sharedb 6.0.3 → 6.0.5

package/README.md

@@ -1,8 +1,8 @@
 # ShareDB
 
   [![NPM Version](https://img.shields.io/npm/v/sharedb.svg)](https://npmjs.org/package/sharedb)
-  ![Test](https://github.com/share/sharedb/workflows/Test/badge.svg)
-  [![Coverage Status](https://coveralls.io/repos/github/share/sharedb/badge.svg?branch=master)](https://coveralls.io/github/share/sharedb?branch=master)
+  ![Test](https://github.com/share/sharedb/actions/workflows/test.yml/badge.svg?branch=main)
+  [![Coverage Status](https://coveralls.io/repos/github/share/sharedb/badge.svg?branch=main)](https://coveralls.io/github/share/sharedb?branch=main)
 
 ShareDB is a realtime database backend based on [Operational Transformation
 (OT)](https://en.wikipedia.org/wiki/Operational_transformation) of JSON

package/lib/agent.js

@@ -229,6 +229,7 @@ Agent.prototype._subscribeToQuery = function(emitter, queryId, collection, query
 
 Agent.prototype._onOp = function(collection, id, op) {
   if (this._isOwnOp(collection, op)) return;
+  if (this._isOpFromCollidingChannel(collection, id, op)) return;
 
   // Ops emitted here are coming directly from pubsub, which emits the same op
   // object to listeners without making a copy. The pattern in middleware is to
@@ -263,6 +264,12 @@ Agent.prototype._isOwnOp = function(collection, op) {
   return (this._src() === op.src) && (collection === (op.i || op.c));
 };
 
+Agent.prototype._isOpFromCollidingChannel = function(collection, id, op) {
+  var projection = this.backend.projections[collection];
+  var target = (projection) ? projection.target : collection;
+  return op.c !== target || op.d !== id;
+};
+
 Agent.prototype.send = function(message) {
   // Quietly drop replies if the stream was closed
   if (this.closed) return;
@@ -388,6 +395,8 @@ Agent.prototype._checkRequest = function(request) {
       request.a === ACTIONS.fetch ||
       request.a === ACTIONS.subscribe ||
       request.a === ACTIONS.unsubscribe ||
+      request.a === ACTIONS.snapshotFetch ||
+      request.a === ACTIONS.snapshotFetchByTimestamp ||
       request.a === ACTIONS.presence) {
     // Doc-based request.
     if (request.c != null) {
@@ -401,6 +410,11 @@ Agent.prototype._checkRequest = function(request) {
       }
     }
 
+    if (request.a === ACTIONS.snapshotFetch || request.a === ACTIONS.snapshotFetchByTimestamp) {
+      if (request.c == null) return 'Invalid collection';
+      if (request.d == null) return 'Invalid id';
+    }
+
     if (request.a === ACTIONS.op || request.a === ACTIONS.presence) {
       if (request.v != null && (typeof request.v !== 'number' || request.v < 0)) return 'Invalid version';
     }
@@ -917,6 +931,10 @@ Agent.prototype._subscribePresence = function(channel, seq, cb) {
       return callback();
     }
     agent.presenceSubscriptionSeq[channel] = seq;
+    if (agent.subscribedPresences[channel]) {
+      stream.destroy();
+      return callback();
+    }
     agent.subscribedPresences[channel] = stream;
     agent._subscribeToPresenceStream(channel, stream);
     agent._requestPresence(channel, function(error) {

package/lib/backend.js

@@ -106,10 +106,7 @@ Backend.prototype.close = function(callback) {
   var wait = 4;
   var backend = this;
   function finish(err) {
-    if (err) {
-      if (callback) return callback(err);
-      return backend.emit('error', err);
-    }
+    if (err) return util.callbackOrEmit(backend, err, callback);
     if (--wait) return;
     if (callback) callback();
   }
@@ -572,7 +569,7 @@ Backend.prototype.subscribeBulk = function(agent, index, versions, callback) {
   var backend = this;
   var streams = Object.create(null);
   var doFetch = Array.isArray(versions);
-  var ids = (doFetch) ? versions : Object.keys(versions);
+  var ids = (doFetch) ? uniqueIds(versions) : Object.keys(versions);
   var request = {
     agent: agent,
     index: index,
@@ -629,6 +626,14 @@ function destroyStreams(streams) {
     streams[id].destroy();
   }
 }
+function uniqueIds(ids) {
+  var seen = Object.create(null);
+  return ids.filter(function(id) {
+    if (seen[id]) return false;
+    seen[id] = true;
+    return true;
+  });
+}
 
 Backend.prototype.queryFetch = function(agent, index, query, options, callback) {
   var start = Date.now();
@@ -742,12 +747,16 @@ Backend.prototype._triggerQuery = function(agent, index, query, options, callbac
     if (err) return callback(err);
     // Set the DB reference for the request after the middleware trigger so
     // that the db option can be changed in middleware
-    request.db = (options.db) ? backend.extraDbs[options.db] : backend.db;
+    request.db = (options.db) ? getExtraDb(backend, options.db) : backend.db;
     if (!request.db) return callback(new ShareDBError(ERROR_CODE.ERR_DATABASE_ADAPTER_NOT_FOUND, 'DB not found'));
     request.snapshotProjection = backend._getSnapshotProjection(request.db, projection);
     callback(null, request);
   });
 };
+function getExtraDb(backend, name) {
+  if (typeof name !== 'string' || !util.hasOwn(backend.extraDbs, name)) return null;
+  return backend.extraDbs[name];
+}
 
 Backend.prototype._query = function(agent, request, callback) {
   var backend = this;
@@ -878,8 +887,6 @@ Backend.prototype._fetchSnapshotByTimestamp = function(collection, id, timestamp
   var backend = this;
 
   var milestoneSnapshot;
-  var from = 0;
-  var to = null;
 
   // Always fetch the current snapshot first. We request its metadata so that we
   // can read its mtime, which lets us serve the current snapshot directly when
@@ -901,11 +908,12 @@ Backend.prototype._fetchSnapshotByTimestamp = function(collection, id, timestamp
     milestoneDb.getMilestoneSnapshotAtOrBeforeTime(collection, id, timestamp, function(error, snapshot) {
       if (error) return callback(error);
       milestoneSnapshot = snapshot;
-      if (snapshot) from = snapshot.v;
 
       milestoneDb.getMilestoneSnapshotAtOrAfterTime(collection, id, timestamp, function(error, snapshot) {
         if (error) return callback(error);
-        if (snapshot) to = snapshot.v;
+        var from = milestoneSnapshot ? milestoneSnapshot.v : 0;
+        var to = snapshot ? snapshot.v : currentSnapshot.v;
+        if (from >= to) return backend._buildSnapshotFromOps(id, milestoneSnapshot, [], callback);
 
         var options = {metadata: true};
         db.getOps(collection, id, from, to, options, function(error, ops) {

package/lib/client/doc.js

@@ -131,10 +131,7 @@ Doc.prototype.destroy = function(callback) {
   doc.whenNothingPending(function() {
     if (doc.wantSubscribe) {
       doc.unsubscribe(function(err) {
-        if (err) {
-          if (callback) return callback(err);
-          return doc.emit('error', err);
-        }
+        if (err) return util.callbackOrEmit(doc, err, callback);
         doc.connection._destroyDoc(doc);
         if (callback) callback();
       });
@@ -191,8 +188,7 @@ Doc.prototype.ingestSnapshot = function(snapshot, callback) {
       ERROR_CODE.ERR_INGESTED_SNAPSHOT_HAS_NO_VERSION,
       'Missing version in ingested snapshot. ' + this.collection + '.' + this.id
     );
-    if (callback) return callback(err);
-    return this.emit('error', err);
+    return util.callbackOrEmit(this, err, callback);
   }
 
   // If the doc is already created or there are ops pending, we cannot use the
@@ -214,8 +210,7 @@ Doc.prototype.ingestSnapshot = function(snapshot, callback) {
         ERROR_CODE.ERR_DOC_MISSING_VERSION,
         'Cannot ingest snapshot in doc with null version. ' + this.collection + '.' + this.id
       );
-      if (callback) return callback(err);
-      return this.emit('error', err);
+      return util.callbackOrEmit(this, err, callback);
     }
     // If we got a snapshot for a version further along than the document is
     // currently, issue a fetch to get the latest ops and catch us up
@@ -764,8 +759,7 @@ Doc.prototype._submit = function(op, source, callback) {
         );
       }
 
-      if (callback) return callback(err);
-      return this.emit('error', err);
+      return util.callbackOrEmit(this, err, callback);
     }
     // Try to normalize the op. This removes trailing skip:0's and things like that.
     if (this.type.normalize) op.op = this.type.normalize(op.op);
@@ -773,10 +767,7 @@ Doc.prototype._submit = function(op, source, callback) {
     // This has to happen before _pushOp(), because _tryCompose() applies the op
     // to a pending create, well before _otApply() gets a chance to check it
     var pathError = ot.checkOpPathsForType(this.type, op);
-    if (pathError) {
-      if (callback) return callback(pathError);
-      return this.emit('error', pathError);
-    }
+    if (pathError) return util.callbackOrEmit(this, pathError, callback);
   }
 
   try {
@@ -913,8 +904,7 @@ Doc.prototype.create = function(data, type, options, callback) {
   }
   if (this.type) {
     var err = new ShareDBError(ERROR_CODE.ERR_DOC_ALREADY_CREATED, 'Document already exists');
-    if (callback) return callback(err);
-    return this.emit('error', err);
+    return util.callbackOrEmit(this, err, callback);
   }
   var op = {create: {type: type, data: data}};
   var source = options && options.source;
@@ -935,8 +925,7 @@ Doc.prototype.del = function(options, callback) {
   }
   if (!this.type) {
     var err = new ShareDBError(ERROR_CODE.ERR_DOC_DOES_NOT_EXIST, 'Document does not exist');
-    if (callback) return callback(err);
-    return this.emit('error', err);
+    return util.callbackOrEmit(this, err, callback);
   }
   var op = {del: true};
   var source = options && options.source;

package/lib/client/query.js

@@ -149,8 +149,7 @@ Query.prototype._finishResponse = function(err, callback) {
   this.ready = true;
   if (err) {
     this.connection._destroyQuery(this);
-    if (callback) return callback(err);
-    return this.emit('error', err);
+    return util.callbackOrEmit(this, err, callback);
   }
   if (callback) callback(null, this.results, this.extra);
 };

package/lib/ot.js

@@ -122,20 +122,26 @@ function applyOpEdit(snapshot, edit) {
 
 // ot-json0 walks ops with .length and numeric indexing, so it treats array-like
 // objects as ops too, and it coerces .length. This traversal has to match it
-// exactly: anything ot-json0 will apply has to be checked here.
+// exactly: anything ot-json0 will apply has to be checked here. Coercing
+// .length or a path segment throws for some objects; ot-json0 throws on those
+// too, so they are rejected rather than applied.
 // See GHSA-9rqw-j2q5-gg2g
 function checkJson0OpPaths(op) {
   if (op == null) return;
-  for (var i = 0; i < op.length; i++) {
-    var component = op[i];
-    // ot-json0's checkValidOp() rejects the whole op before applying any of it,
-    // so there is nothing beyond this component left to check
-    if (!component || typeof component !== 'object' || !Array.isArray(component.p)) return;
-    for (var j = 0; j < component.p.length; j++) {
-      if (util.isDangerousProperty(component.p[j])) {
-        return new ShareDBError(ERROR_CODE.ERR_OT_OP_NOT_APPLIED, 'Invalid path segment');
+  try {
+    for (var i = 0; i < op.length; i++) {
+      var component = op[i];
+      // ot-json0's checkValidOp() rejects the whole op before applying any of it,
+      // so there is nothing beyond this component left to check
+      if (!component || typeof component !== 'object' || !Array.isArray(component.p)) return;
+      for (var j = 0; j < component.p.length; j++) {
+        if (util.isDangerousProperty(component.p[j])) {
+          return new ShareDBError(ERROR_CODE.ERR_OT_OP_NOT_APPLIED, 'Invalid path segment');
+        }
       }
     }
+  } catch (error) {
+    return new ShareDBError(ERROR_CODE.ERR_OT_OP_NOT_APPLIED, error.message);
   }
 }
 

package/lib/projections.js

@@ -97,13 +97,13 @@ function isSnapshotAllowed(fields, snapshot) {
 }
 
 function isEditAllowed(fields, op) {
+  if (!Array.isArray(op)) return false;
   for (var i = 0; i < op.length; i++) {
-    var c = op[i];
-    if (c.p.length === 0) {
-      return false;
-    } else if (!isFieldAllowed(fields, c.p[0])) {
-      return false;
-    }
+    var path = op[i] && op[i].p;
+    if (!Array.isArray(path)) return false;
+    var field = path[0];
+    if (typeof field !== 'string' && typeof field !== 'number') return false;
+    if (!isFieldAllowed(fields, field)) return false;
   }
   return true;
 }

package/lib/util.js

@@ -84,6 +84,11 @@ exports.callEach = function(callbacks, error) {
   return called;
 };
 
+exports.callbackOrEmit = function(emitter, error, callback) {
+  if (callback) return callback(error);
+  if (error) emitter.emit('error', error);
+};
+
 exports.truthy = function(arg) {
   return !!arg;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sharedb",
-  "version": "6.0.3",
+  "version": "6.0.5",
   "description": "JSON OT database backend",
   "main": "lib/index.js",
   "dependencies": {

package/test/agent.js

@@ -83,4 +83,108 @@ describe('Agent', function() {
       });
     });
   });
+
+  describe('pub/sub channel collisions', function() {
+    var writer;
+    var subscriber;
+
+    beforeEach(function() {
+      writer = backend.connect();
+      subscriber = backend.connect();
+    });
+
+    it('does not deliver ops for a doc whose collection and id join to the same channel', function(done) {
+      var doc = subscriber.get('notes', 'private.alice');
+      doc.subscribe(function(error) {
+        if (error) return done(error);
+        doc.once('create', function() {
+          expect(doc.data).to.eql({text: 'Hello'});
+          done();
+        });
+        writer.get('notes.private', 'alice').create({diary: 'Dear diary'}, function(error) {
+          if (error) return done(error);
+          writer.get('notes', 'private.alice').create({text: 'Hello'}, function(error) {
+            if (error) done(error);
+          });
+        });
+      });
+    });
+
+    it('does not deliver ops from a collection whose channel matches the doc channel', function(done) {
+      var doc = subscriber.get('notes', 'private');
+      doc.subscribe(function(error) {
+        if (error) return done(error);
+        doc.once('create', function() {
+          expect(doc.data).to.eql({text: 'Hello'});
+          done();
+        });
+        writer.get('notes.private', 'alice').create({diary: 'Dear diary'}, function(error) {
+          if (error) return done(error);
+          writer.get('notes', 'private').create({text: 'Hello'}, function(error) {
+            if (error) done(error);
+          });
+        });
+      });
+    });
+
+    it('does not deliver ops to a query on a collection whose channel matches the doc channel', function(done) {
+      var opMessages = [];
+      var diaryEdit = {p: ['diary'], od: 'Dear diary', oi: 'Dear diary, again'};
+      subscriber.on('receive', function(request) {
+        if (request.data.a === ACTIONS.op) opMessages.push(request.data);
+      });
+      var privateDoc = writer.get('notes.private', 'private');
+      privateDoc.create({diary: 'Dear diary'}, function(error) {
+        if (error) return done(error);
+        subscriber.createSubscribeQuery('notes.private', {}, null, function(error, results) {
+          if (error) return done(error);
+          results[0].once('op', function() {
+            expect(opMessages).to.have.length(1);
+            expect(opMessages[0].op).to.eql([diaryEdit]);
+            done();
+          });
+          writer.get('notes', 'private').create({text: 'Hello'}, function(error) {
+            if (error) return done(error);
+            privateDoc.submitOp(diaryEdit, function(error) {
+              if (error) done(error);
+            });
+          });
+        });
+      });
+    });
+
+    it('does not deliver ops to a query from another collection sharing its custom channel', function(done) {
+      backend.use('commit', function(context, next) {
+        context.channels.push('shared');
+        next();
+      });
+      backend.use('query', function(context, next) {
+        context.channels = ['shared'];
+        next();
+      });
+      var opMessages = [];
+      var rename = {p: ['name'], od: 'Fido', oi: 'Rex'};
+      subscriber.on('receive', function(request) {
+        if (request.data.a === ACTIONS.op) opMessages.push(request.data);
+      });
+      var dog = writer.get('dogs', 'fido');
+      dog.create({name: 'Fido'}, function(error) {
+        if (error) return done(error);
+        subscriber.createSubscribeQuery('dogs', {}, null, function(error, results) {
+          if (error) return done(error);
+          results[0].once('op', function() {
+            expect(opMessages).to.have.length(1);
+            expect(opMessages[0].op).to.eql([rename]);
+            done();
+          });
+          writer.get('cats', 'fido').create({name: 'Tom'}, function(error) {
+            if (error) return done(error);
+            dog.submitOp(rename, function(error) {
+              if (error) done(error);
+            });
+          });
+        });
+      });
+    });
+  });
 });

package/test/backend.js

@@ -1,4 +1,5 @@
 var Backend = require('../lib/backend');
+var MemoryDB = require('../lib/db/memory');
 var expect = require('chai').expect;
 var sinon = require('sinon');
 var logger = require('../lib/logger');
@@ -28,6 +29,46 @@ describe('Backend', function() {
         expect(handler.callCount).to.equal(1);
       });
     });
+
+    describe('extraDbs', function() {
+      var archive;
+
+      beforeEach(function() {
+        archive = new MemoryDB();
+        backend = new Backend({extraDbs: {archive: archive}});
+      });
+
+      ['createFetchQuery', 'createSubscribeQuery'].forEach(function(method) {
+        it(method + ' queries the extra DB named by the db option', function(done) {
+          var query = sinon.spy(archive, 'query');
+          backend.connect()[method]('books', {}, {db: 'archive'}, function(error) {
+            if (error) return done(error);
+            expect(query).to.have.been.calledWith('books');
+            done();
+          });
+        });
+
+        ['constructor', '__proto__', {toString: 1}].forEach(function(badValue) {
+          it(method + ' errors if the db option is ' + JSON.stringify(badValue), function(done) {
+            backend.connect()[method]('books', {}, {db: badValue}, function(error) {
+              expect(error).to.include({code: 'ERR_DATABASE_ADAPTER_NOT_FOUND'});
+              done();
+            });
+          });
+
+          it(method + ' errors if middleware sets the db option to ' + JSON.stringify(badValue), function(done) {
+            backend.use('query', function(request, next) {
+              request.options.db = badValue;
+              process.nextTick(next);
+            });
+            backend.connect()[method]('books', {}, null, function(error) {
+              expect(error).to.include({code: 'ERR_DATABASE_ADAPTER_NOT_FOUND'});
+              done();
+            });
+          });
+        });
+      });
+    });
   });
 
   describe('a simple document', function() {
@@ -229,6 +270,17 @@ describe('Backend', function() {
       });
     });
 
+    describe('subscribeBulk', function() {
+      it('only subscribes once to a duplicated id', function(done) {
+        backend.subscribeBulk(agent, 'books', ['1984', '1984'], function(error, streams) {
+          if (error) return done(error);
+          expect(Object.keys(streams)).to.eql(['1984']);
+          expect(backend.pubsub.streamsCount).to.equal(1);
+          done();
+        });
+      });
+    });
+
     describe('submitRequestEnd', function() {
       it('emits after write', function(done) {
         var afterWriteCalled = false;

package/test/client/presence/presence.js

@@ -486,6 +486,54 @@ describe('Presence', function() {
     ], done);
   });
 
+  it('does not leak Streams when subscribing the same presence multiple times in parallel', function(done) {
+    var streamsCount = backend.pubsub.streamsCount;
+    async.series([
+      function(next) {
+        presence1.subscribe();
+        // Trick it into sending a duplicate request
+        presence1.wantSubscribe = false;
+        presence1.subscribe(next);
+      },
+      function(next) {
+        expect(backend.pubsub.streamsCount).to.equal(streamsCount + 1);
+        next();
+      },
+      presence1.unsubscribe.bind(presence1),
+      function(next) {
+        expect(backend.pubsub.streamsCount).to.equal(streamsCount);
+        next();
+      }
+    ], done);
+  });
+
+  it('does not broadcast a disconnect when subscribing the same presence multiple times in parallel', function(done) {
+    var localPresence1 = presence1.create('presence-1');
+
+    async.series([
+      presence2.subscribe.bind(presence2),
+      function(next) {
+        localPresence1.submit({index: 1}, errorHandler(done));
+        presence2.once('receive', function() {
+          next();
+        });
+      },
+      function(next) {
+        presence1.subscribe();
+        // Trick it into sending a duplicate request
+        presence1.wantSubscribe = false;
+        presence1.subscribe(next);
+      },
+      function(next) {
+        localPresence1.submit({index: 2}, errorHandler(done));
+        presence2.once('receive', function(id, presence) {
+          expect(presence).to.eql({index: 2});
+          next();
+        });
+      }
+    ], done);
+  });
+
   it('throws an error when trying to create a presence with a non-string ID', function() {
     expect(function() {
       presence1.create(123);

package/test/client/snapshot-timestamp-request.js

@@ -128,6 +128,17 @@ describe('SnapshotTimestampRequest', function() {
       ], done);
     });
 
+    it('fetches ops up to the current version when there are no milestones', function(done) {
+      sinon.spy(backend.db, 'getOps');
+      var halfwayBetweenDays2and3 = (day2 + day3) * 0.5;
+
+      backend.connect().fetchSnapshotByTimestamp('books', 'time-machine', halfwayBetweenDays2and3, function(error) {
+        if (error) return done(error);
+        expect(backend.db.getOps.calledWith('books', 'time-machine', 0, 3)).to.equal(true);
+        done();
+      });
+    });
+
     it('fetches the day 3 version when asking for a time after day 3', function(done) {
       var connection = backend.connect();
       async.waterfall([
@@ -208,9 +219,32 @@ describe('SnapshotTimestampRequest', function() {
       expect(fetch).to.throw(Error);
     });
 
+    [{}, null, '__proto__'].forEach(function(badValue) {
+      it('errors without reading the database if the collection is ' + JSON.stringify(badValue), function(done) {
+        var getSnapshot = sinon.spy(MemoryDb.prototype, 'getSnapshot');
+        backend.connect().fetchSnapshotByTimestamp(badValue, 'time-machine', null, function(error) {
+          expect(error).to.include({code: 'ERR_MESSAGE_BADLY_FORMED', message: 'Invalid collection'});
+          expect(getSnapshot).not.to.have.been.called;
+          done();
+        });
+      });
+
+      it('errors without reading the database if the id is ' + JSON.stringify(badValue), function(done) {
+        var getSnapshot = sinon.spy(MemoryDb.prototype, 'getSnapshot');
+        backend.connect().fetchSnapshotByTimestamp('books', badValue, null, function(error) {
+          expect(error).to.include({code: 'ERR_MESSAGE_BADLY_FORMED', message: 'Invalid id'});
+          expect(getSnapshot).not.to.have.been.called;
+          done();
+        });
+      });
+    });
+
     it('returns an empty snapshot if trying to fetch a non-existent document', function(done) {
+      sinon.spy(backend.db, 'getOps');
+
       backend.connect().fetchSnapshotByTimestamp('books', 'does-not-exist', day1, function(error, snapshot) {
         if (error) return done(error);
+        expect(backend.db.getOps.called).to.be.false;
         expect(snapshot).to.eql({
           id: 'does-not-exist',
           v: 0,
@@ -449,6 +483,7 @@ describe('SnapshotTimestampRequest', function() {
       it('fetches a snapshot that matches a milestone snapshot', function(done) {
         sinon.spy(milestoneDb, 'getMilestoneSnapshotAtOrBeforeTime');
         sinon.spy(milestoneDb, 'getMilestoneSnapshotAtOrAfterTime');
+        sinon.spy(db, 'getOps');
 
         backendWithMilestones.connect()
           .fetchSnapshotByTimestamp('books', 'mocking-bird', day2, function(error, snapshot) {
@@ -456,6 +491,7 @@ describe('SnapshotTimestampRequest', function() {
 
             expect(milestoneDb.getMilestoneSnapshotAtOrBeforeTime.calledOnce).to.equal(true);
             expect(milestoneDb.getMilestoneSnapshotAtOrAfterTime.calledOnce).to.equal(true);
+            expect(db.getOps.called).to.be.false;
 
             expect(snapshot.v).to.equal(2);
             expect(snapshot.data).to.eql({title: 'To Kill a Mocking Bird', author: 'Harper Lea'});
@@ -463,6 +499,27 @@ describe('SnapshotTimestampRequest', function() {
           });
       });
 
+      it('skips fetching ops when milestone times are out of version order', function(done) {
+        var milestoneAtVersion = function(version) {
+          return function(collection, id, _timestamp, callback) {
+            milestoneDb.getMilestoneSnapshot(collection, id, version, callback);
+          };
+        };
+        sinon.stub(milestoneDb, 'getMilestoneSnapshotAtOrBeforeTime').callsFake(milestoneAtVersion(4));
+        sinon.stub(milestoneDb, 'getMilestoneSnapshotAtOrAfterTime').callsFake(milestoneAtVersion(2));
+        sinon.spy(db, 'getOps');
+        var halfwayBetweenDays3and4 = (day3 + day4) * 0.5;
+
+        backendWithMilestones.connect()
+          .fetchSnapshotByTimestamp('books', 'mocking-bird', halfwayBetweenDays3and4, function(error, snapshot) {
+            if (error) return done(error);
+            expect(db.getOps.called).to.be.false;
+            expect(snapshot.v).to.equal(4);
+            expect(snapshot.data).to.eql({title: 'To Kill a Mocking Bird', author: 'Harper Lee', year: 1959});
+            done();
+          });
+      });
+
       it('fetches a snapshot before any milestones', function(done) {
         sinon.spy(milestoneDb, 'getMilestoneSnapshotAtOrBeforeTime');
         sinon.spy(milestoneDb, 'getMilestoneSnapshotAtOrAfterTime');
@@ -493,7 +550,7 @@ describe('SnapshotTimestampRequest', function() {
 
             expect(milestoneDb.getMilestoneSnapshotAtOrBeforeTime.calledOnce).to.equal(true);
             expect(milestoneDb.getMilestoneSnapshotAtOrAfterTime.calledOnce).to.equal(true);
-            expect(db.getOps.calledWith('books', 'mocking-bird', 4, null)).to.equal(true);
+            expect(db.getOps.calledWith('books', 'mocking-bird', 4, 5)).to.equal(true);
 
             expect(snapshot.v).to.equal(5);
             expect(snapshot.data).to.eql({

package/test/client/snapshot-version-request.js

@@ -143,6 +143,26 @@ describe('SnapshotVersionRequest', function() {
       expect(fetch).to.throw(Error);
     });
 
+    [{}, null, '__proto__'].forEach(function(badValue) {
+      it('errors without reading the database if the collection is ' + JSON.stringify(badValue), function(done) {
+        var getSnapshot = sinon.spy(MemoryDb.prototype, 'getSnapshot');
+        backend.connect().fetchSnapshot(badValue, 'don-quixote', null, function(error) {
+          expect(error).to.include({code: 'ERR_MESSAGE_BADLY_FORMED', message: 'Invalid collection'});
+          expect(getSnapshot).not.to.have.been.called;
+          done();
+        });
+      });
+
+      it('errors without reading the database if the id is ' + JSON.stringify(badValue), function(done) {
+        var getSnapshot = sinon.spy(MemoryDb.prototype, 'getSnapshot');
+        backend.connect().fetchSnapshot('books', badValue, null, function(error) {
+          expect(error).to.include({code: 'ERR_MESSAGE_BADLY_FORMED', message: 'Invalid id'});
+          expect(getSnapshot).not.to.have.been.called;
+          done();
+        });
+      });
+    });
+
     it('errors if asking for a version that does not exist', function(done) {
       backend.connect().fetchSnapshot('books', 'don-quixote', 4, function(error, snapshot) {
         expect(error).to.be.ok;

package/test/lib-util.js

@@ -0,0 +1,56 @@
+var EventEmitter = require('../lib/emitter').EventEmitter;
+var util = require('../lib/util');
+var expect = require('chai').expect;
+
+describe('util.callbackOrEmit', function() {
+  var emitter;
+  var error;
+
+  beforeEach(function() {
+    emitter = new EventEmitter();
+    error = new Error('some error');
+  });
+
+  it('calls back synchronously with the error', function() {
+    var calledWith = 'not called';
+    util.callbackOrEmit(emitter, error, function(err) {
+      calledWith = err;
+    });
+    expect(calledWith).to.equal(error);
+  });
+
+  it('calls back synchronously when there is no error', function() {
+    var calledWith = 'not called';
+    util.callbackOrEmit(emitter, null, function(err) {
+      calledWith = err;
+    });
+    expect(calledWith).to.equal(null);
+  });
+
+  it('does not emit when a callback is provided', function() {
+    var emitted = false;
+    emitter.on('error', function() {
+      emitted = true;
+    });
+    util.callbackOrEmit(emitter, error, function() {});
+    expect(emitted).to.equal(false);
+  });
+
+  it('emits the error when there is no callback', function() {
+    var emittedWith = 'not emitted';
+    emitter.on('error', function(err) {
+      emittedWith = err;
+    });
+    util.callbackOrEmit(emitter, error);
+    expect(emittedWith).to.equal(error);
+  });
+
+  it('does nothing when there is no error and no callback', function() {
+    var emitted = false;
+    emitter.on('error', function() {
+      emitted = true;
+    });
+    util.callbackOrEmit(emitter, null);
+    expect(emitted).to.equal(false);
+  });
+});

package/test/ot.js

@@ -159,6 +159,22 @@ describe('ot', function() {
       expect({}.polluted).to.equal(undefined);
     });
 
+    it('returns an error for a path segment that cannot be converted to a key', function() {
+      var error;
+      expect(function() {
+        error = ot.apply(snapshot, {v: 6, op: [{p: ['colour', {toString: 'x'}], oi: 'yes'}]});
+      }).to.not.throw();
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+    });
+
+    it('returns an error for an op whose length cannot be converted to a number', function() {
+      var error;
+      expect(function() {
+        error = ot.apply(snapshot, {v: 6, op: {length: {toString: 'x'}}});
+      }).to.not.throw();
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+    });
+
     ['__proto__', 'constructor'].forEach(function(badProp) {
       it('rejects ' + badProp + ' as a path segment', function() {
         var error = ot.apply(snapshot, {v: 6, op: [{p: [badProp, 'polluted'], oi: 'yes'}]});

package/test/projections.js

@@ -383,6 +383,24 @@ describe('projection utility methods', function() {
         {x: true},
         {op: [{p: [], oi: {y: 1}}]}
       );
+      test(
+        {0: true},
+        {op: [{p: [0], na: 1}]}
+      );
+    });
+
+    [
+      null,
+      {},
+      [null],
+      [{}],
+      [{p: null}],
+      [{p: 'x'}],
+      [{p: [{toString: 'x'}]}]
+    ].forEach(function(edit) {
+      it('does not allow the malformed op ' + JSON.stringify(edit), function() {
+        expect(projections.isOpAllowed(null, {x: true}, {op: edit})).equal(false);
+      });
     });
   });