@entifix/testing-auth 0.1.0-0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 r10c Technologies
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from './stub-layers.js';
+export * from './stub-principal.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export * from './stub-layers.js';
+export * from './stub-principal.js';
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './stub-layers.js';\nexport * from './stub-principal.js';\n"],"names":[],"mappings":"AAAA,cAAc,mBAAmB;AACjC,cAAc,sBAAsB"}

package/dist/stub-layers.d.ts

@@ -0,0 +1,22 @@
+import type { PolicyDecision } from '@entifix/authz';
+import { PolicyDecisionTag } from '@entifix/authz';
+import type { TokenClaims, TokenService } from '@entifix/business';
+import { TokenServiceTag } from '@entifix/business';
+import { Layer } from 'effect';
+/**
+ * A `TokenService` that trusts every token and answers with fixed claims.
+ *
+ * ⚠️ **This is the whole reason the package is `type:testing`.** `verify` does
+ * not check a signature, so wiring this into anything reachable from a network
+ * is an open door. It exists so an example can serve `$metadata` without an
+ * identity provider — and it does that by replacing the *port*, not by adding
+ * an unauthenticated branch to `entity-metadata-route.ts`. ADR 0026's point is
+ * that the descriptor is filtered by the verified principal; a hole punched in
+ * the route for a demo would become the adoption pattern.
+ */
+export declare const makeFixedTokenService: (claims?: TokenClaims) => TokenService;
+export declare const FixedTokenServiceLayer: (claims?: TokenClaims) => Layer.Layer<TokenServiceTag>;
+/** A `PolicyDecision` that grants every request. */
+export declare const AllowAllPolicy: PolicyDecision;
+export declare const AllowAllPolicyLayer: Layer.Layer<PolicyDecisionTag>;
+//# sourceMappingURL=stub-layers.d.ts.map

package/dist/stub-layers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stub-layers.d.ts","sourceRoot":"","sources":["../src/stub-layers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAC;AAIvC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GAChC,SAAQ,WAAyB,KAChC,YAKD,CAAC;AAEH,eAAO,MAAM,sBAAsB,GACjC,SAAQ,WAAyB,KAChC,KAAK,CAAC,KAAK,CAAC,eAAe,CACiC,CAAC;AAEhE,oDAAoD;AACpD,eAAO,MAAM,cAAc,EAAE,cAAuC,CAAC;AAErE,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,CACb,CAAC"}

package/dist/stub-layers.js

@@ -0,0 +1,27 @@
+import { PolicyDecisionTag } from '@entifix/authz';
+import { TokenServiceTag } from '@entifix/business';
+import { Effect, Layer } from 'effect';
+import { STUB_CLAIMS, stubAccessToken } from './stub-principal.js';
+/**
+ * A `TokenService` that trusts every token and answers with fixed claims.
+ *
+ * ⚠️ **This is the whole reason the package is `type:testing`.** `verify` does
+ * not check a signature, so wiring this into anything reachable from a network
+ * is an open door. It exists so an example can serve `$metadata` without an
+ * identity provider — and it does that by replacing the *port*, not by adding
+ * an unauthenticated branch to `entity-metadata-route.ts`. ADR 0026's point is
+ * that the descriptor is filtered by the verified principal; a hole punched in
+ * the route for a demo would become the adoption pattern.
+ */ export const makeFixedTokenService = (claims = STUB_CLAIMS)=>({
+        // A stub token carries its own `exp`, so the requested lifetime is not read;
+        // and `verify` ignores the token by design — see the note above.
+        sign: (signed)=>Effect.succeed(stubAccessToken(signed)),
+        verify: ()=>Effect.succeed(claims)
+    });
+export const FixedTokenServiceLayer = (claims = STUB_CLAIMS)=>Layer.succeed(TokenServiceTag, makeFixedTokenService(claims));
+/** A `PolicyDecision` that grants every request. */ export const AllowAllPolicy = {
+    decide: ()=>true
+};
+export const AllowAllPolicyLayer = Layer.succeed(PolicyDecisionTag, AllowAllPolicy);
+
+//# sourceMappingURL=stub-layers.js.map

package/dist/stub-layers.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/stub-layers.ts"],"sourcesContent":["import type { PolicyDecision } from '@entifix/authz';\nimport { PolicyDecisionTag } from '@entifix/authz';\nimport type { TokenClaims, TokenService } from '@entifix/business';\nimport { TokenServiceTag } from '@entifix/business';\nimport { Effect, Layer } from 'effect';\n\nimport { STUB_CLAIMS, stubAccessToken } from './stub-principal.js';\n\n/**\n * A `TokenService` that trusts every token and answers with fixed claims.\n *\n * ⚠️ **This is the whole reason the package is `type:testing`.** `verify` does\n * not check a signature, so wiring this into anything reachable from a network\n * is an open door. It exists so an example can serve `$metadata` without an\n * identity provider — and it does that by replacing the *port*, not by adding\n * an unauthenticated branch to `entity-metadata-route.ts`. ADR 0026's point is\n * that the descriptor is filtered by the verified principal; a hole punched in\n * the route for a demo would become the adoption pattern.\n */\nexport const makeFixedTokenService = (\n  claims: TokenClaims = STUB_CLAIMS,\n): TokenService => ({\n  // A stub token carries its own `exp`, so the requested lifetime is not read;\n  // and `verify` ignores the token by design — see the note above.\n  sign: signed => Effect.succeed(stubAccessToken(signed)),\n  verify: () => Effect.succeed(claims),\n});\n\nexport const FixedTokenServiceLayer = (\n  claims: TokenClaims = STUB_CLAIMS,\n): Layer.Layer<TokenServiceTag> =>\n  Layer.succeed(TokenServiceTag, makeFixedTokenService(claims));\n\n/** A `PolicyDecision` that grants every request. */\nexport const AllowAllPolicy: PolicyDecision = { decide: () => true };\n\nexport const AllowAllPolicyLayer: Layer.Layer<PolicyDecisionTag> =\n  Layer.succeed(PolicyDecisionTag, AllowAllPolicy);\n"],"names":["PolicyDecisionTag","TokenServiceTag","Effect","Layer","STUB_CLAIMS","stubAccessToken","makeFixedTokenService","claims","sign","signed","succeed","verify","FixedTokenServiceLayer","AllowAllPolicy","decide","AllowAllPolicyLayer"],"mappings":"AACA,SAASA,iBAAiB,QAAQ,iBAAiB;AAEnD,SAASC,eAAe,QAAQ,oBAAoB;AACpD,SAASC,MAAM,EAAEC,KAAK,QAAQ,SAAS;AAEvC,SAASC,WAAW,EAAEC,eAAe,QAAQ,sBAAsB;AAEnE;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,wBAAwB,CACnCC,SAAsBH,WAAW,GACf,CAAA;QAClB,6EAA6E;QAC7E,iEAAiE;QACjEI,MAAMC,CAAAA,SAAUP,OAAOQ,OAAO,CAACL,gBAAgBI;QAC/CE,QAAQ,IAAMT,OAAOQ,OAAO,CAACH;IAC/B,CAAA,EAAG;AAEH,OAAO,MAAMK,yBAAyB,CACpCL,SAAsBH,WAAW,GAEjCD,MAAMO,OAAO,CAACT,iBAAiBK,sBAAsBC,SAAS;AAEhE,kDAAkD,GAClD,OAAO,MAAMM,iBAAiC;IAAEC,QAAQ,IAAM;AAAK,EAAE;AAErE,OAAO,MAAMC,sBACXZ,MAAMO,OAAO,CAACV,mBAAmBa,gBAAgB"}

package/dist/stub-principal.d.ts

@@ -0,0 +1,34 @@
+import type { TokenClaims } from '@entifix/business';
+/**
+ * The principal a stubbed application runs as when nobody configured one.
+ *
+ * `admin` rather than something narrower, because the point of the stub is to
+ * let someone see entifix working before they decide how identity works for
+ * them — a stub that hid half the screens would be demonstrating its own
+ * restrictions, not the framework.
+ */
+export declare const STUB_CLAIMS: TokenClaims;
+/**
+ * A structurally valid, **deliberately unsigned** access token for these claims.
+ *
+ * The same shape `@entifix/testing-e2e`'s `seedSession` fabricates, so the two
+ * never disagree about what a seeded session looks like. Only
+ * {@link makeFixedTokenService} will accept it; a real `TokenService` rejects
+ * the signature, which is the property that keeps a stub out of production.
+ */
+export declare const stubAccessToken: (claims?: TokenClaims) => string;
+/**
+ * The cookie to set so an application sees a signed-in session.
+ *
+ * ⚠️ **The real cookie, not a bypass.** The stub mints into `entifix_at`, the
+ * cookie every entifix reader already looks for, so the middleware's presence
+ * check, the Next shell's bearer forwarding and the service shell's
+ * `requirePrincipal` all run exactly as they do for a real user. A stub that
+ * skipped the cookie path would leave that path proven by nothing but the one
+ * application that happens to have an identity provider.
+ */
+export declare const stubSessionCookie: (claims?: TokenClaims) => {
+    readonly name: string;
+    readonly value: string;
+};
+//# sourceMappingURL=stub-principal.d.ts.map

package/dist/stub-principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stub-principal.d.ts","sourceRoot":"","sources":["../src/stub-principal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,EAAE,WAKzB,CAAC;AASF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,GAAI,SAAQ,WAAyB,KAAG,MAQnE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAC5B,SAAQ,WAAyB,KAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAGhD,CAAC"}

package/dist/stub-principal.js

@@ -0,0 +1,51 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { ACCESS_COOKIE } from '@entifix/core';
+/**
+ * The principal a stubbed application runs as when nobody configured one.
+ *
+ * `admin` rather than something narrower, because the point of the stub is to
+ * let someone see entifix working before they decide how identity works for
+ * them — a stub that hid half the screens would be demonstrating its own
+ * restrictions, not the framework.
+ */ export const STUB_CLAIMS = {
+    userId: 'stub-user',
+    subject: 'stub-user',
+    sessionId: 'stub-session',
+    roles: [
+        'admin'
+    ]
+};
+const base64url = (value)=>Buffer.from(value).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+/**
+ * A structurally valid, **deliberately unsigned** access token for these claims.
+ *
+ * The same shape `@entifix/testing-e2e`'s `seedSession` fabricates, so the two
+ * never disagree about what a seeded session looks like. Only
+ * {@link makeFixedTokenService} will accept it; a real `TokenService` rejects
+ * the signature, which is the property that keeps a stub out of production.
+ */ export const stubAccessToken = (claims = STUB_CLAIMS)=>{
+    const header = base64url(JSON.stringify({
+        alg: 'RS256',
+        kid: 'entifix-stub',
+        typ: 'JWT'
+    }));
+    const payload = base64url(JSON.stringify(_extends({}, claims, {
+        exp: Math.floor(Date.now() / 1000) + 3600
+    })));
+    return `${header}.${payload}.entifix-stub-not-a-signature`;
+};
+/**
+ * The cookie to set so an application sees a signed-in session.
+ *
+ * ⚠️ **The real cookie, not a bypass.** The stub mints into `entifix_at`, the
+ * cookie every entifix reader already looks for, so the middleware's presence
+ * check, the Next shell's bearer forwarding and the service shell's
+ * `requirePrincipal` all run exactly as they do for a real user. A stub that
+ * skipped the cookie path would leave that path proven by nothing but the one
+ * application that happens to have an identity provider.
+ */ export const stubSessionCookie = (claims = STUB_CLAIMS)=>({
+        name: ACCESS_COOKIE,
+        value: stubAccessToken(claims)
+    });
+
+//# sourceMappingURL=stub-principal.js.map

package/dist/stub-principal.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/stub-principal.ts"],"sourcesContent":["import type { TokenClaims } from '@entifix/business';\nimport { ACCESS_COOKIE } from '@entifix/core';\n\n/**\n * The principal a stubbed application runs as when nobody configured one.\n *\n * `admin` rather than something narrower, because the point of the stub is to\n * let someone see entifix working before they decide how identity works for\n * them — a stub that hid half the screens would be demonstrating its own\n * restrictions, not the framework.\n */\nexport const STUB_CLAIMS: TokenClaims = {\n  userId: 'stub-user',\n  subject: 'stub-user',\n  sessionId: 'stub-session',\n  roles: ['admin'],\n};\n\nconst base64url = (value: string): string =>\n  Buffer.from(value)\n    .toString('base64')\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\n/**\n * A structurally valid, **deliberately unsigned** access token for these claims.\n *\n * The same shape `@entifix/testing-e2e`'s `seedSession` fabricates, so the two\n * never disagree about what a seeded session looks like. Only\n * {@link makeFixedTokenService} will accept it; a real `TokenService` rejects\n * the signature, which is the property that keeps a stub out of production.\n */\nexport const stubAccessToken = (claims: TokenClaims = STUB_CLAIMS): string => {\n  const header = base64url(\n    JSON.stringify({ alg: 'RS256', kid: 'entifix-stub', typ: 'JWT' }),\n  );\n  const payload = base64url(\n    JSON.stringify({ ...claims, exp: Math.floor(Date.now() / 1000) + 3600 }),\n  );\n  return `${header}.${payload}.entifix-stub-not-a-signature`;\n};\n\n/**\n * The cookie to set so an application sees a signed-in session.\n *\n * ⚠️ **The real cookie, not a bypass.** The stub mints into `entifix_at`, the\n * cookie every entifix reader already looks for, so the middleware's presence\n * check, the Next shell's bearer forwarding and the service shell's\n * `requirePrincipal` all run exactly as they do for a real user. A stub that\n * skipped the cookie path would leave that path proven by nothing but the one\n * application that happens to have an identity provider.\n */\nexport const stubSessionCookie = (\n  claims: TokenClaims = STUB_CLAIMS,\n): { readonly name: string; readonly value: string } => ({\n  name: ACCESS_COOKIE,\n  value: stubAccessToken(claims),\n});\n"],"names":["ACCESS_COOKIE","STUB_CLAIMS","userId","subject","sessionId","roles","base64url","value","Buffer","from","toString","replace","stubAccessToken","claims","header","JSON","stringify","alg","kid","typ","payload","exp","Math","floor","Date","now","stubSessionCookie","name"],"mappings":";AACA,SAASA,aAAa,QAAQ,gBAAgB;AAE9C;;;;;;;CAOC,GACD,OAAO,MAAMC,cAA2B;IACtCC,QAAQ;IACRC,SAAS;IACTC,WAAW;IACXC,OAAO;QAAC;KAAQ;AAClB,EAAE;AAEF,MAAMC,YAAY,CAACC,QACjBC,OAAOC,IAAI,CAACF,OACTG,QAAQ,CAAC,UACTC,OAAO,CAAC,OAAO,KACfA,OAAO,CAAC,OAAO,KACfA,OAAO,CAAC,OAAO;AAEpB;;;;;;;CAOC,GACD,OAAO,MAAMC,kBAAkB,CAACC,SAAsBZ,WAAW;IAC/D,MAAMa,SAASR,UACbS,KAAKC,SAAS,CAAC;QAAEC,KAAK;QAASC,KAAK;QAAgBC,KAAK;IAAM;IAEjE,MAAMC,UAAUd,UACdS,KAAKC,SAAS,CAAC,aAAKH;QAAQQ,KAAKC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK,QAAQ;;IAEnE,OAAO,GAAGX,OAAO,CAAC,EAAEM,QAAQ,6BAA6B,CAAC;AAC5D,EAAE;AAEF;;;;;;;;;CASC,GACD,OAAO,MAAMM,oBAAoB,CAC/Bb,SAAsBZ,WAAW,GACsB,CAAA;QACvD0B,MAAM3B;QACNO,OAAOK,gBAAgBC;IACzB,CAAA,EAAG"}

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@entifix/testing-auth",
+  "version": "0.1.0-0",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/r10c-technologies/entifix.git",
+    "directory": "packages/ts/testing-auth"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "!**/*.tsbuildinfo",
+    "LICENSE"
+  ],
+  "type": "module",
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "@entifix/source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "nx": {
+    "tags": [
+      "layer:entifix",
+      "scope:shared",
+      "type:testing",
+      "tier:5"
+    ],
+    "sourceRoot": "packages/ts/testing-auth/src",
+    "targets": {
+      "build": {
+        "executor": "@nx/js:swc",
+        "outputs": [
+          "{options.outputPath}"
+        ],
+        "options": {
+          "outputPath": "packages/ts/testing-auth/dist",
+          "main": "packages/ts/testing-auth/src/index.ts",
+          "tsConfig": "packages/ts/testing-auth/tsconfig.lib.json",
+          "skipTypeCheck": true,
+          "stripLeadingPaths": true
+        }
+      }
+    }
+  },
+  "dependencies": {
+    "@swc/helpers": "0.5.23",
+    "@entifix/authz": "0.1.0-0",
+    "@entifix/core": "0.1.0-0",
+    "@entifix/business": "0.1.0-0"
+  },
+  "peerDependencies": {
+    "effect": ">=3.22 <4"
+  },
+  "devDependencies": {
+    "effect": "3.22.1"
+  }
+}