@effect-app/infra 4.0.0-beta.33 → 4.0.0-beta.330

package/src/arbs.ts

@@ -1,13 +1,17 @@
 // Do not import to frontend
 
 import { faker } from "@faker-js/faker"
-import { type S } from "effect-app"
 import { setFaker } from "effect-app/faker"
-import * as FastCheck from "effect/testing/FastCheck"
+import type * as S from "effect-app/Schema"
+import * as Effect from "effect/Effect"
+import * as Arbitrary from "effect/unstable/arbitrary/Arbitrary"
+import * as FastCheck from "fast-check"
 import { Random } from "fast-check"
-import * as rand from "pure-rand"
+import { congruential32 } from "pure-rand/generator/congruential32"
 
-const rnd = new Random(rand.congruential32(5))
+const seed = 5
+const rng = congruential32(seed)
+const rnd = new Random(rng)
 
 setFaker(faker)
 
@@ -15,6 +19,22 @@ export function generate<T>(arb: FastCheck.Arbitrary<T>) {
   return arb.generate(rnd, undefined)
 }
 
-export function generateFromArbitrary<T>(arb: S.LazyArbitrary<T>) {
+export function generateFromArbitrary<T>(arb: S.Arbitrary<T>) {
   return generate(arb(FastCheck))
 }
+
+// Native `sampleEffect({ count: 1 })` always uses attempt 0 of the master seed (edge-biased).
+// Integer `seed + n` stayed in that bucket and collided for StringId. Mix a per-call suffix
+// so each call is a jump-before-toss, like successive `generate(rnd)` draws.
+let schemaSamples = 0
+
+export function generateFromSchema<S extends S.Constraint>(schema: S) {
+  const samples = Effect.runSync(
+    Arbitrary.sampleEffect(Arbitrary.schema(schema), { count: 1, seed: `${seed}:${schemaSamples++}` })
+  )
+  const value = samples[0]
+  if (value === undefined) {
+    throw new Error("failed to sample schema")
+  }
+  return { value }
+}

package/src/cosmos-client.ts

@@ -0,0 +1,56 @@
+import { type ContainerRequest, CosmosClient as ComosClient_ } from "@azure/cosmos"
+import * as Context from "effect-app/Context"
+import * as Effect from "effect-app/Effect"
+import * as Layer from "effect-app/Layer"
+
+const withClient = (url: string) => Effect.sync(() => new ComosClient_(url))
+
+export const makeCosmosClient = (url: string, dbName: string) =>
+  Effect.map(withClient(url), (x) => ({ db: x.database(dbName) }))
+
+export class CosmosClient extends Context.Service<CosmosClient, {
+  readonly db: ReturnType<InstanceType<typeof ComosClient_>["database"]>
+}>()("@services/CosmosClient") {}
+
+export const db = CosmosClient.pipe(Effect.map((_) => _.db))
+
+export const CosmosClientLayer = (cosmosUrl: string, dbName: string) =>
+  Layer.effect(CosmosClient, makeCosmosClient(cosmosUrl, dbName))
+
+export interface CosmosContainerThroughput {
+  /**
+   * Autoscale max RU/s for containers created on demand (min 1000; Cosmos bills at
+   * least 10% of it). Only applied to containers that do not exist yet, in databases
+   * without shared throughput — those containers share the database pool instead.
+   * Unset keeps the Cosmos default: manual 400 RU/s per container, billed 24/7.
+   */
+  readonly autoscaleMaxThroughput?: number | undefined
+}
+
+/** The slice of a Cosmos `Database` needed to create containers. */
+export interface ContainerDb {
+  readonly container: (id: string) => { readonly read: () => Promise<unknown> }
+  readonly containers: { readonly createIfNotExists: (body: ContainerRequest) => Promise<unknown> }
+  readonly readOffer: () => Promise<{ readonly resource?: unknown }>
+}
+
+const isNotFound = (e: unknown) => typeof e === "object" && e !== null && "code" in e && e.code === 404
+
+export const createContainerIfNotExists = async (
+  db: ContainerDb,
+  body: ContainerRequest & { id: string },
+  throughput?: CosmosContainerThroughput
+) => {
+  const maxThroughput = throughput?.autoscaleMaxThroughput
+  if (maxThroughput === undefined) {
+    await db.containers.createIfNotExists(body)
+    return
+  }
+  const exists = await db.container(body.id).read().then(
+    () => true,
+    (e) => isNotFound(e) ? false : Promise.reject(e)
+  )
+  if (exists) return
+  const { resource: sharedOffer } = await db.readOffer()
+  await db.containers.createIfNotExists(sharedOffer ? body : { ...body, maxThroughput })
+}

package/src/errorReporter.ts

@@ -1,9 +1,11 @@
 import * as Sentry from "@sentry/node"
-import { Cause, Effect, type LogLevel } from "effect-app"
+import * as Effect from "effect-app/Effect"
+import { getRC } from "effect-app/setupRequest"
 import { dropUndefined, LogLevelToSentry } from "effect-app/utils"
-import { getRC } from "./api/setupRequest.js"
-import { CauseException, tryToJson, tryToReport } from "./errors.js"
-import { InfraLogger } from "./logger.js"
+import * as Cause from "effect/Cause"
+import type * as LogLevel from "effect/LogLevel"
+import { CauseException, tryToJson, tryToReport } from "./errors.ts"
+import { InfraLogger } from "./logger.ts"
 
 const tryCauseException = <E>(cause: Cause.Cause<E>, name: string): CauseException<E> => {
   try {
@@ -13,47 +15,41 @@ const tryCauseException = <E>(cause: Cause.Cause<E>, name: string): CauseExcepti
   }
 }
 
-export function reportError(
-  name: string
-) {
-  return (
-    cause: Cause.Cause<unknown>,
-    extras?: Record<string, unknown>,
-    level: LogLevel.Severity = "Error"
-  ) =>
-    Effect
-      .gen(function*() {
-        if (Cause.hasInterruptsOnly(cause)) {
-          yield* InfraLogger.logDebug("Interrupted").pipe(Effect.annotateLogs("extras", JSON.stringify(extras ?? {})))
-          return
-        }
-        const error = tryCauseException(cause, name)
-
-        yield* reportSentry(error, extras, LogLevelToSentry(level))
-        yield* InfraLogger
-          .logWithLevel(level, "Reporting error", cause)
-          .pipe(
-            Effect.annotateLogs(dropUndefined({
-              extras,
-              error: tryToReport(error),
-              cause: tryToJson(cause),
-              __error_name__: name
-            }))
-          )
-          .pipe(
-            Effect.catchCause((cause) => InfraLogger.logWarning("Failed to log error", cause)),
-            Effect.catchCause(() => InfraLogger.logFatal("Failed to log error cause"))
-          )
+export function reportError(name: string) {
+  return Effect.fnUntraced(
+    function*(
+      cause: Cause.Cause<unknown>,
+      extras?: Record<string, unknown>,
+      level: LogLevel.Severity = "Error"
+    ) {
+      if (Cause.hasInterruptsOnly(cause)) {
+        yield* InfraLogger.logDebug("Interrupted").pipe(Effect.annotateLogs("extras", JSON.stringify(extras ?? {})))
+        return
+      }
+      const error = tryCauseException(cause, name)
 
-        return error
-      })
-      .pipe(
-        Effect.tapCause((cause) =>
-          InfraLogger.logError("Failed to report error", cause).pipe(
-            Effect.tapCause(() => InfraLogger.logFatal("Failed to log error cause"))
-          )
+      yield* reportSentry(error, extras, LogLevelToSentry(level))
+      yield* InfraLogger
+        .logWithLevel(level, "Reporting error", cause)
+        .pipe(
+          Effect.annotateLogs(dropUndefined({
+            extras,
+            error: tryToReport(error),
+            cause: tryToJson(cause),
+            __error_name__: name
+          })),
+          Effect.catchCause((cause) => InfraLogger.logWarning("Failed to log error", cause)),
+          Effect.catchCause(() => InfraLogger.logFatal("Failed to log error cause"))
         )
-      )
+
+      return error
+    },
+    (effect) =>
+      Effect.tapCause(effect, (cause) =>
+        InfraLogger.logError("Failed to report error", cause).pipe(
+          Effect.tapCause(() => InfraLogger.logFatal("Failed to log error cause"))
+        ))
+  )
 }
 
 function reportSentry(
@@ -66,45 +62,39 @@ function reportSentry(
     scope.setLevel(level)
     if (context) scope.setContext("context", { ...context })
     if (extras) scope.setContext("extras", extras)
-    scope.setContext("error", { data: tryToReport(error) })
-    scope.setContext("cause", { data: tryToJson(error.originalCause) })
+    const squashed = Cause.squash(error.originalCause)
+    scope.setContext("mainError", tryToJson(squashed))
+    scope.setContext("error", tryToReport(error))
+    scope.setContext("cause", tryToJson(error.originalCause))
     Sentry.captureException(error, scope)
   }))
 }
 
-export function logError<E>(
-  name: string
-) {
-  return (cause: Cause.Cause<E>, extras?: Record<string, unknown>) =>
-    Effect
-      .gen(function*() {
-        if (Cause.hasInterruptsOnly(cause)) {
-          yield* InfraLogger.logDebug("Interrupted").pipe(Effect.annotateLogs(dropUndefined({ extras })))
-          return
-        }
-        yield* InfraLogger
-          .logWarning("Logging error", cause)
-          .pipe(
-            Effect.annotateLogs(dropUndefined({
-              extras,
-              cause: tryToJson(cause),
-              __error_name__: name
-            }))
-          )
-      })
-      .pipe(
-        Effect.tapCause(() => InfraLogger.logFatal("Failed to log error cause"))
-      )
+export function logError<E>(name: string) {
+  return Effect.fnUntraced(
+    function*(cause: Cause.Cause<E>, extras?: Record<string, unknown>) {
+      if (Cause.hasInterruptsOnly(cause)) {
+        yield* InfraLogger.logDebug("Interrupted").pipe(Effect.annotateLogs(dropUndefined({ extras })))
+        return
+      }
+      yield* InfraLogger
+        .logWarning("Logging error", cause)
+        .pipe(Effect.annotateLogs(dropUndefined({
+          extras,
+          cause: tryToJson(cause),
+          __error_name__: name
+        })))
+    },
+    (effect) => Effect.tapCause(effect, () => InfraLogger.logFatal("Failed to log error cause"))
+  )
 }
 
-export function reportMessage(message: string, extras?: Record<string, unknown>) {
-  return Effect.gen(function*() {
-    const context = yield* getRC
-    const scope = new Sentry.Scope()
-    if (context) scope.setContext("context", { ...context })
-    if (extras) scope.setContext("extras", extras)
-    Sentry.captureMessage(message, scope)
+export const reportMessage = Effect.fnUntraced(function*(message: string, extras?: Record<string, unknown>) {
+  const context = yield* getRC
+  const scope = new Sentry.Scope()
+  if (context) scope.setContext("context", { ...context })
+  if (extras) scope.setContext("extras", extras)
+  Sentry.captureMessage(message, scope)
 
-    console.warn(message, extras)
-  })
-}
+  console.warn(message, extras)
+})

package/src/fileUtil.ts

@@ -1,5 +1,5 @@
 import crypto from "crypto"
-import { Effect } from "effect-app"
+import * as Effect from "effect-app/Effect"
 import type { Abortable } from "events"
 import type { Mode, ObjectEncodingOptions, OpenMode } from "fs"
 import fs from "fs/promises"

package/src/index.ts

@@ -1 +1,2 @@
-export * as Model from "./Model.js"
+export * from "./logger.ts"
+export * from "./Store/index.ts"

package/src/{api/internal → internal}/RequestContextMiddleware.ts

@@ -1,8 +1,10 @@
-import { Effect } from "effect-app"
+import * as Effect from "effect-app/Effect"
 import { HttpMiddleware, HttpServerRequest, HttpServerResponse } from "effect-app/http"
+import * as Layer from "effect-app/Layer"
+import { Locale, LocaleRef, RequestContext, spanAttributes } from "effect-app/RequestContext"
 import { NonEmptyString255 } from "effect-app/Schema"
-import { Locale, RequestContext } from "../../RequestContext.js"
-import { setupRequestContext } from "../setupRequest.js"
+import { provideOnRequestScope, requestStateLayer } from "effect-app/setupRequest"
+import { storeId } from "effect-app/Store"
 
 export const RequestContextMiddleware = (defaultLocale: Locale = "en") =>
   HttpMiddleware.make((app) =>
@@ -21,18 +23,33 @@ export const RequestContextMiddleware = (defaultLocale: Locale = "en") =>
       const namespace = NonEmptyString255((ns && (Array.isArray(ns) ? ns[0] : ns)) || "primary")
       const deviceId = req.headers["x-fe-device-id"]
 
-      const requestContext = new RequestContext({
+      const requestContext = RequestContext.make({
         span: {
           traceId: currentSpan.traceId,
           spanId: currentSpan.spanId,
           sampled: currentSpan.sampled
         },
-        name: NonEmptyString255(req.originalUrl), // set more detailed elsewhere
+        name: NonEmptyString255(`HTTP ${req.method} ${req.originalUrl.split("?")[0]}`), // set more detailed elsewhere
         locale,
         namespace,
         sourceId: deviceId ? NonEmptyString255(deviceId) : undefined
       })
-      const res = yield* setupRequestContext(app, requestContext)
+      yield* Effect.annotateCurrentSpan(spanAttributes(requestContext))
+      const layer = Layer.mergeAll(
+        requestStateLayer,
+        Layer.succeed(LocaleRef, requestContext.locale),
+        Layer.succeed(storeId, requestContext.namespace)
+      )
+      // Bind layer to the request scope so ContextMap's finalizer (clear()) runs only
+      // after the response body is fully drained — not when `app` returns its
+      // HttpServerResponse value. Streaming RPC responses keep producing chunks (and
+      // using ContextMap-cached etags) after `app` returns; a sub-scope from
+      // `Effect.provide(layer)` would close too early and wipe etags mid-stream,
+      // causing spurious OptimisticConcurrencyException on later writes.
+      const res = yield* app.pipe(
+        Effect.withLogSpan(requestContext.name),
+        provideOnRequestScope(layer)
+      )
 
       // TODO: how to set also on errors?
       return HttpServerResponse.setHeaders(res, {

package/src/internal/auth.ts

@@ -0,0 +1,272 @@
+import * as Effect from "effect-app/Effect"
+import { HttpHeaders, HttpMiddleware, HttpServerRequest, HttpServerResponse } from "effect-app/http"
+import * as Option from "effect-app/Option"
+import * as Data from "effect/Data"
+import { createRemoteJWKSet, jwtVerify } from "jose"
+
+const getHeaders = (error: string, description: string, scopes?: ReadonlyArray<string>) => ({
+  "WWW-Authenticate": `Bearer realm="api", error="${error}", error_description="${description.replace(/"/g, "'")}"${
+    scopes ? `, scope="${scopes.join(" ")}"` : ""
+  }`
+})
+
+export class UnauthorizedError extends Error {
+  readonly status: number = 401
+  readonly statusCode: number = 401
+  headers = { "WWW-Authenticate": "Bearer realm=\"api\"" }
+
+  constructor(message = "Unauthorized") {
+    super(message)
+    this.name = this.constructor.name
+  }
+}
+
+export class InvalidRequestError extends UnauthorizedError {
+  readonly code: string
+  override readonly status = 400
+  override readonly statusCode = 400
+
+  constructor(message = "Invalid Request", useErrorCode = true) {
+    super(message)
+    this.code = useErrorCode ? "invalid_request" : ""
+    if (useErrorCode) {
+      this.headers = getHeaders(this.code, this.message)
+    }
+  }
+}
+
+export class InvalidTokenError extends UnauthorizedError {
+  readonly code = "invalid_token"
+
+  constructor(message = "Invalid Token") {
+    super(message)
+    this.headers = getHeaders(this.code, this.message)
+  }
+}
+
+export class InsufficientScopeError extends UnauthorizedError {
+  readonly code = "insufficient_scope"
+  override readonly status = 403
+  override readonly statusCode = 403
+
+  constructor(scopes?: ReadonlyArray<string>, message = "Insufficient Scope") {
+    super(message)
+    this.headers = getHeaders(this.code, this.message, scopes)
+  }
+}
+
+export interface JwtVerifierOptions {
+  readonly audience?: string | Array<string> | ReadonlyArray<string>
+  readonly clockTolerance?: number
+  readonly issuer?: string
+  readonly issuerBaseURL?: string
+  readonly jwksUri?: string
+  readonly maxTokenAge?: number
+  readonly secret?: string
+  readonly strict?: boolean
+  readonly tokenSigningAlg?: string
+}
+
+export interface AuthOptions extends JwtVerifierOptions {
+  readonly authRequired?: boolean
+}
+
+type Config = AuthOptions
+
+type JwtError = InsufficientScopeError | InvalidRequestError | InvalidTokenError | UnauthorizedError
+
+type ResolvedConfigBase = {
+  readonly audience: string | Array<string> | undefined
+  readonly clockTolerance: number
+  readonly issuer: string | undefined
+  readonly maxTokenAge: number | undefined
+  readonly strict: boolean
+  readonly tokenSigningAlg: string | undefined
+}
+
+type ResolvedConfig =
+  & ResolvedConfigBase
+  & (
+    | {
+      readonly key: ReturnType<typeof createRemoteJWKSet>
+      readonly keyType: "jwks"
+    }
+    | {
+      readonly key: Uint8Array
+      readonly keyType: "secret"
+    }
+  )
+
+const isRecord = (value: unknown): value is Record<string, unknown> => typeof value === "object" && value !== null
+
+const getErrorMessage = (error: unknown) => error instanceof Error ? error.message : String(error)
+
+const normalizeAudience = (audience: Config["audience"]): string | Array<string> | undefined =>
+  Array.isArray(audience) ? Array.from(audience) : audience as string | undefined
+
+const buildDiscoveryUrl = (issuerBaseURL: string) => {
+  const url = new URL(issuerBaseURL)
+  if (!url.pathname.includes("/.well-known/")) {
+    url.pathname = url.pathname.endsWith("/")
+      ? `${url.pathname}.well-known/openid-configuration`
+      : `${url.pathname}/.well-known/openid-configuration`
+  }
+  url.search = ""
+  url.hash = ""
+  return url
+}
+
+const fetchDiscoveryDocumentPromise = async (issuerBaseURL: string) => {
+  const response = await fetch(buildDiscoveryUrl(issuerBaseURL))
+  if (!response.ok) {
+    throw new Error(`Failed to fetch authorization server metadata: ${response.status}`)
+  }
+  const json = await response.json()
+  if (!isRecord(json) || typeof json["issuer"] !== "string" || typeof json["jwks_uri"] !== "string") {
+    throw new Error("Invalid authorization server metadata")
+  }
+  return { issuer: json["issuer"], jwksUri: json["jwks_uri"] }
+}
+
+const getAuthorizationToken = (headers: HttpHeaders.Headers, authRequired: boolean) => {
+  const authorization = HttpHeaders.get(headers, "authorization")
+  if (Option.isNone(authorization)) {
+    return authRequired ? Effect.fail(new UnauthorizedError()) : Effect.succeed(Option.none<string>())
+  }
+
+  const [scheme, token] = authorization.value.split(" ")
+  if (!scheme || !token || scheme.toLowerCase() !== "bearer") {
+    return Effect.fail(new InvalidRequestError("", false))
+  }
+
+  return Effect.succeed(Option.some(token))
+}
+
+const makeResolveConfig = (config: Config) => {
+  let cached: Promise<ResolvedConfig> | undefined
+
+  return Effect.tryPromise({
+    try: () => {
+      if (!cached) {
+        cached = (async (): Promise<ResolvedConfig> => {
+          const discovery = config.issuerBaseURL
+            ? await fetchDiscoveryDocumentPromise(config.issuerBaseURL)
+            : undefined
+
+          const issuer = config.issuer ?? discovery?.issuer
+          const jwksUri = config.jwksUri ?? discovery?.jwksUri
+          const secret = config.secret
+          const base = {
+            audience: normalizeAudience(config.audience),
+            clockTolerance: config.clockTolerance ?? 5,
+            issuer,
+            maxTokenAge: config.maxTokenAge,
+            strict: config.strict ?? false,
+            tokenSigningAlg: config.tokenSigningAlg
+          } satisfies ResolvedConfigBase
+
+          if (!issuer && !secret) {
+            throw new InvalidRequestError("JWT config requires 'issuer', 'issuerBaseURL', or 'secret'")
+          }
+
+          if (!secret) {
+            if (!jwksUri) {
+              throw new InvalidRequestError("JWT config requires 'jwksUri', 'issuerBaseURL', or 'secret'")
+            }
+
+            return {
+              ...base,
+              key: createRemoteJWKSet(new URL(jwksUri)),
+              keyType: "jwks"
+            }
+          }
+
+          return {
+            ...base,
+            key: new TextEncoder().encode(secret),
+            keyType: "secret"
+          }
+        })()
+      }
+
+      return cached
+    },
+    catch: (error) =>
+      error instanceof InvalidRequestError || error instanceof InvalidTokenError
+        ? error
+        : new InvalidTokenError(getErrorMessage(error))
+  })
+}
+
+const verifyToken =
+  (resolveConfig: Effect.Effect<ResolvedConfig, InvalidRequestError | InvalidTokenError>) => (token: string) =>
+    resolveConfig.pipe(
+      Effect.flatMap((config) => {
+        const options = {
+          clockTolerance: config.clockTolerance,
+          ...(config.tokenSigningAlg ? { algorithms: [config.tokenSigningAlg] } : {}),
+          ...(config.audience !== undefined ? { audience: config.audience } : {}),
+          ...(config.issuer !== undefined ? { issuer: config.issuer } : {}),
+          ...(config.maxTokenAge !== undefined ? { maxTokenAge: config.maxTokenAge } : {})
+        }
+        const verified = config.keyType === "jwks"
+          ? Effect.tryPromise({
+            try: () => jwtVerify(token, config.key, options).then(({ protectedHeader }) => ({ protectedHeader })),
+            catch: (error) => new InvalidTokenError(getErrorMessage(error))
+          })
+          : Effect.tryPromise({
+            try: () => jwtVerify(token, config.key, options).then(({ protectedHeader }) => ({ protectedHeader })),
+            catch: (error) => new InvalidTokenError(getErrorMessage(error))
+          })
+
+        return verified.pipe(
+          Effect.flatMap(({ protectedHeader }) => {
+            const typ = protectedHeader.typ?.toLowerCase().replace(/^application\//, "")
+            return config.strict && typ !== "at+jwt"
+              ? Effect.fail(new InvalidTokenError("Unexpected 'typ' value"))
+              : Effect.void
+          })
+        )
+      })
+    )
+
+export const checkJWTI = (config: Config) => {
+  const resolveConfig = makeResolveConfig(config)
+  const verify = verifyToken(resolveConfig)
+
+  return Effect.fnUntraced(function*(headers: HttpHeaders.Headers) {
+    const token = yield* getAuthorizationToken(headers, config.authRequired !== false)
+    if (Option.isNone(token)) {
+      return
+    }
+
+    yield* verify(token.value)
+  })
+}
+
+export const checkJwt = (config: Config) => {
+  const check = checkJWTI(config)
+  return HttpMiddleware.make((app) =>
+    Effect.gen(function*() {
+      const req = yield* HttpServerRequest.HttpServerRequest
+      const response = yield* check(req.headers).pipe(
+        Effect.catch((error: JwtError) =>
+          HttpServerResponse.json({ message: error.message }, {
+            status: error.status,
+            headers: HttpHeaders.fromInput(error.headers)
+          })
+        )
+      )
+
+      if (response) {
+        return response
+      }
+
+      return yield* app
+    })
+  )
+}
+
+export class JWTError extends Data.TaggedClass("JWTError")<{
+  error: JwtError
+}> {}