prostgles } from "./Prostgles";
 import type { ProstglesInitOptions } from "./ProstglesTypes";
+export { DB_GENERATED_NAMES } from "./DBSchemaBuilder/constants";
 
 function prostgles<
   S = void,
@@ -22,9 +23,8 @@ export const createProstgles = <
   SUser extends SessionUser = SessionUser,
   ClientSchema = S,
 >() => {
-  return <Context = undefined>(
-    params: ProstglesInitOptions<S, SUser, Context>,
-  ) => prostgles<S, SUser, Context, ClientSchema>(params);
+  return <Context = undefined>(params: ProstglesInitOptions<S, SUser, Context>) =>
+    prostgles<S, SUser, Context, ClientSchema>(params);
 };
 export * from "./PublishParser/defineServerFunction";
 export * from "./Auth/AuthTypes";

package/lib/initProstgles.ts

@@ -19,6 +19,17 @@ import { updateConfiguration, type clientOnlyUpdateKeys } from "./updateConfigur
 import { sleep } from "./utils/utils";
 import { getClientHandlers } from "./WebsocketAPI/getClientHandlers";
 import { getAdminClient } from "./DboBuilder/runSql/getAdminClient";
+import { createServerSideRequest } from "./Auth/utils/serverSideRequest";
+
+type ClientDBHandlerRequest =
+  | AuthClientRequest
+  | {
+      /** Trusted server-only identity, resolved through auth.findUser on every operation. */
+      userId: string;
+      socket?: never;
+      httpReq?: never;
+      res?: never;
+    };
 
 /**
  * Database connection details
@@ -125,9 +136,12 @@ export type InitResult<
   update: (newOpts: UpdatableOptions<S, SUser, Context>, force?: true) => Promise<void>;
   restart: () => Promise<InitResult<S, SUser, Context, ClientSchema>>;
   options: ProstglesInitOptions<S, SUser, Context>;
-  /** Uses the configured client schema by default and accepts a publish-profile schema override. */
+  /**
+   * Uses the configured client schema by default and accepts a publish-profile schema override.
+   * Only pass userId from trusted server code; never forward client-supplied input here.
+   */
   getClientDBHandlers: <NarrowedClientSchema = ClientSchema>(
-    clientReq: AuthClientRequest,
+    clientReq: ClientDBHandlerRequest,
     scope: PermissionScope | undefined,
   ) => ReturnType<typeof getClientHandlers<NarrowedClientSchema>>;
 
@@ -333,10 +347,22 @@ export const initProstgles = async function (
         await sleep(1000);
         return true;
       },
-      getClientDBHandlers: <ClientSchema = void>(
-        clientReq: AuthClientRequest,
+      getClientDBHandlers: async <ClientSchema = void>(
+        clientReq: ClientDBHandlerRequest,
         scope: PermissionScope | undefined,
-      ) => getClientHandlers<ClientSchema>(this, clientReq, scope),
+      ) => {
+        if ("userId" in clientReq) {
+          if ("socket" in clientReq || "httpReq" in clientReq || "res" in clientReq) {
+            throw new Error("userId cannot be combined with a client request");
+          }
+          return getClientHandlers<ClientSchema>(
+            this,
+            createServerSideRequest(this, clientReq.userId),
+            scope,
+          );
+        }
+        return getClientHandlers<ClientSchema>(this, clientReq, scope);
+      },
     };
 
     return initResult;

package/lib/runClientRequest.ts

@@ -9,11 +9,13 @@ import {
 import type { AuthClientRequest } from "./Auth/AuthTypes";
 import { getSessionUser } from "./Auth/utils/getSessionUser";
 import type { LocalParams } from "./DboBuilder/DboBuilder";
+import type { DbTxTableHandlers } from "./DboBuilder/DboBuilderTypes";
 import type { TableHandler as TableHandlerServer } from "./DboBuilder/TableHandler/TableHandler";
 import { canRunSQL } from "./DboBuilder/runSql/runSQL";
 import type { Prostgles } from "./Prostgles";
 import type { ParsedTableRule } from "./PublishParser/publishTypesAndUtils";
 import { type PermissionScope } from "./PublishParser/publishTypesAndUtils";
+import { getAbortSignalKeys } from "./DboBuilder/ViewHandler/getDbHandlerWithAbort";
 
 const TABLE_METHODS = {
   find: 1,
@@ -64,6 +66,7 @@ export const runClientRequest = async function (
   nonValidatedArgs: Args,
   clientReq: AuthClientRequest,
   scope: PermissionScope | undefined,
+  transactionHandlers?: DbTxTableHandlers,
 ) {
   this.checkNotDestroyed();
   /* Channel name will only include client-sent params so we ignore table_rules enforced params */
@@ -102,7 +105,12 @@ export const runClientRequest = async function (
     );
   }
 
-  const tableHandler = this.dboBuilder.dboMap.get(tableName);
+  const tableHandler =
+    transactionHandlers ?
+      Object.hasOwn(transactionHandlers, tableName) ?
+        transactionHandlers[tableName]
+      : undefined
+    : this.dboBuilder.dboMap.get(tableName);
   if (!tableHandler) {
     throw `tableName ${tableName} is invalid or not allowed`;
   }
@@ -119,7 +127,7 @@ export const runClientRequest = async function (
     scope,
   });
 
-  const sessionUser = getSessionUser(clientInfo);
+  const sessionUser = getSessionUser(clientInfo, this.opts.auth?.sessionFields);
   const localParams: LocalParams = {
     clientReq,
     isRemoteRequest: { user: sessionUser, clientInfo },
@@ -151,7 +159,6 @@ export const runClientRequest = async function (
       scope,
     );
 
-    tableHandler.abortRequests.add(validation.data.param1.abortSignalId);
     return tableHandler.abortRemoteQuery(validation.data.param1.abortSignalId, localParams);
   } else {
     this.publishParser.validateRequestRule(