@fitzzero/quickdraw-core 5.1.1 → 5.1.3

package/dist/{admin-DKwkIh5i.d.ts → admin-CS7JB_UH.d.ts}

@@ -1,5 +1,5 @@
-import { e as StandardSchemaWithJSON, d as StandardSchemaV1, I as InferInput, c as InferOutput, X as RowSchema, Q as QueryDef, P as ProjectionList, p as MutationDef, J as AnyContract, ap as MethodName } from './infer-Teo1xpsd.js';
-import { d as ListSort, c as ListQuery, b as ListPage, D as AdminWritable, u as AdminListInput, v as AdminListQuery, y as AdminPage, r as AdminCreateInput, s as AdminCreateQuery, B as AdminUpdateInput, C as AdminUpdateQuery, w as AdminMetaInput, n as AdminServiceMeta, z as AdminSubscribers } from './adminSchemas-2DUA_hZ8.js';
+import { e as StandardSchemaWithJSON, d as StandardSchemaV1, I as InferInput, c as InferOutput, X as RowSchema, Q as QueryDef, P as ProjectionList, p as MutationDef, J as AnyContract, ap as MethodName } from './infer-Br62cnyW.js';
+import { d as ListSort, c as ListQuery, b as ListPage, D as AdminWritable, u as AdminListInput, v as AdminListQuery, y as AdminPage, r as AdminCreateInput, s as AdminCreateQuery, B as AdminUpdateInput, C as AdminUpdateQuery, w as AdminMetaInput, n as AdminServiceMeta, z as AdminSubscribers } from './adminSchemas-29cGgrg5.js';
 
 /** A schema a kit generates: validation, and its JSON Schema. */
 type KitSchema<Input, Output = Input> = StandardSchemaWithJSON<Input, Output>;

package/dist/{adminSchemas-2DUA_hZ8.d.ts → adminSchemas-29cGgrg5.d.ts}

@@ -1,4 +1,4 @@
-import { z as SortDirection, A as AccessLevel } from './infer-Teo1xpsd.js';
+import { z as SortDirection, A as AccessLevel } from './infer-Br62cnyW.js';
 
 /** `list`'s page size when the caller gives none. */
 declare const LIST_DEFAULT_LIMIT = 50;
@@ -111,9 +111,11 @@ interface AdminFieldConfig {
     readonly relationService?: string;
     /**
      * What the field holds, when the kit knows it: `"grants"` for a user's
-     * service-wide grants (`serviceAccess`), which `admin.handlers(contract,
-     * { grants: true })` shows. An admin screen with a grants editor of its own
-     * finds that field by it, never by its name. Absent for any other field.
+     * service-wide grants (`serviceAccess`, or the column the server's
+     * `auth.serviceAccessSource` names, whatever its name), which
+     * `admin.handlers(contract, { grants: true })` shows. An admin screen with
+     * a grants editor of its own finds that field by it, never by its name.
+     * Absent for any other field.
      */
     readonly kind?: "grants";
     /**

package/dist/{auth-BhWqdyb-.d.ts → auth-DtdYjrZ9.d.ts}

@@ -1,7 +1,7 @@
 import { IncomingMessage, IncomingHttpHeaders } from 'node:http';
 import { Socket } from 'socket.io';
-import { A as AccessLevel } from './infer-Teo1xpsd.js';
-import { P as Principal, M as MaybePromise } from './types-Cu0vmx7c.js';
+import { A as AccessLevel } from './infer-Br62cnyW.js';
+import { P as Principal, M as MaybePromise } from './types-CLRCQGnO.js';
 
 /**
  * A request as Express leaves it: maybe with `body` from `express.json()`,
@@ -13,10 +13,13 @@ type HttpRequest = IncomingMessage & {
     readonly secure?: unknown;
 };
 /**
- * Where an HTTP call's token came from. `"cookie"`: the session cookie, which
- * a browser sends with a request any page makes, so whoever accepts it checks
- * the request's `Origin` (`socketAuth` does). `"bearer"`: an
- * `Authorization: Bearer` header, which a page sends only on purpose.
+ * The credential the HTTP transport chose for a call (the cookie first).
+ * `"cookie"`: the session cookie, which a browser sends with a request any
+ * page makes, so whoever accepts it checks the request's `Origin`
+ * (`socketAuth` does). `"bearer"`: an `Authorization: Bearer` header, which a
+ * page sends only on purpose. For an `authenticate` `socketAuth` did not
+ * make, `auth.token` holds the bearer token alone, even when this says
+ * `"cookie"`; the cookie is `request.sessionCookie`.
  */
 type HttpCredentialSource = "cookie" | "bearer";
 
@@ -26,7 +29,10 @@ interface AuthenticateRequestBase {
     /**
      * The credentials. For a socket, its handshake `auth` as the client sent
      * it (`{ token, qd }` from a v5 client). For an HTTP request, `{ token }`
-     * with its session cookie or bearer token, or `{}` when it has neither.
+     * with its bearer token, or `{}` without one; for `socketAuth`'s
+     * `authenticate` alone, the session cookie when the request carries one,
+     * else the bearer token. Every other `authenticate` finds the cookie only
+     * in `sessionCookie`.
      */
     readonly auth: Readonly<Record<string, unknown>>;
     /** The request's headers, or the socket handshake's. */
@@ -42,13 +48,23 @@ interface HttpAuthenticateRequest extends AuthenticateRequestBase {
     readonly transport: "http";
     readonly req: IncomingMessage;
     /**
-     * Where `auth.token` came from (finding F7.1): `"cookie"`, the session
-     * cookie, which a browser sends with a request any page makes, so an
-     * `authenticate` that accepts it checks the request's `Origin` as
-     * `socketAuth` does; `"bearer"`, an `Authorization: Bearer` header, which
-     * a page sends only on purpose. Absent without a token.
+     * The credential the transport chose (finding F7.1): `"cookie"` when the
+     * request carries the session cookie, which a browser sends with a
+     * request any page makes, so an `authenticate` that accepts it checks the
+     * request's `Origin` as `socketAuth` does; else `"bearer"` for an
+     * `Authorization: Bearer` header, which a page sends only on purpose.
+     * Absent with neither.
      */
     readonly credential?: HttpCredentialSource;
+    /**
+     * The session cookie's value, when the request carries one. It is
+     * ambient (a browser sends it with a request any page makes), so an
+     * `authenticate` that accepts it first checks
+     * `cookieOriginAllowed(request, allowedOrigins)`, then the session store,
+     * on every call (`liveSession`). It is in `auth.token` only for
+     * `socketAuth`'s `authenticate`.
+     */
+    readonly sessionCookie?: string;
 }
 /** What `authenticate` is asked about: a socket connecting, or an HTTP call. */
 type AuthenticateRequest = SocketAuthenticateRequest | HttpAuthenticateRequest;
@@ -64,11 +80,15 @@ type AuthenticateResult<P extends Principal> = P | ({
 interface ServerAuth<P extends Principal = Principal> {
     /**
      * Says who is calling. Throwing refuses the socket connection ("Authentication
-     * failed", with `{ code: "UNAUTHENTICATED" }` as the `connect_error` data) or
-     * answers the HTTP call with `UNAUTHENTICATED`; returning nothing lets the
-     * caller in anonymously, so only `"public"` methods pass. Throw a
-     * `QuickdrawError("UNAUTHENTICATED", ...)` for a refusal that is the
-     * caller's doing (it logs at debug; anything else thrown logs at error).
+     * failed") or answers the HTTP call with `UNAUTHENTICATED`; returning
+     * nothing lets the caller in anonymously, so only `"public"` methods pass.
+     * Throw a `QuickdrawError("UNAUTHENTICATED", ...)` (or `"FORBIDDEN"`) for a
+     * refusal that is the caller's doing: it logs at debug, and a socket's
+     * `connect_error` data is `{ code: "UNAUTHENTICATED" }`, which signs a
+     * client out. Anything else thrown is the server's failure (its session
+     * store down, say): it logs at error, and the data is `{ code: "INTERNAL" }`,
+     * which a client retries, keeping the user, so never throw a plain `Error`
+     * for bad credentials.
      * On an HTTP call a thrown `QuickdrawError("FORBIDDEN", ...)` is answered
      * as it is, with 403 (logged at debug): a credential the request may not
      * use from where it came, as `socketAuth` answers a session cookie sent
@@ -87,7 +107,13 @@ interface ServerAuth<P extends Principal = Principal> {
      * sets that column, or creates, deletes or touches such a row, refreshes
      * that user's grants once it is flushed (`server.access.refresh`), so a
      * changed grant reaches their sockets without a reconnect (RFC 0003
-     * section 4.4). Needs `loadServiceAccess`.
+     * section 4.4). `createServer` gives it to its dispatcher, whose admin kit
+     * on that model treats the column as the grants field, whatever its name:
+     * hidden unless `grants: true`, and then for service-wide Admins only. A
+     * dispatcher made without `createServer` takes it as
+     * `createDispatcher({ serviceAccessSource })`, and `createHttpRouter`
+     * refuses an `auth.serviceAccessSource` its dispatcher does not name.
+     * Needs `loadServiceAccess`.
      */
     readonly serviceAccessSource?: ServiceAccessSource;
 }
@@ -101,9 +127,13 @@ interface ServiceAccessSource {
 /**
  * Records the session a socket authenticated with, so that
  * `server.access.disconnectUser(userId, { sessionId })` can end that
- * session's sockets alone. `socketAuth` calls it for the auth routes'
- * sessions; an app's own `authenticate` may too.
+ * session's sockets alone, and, with `expiresAt`, so that the server
+ * disconnects the socket when the session expires (the 5.1 audit's AUTH-4)
+ * and refuses its handshake when it already has. `expiresAt` is a `Date`, a
+ * date string, or epoch milliseconds: a JWT's `exp` is in seconds, so pass
+ * `exp * 1000`. `socketAuth` calls it for the auth routes' sessions; an
+ * app's own `authenticate` may too.
  */
-declare function recordSocketSession(socket: object, sessionId: string): void;
+declare function recordSocketSession(socket: object, sessionId: string, expiresAt?: Date | number | string): void;
 
 export { type AuthenticateResult as A, type HttpRequest as H, type ServerAuth as S, type ServiceGrants as a, type AuthenticateRequest as b, type HttpAuthenticateRequest as c, type HttpCredentialSource as d, type ServiceAccessSource as e, type SocketAuthenticateRequest as f, recordSocketSession as r };