@adonis-agora/agent 0.30.1 → 0.30.2

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @adonis-agora/agent
 
+## 0.30.2
+
+### Patch Changes
+
+- [#108](https://github.com/DavideCarvalho/adonis-agora-agent/pull/108) [`a99256b`](https://github.com/DavideCarvalho/adonis-agora-agent/commit/a99256b185ce1f4d653476d5b5d0fc675ad25c57) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Corrige `AuthzActorResolver` para ler `userRef`/`tenantId` do `@agora/context` como MÉTODOS, não como valores — bug que derrubava com 401 toda rota do agente atrás de authz
+  
+  `@adonis-agora/context@0.6.1` publica no slot global `Symbol.for('@agora/context:accessor')` um accessor cujos campos são funções (`packages/core/src/accessor.ts`): `{ traceId(), tenantId(), userRef(), get() }`. `packages/adonis/src/authz/agora-context.ts` declarava `userRef`/`tenantId` como propriedades diretas, e `AuthzActorResolver.resolve()` lia `accessor?.userRef` como VALOR — contra o accessor real, isso é a própria função, `ref.id` é sempre `undefined`, e o resolver caía no ramo fail-closed ("no authenticated identity in @agora/context") em toda chamada. `tenantId` errava do outro lado, mais silenciosamente: uma função é truthy, então o escopo passado ao authz virava `{ tenantId: <function> }`.
+  
+  Isso passou despercebido porque o spec do resolver montava um dublê com `userRef`/`tenantId` como valor — a forma que o resolver assumia, não a que `@adonis-agora/context` produz. Um dublê que não respeita o contrato do original testa uma fantasia.
+  
+  **O que muda:**
+  
+  - `AgoraContextAccessor` (em `agora-context.ts`) agora tipa `tenantId`/`userRef` como métodos (`() => T | undefined`), espelhando o contrato real do accessor.
+  - Duas novas funções, `userRefFromContext()` e `tenantIdFromContext()`, chamam esses métodos com segurança: toleram o campo não ser uma função (accessor parcial/mockado) e toleram o método lançar (fora de um contexto ativo) — em qualquer um dos dois casos degradam para `undefined` em vez de propagar, mantendo a postura fail-closed do chamador (`AuthzActorResolver` nunca fabrica identidade).
+  - `AuthzActorResolver.resolve()` passa a usar essas duas funções em vez de ler `accessor.userRef`/`accessor.tenantId` como propriedade.
+  - Specs de `authz-actor-resolver.spec.ts` e `agora-context.spec.ts` reescritos para mockar o accessor na forma real (métodos), com casos novos cobrindo: método ausente, método que lança, e `userRef()`/`tenantId()` retornando `undefined` fora de um contexto ativo.
+  
+  Não há mudança de assinatura pública — `AuthzActorResolverConfig`, `authzActorResolver()` e o formato do `Actor` resolvido continuam os mesmos. Consumidores que hoje contornam este bug manualmente (lendo o accessor tolerando as duas formas) podem remover o contorno depois de atualizar.
+
 ## 0.30.1
 
 ### Patch Changes

package/dist/src/authz/agora-context.d.ts

@@ -7,18 +7,34 @@
 /** The symbol slot the Agora context library writes its read accessor into. */
 export declare const AGORA_CONTEXT_ACCESSOR: unique symbol;
 /**
- * The slice of the context accessor this package reads. `userRef` and `tenantId` are direct
- * accessor fields (authkit writes them via the `set` slot); we never read `globalRoles` here —
- * authz's `effectiveRoles` does that internally.
+ * The slice of the context accessor this package reads. `@adonis-agora/context`'s real accessor
+ * (`packages/core/src/accessor.ts`) publishes `tenantId` and `userRef` as METHODS — calling them
+ * returns the active value, or `undefined` outside a request/job. They are NOT plain properties;
+ * treating them as values (the mistake this file used to make) makes every field a truthy function
+ * reference instead of the data it holds. We never read `globalRoles` here — authz's
+ * `effectiveRoles` does that internally.
  */
 export interface AgoraContextAccessor {
-    tenantId?: string;
-    userRef?: {
+    tenantId?: () => string | undefined;
+    userRef?: () => {
         type?: string;
         id?: string | number;
-    };
+    } | undefined;
     get?: () => unknown;
 }
 /** Read the active Agora context accessor from the global slot, if present. */
 export declare function readContextAccessor(): AgoraContextAccessor | undefined;
+/**
+ * The active caller's `userRef` from the Agora context, or `undefined` outside a context / when
+ * the accessor slot is absent.
+ */
+export declare function userRefFromContext(accessor?: AgoraContextAccessor | undefined): {
+    type?: string;
+    id?: string | number;
+} | undefined;
+/**
+ * The active tenant id from the Agora context, or `undefined` outside a context / when unset /
+ * when the accessor slot is absent.
+ */
+export declare function tenantIdFromContext(accessor?: AgoraContextAccessor | undefined): string | undefined;
 //# sourceMappingURL=agora-context.d.ts.map

package/dist/src/authz/agora-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agora-context.d.ts","sourceRoot":"","sources":["../../../src/authz/agora-context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,eAAwC,CAAC;AAE5E;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,CAAC,EAAE,MAAM,OAAO,CAAC;CACrB;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,IAAI,oBAAoB,GAAG,SAAS,CAItE"}
+{"version":3,"file":"agora-context.d.ts","sourceRoot":"","sources":["../../../src/authz/agora-context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,eAAwC,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACpE,GAAG,CAAC,EAAE,MAAM,OAAO,CAAC;CACrB;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,IAAI,oBAAoB,GAAG,SAAS,CAItE;AAiBD;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,GAAE,oBAAoB,GAAG,SAAiC,GACjE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,SAAS,CAErD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,GAAE,oBAAoB,GAAG,SAAiC,GACjE,MAAM,GAAG,SAAS,CAEpB"}

package/dist/src/authz/agora-context.js

@@ -13,4 +13,34 @@ export function readContextAccessor() {
         return undefined;
     return slot;
 }
+/**
+ * Call an accessor method safely: tolerates the method being absent (a partial/mocked accessor,
+ * or a slot that isn't the real `@adonis-agora/context` implementation) and tolerates it throwing.
+ * Degrades to `undefined` either way — this package never fabricates identity from a broken
+ * context, it just leaves the field empty and lets the caller fail closed.
+ */
+function readMethod(fn) {
+    if (typeof fn !== 'function')
+        return undefined;
+    try {
+        return fn();
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The active caller's `userRef` from the Agora context, or `undefined` outside a context / when
+ * the accessor slot is absent.
+ */
+export function userRefFromContext(accessor = readContextAccessor()) {
+    return readMethod(accessor?.userRef);
+}
+/**
+ * The active tenant id from the Agora context, or `undefined` outside a context / when unset /
+ * when the accessor slot is absent.
+ */
+export function tenantIdFromContext(accessor = readContextAccessor()) {
+    return readMethod(accessor?.tenantId);
+}
 //# sourceMappingURL=agora-context.js.map

package/dist/src/authz/agora-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"agora-context.js","sourceRoot":"","sources":["../../../src/authz/agora-context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAa5E,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB;IACjC,MAAM,IAAI,GAAI,UAAsC,CAAC,sBAAsB,CAAC,CAAC;IAC7E,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,IAA4B,CAAC;AACtC,CAAC"}
+{"version":3,"file":"agora-context.js","sourceRoot":"","sources":["../../../src/authz/agora-context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAgB5E,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB;IACjC,MAAM,IAAI,GAAI,UAAsC,CAAC,sBAAsB,CAAC,CAAC;IAC7E,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,IAA4B,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAI,EAAW;IAChC,IAAI,OAAO,EAAE,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC;QACH,OAAQ,EAA0B,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAQ,GAAqC,mBAAmB,EAAE;IAElE,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAQ,GAAqC,mBAAmB,EAAE;IAElE,OAAO,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC"}

package/dist/src/authz/authz-actor-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz-actor-resolver.d.ts","sourceRoot":"","sources":["../../../src/authz/authz-actor-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC5E;AAED,2EAA2E;AAC3E,MAAM,WAAW,wBAAwB;IACvC,wGAAwG;IACxG,KAAK,EAAE,oBAAoB,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,kBAAmB,YAAW,aAAa;;IAGtD,YAAY,MAAM,EAAE,wBAAwB,EAE3C;IAEK,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAqB3C;CACF;AAED,8CAA8C;AAC9C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,aAAa,CAElF"}
+{"version":3,"file":"authz-actor-resolver.d.ts","sourceRoot":"","sources":["../../../src/authz/authz-actor-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC5E;AAED,2EAA2E;AAC3E,MAAM,WAAW,wBAAwB;IACvC,wGAAwG;IACxG,KAAK,EAAE,oBAAoB,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,kBAAmB,YAAW,aAAa;;IAGtD,YAAY,MAAM,EAAE,wBAAwB,EAE3C;IAEK,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAoB3C;CACF;AAED,8CAA8C;AAC9C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,aAAa,CAElF"}

package/dist/src/authz/authz-actor-resolver.js

@@ -1,4 +1,4 @@
-import { readContextAccessor } from './agora-context.js';
+import { readContextAccessor, tenantIdFromContext, userRefFromContext } from './agora-context.js';
 /**
  * An {@link ActorResolver} that reads the caller from the Agora context authkit populates
  * (`userRef`, `tenantId`) and takes the caller's roles from authz (`effectiveRoles`). It ignores
@@ -17,20 +17,19 @@ export class AuthzActorResolver {
     }
     async resolve(_req) {
         const accessor = readContextAccessor();
-        const ref = accessor?.userRef;
+        const ref = userRefFromContext(accessor);
         if (ref?.id === undefined || ref.id === null || String(ref.id).length === 0) {
             throw new Error('authzActorResolver: no authenticated identity in @agora/context. The agent route must ' +
                 'sit behind authkit auth middleware (which populates the context), with the ' +
                 '@adonis-agora/context provider registered.');
         }
-        const scope = accessor?.tenantId
-            ? { tenantId: accessor.tenantId }
-            : undefined;
+        const tenantId = tenantIdFromContext(accessor);
+        const scope = tenantId ? { tenantId } : undefined;
         const roles = await this.#authz.effectiveRoles(ref, scope);
         return {
             id: String(ref.id),
             roles,
-            ...(accessor?.tenantId ? { tenantRef: accessor.tenantId } : {}),
+            ...(tenantId ? { tenantRef: tenantId } : {}),
         };
     }
 }

package/dist/src/authz/authz-actor-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz-actor-resolver.js","sourceRoot":"","sources":["../../../src/authz/authz-actor-resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAkBzD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,kBAAkB;IACpB,MAAM,CAAuB;IAEtC,YAAY,MAAgC;QAC1C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAa;QACzB,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,QAAQ,EAAE,OAAO,CAAC;QAC9B,IAAI,GAAG,EAAE,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CACb,wFAAwF;gBACtF,6EAA6E;gBAC7E,4CAA4C,CAC/C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAiC,QAAQ,EAAE,QAAQ;YAC5D,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;YACjC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAE3D,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,KAAK;YACL,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACJ,CAAC;CACF;AAED,8CAA8C;AAC9C,MAAM,UAAU,kBAAkB,CAAC,MAAgC;IACjE,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"authz-actor-resolver.js","sourceRoot":"","sources":["../../../src/authz/authz-actor-resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAkBlG;;;;;;;;;;GAUG;AACH,MAAM,OAAO,kBAAkB;IACpB,MAAM,CAAuB;IAEtC,YAAY,MAAgC;QAC1C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAa;QACzB,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,GAAG,EAAE,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CACb,wFAAwF;gBACtF,6EAA6E;gBAC7E,4CAA4C,CAC/C,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAiC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAE3D,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,KAAK;YACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC;IACJ,CAAC;CACF;AAED,8CAA8C;AAC9C,MAAM,UAAU,kBAAkB,CAAC,MAAgC;IACjE,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC"}

package/dist/src/index.d.ts

@@ -1,4 +1,4 @@
-export declare const VERSION = "0.30.1";
+export declare const VERSION = "0.30.2";
 export { configure } from '../configure.js';
 export * from './actor-labels.js';
 export type { AuthActorResolverOptions } from './actor-resolver.js';

package/dist/src/index.js

@@ -1,4 +1,4 @@
-export const VERSION = '0.30.1';
+export const VERSION = '0.30.2';
 // Re-export the configure hook from the package root so `node ace configure` finds it.
 // AdonisJS imports the package MAIN and reads `configure` off the module namespace —
 // the `./configure` subpath alone is never consulted.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/agent",
-  "version": "0.30.1",
+  "version": "0.30.2",
   "description": "Governed, durable-backed AI agent (chat + tool-calling + governance) for AdonisJS — part of the Agora ecosystem.",
   "license": "MIT",
   "repository": {