@browserlessapi/inferlo 0.6.0 → 0.8.0

package/dist/authjs.js

@@ -0,0 +1,94 @@
+import { checkCrossSite, originOf } from "./cross-site.js";
+import { InferloError } from "./errors.js";
+const fix = 'Pass Auth from "@auth/core" and your Auth.js configuration: authJsSession(Auth, { secret, providers: [...] }).';
+const idFix = "Add the user id to the session in the Auth.js configuration: callbacks: { session: ({ session, token }) => ({ ...session, user: { ...session.user, id: token.sub } }) } (with the database strategy: ({ session, user }) => ({ ...session, user: { ...session.user, id: user.id } })), or pass authJsSession(Auth, config, { user: (session) => ... }).";
+/** Whether the request carries a cookie named like Auth.js's session token (authjs or next-auth, chunked or not). */
+function hasSessionCookie(req) {
+    const header = req.headers.get("cookie");
+    return header !== null && /(?:^|;\s*)[^=;]*session-token(?:\.\d+)?=/.test(header);
+}
+function defaultUser(session) {
+    const user = session.user ?? {};
+    if (typeof user.id !== "string" || !user.id)
+        throw new InferloError("IL6044", "The Auth.js session has no user id.", { fix: idFix });
+    const roles = Array.isArray(user.roles) ? user.roles.filter((r) => typeof r === "string") : [];
+    const out = { id: user.id, roles };
+    if (typeof user.email === "string")
+        out.email = user.email;
+    if (typeof user.name === "string")
+        out.name = user.name;
+    // Apps that register their own user type (Register) map the session with options.user.
+    return out;
+}
+/**
+ * Auth.js sessions as the app's auth: createApp({ auth: session, middleware: [session.middleware] }) with
+ * session = authJsSession(Auth, config). Routes get the user that options.user returns for the session.
+ */
+export function authJsSession(Auth, config, options = {}) {
+    if (typeof Auth !== "function")
+        throw new InferloError("IL6043", 'authJsSession() needs Auth from "@auth/core" as its first argument.', { fix });
+    if (!config || typeof config !== "object" || Array.isArray(config) || !Array.isArray(config.providers)) {
+        throw new InferloError("IL6043", "authJsSession() needs the Auth.js configuration, with its providers, as its second argument.", { fix });
+    }
+    if (!options || typeof options !== "object" || Array.isArray(options))
+        throw new InferloError("IL6043", "authJsSession() options must be an object.", { fix });
+    for (const key of Object.keys(options)) {
+        if (!["user", "trustedOrigins", "roles", "tenant"].includes(key)) {
+            throw new InferloError("IL6043", `authJsSession() has no option "${key}".`, { fix: "Use user, trustedOrigins, roles or tenant." });
+        }
+    }
+    for (const key of ["user", "roles", "tenant"]) {
+        if (options[key] !== undefined && typeof options[key] !== "function")
+            throw new InferloError("IL6043", `authJsSession() ${key} must be a function.`, { fix });
+    }
+    const basePath = config.basePath === undefined ? "/auth" : config.basePath;
+    if (typeof basePath !== "string" || !basePath.startsWith("/") || !basePath.replace(/\/+$/, "")) {
+        throw new InferloError("IL6043", `Auth.js's basePath must be a path such as "/auth", got ${JSON.stringify(basePath)}.`, {
+            fix: 'Leave basePath out of the Auth.js configuration or set it to a path under the root such as "/auth", so the app\'s own routes stay reachable.',
+        });
+    }
+    const base = basePath.replace(/\/+$/, "");
+    if (options.trustedOrigins !== undefined && !Array.isArray(options.trustedOrigins)) {
+        throw new InferloError("IL6043", "authJsSession() trustedOrigins must be a list of origins.", { fix: 'Use trustedOrigins: ["https://admin.example.com"].' });
+    }
+    const trusted = new Set((options.trustedOrigins ?? []).map((value) => {
+        const origin = originOf(value);
+        if (!origin || origin !== String(value).replace(/\/+$/, "")) {
+            throw new InferloError("IL6043", `authJsSession() trustedOrigins: ${JSON.stringify(value)} is not an origin.`, { fix: 'Use origins without a path, such as "https://admin.example.com".' });
+        }
+        return origin;
+    }));
+    const toUser = options.user ?? defaultUser;
+    return {
+        basePath: base,
+        middleware: async ({ req, url }, next) => {
+            const path = url.pathname;
+            if (path === base || path.startsWith(base + "/"))
+                return Auth(req, config);
+            return next();
+        },
+        async resolve(req, { db, url }) {
+            if (!hasSessionCookie(req))
+                return null;
+            // Auth.js reads and decrypts its own cookie: ask its session endpoint, as its framework adapters do.
+            const headers = new Headers();
+            for (const name of ["cookie", "host", "x-forwarded-host", "x-forwarded-proto", "user-agent"]) {
+                const value = req.headers.get(name);
+                if (value !== null)
+                    headers.set(name, value);
+            }
+            const response = await Auth(new Request(new URL(`${base}/session`, url), { headers }), config);
+            if (response.status !== 200) {
+                throw new InferloError("IL6044", `Auth.js answered ${response.status} for the session; check its configuration (secret, trustHost, basePath).`, { fix: "Fix the Auth.js configuration; its log says what is wrong." });
+            }
+            const session = (await response.json());
+            if (!session || !session.user)
+                return null;
+            checkCrossSite(req, url, trusted, hasSessionCookie, "authJsSession(Auth, config, { trustedOrigins: [...] })");
+            return (await toUser(session, { db, req })) ?? null;
+        },
+        ...(options.roles ? { roles: options.roles } : {}),
+        ...(options.tenant ? { tenant: options.tenant } : {}),
+    };
+}
+//# sourceMappingURL=authjs.js.map

package/dist/authjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authjs.js","sourceRoot":"","sources":["../src/authjs.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA0C3C,MAAM,GAAG,GAAG,gHAAgH,CAAC;AAC7H,MAAM,KAAK,GAAG,yVAAyV,CAAC;AAExW,qHAAqH;AACrH,SAAS,gBAAgB,CAAC,GAAY;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,MAAM,KAAK,IAAI,IAAI,0CAA0C,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,WAAW,CAAC,OAA0B;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,qCAAqC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACrI,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5G,MAAM,GAAG,GAA4B,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;IAC5D,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3D,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACxD,uFAAuF;IACvF,OAAO,GAAc,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAmB,EAAE,MAAwB,EAAE,UAAgC,EAAE;IAC7G,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,qEAAqE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACjJ,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACvG,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,8FAA8F,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,4CAA4C,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/J,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,kCAAkC,GAAG,IAAI,EAAE,EAAE,GAAG,EAAE,4CAA4C,EAAE,CAAC,CAAC;QACrI,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAU,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU;YAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,mBAAmB,GAAG,sBAAsB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAChK,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC3E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,0DAA0D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE;YACtH,GAAG,EAAE,8IAA8I;SACpJ,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,2DAA2D,EAAE,EAAE,GAAG,EAAE,oDAAoD,EAAE,CAAC,CAAC;IAC/J,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,mCAAmC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,kEAAkE,EAAE,CAAC,CAAC;QAC9L,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CACH,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAE3C,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC1B,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC3E,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;YAC5B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxC,qGAAqG;YACrG,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;YAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC7F,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,KAAK,KAAK,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YAC/F,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,oBAAoB,QAAQ,CAAC,MAAM,0EAA0E,EAAE,EAAE,GAAG,EAAE,4DAA4D,EAAE,CAAC,CAAC;YACzN,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA6B,CAAC;YACpE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC3C,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,wDAAwD,CAAC,CAAC;YAC9G,OAAO,CAAC,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;QACtD,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC"}

package/dist/azure.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Inferlo on Azure Functions (Node.js programming model v4), without a runtime dependency on @azure/functions:
+ *
+ *   // src/functions/inferlo.ts
+ *   import { app as azure } from "@azure/functions";
+ *   import { toAzureHandler } from "@browserlessapi/inferlo/azure";
+ *   import { app } from "../app.ts";
+ *
+ *   azure.setup({ enableHttpStream: true });
+ *   azure.http("inferlo", {
+ *     route: "{*path}",
+ *     methods: ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"],
+ *     authLevel: "anonymous",
+ *     handler: toAzureHandler(app, { prefix: "/api" }),
+ *   });
+ *
+ * The handler runs the whole Inferlo app (routes, auth, validation, rate limits, OpenAPI and MCP) for HTTP
+ * trigger requests and answers with an HttpResponseInit. With enableHttpStream the answer (AI streams included)
+ * is streamed to the caller as the app writes it.
+ */
+import type { App } from "./app.ts";
+/** The parts of an Azure Functions HttpRequest (@azure/functions 4.x) that Inferlo reads. */
+export interface AzureHttpRequest {
+    readonly method: string;
+    readonly url: string;
+    readonly headers: {
+        get(name: string): string | null;
+        entries?(): IterableIterator<[string, string]>;
+    } & Iterable<[string, string]>;
+    arrayBuffer(): Promise<ArrayBuffer>;
+}
+/** A cookie in the Azure Functions response format (Cookie from @azure/functions). */
+export interface AzureCookie {
+    name: string;
+    value: string;
+    domain?: string;
+    path?: string;
+    expires?: Date | number;
+    secure?: boolean;
+    httpOnly?: boolean;
+    sameSite?: "Strict" | "Lax" | "None";
+    maxAge?: number;
+}
+/** The answer, an HttpResponseInit for @azure/functions 4.x. */
+export interface AzureHttpResponseInit {
+    status: number;
+    headers: Record<string, string>;
+    cookies: AzureCookie[];
+    /** The answer's body stream (async iterable, which every @azure/functions 4.x version accepts as a body). */
+    body?: ReadableStream<Uint8Array> & AsyncIterable<Uint8Array>;
+}
+/** An Azure Functions HTTP trigger handler: handler: toAzureHandler(app, { prefix: "/api" }). */
+export type AzureHttpHandler = (request: AzureHttpRequest, context?: unknown) => Promise<AzureHttpResponseInit>;
+export interface AzureHandlerOptions {
+    /**
+     * A path prefix removed before the app routes the request. Azure Functions puts every HTTP function under
+     * "/api" unless host.json sets extensions.http.routePrefix, so use { prefix: "/api" } with the default host.json.
+     * Requests outside it keep their path.
+     */
+    prefix?: string;
+}
+/**
+ * An Azure Functions v4 HTTP trigger handler that runs a whole Inferlo app:
+ * azure.http("inferlo", { route: "{*path}", methods: [...], authLevel: "anonymous", handler: toAzureHandler(app, { prefix: "/api" }) }).
+ */
+export declare function toAzureHandler(app: Pick<App<any>, "fetch">, options?: AzureHandlerOptions): AzureHttpHandler;

package/dist/azure.js

@@ -0,0 +1,119 @@
+import { clientIps } from "./client-ip.js";
+import { InferloError } from "./errors.js";
+const fix = 'Pass the app from createApp: handler: toAzureHandler(app, { prefix: "/api" }), with route: "{*path}" on azure.http(...).';
+/** The caller's address: the last X-Forwarded-For entry, which the Azure front end adds, without its port. */
+function azureClientIp(forwarded) {
+    const last = forwarded?.split(",").pop()?.trim();
+    if (!last)
+        return undefined;
+    const bracketed = /^\[([^\]]+)\](?::\d+)?$/.exec(last);
+    if (bracketed)
+        return bracketed[1];
+    // IPv4 with a port ("203.0.113.9:51234"); a bare IPv6 address has more than one colon and no port.
+    const v4 = /^(\d{1,3}(?:\.\d{1,3}){3})(?::\d+)?$/.exec(last);
+    return v4 ? v4[1] : last;
+}
+async function toRequest(request, prefix) {
+    const headers = new Headers();
+    for (const [name, value] of request.headers)
+        headers.append(name, value);
+    const original = new URL(request.url);
+    // The Functions host runs behind a TLS front end: use the scheme and host the caller used.
+    const forwardedProto = headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
+    const proto = forwardedProto === "https" || forwardedProto === "http" ? forwardedProto : original.protocol.slice(0, -1);
+    const host = headers.get("x-forwarded-host")?.split(",")[0]?.trim() || headers.get("host") || original.host;
+    let url;
+    try {
+        url = new URL(`${proto}://${host}`);
+    }
+    catch {
+        url = new URL(original.origin);
+    }
+    url.pathname = original.pathname;
+    url.search = original.search;
+    const path = url.pathname;
+    if (prefix && (path === prefix || path.startsWith(prefix + "/")))
+        url.pathname = path.slice(prefix.length) || "/";
+    const method = request.method.toUpperCase();
+    const body = method === "GET" || method === "HEAD" ? undefined : new Uint8Array(await request.arrayBuffer());
+    const result = new Request(url, { method, headers, body: body && body.length ? body : undefined });
+    const ip = azureClientIp(headers.get("x-forwarded-for"));
+    if (ip)
+        clientIps.set(result, ip);
+    return result;
+}
+const SAME_SITE = { strict: "Strict", lax: "Lax", none: "None" };
+/** Parses a Set-Cookie header into the Cookie object Azure Functions sends (it would keep only one Set-Cookie header). */
+function parseSetCookie(header) {
+    const [pair, ...attributes] = header.split(";");
+    const eq = pair.indexOf("=");
+    if (eq < 1)
+        return undefined;
+    const cookie = { name: pair.slice(0, eq).trim(), value: pair.slice(eq + 1).trim() };
+    for (const attribute of attributes) {
+        const at = attribute.indexOf("=");
+        const key = (at === -1 ? attribute : attribute.slice(0, at)).trim().toLowerCase();
+        const value = at === -1 ? "" : attribute.slice(at + 1).trim();
+        if (key === "domain" && value)
+            cookie.domain = value;
+        else if (key === "path" && value)
+            cookie.path = value;
+        else if (key === "expires" && value) {
+            const time = Date.parse(value);
+            if (!Number.isNaN(time))
+                cookie.expires = new Date(time);
+        }
+        else if (key === "max-age" && /^-?\d+$/.test(value))
+            cookie.maxAge = Number(value);
+        else if (key === "secure")
+            cookie.secure = true;
+        else if (key === "httponly")
+            cookie.httpOnly = true;
+        else if (key === "samesite" && SAME_SITE[value.toLowerCase()])
+            cookie.sameSite = SAME_SITE[value.toLowerCase()];
+    }
+    return cookie;
+}
+function toResponseInit(response, method) {
+    const headers = {};
+    for (const [name, value] of response.headers)
+        if (name !== "set-cookie")
+            headers[name] = value;
+    const cookies = [];
+    for (const header of response.headers.getSetCookie()) {
+        const cookie = parseSetCookie(header);
+        if (cookie)
+            cookies.push(cookie);
+    }
+    const init = { status: response.status, headers, cookies };
+    if (response.body && method !== "HEAD")
+        init.body = response.body;
+    return init;
+}
+/**
+ * An Azure Functions v4 HTTP trigger handler that runs a whole Inferlo app:
+ * azure.http("inferlo", { route: "{*path}", methods: [...], authLevel: "anonymous", handler: toAzureHandler(app, { prefix: "/api" }) }).
+ */
+export function toAzureHandler(app, options = {}) {
+    if (!app || typeof app.fetch !== "function") {
+        throw new InferloError("IL5026", "toAzureHandler() needs an Inferlo app (the value returned by createApp).", { fix });
+    }
+    if (options === null ||
+        typeof options !== "object" ||
+        Object.keys(options).some((key) => key !== "prefix") ||
+        (options.prefix !== undefined && (typeof options.prefix !== "string" || !options.prefix.startsWith("/")))) {
+        throw new InferloError("IL5026", 'toAzureHandler() options are { prefix }, and prefix starts with /, such as "/api".', { fix });
+    }
+    const prefix = (options.prefix ?? "").replace(/\/+$/, "").replace(/\/{2,}/g, "/");
+    return async (request) => {
+        const r = request;
+        if (!r || typeof r.method !== "string" || typeof r.url !== "string" || typeof r.arrayBuffer !== "function" || !r.headers) {
+            throw new InferloError("IL5026", "The handler from toAzureHandler() received something that is not an Azure Functions HTTP request.", {
+                fix: "Use it as the handler of an HTTP trigger: azure.http(name, { route: \"{*path}\", handler: toAzureHandler(app, { prefix: \"/api\" }) }). Other triggers (queues, timers, blobs) need their own handler.",
+            });
+        }
+        const response = await app.fetch(await toRequest(request, prefix));
+        return toResponseInit(response, request.method.toUpperCase());
+    };
+}
+//# sourceMappingURL=azure.js.map

package/dist/azure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure.js","sourceRoot":"","sources":["../src/azure.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA4C3C,MAAM,GAAG,GAAG,0HAA0H,CAAC;AAEvI,8GAA8G;AAC9G,SAAS,aAAa,CAAC,SAAwB;IAC7C,MAAM,IAAI,GAAG,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;IACnC,mGAAmG;IACnG,MAAM,EAAE,GAAG,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAyB,EAAE,MAAc;IAChE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,2FAA2F;IAC3F,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,cAAc,KAAK,OAAO,IAAI,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC;IAC5G,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACjC,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,MAAM,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QAAE,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAClH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACnG,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACzD,IAAI,EAAE;QAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,SAAS,GAA4C,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAE1G,0HAA0H;AAC1H,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,IAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACnG,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,GAAG,KAAK,QAAQ,IAAI,KAAK;YAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;aAChD,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC;aACjD,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,GAAG,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;aAChF,IAAI,GAAG,KAAK,QAAQ;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;aAC3C,IAAI,GAAG,KAAK,UAAU;YAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;aAC/C,IAAI,GAAG,KAAK,UAAU,IAAI,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,QAAkB,EAAE,MAAc;IACxD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO;QAAE,IAAI,IAAI,KAAK,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC/F,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,IAAI,GAA0B,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAClF,IAAI,QAAQ,CAAC,IAAI,IAAI,MAAM,KAAK,MAAM;QAAE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,IAA8D,CAAC;IAC5H,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAA4B,EAAE,UAA+B,EAAE;IAC5F,IAAI,CAAC,GAAG,IAAI,OAAQ,GAA2B,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACrE,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,0EAA0E,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACxH,CAAC;IACD,IACE,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,KAAK,QAAQ;QAC3B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC;QACpD,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EACzG,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,oFAAoF,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClI,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAClF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,CAAC,GAAG,OAA2C,CAAC;QACtD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACzH,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,mGAAmG,EAAE;gBACpI,GAAG,EAAE,wMAAwM;aAC9M,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACnE,OAAO,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC;AACJ,CAAC"}

package/dist/better-auth.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Better Auth sessions as an Inferlo app's auth, without a runtime dependency on Better Auth:
+ *
+ *   import { betterAuth } from "better-auth";
+ *   import { betterAuthSession } from "@browserlessapi/inferlo/better-auth";
+ *
+ *   export const auth = betterAuth({ database: pool, emailAndPassword: { enabled: true } });
+ *   export const session = betterAuthSession(auth, {
+ *     user: ({ user }) => ({ id: user.id, email: user.email, roles: user.role ? [user.role] : [] }),
+ *   });
+ *   createApp({ auth: session, middleware: [session.middleware], ... });
+ *
+ * session.middleware answers Better Auth's own endpoints (sign-up, sign-in, sign-out, OAuth callbacks) under its
+ * basePath, "/api/auth" by default. Inferlo routes see the signed-in user from Better Auth's session cookie (or its
+ * bearer plugin). Requests that change data (POST, PUT, PATCH, DELETE) with the session cookie are refused with
+ * IL3007 when a browser sends them from another site, so other sites cannot act for a signed-in user.
+ */
+import type { AuthConfig, Middleware } from "./app.ts";
+import type { AppDb, AppUser } from "./route.ts";
+/** The user Better Auth returns with a session. Plugins add fields, such as role (admin plugin). */
+export interface BetterAuthUser {
+    id: string;
+    email: string;
+    name: string;
+    emailVerified?: boolean;
+    image?: string | null;
+    role?: string | null;
+    [field: string]: unknown;
+}
+/** The session Better Auth returns. Plugins add fields, such as activeOrganizationId (organization plugin). */
+export interface BetterAuthSessionData {
+    id: string;
+    userId: string;
+    expiresAt: Date;
+    activeOrganizationId?: string | null;
+    [field: string]: unknown;
+}
+/** The parts of a Better Auth instance (what betterAuth({ ... }) returns) that Inferlo uses. */
+export interface BetterAuthLike {
+    handler(request: Request): Promise<Response>;
+    api: {
+        getSession(context: {
+            headers: Headers;
+        }): Promise<{
+            user: BetterAuthUser;
+            session: BetterAuthSessionData;
+        } | null | undefined>;
+    };
+    options: {
+        basePath?: string;
+        baseURL?: unknown;
+        trustedOrigins?: unknown;
+        advanced?: unknown;
+    };
+}
+export interface BetterAuthSessionOptions {
+    /**
+     * The app's user for a Better Auth session, or null to refuse it (for example a disabled account). Default:
+     * { id, email, name, roles }, with roles from the admin plugin's comma-separated user.role.
+     */
+    user?: (data: {
+        user: BetterAuthUser;
+        session: BetterAuthSessionData;
+    }, ctx: {
+        db: AppDb;
+        req: Request;
+    }) => AppUser | null | undefined | Promise<AppUser | null | undefined>;
+    /**
+     * Origins ("https://admin.example.com") whose pages may change data with the session cookie, besides the app's
+     * own. Default: Better Auth's trustedOrigins when it is a list, and the origin of its baseURL.
+     */
+    trustedOrigins?: string[];
+    /** Roles of a user, checked when a route uses auth: "<role>". Default: user.roles ?? []. */
+    roles?: (user: AppUser) => string[];
+    /** The tenant of a user, for tenant-scoped models. Default: user.tenantId. */
+    tenant?: (user: AppUser) => string | null | undefined;
+}
+/** createApp({ auth: session, middleware: [session.middleware] }) for a Better Auth instance. */
+export interface BetterAuthSession extends AuthConfig {
+    /** Answers Better Auth's own endpoints under basePath with auth.handler; other requests go on to the app. */
+    middleware: Middleware;
+    /** The path Better Auth's endpoints are under, such as "/api/auth". */
+    basePath: string;
+}
+/**
+ * Better Auth sessions as the app's auth: createApp({ auth: session, middleware: [session.middleware] }) with
+ * session = betterAuthSession(auth). Routes get the user that options.user returns for the session.
+ */
+export declare function betterAuthSession(auth: BetterAuthLike, options?: BetterAuthSessionOptions): BetterAuthSession;

package/dist/better-auth.js

@@ -0,0 +1,75 @@
+import { checkCrossSite, originOf } from "./cross-site.js";
+import { InferloError } from "./errors.js";
+const fix = 'Pass the instance betterAuth({ ... }) returns: betterAuthSession(auth, { user: ({ user }) => ({ id: user.id, email: user.email }) }).';
+function defaultUser({ user }) {
+    const roles = typeof user.role === "string" ? user.role.split(",").map((r) => r.trim()).filter(Boolean) : [];
+    // Apps that register their own user type (Register) map the session with options.user.
+    return { id: user.id, email: user.email, name: user.name, roles };
+}
+/** Whether the request carries a cookie named like Better Auth's session token (its prefix is configurable). */
+function hasSessionCookie(req) {
+    const header = req.headers.get("cookie");
+    return header !== null && /(?:^|;\s*)(?:__Secure-|__Host-)?[^=;]*session_token=/.test(header);
+}
+/**
+ * Better Auth sessions as the app's auth: createApp({ auth: session, middleware: [session.middleware] }) with
+ * session = betterAuthSession(auth). Routes get the user that options.user returns for the session.
+ */
+export function betterAuthSession(auth, options = {}) {
+    if (!auth || typeof auth !== "object" || typeof auth.handler !== "function" || typeof auth.api?.getSession !== "function" || !auth.options || typeof auth.options !== "object") {
+        throw new InferloError("IL6041", "betterAuthSession() needs a Better Auth instance.", { fix });
+    }
+    if (!options || typeof options !== "object" || Array.isArray(options))
+        throw new InferloError("IL6041", "betterAuthSession() options must be an object.", { fix });
+    for (const key of Object.keys(options)) {
+        if (!["user", "trustedOrigins", "roles", "tenant"].includes(key)) {
+            throw new InferloError("IL6041", `betterAuthSession() has no option "${key}".`, { fix: "Use user, trustedOrigins, roles or tenant." });
+        }
+    }
+    for (const key of ["user", "roles", "tenant"]) {
+        if (options[key] !== undefined && typeof options[key] !== "function")
+            throw new InferloError("IL6041", `betterAuthSession() ${key} must be a function.`, { fix });
+    }
+    const basePath = auth.options.basePath === undefined ? "/api/auth" : auth.options.basePath;
+    if (typeof basePath !== "string" || !basePath.startsWith("/") || !basePath.replace(/\/+$/, "")) {
+        throw new InferloError("IL6041", `Better Auth's basePath must be a path such as "/api/auth", got ${JSON.stringify(basePath)}.`, { fix: 'Leave basePath out of betterAuth({ ... }) or set it to a path under the root such as "/api/auth", so the app\'s own routes stay reachable.' });
+    }
+    const base = basePath.replace(/\/+$/, "");
+    let trusted;
+    if (options.trustedOrigins !== undefined) {
+        if (!Array.isArray(options.trustedOrigins))
+            throw new InferloError("IL6041", "betterAuthSession() trustedOrigins must be a list of origins.", { fix: 'Use trustedOrigins: ["https://admin.example.com"].' });
+        trusted = options.trustedOrigins.map((value) => {
+            const origin = originOf(value);
+            if (!origin || origin !== value.replace(/\/+$/, "")) {
+                throw new InferloError("IL6041", `betterAuthSession() trustedOrigins: ${JSON.stringify(value)} is not an origin.`, { fix: 'Use origins without a path, such as "https://admin.example.com".' });
+            }
+            return origin;
+        });
+    }
+    else {
+        const fromAuth = Array.isArray(auth.options.trustedOrigins) ? auth.options.trustedOrigins : [];
+        trusted = [...fromAuth, auth.options.baseURL].map(originOf).filter((o) => o !== null);
+    }
+    const trustedSet = new Set(trusted);
+    const toUser = options.user ?? defaultUser;
+    return {
+        basePath: base,
+        middleware: async ({ req, url }, next) => {
+            const path = url.pathname;
+            if (path === base || path.startsWith(base + "/"))
+                return auth.handler(req);
+            return next();
+        },
+        async resolve(req, { db, url }) {
+            const found = await auth.api.getSession({ headers: req.headers });
+            if (!found || !found.user || !found.session)
+                return null;
+            checkCrossSite(req, url, trustedSet, hasSessionCookie, "betterAuthSession(auth, { trustedOrigins: [...] }) (or Better Auth's trustedOrigins)");
+            return (await toUser(found, { db, req })) ?? null;
+        },
+        ...(options.roles ? { roles: options.roles } : {}),
+        ...(options.tenant ? { tenant: options.tenant } : {}),
+    };
+}
+//# sourceMappingURL=better-auth.js.map

package/dist/better-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth.js","sourceRoot":"","sources":["../src/better-auth.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA4D3C,MAAM,GAAG,GAAG,uIAAuI,CAAC;AAEpJ,SAAS,WAAW,CAAC,EAAE,IAAI,EAA4B;IACrD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7G,uFAAuF;IACvF,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAa,CAAC;AAC/E,CAAC;AAED,gHAAgH;AAChH,SAAS,gBAAgB,CAAC,GAAY;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,MAAM,KAAK,IAAI,IAAI,sDAAsD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAoB,EAAE,UAAoC,EAAE;IAC5F,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,UAAU,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC/K,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,mDAAmD,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,gDAAgD,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACnK,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,sCAAsC,GAAG,IAAI,EAAE,EAAE,GAAG,EAAE,4CAA4C,EAAE,CAAC,CAAC;QACzI,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAU,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU;YAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,uBAAuB,GAAG,sBAAsB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACpK,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC3F,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,kEAAkE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,4IAA4I,EAAE,CAAC,CAAC;IACzR,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE1C,IAAI,OAAiB,CAAC;IACtB,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,+DAA+D,EAAE,EAAE,GAAG,EAAE,oDAAoD,EAAE,CAAC,CAAC;QAC7M,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,kEAAkE,EAAE,CAAC,CAAC;YAClM,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,OAAO,GAAG,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAE3C,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC1B,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3E,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;YAC5B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YACzD,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,sFAAsF,CAAC,CAAC;YAC/I,OAAO,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;QACpD,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC"}

package/dist/cache.d.ts

@@ -12,8 +12,9 @@ export interface CacheConfig {
     /**
      * Where entries are kept. "memory" (default): in this process, for one instance and tests.
      * "database": in the inferlo_cache table of the app's Postgres database, shared by every instance.
+     * "redis": in the Redis of createApp({ redis }), shared by every instance.
      */
-    store?: "memory" | "database";
+    store?: "memory" | "database" | "redis";
     /** Most entries the memory store keeps; the least recently used go first. Default 10000. */
     maxEntries?: number;
 }
@@ -24,8 +25,8 @@ export interface CacheSetOptions {
     tags?: readonly string[];
 }
 export interface Cache {
-    /** Where entries are kept: "memory" or "database". */
-    readonly store: "memory" | "database";
+    /** Where entries are kept: "memory", "database" or "redis". */
+    readonly store: "memory" | "database" | "redis";
     /** The cached value, or undefined when there is none or it expired. */
     get<T = unknown>(key: string): Promise<T | undefined>;
     /** Store a JSON value (not undefined; use null for "nothing") for ttlMs. Dates are stored as ISO strings. */
@@ -52,11 +53,11 @@ export interface CacheStore {
 }
 /** Check createApp({ cache }) at startup. Raises IL6028. */
 export declare function resolveCacheConfig(config: unknown): {
-    store: "memory" | "database";
+    store: "memory" | "database" | "redis";
     maxEntries: number;
 };
 /** A Cache over a store: checks keys, options and values, stores JSON, shares concurrent getOrSet calls. */
-export declare function createCache(store: CacheStore, name: "memory" | "database"): Cache;
+export declare function createCache(store: CacheStore, name: "memory" | "database" | "redis"): Cache;
 /** Entries in this process, least recently used removed first once maxEntries is reached. */
 export declare function memoryCacheStore(maxEntries?: number, now?: () => number): CacheStore;
 /** Entries in the inferlo_cache table (created on first use), shared by every instance of the app. */
@@ -67,9 +68,11 @@ export interface RouteCache {
     ttlMs: number;
     /**
      * Who shares a cached response. "user" (default): each signed-in user gets their own (requests without a user
-     * share one). "public": every caller gets the same response; only for data that does not depend on the user.
+     * share one). "tenant": the users of one tenant (organisation) share one, in multi-tenant apps (users without a
+     * tenant get their own). "public": every caller gets the same response; only for data that does not depend on
+     * the user.
      */
-    by?: "user" | "public";
+    by?: "user" | "tenant" | "public";
     /** Tags for ctx.cache.invalidate(tag), so a change removes the cached responses at once. */
     tags?: readonly string[];
 }
@@ -82,10 +85,11 @@ export interface CachedResponse {
     etag: string;
 }
 /**
- * The cache key of one request to a cached route: the route, who shares the response and the full URL path and
+ * The cache key of one request to a cached route: the route, who shares the response (the user, the tenant or
+ * everyone) and the full URL path and
  * query (sorted, so ?a=1&b=2 and ?b=2&a=1 share an entry), hashed to a short key.
  */
-export declare function routeCacheKey(method: string, path: string, option: RouteCache, userId: string | undefined, url: URL): Promise<string>;
+export declare function routeCacheKey(method: string, path: string, option: RouteCache, userId: string | undefined, url: URL, tenantId?: string | null): Promise<string>;
 /** A weak ETag for a JSON body. */
 export declare function etagFor(json: string): Promise<string>;
 /** True when an If-None-Match header lists the ETag (or is *). */

package/dist/cache.js

@@ -6,20 +6,20 @@ export function resolveCacheConfig(config) {
     if (config === undefined)
         return { store: "memory", maxEntries: 10_000 };
     const c = config;
-    const fix = 'Use createApp({ cache: { store: "memory" } }) (the default, with an optional maxEntries) or { store: "database" }.';
+    const fix = 'Use createApp({ cache: { store: "memory" } }) (the default, with an optional maxEntries), { store: "database" } or { store: "redis" }.';
     if (typeof c !== "object" || c === null || Array.isArray(c))
         throw bad("createApp({ cache }) must be an object.", fix);
     for (const key of Object.keys(c))
         if (key !== "store" && key !== "maxEntries")
             throw bad(`Unknown cache option "${key}".`, fix);
     const store = c.store ?? "memory";
-    if (store !== "memory" && store !== "database")
+    if (store !== "memory" && store !== "database" && store !== "redis")
         throw bad(`Invalid cache store ${JSON.stringify(store)}.`, fix);
     const maxEntries = c.maxEntries ?? 10_000;
     if (!Number.isInteger(maxEntries) || maxEntries < 1)
         throw bad("cache maxEntries must be a whole number of at least 1.", fix);
-    if (store === "database" && c.maxEntries !== undefined)
-        throw bad("cache maxEntries only applies to the memory store.", 'Remove maxEntries from createApp({ cache: { store: "database" } }).');
+    if (store !== "memory" && c.maxEntries !== undefined)
+        throw bad("cache maxEntries only applies to the memory store.", `Remove maxEntries from createApp({ cache: { store: "${store}" } }).`);
     return { store, maxEntries };
 }
 function checkKey(key) {
@@ -209,8 +209,8 @@ export function checkRouteCache(option, method, where) {
                 problems.push(`unknown option "${key}"`);
         if (!Number.isInteger(o.ttlMs) || o.ttlMs < 1 || o.ttlMs > MAX_TTL_MS)
             problems.push("ttlMs must be a whole number of milliseconds from 1 to 365 days");
-        if (o.by !== undefined && o.by !== "user" && o.by !== "public")
-            problems.push('by must be "user" or "public"');
+        if (o.by !== undefined && o.by !== "user" && o.by !== "tenant" && o.by !== "public")
+            problems.push('by must be "user", "tenant" or "public"');
         if (o.tags !== undefined && (!Array.isArray(o.tags) || o.tags.some((t) => typeof t !== "string" || t.length === 0 || t.length > 256)))
             problems.push("tags must be strings of 1 to 256 characters");
     }
@@ -223,11 +223,13 @@ async function sha256(text) {
     return base64url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text)));
 }
 /**
- * The cache key of one request to a cached route: the route, who shares the response and the full URL path and
+ * The cache key of one request to a cached route: the route, who shares the response (the user, the tenant or
+ * everyone) and the full URL path and
  * query (sorted, so ?a=1&b=2 and ?b=2&a=1 share an entry), hashed to a short key.
  */
-export async function routeCacheKey(method, path, option, userId, url) {
-    const who = (option.by ?? "user") === "public" ? "public" : userId === undefined ? "anonymous" : `user:${userId}`;
+export async function routeCacheKey(method, path, option, userId, url, tenantId) {
+    const by = option.by ?? "user";
+    const who = by === "public" ? "public" : by === "tenant" && tenantId ? `tenant:${tenantId}` : userId === undefined ? "anonymous" : `user:${userId}`;
     const query = [...url.searchParams].sort(([a, x], [b, y]) => (a < b ? -1 : a > b ? 1 : x < y ? -1 : x > y ? 1 : 0));
     return `route:${await sha256(JSON.stringify([method, path, who, url.pathname, query]))}`;
 }