fix(dexie-cloud): allow anonymous blob download + fix SW Dexie.ignoreTransaction crash (#2287)

* fix(dexie-cloud): allow anonymous blob download and fix SW Dexie.ignoreTransaction crash

Two bugs fixed:

1. BlobDownloadTracker: Remove hard requirement for access token.
   Public realm (rlm-public) blobs must be downloadable without auth.
   downloadBlob() now omits the Authorization header when token is null,
   letting the server decide whether to allow anonymous access.

2. loadCachedAccessToken: Skip Dexie.ignoreTransaction() when user is
   not logged in. Previously this always fell through to a DB lookup via
   Dexie.ignoreTransaction() even for unauthenticated users who clearly
   have no token to find. This caused a crash in service worker context
   where PSD.transless.env is undefined when called from within an active
   rw transaction (e.g. during applyServerChanges after sync).

   The fix: if currentUser.isLoggedIn is falsy, return null immediately
   without touching Dexie.ignoreTransaction.

* fix(dexie): guard Dexie.ignoreTransaction against undefined PSD.transless

PSD.transless can be undefined even when PSD.trans is truthy (e.g. in
service worker context). This caused a crash in switchToZone when
accessing targetZone.env on the undefined transless PSD.

Fix: check both PSD.trans AND PSD.transless before calling usePSD.
If transless is undefined, fall through to calling scopeFunc() directly
(same as no-transaction case).

* fix(dexie): use PSD.transless || globalPSD in ignoreTransaction

Better approach: instead of skipping usePSD when transless is undefined,
fall back to globalPSD. This ensures the zone switch always happens with
a valid PSD that has proper env properties for promise patching.

Author: liz709

addons/dexie-cloud/src/sync/BlobDownloadTracker.ts

@@ -31,8 +31,9 @@ export class BlobDownloadTracker {
     if (!promise) {
       promise = loadCachedAccessToken(this.db)
         .then((accessToken) => {
-          if (!accessToken)
-            throw new Error('No access token available for blob download');
+          // accessToken may be null for anonymous/unauthenticated users.
+          // Public realm blobs (rlm-public) are accessible without auth.
+          // downloadBlob will omit the Authorization header when token is null.
           return downloadBlob(blobRef, dbUrl, accessToken);
         })
         .finally(() => this.inFlight.delete(blobRef.ref));
@@ -45,23 +46,26 @@ export class BlobDownloadTracker {
 /**
  * Download blob data from server via proxy endpoint.
  * Uses auth header for authentication (same as sync).
+ * When accessToken is null, the request is made without Authorization header —
+ * this allows downloading blobs from public realms (rlm-public) for
+ * unauthenticated users.
  *
  * @param blobRef - The BlobRef to download
  * @param dbUrl - Base URL for the database (e.g., 'https://mydb.dexie.cloud')
- * @param accessToken - Access token for authentication
+ * @param accessToken - Access token for authentication, or null for anonymous access
  */
 
 export async function downloadBlob(
   blobRef: BlobRef,
   dbUrl: string,
-  accessToken: string
+  accessToken: string | null
 ): Promise<Uint8Array> {
   const downloadUrl = `${dbUrl}/blob/${blobRef.ref}`;
-  const response = await fetch(downloadUrl, {
-    headers: {
-      Authorization: `Bearer ${accessToken}`,
-    },
-  });
+  const headers: HeadersInit = {};
+  if (accessToken) {
+    headers['Authorization'] = `Bearer ${accessToken}`;
+  }
+  const response = await fetch(downloadUrl, { headers });
 
   if (!response.ok) {
     throw new Error(

addons/dexie-cloud/src/sync/loadCachedAccessToken.ts

@@ -27,6 +27,14 @@ export function loadCachedAccessToken(
     });
     return Promise.resolve(currentUser.accessToken);
   }
+  // If the current user is not logged in (no isLoggedIn flag), there's no
+  // token to load from the database — skip the Dexie.ignoreTransaction() call.
+  // This avoids a crash in service worker context where Dexie's Promise zone
+  // (PSD.transless.env) may be undefined when called from within an active
+  // rw transaction (e.g. during applyServerChanges).
+  if (!currentUser?.isLoggedIn) {
+    return Promise.resolve(null);
+  }
   return Dexie.ignoreTransaction(() =>
     loadAccessToken(db).then((user) => {
       if (user?.accessToken) {

src/classes/dexie/dexie-static-props.ts

@@ -16,7 +16,7 @@ import { getObjectDiff } from '../../functions/get-object-diff';
 import { fullNameExceptions } from '../../errors';
 import { DexieConstructor } from '../../public/types/dexie-constructor';
 import { getDatabaseNames } from '../../helpers/database-enumerator';
-import { PSD } from '../../helpers/promise';
+import { PSD, globalPSD } from '../../helpers/promise';
 import { usePSD } from '../../helpers/promise';
 import { newScope } from '../../helpers/promise';
 import { rejection } from '../../helpers/promise';
@@ -125,7 +125,7 @@ props(Dexie, {
     //  3) setImmediate() is not supported in the ES standard.
     //  4) You might want to keep other PSD state that was set in a parent PSD, such as PSD.letThrough.
     return PSD.trans
-      ? usePSD(PSD.transless, scopeFunc) // Use the closest parent that was non-transactional.
+      ? usePSD(PSD.transless || globalPSD, scopeFunc) // Use the closest parent that was non-transactional.
       : scopeFunc(); // No need to change scope because there is no ongoing transaction.
   },