@aventara/access 0.0.0-stage → 0.1.0-rc.0

package/dist/access.engine.js

@@ -0,0 +1,470 @@
+// The engine: a plain object that answers core's `AvPolicyEngine` questions by shape
+// (`can`, `grantsOf`, `scopeOf`, `fieldsOf`, the startup facts `governed`,
+// `paths`, `afterChecks`, `unheld` (the Resources the rules read as foreign), and
+// `hosted`, where the framework says which Resources it holds a written reference
+// to and the rules are checked against them, reference-reads.check.ts and
+// foreign-references.check.ts), run from a `@1` policies file alone. Default deny, any grant
+// allows, any deny wins, order never matters. Neither package imports the other.
+// The decisions themselves are `policies.decider.ts`'s; the engine adds the lock,
+// the guardrails, the decision observer, `explain`, the startup facts and, when it
+// runs from a lock and its rules read other namespaces' Resources as foreign, the
+// startup check that the service reaches their database (`checkBeacons`): until it
+// has passed, the engine decides nothing.
+import { AccessError } from "./access/access.error.js";
+import { operatorOf } from "./aventara-where.translator.js";
+import { beaconProblem, } from "./beacon/beacon.check.js";
+import { warnForeignReferences } from "./foreign-references.check.js";
+import { composeGuardrails } from "./guardrails/guardrails.composer.js";
+import { foreignOwnersOf, verifyLocked } from "./lock/lock.verifier.js";
+import { checkLock } from "./lock/lock-contract.js";
+import { checkPolicies, fail, isRecord } from "./policies.compiler.js";
+import { afterChecksOf, createDecider, fieldsQuestionProblem, grantsQuestionProblem, newTrace, } from "./policies.decider.js";
+import { warnReferenceReads } from "./reference-reads.check.js";
+import { guardedFields, } from "./resources/auth-tables.guard.js";
+import { nullSafe, ownOf } from "./scope.resolver.js";
+const ENGINE_OPTIONS = new Set(["guardrails", "lock", "requireLock"]);
+/**
+ * The engine's own copy of a file handed to it: what is checked and hashed is what
+ * runs, whatever the caller does to its object afterwards.
+ */
+const copyOf = (what, file) => {
+    try {
+        return structuredClone(file);
+    }
+    catch {
+        return fail(what, "is JSON data: it holds a value that cannot be copied");
+    }
+};
+/** Freezes a copied file all the way down, once it is checked. */
+const deepFreeze = (value) => {
+    if (typeof value === "object" && value !== null && !Object.isFrozen(value)) {
+        Object.freeze(value);
+        for (const member of Object.values(value)) {
+            deepFreeze(member);
+        }
+    }
+    return value;
+};
+// ---------------------------------------------------------------------------
+// Startup facts
+// ---------------------------------------------------------------------------
+const pathCollector = (policies) => {
+    const collect = (predicate, prefix, into, roles = new Set()) => {
+        switch (predicate.op) {
+            case "and":
+            case "or":
+                for (const arg of predicate.args) {
+                    collect(arg, prefix, into, roles);
+                }
+                return;
+            case "not":
+                collect(predicate.arg, prefix, into, roles);
+                return;
+            case "cmp":
+                into.push([...prefix, predicate.field, operatorOf(predicate.cmp)]);
+                return;
+            case "rel":
+                collect(predicate.where, [...prefix, predicate.relation], into, roles);
+                return;
+            case "some":
+            case "every":
+            case "none":
+                collect(predicate.where, [...prefix, predicate.relation, predicate.op], into, roles);
+                return;
+            case "role": {
+                const role = ownOf(policies.roles, predicate.role);
+                if (role !== undefined && "on" in role && !roles.has(predicate.role)) {
+                    collect(role.where, prefix, into, new Set([...roles, predicate.role]));
+                }
+                return;
+            }
+            default:
+                return;
+        }
+    };
+    return collect;
+};
+/**
+ * A rule's condition as the null-safe rewrite reads it: roles followed, a `me` value
+ * stood in for by a string (never `null`: a missing one folds the comparison away).
+ * Nothing is folded, so every comparison stays to be counted.
+ */
+const resolvedOf = (policies, predicate, roles = new Set()) => {
+    switch (predicate.op) {
+        case "true":
+        case "false":
+            return { k: predicate.op };
+        case "and":
+        case "or":
+            return {
+                k: predicate.op,
+                args: predicate.args.map((arg) => resolvedOf(policies, arg, roles)),
+            };
+        case "not":
+            return { k: "not", arg: resolvedOf(policies, predicate.arg, roles) };
+        case "cmp": {
+            const literal = (operand) => operand !== null && typeof operand === "object"
+                ? ""
+                : operand;
+            return {
+                k: "cmp",
+                field: predicate.field,
+                cmp: predicate.cmp,
+                value: Array.isArray(predicate.value)
+                    ? predicate.value.map(literal)
+                    : literal(predicate.value),
+            };
+        }
+        case "rel":
+        case "some":
+        case "every":
+        case "none":
+            return {
+                k: predicate.op,
+                relation: predicate.relation,
+                target: predicate.target,
+                where: resolvedOf(policies, predicate.where, roles),
+            };
+        case "role": {
+            const role = ownOf(policies.roles, predicate.role);
+            return role !== undefined && "on" in role && !roles.has(predicate.role)
+                ? resolvedOf(policies, role.where, new Set([...roles, predicate.role]))
+                : { k: "false" };
+        }
+    }
+};
+/** The filter paths a condition the null-safe rewrite wrote uses. */
+const resolvedPaths = (node, prefix, into) => {
+    switch (node.k) {
+        case "true":
+        case "false":
+            return;
+        case "cmp":
+            into.push([...prefix, node.field, operatorOf(node.cmp)]);
+            return;
+        case "and":
+        case "all":
+        case "or":
+            for (const arg of node.args) {
+                resolvedPaths(arg, prefix, into);
+            }
+            return;
+        case "not":
+            resolvedPaths(node.arg, prefix, into);
+            return;
+        case "rel":
+            resolvedPaths(node.where, [...prefix, node.relation], into);
+            return;
+        case "some":
+        case "every":
+        case "none":
+            resolvedPaths(node.where, [...prefix, node.relation, node.k], into);
+    }
+};
+/**
+ * The paths the null-safe rewrite adds to a condition on `resource`, read as it is
+ * (a grant, an `exists` question) and, for a deny, negated too (its scope): the
+ * `IS NULL` guards (`equals`), a reference's `IS NULL`, `not` for a `notIn` left
+ * empty, and the `none` and `some` an `every` becomes.
+ */
+const nullSafePaths = (policies, resource, predicate, negated, into) => {
+    const node = resolvedOf(policies, predicate);
+    resolvedPaths(nullSafe(policies, resource, node), [resource], into);
+    if (negated) {
+        resolvedPaths(nullSafe(policies, resource, { k: "not", arg: node }), [resource], into);
+    }
+};
+/** The to-one steps at a created row's own level, roles followed: each is one `exists` on its target. */
+const createSteps = (policies, predicate, roles = new Set()) => {
+    switch (predicate.op) {
+        case "and":
+        case "or":
+            return predicate.args.flatMap((arg) => createSteps(policies, arg, roles));
+        case "not":
+            return createSteps(policies, predicate.arg, roles);
+        case "rel":
+            return [predicate];
+        case "role": {
+            const role = ownOf(policies.roles, predicate.role);
+            return role !== undefined && "on" in role && !roles.has(predicate.role)
+                ? createSteps(policies, role.where, new Set([...roles, predicate.role]))
+                : [];
+        }
+        default:
+            return [];
+    }
+};
+const subjectPredicate = (policies, grant, subject) => {
+    const role = ownOf(policies.roles, subject);
+    if (role === undefined || !("on" in role)) {
+        return undefined;
+    }
+    const held = { op: "role", role: subject };
+    return grant.in === undefined
+        ? held
+        : { op: "rel", relation: grant.in, target: role.on, where: held };
+};
+const pathsOf = (policies) => {
+    const collect = pathCollector(policies);
+    const paths = {};
+    const existsPaths = (resource, predicate, into) => {
+        for (const step of createSteps(policies, predicate)) {
+            const relation = ownOf(ownOf(policies.schema, resource)?.relations, step.relation);
+            for (const reference of relation?.references ?? []) {
+                into.push([step.target, reference, "equals"]);
+            }
+            collect(step.where, [step.target], into);
+            nullSafePaths(policies, step.target, step.where, false, into);
+        }
+    };
+    const keep = (rule, found) => {
+        const unique = new Map(found.map((path) => [JSON.stringify(path), path]));
+        if (unique.size > 0) {
+            paths[rule] = [...unique.values()];
+        }
+    };
+    for (const grant of policies.grants) {
+        if (grant.resource === "*") {
+            continue;
+        }
+        const found = [];
+        const parts = [
+            grant.where,
+            ...grant.subjects.map((subject) => subjectPredicate(policies, grant, subject)),
+        ].filter((part) => part !== undefined);
+        for (const part of parts) {
+            collect(part, [grant.resource], found);
+            nullSafePaths(policies, grant.resource, part, false, found);
+        }
+        if (grant.after !== undefined) {
+            collect(grant.after, [grant.resource], found);
+            nullSafePaths(policies, grant.resource, grant.after, false, found);
+            const identifier = ownOf(policies.schema, grant.resource)?.identifiers[0] ?? [];
+            for (const field of identifier) {
+                found.push([grant.resource, field, "equals"]);
+            }
+        }
+        if (grant.actions.includes("create")) {
+            for (const part of parts) {
+                existsPaths(grant.resource, part, found);
+            }
+        }
+        keep(grant.id, found);
+    }
+    for (const deny of policies.denies) {
+        if (deny.where === undefined) {
+            continue;
+        }
+        const found = [];
+        collect(deny.where, [deny.resource], found);
+        // A scope (read, update, delete) negates the deny; a create only asks it as it is.
+        const scoped = deny.actions === "*" ||
+            deny.actions.some((action) => action !== "create");
+        nullSafePaths(policies, deny.resource, deny.where, scoped, found);
+        if (deny.actions === "*" || deny.actions.includes("create")) {
+            existsPaths(deny.resource, deny.where, found);
+        }
+        keep(deny.id, found);
+    }
+    return paths;
+};
+// ---------------------------------------------------------------------------
+// Decisions
+// ---------------------------------------------------------------------------
+/** The rule a trace shows deciding: the first grant matched, or the first deny that counted (fail closed). */
+const decidingRule = (trace, allowed) => {
+    if (allowed) {
+        for (const [grant, outcome] of trace.grants) {
+            if (outcome === "matched") {
+                return { kind: "grant", id: grant.grant.id };
+            }
+        }
+        return null;
+    }
+    for (const [deny, outcome] of trace.denies) {
+        if (outcome === "matched" || outcome === "unknown") {
+            return { kind: "deny", id: deny.deny.id };
+        }
+    }
+    return null;
+};
+/** Refuses a `fieldsOf` question the types rule out but a caller can still send (the decider refuses it too). */
+const checkFieldsQuestion = (question) => {
+    const problem = fieldsQuestionProblem(question);
+    if (problem !== undefined) {
+        throw new AccessError("ACCESS_QUESTION_INVALID", problem);
+    }
+};
+/**
+ * Builds the engine from a policies file and, optionally, the org's guardrails. Both
+ * are checked first; a bad one throws, naming the rule. With `lock`, both are held
+ * to the hashes `avAccess.lock.json` pins (`ACCESS_LOCK_MISMATCH`).
+ */
+export const createAccessEngine = (policies, options) => engineOf(policies, options, "file");
+/**
+ * The engine, from a policies file that came from `source`: with a `lock`, a file
+ * handed over is held to the lock's pin, and typed rules (the project's own
+ * source) to its namespace only. `createAccess` adds its built-in rules over Better
+ * Auth's tables (`guard`): their denies join the file's, and `fieldsOf` never lists a
+ * secret column or a field a write may not set.
+ */
+export const engineOf = (policies, options, source, observe, guard) => {
+    // The engine's own copy, checked, held to the lock, then frozen: nothing the
+    // caller does to its objects afterwards reaches what the engine runs from.
+    const own = copyOf("policies", policies);
+    checkPolicies(own);
+    if (options !== undefined &&
+        (!isRecord(options) ||
+            Object.keys(options).some((key) => !ENGINE_OPTIONS.has(key)) ||
+            (options.requireLock !== undefined &&
+                typeof options.requireLock !== "boolean"))) {
+        fail("engine", "the engine's options are `{ guardrails?, lock?, requireLock?: boolean }`");
+    }
+    // A guardrails file imported as JSON is typed by its outline only; it is checked
+    // here (`composeGuardrails`), as a typed one is.
+    const guardrails = options?.guardrails === undefined
+        ? undefined
+        : copyOf("guardrails", options.guardrails);
+    if (options?.lock === undefined) {
+        if (options?.requireLock === true) {
+            throw new AccessError("ACCESS_LOCK_MISMATCH", "`requireLock` is set and no `lock` was given: pass the project's avAccess.lock.json (`avaccess pull` writes it), so the engine runs only from the files it pins");
+        }
+    }
+    else {
+        verifyLocked(checkLock(options.lock, "engine"), {
+            namespace: own.namespace,
+            // Typed rules are the project's own source; with `requireLock` they are held to
+            // the lock's pin too, so a lock that pins other rules is refused.
+            ...(source === "file" || options.requireLock === true
+                ? { policies: own }
+                : {}),
+            guardrails,
+        });
+    }
+    // The namespaces the rules read as foreign, from the file's own markers: with a
+    // lock or without, they are read only once the beacons have passed.
+    const owners = foreignOwnersOf(own);
+    const guarded = guardrails === undefined ? own : composeGuardrails(own, guardrails);
+    const file = deepFreeze(guard === undefined || guard.denies.length === 0
+        ? guarded
+        : { ...guarded, denies: [...guarded.denies, ...guard.denies] });
+    if (file !== own) {
+        checkPolicies(file, true);
+    }
+    deepFreeze(own);
+    const decider = createDecider(file);
+    // The beacons' state: `undefined` once they have passed (or when the rules read
+    // no other namespace), otherwise why the engine answers nothing yet.
+    let refusal = owners.length === 0
+        ? undefined
+        : `the rules read ${owners.map((owner) => `namespace "${owner}"'s`).join(" and ")} Resources as foreign, and the beacons were not checked: \`await engine.checkBeacons(reader, pins, environment)\` when the service starts, before it takes requests, with this environment's avAccess.beacons.<environment>.json`;
+    // A failed check latches: no later check opens the engine again.
+    let failed;
+    // The checks, one after another.
+    let checking = Promise.resolve();
+    const open = () => {
+        if (refusal !== undefined) {
+            throw new AccessError("ACCESS_BEACON_MISMATCH", refusal);
+        }
+    };
+    const fieldsOf = (question) => {
+        open();
+        checkFieldsQuestion(question);
+        return guard === undefined
+            ? decider.fieldsOf(question)
+            : guardedFields(guard, question, decider.fieldsOf(question), {
+                fields: ownOf(file.schema, question.resource)?.fields ?? [],
+                governed: ownOf(file.govern, question.resource) ?? [],
+            });
+    };
+    return {
+        governed: own.govern,
+        paths: deepFreeze(pathsOf(file)),
+        afterChecks: deepFreeze(afterChecksOf(file)),
+        unheld: Object.freeze(Object.entries(own.schema)
+            .filter(([, facts]) => facts.foreign !== undefined)
+            .map(([resource]) => resource)),
+        can: observe === undefined
+            ? (question) => {
+                open();
+                return decider.can(question, newTrace());
+            }
+            : (question) => {
+                open();
+                const trace = newTrace();
+                const report = async (allowed) => {
+                    await observe(question, allowed, decidingRule(trace, allowed));
+                    return allowed;
+                };
+                const answer = decider.can(question, trace);
+                return typeof answer === "boolean"
+                    ? report(answer)
+                    : answer.then(report);
+            },
+        grantsOf: (question) => {
+            open();
+            const problem = grantsQuestionProblem(question);
+            if (problem !== undefined) {
+                throw new AccessError("ACCESS_QUESTION_INVALID", problem);
+            }
+            return decider.grantsOf(question);
+        },
+        scopeOf: (question) => {
+            open();
+            return decider.scopeOf(question);
+        },
+        fieldsOf,
+        hosted: (host) => {
+            const held = isRecord(host) ? host.held : undefined;
+            if (!Array.isArray(held) ||
+                !held.every((resource) => typeof resource === "string")) {
+                throw new AccessError("ACCESS_QUESTION_INVALID", "`hosted` takes `{ held }`, the list of Resource names the framework holds a written reference to");
+            }
+            const served = new Set(held);
+            warnReferenceReads(own, served);
+            warnForeignReferences(own, served);
+        },
+        explain: async (question) => {
+            open();
+            if (globalThis.process
+                ?.env?.NODE_ENV === "production") {
+                throw new Error("Aventara Access: explain() is for development only");
+            }
+            const trace = newTrace();
+            const allowed = await decider.can(question, trace);
+            return {
+                allowed,
+                grants: [...trace.grants].map(([grant, outcome]) => ({
+                    id: grant.grant.id,
+                    subject: grant.subject,
+                    outcome,
+                })),
+                denies: [...trace.denies].map(([deny, outcome]) => ({
+                    id: deny.deny.id,
+                    outcome,
+                })),
+                lookups: trace.lookups,
+            };
+        },
+        checkBeacons: (reader, pins, environment) => {
+            const run = async () => {
+                if (owners.length === 0) {
+                    return;
+                }
+                if (failed !== undefined) {
+                    throw new AccessError("ACCESS_BEACON_MISMATCH", `a beacon check failed before, and the engine stays shut: ${failed}`);
+                }
+                const problem = await beaconProblem(own.namespace ?? "", owners, pins, environment, reader);
+                if (problem !== undefined) {
+                    failed = problem;
+                    refusal = problem;
+                    throw new AccessError("ACCESS_BEACON_MISMATCH", problem);
+                }
+                refusal = undefined;
+            };
+            const result = checking.then(run);
+            checking = result.catch(() => undefined);
+            return result;
+        },
+    };
+};

package/dist/audit/audit-event.d.ts

@@ -0,0 +1,135 @@
+import type { AccessAction, AccessOrigin } from "../policies-contract.js";
+/**
+ * One audit event.
+ *
+ * - `sign-in`: a session began (a sign-in, or a sign-up that signs the user in).
+ *   `origin` is `client` when it came through Access's routes, `application` when the
+ *   server called Better Auth's API itself. `impersonatedBy` is the admin's user id
+ *   when the session is an impersonation (Better Auth's `admin()` plugin).
+ * - `sign-in-failed`: a route that starts a session refused the caller, or the rate
+ *   limit refused a server call of `signIn`, `signUp` or `resetPassword`
+ *   (`access.client`, reason `rate-limited`). `route` is
+ *   the Better Auth endpoint (`/sign-in/email`), `reason` the code it refused with
+ *   (`INVALID_EMAIL_OR_PASSWORD`), `target` an HMAC-SHA-256 of the identifier the
+ *   request named (its email, username or phone number), keyed by Better Auth's
+ *   secret: the same for every attempt on one identifier, and no way back to it. The
+ *   identifier itself, and anything else the caller sent, is never recorded.
+ * - `sign-out`: a session was ended through `/sign-out`.
+ * - `token`: a JWT was issued for a session by `GET /token`, with `impersonatedBy` as
+ *   for `sign-in`.
+ * - `kiosk-switch` (the kiosk profile): a PIN switched the device to `userId`, ending
+ *   the session of `previousUserId` on it (`null` when the device was locked).
+ *   `deviceId` is the enrolled device's id. A failed PIN is a `sign-in-failed` on
+ *   `/kiosk/switch-user`, with its `deviceId`.
+ * - `kiosk-lock`: a session on a device ended without a switch: `lock` (asked),
+ *   `idle` (unused for the profile's `idleTimeout`), or `device-mismatch` (it was
+ *   brought by a request without its device's credential, so it is ended for both).
+ *   `userId` is the session's user.
+ * - `kiosk-device`: a device `enrolled` or `revoked` (by `userId`, `null` when the
+ *   app's server did it), or revoked for `token-reuse`: its replaced credential was
+ *   brought again, so a copy of it is in use somewhere (`userId` is `null`); or a
+ *   request refused `stale-in-grace` (409): it brought the credential the device's
+ *   last rotation retired, inside the grace, and nothing changed (`userId` is
+ *   `null`).
+ * - `kiosk-pin`: `userId`'s PIN was set.
+ * - `decision`: the engine answered a `can` question. A request's admission (may
+ *   this caller ever do `action` on `resource`?) is one event, allowed or refused,
+ *   however many rows the request then reads or writes; a row question (a row a
+ *   create inserts, or an update leaves) adds an event only when the rules refuse
+ *   that row. `scopeOf` and `fieldsOf` shape an answer and are not decisions.
+ *   `reason` names the rule that decided: `grant:<id>`, `deny:<id>`, or `no grant`.
+ *   `userId` is the `sub` of the token or session the principal came from (through
+ *   `access.state`); `null` for an anonymous caller or a principal Access did not derive.
+ *
+ * Anonymous refusals (a `decision` refused with `userId: null`, and every
+ * `sign-in-failed`) are logged once a minute for each origin and reason (a refused
+ * sign-in, for each route and target too): the first is logged, the repeats in the
+ * minute are counted, and when the minute closes the count is logged as a summary
+ * event, the first one's fields with `suppressed` (the count), `windowStart` and
+ * `windowEnd`. The summary is logged on the next event of any kind after the minute,
+ * or by a timer at its end; a sign-in on a target logs its target's count first. A
+ * flood of anonymous requests makes two events a minute, not one per request.
+ */
+export type AccessAuditEvent = {
+    readonly at: Date;
+    readonly kind: "sign-in";
+    readonly userId: string;
+    readonly origin: AccessOrigin;
+    readonly impersonatedBy?: string;
+} | {
+    readonly at: Date;
+    readonly kind: "sign-in-failed";
+    readonly userId: null;
+    readonly route: string;
+    readonly reason: string;
+    readonly target?: string;
+    /** The kiosk profile's device, for a failed PIN. */
+    readonly deviceId?: string;
+    readonly origin: AccessOrigin;
+    readonly suppressed?: number;
+    readonly windowStart?: Date;
+    readonly windowEnd?: Date;
+} | {
+    readonly at: Date;
+    readonly kind: "sign-out";
+    readonly userId: string;
+    readonly origin: AccessOrigin;
+    readonly impersonatedBy?: string;
+} | {
+    readonly at: Date;
+    readonly kind: "token";
+    readonly userId: string;
+    readonly origin: AccessOrigin;
+    readonly impersonatedBy?: string;
+} | {
+    readonly at: Date;
+    readonly kind: "kiosk-switch";
+    readonly userId: string;
+    readonly previousUserId: string | null;
+    readonly deviceId: string;
+    readonly origin: AccessOrigin;
+} | {
+    readonly at: Date;
+    readonly kind: "kiosk-lock";
+    readonly userId: string;
+    readonly deviceId: string;
+    readonly reason: "lock" | "idle" | "device-mismatch";
+    readonly origin: AccessOrigin;
+} | {
+    readonly at: Date;
+    readonly kind: "kiosk-device";
+    readonly userId: string | null;
+    readonly deviceId: string;
+    readonly reason: "enrolled" | "revoked" | "token-reuse" | "stale-in-grace";
+    readonly origin: AccessOrigin;
+} | {
+    readonly at: Date;
+    readonly kind: "kiosk-pin";
+    readonly userId: string;
+    readonly origin: AccessOrigin;
+} | {
+    readonly at: Date;
+    readonly kind: "decision";
+    readonly userId: string | null;
+    readonly resource: string;
+    readonly action: AccessAction;
+    readonly allowed: boolean;
+    readonly reason: string;
+    readonly origin: AccessOrigin;
+    readonly suppressed?: number;
+    readonly windowStart?: Date;
+    readonly windowEnd?: Date;
+};
+/**
+ * The `audit` block: `true` writes each event to the `accessAudit` table, through
+ * Better Auth's database adapter (Better Auth's own `generate`/`migrate` create it);
+ * `{ sink }` hands each event to the app instead, and the table is not declared.
+ * `false`, the default, logs nothing.
+ *
+ * The request waits for the write or the sink. A sink that throws (or a write that
+ * fails) does not fail the request: Better Auth's logger warns, and the request goes on.
+ */
+export type AccessAuditOptions = boolean | {
+    /** Receives each event; the request waits for it, so queue slow work. */
+    readonly sink: (event: AccessAuditEvent) => void | Promise<void>;
+};

package/dist/audit/audit-event.js

@@ -0,0 +1,8 @@
+// The audit log's event and the `audit` option. One shape for both destinations: a
+// row of the `accessAudit` table (`audit: true`) or the argument of the app's sink
+// (`audit: { sink }`).
+//
+// An event holds who, what and the answer, never a credential: no token, password,
+// cookie, key or header reaches it, because it is built field by field from the
+// session's user id and the engine's question, never copied from a request.
+export {};