@effect-app/infra 4.0.0-beta.26 → 4.0.0-beta.260

package/src/arbs.ts

@@ -1,13 +1,15 @@
 // Do not import to frontend
 
 import { faker } from "@faker-js/faker"
-import { type S } from "effect-app"
 import { setFaker } from "effect-app/faker"
+import type * as S from "effect-app/Schema"
 import * as FastCheck from "effect/testing/FastCheck"
 import { Random } from "fast-check"
-import * as rand from "pure-rand"
+import { congruential32 } from "pure-rand/generator/congruential32"
 
-const rnd = new Random(rand.congruential32(5))
+const seed = 5
+const rng = congruential32(seed)
+const rnd = new Random(rng)
 
 setFaker(faker)
 

package/src/{adapters/cosmos-client.ts → cosmos-client.ts}

@@ -1,16 +1,18 @@
 import { CosmosClient as ComosClient_ } from "@azure/cosmos"
-import { Effect, Layer, ServiceMap } from "effect-app"
+import * as Context from "effect-app/Context"
+import * as Effect from "effect-app/Effect"
+import * as Layer from "effect-app/Layer"
 
 const withClient = (url: string) => Effect.sync(() => new ComosClient_(url))
 
 export const makeCosmosClient = (url: string, dbName: string) =>
   Effect.map(withClient(url), (x) => ({ db: x.database(dbName) }))
 
-export class CosmosClient extends ServiceMap.Service<CosmosClient, {
+export class CosmosClient extends Context.Service<CosmosClient, {
   readonly db: ReturnType<InstanceType<typeof ComosClient_>["database"]>
 }>()("@services/CosmosClient") {}
 
-export const db = CosmosClient.asEffect().pipe(Effect.map((_) => _.db))
+export const db = CosmosClient.pipe(Effect.map((_) => _.db))
 
 export const CosmosClientLayer = (cosmosUrl: string, dbName: string) =>
   Layer.effect(CosmosClient, makeCosmosClient(cosmosUrl, dbName))

package/src/errorReporter.ts

@@ -1,7 +1,9 @@
 import * as Sentry from "@sentry/node"
-import { Cause, Effect, type LogLevel } from "effect-app"
+import * as Effect from "effect-app/Effect"
+import { getRC } from "effect-app/setupRequest"
 import { dropUndefined, LogLevelToSentry } from "effect-app/utils"
-import { getRC } from "./api/setupRequest.js"
+import * as Cause from "effect/Cause"
+import type * as LogLevel from "effect/LogLevel"
 import { CauseException, tryToJson, tryToReport } from "./errors.js"
 import { InfraLogger } from "./logger.js"
 
@@ -13,47 +15,41 @@ const tryCauseException = <E>(cause: Cause.Cause<E>, name: string): CauseExcepti
   }
 }
 
-export function reportError(
-  name: string
-) {
-  return (
-    cause: Cause.Cause<unknown>,
-    extras?: Record<string, unknown>,
-    level: LogLevel.Severity = "Error"
-  ) =>
-    Effect
-      .gen(function*() {
-        if (Cause.hasInterruptsOnly(cause)) {
-          yield* InfraLogger.logDebug("Interrupted").pipe(Effect.annotateLogs("extras", JSON.stringify(extras ?? {})))
-          return
-        }
-        const error = tryCauseException(cause, name)
-
-        yield* reportSentry(error, extras, LogLevelToSentry(level))
-        yield* InfraLogger
-          .logWithLevel(level, "Reporting error", cause)
-          .pipe(
-            Effect.annotateLogs(dropUndefined({
-              extras,
-              error: tryToReport(error),
-              cause: tryToJson(cause),
-              __error_name__: name
-            }))
-          )
-          .pipe(
-            Effect.catchCause((cause) => InfraLogger.logWarning("Failed to log error", cause)),
-            Effect.catchCause(() => InfraLogger.logFatal("Failed to log error cause"))
-          )
+export function reportError(name: string) {
+  return Effect.fnUntraced(
+    function*(
+      cause: Cause.Cause<unknown>,
+      extras?: Record<string, unknown>,
+      level: LogLevel.Severity = "Error"
+    ) {
+      if (Cause.hasInterruptsOnly(cause)) {
+        yield* InfraLogger.logDebug("Interrupted").pipe(Effect.annotateLogs("extras", JSON.stringify(extras ?? {})))
+        return
+      }
+      const error = tryCauseException(cause, name)
 
-        return error
-      })
-      .pipe(
-        Effect.tapCause((cause) =>
-          InfraLogger.logError("Failed to report error", cause).pipe(
-            Effect.tapCause(() => InfraLogger.logFatal("Failed to log error cause"))
-          )
+      yield* reportSentry(error, extras, LogLevelToSentry(level))
+      yield* InfraLogger
+        .logWithLevel(level, "Reporting error", cause)
+        .pipe(
+          Effect.annotateLogs(dropUndefined({
+            extras,
+            error: tryToReport(error),
+            cause: tryToJson(cause),
+            __error_name__: name
+          })),
+          Effect.catchCause((cause) => InfraLogger.logWarning("Failed to log error", cause)),
+          Effect.catchCause(() => InfraLogger.logFatal("Failed to log error cause"))
         )
-      )
+
+      return error
+    },
+    (effect) =>
+      Effect.tapCause(effect, (cause) =>
+        InfraLogger.logError("Failed to report error", cause).pipe(
+          Effect.tapCause(() => InfraLogger.logFatal("Failed to log error cause"))
+        ))
+  )
 }
 
 function reportSentry(
@@ -66,45 +62,39 @@ function reportSentry(
     scope.setLevel(level)
     if (context) scope.setContext("context", { ...context })
     if (extras) scope.setContext("extras", extras)
-    scope.setContext("error", { data: tryToReport(error) })
-    scope.setContext("cause", { data: tryToJson(error.originalCause) })
+    const squashed = Cause.squash(error.originalCause)
+    scope.setContext("mainError", tryToJson(squashed))
+    scope.setContext("error", tryToReport(error))
+    scope.setContext("cause", tryToJson(error.originalCause))
     Sentry.captureException(error, scope)
   }))
 }
 
-export function logError<E>(
-  name: string
-) {
-  return (cause: Cause.Cause<E>, extras?: Record<string, unknown>) =>
-    Effect
-      .gen(function*() {
-        if (Cause.hasInterruptsOnly(cause)) {
-          yield* InfraLogger.logDebug("Interrupted").pipe(Effect.annotateLogs(dropUndefined({ extras })))
-          return
-        }
-        yield* InfraLogger
-          .logWarning("Logging error", cause)
-          .pipe(
-            Effect.annotateLogs(dropUndefined({
-              extras,
-              cause: tryToJson(cause),
-              __error_name__: name
-            }))
-          )
-      })
-      .pipe(
-        Effect.tapCause(() => InfraLogger.logFatal("Failed to log error cause"))
-      )
+export function logError<E>(name: string) {
+  return Effect.fnUntraced(
+    function*(cause: Cause.Cause<E>, extras?: Record<string, unknown>) {
+      if (Cause.hasInterruptsOnly(cause)) {
+        yield* InfraLogger.logDebug("Interrupted").pipe(Effect.annotateLogs(dropUndefined({ extras })))
+        return
+      }
+      yield* InfraLogger
+        .logWarning("Logging error", cause)
+        .pipe(Effect.annotateLogs(dropUndefined({
+          extras,
+          cause: tryToJson(cause),
+          __error_name__: name
+        })))
+    },
+    (effect) => Effect.tapCause(effect, () => InfraLogger.logFatal("Failed to log error cause"))
+  )
 }
 
-export function reportMessage(message: string, extras?: Record<string, unknown>) {
-  return Effect.gen(function*() {
-    const context = yield* getRC
-    const scope = new Sentry.Scope()
-    if (context) scope.setContext("context", { ...context })
-    if (extras) scope.setContext("extras", extras)
-    Sentry.captureMessage(message, scope)
+export const reportMessage = Effect.fnUntraced(function*(message: string, extras?: Record<string, unknown>) {
+  const context = yield* getRC
+  const scope = new Sentry.Scope()
+  if (context) scope.setContext("context", { ...context })
+  if (extras) scope.setContext("extras", extras)
+  Sentry.captureMessage(message, scope)
 
-    console.warn(message, extras)
-  })
-}
+  console.warn(message, extras)
+})

package/src/fileUtil.ts

@@ -1,5 +1,5 @@
 import crypto from "crypto"
-import { Effect } from "effect-app"
+import * as Effect from "effect-app/Effect"
 import type { Abortable } from "events"
 import type { Mode, ObjectEncodingOptions, OpenMode } from "fs"
 import fs from "fs/promises"

package/src/index.ts

@@ -1 +1,2 @@
-export * as Model from "./Model.js"
+export * from "./logger.js"
+export * from "./Store/index.js"

package/src/{api/internal → internal}/RequestContextMiddleware.ts

@@ -1,8 +1,10 @@
-import { Effect } from "effect-app"
+import * as Effect from "effect-app/Effect"
 import { HttpMiddleware, HttpServerRequest, HttpServerResponse } from "effect-app/http"
+import * as Layer from "effect-app/Layer"
+import { Locale, LocaleRef, RequestContext, spanAttributes } from "effect-app/RequestContext"
 import { NonEmptyString255 } from "effect-app/Schema"
-import { Locale, RequestContext } from "../../RequestContext.js"
-import { setupRequestContext } from "../setupRequest.js"
+import { provideOnRequestScope } from "effect-app/setupRequest"
+import { ContextMapContainer, storeId } from "effect-app/Store"
 
 export const RequestContextMiddleware = (defaultLocale: Locale = "en") =>
   HttpMiddleware.make((app) =>
@@ -21,18 +23,33 @@ export const RequestContextMiddleware = (defaultLocale: Locale = "en") =>
       const namespace = NonEmptyString255((ns && (Array.isArray(ns) ? ns[0] : ns)) || "primary")
       const deviceId = req.headers["x-fe-device-id"]
 
-      const requestContext = new RequestContext({
+      const requestContext = RequestContext.make({
         span: {
           traceId: currentSpan.traceId,
           spanId: currentSpan.spanId,
           sampled: currentSpan.sampled
         },
-        name: NonEmptyString255(req.originalUrl), // set more detailed elsewhere
+        name: NonEmptyString255(`HTTP ${req.method} ${req.originalUrl.split("?")[0]}`), // set more detailed elsewhere
         locale,
         namespace,
         sourceId: deviceId ? NonEmptyString255(deviceId) : undefined
       })
-      const res = yield* setupRequestContext(app, requestContext)
+      yield* Effect.annotateCurrentSpan(spanAttributes(requestContext))
+      const layer = Layer.mergeAll(
+        ContextMapContainer.layer,
+        Layer.succeed(LocaleRef, requestContext.locale),
+        Layer.succeed(storeId, requestContext.namespace)
+      )
+      // Bind layer to the request scope so ContextMap's finalizer (clear()) runs only
+      // after the response body is fully drained — not when `app` returns its
+      // HttpServerResponse value. Streaming RPC responses keep producing chunks (and
+      // using ContextMap-cached etags) after `app` returns; a sub-scope from
+      // `Effect.provide(layer)` would close too early and wipe etags mid-stream,
+      // causing spurious OptimisticConcurrencyException on later writes.
+      const res = yield* app.pipe(
+        Effect.withLogSpan(requestContext.name),
+        provideOnRequestScope(layer)
+      )
 
       // TODO: how to set also on errors?
       return HttpServerResponse.setHeaders(res, {

package/src/internal/auth.ts

@@ -0,0 +1,272 @@
+import * as Effect from "effect-app/Effect"
+import { HttpHeaders, HttpMiddleware, HttpServerRequest, HttpServerResponse } from "effect-app/http"
+import * as Option from "effect-app/Option"
+import * as Data from "effect/Data"
+import { createRemoteJWKSet, jwtVerify } from "jose"
+
+const getHeaders = (error: string, description: string, scopes?: ReadonlyArray<string>) => ({
+  "WWW-Authenticate": `Bearer realm="api", error="${error}", error_description="${description.replace(/"/g, "'")}"${
+    scopes ? `, scope="${scopes.join(" ")}"` : ""
+  }`
+})
+
+export class UnauthorizedError extends Error {
+  readonly status: number = 401
+  readonly statusCode: number = 401
+  headers = { "WWW-Authenticate": "Bearer realm=\"api\"" }
+
+  constructor(message = "Unauthorized") {
+    super(message)
+    this.name = this.constructor.name
+  }
+}
+
+export class InvalidRequestError extends UnauthorizedError {
+  readonly code: string
+  override readonly status = 400
+  override readonly statusCode = 400
+
+  constructor(message = "Invalid Request", useErrorCode = true) {
+    super(message)
+    this.code = useErrorCode ? "invalid_request" : ""
+    if (useErrorCode) {
+      this.headers = getHeaders(this.code, this.message)
+    }
+  }
+}
+
+export class InvalidTokenError extends UnauthorizedError {
+  readonly code = "invalid_token"
+
+  constructor(message = "Invalid Token") {
+    super(message)
+    this.headers = getHeaders(this.code, this.message)
+  }
+}
+
+export class InsufficientScopeError extends UnauthorizedError {
+  readonly code = "insufficient_scope"
+  override readonly status = 403
+  override readonly statusCode = 403
+
+  constructor(scopes?: ReadonlyArray<string>, message = "Insufficient Scope") {
+    super(message)
+    this.headers = getHeaders(this.code, this.message, scopes)
+  }
+}
+
+export interface JwtVerifierOptions {
+  readonly audience?: string | Array<string> | ReadonlyArray<string>
+  readonly clockTolerance?: number
+  readonly issuer?: string
+  readonly issuerBaseURL?: string
+  readonly jwksUri?: string
+  readonly maxTokenAge?: number
+  readonly secret?: string
+  readonly strict?: boolean
+  readonly tokenSigningAlg?: string
+}
+
+export interface AuthOptions extends JwtVerifierOptions {
+  readonly authRequired?: boolean
+}
+
+type Config = AuthOptions
+
+type JwtError = InsufficientScopeError | InvalidRequestError | InvalidTokenError | UnauthorizedError
+
+type ResolvedConfigBase = {
+  readonly audience: string | Array<string> | undefined
+  readonly clockTolerance: number
+  readonly issuer: string | undefined
+  readonly maxTokenAge: number | undefined
+  readonly strict: boolean
+  readonly tokenSigningAlg: string | undefined
+}
+
+type ResolvedConfig =
+  & ResolvedConfigBase
+  & (
+    | {
+      readonly key: ReturnType<typeof createRemoteJWKSet>
+      readonly keyType: "jwks"
+    }
+    | {
+      readonly key: Uint8Array
+      readonly keyType: "secret"
+    }
+  )
+
+const isRecord = (value: unknown): value is Record<string, unknown> => typeof value === "object" && value !== null
+
+const getErrorMessage = (error: unknown) => error instanceof Error ? error.message : String(error)
+
+const normalizeAudience = (audience: Config["audience"]): string | Array<string> | undefined =>
+  Array.isArray(audience) ? Array.from(audience) : audience as string | undefined
+
+const buildDiscoveryUrl = (issuerBaseURL: string) => {
+  const url = new URL(issuerBaseURL)
+  if (!url.pathname.includes("/.well-known/")) {
+    url.pathname = url.pathname.endsWith("/")
+      ? `${url.pathname}.well-known/openid-configuration`
+      : `${url.pathname}/.well-known/openid-configuration`
+  }
+  url.search = ""
+  url.hash = ""
+  return url
+}
+
+const fetchDiscoveryDocumentPromise = async (issuerBaseURL: string) => {
+  const response = await fetch(buildDiscoveryUrl(issuerBaseURL))
+  if (!response.ok) {
+    throw new Error(`Failed to fetch authorization server metadata: ${response.status}`)
+  }
+  const json = await response.json()
+  if (!isRecord(json) || typeof json["issuer"] !== "string" || typeof json["jwks_uri"] !== "string") {
+    throw new Error("Invalid authorization server metadata")
+  }
+  return { issuer: json["issuer"], jwksUri: json["jwks_uri"] }
+}
+
+const getAuthorizationToken = (headers: HttpHeaders.Headers, authRequired: boolean) => {
+  const authorization = HttpHeaders.get(headers, "authorization")
+  if (Option.isNone(authorization)) {
+    return authRequired ? Effect.fail(new UnauthorizedError()) : Effect.succeed(Option.none<string>())
+  }
+
+  const [scheme, token] = authorization.value.split(" ")
+  if (!scheme || !token || scheme.toLowerCase() !== "bearer") {
+    return Effect.fail(new InvalidRequestError("", false))
+  }
+
+  return Effect.succeed(Option.some(token))
+}
+
+const makeResolveConfig = (config: Config) => {
+  let cached: Promise<ResolvedConfig> | undefined
+
+  return Effect.tryPromise({
+    try: () => {
+      if (!cached) {
+        cached = (async (): Promise<ResolvedConfig> => {
+          const discovery = config.issuerBaseURL
+            ? await fetchDiscoveryDocumentPromise(config.issuerBaseURL)
+            : undefined
+
+          const issuer = config.issuer ?? discovery?.issuer
+          const jwksUri = config.jwksUri ?? discovery?.jwksUri
+          const secret = config.secret
+          const base = {
+            audience: normalizeAudience(config.audience),
+            clockTolerance: config.clockTolerance ?? 5,
+            issuer,
+            maxTokenAge: config.maxTokenAge,
+            strict: config.strict ?? false,
+            tokenSigningAlg: config.tokenSigningAlg
+          } satisfies ResolvedConfigBase
+
+          if (!issuer && !secret) {
+            throw new InvalidRequestError("JWT config requires 'issuer', 'issuerBaseURL', or 'secret'")
+          }
+
+          if (!secret) {
+            if (!jwksUri) {
+              throw new InvalidRequestError("JWT config requires 'jwksUri', 'issuerBaseURL', or 'secret'")
+            }
+
+            return {
+              ...base,
+              key: createRemoteJWKSet(new URL(jwksUri)),
+              keyType: "jwks"
+            }
+          }
+
+          return {
+            ...base,
+            key: new TextEncoder().encode(secret),
+            keyType: "secret"
+          }
+        })()
+      }
+
+      return cached
+    },
+    catch: (error) =>
+      error instanceof InvalidRequestError || error instanceof InvalidTokenError
+        ? error
+        : new InvalidTokenError(getErrorMessage(error))
+  })
+}
+
+const verifyToken =
+  (resolveConfig: Effect.Effect<ResolvedConfig, InvalidRequestError | InvalidTokenError>) => (token: string) =>
+    resolveConfig.pipe(
+      Effect.flatMap((config) => {
+        const options = {
+          clockTolerance: config.clockTolerance,
+          ...(config.tokenSigningAlg ? { algorithms: [config.tokenSigningAlg] } : {}),
+          ...(config.audience !== undefined ? { audience: config.audience } : {}),
+          ...(config.issuer !== undefined ? { issuer: config.issuer } : {}),
+          ...(config.maxTokenAge !== undefined ? { maxTokenAge: config.maxTokenAge } : {})
+        }
+        const verified = config.keyType === "jwks"
+          ? Effect.tryPromise({
+            try: () => jwtVerify(token, config.key, options).then(({ protectedHeader }) => ({ protectedHeader })),
+            catch: (error) => new InvalidTokenError(getErrorMessage(error))
+          })
+          : Effect.tryPromise({
+            try: () => jwtVerify(token, config.key, options).then(({ protectedHeader }) => ({ protectedHeader })),
+            catch: (error) => new InvalidTokenError(getErrorMessage(error))
+          })
+
+        return verified.pipe(
+          Effect.flatMap(({ protectedHeader }) => {
+            const typ = protectedHeader.typ?.toLowerCase().replace(/^application\//, "")
+            return config.strict && typ !== "at+jwt"
+              ? Effect.fail(new InvalidTokenError("Unexpected 'typ' value"))
+              : Effect.void
+          })
+        )
+      })
+    )
+
+export const checkJWTI = (config: Config) => {
+  const resolveConfig = makeResolveConfig(config)
+  const verify = verifyToken(resolveConfig)
+
+  return Effect.fnUntraced(function*(headers: HttpHeaders.Headers) {
+    const token = yield* getAuthorizationToken(headers, config.authRequired !== false)
+    if (Option.isNone(token)) {
+      return
+    }
+
+    yield* verify(token.value)
+  })
+}
+
+export const checkJwt = (config: Config) => {
+  const check = checkJWTI(config)
+  return HttpMiddleware.make((app) =>
+    Effect.gen(function*() {
+      const req = yield* HttpServerRequest.HttpServerRequest
+      const response = yield* check(req.headers).pipe(
+        Effect.catch((error: JwtError) =>
+          HttpServerResponse.json({ message: error.message }, {
+            status: error.status,
+            headers: HttpHeaders.fromInput(error.headers)
+          })
+        )
+      )
+
+      if (response) {
+        return response
+      }
+
+      return yield* app
+    })
+  )
+}
+
+export class JWTError extends Data.TaggedClass("JWTError")<{
+  error: JwtError
+}> {}

package/src/{api/internal → internal}/events.ts

@@ -1,7 +1,13 @@
-import { Duration, Effect, pipe, S, Schedule, Stream } from "effect-app"
+import * as Effect from "effect-app/Effect"
 import { HttpHeaders, HttpServerResponse } from "effect-app/http"
-import { reportError } from "../../errorReporter.js"
-import { setupRequestContextFromCurrent } from "../setupRequest.js"
+import * as S from "effect-app/Schema"
+import { setupStreamingRequestContextFromCurrent } from "effect-app/setupRequest"
+import { storeId } from "effect-app/Store"
+import * as Duration from "effect/Duration"
+import { pipe } from "effect/Function"
+import * as Schedule from "effect/Schedule"
+import * as Stream from "effect/Stream"
+import { reportError } from "../errorReporter.js"
 
 // Tell the client to retry every 10 seconds if connectivity is lost
 const setRetry = Stream.succeed("retry: 10000")
@@ -9,29 +15,32 @@ const keepAlive = Stream.fromEffectSchedule(Effect.succeed(":keep-alive"), Sched
 
 let connId = BigInt(0)
 
-export const makeSSE = <A extends { id: any }, SI, SR>(
-  schema: S.Codec<A, SI, SR>
+export const makeSSE = <A extends { id: any }, SI, SRD, SRE>(
+  schema: S.Codec<A, SI, SRD, SRE>
 ) =>
 <E, R>(events: Stream.Stream<{ evt: A; namespace: string }, E, R>) =>
   Effect
     .gen(function*() {
       const id = connId++
-      const ctx = yield* Effect.services<R | SR>()
+      const ctx = yield* Effect.context<R | SRD | SRE>()
       const res = HttpServerResponse.stream(
         // workaround for different scoped behaviour for streams in Bun
         // https://discord.com/channels/795981131316985866/1098177242598756412/1389646879675125861
         Effect
           .gen(function*() {
-            yield* Effect.annotateCurrentSpan({ connectionId: id.toString() })
-            yield* Effect.logInfo("$ start listening to events, id: " + id.toString())
-            yield* Effect.addFinalizer(() => Effect.logInfo("$ end listening to events, id: " + id.toString()))
+            const ns = yield* storeId
+            yield* Effect.annotateCurrentSpan({ "network.connection.id": id.toString() })
+            yield* Effect.logInfo("$ start listening to events, id: " + id.toString() + ", ns: " + ns)
+            yield* Effect.addFinalizer(() =>
+              Effect.logInfo("$ end listening to events, id: " + id.toString() + ", ns: " + ns)
+            )
 
             const enc = new TextEncoder()
 
-            const encode = S.encodeEffect(S.fromJsonString(schema))
+            const encode = S.encodeEffect(S.fromJsonString(S.toCodecJson(schema)))
 
             const eventStream = Stream.mapEffect(
-              events,
+              Stream.filter(events, (_) => _.namespace === ns),
               (_) =>
                 encode(_.evt)
                   .pipe(Effect.map((data) => `id: ${_.evt.id}\ndata: ${data}`))
@@ -42,7 +51,7 @@ export const makeSSE = <A extends { id: any }, SI, SR>(
               Stream.merge(keepAlive),
               // Keep this unary so pipe receives a function, not a Stream value.
               (self) => Stream.merge(self, eventStream, { haltStrategy: "either" }),
-              Stream.tapCause((cause) => Effect.logError("SSE error", cause)),
+              Stream.tapCause((cause) => Effect.logError("SSE error, id: " + id.toString() + ", ns: " + ns, cause)),
               Stream.map((_) => enc.encode(_ + "\n\n"))
             )
 
@@ -65,4 +74,4 @@ export const makeSSE = <A extends { id: any }, SI, SR>(
       )
       return res
     })
-    .pipe(Effect.tapCause(reportError("Request")), setupRequestContextFromCurrent("events"))
+    .pipe(Effect.tapCause(reportError("Request")), setupStreamingRequestContextFromCurrent("events"))