fix(dexie-cloud): allow anonymous blob download + fix SW Dexie.ignoreTransaction crash#2287
Merged
dfahlander merged 3 commits intomasterfrom Mar 31, 2026
Merged
Conversation
…reTransaction crash Two bugs fixed: 1. BlobDownloadTracker: Remove hard requirement for access token. Public realm (rlm-public) blobs must be downloadable without auth. downloadBlob() now omits the Authorization header when token is null, letting the server decide whether to allow anonymous access. 2. loadCachedAccessToken: Skip Dexie.ignoreTransaction() when user is not logged in. Previously this always fell through to a DB lookup via Dexie.ignoreTransaction() even for unauthenticated users who clearly have no token to find. This caused a crash in service worker context where PSD.transless.env is undefined when called from within an active rw transaction (e.g. during applyServerChanges after sync). The fix: if currentUser.isLoggedIn is falsy, return null immediately without touching Dexie.ignoreTransaction.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughBlob download now accepts nullable access tokens and skips Authorization when token is null; cached access token loader returns null immediately if user is not logged in; Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
addons/dexie-cloud/src/sync/loadCachedAccessToken.ts (1)
13-16:⚠️ Potential issue | 🟠 MajorGuard order allows stale token reuse after logout.
At Line 14, cached tokens are returned before the new logged-out guard at Line 35 runs. If a token is already in
wm, logged-out users may still sendAuthorization, which can break the anonymous/public-blob path and keep old auth context alive.💡 Proposed fix
export function loadCachedAccessToken( db: DexieCloudDB ): Promise<string | null> { + const currentUser = db.cloud.currentUser.value; + if (!currentUser?.isLoggedIn) { + wm.delete(db); // prevent stale token reuse after logout + return Promise.resolve(null); + } + let cached = wm.get(db); if (cached && cached.expiration > Date.now() + 5 * MINUTES) { return Promise.resolve(cached.accessToken); } - const currentUser = db.cloud.currentUser.value; + if ( currentUser && currentUser.accessToken &&Also applies to: 35-37
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@addons/dexie-cloud/src/sync/loadCachedAccessToken.ts` around lines 13 - 16, The current guard order returns a cached token from wm.get(db) using cached.expiration before the "logged-out" check runs, allowing stale tokens after logout; move the logged-out check (the guard that detects a recently-logged-out DB/user) to run before consulting wm.get(db) so you refuse/clear tokens for logged-out sessions first, and only then read cached = wm.get(db) and validate cached.expiration > Date.now() + 5 * MINUTES; also ensure any cached token is removed/ignored when the logged-out condition is true so loadCachedAccessToken (and its use of wm.get/db/cached/accessToken) cannot return an auth token for a logged-out user.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@addons/dexie-cloud/src/sync/loadCachedAccessToken.ts`:
- Around line 13-16: The current guard order returns a cached token from
wm.get(db) using cached.expiration before the "logged-out" check runs, allowing
stale tokens after logout; move the logged-out check (the guard that detects a
recently-logged-out DB/user) to run before consulting wm.get(db) so you
refuse/clear tokens for logged-out sessions first, and only then read cached =
wm.get(db) and validate cached.expiration > Date.now() + 5 * MINUTES; also
ensure any cached token is removed/ignored when the logged-out condition is true
so loadCachedAccessToken (and its use of wm.get/db/cached/accessToken) cannot
return an auth token for a logged-out user.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 74dda9ce-6235-4bb7-a4d4-85cead7137fb
📒 Files selected for processing (2)
addons/dexie-cloud/src/sync/BlobDownloadTracker.tsaddons/dexie-cloud/src/sync/loadCachedAccessToken.ts
…less PSD.transless can be undefined even when PSD.trans is truthy (e.g. in service worker context). This caused a crash in switchToZone when accessing targetZone.env on the undefined transless PSD. Fix: check both PSD.trans AND PSD.transless before calling usePSD. If transless is undefined, fall through to calling scopeFunc() directly (same as no-transaction case).
Better approach: instead of skipping usePSD when transless is undefined, fall back to globalPSD. This ensures the zone switch always happens with a valid PSD that has proper env properties for promise patching.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Two bugs preventing blob resolution for
rlm-publicroles (and other public realm data), plus a defensive fix in Dexie core.Bug 1:
Dexie.ignoreTransaction()crashes in service worker contextloadCachedAccessTokenfell through toDexie.ignoreTransaction()even for unauthenticated users. In service worker context, this crashes with:Root cause:
PSD.translesscan beundefinedeven whenPSD.transis truthy (e.g. in service worker context).Dexie.ignoreTransaction()calledusePSD(PSD.transless, ...)without checking.Bug 2: Anonymous users can't download blobs from public realms
BlobDownloadTracker.download()threwError: No access token available for blob downloadfor unauthenticated users. But the server already supports anonymous access forrlm-publicblobs —authenticateUser()returns an anonymous user withACCESS_DBscope and public realm access when no Bearer token is provided.Fixes (3 files)
src/classes/dexie/dexie-static-props.ts— Dexie coreGuard
Dexie.ignoreTransaction(): check bothPSD.trans && PSD.translessbefore callingusePSD. Iftranslessis undefined, fall through to callingscopeFunc()directly (same as no-transaction case).addons/dexie-cloud/src/sync/loadCachedAccessToken.tsIf
currentUser.isLoggedInis falsy, returnnullimmediately — no need to attempt a DB lookup viaDexie.ignoreTransaction()when we know there's no token.addons/dexie-cloud/src/sync/BlobDownloadTracker.tsdownloadBlob()acceptsstring | nullforaccessTokenAuthorizationheader when token is null — server handles anonymous access for public realm blobsVerified
authenticateUser()already handles anonymous requests correctly (ACCESS_DBscope +rlm-publicrealm)blob_refs.realm_id) will pass forrlm-publicblobspromise.js— confirmed by whitespace-stripped diffSummary by CodeRabbit
New Features
Bug Fixes
Refactor