@btst/stack 3.0.0-rc.1 → 3.0.0-rc.3

package/dist/api/index.mjs

@@ -1,63 +1,168 @@
 import { createRouter } from 'better-call';
+import { isServerAuth, AuthorizationError } from '../authorization/server.mjs';
 import { defineDb } from '@btst/db';
+import { runAuthorizedOperation, runTrustedOperation, bindRouteOperationHandler, isOperationInputValidationError, OperationHttpError } from '../packages/stack/src/plugins/api/operation.mjs';
+import { composeEndpointInventory } from '../packages/stack/src/plugins/api/endpoint-inventory.mjs';
+import { serializeValidationIssues } from '../packages/stack/src/plugins/api/create-endpoint.mjs';
+import { resolvePluginRegistrationIds } from '../packages/stack/src/plugin-registration.mjs';
 export { toNodeHandler } from 'better-call/node';
 
-const identityResolvers = /* @__PURE__ */ new WeakMap();
-function registerIdentityResolver(request, auth) {
-  let cached;
-  identityResolvers.set(request.headers, () => {
-    cached ??= Promise.resolve().then(() => auth.getIdentity({ headers: request.headers, request })).then((identity) => identity ?? null).catch((error) => {
-      console.error("[btst/auth] getIdentity() failed:", error);
-      return null;
+function throwHttpOperationError(cause, error) {
+  if (isOperationInputValidationError(cause)) {
+    throw error(400, {
+      message: cause.message,
+      code: "VALIDATION_ERROR",
+      issues: serializeValidationIssues(cause.issues)
     });
-    return cached;
-  });
-}
-async function getRequestIdentity(headers) {
-  const resolve = headers ? identityResolvers.get(headers) : void 0;
-  return resolve ? resolve() : null;
+  }
+  if (cause instanceof AuthorizationError || cause instanceof OperationHttpError) {
+    const candidate = cause;
+    if (typeof candidate.statusCode === "number" && Number.isInteger(candidate.statusCode) && candidate.statusCode >= 400 && candidate.statusCode <= 599 && typeof candidate.code === "string") {
+      throw error(candidate.statusCode, {
+        message: candidate.message,
+        code: candidate.code,
+        ...candidate instanceof OperationHttpError && Array.isArray(candidate.issues) ? { issues: candidate.issues } : {}
+      });
+    }
+  }
+  throw cause;
 }
-function stack(config) {
-  const { plugins, adapter, dbSchema, basePath, auth } = config;
-  const allRoutes = {};
+function createBackendStack(config) {
+  const { plugins, adapter, dbSchema, basePath } = config;
+  const registrationIds = resolvePluginRegistrationIds(plugins, "backend");
+  const runtimeAuth = config.auth;
+  if (runtimeAuth && !isServerAuth(runtimeAuth)) {
+    throw new TypeError(
+      "createBackendStack({ auth }) requires an adapter created by createServerAuth()."
+    );
+  }
+  const allRoutes = /* @__PURE__ */ Object.create(null);
   let betterDbSchema = dbSchema ?? defineDb({});
   for (const [pluginKey, plugin] of Object.entries(plugins)) {
     betterDbSchema = betterDbSchema.use(plugin.dbPlugin);
   }
   const adapterInstance = adapter(betterDbSchema);
+  const pluginRoutesByName = /* @__PURE__ */ Object.create(
+    null
+  );
+  const pluginOperations = /* @__PURE__ */ Object.create(
+    null
+  );
+  const endpointInventory = [];
   const context = {
     plugins,
     basePath,
     adapter: adapterInstance,
-    auth
+    auth: runtimeAuth,
+    pluginRoutes: pluginRoutesByName
   };
   for (const [pluginKey, plugin] of Object.entries(plugins)) {
-    const pluginRoutes = plugin.routes(adapterInstance, context);
+    if (plugin.operations) {
+      pluginOperations[pluginKey] = plugin.operations(adapterInstance, context);
+    }
+  }
+  const routeOperationApis = /* @__PURE__ */ Object.create(null);
+  for (const [pluginKey, operations] of Object.entries(pluginOperations)) {
+    routeOperationApis[pluginKey] = /* @__PURE__ */ Object.create(null);
+    for (const [operationKey, operation] of Object.entries(operations)) {
+      const invoke = (input, request) => runAuthorizedOperation(operation, input, {
+        request,
+        ...runtimeAuth ? { auth: runtimeAuth } : {}
+      });
+      Object.defineProperty(invoke, "route", {
+        value: (resolveInput) => {
+          const handler2 = async (context2) => {
+            try {
+              const input = await resolveInput(context2);
+              return await invoke(input, context2.request);
+            } catch (cause) {
+              throwHttpOperationError(cause, context2.error);
+            }
+          };
+          return bindRouteOperationHandler(handler2, {
+            pluginKey,
+            operationKey,
+            operation
+          });
+        }
+      });
+      routeOperationApis[pluginKey][operationKey] = invoke;
+    }
+  }
+  for (const [pluginKey, plugin] of Object.entries(plugins)) {
+    const pluginRoutes = plugin.routes(
+      adapterInstance,
+      context,
+      routeOperationApis[pluginKey] ?? /* @__PURE__ */ Object.create(null)
+    );
+    pluginRoutesByName[pluginKey] = pluginRoutes;
+    endpointInventory.push(
+      ...composeEndpointInventory(
+        pluginKey,
+        registrationIds[pluginKey],
+        pluginRoutes,
+        pluginOperations[pluginKey] ?? /* @__PURE__ */ Object.create(null),
+        plugin.operations !== void 0 || runtimeAuth !== void 0,
+        plugin.infrastructureRoutes,
+        plugin.operationRouteMap
+      )
+    );
     for (const [routeKey, endpoint] of Object.entries(pluginRoutes)) {
       const compositeKey = `${pluginKey}_${routeKey}`;
       allRoutes[compositeKey] = endpoint;
     }
   }
-  const pluginApis = {};
+  Object.defineProperty(context, "endpointInventory", {
+    value: Object.freeze(endpointInventory),
+    enumerable: true
+  });
+  const pluginRaw = /* @__PURE__ */ Object.create(null);
   for (const [pluginKey, plugin] of Object.entries(plugins)) {
-    if (plugin.api) {
-      pluginApis[pluginKey] = plugin.api(adapterInstance);
+    if (plugin.raw) {
+      pluginRaw[pluginKey] = plugin.raw(adapterInstance);
     }
   }
   const router = createRouter(allRoutes, {
-    basePath
+    basePath,
+    openapi: { disabled: true }
   });
-  const handler = auth ? (request) => {
-    registerIdentityResolver(request, auth);
-    return router.handler(request);
-  } : router.handler;
+  const handler = router.handler;
+  const createRequestOperationApi = (request) => {
+    const result = /* @__PURE__ */ Object.create(null);
+    for (const [pluginKey, operations] of Object.entries(pluginOperations)) {
+      result[pluginKey] = /* @__PURE__ */ Object.create(null);
+      for (const [operationKey, operation] of Object.entries(operations)) {
+        result[pluginKey][operationKey] = (input) => runAuthorizedOperation(operation, input, {
+          request,
+          ...runtimeAuth ? { auth: runtimeAuth } : {}
+        });
+      }
+    }
+    return result;
+  };
+  const trustedResult = /* @__PURE__ */ Object.create(null);
+  for (const [pluginKey, operations] of Object.entries(pluginOperations)) {
+    trustedResult[pluginKey] = /* @__PURE__ */ Object.create(null);
+    for (const [operationKey, operation] of Object.entries(operations)) {
+      trustedResult[pluginKey][operationKey] = (input) => runTrustedOperation(operation, input);
+    }
+  }
+  const trusted = trustedResult;
   return {
     handler,
     router,
     dbSchema: betterDbSchema,
     adapter: adapterInstance,
-    api: pluginApis
+    raw: pluginRaw,
+    trusted,
+    forRequest: (request) => {
+      return {
+        operations: createRequestOperationApi(
+          request
+        )
+      };
+    }
   };
 }
 
-export { getRequestIdentity, stack };
+export { createBackendStack };

package/dist/authorization/client.cjs

@@ -0,0 +1,154 @@
+"use client";
+'use strict';
+
+const React = require('react');
+const authorization_remote = require('./remote.cjs');
+const json = require('../packages/stack/src/authorization/json.cjs');
+const auth = require('../packages/stack/src/context/auth.cjs');
+
+function toError(error) {
+  return error instanceof Error ? error : new Error(String(error));
+}
+function permissionKey(permission) {
+  const request = permission;
+  const wirePermission = request?.permission?.schema === void 0 ? { id: request?.id } : { id: request.id, facts: request.facts };
+  json.assertJsonSafe(wirePermission);
+  return JSON.stringify(wirePermission);
+}
+function createClientAuth(config) {
+  const contractValue = config.authorization?.contract ?? config.evaluator?.contract;
+  if (!contractValue) {
+    throw new TypeError(
+      "createClientAuth requires an authorization or evaluator."
+    );
+  }
+  const contract = contractValue;
+  const runtimeAuthorization = config.authorization;
+  const runtimeEvaluator = config.evaluator;
+  let clientAuth;
+  const useIdentity = () => {
+    const context = auth.useAuthContext();
+    if (context && context.provider !== clientAuth) {
+      throw new Error(
+        "This bound useIdentity hook must be used with its createClientAuth instance on StackProvider."
+      );
+    }
+    return auth.useIdentity();
+  };
+  const useCanRuntime = (permissionRequest) => {
+    const context = auth.useAuthContext();
+    const contextProvider = context?.provider;
+    const contextError = context?.error;
+    const identity = context?.identity ?? null;
+    const identityPending = context?.isPending ?? true;
+    let key = "local";
+    let permissionError;
+    if (runtimeEvaluator) {
+      try {
+        key = permissionKey(permissionRequest);
+      } catch (error) {
+        permissionError = new authorization_remote.AuthorizationRequestValidationError(error);
+        key = "invalid-remote-permission";
+      }
+    }
+    const permissionRef = React.useRef(permissionRequest);
+    permissionRef.current = permissionRequest;
+    const [resolved, setResolved] = React.useState(null);
+    React.useEffect(() => {
+      if (!runtimeEvaluator || permissionError || !contextProvider || contextProvider !== clientAuth || identityPending || contextError) {
+        return;
+      }
+      let cancelled = false;
+      void (async () => {
+        try {
+          const can = await runtimeEvaluator.evaluate({
+            identity,
+            permission: permissionRef.current
+          });
+          if (typeof can !== "boolean") {
+            throw new TypeError(
+              "Authorization evaluators must return a boolean."
+            );
+          }
+          if (!cancelled) {
+            setResolved({
+              can,
+              forIdentity: identity,
+              forPermission: key
+            });
+          }
+        } catch (error) {
+          if (!cancelled) {
+            setResolved({
+              can: false,
+              forIdentity: identity,
+              forPermission: key,
+              error: toError(error)
+            });
+          }
+        }
+      })();
+      return () => {
+        cancelled = true;
+      };
+    }, [contextError, contextProvider, identity, identityPending, key]);
+    if (!context || context.provider !== clientAuth) {
+      throw new Error(
+        "This bound useCan hook must be used with its createClientAuth instance on StackProvider."
+      );
+    }
+    if (context.isPending) return { can: false, isPending: true };
+    if (context.error) {
+      return { can: false, isPending: false, error: context.error };
+    }
+    if (permissionError) {
+      return { can: false, isPending: false, error: permissionError };
+    }
+    if (runtimeAuthorization) {
+      try {
+        return {
+          can: runtimeAuthorization.can(permissionRequest, context.identity),
+          isPending: false
+        };
+      } catch (error) {
+        return { can: false, isPending: false, error: toError(error) };
+      }
+    }
+    if (!resolved || resolved.forIdentity !== identity || resolved.forPermission !== key) {
+      return { can: false, isPending: true };
+    }
+    return {
+      can: resolved.can,
+      isPending: false,
+      ...resolved.error ? { error: resolved.error } : {}
+    };
+  };
+  const CanAccessRuntime = ({
+    permission: permissionRequest,
+    fallback = null,
+    loading = null,
+    children
+  }) => {
+    const state = useCanRuntime(permissionRequest);
+    if (state.error) throw state.error;
+    if (state.isPending) return loading;
+    return state.can ? children : fallback;
+  };
+  clientAuth = {
+    mode: "one-rule",
+    contract: contractValue,
+    ...config.authorization ? { authorization: config.authorization } : {},
+    async getIdentity() {
+      const identity = await config.getIdentity();
+      return contract.parseIdentity(identity);
+    },
+    ...config.loginPath ? { loginPath: config.loginPath } : {},
+    useIdentity,
+    useCan: useCanRuntime,
+    usePermission: useCanRuntime,
+    CanAccess: CanAccessRuntime
+  };
+  return clientAuth;
+}
+
+exports.createClientAuth = createClientAuth;

package/dist/authorization/client.d.cts

@@ -0,0 +1,70 @@
+import { ReactNode } from 'react';
+import { AnyAuthorization, AuthorizationIdentity, AuthorizationPermissionRequest, AnyAuthorizationContract, AuthorizationIdentityInput, AuthorizationContractIdentityInput, AuthorizationContractIdentity, AuthorizationContractPermissionRequest } from './index.cjs';
+import { AuthorizationEvaluatorFor } from './remote.cjs';
+import { S as StackClientAuth } from '../shared/stack.BYMentwB.cjs';
+import { M as MaybePromise } from '../shared/stack.CKXzdGiJ.cjs';
+import 'zod';
+
+/** Result returned by a bound browser permission check. */
+interface AuthorizationCanState {
+    can: boolean;
+    isPending: boolean;
+    error?: Error;
+}
+/** Validated identity state returned by the bound browser identity hook. */
+interface AuthorizationIdentityState<TIdentity> {
+    identity: TIdentity | null;
+    isPending: boolean;
+    error?: Error;
+    refetch: () => Promise<void>;
+}
+/** Browser identity adapter and hooks bound to synchronous local rules. */
+interface ClientAuth<TAuthorization extends AnyAuthorization> extends StackClientAuth {
+    readonly mode: "one-rule";
+    readonly authorization: TAuthorization;
+    readonly contract: TAuthorization["contract"];
+    getIdentity: () => Promise<AuthorizationIdentity<TAuthorization> | null>;
+    useIdentity: () => AuthorizationIdentityState<AuthorizationIdentity<TAuthorization>>;
+    useCan: (permission: AuthorizationPermissionRequest<TAuthorization>) => AuthorizationCanState;
+    /** Generic runtime hook used by descriptor-aware built-in plugin UI. */
+    usePermission: (permission: unknown) => AuthorizationCanState;
+    CanAccess: (props: {
+        permission: AuthorizationPermissionRequest<TAuthorization>;
+        fallback?: ReactNode;
+        loading?: ReactNode;
+        children?: ReactNode;
+    }) => ReactNode;
+}
+/** Browser identity adapter and hooks bound to an evaluator such as remote auth. */
+interface EvaluatedClientAuth<TIdentity extends {
+    id: string;
+}, TPermission, TContract extends AnyAuthorizationContract = AnyAuthorizationContract> extends StackClientAuth {
+    readonly mode: "one-rule";
+    readonly contract: TContract;
+    getIdentity: () => Promise<TIdentity | null>;
+    useIdentity: () => AuthorizationIdentityState<TIdentity>;
+    useCan: (permission: TPermission) => AuthorizationCanState;
+    /** Generic runtime hook used by descriptor-aware built-in plugin UI. */
+    usePermission: (permission: unknown) => AuthorizationCanState;
+    CanAccess: (props: {
+        permission: TPermission;
+        fallback?: ReactNode;
+        loading?: ReactNode;
+        children?: ReactNode;
+    }) => ReactNode;
+}
+declare function createClientAuth<TAuthorization extends AnyAuthorization>(config: {
+    authorization: TAuthorization;
+    evaluator?: never;
+    getIdentity: () => MaybePromise<AuthorizationIdentityInput<TAuthorization> | null>;
+    loginPath?: string;
+}): ClientAuth<TAuthorization>;
+declare function createClientAuth<TContract extends AnyAuthorizationContract>(config: {
+    authorization?: never;
+    evaluator: AuthorizationEvaluatorFor<TContract>;
+    getIdentity: () => MaybePromise<AuthorizationContractIdentityInput<TContract> | null>;
+    loginPath?: string;
+}): EvaluatedClientAuth<AuthorizationContractIdentity<TContract>, AuthorizationContractPermissionRequest<TContract>, TContract>;
+
+export { createClientAuth };
+export type { AuthorizationCanState, AuthorizationIdentityState, ClientAuth, EvaluatedClientAuth };

package/dist/authorization/client.d.mts

@@ -0,0 +1,70 @@
+import { ReactNode } from 'react';
+import { AnyAuthorization, AuthorizationIdentity, AuthorizationPermissionRequest, AnyAuthorizationContract, AuthorizationIdentityInput, AuthorizationContractIdentityInput, AuthorizationContractIdentity, AuthorizationContractPermissionRequest } from './index.mjs';
+import { AuthorizationEvaluatorFor } from './remote.mjs';
+import { S as StackClientAuth } from '../shared/stack.BYMentwB.mjs';
+import { M as MaybePromise } from '../shared/stack.CKXzdGiJ.mjs';
+import 'zod';
+
+/** Result returned by a bound browser permission check. */
+interface AuthorizationCanState {
+    can: boolean;
+    isPending: boolean;
+    error?: Error;
+}
+/** Validated identity state returned by the bound browser identity hook. */
+interface AuthorizationIdentityState<TIdentity> {
+    identity: TIdentity | null;
+    isPending: boolean;
+    error?: Error;
+    refetch: () => Promise<void>;
+}
+/** Browser identity adapter and hooks bound to synchronous local rules. */
+interface ClientAuth<TAuthorization extends AnyAuthorization> extends StackClientAuth {
+    readonly mode: "one-rule";
+    readonly authorization: TAuthorization;
+    readonly contract: TAuthorization["contract"];
+    getIdentity: () => Promise<AuthorizationIdentity<TAuthorization> | null>;
+    useIdentity: () => AuthorizationIdentityState<AuthorizationIdentity<TAuthorization>>;
+    useCan: (permission: AuthorizationPermissionRequest<TAuthorization>) => AuthorizationCanState;
+    /** Generic runtime hook used by descriptor-aware built-in plugin UI. */
+    usePermission: (permission: unknown) => AuthorizationCanState;
+    CanAccess: (props: {
+        permission: AuthorizationPermissionRequest<TAuthorization>;
+        fallback?: ReactNode;
+        loading?: ReactNode;
+        children?: ReactNode;
+    }) => ReactNode;
+}
+/** Browser identity adapter and hooks bound to an evaluator such as remote auth. */
+interface EvaluatedClientAuth<TIdentity extends {
+    id: string;
+}, TPermission, TContract extends AnyAuthorizationContract = AnyAuthorizationContract> extends StackClientAuth {
+    readonly mode: "one-rule";
+    readonly contract: TContract;
+    getIdentity: () => Promise<TIdentity | null>;
+    useIdentity: () => AuthorizationIdentityState<TIdentity>;
+    useCan: (permission: TPermission) => AuthorizationCanState;
+    /** Generic runtime hook used by descriptor-aware built-in plugin UI. */
+    usePermission: (permission: unknown) => AuthorizationCanState;
+    CanAccess: (props: {
+        permission: TPermission;
+        fallback?: ReactNode;
+        loading?: ReactNode;
+        children?: ReactNode;
+    }) => ReactNode;
+}
+declare function createClientAuth<TAuthorization extends AnyAuthorization>(config: {
+    authorization: TAuthorization;
+    evaluator?: never;
+    getIdentity: () => MaybePromise<AuthorizationIdentityInput<TAuthorization> | null>;
+    loginPath?: string;
+}): ClientAuth<TAuthorization>;
+declare function createClientAuth<TContract extends AnyAuthorizationContract>(config: {
+    authorization?: never;
+    evaluator: AuthorizationEvaluatorFor<TContract>;
+    getIdentity: () => MaybePromise<AuthorizationContractIdentityInput<TContract> | null>;
+    loginPath?: string;
+}): EvaluatedClientAuth<AuthorizationContractIdentity<TContract>, AuthorizationContractPermissionRequest<TContract>, TContract>;
+
+export { createClientAuth };
+export type { AuthorizationCanState, AuthorizationIdentityState, ClientAuth, EvaluatedClientAuth };

package/dist/authorization/client.d.ts

@@ -0,0 +1,70 @@
+import { ReactNode } from 'react';
+import { AnyAuthorization, AuthorizationIdentity, AuthorizationPermissionRequest, AnyAuthorizationContract, AuthorizationIdentityInput, AuthorizationContractIdentityInput, AuthorizationContractIdentity, AuthorizationContractPermissionRequest } from './index.js';
+import { AuthorizationEvaluatorFor } from './remote.js';
+import { S as StackClientAuth } from '../shared/stack.BYMentwB.js';
+import { M as MaybePromise } from '../shared/stack.CKXzdGiJ.js';
+import 'zod';
+
+/** Result returned by a bound browser permission check. */
+interface AuthorizationCanState {
+    can: boolean;
+    isPending: boolean;
+    error?: Error;
+}
+/** Validated identity state returned by the bound browser identity hook. */
+interface AuthorizationIdentityState<TIdentity> {
+    identity: TIdentity | null;
+    isPending: boolean;
+    error?: Error;
+    refetch: () => Promise<void>;
+}
+/** Browser identity adapter and hooks bound to synchronous local rules. */
+interface ClientAuth<TAuthorization extends AnyAuthorization> extends StackClientAuth {
+    readonly mode: "one-rule";
+    readonly authorization: TAuthorization;
+    readonly contract: TAuthorization["contract"];
+    getIdentity: () => Promise<AuthorizationIdentity<TAuthorization> | null>;
+    useIdentity: () => AuthorizationIdentityState<AuthorizationIdentity<TAuthorization>>;
+    useCan: (permission: AuthorizationPermissionRequest<TAuthorization>) => AuthorizationCanState;
+    /** Generic runtime hook used by descriptor-aware built-in plugin UI. */
+    usePermission: (permission: unknown) => AuthorizationCanState;
+    CanAccess: (props: {
+        permission: AuthorizationPermissionRequest<TAuthorization>;
+        fallback?: ReactNode;
+        loading?: ReactNode;
+        children?: ReactNode;
+    }) => ReactNode;
+}
+/** Browser identity adapter and hooks bound to an evaluator such as remote auth. */
+interface EvaluatedClientAuth<TIdentity extends {
+    id: string;
+}, TPermission, TContract extends AnyAuthorizationContract = AnyAuthorizationContract> extends StackClientAuth {
+    readonly mode: "one-rule";
+    readonly contract: TContract;
+    getIdentity: () => Promise<TIdentity | null>;
+    useIdentity: () => AuthorizationIdentityState<TIdentity>;
+    useCan: (permission: TPermission) => AuthorizationCanState;
+    /** Generic runtime hook used by descriptor-aware built-in plugin UI. */
+    usePermission: (permission: unknown) => AuthorizationCanState;
+    CanAccess: (props: {
+        permission: TPermission;
+        fallback?: ReactNode;
+        loading?: ReactNode;
+        children?: ReactNode;
+    }) => ReactNode;
+}
+declare function createClientAuth<TAuthorization extends AnyAuthorization>(config: {
+    authorization: TAuthorization;
+    evaluator?: never;
+    getIdentity: () => MaybePromise<AuthorizationIdentityInput<TAuthorization> | null>;
+    loginPath?: string;
+}): ClientAuth<TAuthorization>;
+declare function createClientAuth<TContract extends AnyAuthorizationContract>(config: {
+    authorization?: never;
+    evaluator: AuthorizationEvaluatorFor<TContract>;
+    getIdentity: () => MaybePromise<AuthorizationContractIdentityInput<TContract> | null>;
+    loginPath?: string;
+}): EvaluatedClientAuth<AuthorizationContractIdentity<TContract>, AuthorizationContractPermissionRequest<TContract>, TContract>;
+
+export { createClientAuth };
+export type { AuthorizationCanState, AuthorizationIdentityState, ClientAuth, EvaluatedClientAuth };