toiljs 0.0.107 → 0.0.109

package/server/auth/AuthController.ts

@@ -443,19 +443,6 @@ class EmailOwner {
     }
 }
 
-/** Reverse-index key for the STABLE ToilUserId uniqueness guard: (realm host,
- *  32-byte id). Realm-scoped, so uniqueness is enforced PER TENANT — two sites
- *  never share an id namespace. */
-@data
-class UserIdKey {
-    host: string = '';
-    id: Uint8Array = new Uint8Array(0);
-    constructor(host: string = '', id: Uint8Array = new Uint8Array(0)) {
-        this.host = host;
-        this.id = id;
-    }
-}
-
 @data
 class TokenId {
     hash: Uint8Array = new Uint8Array(0);
@@ -550,7 +537,6 @@ class TwoFaChallenge {
 class AuthDb {
     @collection static accounts: Documents<Username, AuthAccount>;
     @collection static emails: Documents<EmailKey, EmailOwner>; // email -> username (uniqueness index)
-    @collection static userIds: Documents<UserIdKey, EmailOwner>; // toilUserId -> username (per-tenant uniqueness guard)
     @collection static challenges: Documents<ChallengeId, Challenge>;
     @collection static confirmTokens: Documents<TokenId, TokenRec>;
     @collection static resetTokens: Documents<TokenId, TokenRec>;
@@ -626,16 +612,6 @@ class Auth {
         // on domain A is a DIFFERENT account + index entry from the same on domain B.
         const h = realm(ctx);
 
-        // Distinguishable statuses (not the generic 401) so the UI can say
-        // "username taken" / "email in use". Signup intentionally leaks existence
-        // (a product choice, now gated behind the PoP above); reset never does.
-        if (AuthDb.accounts.exists(new Username(h, username))) {
-            return Response.bytes(new DataWriter().writeU8(ST_TAKEN).toBytes());
-        }
-        if (AuthDb.emails.exists(new EmailKey(h, email))) {
-            return Response.bytes(new DataWriter().writeU8(ST_EMAIL_TAKEN).toBytes());
-        }
-
         // Send the confirm email + store unconfirmed when EITHER flag is on
         // (AUTH_EMAIL_CONFIRMATION or the stricter AUTH_REQUIRE_EMAIL_CONFIRMATION).
         // Whether login is then BLOCKED is a separate check (requireConfirmation,
@@ -650,29 +626,24 @@ class Auth {
         a.memKiB = MEM_KIB;
         a.iterations = ITERS;
         a.parallelism = PAR;
-        // Derive + persist the stable id once, here. Tenant-scoped (framed domain +
-        // realm-keyed reverse index below).
-        const uid = ToilUserId.derive(pk, username, authDomain(ctx)).toBytes();
-        a.toilUserId = uid;
-        // create-if-absent: a racing duplicate registration loses here, not above.
+        // Derive + persist the stable id once. Tenant-scoped, and unique WITHOUT a
+        // separate index: the framed derive maps distinct (username, domain) to
+        // distinct ids, and username is unique per realm (accounts.create below), so
+        // two accounts can never share an id.
+        a.toilUserId = ToilUserId.derive(pk, username, authDomain(ctx)).toBytes();
+        // create-if-absent IS the authoritative, race-safe uniqueness guard
+        // (serialized at the key's home): a duplicate username loses here and gets the
+        // distinguishable ST_TAKEN. No pre-`exists` read needed -- the create result
+        // is the answer.
         if (!AuthDb.accounts.create(new Username(h, username), a)) {
             return Response.bytes(new DataWriter().writeU8(ST_TAKEN).toBytes());
         }
-        // Reserve the email -> username index (uniqueness for reset-by-email, scoped
-        // per host). A racing duplicate email loses here: roll back the account we
-        // just created so a lost email race can't orphan a username whose email index
-        // points at someone else (which would also break reset-by-email for it).
+        // Reserve the email -> username index (email uniqueness + reset-by-email). A
+        // duplicate email loses here; roll back the account so nothing is orphaned.
         if (!AuthDb.emails.create(new EmailKey(h, email), new EmailOwner(username))) {
             AuthDb.accounts.delete(new Username(h, username));
             return Response.bytes(new DataWriter().writeU8(ST_EMAIL_TAKEN).toBytes());
         }
-        // Per-tenant id-uniqueness guard: atomic create of toilUserId -> username
-        // (race-safe at the key's home). A lost race rolls back email + account.
-        if (!AuthDb.userIds.create(new UserIdKey(h, uid), new EmailOwner(username))) {
-            AuthDb.emails.delete(new EmailKey(h, email));
-            AuthDb.accounts.delete(new Username(h, username));
-            return fail();
-        }
 
         if (mustConfirm) {
             this.issueConfirmation(h, ctx, username, email);
@@ -992,7 +963,6 @@ class Auth {
         const uid = ToilUserId.derive(acct.publicKey, username, authDomain(ctx)).toBytes();
         acct.toilUserId = uid;
         AuthDb.accounts.patch(new Username(h, username), acct);
-        AuthDb.userIds.create(new UserIdKey(h, uid), new EmailOwner(username));
         return uid;
     }
 

package/src/devserver/db/catalog.ts

@@ -21,6 +21,7 @@ import {
     type DbCatalogState,
     DEFAULT_FILL_WAIT_MS,
     type DevCollectionHandle,
+    type DevField,
     isCollectionFamily,
     MAX_FILL_WAIT_MS,
 } from './types.js';
@@ -72,10 +73,13 @@ export function parseCatalog(wasm: Buffer): DbCatalogState {
                 return { kind: 'malformed' };
             const fillAllowStale = fillAllowStaleByte === 1;
             const nFields = r.readU16();
+            const fields: DevField[] = [];
             for (let f = 0; f < nFields; f++) {
-                r.readString(); // field name
-                r.readString(); // field type
-                r.readU8(); // isArray
+                const fName = r.readString();
+                const fType = r.readString();
+                const isArray = r.readU8() !== 0;
+                const unique = r.readU8() !== 0;
+                fields.push({ name: fName, typeName: fType, isArray, unique });
             }
             const nMig = r.readU16();
             for (let m = 0; m < nMig; m++) r.readU32(); // migratableFrom versions
@@ -96,6 +100,7 @@ export function parseCatalog(wasm: Buffer): DbCatalogState {
                     placement,
                     fillMaxWaitMs,
                     fillAllowStale,
+                    fields,
                 });
         }
     }

package/src/devserver/db/database.ts

@@ -685,6 +685,71 @@ export class DevDatabase {
         return this.store.has(storeKey(coll.name, readKey(ref, keyPtr, keyLen))) ? 1 : 0;
     }
 
+    /** Each `@unique` field's raw value in an encoded record, per the collection's
+     *  field layout. `[]` when there is no layout or no `@unique` field. The
+     *  compiler restricts `@unique` to top-level scalar/blob records, so the walker
+     *  only skips fixed scalars and length-prefixed blobs. */
+    private uniqueValuesOf(coll: DevCollectionHandle, value: Buffer): { index: number; val: Buffer }[] {
+        const fields = coll.fields;
+        if (!fields || !fields.some((f) => f.unique)) return [];
+        const r = new DataReader(value);
+        r.readU32(); // skip the @data message-boundary id that encode() writes before the fields
+        const out: { index: number; val: Buffer }[] = [];
+        for (let i = 0; i < fields.length; i++) {
+            const f = fields[i];
+            if (f.isArray) break;
+            if (f.typeName === 'string') {
+                const s = r.readString();
+                if (f.unique) out.push({ index: i, val: Buffer.from(s, 'utf8') });
+            } else if (f.typeName === 'Uint8Array') {
+                const b = r.readBytes();
+                if (f.unique) out.push({ index: i, val: Buffer.from(b) });
+            } else {
+                switch (f.typeName) {
+                    case 'bool':
+                    case 'u8':
+                    case 'i8':
+                        r.readU8();
+                        break;
+                    case 'u16':
+                    case 'i16':
+                        r.readU16();
+                        break;
+                    case 'u32':
+                    case 'i32':
+                    case 'f32':
+                        r.readU32();
+                        break;
+                    case 'u64':
+                    case 'i64':
+                    case 'f64':
+                        r.readU64();
+                        break;
+                    default:
+                        return out; // nested @data — compiler forbids @unique on/after it
+                }
+            }
+        }
+        return out;
+    }
+
+    /** True when another record in `coll` already holds one of `value`'s `@unique`
+     *  field values (per-tenant uniqueness). `selfSk` is the writing record's store
+     *  key so it never conflicts with itself; empty values are unique-if-present. */
+    private uniqueConflict(coll: DevCollectionHandle, value: Buffer, selfSk: string): boolean {
+        const uvals = this.uniqueValuesOf(coll, value).filter((u) => u.val.length > 0);
+        if (uvals.length === 0) return false;
+        const prefix = coll.name + '\0';
+        for (const [otherSk, otherVal] of this.store) {
+            if (otherSk === selfSk || !otherSk.startsWith(prefix)) continue;
+            const otherUvals = this.uniqueValuesOf(coll, otherVal);
+            for (const u of uvals) {
+                if (otherUvals.some((o) => o.index === u.index && o.val.equals(u.val))) return true;
+            }
+        }
+        return false;
+    }
+
     create(
         ref: MemoryRef,
         db: DbDevState,
@@ -706,9 +771,12 @@ export class DevDatabase {
         if (!start.fresh)
             return start.outcome ? this.replayRecordOutcome(db, start.outcome) : start.status;
         const sk = storeKey(coll.name, key);
-        const outcome: RecordOutcome = this.store.has(sk)
-            ? { kind: 'already_exists' }
-            : { kind: 'unit' };
+        // @unique: a value already held by another record blocks the create, exactly
+        // like the edge's op_create claim (surfaced as AlreadyExists -> create false).
+        const outcome: RecordOutcome =
+            this.store.has(sk) || this.uniqueConflict(coll, value, sk)
+                ? { kind: 'already_exists' }
+                : { kind: 'unit' };
         if (outcome.kind === 'unit') {
             this.store.set(sk, value);
             this.stampVersion(coll, sk); // stamp the value type's current schema version
@@ -740,7 +808,9 @@ export class DevDatabase {
             return start.outcome ? this.replayRecordOutcome(db, start.outcome) : start.status;
         const sk = storeKey(coll.name, key);
         const outcome: RecordOutcome = this.store.has(sk)
-            ? { kind: 'value', value: v, schemaVersion: this.currentSchemaVersion(coll) }
+            ? this.uniqueConflict(coll, v, sk)
+                ? { kind: 'already_exists' } // patch would collide a @unique field
+                : { kind: 'value', value: v, schemaVersion: this.currentSchemaVersion(coll) }
             : { kind: 'not_found' };
         if (outcome.kind === 'value') {
             this.store.set(sk, v);

package/src/devserver/db/types.ts

@@ -28,6 +28,13 @@ export function isCollectionFamily(value: number): value is CollectionFamily {
     return value >= CollectionFamily.Record && value <= CollectionFamily.Capacity;
 }
 
+export interface DevField {
+    name: string;
+    typeName: string;
+    isArray: boolean;
+    unique: boolean;
+}
+
 export interface DevCollectionHandle {
     name: string;
     family: CollectionFamily;
@@ -36,6 +43,9 @@ export interface DevCollectionHandle {
     placement: number;
     fillMaxWaitMs: number;
     fillAllowStale: boolean;
+    /** The value type's field layout (declaration order); present when the catalog
+     *  carried one. Drives @unique enforcement. */
+    fields?: DevField[];
 }
 
 export type DbCatalogState =