@alxia/janus 0.1.2 → 0.2.0

package/docs/guide/errors.md

@@ -1,12 +1,12 @@
 # Errors
 
-This page covers `janusErrors()`: the plugin that answers every refusal
+This page covers `janusErrors()`: the middleware that answers every refusal
 `@nxgt/janus` throws — a wrong password, a login taken, a store down —
 with its status and a body a client can act on, typed on the routes after
 it; and `bodyOf` and `statusOf`, the two functions it is made of.
 
 ```ts
-import { alxia } from '@alxia/core';
+import { alxia, validate } from '@alxia/core';
 import { janusErrors, session } from '@alxia/janus';
 import { createMemoryStores, janus, scryptHasher } from '@nxgt/janus';
 import { z } from 'zod';
@@ -23,13 +23,13 @@ const SignUp = z.object({ email: z.string(), name: z.string(), password: z.strin
 const app = alxia()
 	.use(janusErrors())
 	.use(session(accounts))
-	.post('/signup', { body: SignUp }, async ({ body, auth, reply }) => {
+	.post('/signup', validate({ body: SignUp }), async ({ body, auth, reply }) => {
 		const signedUp = await accounts.signUp(body); // throws a JanusError when it refuses
 		return reply.created({ id: auth.send(signedUp).id });
 	});
 ```
 
-A route needs no `try`: `signUp` throws, and the plugin answers.
+A route needs no `try`: `signUp` throws, and the middleware answers.
 
 ```text
 400 {"code":"PASSWORD_TOO_SHORT","minLength":12}
@@ -42,12 +42,36 @@ A route needs no `try`: `signUp` throws, and the plugin answers.
 
 ## Where to put it
 
-`janusErrors()` is an `onError` hook: it answers the errors of the routes
-declared **after** it. Put it first. A `JanusError` thrown by a route
-declared before it is the app's 500 `{"error":"internal"}`.
+`janusErrors()` is a try/catch middleware: it answers a `JanusError` thrown
+**behind** it, by `session()`, by `permission()` or by a route. Give it to
+`use` before `session()`:
+
+```ts
+const app = alxia().use(janusErrors(), session(accounts));
+```
 
-It answers only a `JanusError`. Anything else goes on to the app's next
-`onError`, or its 500.
+Declared after `session()`, it never sees what `session()` throws: a store
+down while the session is read (`STORE_FAILED`) is the app's 500
+`{"error":"internal"}`, not the 503. The same goes for a route declared
+before it: a `JanusError` it throws is not behind `janusErrors()`.
+
+It answers only a `JanusError`. Anything else goes on, thrown, to the
+middlewares before it, then the app's `onError`, or its 500.
+
+An observer that settles `next()` (`logger()`, `secureHeaders()`,
+`telemetry()`, `createI18n()`) reads the response the error would be
+answered with, and lets the error go on: `janusErrors()` answers it
+wherever it stands, `use(janusErrors()).use(i18n).use(session())`
+included. Give the observers to `use` first, then `janusErrors()`, so
+that they see its reply rather than the 500.
+
+```ts
+import { logger } from '@alxia/logger';
+
+const app = alxia()
+	.use(logger())                          // sees the 503 janusErrors() answers
+	.use(janusErrors(), session(accounts));
+```
 
 ## Statuses
 
@@ -95,7 +119,7 @@ bodyOf(new NotFoundError('user')); // { code: 'NOT_FOUND' }
 `CREDENTIALS_INVALID` is one code for an unknown login, a wrong password and
 a login throttled for too many attempts: a client cannot tell a login exists
 from it. `retryAfter` is set only once `janus()`'s throttle trips — ten
-passwords in fifteen minutes by default — and the plugin then adds the
+passwords in fifteen minutes by default — and the middleware then adds the
 `Retry-After` header.
 
 ## Reporting the 5xx
@@ -105,6 +129,7 @@ const app = alxia().use(
 	janusErrors({
 		report: (error, ctx) => console.error(`${ctx.route}: ${error.code}`, error.cause),
 	}),
+	session(accounts),
 );
 ```
 
@@ -122,35 +147,39 @@ or rejects is a process warning, and the 503 is sent all the same:
 
 The 4xx are not reported: they are the client's.
 
-## On the client
+## On the wire
 
-The refusals are in the type of every route after the plugin, so
-`@alxia/client` reads them. A 401 from a route behind
+Every route after the middleware may answer these refusals: declare them in
+your OpenAPI document, and the client you generate from it (with
+`@nxgt/openapi-codegen`, say) reads them typed. A 401 from a route behind
 `session(accounts, { required: true })` is either the session's
-`{ error: 'unauthenticated' }` or janus's `{ code }`; narrow on the key:
+`{ error: 'unauthenticated' }` or janus's `{ code }`; a caller narrows on
+the key:
 
 ```ts
-import { client } from '@alxia/client';
 import { alxia } from '@alxia/core';
 import { janusErrors, session } from '@alxia/janus';
 
 const app = alxia()
-	.use(janusErrors())
-	.use(session(accounts, { required: true }))
+	.use(janusErrors(), session(accounts, { required: true }))
 	.get('/me', ({ user, reply }) => reply(200, { name: user.name }));
 
-const me = await client(app).get('/me');
+const me = await app.request('/me');
+const body = await me.json();
 if (me.status === 401) {
-	if ('error' in me.data) console.log('sign in first');   // the session's own 401
-	else console.log(me.data.code);                           // a JanusErrorCode
+	if ('error' in body) console.log('sign in first');   // the session's own 401
+	else console.log(body.code);                          // a JanusErrorCode
 }
-if (me.status === 503) console.log(me.data.code);          // 'STORE_FAILED' and the like: try again later
+if (me.status === 503) console.log(body.code);         // 'STORE_FAILED' and the like: try again later
 ```
 
 ## Signatures
 
 ```ts
-function janusErrors(options?: JanusErrorsOptions): Alxia<Empty, Empty, '', Reply<JanusErrorStatus, JanusErrorBody>>;
+function janusErrors(options?: JanusErrorsOptions): JanusErrors;
+
+// a middleware: answers the JanusErrors thrown behind it
+type JanusErrors = Middleware<object, Promise<Next | Reply<JanusErrorStatus, JanusErrorBody>>> & MiddlewareMark;
 
 interface JanusErrorsOptions {
 	readonly report?: (error: JanusError, ctx: BaseContext) => unknown;
@@ -170,7 +199,7 @@ function statusOf(code: JanusErrorCode): JanusErrorStatus; // @nxgt/janus's
 ```
 
 `JanusError`, `JanusErrorCode` and `JanusErrorStatus` are `@nxgt/janus`'s;
-`Alxia`, `Empty`, `Reply` and `BaseContext` are `@alxia/core`'s.
+`Middleware`, `MiddlewareMark`, `Next`, `Reply` and `BaseContext` are `@alxia/core`'s.
 
 The permission guard's own refusals — `{ error: 'forbidden' }` and the
 like — are not `JanusError`s; see [Permissions](permissions.md#refusals).

package/docs/guide/permissions.md

@@ -45,6 +45,11 @@ const app = alxia()
 	);
 ```
 
+The guard lives in a `group`: given to the app's own `use`, it would also run
+on a request no route matches, and answer it 401 or 404 before the 404 it
+should get. `janusErrors()` is given to `use` before `session()`, so it
+answers what `session()` and the guard throw.
+
 `object` is what `findRecord` answered, typed as such. Granting access is
 `@nxgt/janus`'s:
 
@@ -64,7 +69,7 @@ await access.grant({ type: 'record', id: 'r1' }, 'owners', user); // user: what
 | `options.ctx` | `(ctx: BaseContext, object: O) => …` | the context a condition of the permission reads; **required exactly when the permission has one**, refused otherwise |
 
 Each callback reads the request's `BaseContext`, and, when its parameter is
-annotated, what an earlier plugin added: see
+annotated, what an earlier middleware added: see
 [Reading the app's context](#reading-the-apps-context).
 
 It runs once per request, before the route:
@@ -83,7 +88,7 @@ and answer it 401 or 404.
 
 ## Refusals
 
-Each refusal is in the type of the guarded routes, with the body
+Each guarded route may answer these refusals, with the body
 `PermissionRefusedBody`:
 
 | The request | Answered |
@@ -206,7 +211,7 @@ request throws a `TypeError` and answers 500
 `subject` names another — an API key's service account, a user read from a
 header set by a gateway. It reads the `BaseContext`, so the request, the
 URL and the path parameters, not the route's validated headers — and, when
-its parameter is annotated, what an earlier plugin added
+its parameter is annotated, what an earlier middleware added
 ([Reading the app's context](#reading-the-apps-context)). `null` is
 anonymous, a 401:
 
@@ -222,12 +227,12 @@ permission(access, 'view', 'record', byParam('id', findRecord), {
 ## Reading the app's context
 
 `load`, `subject` and `ctx` read `BaseContext` — the request, the URL, the
-path parameters. To read what an earlier plugin added — a tenant, a member,
+path parameters. To read what an earlier middleware added — a tenant, a member,
 a feature flag — annotate the callback's parameter. `permission()` infers
 what each one reads from its annotation, while `access`, `permission`,
 `type` and the object stay inferred as before, and the guard is a
-[`definePlugin`](https://github.com/softistx/alxia/blob/develop/packages/core/docs/guide/writing-a-plugin.md#a-plugin-that-needs-an-earlier-one)
-plugin: an app that does not give it before the guard cannot use it.
+[middleware that requires an earlier one](https://github.com/softistx/alxia/blob/develop/packages/core/docs/guide/writing-a-plugin.md#a-plugin-that-needs-an-earlier-one):
+an app that does not give it before the guard cannot `use` it.
 
 ```ts
 import { alxia, type BaseContext } from '@alxia/core';
@@ -250,20 +255,20 @@ const edit = permission(
 
 const app = alxia()
 	.use(janusErrors())
-	.use(tenancy) // derives tenant and member
+	.plugin(tenancy) // derives tenant and member
 	.group('/records/:id', (record) =>
 		record.use(edit).put('/', ({ object, reply }) => reply(200, { title: object.title })),
 	);
 
 alxia().use(edit);
-// error, one message per missing key: the plugin reads "tenant", which this app's context does not give: use the plugin that adds it first
-//   | the plugin reads "member", which this app's context does not give: use the plugin that adds it first
+// error, one message per missing key: Property 'tenant' is missing in type 'BaseContext & Empty' but required in type '{ tenant: Tenant; }'
+//   | Property 'member' is missing in type 'BaseContext & Empty' but required in type '{ member: { type: 'user'; id: string } | null; }'
 ```
 
 What the guard requires is the union of what the three annotations read.
 An annotation may be `BaseContext & { member: Member }` or `{ member: Member }`
 alone. An app whose `member` has a type that does not fit is refused too —
-`the plugin reads "member", which this app's context gives with another type`
+`Types of property 'member' are incompatible`
 — while a narrower one passes. A key `BaseContext` already has, annotated
 with a type it does not give — `({ pathParams }: { pathParams: string })` —
 is refused the same way.
@@ -318,7 +323,6 @@ function permission<
 	...options: OptionsArgs<C, T, P, O, SubjectCtx, CheckCtx>
 ): Alxia<
 	RequiresOf<LoadCtx & SubjectCtx & CheckCtx> & { object: O },
-	Empty,
 	'',
 	Reply<401, PermissionRefusedBody> | Reply<404, PermissionRefusedBody> | Reply<403, PermissionRefusedBody>
 > &

package/docs/guide/sessions.md

@@ -1,6 +1,6 @@
 # Sessions
 
-This page covers `session()`: the plugin that reads who a request belongs
+This page covers `session()`: the middleware that reads who a request belongs
 to, hands the routes after it a typed `user` and `session` and a bound
 `auth`, refuses an anonymous request when asked to, and sends a renewed
 session's cookie again.
@@ -27,7 +27,9 @@ const app = alxia()
 
 `session(accounts)` calls `accounts.authenticate(request)` once per request, for
 the routes declared **after** it. A route declared before it is not
-touched, and has no `user`, `session` or `auth`.
+touched, and has no `user`, `session` or `auth`. A request no route matches
+is not a route, so `session()` runs on it, wherever it is declared: with
+`required: true`, `GET /nothing` is a 401 before it is a 404.
 
 ## Where the session is read from
 
@@ -68,8 +70,9 @@ const app = alxia()
 	);
 ```
 
-With `required: true`, the 401 is in the type of every route after it, so a
-client generated from the app reads it:
+With `required: true`, every route after it answers this 401 to an
+anonymous request; declare it in the OpenAPI document a client is
+generated from:
 
 ```text
 401 {"error":"unauthenticated"}
@@ -143,7 +146,7 @@ A patient's session on `/staff/me` is a 401, as if they had sent none. A
 | `user` | the user, typed by its schema and narrowed by `type`, or `null` | the user, or `null` | the user |
 | `session` | `Session` or `null` | `Session` or `null` | `Session` |
 | `auth` | `RequestAuth`: `send`, `signOut`, `device` | the same | the same |
-| a 401 in the routes' type | no | yes | yes |
+| a 401 to an anonymous request | no | yes | yes |
 
 `Session` is `@nxgt/janus`'s: `id`, `userId`, `authenticatedAt`,
 `expiresAt`, `revokedAt`, `createdAt`. The token is never in it.
@@ -164,11 +167,11 @@ is signed in — [Signing in and out](sign-in-and-out.md) is its page.
 
 A sign-in route is called by someone who is not signed in yet, so it sits
 behind a `session()` that is **not** required: behind `required: true` it
-answers `401 {"error":"unauthenticated"}` before it runs. Use the plugin
+answers `401 {"error":"unauthenticated"}` before it runs. Use the middleware
 twice — once open, for the sign-in routes; once required, for the rest:
 
 ```ts
-import { alxia } from '@alxia/core';
+import { alxia, validate } from '@alxia/core';
 import { janusErrors, session } from '@alxia/janus';
 import { createMemoryStores, janus, scryptHasher } from '@nxgt/janus';
 import { z } from 'zod';
@@ -185,7 +188,7 @@ const SignIn = z.object({ email: z.string(), password: z.string() });
 const app = alxia()
 	.use(janusErrors())
 	.use(session(accounts))                       // open: user may be null
-	.post('/signin', { body: SignIn }, async ({ body, auth, reply }) => {
+	.post('/signin', validate({ body: SignIn }), async ({ body, auth, reply }) => {
 		const signedIn = await accounts.signIn(body);
 		return reply.ok({ id: auth.send(signedIn).id });
 	})
@@ -202,10 +205,13 @@ The second `session()` replaces the first's `user`, `session` and `auth`
 for the routes after it, with its own types: `user` is never `null` under
 `/account`, and still may be on `/greeting`, outside the group. Without the
 `group`, `.use(session(accounts, { required: true }))` on the app itself works
-the same for every route declared after it.
+the same for every route declared after it, and for a request no route
+matches: an anonymous request to a missing path is then a 401, not a 404.
+Scope a required session with a `group` to guard only some routes: a path-scoped
+`use('/api', session(…))` does not compile, since `session` adds `user`.
 
-A route behind both plugins still looks the session up once: the plugins
-of one instance share a request's lookup, for the same `type`. A different
+A route behind both middlewares still looks the session up once: the
+middlewares of one instance share a request's lookup, for the same `type`. A different
 `type` is its own lookup.
 
 ## A renewed session is sent again
@@ -219,7 +225,7 @@ conditions:
   `Authorization: Bearer` is never handed a cookie; it keeps its token,
   which is still the same one;
 - **the route did not set a session cookie itself.** A route behind the
-  plugin that signs in, or signs out, keeps its own `Set-Cookie`: the
+  route that signs in, or signs out, keeps its own `Set-Cookie`: the
   session it replaced does not undo it.
 
 ```ts
@@ -260,11 +266,17 @@ writes it with `accounts.cookie.serialize`, so they are set in one place.
 A store that cannot answer makes `authenticate` throw `STORE_FAILED`.
 `session()` does not catch it: the request fails, and `janusErrors()`
 answers it **503** `{ "code": "STORE_FAILED" }` — never a 401 that would
-send every user to the sign-in page. Without `janusErrors()`, it is the
-app's 500. See [Errors](errors.md).
+send every user to the sign-in page. `janusErrors()` must be given to `use`
+**before** `session()`, or it is not behind it to see the error: the app's
+500 answers instead. See [Errors](errors.md).
+
+```ts
+const app = alxia().use(janusErrors(), session(accounts, { required: true }));
+```
 
 Routes declared before `session()` do not call the store, and keep
-answering.
+answering. A request no route matches does run it: `session()` on the app is
+given to every request.
 
 ## Testing it
 
@@ -303,7 +315,7 @@ function session<A extends Auth<{ readonly type: string }>, const T extends User
 	options: SessionOptions<T> & { readonly required: true },
 ): Alxia<
 	{ readonly user: UserOf<A, T>; readonly session: Session; readonly auth: RequestAuth },
-	Empty, '', Reply<401, UnauthenticatedBody>
+	'', Reply<401, UnauthenticatedBody>
 >;
 
 function session<A extends Auth<{ readonly type: string }>, const T extends UserOfAuth<A>['type']>(
@@ -311,7 +323,7 @@ function session<A extends Auth<{ readonly type: string }>, const T extends User
 	options?: SessionOptions<T> & { readonly required?: false },
 ): Alxia<
 	{ readonly user: UserOf<A, T> | null; readonly session: Session | null; readonly auth: RequestAuth },
-	Empty, '', never
+	'', never
 >;
 
 function session<A extends Auth<{ readonly type: string }>, const T extends UserOfAuth<A>['type']>(
@@ -319,7 +331,7 @@ function session<A extends Auth<{ readonly type: string }>, const T extends User
 	options?: SessionOptions<T>,
 ): Alxia<
 	{ readonly user: UserOf<A, T> | null; readonly session: Session | null; readonly auth: RequestAuth },
-	Empty, '', Reply<401, UnauthenticatedBody>
+	'', Reply<401, UnauthenticatedBody>
 >;
 
 interface SessionOptions<T extends string> {
@@ -346,5 +358,5 @@ type UserOfAuth<A> = A extends Auth<infer U> ? U : never;
 exported. `Alxia`, `Empty` and `Reply` are `@alxia/core`'s; `Session` and
 `SharedApi` are `@nxgt/janus`'s.
 
-Next: [Signing in and out](sign-in-and-out.md) sets the cookie this plugin
+Next: [Signing in and out](sign-in-and-out.md) sets the cookie this middleware
 reads.

package/docs/guide/sign-in-and-out.md

@@ -6,7 +6,7 @@ cookie that tells `janus()` a sign-in comes from a device it has seen
 before — and the unbound functions for code outside a route.
 
 ```ts
-import { alxia } from '@alxia/core';
+import { alxia, validate } from '@alxia/core';
 import { janusErrors, session } from '@alxia/janus';
 import { createMemoryStores, janus, scryptHasher } from '@nxgt/janus';
 import { z } from 'zod';
@@ -24,11 +24,11 @@ const SignIn = z.object({ email: z.string(), password: z.string() });
 const app = alxia()
 	.use(janusErrors()) // a refused sign-in answered 401, a login taken 409
 	.use(session(accounts)) // not required: the people signing in are anonymous
-	.post('/signup', { body: SignUp }, async ({ body, auth, reply }) => {
+	.post('/signup', validate({ body: SignUp }), async ({ body, auth, reply }) => {
 		const signedUp = await accounts.signUp(body);
 		return reply.created({ id: auth.send(signedUp).id });
 	})
-	.post('/signin', { body: SignIn }, async ({ body, auth, reply }) => {
+	.post('/signin', validate({ body: SignIn }), async ({ body, auth, reply }) => {
 		const signedIn = await accounts.signIn(body);
 		return reply.ok({ id: auth.send(signedIn).id });
 	})
@@ -60,12 +60,12 @@ It takes a `SessionOpened` — anything holding a `token`, a `session` and
 a `user`, what `signUp`, `signIn` and the other flows of `janus()` that open
 a session answer — so it works after a sign-in by code, by link, or after
 a second factor is confirmed too. With a `deviceToken`, it sets the device
-cookie as well, with the plugin's `device` options ([below](#devices)).
+cookie as well, with the middleware's `device` options ([below](#devices)).
 
 The cookie's attributes — `name` (`janus-session`), `domain`, `path`
 (`'/'`), `sameSite` (`'lax'`), `secure` (`true`) — are set once, in
 `janus({ cookie })`, and `session()` reads and renews the same cookie. A
-route that sends a session keeps its own `Set-Cookie`: the plugin never
+route that sends a session keeps its own `Set-Cookie`: the middleware never
 overwrites it with the session the request came in with.
 
 ### A user type
@@ -74,7 +74,7 @@ With several user types, the flow is the type's; `ctx.auth.send` is the
 same:
 
 ```ts
-import { alxia } from '@alxia/core';
+import { alxia, validate } from '@alxia/core';
 import { janusErrors, session } from '@alxia/janus';
 import { createMemoryStores, janus, scryptHasher } from '@nxgt/janus';
 import { z } from 'zod';
@@ -93,7 +93,7 @@ const SignIn = z.object({ email: z.string(), password: z.string() });
 const app = alxia()
 	.use(janusErrors())
 	.use(session(accounts))
-	.post('/patients/signin', { body: SignIn }, async ({ body, auth, reply }) => {
+	.post('/patients/signin', validate({ body: SignIn }), async ({ body, auth, reply }) => {
 		const signedIn = await accounts.patient.signIn(body);
 		return reply.ok({ id: auth.send(signedIn).id });
 	});
@@ -107,7 +107,7 @@ challenge, and `send` refuses the union at compile time
 Switch on `status` first:
 
 ```ts
-.post('/signin', { body: SignIn }, async ({ body, auth, reply }) => {
+.post('/signin', validate({ body: SignIn }), async ({ body, auth, reply }) => {
 	const result = await accounts.signIn(body);
 	if (result.status === 'secondFactor') {
 		return reply.ok({ status: result.status, challenge: result.challenge });
@@ -151,7 +151,7 @@ client keeps in a long-lived cookie and presents at its next sign-in.
 `ctx.auth.device` reads it, `ctx.auth.send` writes it back:
 
 ```ts
-import { alxia } from '@alxia/core';
+import { alxia, validate } from '@alxia/core';
 import { janusErrors, session } from '@alxia/janus';
 import { createMemoryStores, janus, scryptHasher } from '@nxgt/janus';
 import { z } from 'zod';
@@ -169,7 +169,7 @@ const SignIn = z.object({ email: z.string(), password: z.string() });
 const app = alxia()
 	.use(janusErrors())
 	.use(session(accounts))
-	.post('/signin', { body: SignIn }, async ({ body, auth, reply }) => {
+	.post('/signin', validate({ body: SignIn }), async ({ body, auth, reply }) => {
 		const signedIn = await accounts.signIn(body, { device: auth.device });
 		return reply.ok({
 			id: auth.send(signedIn).id,
@@ -203,7 +203,7 @@ const device = { name: 'shop-device', domain: 'example.com' };
 
 alxia()
 	.use(session(accounts, { device }))
-	.post('/signin', { body: SignIn }, async ({ body, auth, reply }) => {
+	.post('/signin', validate({ body: SignIn }), async ({ body, auth, reply }) => {
 		const signedIn = await accounts.signIn(body, { device: auth.device });
 		return reply.ok({ id: auth.send(signedIn).id });
 	});
@@ -241,7 +241,7 @@ helper shared by several routes, a test, or a route declared **before**
 any `session()`, which then looks up no session at all:
 
 ```ts
-import { alxia } from '@alxia/core';
+import { alxia, validate } from '@alxia/core';
 import { deviceOf, janusErrors, sendSession, session, signOut } from '@alxia/janus';
 import { createMemoryStores, janus, scryptHasher } from '@nxgt/janus';
 import { z } from 'zod';
@@ -258,7 +258,7 @@ const SignIn = z.object({ email: z.string(), password: z.string() });
 
 const app = alxia()
 	.use(janusErrors())
-	.post('/signin', { body: SignIn }, async (ctx) => {
+	.post('/signin', validate({ body: SignIn }), async (ctx) => {
 		const signedIn = await accounts.signIn(ctx.body, { device: deviceOf(ctx) });
 		return ctx.reply.ok({ id: sendSession(ctx, accounts, signedIn).id });
 	})

package/docs/roadmap.md

@@ -7,7 +7,11 @@ number on it. Every release, with each change it made, is in
 
 ## Now
 
-Nothing scheduled yet.
+- **Middlewares, not hooks.** `session()`, `permission()` and `janusErrors()`
+  are middlewares given to `use`. `janusErrors()` is a try/catch: it answers
+  the refusals thrown behind it, so it goes to `use` before `session()`. A
+  required `session()` on the app answers an anonymous request to a missing
+  path with its 401: scope it with a `group`. Lands in 0.4.
 
 ## Next
 
@@ -31,7 +35,7 @@ Nothing scheduled yet.
 
 ### 0.1.0
 
-- **The user in the context.** `use(session(accounts))` hands the routes
+- **The user in the context.** `plugin(session(accounts))` hands the routes
   after it `user`, `session` and `auth`, typed by the user schema and
   narrowed by `type`; with `required: true`, an anonymous request is a typed
   401 and `user` is never `null`. A required `session()` behind an open one