@effect-auth/core 0.1.0-alpha.15 → 0.1.0-alpha.18

package/dist/HttpApi/Security.d.ts

@@ -1,17 +1,16 @@
-import { Context, Duration, Effect, Layer } from "effect";
+import { Context, Effect, Layer } from "effect";
 import { HttpServerRequest } from "effect/unstable/http";
 import { HttpApiMiddleware } from "effect/unstable/httpapi";
-import type { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
-import type { EmailVerificationIssueInput } from "../EmailVerification.js";
-import type { EmailOtpStartInput } from "../EmailOtp.js";
-import type { MagicLinkStartInput } from "../MagicLink.js";
+import { CustomEvidencePolicyError } from "../Assurance.js";
 import type { IpAddress } from "../Identifiers.js";
-import type { PasswordResetStartInput, PasswordSignInInput, PasswordSignUpInput } from "../Password.js";
-import { Privacy } from "../Privacy.js";
+import type { PermissionCheckError } from "../Permission.js";
+import type { AuthorizationError } from "../Policy.js";
 import type { PrivacyError } from "../Privacy.js";
-import { RateLimiter } from "../RateLimiter.js";
-import type { RateLimitError, RateLimitPolicy as RateLimitPolicyShape } from "../RateLimiter.js";
-import { AuthInternalError, AuthRateLimitedError, AuthRequestRejectedError } from "./Errors.js";
+import type { RateLimitExceededError, RateLimitStoreError } from "../RateLimiter.js";
+import type { StepUpCapabilityError, StepUpDenied, StepUpRequired } from "../StepUp.js";
+import { AuthPolicyDeniedError, AuthInternalError, AuthRateLimitedError, AuthRequestRejectedError, AuthStepUpRequiredError } from "./Errors.js";
+import { AuthOriginCheckMiddleware } from "./Middleware.js";
+export { AuthOriginCheckMiddleware } from "./Middleware.js";
 export interface AuthOriginCheckOptions {
     readonly allowedOrigins?: string | readonly string[];
     readonly allowMissingOrigin?: boolean;
@@ -31,64 +30,10 @@ export interface AuthRequestMetadataShape {
     readonly origin?: string;
     readonly referer?: string;
 }
-export interface AuthRateLimitPolicyInput {
-    readonly metadata: AuthRequestMetadataShape;
-    readonly endpoint: HttpApiEndpoint.Any;
-    readonly group: HttpApiGroup.Any;
-}
-export type AuthRateLimitPolicy = (input: AuthRateLimitPolicyInput) => Effect.Effect<RateLimitPolicyShape | undefined, PrivacyError, Privacy>;
-export interface AuthRateLimitByIpOptions {
-    readonly id: string;
-    readonly window: Duration.Duration;
-    readonly limit: number;
-    readonly tokens?: number;
-}
-export interface AuthApiRateLimitRuleOptions {
-    readonly window?: Duration.Duration;
-    readonly limit?: number;
-    readonly tokens?: number;
-}
-export type AuthApiRateLimitRuleConfig = AuthApiRateLimitRuleOptions | boolean;
-export interface AuthApiEndpointRateLimitOptions {
-    readonly byIp?: AuthApiRateLimitRuleConfig;
-    readonly byEmail?: AuthApiRateLimitRuleConfig;
-}
-export type AuthApiEndpointRateLimitConfig = AuthApiEndpointRateLimitOptions | boolean;
-export interface AuthApiRateLimitOptions {
-    readonly trustProxyHeaders?: boolean;
-    readonly passwordSignIn?: AuthApiEndpointRateLimitConfig;
-    readonly passwordSignUp?: AuthApiEndpointRateLimitConfig;
-    readonly passwordResetStart?: AuthApiEndpointRateLimitConfig;
-    readonly passwordResetVerify?: AuthApiEndpointRateLimitConfig;
-    readonly emailOtpStart?: AuthApiEndpointRateLimitConfig;
-    readonly emailOtpVerify?: AuthApiEndpointRateLimitConfig;
-    readonly magicLinkStart?: AuthApiEndpointRateLimitConfig;
-    readonly magicLinkVerify?: AuthApiEndpointRateLimitConfig;
-    readonly emailVerificationStart?: AuthApiEndpointRateLimitConfig;
-}
-export type AuthApiRateLimitConfigValue = AuthApiRateLimitOptions | boolean;
 export interface AuthHttpApiConfigValue {
-    readonly rateLimit?: AuthApiRateLimitConfigValue;
     readonly originCheck?: AuthOriginCheckOptions;
     readonly requestMetadata?: AuthRequestMetadataOptions;
 }
-export type AuthRateLimitEndpointKey = `${string}.${string}`;
-export type AuthRateLimitEndpointPolicyMap = Readonly<Record<AuthRateLimitEndpointKey, AuthRateLimitPolicy | undefined>>;
-export interface AuthApiRateLimitService {
-    readonly request: (input: AuthRateLimitPolicyInput) => Effect.Effect<void, RateLimitError | PrivacyError>;
-    readonly passwordSignIn: (input: PasswordSignInInput) => Effect.Effect<void, RateLimitError | PrivacyError>;
-    readonly passwordSignUp: (input: PasswordSignUpInput) => Effect.Effect<void, RateLimitError | PrivacyError>;
-    readonly passwordResetStart: (input: PasswordResetStartInput) => Effect.Effect<void, RateLimitError | PrivacyError>;
-    readonly emailOtpStart: (input: EmailOtpStartInput) => Effect.Effect<void, RateLimitError | PrivacyError>;
-    readonly magicLinkStart: (input: MagicLinkStartInput) => Effect.Effect<void, RateLimitError | PrivacyError>;
-    readonly emailVerificationStart: (input: EmailVerificationIssueInput) => Effect.Effect<void, RateLimitError | PrivacyError>;
-}
-declare const AuthApiRateLimit_base: Context.ServiceClass<AuthApiRateLimit, "auth/AuthApiRateLimit", AuthApiRateLimitService>;
-export declare class AuthApiRateLimit extends AuthApiRateLimit_base {
-}
-export declare namespace AuthApiRateLimit {
-    const make: (service: AuthApiRateLimitService) => AuthApiRateLimitService;
-}
 declare const AuthHttpApiConfig_base: Context.ServiceClass<AuthHttpApiConfig, "auth/AuthHttpApiConfig", AuthHttpApiConfigValue>;
 export declare class AuthHttpApiConfig extends AuthHttpApiConfig_base {
 }
@@ -101,16 +46,6 @@ export declare class AuthRequestMetadata extends AuthRequestMetadata_base {
 export declare namespace AuthRequestMetadata {
     const make: (metadata: AuthRequestMetadataShape) => AuthRequestMetadataShape;
 }
-declare const AuthOriginCheckMiddleware_base: HttpApiMiddleware.ServiceClass<AuthOriginCheckMiddleware, "auth/AuthOriginCheckMiddleware", {
-    requires: never;
-    provides: never;
-    error: typeof AuthRequestRejectedError;
-    clientError: never;
-    requiredForClient: false;
-    security: never;
-}, HttpApiMiddleware.HttpApiMiddleware<never, typeof AuthRequestRejectedError, never>>;
-export declare class AuthOriginCheckMiddleware extends AuthOriginCheckMiddleware_base {
-}
 declare const AuthRequestMetadataMiddleware_base: HttpApiMiddleware.ServiceClass<AuthRequestMetadataMiddleware, "auth/AuthRequestMetadataMiddleware", {
     requires: never;
     provides: AuthRequestMetadata;
@@ -121,16 +56,6 @@ declare const AuthRequestMetadataMiddleware_base: HttpApiMiddleware.ServiceClass
 }, HttpApiMiddleware.HttpApiMiddleware<AuthRequestMetadata, never, never>>;
 export declare class AuthRequestMetadataMiddleware extends AuthRequestMetadataMiddleware_base {
 }
-declare const AuthRateLimitMiddleware_base: HttpApiMiddleware.ServiceClass<AuthRateLimitMiddleware, "auth/AuthRateLimitMiddleware", {
-    requires: never;
-    provides: never;
-    error: readonly [typeof AuthRateLimitedError, typeof AuthInternalError];
-    clientError: never;
-    requiredForClient: false;
-    security: never;
-}, HttpApiMiddleware.HttpApiMiddleware<never, readonly [typeof AuthRateLimitedError, typeof AuthInternalError], never>>;
-export declare class AuthRateLimitMiddleware extends AuthRateLimitMiddleware_base {
-}
 declare const AuthCsrfMiddleware_base: HttpApiMiddleware.ServiceClass<AuthCsrfMiddleware, "auth/AuthCsrfMiddleware", {
     requires: never;
     provides: never;
@@ -142,18 +67,12 @@ declare const AuthCsrfMiddleware_base: HttpApiMiddleware.ServiceClass<AuthCsrfMi
 export declare class AuthCsrfMiddleware extends AuthCsrfMiddleware_base {
 }
 export declare const makeAuthRequestMetadata: (request: HttpServerRequest.HttpServerRequest, options?: AuthRequestMetadataOptions) => AuthRequestMetadataShape;
-export declare const AuthRateLimitPolicy: {
-    readonly fixedWindowByIp: (options: AuthRateLimitByIpOptions) => AuthRateLimitPolicy;
-    readonly byEndpoint: (policies: AuthRateLimitEndpointPolicyMap) => AuthRateLimitPolicy;
-};
+type MapAuthGuardError<E> = E extends RateLimitExceededError ? AuthRateLimitedError : E extends CustomEvidencePolicyError | RateLimitStoreError | PrivacyError | StepUpCapabilityError | PermissionCheckError ? AuthInternalError : E extends StepUpRequired ? AuthStepUpRequiredError : E extends StepUpDenied | AuthorizationError ? AuthPolicyDeniedError : E;
+export declare const customEvidencePolicyHttpFailure: (error: unknown, message?: string) => Effect.Effect<never, AuthInternalError> | undefined;
+export declare const mapAuthGuardErrors: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, MapAuthGuardError<E>, R>;
 export declare const AuthHttpApiConfigLive: (config: AuthHttpApiConfigValue) => Layer.Layer<AuthHttpApiConfig, never, never>;
-export declare const AuthApiRateLimitMiddlewareLive: Layer.Layer<AuthRateLimitMiddleware, never, AuthApiRateLimit>;
-export declare const AuthApiRateLimitLive: Layer.Layer<AuthApiRateLimit | AuthRateLimitMiddleware, never, Privacy | RateLimiter>;
-export declare const AuthApiRateLimitNoopLive: Layer.Layer<AuthApiRateLimit | AuthRateLimitMiddleware>;
 export declare const AuthOriginCheckMiddlewareLive: (options?: AuthOriginCheckOptions) => Layer.Layer<AuthOriginCheckMiddleware, never, never>;
 export declare const AuthOriginCheckMiddlewareConfigLive: Layer.Layer<AuthOriginCheckMiddleware, never, never>;
 export declare const AuthRequestMetadataMiddlewareLive: (options?: AuthRequestMetadataOptions) => Layer.Layer<AuthRequestMetadataMiddleware, never, never>;
-export declare const AuthRateLimitMiddlewareLive: (policy: AuthRateLimitPolicy, metadataOptions?: AuthRequestMetadataOptions) => Layer.Layer<AuthRateLimitMiddleware, never, Privacy | RateLimiter>;
 export declare const AuthCsrfMiddlewareLive: (options?: AuthCsrfOptions) => Layer.Layer<AuthCsrfMiddleware, never, never>;
-export {};
 //# sourceMappingURL=Security.d.ts.map

package/dist/HttpApi/Security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Security.d.ts","sourceRoot":"","sources":["../../src/HttpApi/Security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,QAAQ,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE7E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,KAAK,EACV,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAkB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAgB,WAAW,EAAmB,MAAM,mBAAmB,CAAC;AAC/E,OAAO,KAAK,EAEV,cAAc,EACd,eAAe,IAAI,oBAAoB,EACxC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACzB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACrD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC;CAClC;AAED,MAAM,MAAM,mBAAmB,GAAG,CAChC,KAAK,EAAE,wBAAwB,KAC5B,MAAM,CAAC,MAAM,CAAC,oBAAoB,GAAG,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AAE5E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,0BAA0B,GAAG,2BAA2B,GAAG,OAAO,CAAC;AAE/E,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,0BAA0B,CAAC;CAC/C;AAED,MAAM,MAAM,8BAA8B,GACtC,+BAA+B,GAC/B,OAAO,CAAC;AAEZ,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC;IACzD,QAAQ,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC;IACzD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,8BAA8B,CAAC;IAC7D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC;IAC9D,QAAQ,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC;IACxD,QAAQ,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC;IACzD,QAAQ,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC;IACzD,QAAQ,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC;IAC1D,QAAQ,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;CAClE;AAED,MAAM,MAAM,2BAA2B,GAAG,uBAAuB,GAAG,OAAO,CAAC;AAE5E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,0BAA0B,CAAC;CACvD;AAED,MAAM,MAAM,wBAAwB,GAAG,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;AAE7D,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CACnD,MAAM,CAAC,wBAAwB,EAAE,mBAAmB,GAAG,SAAS,CAAC,CAClE,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,CAChB,KAAK,EAAE,wBAAwB,KAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,CAAC,CAAC;IACxD,QAAQ,CAAC,cAAc,EAAE,CACvB,KAAK,EAAE,mBAAmB,KACvB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,CAAC,CAAC;IACxD,QAAQ,CAAC,cAAc,EAAE,CACvB,KAAK,EAAE,mBAAmB,KACvB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,CAAC,CAAC;IACxD,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,KAAK,EAAE,uBAAuB,KAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,CAAC,CAAC;IACxD,QAAQ,CAAC,aAAa,EAAE,CACtB,KAAK,EAAE,kBAAkB,KACtB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,CAAC,CAAC;IACxD,QAAQ,CAAC,cAAc,EAAE,CACvB,KAAK,EAAE,mBAAmB,KACvB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,CAAC,CAAC;IACxD,QAAQ,CAAC,sBAAsB,EAAE,CAC/B,KAAK,EAAE,2BAA2B,KAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,CAAC,CAAC;CACzD;;AAED,qBAAa,gBAAiB,SAAQ,qBAGV;CAAG;AAE/B,yBAAiB,gBAAgB,CAAC;IACzB,MAAM,IAAI,GACf,SAAS,uBAAuB,KAC/B,uBAAuD,CAAC;CAC5D;;AAED,qBAAa,iBAAkB,SAAQ,sBAGV;CAAG;AAEhC,yBAAiB,iBAAiB,CAAC;IAC1B,MAAM,IAAI,GACf,QAAQ,sBAAsB,KAC7B,sBAAsD,CAAC;CAC3D;;AAED,qBAAa,mBAAoB,SAAQ,wBAGV;CAAG;AAElC,yBAAiB,mBAAmB,CAAC;IAC5B,MAAM,IAAI,GACf,UAAU,wBAAwB,KACjC,wBAA4D,CAAC;CACjE;;;;;;;;;AAED,qBAAa,yBAA0B,SAAQ,8BAG9C;CAAG;;;;;;;;;AAEJ,qBAAa,6BAA8B,SAAQ,kCAGV;CAAG;;;;;;;;;AAE5C,qBAAa,uBAAwB,SAAQ,4BAG5C;CAAG;;;;;;;;;AAEJ,qBAAa,kBAAmB,SAAQ,uBAGvC;CAAG;AA4EJ,eAAO,MAAM,uBAAuB,GAClC,SAAS,iBAAiB,CAAC,iBAAiB,EAC5C,UAAS,0BAA+B,KACvC,wBAaF,CAAC;AAoFF,eAAO,MAAM,mBAAmB;wCAElB,wBAAwB,KAAG,mBAAmB;oCAoB7C,8BAA8B,KAAG,mBAAmB;CAIzD,CAAC;AAkcX,eAAO,MAAM,qBAAqB,GAAI,QAAQ,sBAAsB,iDACF,CAAC;AAiBnE,eAAO,MAAM,8BAA8B,+DA6B1C,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,KAAK,CAC5C,gBAAgB,GAAG,uBAAuB,EAC1C,KAAK,EACL,OAAO,GAAG,WAAW,CAMtB,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAChD,gBAAgB,GAAG,uBAAuB,CAI3C,CAAC;AAEF,eAAO,MAAM,6BAA6B,GACxC,UAAS,sBAA2B,yDAwBrC,CAAC;AAEF,eAAO,MAAM,mCAAmC,sDAS/C,CAAC;AAEF,eAAO,MAAM,iCAAiC,GAC5C,UAAS,0BAA+B,6DAavC,CAAC;AAEJ,eAAO,MAAM,2BAA2B,GACtC,QAAQ,mBAAmB,EAC3B,kBAAiB,0BAA+B,uEAkD/C,CAAC;AAEJ,eAAO,MAAM,sBAAsB,GAAI,UAAS,eAAoB,kDAoBnE,CAAC"}
+{"version":3,"file":"Security.d.ts","sourceRoot":"","sources":["../../src/HttpApi/Security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,QAAQ,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EACV,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACrD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,0BAA0B,CAAC;CACvD;;AAED,qBAAa,iBAAkB,SAAQ,sBAGV;CAAG;AAEhC,yBAAiB,iBAAiB,CAAC;IAC1B,MAAM,IAAI,WACP,sBAAsB,KAC7B,sBAAsD,CAAC;CAC3D;;AAED,qBAAa,mBAAoB,SAAQ,wBAGV;CAAG;AAElC,yBAAiB,mBAAmB,CAAC;IAC5B,MAAM,IAAI,aACL,wBAAwB,KACjC,wBAA4D,CAAC;CACjE;;;;;;;;;AAED,qBAAa,6BAA8B,SAAQ,kCAGV;CAAG;;;;;;;;;AAE5C,qBAAa,kBAAmB,SAAQ,uBAGvC;CAAG;AA4EJ,eAAO,MAAM,uBAAuB,YACzB,iBAAiB,CAAC,iBAAiB,YACnC,0BAA0B,KAClC,wBAaF,CAAC;AAaF,KAAK,iBAAiB,CAAC,CAAC,IAAI,CAAC,SAAS,sBAAsB,GACxD,oBAAoB,GACpB,CAAC,SACK,yBAAyB,GACzB,mBAAmB,GACnB,YAAY,GACZ,qBAAqB,GACrB,oBAAoB,GACxB,iBAAiB,GACjB,CAAC,SAAS,cAAc,GACtB,uBAAuB,GACvB,CAAC,SAAS,YAAY,GAAG,kBAAkB,GACzC,qBAAqB,GACrB,CAAC,CAAC;AAkBZ,eAAO,MAAM,+BAA+B,UACnC,OAAO,uBAEb,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,iBAAiB,CAAC,GAAG,SAmB5C,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,UAChC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CA6E1C,CAAC;AAoFF,eAAO,MAAM,qBAAqB,WAAY,sBAAsB,iDACF,CAAC;AAEnE,eAAO,MAAM,6BAA6B,aAC/B,sBAAsB,yDAwBhC,CAAC;AAEF,eAAO,MAAM,mCAAmC,sDAS/C,CAAC;AAEF,eAAO,MAAM,iCAAiC,aACnC,0BAA0B,6DAalC,CAAC;AAEJ,eAAO,MAAM,sBAAsB,aAAa,eAAe,kDAoB9D,CAAC"}

package/dist/HttpApi/Security.js

@@ -1,15 +1,11 @@
-import { Context, Duration, Effect, Layer, Option } from "effect";
+import { Context, Effect, Layer, Option } from "effect";
 import { HttpServerRequest } from "effect/unstable/http";
 import { HttpApiMiddleware } from "effect/unstable/httpapi";
+import { CustomEvidencePolicyError } from "../Assurance.js";
 import { IpAddress as makeIpAddress } from "../Identifiers.js";
-import { Privacy } from "../Privacy.js";
-import { RateLimitKey, RateLimiter, RateLimitPolicy } from "../RateLimiter.js";
-import { AuthInternalError, AuthRateLimitedError, AuthRequestRejectedError, } from "./Errors.js";
-export class AuthApiRateLimit extends Context.Service()("auth/AuthApiRateLimit") {
-}
-(function (AuthApiRateLimit) {
-    AuthApiRateLimit.make = (service) => AuthApiRateLimit.of(service);
-})(AuthApiRateLimit || (AuthApiRateLimit = {}));
+import { AuthPolicyDeniedError, AuthInternalError, AuthRateLimitedError, AuthRequestRejectedError, AuthStepUpRequiredError, } from "./Errors.js";
+import { AuthOriginCheckMiddleware } from "./Middleware.js";
+export { AuthOriginCheckMiddleware } from "./Middleware.js";
 export class AuthHttpApiConfig extends Context.Service()("auth/AuthHttpApiConfig") {
 }
 (function (AuthHttpApiConfig) {
@@ -20,12 +16,8 @@ export class AuthRequestMetadata extends Context.Service()("auth/AuthRequestMeta
 (function (AuthRequestMetadata) {
     AuthRequestMetadata.make = (metadata) => AuthRequestMetadata.of(metadata);
 })(AuthRequestMetadata || (AuthRequestMetadata = {}));
-export class AuthOriginCheckMiddleware extends HttpApiMiddleware.Service()("auth/AuthOriginCheckMiddleware", { error: AuthRequestRejectedError }) {
-}
 export class AuthRequestMetadataMiddleware extends HttpApiMiddleware.Service()("auth/AuthRequestMetadataMiddleware") {
 }
-export class AuthRateLimitMiddleware extends HttpApiMiddleware.Service()("auth/AuthRateLimitMiddleware", { error: [AuthRateLimitedError, AuthInternalError] }) {
-}
 export class AuthCsrfMiddleware extends HttpApiMiddleware.Service()("auth/AuthCsrfMiddleware", { error: AuthRequestRejectedError }) {
 }
 const unsafeMethods = new Set(["POST", "PUT", "PATCH", "DELETE"]);
@@ -93,6 +85,66 @@ export const makeAuthRequestMetadata = (request, options = {}) => {
         referer: firstHeaderValue(request.headers.referer),
     });
 };
+const findCustomEvidencePolicyError = (error) => {
+    if (error instanceof CustomEvidencePolicyError) {
+        return error;
+    }
+    if (typeof error !== "object" || error === null || !("cause" in error)) {
+        return undefined;
+    }
+    return error.cause instanceof CustomEvidencePolicyError
+        ? error.cause
+        : undefined;
+};
+export const customEvidencePolicyHttpFailure = (error, message = "Failed to evaluate authentication evidence policy") => {
+    const policyError = findCustomEvidencePolicyError(error);
+    if (policyError === undefined) {
+        return undefined;
+    }
+    return Effect.gen(function* () {
+        yield* Effect.annotateCurrentSpan({
+            "auth.custom_evidence_policy.reason": policyError.reason,
+            "auth.custom_evidence_policy.id": policyError.policyId,
+            "auth.custom_evidence_policy.version": policyError.policyVersion,
+        });
+        return yield* new AuthInternalError({
+            code: "internal_error",
+            message,
+        });
+    });
+};
+export const mapAuthGuardErrors = (effect) => {
+    const source = effect;
+    return source.pipe(Effect.catchTag("CustomEvidencePolicyError", (error) => customEvidencePolicyHttpFailure(error)), Effect.catchTag("RateLimitExceededError", (error) => Effect.fail(new AuthRateLimitedError({
+        code: "rate_limited",
+        message: "Too many requests",
+        retryAfter: error.retryAfter,
+    }))), Effect.catchTag("RateLimitStoreError", () => Effect.fail(new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to consume rate limit",
+    }))), Effect.catchTag("PrivacyError", () => Effect.fail(new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to build rate limit key",
+    }))), Effect.catchTag("StepUpRequired", (error) => Effect.fail(new AuthStepUpRequiredError({
+        code: "step_up_required",
+        message: "Step-up authentication required",
+        ...(error.capabilities === undefined
+            ? {}
+            : { capabilities: [...error.capabilities] }),
+    }))), Effect.catchTag("StepUpDenied", () => Effect.fail(new AuthPolicyDeniedError({
+        code: "policy_denied",
+        message: "Access denied",
+    }))), Effect.catchTag("StepUpCapabilityError", () => Effect.fail(new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to evaluate step-up capabilities",
+    }))), Effect.catchTag("AuthorizationError", () => Effect.fail(new AuthPolicyDeniedError({
+        code: "policy_denied",
+        message: "Access denied",
+    }))), Effect.catchTag("PermissionCheckError", () => Effect.fail(new AuthInternalError({
+        code: "internal_error",
+        message: "Failed to check permission policy",
+    }))));
+};
 const originFromReferer = (referer) => referer === undefined ? undefined : normalizeOrigin(referer);
 const requestOriginCandidates = (request) => {
     const originalOrigin = normalizeOrigin(request.originalUrl);
@@ -138,320 +190,7 @@ const csrfAllowed = (request, options) => {
         fromCookie.length > 0 &&
         fromCookie === fromHeader);
 };
-export const AuthRateLimitPolicy = {
-    fixedWindowByIp: (options) => (input) => Effect.gen(function* () {
-        const privacy = yield* Privacy;
-        const key = input.metadata.ipAddress === undefined
-            ? RateLimitKey.customHash("ip", "missing")
-            : RateLimitKey.ipHash(yield* privacy.ipHash(input.metadata.ipAddress));
-        return RateLimitPolicy.fixedWindow({
-            id: options.id,
-            key,
-            limit: options.limit,
-            tokens: options.tokens,
-            window: options.window,
-        });
-    }),
-    byEndpoint: (policies) => (input) => policies[`${input.group.identifier}.${input.endpoint.name}`]?.(input) ??
-        Effect.succeed(undefined),
-};
-const authApiRateLimitDefaults = {
-    trustProxyHeaders: false,
-    passwordSignIn: {
-        byIp: {
-            id: "auth.password.sign_in.ip",
-            limit: 20,
-            window: Duration.minutes(10),
-        },
-        byEmail: {
-            id: "auth.password.sign_in.email",
-            limit: 5,
-            window: Duration.minutes(10),
-        },
-    },
-    passwordSignUp: {
-        byIp: {
-            id: "auth.password.sign_up.ip",
-            limit: 10,
-            window: Duration.hours(1),
-        },
-        byEmail: {
-            id: "auth.password.sign_up.email",
-            limit: 3,
-            window: Duration.hours(1),
-        },
-    },
-    passwordResetStart: {
-        byIp: {
-            id: "auth.password.reset_start.ip",
-            limit: 10,
-            window: Duration.minutes(10),
-        },
-        byEmail: {
-            id: "auth.password.reset_start.email",
-            limit: 3,
-            window: Duration.minutes(10),
-        },
-    },
-    passwordResetVerify: {
-        byIp: {
-            id: "auth.password.reset_verify.ip",
-            limit: 20,
-            window: Duration.minutes(10),
-        },
-    },
-    emailOtpStart: {
-        byIp: {
-            id: "auth.email_otp.start.ip",
-            limit: 10,
-            window: Duration.minutes(10),
-        },
-        byEmail: {
-            id: "auth.email_otp.start.email",
-            limit: 5,
-            window: Duration.minutes(10),
-        },
-    },
-    emailOtpVerify: {
-        byIp: {
-            id: "auth.email_otp.verify.ip",
-            limit: 20,
-            window: Duration.minutes(10),
-        },
-    },
-    magicLinkStart: {
-        byIp: {
-            id: "auth.magic_link.start.ip",
-            limit: 10,
-            window: Duration.minutes(10),
-        },
-        byEmail: {
-            id: "auth.magic_link.start.email",
-            limit: 5,
-            window: Duration.minutes(10),
-        },
-    },
-    magicLinkVerify: {
-        byIp: {
-            id: "auth.magic_link.verify.ip",
-            limit: 20,
-            window: Duration.minutes(10),
-        },
-    },
-    emailVerificationStart: {
-        byIp: {
-            id: "auth.email_verification.start.ip",
-            limit: 10,
-            window: Duration.minutes(10),
-        },
-        byEmail: {
-            id: "auth.email_verification.start.email",
-            limit: 3,
-            window: Duration.minutes(10),
-        },
-    },
-};
-const resolveAuthApiRateLimitRule = (defaults, config) => {
-    if (config === false) {
-        return undefined;
-    }
-    if (config === undefined || config === true) {
-        return defaults;
-    }
-    return {
-        id: defaults.id,
-        limit: config.limit ?? defaults.limit,
-        tokens: config.tokens ?? defaults.tokens,
-        window: config.window ?? defaults.window,
-    };
-};
-const resolveAuthApiEndpointRateLimit = (defaults, config) => {
-    if (config === false) {
-        return undefined;
-    }
-    if (config === undefined || config === true) {
-        return defaults;
-    }
-    const byIp = defaults.byIp === undefined
-        ? undefined
-        : resolveAuthApiRateLimitRule(defaults.byIp, config.byIp);
-    const byEmail = defaults.byEmail === undefined
-        ? undefined
-        : resolveAuthApiRateLimitRule(defaults.byEmail, config.byEmail);
-    return byIp === undefined && byEmail === undefined
-        ? undefined
-        : { byIp, byEmail };
-};
-const resolveAuthApiRateLimitConfig = (config) => {
-    if (config === false) {
-        return undefined;
-    }
-    if (config === true) {
-        return authApiRateLimitDefaults;
-    }
-    return {
-        trustProxyHeaders: config.trustProxyHeaders ?? authApiRateLimitDefaults.trustProxyHeaders,
-        passwordSignIn: resolveAuthApiEndpointRateLimit(authApiRateLimitDefaults.passwordSignIn, config.passwordSignIn),
-        passwordSignUp: resolveAuthApiEndpointRateLimit(authApiRateLimitDefaults.passwordSignUp, config.passwordSignUp),
-        passwordResetStart: resolveAuthApiEndpointRateLimit(authApiRateLimitDefaults.passwordResetStart, config.passwordResetStart),
-        passwordResetVerify: resolveAuthApiEndpointRateLimit(authApiRateLimitDefaults.passwordResetVerify, config.passwordResetVerify),
-        emailOtpStart: resolveAuthApiEndpointRateLimit(authApiRateLimitDefaults.emailOtpStart, config.emailOtpStart),
-        emailOtpVerify: resolveAuthApiEndpointRateLimit(authApiRateLimitDefaults.emailOtpVerify, config.emailOtpVerify),
-        magicLinkStart: resolveAuthApiEndpointRateLimit(authApiRateLimitDefaults.magicLinkStart, config.magicLinkStart),
-        magicLinkVerify: resolveAuthApiEndpointRateLimit(authApiRateLimitDefaults.magicLinkVerify, config.magicLinkVerify),
-        emailVerificationStart: resolveAuthApiEndpointRateLimit(authApiRateLimitDefaults.emailVerificationStart, config.emailVerificationStart),
-    };
-};
-const makeRateLimitPolicy = (rule, key) => RateLimitPolicy.fixedWindow({
-    id: rule.id,
-    key,
-    limit: rule.limit,
-    tokens: rule.tokens,
-    window: rule.window,
-});
-const endpointKey = (input) => `${input.group.identifier}.${input.endpoint.name}`;
-const requestIpRuleByEndpoint = new Map([
-    ["password.signIn", (config) => config.passwordSignIn?.byIp],
-    ["password.signUp", (config) => config.passwordSignUp?.byIp],
-    ["password.resetStart", (config) => config.passwordResetStart?.byIp],
-    ["password.resetVerify", (config) => config.passwordResetVerify?.byIp],
-    ["emailOtp.start", (config) => config.emailOtpStart?.byIp],
-    ["emailOtp.verify", (config) => config.emailOtpVerify?.byIp],
-    ["magicLink.start", (config) => config.magicLinkStart?.byIp],
-    ["magicLink.verify", (config) => config.magicLinkVerify?.byIp],
-    [
-        "emailVerification.start",
-        (config) => config.emailVerificationStart?.byIp,
-    ],
-]);
-const requestIpRule = (config, input) => config === undefined
-    ? undefined
-    : requestIpRuleByEndpoint.get(endpointKey(input))?.(config);
-const ipRateLimitKey = (privacy, metadata) => metadata.ipAddress === undefined
-    ? Effect.succeed(RateLimitKey.customHash("ip", "missing"))
-    : Effect.map(privacy.ipHash(metadata.ipAddress), RateLimitKey.ipHash);
-const consumeRule = (rateLimiter, rule, key) => rateLimiter.require(makeRateLimitPolicy(rule, key));
-const authApiRateLimitConfig = Effect.gen(function* () {
-    const configOption = yield* Effect.serviceOption(AuthHttpApiConfig);
-    const config = Option.isSome(configOption)
-        ? (configOption.value.rateLimit ?? true)
-        : true;
-    return resolveAuthApiRateLimitConfig(config);
-});
-const noopAuthApiRateLimit = AuthApiRateLimit.make({
-    request: () => Effect.void,
-    passwordSignIn: () => Effect.void,
-    passwordSignUp: () => Effect.void,
-    passwordResetStart: () => Effect.void,
-    emailOtpStart: () => Effect.void,
-    magicLinkStart: () => Effect.void,
-    emailVerificationStart: () => Effect.void,
-});
-const makeAuthApiRateLimit = (config, dependencies) => {
-    if (config === undefined) {
-        return noopAuthApiRateLimit;
-    }
-    return AuthApiRateLimit.make({
-        request: (input) => Effect.gen(function* () {
-            const rule = requestIpRule(config, input);
-            if (rule === undefined) {
-                return;
-            }
-            const key = yield* ipRateLimitKey(dependencies.privacy, input.metadata);
-            yield* consumeRule(dependencies.rateLimiter, rule, key);
-        }),
-        passwordSignIn: (input) => Effect.gen(function* () {
-            const rule = config.passwordSignIn?.byEmail;
-            if (rule === undefined) {
-                return;
-            }
-            const emailHash = yield* dependencies.privacy.emailHash(input.email);
-            yield* consumeRule(dependencies.rateLimiter, rule, RateLimitKey.emailHash(emailHash));
-        }),
-        passwordSignUp: (input) => Effect.gen(function* () {
-            const rule = config.passwordSignUp?.byEmail;
-            if (rule === undefined) {
-                return;
-            }
-            const emailHash = yield* dependencies.privacy.emailHash(input.email);
-            yield* consumeRule(dependencies.rateLimiter, rule, RateLimitKey.emailHash(emailHash));
-        }),
-        passwordResetStart: (input) => Effect.gen(function* () {
-            const rule = config.passwordResetStart?.byEmail;
-            if (rule === undefined) {
-                return;
-            }
-            const emailHash = yield* dependencies.privacy.emailHash(input.email);
-            yield* consumeRule(dependencies.rateLimiter, rule, RateLimitKey.emailHash(emailHash));
-        }),
-        emailOtpStart: (input) => Effect.gen(function* () {
-            const rule = config.emailOtpStart?.byEmail;
-            if (rule === undefined) {
-                return;
-            }
-            const emailHash = yield* dependencies.privacy.emailHash(input.email);
-            yield* consumeRule(dependencies.rateLimiter, rule, RateLimitKey.emailHash(emailHash));
-        }),
-        magicLinkStart: (input) => Effect.gen(function* () {
-            const rule = config.magicLinkStart?.byEmail;
-            if (rule === undefined) {
-                return;
-            }
-            const emailHash = yield* dependencies.privacy.emailHash(input.email);
-            yield* consumeRule(dependencies.rateLimiter, rule, RateLimitKey.emailHash(emailHash));
-        }),
-        emailVerificationStart: (input) => Effect.gen(function* () {
-            const rule = config.emailVerificationStart?.byEmail;
-            if (rule === undefined) {
-                return;
-            }
-            const emailHash = yield* dependencies.privacy.emailHash(input.email);
-            yield* consumeRule(dependencies.rateLimiter, rule, RateLimitKey.emailHash(emailHash));
-        }),
-    });
-};
-const rateLimitMiddlewareError = (effect) => effect.pipe(Effect.catchTag("RateLimitExceededError", (error) => Effect.fail(new AuthRateLimitedError({
-    code: "rate_limited",
-    message: "Too many requests",
-    retryAfter: error.retryAfter,
-}))), Effect.catchTag("RateLimitStoreError", () => Effect.fail(new AuthInternalError({
-    code: "internal_error",
-    message: "Failed to consume rate limit",
-}))), Effect.catchTag("PrivacyError", () => Effect.fail(new AuthInternalError({
-    code: "internal_error",
-    message: "Failed to build rate limit key",
-}))));
 export const AuthHttpApiConfigLive = (config) => Layer.succeed(AuthHttpApiConfig, AuthHttpApiConfig.make(config));
-const AuthApiRateLimitServiceLive = Layer.effect(AuthApiRateLimit)(Effect.gen(function* () {
-    const config = yield* authApiRateLimitConfig;
-    if (config === undefined) {
-        return noopAuthApiRateLimit;
-    }
-    const privacy = yield* Privacy;
-    const rateLimiter = yield* RateLimiter;
-    return makeAuthApiRateLimit(config, { privacy, rateLimiter });
-}));
-export const AuthApiRateLimitMiddlewareLive = Layer.effect(AuthRateLimitMiddleware)(Effect.gen(function* () {
-    const config = yield* authApiRateLimitConfig;
-    const authApiRateLimit = yield* AuthApiRateLimit;
-    if (config === undefined) {
-        return (httpEffect) => httpEffect;
-    }
-    return (httpEffect, options) => Effect.gen(function* () {
-        const request = yield* HttpServerRequest.HttpServerRequest;
-        const metadata = makeAuthRequestMetadata(request, {
-            trustProxyHeaders: config.trustProxyHeaders,
-        });
-        yield* rateLimitMiddlewareError(authApiRateLimit.request({
-            metadata,
-            endpoint: options.endpoint,
-            group: options.group,
-        }));
-        return yield* httpEffect;
-    });
-}));
-export const AuthApiRateLimitLive = Layer.merge(AuthApiRateLimitServiceLive, AuthApiRateLimitMiddlewareLive.pipe(Layer.provide(AuthApiRateLimitServiceLive)));
-export const AuthApiRateLimitNoopLive = Layer.merge(Layer.succeed(AuthApiRateLimit, noopAuthApiRateLimit), Layer.succeed(AuthRateLimitMiddleware, (httpEffect) => httpEffect));
 export const AuthOriginCheckMiddlewareLive = (options = {}) => {
     const allowedOrigins = new Set(allowedOriginValues(options.allowedOrigins).flatMap((origin) => {
         const normalized = normalizeOrigin(origin);
@@ -481,36 +220,6 @@ export const AuthRequestMetadataMiddlewareLive = (options = {}) => Layer.succeed
     const metadata = makeAuthRequestMetadata(request, options);
     return yield* Effect.provideService(httpEffect, AuthRequestMetadata, metadata);
 }));
-export const AuthRateLimitMiddlewareLive = (policy, metadataOptions = {}) => Layer.effect(AuthRateLimitMiddleware, Effect.gen(function* () {
-    const rateLimiter = yield* RateLimiter;
-    const privacy = yield* Privacy;
-    return (httpEffect, options) => Effect.gen(function* () {
-        const request = yield* HttpServerRequest.HttpServerRequest;
-        const metadata = makeAuthRequestMetadata(request, metadataOptions);
-        const rateLimitPolicy = yield* policy({
-            metadata,
-            endpoint: options.endpoint,
-            group: options.group,
-        }).pipe(Effect.provideService(Privacy, privacy), Effect.mapError(() => new AuthInternalError({
-            code: "internal_error",
-            message: "Failed to build rate limit policy",
-        })));
-        if (rateLimitPolicy !== undefined) {
-            const decision = yield* rateLimiter.consume(rateLimitPolicy).pipe(Effect.mapError(() => new AuthInternalError({
-                code: "internal_error",
-                message: "Failed to consume rate limit",
-            })));
-            if (decision.type === "denied") {
-                return yield* new AuthRateLimitedError({
-                    code: "rate_limited",
-                    message: "Too many requests",
-                    retryAfter: decision.retryAfter,
-                });
-            }
-        }
-        return yield* httpEffect;
-    });
-}));
 export const AuthCsrfMiddlewareLive = (options = {}) => {
     const resolved = {
         cookieName: options.cookieName ?? "__Host-csrf",