zeekayandHanzo Dev 3d02cf7c01 Bound what one connection can store, and replay what a client can read ...

A document was one blob that every frame rewrote whole, from a goroutine
started per frame, with nothing capping the blob or the file. Any IAM user
could stream frames at doc ids under their own org and fill the disk the
volume sits on, or stream at one doc until the goroutines queued behind the
write lock ran the pod out of memory.

Each frame is now its own row, so an append writes the frame and nothing
else. The reader persists a frame before it reads the next, so a connection
has at most one append in flight, and one database connection serializes
them. Four bounds hold: a frame over 1 MiB closes the connection (1009),
more than 50 frames a second past a burst of 200 closes it (1008), a
document stores at most 16 MiB, and max_page_count holds the file to
COLLAB_STORE_BYTES. The journal is a rollback journal, so the files never
pass twice that. The store applies its pragmas per connection through
hanzoai/sqlite's OpenPragma, which both driver backends honour; a DSN
carries them only on the pure-Go one.

Only frames that carry document content are stored: y-websocket sync step 2
and update. Awareness, sent on every cursor move, and sync step 1 are
relayed and dropped, since replaying them rebuilds nothing.

A joining peer gets each stored frame as its own message. They used to be
concatenated into one, and y-websocket decodes one message per frame, so a
client applied the first and lost the rest.

A token is read from the Authorization header or from a bearer.<token>
entry in the subprotocol list a browser offers beside yjs, never from the
query string, which the edge writes to its access log.

When a JWKS refresh fails, the keys of the last good fetch keep verifying,
so an IAM outage past the cache TTL no longer refuses every token for the
refresh window. A refresh that succeeds and drops a key still revokes it.

The S3 adapter goes: production runs SQLite, and the adapter had never
stored anything. The tables are new (doc, frame); a database written by
0.1.x keeps its docs table, which nothing reads.

Co-authored-by: Hanzo Dev <[email protected]>

2026-09-23 06:23:18 -07:00

..

auth_test.go

Bound what one connection can store, and replay what a client can read

2026-09-23 06:23:18 -07:00

auth.go

Bound what one connection can store, and replay what a client can read

2026-09-23 06:23:18 -07:00