sharedb 6.0.5 → 7.0.0

package/lib/agent.js

@@ -25,8 +25,7 @@ function Agent(backend, stream) {
   // src is a client-configurable "id" which the client will set in its handshake,
   // and attach to its ops. This should take precedence over clientId if set.
   // Only legacy clients, or new clients connecting for the first time will use the
-  // Agent-provided clientId. Ideally we'll deprecate clientId in favour of src
-  // in the next breaking change.
+  // Agent-provided clientId.
   this.src = null;
   this.connectTime = Date.now();
 
@@ -382,6 +381,42 @@ Agent.prototype._open = function() {
   this.stream.on('close', cleanup);
 };
 
+function isInvalidName(name) {
+  return typeof name !== 'string' || util.isDangerousProperty(name);
+}
+
+function isInvalidVersion(version) {
+  return version != null && (typeof version !== 'number' || version < 0);
+}
+
+function isInvalidProtocol(value) {
+  return value != null && typeof value !== 'number' && typeof value !== 'string';
+}
+
+function checkBulkData(data) {
+  if (!data || typeof data !== 'object') return 'Invalid bulk subscribe data';
+  if (Array.isArray(data)) {
+    if (data.some(isInvalidName)) return 'Invalid id';
+    return;
+  }
+  for (var id in data) {
+    if (isInvalidName(id)) return 'Invalid id';
+    if (isInvalidVersion(data[id])) return 'Invalid version';
+  }
+}
+
+function checkQueryResults(results) {
+  if (!Array.isArray(results)) return 'Invalid query results';
+  for (var i = 0; i < results.length; i++) {
+    var result = results[i];
+    if (!Array.isArray(result)) return 'Invalid query results';
+    var id = result[0];
+    var version = result[1];
+    if (isInvalidName(id)) return 'Invalid id';
+    if (isInvalidVersion(version)) return 'Invalid version';
+  }
+}
+
 // Check a request to see if its valid. Returns an error if there's a problem.
 Agent.prototype._checkRequest = function(request) {
   if (
@@ -391,6 +426,10 @@ Agent.prototype._checkRequest = function(request) {
   ) {
     // Query messages need an ID property.
     if (typeof request.id !== 'number') return 'Missing query ID';
+    if (request.r != null) {
+      var resultsError = checkQueryResults(request.r);
+      if (resultsError) return resultsError;
+    }
   } else if (request.a === ACTIONS.op ||
       request.a === ACTIONS.fetch ||
       request.a === ACTIONS.subscribe ||
@@ -399,30 +438,19 @@ Agent.prototype._checkRequest = function(request) {
       request.a === ACTIONS.snapshotFetchByTimestamp ||
       request.a === ACTIONS.presence) {
     // Doc-based request.
-    if (request.c != null) {
-      if (typeof request.c !== 'string' || util.isDangerousProperty(request.c)) {
-        return 'Invalid collection';
-      }
-    }
-    if (request.d != null) {
-      if (typeof request.d !== 'string' || util.isDangerousProperty(request.d)) {
-        return 'Invalid id';
-      }
-    }
+    if (request.d != null && isInvalidName(request.d)) return 'Invalid id';
 
     if (request.a === ACTIONS.snapshotFetch || request.a === ACTIONS.snapshotFetchByTimestamp) {
       if (request.c == null) return 'Invalid collection';
       if (request.d == null) return 'Invalid id';
     }
 
-    if (request.a === ACTIONS.op || request.a === ACTIONS.presence) {
-      if (request.v != null && (typeof request.v !== 'number' || request.v < 0)) return 'Invalid version';
-    }
+    if (isInvalidVersion(request.v)) return 'Invalid version';
+    if (request.ts != null && typeof request.ts !== 'number') return 'Invalid timestamp';
 
     if (request.a === ACTIONS.presence) {
-      if (typeof request.id !== 'string' || util.isDangerousProperty(request.id)) {
-        return 'Invalid presence ID';
-      }
+      if (isInvalidName(request.id)) return 'Invalid presence ID';
+      if (isInvalidVersion(request.pv)) return 'Invalid presence version';
     }
   } else if (
     request.a === ACTIONS.bulkFetch ||
@@ -430,18 +458,14 @@ Agent.prototype._checkRequest = function(request) {
     request.a === ACTIONS.bulkUnsubscribe
   ) {
     // Bulk request
-    if (request.c != null) {
-      if (typeof request.c !== 'string' || util.isDangerousProperty(request.c)) {
-        return 'Invalid collection';
-      }
-    }
-    if (typeof request.b !== 'object') return 'Invalid bulk subscribe data';
-  }
-  if (request.ch != null) {
-    if (typeof request.ch !== 'string' || util.isDangerousProperty(request.ch)) {
-      return 'Invalid presence channel';
-    }
+    var bulkError = checkBulkData(request.b);
+    if (bulkError) return bulkError;
+  } else if (request.a === ACTIONS.handshake) {
+    if (isInvalidProtocol(request.protocol) || isInvalidProtocol(request.protocolMinor)) return 'Invalid protocol';
   }
+  if (request.c != null && isInvalidName(request.c)) return 'Invalid collection';
+  if (request.ch != null && isInvalidName(request.ch)) return 'Invalid presence channel';
+  if (request.seq != null && typeof request.seq !== 'number') return 'Invalid seq';
 };
 
 // Handle an incoming message from the client
@@ -540,6 +564,8 @@ function getQueryOptions(request) {
     }
   }
   var options = request.o || {};
+  delete options.pollInterval;
+  delete options.pollDebounce;
   options.ids = ids;
   options.fetch = fetch;
   options.fetchOps = fetchOps;

package/lib/backend.js

@@ -576,15 +576,18 @@ Backend.prototype.subscribeBulk = function(agent, index, versions, callback) {
     collection: collection,
     versions: versions
   };
+  var subscribeFailed = false;
   async.each(ids, function(id, eachCb) {
     var channel = backend.getDocChannel(collection, id);
     backend.pubsub.subscribe(channel, function(err, stream) {
       if (err) return eachCb(err);
+      if (subscribeFailed) return stream.destroy();
       streams[id] = stream;
       eachCb();
     });
   }, function(err) {
     if (err) {
+      subscribeFailed = true;
       destroyStreams(streams);
       return callback(err);
     }

package/lib/client/doc.js

@@ -762,7 +762,20 @@ Doc.prototype._submit = function(op, source, callback) {
       return util.callbackOrEmit(this, err, callback);
     }
     // Try to normalize the op. This removes trailing skip:0's and things like that.
-    if (this.type.normalize) op.op = this.type.normalize(op.op);
+    if (this.type.normalize) {
+      try {
+        op.op = this.type.normalize(op.op);
+      } catch (error) {
+        // Otherwise a type that throws on a badly formed op throws out of
+        // submitOp() rather than calling back
+        var normalizeError = error instanceof ShareDBError ? error : new ShareDBError(
+          ERROR_CODE.ERR_OT_OP_BADLY_FORMED,
+          (error && error.message) || String(error)
+        );
+        if (callback) return callback(normalizeError);
+        return this.emit('error', normalizeError);
+      }
+    }
 
     // This has to happen before _pushOp(), because _tryCompose() applies the op
     // to a pending create, well before _otApply() gets a chance to check it

package/lib/client/presence/remote-doc-presence.js

@@ -120,7 +120,13 @@ RemoteDocPresence.prototype._catchUpStalePresence = function() {
       this._pending.p = null;
       this._pending.v++;
     } else {
-      ot.transformPresence(this._pending, op, isOwnOp);
+      var error = ot.transformPresence(this._pending, op, isOwnOp);
+      if (error) {
+        this._pending = null;
+        this._stopCachingOps();
+        this.presence.emit('error', error);
+        return false;
+      }
     }
   }
 

package/lib/ot.js

@@ -120,6 +120,10 @@ function applyOpEdit(snapshot, edit) {
   }
 }
 
+function isJson0OpComponent(component) {
+  return !!component && typeof component === 'object' && Array.isArray(component.p);
+}
+
 // ot-json0 walks ops with .length and numeric indexing, so it treats array-like
 // objects as ops too, and it coerces .length. This traversal has to match it
 // exactly: anything ot-json0 will apply has to be checked here. Coercing
@@ -133,7 +137,7 @@ function checkJson0OpPaths(op) {
       var component = op[i];
       // ot-json0's checkValidOp() rejects the whole op before applying any of it,
       // so there is nothing beyond this component left to check
-      if (!component || typeof component !== 'object' || !Array.isArray(component.p)) return;
+      if (!isJson0OpComponent(component)) return;
       for (var j = 0; j < component.p.length; j++) {
         if (util.isDangerousProperty(component.p[j])) {
           return new ShareDBError(ERROR_CODE.ERR_OT_OP_NOT_APPLIED, 'Invalid path segment');
@@ -145,13 +149,42 @@ function checkJson0OpPaths(op) {
   }
 }
 
+// Only for ops arriving at submit-request, which reach ot-json0 exactly as
+// they came off the wire, with nothing to normalize them on the way. Ops that
+// are already committed can only have their paths checked, since ops that
+// ot-json0 quietly treats as no-ops were committable by older versions of
+// ShareDB
+function checkSubmittedJson0Op(op) {
+  if (!Array.isArray(op)) {
+    return new ShareDBError(ERROR_CODE.ERR_OT_OP_BADLY_FORMED, 'json0 op must be an array');
+  }
+
+  for (var i = 0; i < op.length; i++) {
+    if (!isJson0OpComponent(op[i])) {
+      return new ShareDBError(ERROR_CODE.ERR_OT_OP_BADLY_FORMED, 'Missing path');
+    }
+  }
+
+  return checkJson0OpPaths(op);
+}
+
+function isJson0(type) {
+  if (typeof type === 'string') type = types.map[type];
+  return !!type && type.name === 'json0';
+}
+
 exports.checkOpPathsForType = function(type, op) {
   if (!('op' in op)) return;
-  if (typeof type === 'string') type = types.map[type];
-  if (!type || type.name !== 'json0') return;
+  if (!isJson0(type)) return;
   return checkJson0OpPaths(op.op);
 };
 
+exports.checkSubmittedOpForType = function(type, op) {
+  if (!('op' in op)) return;
+  if (!isJson0(type)) return;
+  return checkSubmittedJson0Op(op.op);
+};
+
 exports.transform = function(type, op, appliedOp) {
   // There are 16 cases this function needs to deal with - which are all the
   // combinations of create/delete/op/noop from both op and appliedOp
@@ -229,9 +262,9 @@ exports.transformPresence = function(presence, op, isOwnOp) {
   if (typeof type === 'string') {
     type = types.map[type];
   }
-  if (!type) return {code: ERROR_CODE.ERR_DOC_TYPE_NOT_RECOGNIZED, message: 'Unknown type'};
+  if (!type) return new ShareDBError(ERROR_CODE.ERR_DOC_TYPE_NOT_RECOGNIZED, 'Unknown type');
   if (!util.supportsPresence(type)) {
-    return {code: ERROR_CODE.ERR_TYPE_DOES_NOT_SUPPORT_PRESENCE, message: 'Type does not support presence'};
+    return new ShareDBError(ERROR_CODE.ERR_TYPE_DOES_NOT_SUPPORT_PRESENCE, 'Type does not support presence');
   }
 
   if (op.create || op.del) {
@@ -245,7 +278,7 @@ exports.transformPresence = function(presence, op, isOwnOp) {
       null :
       type.transformPresence(presence.p, op.op, isOwnOp);
   } catch (error) {
-    return {code: ERROR_CODE.ERR_PRESENCE_TRANSFORM_FAILED, message: error.message || error};
+    return new ShareDBError(ERROR_CODE.ERR_PRESENCE_TRANSFORM_FAILED, error.message || error);
   }
 
   presence.v++;

package/lib/pubsub/index.js

@@ -19,6 +19,8 @@ function PubSub(options) {
   // isn't complete until the callback returns from Redis
   // Maps channel -> true
   this.subscribed = Object.create(null);
+  // Maps channel -> callbacks waiting on _subscribe
+  this._subscribing = Object.create(null);
 
   var pubsub = this;
   this._defaultCallback = function(err) {
@@ -76,11 +78,21 @@ PubSub.prototype.subscribe = function(channel, callback) {
     });
     return;
   }
+  if (this._subscribing[channel]) {
+    this._subscribing[channel].push(callback);
+    return;
+  }
+  var callbacks = this._subscribing[channel] = [callback];
   this._subscribe(channel, function(err) {
-    if (err) return callback(err);
+    delete pubsub._subscribing[channel];
+    if (err) return util.callEach(callbacks, err);
     pubsub.subscribed[channel] = true;
-    var stream = pubsub._createStream(channel);
-    callback(null, stream);
+    var streams = callbacks.map(function() {
+      return pubsub._createStream(channel);
+    });
+    callbacks.forEach(function(callback, i) {
+      callback(null, streams[i]);
+    });
   });
 };
 

package/lib/submit-request.js

@@ -109,6 +109,12 @@ SubmitRequest.prototype.submit = function(callback) {
     request.snapshot = snapshot;
     request._addSnapshotMeta();
 
+    // The type is only known once we have the snapshot, so this is the earliest
+    // we can validate the op against it. It has to happen before the op reaches
+    // any type function, including through $fixup() in the apply middleware
+    var opError = ot.checkSubmittedOpForType(snapshot.type, op);
+    if (opError) return callback(opError);
+
     if (op.v == null) {
       if (op.create && snapshot.type && op.src) {
         // If the document was already created by another op, we will return a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sharedb",
-  "version": "6.0.5",
+  "version": "7.0.0",
   "description": "JSON OT database backend",
   "main": "lib/index.js",
   "dependencies": {

package/test/agent.js

@@ -1,4 +1,5 @@
 var Backend = require('../lib/backend');
+var MemoryDb = require('../lib/db/memory');
 var logger = require('../lib/logger');
 var sinon = require('sinon');
 var StreamSocket = require('../lib/stream-socket');
@@ -19,6 +20,141 @@ describe('Agent', function() {
     backend.close(done);
   });
 
+  describe('request validation', function() {
+    var socket;
+    var connection;
+
+    beforeEach(function(done) {
+      socket = new StreamSocket();
+      backend.listen(socket.stream);
+      connection = new Connection(socket);
+      socket._open();
+      connection.once('connected', function() {
+        done();
+      });
+    });
+
+    function expectRejected(message, expectedError, done) {
+      var dbReads = ['getSnapshot', 'getSnapshotBulk', 'getOps', 'getOpsBulk', 'query'].map(function(method) {
+        return sinon.spy(MemoryDb.prototype, method);
+      });
+      connection.on('receive', function(request) {
+        var reply = request.data;
+        if (!reply || !reply.error) return;
+        request.data = null;
+        expect(reply.error).to.include({code: 'ERR_MESSAGE_BADLY_FORMED', message: expectedError});
+        dbReads.forEach(function(dbRead) {
+          expect(dbRead).not.to.have.been.called;
+        });
+        done();
+      });
+      socket.send(JSON.stringify(message));
+    }
+
+    var unconvertible = {toString: 1};
+    var badIds = [unconvertible, 42, null, '__proto__'];
+    var badVersions = [unconvertible, '1', -1];
+
+    [ACTIONS.fetch, ACTIONS.subscribe, ACTIONS.snapshotFetch].forEach(function(action) {
+      badVersions.forEach(function(badVersion) {
+        it('rejects a ' + action + ' with version ' + JSON.stringify(badVersion), function(done) {
+          expectRejected({a: action, c: 'dogs', d: 'fido', v: badVersion}, 'Invalid version', done);
+        });
+      });
+    });
+
+    [unconvertible, '1'].forEach(function(badTimestamp) {
+      it('rejects a snapshot fetch with timestamp ' + JSON.stringify(badTimestamp), function(done) {
+        var message = {a: ACTIONS.snapshotFetchByTimestamp, c: 'dogs', d: 'fido', ts: badTimestamp};
+        expectRejected(message, 'Invalid timestamp', done);
+      });
+    });
+
+    [ACTIONS.bulkFetch, ACTIONS.bulkSubscribe, ACTIONS.bulkUnsubscribe].forEach(function(action) {
+      it('rejects a ' + action + ' without bulk data', function(done) {
+        expectRejected({a: action, c: 'dogs', b: null}, 'Invalid bulk subscribe data', done);
+      });
+
+      badIds.forEach(function(badId) {
+        it('rejects a ' + action + ' with id ' + JSON.stringify(badId), function(done) {
+          expectRejected({a: action, c: 'dogs', b: ['fido', badId]}, 'Invalid id', done);
+        });
+      });
+
+      badVersions.forEach(function(badVersion) {
+        it('rejects a ' + action + ' with version ' + JSON.stringify(badVersion), function(done) {
+          expectRejected({a: action, c: 'dogs', b: {fido: badVersion}}, 'Invalid version', done);
+        });
+      });
+
+      it('rejects a ' + action + ' with a __proto__ key in its version map', function(done) {
+        expectRejected({a: action, c: 'dogs', b: JSON.parse('{"__proto__": 0}')}, 'Invalid id', done);
+      });
+    });
+
+    [ACTIONS.queryFetch, ACTIONS.querySubscribe].forEach(function(action) {
+      [unconvertible, ['dogs'], '__proto__'].forEach(function(badCollection) {
+        it('rejects a ' + action + ' with collection ' + JSON.stringify(badCollection), function(done) {
+          expectRejected({a: action, id: 1, c: badCollection, q: {}}, 'Invalid collection', done);
+        });
+      });
+
+      badIds.forEach(function(badId) {
+        it('rejects a ' + action + ' with result id ' + JSON.stringify(badId), function(done) {
+          expectRejected({a: action, id: 1, c: 'dogs', q: {}, r: [[badId]]}, 'Invalid id', done);
+        });
+      });
+
+      badVersions.forEach(function(badVersion) {
+        it('rejects a ' + action + ' with result version ' + JSON.stringify(badVersion), function(done) {
+          expectRejected({a: action, id: 1, c: 'dogs', q: {}, r: [['fido', badVersion]]}, 'Invalid version', done);
+        });
+      });
+
+      [{fido: 0}, ['fido']].forEach(function(badResults) {
+        it('rejects a ' + action + ' with results ' + JSON.stringify(badResults), function(done) {
+          expectRejected({a: action, id: 1, c: 'dogs', q: {}, r: badResults}, 'Invalid query results', done);
+        });
+      });
+    });
+
+    it('accepts a query unsubscribe without a collection', function(done) {
+      connection.on('receive', function(request) {
+        var reply = request.data;
+        if (!reply || reply.a !== ACTIONS.queryUnsubscribe) return;
+        request.data = null;
+        expect(reply).not.to.have.property('error');
+        done();
+      });
+      socket.send(JSON.stringify({a: ACTIONS.queryUnsubscribe, id: 1}));
+    });
+
+    [ACTIONS.presenceSubscribe, ACTIONS.presenceUnsubscribe].forEach(function(action) {
+      [unconvertible, '1'].forEach(function(badSeq) {
+        it('rejects a ' + action + ' with seq ' + JSON.stringify(badSeq), function(done) {
+          expectRejected({a: action, ch: 'dogs.fido', seq: badSeq}, 'Invalid seq', done);
+        });
+      });
+    });
+
+    badVersions.forEach(function(badVersion) {
+      it('rejects presence with presence version ' + JSON.stringify(badVersion), function(done) {
+        var message = {a: ACTIONS.presence, ch: 'dogs.fido', id: 'rex', p: null, pv: badVersion};
+        expectRejected(message, 'Invalid presence version', done);
+      });
+    });
+
+    [unconvertible, true].forEach(function(badProtocol) {
+      it('rejects a handshake with protocol ' + JSON.stringify(badProtocol), function(done) {
+        expectRejected({a: ACTIONS.handshake, protocol: badProtocol, protocolMinor: 2}, 'Invalid protocol', done);
+      });
+
+      it('rejects a handshake with minor protocol ' + JSON.stringify(badProtocol), function(done) {
+        expectRejected({a: ACTIONS.handshake, protocol: 1, protocolMinor: badProtocol}, 'Invalid protocol', done);
+      });
+    });
+  });
+
   describe('handshake', function() {
     it('warns when messages are sent before the handshake', function(done) {
       var socket = new StreamSocket();

package/test/backend.js

@@ -248,7 +248,7 @@ describe('Backend', function() {
             title: '1984',
             author: 'George Orwell'
           });
-          var op = {op: {p: ['publication'], oi: 1949}};
+          var op = {op: [{p: ['publication'], oi: 1949}]};
           stream.on('data', function(data) {
             expect(data.op).to.eql(op.op);
             done();
@@ -279,6 +279,37 @@ describe('Backend', function() {
           done();
         });
       });
+
+      describe('when one subscribe fails', function() {
+        var finishSubscribe;
+
+        beforeEach(function() {
+          finishSubscribe = {};
+          backend.pubsub._subscribe = function(channel, callback) {
+            finishSubscribe[channel] = callback;
+          };
+        });
+
+        it('destroys streams that subscribed before the failure', function(done) {
+          backend.subscribeBulk(agent, 'books', ['1984', 'bad'], function(error) {
+            expect(error.message).to.equal('subscribe failed');
+            expect(backend.pubsub.streamsCount).to.equal(0);
+            done();
+          });
+          finishSubscribe['books.1984']();
+          finishSubscribe['books.bad'](new Error('subscribe failed'));
+        });
+
+        it('destroys streams that subscribe after the failure', function(done) {
+          backend.subscribeBulk(agent, 'books', ['1984', 'bad'], function(error) {
+            expect(error.message).to.equal('subscribe failed');
+            finishSubscribe['books.1984']();
+            expect(backend.pubsub.streamsCount).to.equal(0);
+            done();
+          });
+          finishSubscribe['books.bad'](new Error('subscribe failed'));
+        });
+      });
     });
 
     describe('submitRequestEnd', function() {
@@ -297,7 +328,7 @@ describe('Backend', function() {
           done();
         });
 
-        var op = {op: {p: ['publicationYear'], oi: 1949}};
+        var op = {op: [{p: ['publicationYear'], oi: 1949}]};
         backend.submit(agent, 'books', '1984', op, null, function(error) {
           if (error) done(error);
         });
@@ -314,7 +345,7 @@ describe('Backend', function() {
           done();
         });
 
-        var op = {op: {p: ['publicationYear'], oi: 1949}};
+        var op = {op: [{p: ['publicationYear'], oi: 1949}]};
         backend.submit(agent, 'books', '1984', op, null, function() {
           // Swallow the error
         });

package/test/client/doc.js

@@ -657,31 +657,31 @@ describe('Doc', function() {
     });
   });
 
-  describe('errors on ops that could cause prototype corruption', function() {
-    function expectReceiveError(
-      connection,
-      collectionName,
-      docId,
-      expectedError,
-      done
-    ) {
-      connection.on('receive', function(request) {
-        var message = request.data;
-        if (message.c === collectionName && message.d === docId) {
-          if ('error' in message) {
-            request.data = null; // Stop further processing of the message
-            if (message.error.message === expectedError) {
-              return done();
-            } else {
-              return done('Unexpected ShareDB error: ' + message.error.message);
-            }
+  function expectReceiveError(
+    connection,
+    collectionName,
+    docId,
+    expectedError,
+    done
+  ) {
+    connection.on('receive', function(request) {
+      var message = request.data;
+      if (message.c === collectionName && message.d === docId) {
+        if ('error' in message) {
+          request.data = null; // Stop further processing of the message
+          if (message.error.message === expectedError) {
+            return done();
           } else {
-            return done('Expected error on ' + collectionName + '.' + docId + ' but got no error');
+            return done('Unexpected ShareDB error: ' + message.error.message);
           }
+        } else {
+          return done('Expected error on ' + collectionName + '.' + docId + ' but got no error');
         }
-      });
-    }
+      }
+    });
+  }
 
+  describe('errors on ops that could cause prototype corruption', function() {
     afterEach(function() {
       delete Object.prototype.polluted;
     });
@@ -760,16 +760,21 @@ describe('Doc', function() {
       });
     });
 
-    // ot-json0 walks ops with .length and numeric indexing, so it applies an
-    // array-like object as if it were an op
     [
       {
         name: 'an array-like op',
-        op: {0: {p: ['__proto__', 'polluted'], oi: 'oops'}, length: 1}
+        op: {0: {p: ['__proto__', 'polluted'], oi: 'oops'}, length: 1},
+        error: 'json0 op must be an array'
       },
       {
         name: 'ops with a path segment that is not a string',
-        op: [{p: [['__proto__'], 'polluted'], oi: 'oops'}]
+        op: [{p: [['__proto__'], 'polluted'], oi: 'oops'}],
+        error: 'Invalid path segment'
+      },
+      {
+        name: 'ops with a component that is not an object',
+        op: [null],
+        error: 'Missing path'
       }
     ].forEach(function(test) {
       it('Rejects ' + test.name, function(done) {
@@ -780,7 +785,7 @@ describe('Doc', function() {
           if (err) {
             return done(err);
           }
-          expectReceiveError(connection, collectionName, docId, 'Invalid path segment', function(error) {
+          expectReceiveError(connection, collectionName, docId, test.error, function(error) {
             if (error) {
               return done(error);
             }
@@ -911,6 +916,31 @@ describe('Doc', function() {
         });
       });
 
+      // normalize() runs before the paths are checked, and it takes a bare
+      // component as well as an op, fills in a missing path, and branches on
+      // Array.isArray() — so these all reach the check as a real op
+      [
+        {name: 'a bare op component', op: {p: ['__proto__', 'polluted'], oi: 'oops'}},
+        {name: 'an op that is also shaped like a component', op: (function() {
+          var op = [{p: ['__proto__', 'polluted'], oi: 'oops'}];
+          op.p = [];
+          return op;
+        })()},
+        {name: 'an op with a pathless component before a bad one', op: [
+          {p: [], od: {foo: 'bar'}, oi: {foo: 'bar'}},
+          {p: ['__proto__', 'polluted'], oi: 'oops'}
+        ]}
+      ].forEach(function(test) {
+        it('rejects ' + test.name + ' composed into a pending create', function(done) {
+          var doc = this.connection.get('test-collection', 'test-doc');
+          doc.create({foo: 'bar'});
+          doc.submitOp(test.op, function(error) {
+            expectInvalidPathSegment(error);
+            done();
+          });
+        });
+      });
+
       it('leaves the doc usable after rejecting an op', function(done) {
         var doc = this.connection.get('test-collection', 'test-doc');
         async.series([
@@ -932,6 +962,165 @@ describe('Doc', function() {
     });
   });
 
+  // ot-json0's apply() quietly ignores an op that isn't an array, but its
+  // compose() and invert() throw on one. $fixup() composes, and it is called
+  // from middleware, so the throw is uncaught and takes the process down
+  describe('errors on badly formed json0 ops', function() {
+    [
+      {
+        name: 'an array-like op',
+        op: {0: {p: ['colour'], oi: 'red'}, length: 1},
+        error: 'json0 op must be an array'
+      },
+      {
+        name: 'a bare op component',
+        op: {p: ['colour'], oi: 'red'},
+        error: 'json0 op must be an array'
+      },
+      {
+        name: 'an op component that is not an object',
+        op: [null],
+        error: 'Missing path'
+      }
+    ].forEach(function(test) {
+      it('Rejects ' + test.name + ' before the apply middleware can fix it up', function(done) {
+        var connection = this.connection;
+        var collectionName = 'test-collection';
+        var docId = 'test-doc';
+        this.backend.use('apply', function(request, next) {
+          if ('op' in request.op) request.$fixup([{p: ['fixed'], oi: true}]);
+          next();
+        });
+        connection.get(collectionName, docId).create({id: docId}, function(err) {
+          if (err) {
+            return done(err);
+          }
+          expectReceiveError(connection, collectionName, docId, test.error, done);
+          connection.send({
+            a: 'op',
+            c: collectionName,
+            d: docId,
+            v: 1,
+            seq: connection.seq++,
+            x: {},
+            op: test.op
+          });
+        });
+      });
+    });
+
+    describe('locally submitted ops', function() {
+      // json0's normalize() throws on a component that isn't an object, and it
+      // runs before the op is checked, so this used to come straight out of
+      // submitOp() rather than through the callback
+      it('rejects an op component that is not an object without sending it to the server', function(done) {
+        var doc = this.connection.get('test-collection', 'test-doc');
+        doc.create({foo: 'bar'}, function(error) {
+          if (error) return done(error);
+          var calledBack = false;
+          doc.submitOp([null], function(error) {
+            calledBack = true;
+            expect(error.code).to.equal(ShareDBError.CODES.ERR_OT_OP_BADLY_FORMED);
+          });
+          // The server would only reject asynchronously, so calling back
+          // synchronously is how we know the op never left the client
+          expect(calledBack).to.equal(true);
+          done();
+        });
+      });
+
+      it('emits an error for an op component that is not an object with no callback', function(done) {
+        var doc = this.connection.get('test-collection', 'test-doc');
+        doc.create({foo: 'bar'}, function(error) {
+          if (error) return done(error);
+          doc.on('error', function(error) {
+            expect(error.code).to.equal(ShareDBError.CODES.ERR_OT_OP_BADLY_FORMED);
+            done();
+          });
+          doc.submitOp([null]);
+        });
+      });
+
+      // A type can throw anything at all, and reading .message off a thrown
+      // null would throw out of the catch, which is what the catch is for
+      [
+        {
+          name: 'a string',
+          thrown: 'not an op',
+          code: ShareDBError.CODES.ERR_OT_OP_BADLY_FORMED,
+          message: 'not an op'
+        },
+        {
+          name: 'null',
+          thrown: null,
+          code: ShareDBError.CODES.ERR_OT_OP_BADLY_FORMED,
+          message: 'null'
+        },
+        {
+          name: 'a ShareDBError',
+          thrown: new ShareDBError('ERR_CUSTOM_TYPE_ERROR', 'Custom type error'),
+          code: 'ERR_CUSTOM_TYPE_ERROR',
+          message: 'Custom type error'
+        }
+      ].forEach(function(test) {
+        it('reports ' + test.name + ' thrown by normalize()', function(done) {
+          var doc = this.connection.get('test-collection', 'test-doc');
+          doc.create({foo: 'bar'}, function(error) {
+            if (error) return done(error);
+            sinon.stub(json0, 'normalize').callsFake(function() {
+              throw test.thrown;
+            });
+            doc.submitOp([{p: ['foo'], od: 'bar'}], function(error) {
+              expect(error.code).to.equal(test.code);
+              expect(error.message).to.equal(test.message);
+              done();
+            });
+          });
+        });
+      });
+
+      // normalize() accepts more than the server does, and everything it
+      // accepts has to stay submittable
+      [
+        {name: 'a bare op component', op: {p: ['baz'], oi: true}},
+        {name: 'an op whose component has no path', op: [{od: {foo: 'bar'}, oi: {foo: 'bar', baz: true}}]},
+        {name: 'a bare component with no path', op: {od: {foo: 'bar'}, oi: {foo: 'bar', baz: true}}}
+      ].forEach(function(test) {
+        it('accepts ' + test.name + ', which json0 normalizes into an op', function(done) {
+          var doc = this.connection.get('test-collection', 'test-doc');
+          async.series([
+            doc.create.bind(doc, {foo: 'bar'}),
+            doc.submitOp.bind(doc, test.op),
+            doc.whenNothingPending.bind(doc),
+            function(next) {
+              expect(doc.data).to.eql({foo: 'bar', baz: true});
+              next();
+            }
+          ], done);
+        });
+      });
+
+      it('leaves the doc usable after rejecting an op', function(done) {
+        var doc = this.connection.get('test-collection', 'test-doc');
+        async.series([
+          doc.create.bind(doc, {foo: 'bar'}),
+          function(next) {
+            doc.submitOp([null], function(error) {
+              expect(error).to.be.instanceOf(Error);
+              next();
+            });
+          },
+          doc.submitOp.bind(doc, [{p: ['baz'], oi: true}]),
+          doc.whenNothingPending.bind(doc),
+          function(next) {
+            expect(doc.data).to.eql({foo: 'bar', baz: true});
+            next();
+          }
+        ], done);
+      });
+    });
+  });
+
   describe('toSnapshot', function() {
     var doc;
     beforeEach(function(done) {

package/test/client/presence/doc-presence.js

@@ -6,6 +6,7 @@ var presenceTestType = require('./presence-test-type');
 var errorHandler = require('../../util').errorHandler;
 var PresencePauser = require('./presence-pauser');
 var sinon = require('sinon');
+var ACTIONS = require('../../../lib/message-actions').ACTIONS;
 types.register(presenceTestType.type);
 
 describe('DocPresence', function() {
@@ -971,6 +972,59 @@ describe('DocPresence', function() {
     ], done);
   });
 
+  it('emits an error and drops stale remote presence that cannot be transformed', function(done) {
+    var localPresence1 = presence1.create('presence-1');
+    var catchUpCount = 0;
+
+    function sendUntypedPresenceAtVersion(version) {
+      var message = localPresence1._message();
+      message.d = null;
+      message.p = {index: 0};
+      message.v = version;
+      connection1.send(message);
+    }
+
+    async.series([
+      presence2.subscribe.bind(presence2),
+      function(next) {
+        connection2.on('send', function(message) {
+          if (message.a !== ACTIONS.presenceRequest) return;
+          catchUpCount++;
+          if (catchUpCount === 1) next();
+        });
+        sendUntypedPresenceAtVersion(0);
+      },
+      function(next) {
+        doc2.once('op', function() {
+          next();
+        });
+        doc1.submitOp({index: 5, value: 'ern'}, errorHandler(done));
+      },
+      function(next) {
+        presence2.once('error', function(error) {
+          expect(error).to.be.an.instanceOf(Error);
+          expect(error.code).to.equal('ERR_DOC_TYPE_NOT_RECOGNIZED');
+          next();
+        });
+        sendUntypedPresenceAtVersion(1);
+      },
+      function(next) {
+        doc2.once('op', function() {
+          next();
+        });
+        doc1.submitOp({index: 0, value: 'The'}, errorHandler(done));
+      },
+      function(next) {
+        presence2.once('receive', function(id, presence) {
+          expect(presence).to.eql({index: 1});
+          expect(catchUpCount).to.equal(1);
+          next();
+        });
+        localPresence1.submit({index: 1}, errorHandler(done));
+      }
+    ], done);
+  });
+
   it('sends null presence when the doc is destroyed', function(done) {
     var localPresence1 = presence1.create('presence-1');
 

package/test/client/query-subscribe.js

@@ -127,11 +127,13 @@ module.exports = function(options) {
 
         it('does not duplicate messages', function(done) {
           var connection = this.backend.connect();
+          this.backend.db.pollInterval = 0;
+          this.backend.db.pollDebounce = 0;
           var count = 0;
           var query = connection.createSubscribeQuery(
             'dogs',
             this.matchAllDbQuery,
-            {pollInterval: 0, pollDebounce: 0},
+            null,
             function(err) {
               if (err) return done(err);
               connection.get('dogs', '1').on('error', done).create({});
@@ -519,13 +521,17 @@ function commonTests(options) {
     });
   });
 
-  it('pollDebounce option reduces subsequent poll interval', function(done) {
+  it('query middleware pollDebounce option reduces subsequent poll interval', function(done) {
     var clock = util.useFakeTimers();
     var connection = this.backend.connect();
     this.backend.db.canPollDoc = function() {
       return false;
     };
-    var query = connection.createSubscribeQuery('items', this.matchAllDbQuery, {pollDebounce: 2000});
+    this.backend.use('query', function(context, next) {
+      context.options.pollDebounce = 2000;
+      next();
+    });
+    var query = connection.createSubscribeQuery('items', this.matchAllDbQuery);
     query.on('error', done);
     var batchSizes = [];
     var total = 0;
@@ -618,21 +624,21 @@ function commonTests(options) {
     });
   });
 
-  it('pollInterval updates a subscribed query after an unpublished create', function(done) {
+  it('query middleware pollInterval updates a subscribed query after an unpublished create', function(done) {
     var clock = util.useFakeTimers();
     var connection = this.backend.connect();
     this.backend.suppressPublish = true;
-    var query = connection.createSubscribeQuery(
-      'dogs',
-      this.matchAllDbQuery,
-      {pollDebounce: 0, pollInterval: 50},
-      function(err) {
-        if (err) return done(err);
-        connection.get('dogs', 'fido').on('error', done).create({}, function() {
-          clock.tick(51);
-        });
-      }
-    );
+    this.backend.use('query', function(context, next) {
+      context.options.pollDebounce = 0;
+      context.options.pollInterval = 50;
+      next();
+    });
+    var query = connection.createSubscribeQuery('dogs', this.matchAllDbQuery, null, function(err) {
+      if (err) return done(err);
+      connection.get('dogs', 'fido').on('error', done).create({}, function() {
+        clock.tick(51);
+      });
+    });
     query.on('error', done);
     query.on('insert', function(docs) {
       expect(util.pluck(docs, 'id')).eql(['fido']);
@@ -659,13 +665,17 @@ function commonTests(options) {
     });
   });
 
-  it('pollInterval captures additional unpublished creates', function(done) {
+  it('query middleware pollInterval captures additional unpublished creates', function(done) {
     var clock = util.useFakeTimers();
     var connection = this.backend.connect();
     this.backend.suppressPublish = true;
+    this.backend.use('query', function(context, next) {
+      context.options.pollInterval = 1000;
+      next();
+    });
     var count = 0;
 
-    var query = connection.createSubscribeQuery('dogs', this.matchAllDbQuery, {pollInterval: 1000}, function(err) {
+    var query = connection.createSubscribeQuery('dogs', this.matchAllDbQuery, null, function(err) {
       if (err) return done(err);
       var doc = connection.get('dogs', count.toString()).on('error', done);
       doc.create({}, function(e) {
@@ -686,6 +696,34 @@ function commonTests(options) {
     clock.tick(1);
   });
 
+  it('does not pass client pollInterval or pollDebounce to query middleware', function(done) {
+    var connection = this.backend.connect();
+    var queryOptions;
+    this.backend.use('query', function(context, next) {
+      queryOptions = context.options;
+      next();
+    });
+    connection.createSubscribeQuery('dogs', this.matchAllDbQuery, {pollInterval: 1, pollDebounce: 0}, function(err) {
+      if (err) return done(err);
+      expect(queryOptions).not.to.have.any.keys('pollInterval', 'pollDebounce');
+      done();
+    });
+  });
+
+  it('ignores pollInterval from client query options', function(done) {
+    var clock = util.useFakeTimers();
+    var connection = this.backend.connect();
+    var db = this.backend.db;
+    db.pollInterval = 0;
+    sinon.spy(db, 'queryPoll');
+    connection.createSubscribeQuery('dogs', this.matchAllDbQuery, {pollInterval: 50}, function(err) {
+      if (err) return done(err);
+      clock.tick(1000);
+      expect(db.queryPoll.called).to.be.false;
+      done();
+    });
+  });
+
   it('query extra is returned to client', function(done) {
     var connection = this.backend.connect();
     this.backend.db.query = function(collection, query, fields, options, callback) {
@@ -906,7 +944,7 @@ function commonTests(options) {
     connection.createSubscribeQuery(
       'dogs',
       this.matchAllDbQuery,
-      {pollInterval: 0, pollDebounce: 0},
+      null,
       function(err) {
         if (err) {
           expect(err.message).to.be.equal('TEST_ERROR');

package/test/middleware.js

@@ -5,6 +5,7 @@ var types = require('../lib/types');
 var errorHandler = util.errorHandler;
 var ShareDBError = require('../lib/error');
 var sinon = require('sinon');
+var crypto = require('crypto');
 var ACTIONS = require('../lib/message-actions').ACTIONS;
 
 var ERROR_CODE = ShareDBError.CODES;
@@ -63,6 +64,101 @@ describe('middleware', function() {
         done();
       });
     });
+
+    it('uses a clientId set on connect as the connection id and op src', function(done) {
+      var backend = this.backend;
+      backend.use('connect', function(request, next) {
+        request.agent.clientId = 'alice:1';
+        next();
+      });
+
+      var srcs = [];
+      backend.use('submit', function(request, next) {
+        srcs.push(request.op.src);
+        next();
+      });
+
+      backend.connect(null, null, function(connection) {
+        expect(connection.id).to.equal('alice:1');
+        connection.get('dogs', 'fido').create({age: 3}, function(error) {
+          if (error) return done(error);
+          expect(srcs).to.eql(['alice:1']);
+          done();
+        });
+      });
+    });
+  });
+
+  describe('restricting op sources', function() {
+    beforeEach(function() {
+      function srcFor(userId) {
+        return userId + ':' + crypto.randomUUID();
+      }
+
+      function isSrcOf(userId, src) {
+        if (typeof src !== 'string') return false;
+        var separator = src.lastIndexOf(':');
+        return separator !== -1 && src.slice(0, separator) === String(userId);
+      }
+
+      this.backend.use('connect', function(context, next) {
+        var userId = context.req.userId;
+        context.agent.custom.userId = userId;
+        context.agent.clientId = srcFor(userId);
+        next();
+      });
+
+      this.backend.use('receive', function(context, next) {
+        var message = context.data;
+        var userId = context.agent.custom.userId;
+        if (message.a === ACTIONS.handshake && message.id != null && !isSrcOf(userId, message.id)) {
+          delete message.id;
+        }
+        if (message.a === ACTIONS.op && message.src != null && !isSrcOf(userId, message.src)) {
+          return next(new Error('Op src belongs to another user'));
+        }
+        next();
+      });
+    });
+
+    it('keeps a reclaimed id that names the same user', function(done) {
+      var backend = this.backend;
+      backend.connect(null, {userId: 42}, function(connection) {
+        var id = connection.id;
+        expect(id).to.match(/^42:/);
+        connection.close();
+        backend.connect(connection, {userId: 42}, function() {
+          expect(connection.id).to.equal(id);
+          done();
+        });
+      });
+    });
+
+    it('replaces a reclaimed id that names another user', function(done) {
+      var backend = this.backend;
+      backend.connect(null, {userId: 42}, function(connection) {
+        connection.close();
+        connection.id = '7:stale';
+        backend.connect(connection, {userId: 42}, function() {
+          expect(connection.id).to.match(/^42:/);
+          expect(connection.id).to.equal(connection.agent.clientId);
+          done();
+        });
+      });
+    });
+
+    it('rejects an op whose src names another user', function(done) {
+      this.backend.connect(null, {userId: 42}, function(connection) {
+        connection.get('dogs', 'fido').on('error', function(error) {
+          expect(error.message).to.equal('Op src belongs to another user');
+          done();
+        });
+        connection.send({
+          a: ACTIONS.op, c: 'dogs', d: 'fido', v: 0, src: '7:1', seq: 1,
+          create: {type: 'json0', data: {}}
+        });
+      });
+    });
   });
 
   describe('readSnapshots', function() {

package/test/ot.js

@@ -203,6 +203,52 @@ describe('ot', function() {
     });
   });
 
+  describe('checkSubmittedOpForType', function() {
+    it('rejects an array-like json0 op', function() {
+      var op = {op: {0: {p: ['colour'], oi: 'red'}, length: 1}};
+      var error = ot.checkSubmittedOpForType(type.uri, op);
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_BADLY_FORMED);
+    });
+
+    it('rejects a json0 op that is not an array', function() {
+      var error = ot.checkSubmittedOpForType(type.uri, {op: {p: ['colour'], oi: 'red'}});
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_BADLY_FORMED);
+    });
+
+    it('rejects a json0 op component that is not an object', function() {
+      var error = ot.checkSubmittedOpForType(type.uri, {op: [null]});
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_BADLY_FORMED);
+      expect(error.message).to.equal('Missing path');
+    });
+
+    it('rejects a dangerous path segment', function() {
+      var error = ot.checkSubmittedOpForType(type.uri, {op: [{p: ['__proto__', 'x'], oi: 'yes'}]});
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+      expect(error.message).to.equal('Invalid path segment');
+    });
+
+    it('returns an error for a path segment that cannot be converted to a key', function() {
+      var error;
+      expect(function() {
+        error = ot.checkSubmittedOpForType(type.uri, {op: [{p: ['colour', {toString: 'x'}], oi: 'yes'}]});
+      }).to.not.throw();
+      expect(error.code).to.equal(ERROR_CODE.ERR_OT_OP_NOT_APPLIED);
+    });
+
+    it('accepts a valid json0 op', function() {
+      expect(ot.checkSubmittedOpForType(type.uri, {op: [{p: ['colour'], oi: 'red'}]})).equal();
+    });
+
+    it('leaves ops for other types alone', function() {
+      expect(ot.checkSubmittedOpForType(presenceType.uri, {op: {index: 0, value: 'hi'}})).equal();
+    });
+
+    it('leaves creates and deletes alone', function() {
+      expect(ot.checkSubmittedOpForType(type.uri, {create: {type: type.uri}})).equal();
+      expect(ot.checkSubmittedOpForType(type.uri, {del: true})).equal();
+    });
+  });
+
   describe('no-op', function() {
     it('works on existing docs', function() {
       var doc = {v: 6, type: type.uri, data: 'Hi'};

package/test/pubsub-memory.js

@@ -1,6 +1,7 @@
 var MemoryPubSub = require('../lib/pubsub/memory');
 var PubSub = require('../lib/pubsub');
 var expect = require('chai').expect;
+var sinon = require('sinon');
 
 require('./pubsub')(function(callback) {
   callback(null, new MemoryPubSub());
@@ -29,6 +30,50 @@ describe('PubSub base class', function() {
     pubsub.subscribe('x');
   });
 
+  it('returns the _subscribe error to every concurrent subscriber', function(done) {
+    var pubsub = new PubSub();
+    sinon.spy(pubsub, '_subscribe');
+    var errors = 0;
+    function onSubscribe(err) {
+      expect(err.code).to.equal('ERR_DATABASE_METHOD_NOT_IMPLEMENTED');
+      if (++errors < 2) return;
+      expect(pubsub._subscribe).to.have.been.calledOnce;
+      done();
+    }
+    pubsub.subscribe('x', onSubscribe);
+    pubsub.subscribe('x', onSubscribe);
+  });
+
+  it('calls _subscribe again after a failed subscribe', function(done) {
+    var pubsub = new PubSub();
+    pubsub.subscribe('x', function(err) {
+      expect(err.code).to.equal('ERR_DATABASE_METHOD_NOT_IMPLEMENTED');
+      pubsub._subscribe = function(channel, callback) {
+        callback();
+      };
+      pubsub.subscribe('x', function(err) {
+        if (err) return done(err);
+        expect(pubsub.streamsCount).to.equal(1);
+        done();
+      });
+    });
+  });
+
+  it('can resubscribe from a callback that destroyed the last stream', function(done) {
+    var pubsub = new PubSub();
+    pubsub._subscribe = function(channel, callback) {
+      callback();
+    };
+    pubsub._unsubscribe = function(channel, callback) {
+      callback();
+    };
+    pubsub.subscribe('x', function(err, stream) {
+      if (err) return done(err);
+      stream.destroy();
+      pubsub.subscribe('x', done);
+    });
+  });
+
   it('emits an error if _unsubscribe is unimplemented', function(done) {
     var pubsub = new PubSub();
     pubsub._subscribe = function(channel, callback) {

package/test/pubsub.js

@@ -60,6 +60,51 @@ module.exports = function(create) {
       });
     });
 
+    it('calls _subscribe once for concurrent subscribes to a channel', function(done) {
+      var pubsub = this.pubsub;
+      var _subscribe = pubsub._subscribe;
+      var subscribeCalls = 0;
+      pubsub._subscribe = function() {
+        subscribeCalls++;
+        return _subscribe.apply(this, arguments);
+      };
+      var received = [];
+      var finished = 0;
+      function onSubscribe(err, stream) {
+        if (err) return done(err);
+        var messages = [];
+        received.push(messages);
+        stream.on('data', function(data) {
+          messages.push(data.n);
+          if (data.n !== 2 || ++finished < 2) return;
+          expect(received).eql([[1, 2], [1, 2]]);
+          done();
+        });
+        if (received.length < 2) return;
+        expect(subscribeCalls).equal(1);
+        pubsub.publish(['x'], {n: 1});
+        pubsub.publish(['x'], {n: 2});
+      }
+      pubsub.subscribe('x', onSubscribe);
+      pubsub.subscribe('x', onSubscribe);
+    });
+
+    it('keeps a channel subscribed when a concurrent subscriber destroys its stream', function(done) {
+      var pubsub = this.pubsub;
+      pubsub.subscribe('x', function(err, stream) {
+        if (err) return done(err);
+        stream.destroy();
+      });
+      pubsub.subscribe('x', function(err, stream) {
+        if (err) return done(err);
+        stream.on('data', function(data) {
+          expect(data).eql({test: true});
+          done();
+        });
+        pubsub.publish(['x'], {test: true});
+      });
+    });
+
     it('stream.destroy() unsubscribes from a channel', function(done) {
       var pubsub = this.pubsub;
       pubsub.subscribe('x', function(err, stream) {