mirror of
https://github.com/hanzoai/collab.git
synced 2026-10-30 18:44:20 +00:00
A document was one blob that every frame rewrote whole, from a goroutine started per frame, with nothing capping the blob or the file. Any IAM user could stream frames at doc ids under their own org and fill the disk the volume sits on, or stream at one doc until the goroutines queued behind the write lock ran the pod out of memory. Each frame is now its own row, so an append writes the frame and nothing else. The reader persists a frame before it reads the next, so a connection has at most one append in flight, and one database connection serializes them. Four bounds hold: a frame over 1 MiB closes the connection (1009), more than 50 frames a second past a burst of 200 closes it (1008), a document stores at most 16 MiB, and max_page_count holds the file to COLLAB_STORE_BYTES. The journal is a rollback journal, so the files never pass twice that. The store applies its pragmas per connection through hanzoai/sqlite's OpenPragma, which both driver backends honour; a DSN carries them only on the pure-Go one. Only frames that carry document content are stored: y-websocket sync step 2 and update. Awareness, sent on every cursor move, and sync step 1 are relayed and dropped, since replaying them rebuilds nothing. A joining peer gets each stored frame as its own message. They used to be concatenated into one, and y-websocket decodes one message per frame, so a client applied the first and lost the rest. A token is read from the Authorization header or from a bearer.<token> entry in the subprotocol list a browser offers beside yjs, never from the query string, which the edge writes to its access log. When a JWKS refresh fails, the keys of the last good fetch keep verifying, so an IAM outage past the cache TTL no longer refuses every token for the refresh window. A refresh that succeeds and drops a key still revokes it. The S3 adapter goes: production runs SQLite, and the adapter had never stored anything. The tables are new (doc, frame); a database written by 0.1.x keeps its docs table, which nothing reads. Co-authored-by: Hanzo Dev <[email protected]>
143 lines
3.5 KiB
Go
143 lines
3.5 KiB
Go
package store
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"sync"
|
|
"testing"
|
|
)
|
|
|
|
func open(t *testing.T, path string, maxDoc, maxFile int64) *SQLite {
|
|
t.Helper()
|
|
s, err := NewSQLite(path, maxDoc, maxFile)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
t.Cleanup(func() { s.Close() })
|
|
return s
|
|
}
|
|
|
|
func frames(t *testing.T, s *SQLite, doc string) []string {
|
|
t.Helper()
|
|
got, err := s.Load(context.Background(), doc)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
out := make([]string, len(got))
|
|
for i, f := range got {
|
|
out[i] = string(f)
|
|
}
|
|
return out
|
|
}
|
|
|
|
func TestSQLiteAppendLoad(t *testing.T) {
|
|
s := open(t, filepath.Join(t.TempDir(), "t.db"), 1<<20, 64<<20)
|
|
ctx := context.Background()
|
|
|
|
if got := frames(t, s, "doc1"); len(got) != 0 {
|
|
t.Fatalf("new doc has frames: %q", got)
|
|
}
|
|
for _, f := range []string{"aa", "bb", "cc"} {
|
|
if err := s.Append(ctx, "doc1", []byte(f)); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
if err := s.Append(ctx, "doc2", []byte("xx")); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got := fmt.Sprint(frames(t, s, "doc1")); got != "[aa bb cc]" {
|
|
t.Fatalf("doc1 frames %s, want [aa bb cc]", got)
|
|
}
|
|
if got := fmt.Sprint(frames(t, s, "doc2")); got != "[xx]" {
|
|
t.Fatalf("doc2 frames %s, want [xx]", got)
|
|
}
|
|
}
|
|
|
|
// A frame that would take its document past the cap is refused whole, and the
|
|
// document keeps what it had; other documents are unaffected.
|
|
func TestSQLiteDocCap(t *testing.T) {
|
|
s := open(t, filepath.Join(t.TempDir(), "t.db"), 10, 64<<20)
|
|
ctx := context.Background()
|
|
|
|
if err := s.Append(ctx, "doc", []byte("0123456")); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := s.Append(ctx, "doc", []byte("7890")); !errors.Is(err, ErrFull) {
|
|
t.Fatalf("append past cap: %v, want ErrFull", err)
|
|
}
|
|
if err := s.Append(ctx, "doc", []byte("789")); err != nil {
|
|
t.Fatalf("append up to cap: %v", err)
|
|
}
|
|
if got := fmt.Sprint(frames(t, s, "doc")); got != "[0123456 789]" {
|
|
t.Fatalf("frames %s", got)
|
|
}
|
|
if err := s.Append(ctx, "other", []byte("0123456789")); err != nil {
|
|
t.Fatalf("other doc refused: %v", err)
|
|
}
|
|
}
|
|
|
|
// maxFile bounds the database file across all documents: once it is reached
|
|
// every append fails, the file stays inside the cap, and what it holds still
|
|
// reads back.
|
|
func TestSQLiteFileCap(t *testing.T) {
|
|
const maxFile = 1 << 20
|
|
path := filepath.Join(t.TempDir(), "t.db")
|
|
s := open(t, path, 1<<30, maxFile)
|
|
ctx := context.Background()
|
|
|
|
frame := make([]byte, 16<<10)
|
|
var full int
|
|
for i := range 200 {
|
|
err := s.Append(ctx, fmt.Sprintf("o:w:%d", i), frame)
|
|
if err == nil {
|
|
continue
|
|
}
|
|
if !strings.Contains(err.Error(), "full") {
|
|
t.Fatalf("append %d: %v", i, err)
|
|
}
|
|
full++
|
|
}
|
|
if full == 0 {
|
|
t.Fatal("file cap never reached")
|
|
}
|
|
fi, err := os.Stat(path)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if fi.Size() > maxFile {
|
|
t.Fatalf("file is %d bytes, cap %d", fi.Size(), maxFile)
|
|
}
|
|
if got := frames(t, s, "o:w:0"); len(got) != 1 {
|
|
t.Fatalf("stored doc unreadable after the cap: %d frames", len(got))
|
|
}
|
|
}
|
|
|
|
// Concurrent appends all land: one connection serializes them, so none fails
|
|
// on the write lock.
|
|
func TestSQLiteConcurrentAppends(t *testing.T) {
|
|
s := open(t, filepath.Join(t.TempDir(), "t.db"), 1<<20, 64<<20)
|
|
var wg sync.WaitGroup
|
|
errs := make(chan error, 200)
|
|
for range 200 {
|
|
wg.Add(1)
|
|
go func() {
|
|
defer wg.Done()
|
|
if err := s.Append(context.Background(), "doc", []byte("0123456789")); err != nil {
|
|
errs <- err
|
|
}
|
|
}()
|
|
}
|
|
wg.Wait()
|
|
close(errs)
|
|
for err := range errs {
|
|
t.Fatalf("append failed: %v", err)
|
|
}
|
|
if n := len(frames(t, s, "doc")); n != 200 {
|
|
t.Fatalf("%d frames stored, want 200", n)
|
|
}
|
|
}
|