statewire 0.13.1 → 0.15.0

package/src/host/http.ts

@@ -1,7 +1,11 @@
 import type { StatewireHost } from "../host";
 import {
   CLIENT_ID_RE,
+  PRINCIPAL_MISMATCH_MESSAGE,
+  SUBSCRIBER_LIMIT_MESSAGE,
   admitFrame,
+  atSubscriberLimit,
+  authEquals,
   closeConn,
   flush,
   parseFrame,
@@ -10,12 +14,45 @@ import {
   sendTo,
 } from "./socket";
 import type { ParsedFrame, Registration, SocketHostState } from "./socket";
+import { MAX_FRAME_BODY_BYTES } from "../wire/limits";
+import { PROTOCOL_VERSION, VERSION_HEADER } from "../wire/version";
+
+export { MAX_FRAME_BODY_BYTES } from "../wire/limits";
 
 const CLIENT_ID_HEADER = "Statewire-Client-Id";
 const LEASE_HEADER = "Statewire-Lease";
-const VERSION_HEADER = "Statewire-Version";
-const VERSION = "1";
 const encoder = new TextEncoder();
+const laggardFin = encoder.encode(
+  'data: {"fin":{"reason":"reconnect","code":"client-fell-behind"}}\n\n',
+);
+const readFrameBody = async (request: Request): Promise<string | null> => {
+  const declared = request.headers.get("content-length");
+  if (declared !== null && Number(declared) > MAX_FRAME_BODY_BYTES) {
+    await request.body?.cancel("frame body too large").catch(() => {});
+    return null;
+  }
+  if (request.body === null) return "";
+  const reader = request.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.length;
+    if (size > MAX_FRAME_BODY_BYTES) {
+      await reader.cancel("frame body too large").catch(() => {});
+      return null;
+    }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return new TextDecoder().decode(body);
+};
 
 const invalidClientIdReason = (clientId: string): string | null => {
   if (clientId === "") return "id must be non-empty";
@@ -53,30 +90,37 @@ const clientIdResponse = (
 const headersOf = (request: Request): Record<string, string> =>
   Object.fromEntries(request.headers);
 
-const mergedHeaders = (
-  request: Request,
-  extra: Record<string, string>,
-): Record<string, string> => {
-  const headers = headersOf(request);
-  for (const [name, value] of Object.entries(extra)) {
-    headers[name.toLowerCase()] = value;
-  }
-  return headers;
-};
-
 const authorize = async (
   h: SocketHostState,
   headers: Record<string, string>,
-): Promise<Response | null> => {
+): Promise<{ auth: unknown } | { refused: Response }> => {
   try {
-    await h.authorize?.({ headers });
-    return null;
+    return { auth: await h.authorize?.({ headers }) };
   } catch (error) {
-    if (error instanceof Response) return error;
+    if (error instanceof Response) return { refused: error };
     throw error;
   }
 };
 
+const subscriberLimitResponse = (): Response =>
+  Response.json({ detail: SUBSCRIBER_LIMIT_MESSAGE }, { status: 503 });
+
+// No awaits between this check and register: the binding cannot race.
+const principalMismatchResponse = (
+  h: SocketHostState,
+  clientId: string,
+  auth: unknown,
+): Response | null => {
+  const rec = h.clients.get(clientId);
+  if (rec !== undefined && !authEquals(rec.principal, auth)) {
+    return Response.json(
+      { detail: PRINCIPAL_MISMATCH_MESSAGE },
+      { status: 403 },
+    );
+  }
+  return null;
+};
+
 const mintLease = (): string => {
   const bytes = crypto.getRandomValues(new Uint8Array(16));
   return btoa(String.fromCharCode(...bytes))
@@ -88,24 +132,48 @@ const mintLease = (): string => {
 type SseAttachment = {
   body: ReadableStream<Uint8Array>;
   registration: Registration | null;
+  activateBackpressure: () => void;
 };
 
-const attachSse = (h: SocketHostState, clientId: string): SseAttachment => {
+const attachSse = (
+  h: SocketHostState,
+  clientId: string,
+  auth: unknown,
+): SseAttachment => {
   let controller: ReadableStreamDefaultController<Uint8Array>;
   let connection: Registration["connection"] | null = null;
   let open = true;
-  const body = new ReadableStream({
-    start: (next) => {
-      controller = next;
-    },
-    cancel: () => {
-      open = false;
-      connection?.close();
+  let backpressureActive = false;
+  const body = new ReadableStream(
+    {
+      start: (next) => {
+        controller = next;
+      },
+      cancel: () => {
+        open = false;
+        connection?.close();
+      },
     },
-  });
+    { highWaterMark: h.streamQueueSize },
+  );
   const socket = {
     send: (data: string) => {
       if (!open) return;
+      if (
+        backpressureActive &&
+        controller.desiredSize !== null &&
+        controller.desiredSize <= 0
+      ) {
+        open = false;
+        try {
+          controller.enqueue(laggardFin);
+          controller.close();
+        } catch {
+          /* stream already gone */
+        }
+        connection?.close();
+        return;
+      }
       const frame = data === "{}" ? ": ping\n\n" : `data: ${data}\n\n`;
       try {
         controller.enqueue(encoder.encode(frame));
@@ -124,24 +192,32 @@ const attachSse = (h: SocketHostState, clientId: string): SseAttachment => {
       }
     },
   };
-  const registration = register(h, clientId, socket);
+  const registration = register(h, clientId, socket, false, auth);
   connection = registration?.connection ?? null;
   if (!open) connection?.close();
-  return { body, registration };
+  return {
+    body,
+    registration,
+    activateBackpressure: () => {
+      backpressureActive = true;
+    },
+  };
 };
 
 const streamResponse = (
   attachment: SseAttachment,
   lease: string | null,
-): Response =>
-  new Response(attachment.body, {
+): Response => {
+  attachment.activateBackpressure();
+  return new Response(attachment.body, {
     status: 200,
     headers: {
       "Content-Type": "text/event-stream",
-      [VERSION_HEADER]: VERSION,
+      [VERSION_HEADER]: PROTOCOL_VERSION,
       ...(lease !== null && { [LEASE_HEADER]: lease }),
     },
   });
+};
 
 const admitAttachFrame = (
   h: SocketHostState,
@@ -149,7 +225,12 @@ const admitAttachFrame = (
   frame: ParsedFrame,
 ) => {
   if (frame.ctx.length === 0 && frame.cmd.length === 0) return;
-  const admission = admitFrame(h, registration.rec, frame);
+  const admission = admitFrame(
+    h,
+    registration.rec,
+    frame,
+    registration.conn.auth,
+  );
   if (admission.type === "refused") {
     sendTo(h, registration.conn, JSON.stringify(admission.syn));
   }
@@ -159,11 +240,18 @@ const getStream = async (
   h: SocketHostState,
   request: Request,
 ): Promise<Response> => {
-  const refused = await authorize(h, headersOf(request));
-  if (refused !== null) return refused;
+  const authorized = await authorize(h, headersOf(request));
+  if ("refused" in authorized) return authorized.refused;
   const client = clientIdResponse(request);
   if ("response" in client) return client.response;
-  const attachment = attachSse(h, client.clientId);
+  const mismatch = principalMismatchResponse(
+    h,
+    client.clientId,
+    authorized.auth,
+  );
+  if (mismatch !== null) return mismatch;
+  if (atSubscriberLimit(h)) return subscriberLimitResponse();
+  const attachment = attachSse(h, client.clientId, authorized.auth);
   const lease = attachment.registration === null ? null : mintLease();
   if (attachment.registration !== null)
     attachment.registration.conn.lease = lease;
@@ -176,30 +264,38 @@ const postStream = async (
 ): Promise<Response> => {
   const client = clientIdResponse(request);
   if ("response" in client) return client.response;
+  const raw = await readFrameBody(request);
+  if (raw === null) {
+    return Response.json({ detail: "frame body too large" }, { status: 413 });
+  }
   let body: unknown;
   try {
-    body = JSON.parse(await request.text());
+    body = raw.trim() ? JSON.parse(raw) : null;
   } catch {
     return Response.json({ detail: "body must be JSON" }, { status: 400 });
   }
   let frame: ParsedFrame;
   try {
-    frame = parseFrameValue(body, true);
+    frame =
+      body === null && !raw.trim()
+        ? { ctx: [], cmd: [] }
+        : parseFrameValue(body);
   } catch (error) {
     if (!(error instanceof Error) || error.name !== "StatewireViolation") {
       throw error;
     }
     return Response.json({ detail: error.message }, { status: 400 });
   }
-  if (frame.headers === null) {
-    return Response.json(
-      { detail: "first frame must carry headers" },
-      { status: 400 },
-    );
-  }
-  const refused = await authorize(h, mergedHeaders(request, frame.headers));
-  if (refused !== null) return refused;
-  const attachment = attachSse(h, client.clientId);
+  const authorized = await authorize(h, headersOf(request));
+  if ("refused" in authorized) return authorized.refused;
+  const mismatch = principalMismatchResponse(
+    h,
+    client.clientId,
+    authorized.auth,
+  );
+  if (mismatch !== null) return mismatch;
+  if (atSubscriberLimit(h)) return subscriberLimitResponse();
+  const attachment = attachSse(h, client.clientId, authorized.auth);
   if (attachment.registration === null) return streamResponse(attachment, null);
   const lease = mintLease();
   attachment.registration.conn.lease = lease;
@@ -238,8 +334,8 @@ const violationResponse = (
   reason: string,
 ) => {
   finClient(h, clientId, {
-    reason: "error",
-    message: `protocol violation: ${reason}`,
+    reason: "protocol-error",
+    message: reason,
   });
   return Response.json({ error: reason }, { status: 400 });
 };
@@ -248,34 +344,42 @@ export const frames = async (
   h: SocketHostState,
   request: Request,
 ): Promise<Response> => {
-  const refused = await authorize(h, headersOf(request));
-  if (refused !== null) return refused;
-  const client = clientIdResponse(request);
-  if ("response" in client) return client.response;
-  const rec = h.clients.get(client.clientId);
   const lease = request.headers.get(LEASE_HEADER);
   // A lease lives and dies with its attach: any live attach of the id accepts.
-  const live =
-    lease !== null &&
-    [...h.conns].some(
-      (conn) =>
-        conn.open && conn.clientId === client.clientId && conn.lease === lease,
-    );
-  if (h.disposed || h.finished !== null || rec === undefined || !live) {
+  const leased =
+    lease === null
+      ? undefined
+      : [...h.conns].find((conn) => conn.open && conn.lease === lease);
+  if (h.disposed || h.finished !== null || leased === undefined) {
     return Response.json({ error: "stale-lease" }, { status: 423 });
   }
+  const clientId = leased.clientId;
+  const rec = h.clients.get(clientId)!;
+  const raw = await readFrameBody(request);
+  if (raw === null) {
+    return Response.json({ error: "frame body too large" }, { status: 413 });
+  }
   let frame: ParsedFrame;
   try {
-    frame = parseFrame(await request.text(), false);
+    frame = parseFrame(raw);
   } catch (error) {
     if (!(error instanceof Error) || error.name !== "StatewireViolation") {
       throw error;
     }
-    return violationResponse(h, client.clientId, error.message);
+    return violationResponse(h, clientId, error.message);
+  }
+  if (!leased.open || h.disposed || h.finished !== null) {
+    return Response.json({ error: "stale-lease" }, { status: 423 });
   }
-  const admission = admitFrame(h, rec, frame);
+  const admission = admitFrame(h, rec, frame, leased.auth);
   if (admission.type === "refused") {
-    return Response.json(admission.syn, { status: 409 });
+    const retry = admission.syn.syn.retry;
+    return Response.json(admission.syn, {
+      status: retry === undefined ? 409 : 429,
+      ...(retry !== undefined && {
+        headers: { "Retry-After": String(Math.ceil(retry / 1000)) },
+      }),
+    });
   }
   return Response.json({});
 };