@decohere/http 0.0.1-dev.126 → 0.0.1-dev.5

package/es6/src/auth/token-service.js

@@ -1,141 +0,0 @@
-import { createRemoteJWKSet, importJWK, importSPKI, jwtVerify, SignJWT } from "jose";
-import { UnauthorizedError } from "../routing/anvil.types.js";
-import { createPrincipalFromPayload } from "./ability.js";
-import { assertDevStaticAllowed, assertNonEmptyAudience, isDevStaticConfig, isDiscoveryConfig, isJwksConfig, isPublicKeyConfig, isSecretConfig } from "./auth.types.js";
-import { assertSafeOutboundUrl } from "./safe-outbound-url.js";
-export class TokenService {
-    config;
-    principalMapper;
-    /** Lazily resolved JWKS set when using OIDC discovery. */ discoveryJwks;
-    discoveryIssuer;
-    /** Remote key set for `jwksUrl` mode, created once so jose can cache the keys. */ configuredJwks;
-    constructor(config, principalMapper){
-        if (isDevStaticConfig(config)) {
-            assertDevStaticAllowed();
-        } else {
-            assertNonEmptyAudience(config.audience);
-        }
-        this.config = config;
-        this.principalMapper = principalMapper;
-    }
-    async verifyRequest(request) {
-        const authHeader = request.headers.authorization;
-        if (!authHeader) {
-            throw new UnauthorizedError("Missing Authorization header");
-        }
-        const spaceIdx = authHeader.indexOf(" ");
-        if (spaceIdx === -1) {
-            throw new UnauthorizedError("Malformed Authorization header");
-        }
-        const scheme = authHeader.slice(0, spaceIdx);
-        if (scheme !== "Bearer") {
-            throw new UnauthorizedError(`Unsupported authorization scheme: ${scheme}`);
-        }
-        const credentials = authHeader.slice(spaceIdx + 1);
-        return this.verify(credentials);
-    }
-    async verify(credentials) {
-        if (isDevStaticConfig(this.config)) {
-            return this.config.devStatic;
-        }
-        try {
-            const { key, issuer, audience } = await this.resolveVerificationContext();
-            // jose's overloads don't accept Key | JWKS-getter as a union; runtime does.
-            const { payload } = await jwtVerify(credentials, key, {
-                issuer,
-                audience
-            });
-            return this.mapPrincipal(payload);
-        } catch (err) {
-            throw new UnauthorizedError(err instanceof Error ? err.message : "Token verification failed");
-        }
-    }
-    /**
-	 * Resolve how to verify tokens for the configured strategy:
-	 * - OIDC discovery → fetch JWKS + issuer from `/.well-known/openid-configuration`
-	 * - explicit JWKS URL → remote key set + configured issuer/audience
-	 * - public key / shared secret → static key material + configured issuer/audience
-	 */ async resolveVerificationContext() {
-        if (isDiscoveryConfig(this.config)) {
-            const { jwks, issuer } = await this.resolveOidcDiscovery();
-            return {
-                key: jwks,
-                issuer,
-                audience: this.config.audience
-            };
-        }
-        if (isJwksConfig(this.config)) {
-            this.configuredJwks ??= createRemoteJWKSet(await assertSafeOutboundUrl(this.config.jwksUrl, "jwksUrl"));
-            return {
-                key: this.configuredJwks,
-                issuer: this.config.issuer,
-                audience: this.config.audience
-            };
-        }
-        return {
-            key: await this.getStaticKey(),
-            issuer: this.config.issuer,
-            audience: this.config.audience
-        };
-    }
-    async resolveOidcDiscovery() {
-        if (this.discoveryJwks && this.discoveryIssuer) {
-            return {
-                jwks: this.discoveryJwks,
-                issuer: this.discoveryIssuer
-            };
-        }
-        const { discoveryUrl } = this.config;
-        await assertSafeOutboundUrl(discoveryUrl, "discoveryUrl");
-        const resp = await fetch(`${discoveryUrl.replace(/\/$/, "")}/.well-known/openid-configuration`, {
-            redirect: "error"
-        });
-        if (!resp.ok) {
-            throw new Error(`OIDC discovery failed for ${discoveryUrl}: HTTP ${resp.status}`);
-        }
-        const doc = await resp.json();
-        if (typeof doc.jwks_uri !== "string" || doc.jwks_uri.length === 0) {
-            throw new Error(`OIDC discovery for ${discoveryUrl} did not return jwks_uri`);
-        }
-        const jwksUrl = await assertSafeOutboundUrl(doc.jwks_uri, "jwks_uri");
-        this.discoveryIssuer = doc.issuer;
-        this.discoveryJwks = createRemoteJWKSet(jwksUrl);
-        return {
-            jwks: this.discoveryJwks,
-            issuer: this.discoveryIssuer
-        };
-    }
-    /**
-	 * Sign a payload and return a JWT string.
-	 * Only available when configured with a SecretConfig (HS256).
-	 * For RS256/ES256 issuance, the caller is responsible for key management.
-	 */ async sign(payload, expiresIn = "1h") {
-        if (!isSecretConfig(this.config)) {
-            throw new Error("TokenService.sign() requires SecretConfig (shared secret / HS256)");
-        }
-        const key = new TextEncoder().encode(this.config.secret);
-        return new SignJWT(payload).setProtectedHeader({
-            alg: "HS256"
-        }).setIssuedAt().setIssuer(this.config.issuer ?? "").setAudience(this.config.audience ?? "").setExpirationTime(expiresIn).sign(key);
-    }
-    async getStaticKey() {
-        if (isPublicKeyConfig(this.config)) {
-            const cfg = this.config;
-            const trimmed = cfg.publicKey.trim();
-            if (trimmed.startsWith("{")) {
-                const jwk = JSON.parse(trimmed);
-                return importJWK(jwk);
-            }
-            return importSPKI(trimmed, cfg.algorithms?.[0] ?? "RS256");
-        }
-        if (isSecretConfig(this.config)) {
-            const enc = new TextEncoder().encode(this.config.secret);
-            return enc;
-        }
-        throw new Error("Invalid TokenService configuration");
-    }
-    mapPrincipal(payload) {
-        if (this.principalMapper) return this.principalMapper(payload);
-        return createPrincipalFromPayload(payload);
-    }
-}

package/es6/src/builder/builder.js

@@ -1,85 +0,0 @@
-import { ServiceContainerBuilder } from "@decohere/crucible";
-import { ConfigurationServiceToken } from "@decohere/core/configuration";
-import { scribe } from "@decohere/scribe";
-import { App } from "../app/app.js";
-import { HostedServiceHostToken } from "../const.js";
-import { HostedServiceHost } from "../hosting/hosted-service-host.js";
-export class Builder {
-    static create(options) {
-        return new Builder(options);
-    }
-    containerBuilder;
-    applicationName;
-    logger = scribe.logger("name");
-    userServices = [];
-    preBuildSteps = [];
-    postBuildSteps = [];
-    hostedServices = new HostedServiceHost();
-    constructor(options){
-        this.containerBuilder = options?.containerBuilder ?? new ServiceContainerBuilder();
-        this.applicationName = options?.applicationName;
-    }
-    withServices(userServices) {
-        this.userServices.push(userServices);
-        return this;
-    }
-    /**
-	 * Run {@link HostedService}s for the life of the app: started in this order before the HTTP
-	 * server listens, stopped in reverse when the app stops (including SIGTERM and Flux reboots).
-	 * Each is registered as a singleton, so other services can inject it by its class.
-	 */ withHostedService(...types) {
-        for (const type of types)this.containerBuilder.registerSingleton(type);
-        this.hostedServices.add(...types);
-        return this;
-    }
-    registerPreBuildStep(step) {
-        this.preBuildSteps.push(step);
-    }
-    registerPostBuildStep(step) {
-        this.postBuildSteps.push(step);
-    }
-    async buildAndStart(type) {
-        const app = await this.build(type);
-        await app.start();
-        this.logger.info("App started...");
-        return app;
-    }
-    async build(type) {
-        this.logger.info("Building App...");
-        this.configureUserServices();
-        this.configureApp(type);
-        await this.runPreBuildSteps(this.containerBuilder);
-        const container = this.containerBuilder.build();
-        await this.runPostBuildSteps(container);
-        const app = this.resolveApp(container, type);
-        return app;
-    }
-    configureUserServices() {
-        for (const userService of this.userServices){
-            userService(this.containerBuilder);
-        }
-    }
-    async runPreBuildSteps(containerBuilder) {
-        if (this.preBuildSteps.length === 0) {
-            return;
-        }
-        const container = containerBuilder.build();
-        const config = container.resolve(ConfigurationServiceToken);
-        for (const step of this.preBuildSteps){
-            await step(config, containerBuilder);
-        }
-    }
-    async runPostBuildSteps(container) {
-        for (const step of this.postBuildSteps){
-            await step(container);
-        }
-    }
-    configureApp(type) {
-        this.containerBuilder.registerSingleton(HostedServiceHostToken, this.hostedServices);
-        this.containerBuilder.registerSingleton(type ?? App);
-    }
-    resolveApp(container, type) {
-        const app = type ? container.resolve(type) : container.resolve(App);
-        return app;
-    }
-}

package/es6/src/builder/index.js

@@ -1 +0,0 @@
-export * from "./builder.js";

package/es6/src/health/health.controller.js

@@ -1,65 +0,0 @@
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { inject, injectable } from "@decohere/crucible/decorators";
-import { ReadinessServiceToken } from "../const.js";
-import { HttpError } from "../routing/anvil.types.js";
-import { AllowAnonymous, Controller, Get } from "../routing/index.js";
-import { ReadinessService } from "./readiness.service.js";
-export class HealthController {
-    readiness;
-    constructor(readiness){
-        this.readiness = readiness;
-    }
-    health() {
-        return {
-            status: "ok"
-        };
-    }
-    async ready() {
-        const result = await this.readiness.checkAll();
-        if (!result.ok) {
-            throw new HttpError("Not ready", 503);
-        }
-        return {
-            status: "ok"
-        };
-    }
-}
-_ts_decorate([
-    AllowAnonymous(),
-    Get("/health"),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", []),
-    _ts_metadata("design:returntype", void 0)
-], HealthController.prototype, "health", null);
-_ts_decorate([
-    AllowAnonymous(),
-    Get("/ready"),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", []),
-    _ts_metadata("design:returntype", Promise)
-], HealthController.prototype, "ready", null);
-HealthController = _ts_decorate([
-    Controller({
-        prefix: "/",
-        globalPrefix: false
-    }),
-    injectable(),
-    _ts_param(0, inject(ReadinessServiceToken)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof ReadinessService === "undefined" ? Object : ReadinessService
-    ])
-], HealthController);

package/es6/src/health/health.extensions.js

@@ -1,40 +0,0 @@
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-import { extension } from "@decohere/core/extensibility";
-import { Builder } from "../builder/builder.js";
-import { ReadinessCheckToken, ReadinessServiceToken } from "../const.js";
-import "../http/http.extensions.js";
-import { getOrCreateHttpOptions } from "../http/http.options.store.js";
-import { HealthController } from "./health.controller.js";
-import { ReadinessService } from "./readiness.service.js";
-export class BuilderExtensions {
-    static withHealth(builder, options) {
-        builder.withServices((containerBuilder)=>{
-            containerBuilder.registerSingleton(ReadinessServiceToken, ReadinessService);
-            for (const check of options?.checks ?? []){
-                containerBuilder.registerSingleton(ReadinessCheckToken, check);
-            }
-        });
-        if (options?.underGlobalPrefix === true) {
-            getOrCreateHttpOptions(builder).underGlobalPrefix.add(HealthController);
-        }
-        builder.withControllers(HealthController);
-        return builder;
-    }
-}
-_ts_decorate([
-    extension(Builder),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof Builder === "undefined" ? Object : Builder,
-        typeof WithHealthOptions === "undefined" ? Object : WithHealthOptions
-    ]),
-    _ts_metadata("design:returntype", void 0)
-], BuilderExtensions, "withHealth", null);

package/es6/src/health/index.js

@@ -1,4 +0,0 @@
-export * from "./health.controller.js";
-export * from "./health.extensions.js";
-export * from "./readiness.service.js";
-export * from "./readiness.types.js";

package/es6/src/health/readiness.service.js

@@ -1,57 +0,0 @@
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { inject, injectable } from "@decohere/crucible/decorators";
-import { HostedServiceHostToken, ReadinessCheckToken } from "../const.js";
-export class ReadinessService {
-    hostedServices;
-    checks;
-    constructor(checks = [], hostedServices){
-        this.hostedServices = hostedServices;
-        this.checks = checks;
-    }
-    /** Registered checks, then each started hosted service that has a `check()` (still warming up). */ async checkAll() {
-        const failures = [];
-        const probes = [
-            ...this.checks,
-            ...this.hostedServices?.readinessChecks() ?? []
-        ];
-        for (const probe of probes){
-            try {
-                await probe.check();
-            } catch  {
-                failures.push(probe.name);
-            }
-        }
-        if (failures.length > 0) {
-            return {
-                ok: false,
-                failures
-            };
-        }
-        return {
-            ok: true
-        };
-    }
-}
-ReadinessService = _ts_decorate([
-    injectable(),
-    _ts_param(0, inject(ReadinessCheckToken)),
-    _ts_param(1, inject(HostedServiceHostToken)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        Array,
-        typeof HostedServiceHost === "undefined" ? Object : HostedServiceHost
-    ])
-], ReadinessService);

package/es6/src/health/readiness.types.js

@@ -1,4 +0,0 @@
-/**
- * A dependency probe run by `GET /ready`.
- * Register instances under {@link ReadinessCheckToken} (multi-inject).
- */ export { };

package/es6/src/hosting/hosted-service-host.js

@@ -1,81 +0,0 @@
-import { scribe } from "@decohere/scribe";
-/**
- * Starts and stops the app's {@link HostedService}s. One per app; `Builder.withHostedService`
- * adds the types and `App` drives it.
- */ export class HostedServiceHost {
-    logger = scribe.logger(HostedServiceHost.name);
-    types = [];
-    controller = new AbortController();
-    /** In start order; stopped in reverse. */ started = [];
-    starting;
-    stopping;
-    add(...types) {
-        this.types.push(...types);
-    }
-    get isEmpty() {
-        return this.types.length === 0;
-    }
-    /**
-	 * Start every service in registration order. If one throws, the ones already started are
-	 * stopped and the error is rethrown. Stops launching more once {@link stop} has begun.
-	 */ start(container) {
-        this.starting ??= this.startAll(container);
-        return this.starting;
-    }
-    /** Abort the services' signal: background work should wind down. {@link stop} does this too. */ abort() {
-        this.controller.abort();
-    }
-    /**
-	 * Abort the signal, wait for a start still in progress, then stop the started services in
-	 * reverse order. Every `stop()` runs even if one throws; the failures are rethrown after.
-	 */ stop() {
-        this.stopping ??= this.stopAll();
-        return this.stopping;
-    }
-    /** The started services that report readiness, for `GET /ready`. */ readinessChecks() {
-        return this.started.filter((service)=>typeof service.check === "function").map((service)=>({
-                name: service.constructor.name,
-                check: ()=>service.check?.() ?? Promise.resolve()
-            }));
-    }
-    async startAll(container) {
-        const { signal } = this.controller;
-        for (const type of this.types){
-            if (signal.aborted) return;
-            const service = container.resolve(type);
-            try {
-                await service.start(signal);
-            } catch (error) {
-                this.logger.error(`Hosted service ${type.name} failed to start`, error);
-                // Not stop(): it waits for this start to settle.
-                this.controller.abort();
-                await this.stopStarted().catch(()=>{});
-                throw error;
-            }
-            this.started.push(service);
-            this.logger.debug(`Hosted service ${type.name} started`);
-        }
-    }
-    async stopAll() {
-        this.controller.abort();
-        await Promise.allSettled([
-            this.starting
-        ]);
-        await this.stopStarted();
-    }
-    /** Stop what is started, newest first. Takes each service off the list, so it runs once. */ async stopStarted() {
-        const failures = [];
-        for(let service = this.started.pop(); service != null; service = this.started.pop()){
-            try {
-                await service.stop?.();
-            } catch (error) {
-                this.logger.error(`Hosted service ${service.constructor.name} failed to stop`, error);
-                failures.push(error);
-            }
-        }
-        if (failures.length === 1) throw failures[0];
-        if (failures.length > 1) {
-            throw new AggregateError(failures, `${failures.length} hosted services failed to stop`);
-        }
-    }
-}

package/es6/src/hosting/hosted-service.js

@@ -1,8 +0,0 @@
-/**
- * Work that runs for the life of the app outside a request: a feed, a poller, a queue consumer.
- * Register it with `builder.withHostedService(Type)`; it is a singleton, so other services can
- * inject it by its class.
- *
- * The app starts hosted services in registration order before the HTTP server listens, and stops
- * them in reverse order when it stops (`app.dispose()`, SIGTERM or SIGINT, a Flux reboot).
- */ export { };

package/es6/src/hosting/index.js

@@ -1,2 +0,0 @@
-export * from "./hosted-service.js";
-export * from "./hosted-service-host.js";

package/es6/src/http/http.compression.js

@@ -1,9 +0,0 @@
-/**
- * Response compression (`builder.withCompression`). Provider-neutral options and defaults;
- * the HTTP provider hands them to its compression plugin and the plugin owns the policy
- * (which responses are compressed, `Vary`, `HEAD`, streams). See ADR 0008.
- */ /** A content coding the HTTP package can offer. */ /** Bodies smaller than this many bytes are sent as they are (not applied to streams, such as files). */ export const DEFAULT_COMPRESSION_THRESHOLD = 1024;
-/** The codings offered by default, in order of preference. `deflate` is left out on purpose. */ export const DEFAULT_COMPRESSION_ENCODINGS = [
-    "br",
-    "gzip"
-];