prostgles-server 4.2.643 → 4.2.644

package/lib/DboBuilder/ViewHandler/size.ts

@@ -9,6 +9,7 @@ import {
 import type { ViewHandler } from "./ViewHandler";
 import { getReturnTypeQuery } from "./getReturnTypeQuery";
 import type { Param3 } from "./find";
+import { getDbHandlerWithAbort } from "./getDbHandlerWithAbort";
 export async function size(
   this: ViewHandler,
   _filter?: Filter,
@@ -62,7 +63,7 @@ export async function size(
         return queryToReturn as unknown[];
       }
 
-      const handler = this.getDbHandlerWithAbort(localParams, {
+      const handler = getDbHandlerWithAbort(this, localParams, {
         abortSignal: selectParams?.abortSignal,
         abortSignalId: param3?.abortSignalId,
       });

package/lib/initProstgles.ts

@@ -19,6 +19,17 @@ import { updateConfiguration, type clientOnlyUpdateKeys } from "./updateConfigur
 import { sleep } from "./utils/utils";
 import { getClientHandlers } from "./WebsocketAPI/getClientHandlers";
 import { getAdminClient } from "./DboBuilder/runSql/getAdminClient";
+import { createServerSideRequest } from "./Auth/utils/serverSideRequest";
+
+type ClientDBHandlerRequest =
+  | AuthClientRequest
+  | {
+      /** Trusted server-only identity, resolved through auth.findUser on every operation. */
+      userId: string;
+      socket?: never;
+      httpReq?: never;
+      res?: never;
+    };
 
 /**
  * Database connection details
@@ -125,9 +136,12 @@ export type InitResult<
   update: (newOpts: UpdatableOptions<S, SUser, Context>, force?: true) => Promise<void>;
   restart: () => Promise<InitResult<S, SUser, Context, ClientSchema>>;
   options: ProstglesInitOptions<S, SUser, Context>;
-  /** Uses the configured client schema by default and accepts a publish-profile schema override. */
+  /**
+   * Uses the configured client schema by default and accepts a publish-profile schema override.
+   * Only pass userId from trusted server code; never forward client-supplied input here.
+   */
   getClientDBHandlers: <NarrowedClientSchema = ClientSchema>(
-    clientReq: AuthClientRequest,
+    clientReq: ClientDBHandlerRequest,
     scope: PermissionScope | undefined,
   ) => ReturnType<typeof getClientHandlers<NarrowedClientSchema>>;
 
@@ -333,10 +347,22 @@ export const initProstgles = async function (
         await sleep(1000);
         return true;
       },
-      getClientDBHandlers: <ClientSchema = void>(
-        clientReq: AuthClientRequest,
+      getClientDBHandlers: async <ClientSchema = void>(
+        clientReq: ClientDBHandlerRequest,
         scope: PermissionScope | undefined,
-      ) => getClientHandlers<ClientSchema>(this, clientReq, scope),
+      ) => {
+        if ("userId" in clientReq) {
+          if ("socket" in clientReq || "httpReq" in clientReq || "res" in clientReq) {
+            throw new Error("userId cannot be combined with a client request");
+          }
+          return getClientHandlers<ClientSchema>(
+            this,
+            createServerSideRequest(this, clientReq.userId),
+            scope,
+          );
+        }
+        return getClientHandlers<ClientSchema>(this, clientReq, scope);
+      },
     };
 
     return initResult;

package/lib/runClientRequest.ts

@@ -15,6 +15,7 @@ import { canRunSQL } from "./DboBuilder/runSql/runSQL";
 import type { Prostgles } from "./Prostgles";
 import type { ParsedTableRule } from "./PublishParser/publishTypesAndUtils";
 import { type PermissionScope } from "./PublishParser/publishTypesAndUtils";
+import { getAbortSignalKeys } from "./DboBuilder/ViewHandler/getDbHandlerWithAbort";
 
 const TABLE_METHODS = {
   find: 1,
@@ -104,9 +105,12 @@ export const runClientRequest = async function (
     );
   }
 
-  const tableHandler = transactionHandlers ?
-    (Object.hasOwn(transactionHandlers, tableName) ? transactionHandlers[tableName] : undefined)
-  : this.dboBuilder.dboMap.get(tableName);
+  const tableHandler =
+    transactionHandlers ?
+      Object.hasOwn(transactionHandlers, tableName) ?
+        transactionHandlers[tableName]
+      : undefined
+    : this.dboBuilder.dboMap.get(tableName);
   if (!tableHandler) {
     throw `tableName ${tableName} is invalid or not allowed`;
   }
@@ -123,7 +127,7 @@ export const runClientRequest = async function (
     scope,
   });
 
-  const sessionUser = getSessionUser(clientInfo);
+  const sessionUser = getSessionUser(clientInfo, this.opts.auth?.sessionFields);
   const localParams: LocalParams = {
     clientReq,
     isRemoteRequest: { user: sessionUser, clientInfo },
@@ -155,7 +159,6 @@ export const runClientRequest = async function (
       scope,
     );
 
-    tableHandler.abortRequests.add(validation.data.param1.abortSignalId);
     return tableHandler.abortRemoteQuery(validation.data.param1.abortSignalId, localParams);
   } else {
     this.publishParser.validateRequestRule(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prostgles-server",
-  "version": "4.2.643",
+  "version": "4.2.644",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",