@fuzdev/fuz_app 0.39.0 → 0.41.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/actions/action_codegen.d.ts +0 -9
- package/dist/actions/action_codegen.d.ts.map +1 -1
- package/dist/actions/action_codegen.js +2 -35
- package/dist/actions/action_event.d.ts.map +1 -1
- package/dist/actions/action_event.js +1 -1
- package/dist/actions/action_types.d.ts +1 -1
- package/dist/actions/action_types.d.ts.map +1 -1
- package/dist/actions/register_action_ws.d.ts +1 -1
- package/dist/actions/register_action_ws.d.ts.map +1 -1
- package/dist/actions/transports_ws_backend.d.ts +1 -1
- package/dist/actions/transports_ws_backend.d.ts.map +1 -1
- package/dist/actions/transports_ws_backend.js +1 -1
- package/dist/auth/CLAUDE.md +117 -22
- package/dist/auth/account_actions.d.ts +5 -3
- package/dist/auth/account_actions.d.ts.map +1 -1
- package/dist/auth/account_actions.js +5 -6
- package/dist/auth/account_queries.d.ts.map +1 -1
- package/dist/auth/account_routes.d.ts.map +1 -1
- package/dist/auth/account_routes.js +7 -7
- package/dist/auth/account_schema.d.ts +1 -1
- package/dist/auth/account_schema.d.ts.map +1 -1
- package/dist/auth/account_schema.js +1 -1
- package/dist/auth/admin_action_specs.d.ts +6 -138
- package/dist/auth/admin_action_specs.d.ts.map +1 -1
- package/dist/auth/admin_action_specs.js +5 -4
- package/dist/auth/admin_actions.d.ts +4 -3
- package/dist/auth/admin_actions.d.ts.map +1 -1
- package/dist/auth/admin_actions.js +10 -10
- package/dist/auth/app_settings_schema.d.ts +1 -1
- package/dist/auth/app_settings_schema.d.ts.map +1 -1
- package/dist/auth/app_settings_schema.js +1 -1
- package/dist/auth/audit_log_queries.d.ts +16 -8
- package/dist/auth/audit_log_queries.d.ts.map +1 -1
- package/dist/auth/audit_log_queries.js +8 -11
- package/dist/auth/audit_log_schema.d.ts +28 -75
- package/dist/auth/audit_log_schema.d.ts.map +1 -1
- package/dist/auth/audit_log_schema.js +23 -5
- package/dist/auth/bootstrap_routes.d.ts.map +1 -1
- package/dist/auth/bootstrap_routes.js +3 -3
- package/dist/auth/cleanup.d.ts +9 -1
- package/dist/auth/cleanup.d.ts.map +1 -1
- package/dist/auth/cleanup.js +2 -2
- package/dist/auth/deps.d.ts +13 -1
- package/dist/auth/deps.d.ts.map +1 -1
- package/dist/auth/invite_schema.d.ts +1 -1
- package/dist/auth/invite_schema.d.ts.map +1 -1
- package/dist/auth/invite_schema.js +1 -1
- package/dist/auth/permit_offer_action_specs.d.ts.map +1 -1
- package/dist/auth/permit_offer_action_specs.js +1 -1
- package/dist/auth/permit_offer_actions.d.ts +16 -2
- package/dist/auth/permit_offer_actions.d.ts.map +1 -1
- package/dist/auth/permit_offer_actions.js +26 -8
- package/dist/auth/permit_offer_notifications.d.ts +11 -6
- package/dist/auth/permit_offer_notifications.d.ts.map +1 -1
- package/dist/auth/permit_offer_notifications.js +11 -8
- package/dist/auth/permit_offer_queries.d.ts +1 -1
- package/dist/auth/permit_offer_queries.d.ts.map +1 -1
- package/dist/auth/permit_offer_schema.d.ts +1 -1
- package/dist/auth/permit_offer_schema.d.ts.map +1 -1
- package/dist/auth/permit_offer_schema.js +1 -1
- package/dist/auth/permit_queries.d.ts +50 -1
- package/dist/auth/permit_queries.d.ts.map +1 -1
- package/dist/auth/permit_queries.js +55 -0
- package/dist/auth/self_service_role_action_specs.d.ts +83 -0
- package/dist/auth/self_service_role_action_specs.d.ts.map +1 -0
- package/dist/auth/self_service_role_action_specs.js +71 -0
- package/dist/auth/self_service_role_actions.d.ts +67 -0
- package/dist/auth/self_service_role_actions.d.ts.map +1 -0
- package/dist/auth/self_service_role_actions.js +139 -0
- package/dist/auth/signup_routes.d.ts.map +1 -1
- package/dist/auth/signup_routes.js +2 -2
- package/dist/auth/standard_rpc_actions.d.ts +1 -1
- package/dist/auth/standard_rpc_actions.js +1 -1
- package/dist/server/app_backend.d.ts +9 -1
- package/dist/server/app_backend.d.ts.map +1 -1
- package/dist/server/app_backend.js +12 -1
- package/dist/testing/CLAUDE.md +1 -1
- package/dist/testing/admin_integration.d.ts.map +1 -1
- package/dist/testing/app_server.d.ts +13 -2
- package/dist/testing/app_server.d.ts.map +1 -1
- package/dist/testing/app_server.js +6 -1
- package/dist/testing/entities.d.ts.map +1 -1
- package/dist/testing/ws_round_trip.d.ts +1 -1
- package/dist/testing/ws_round_trip.d.ts.map +1 -1
- package/dist/testing/ws_round_trip.js +1 -1
- package/dist/ui/ui_format.d.ts +2 -3
- package/dist/ui/ui_format.d.ts.map +1 -1
- package/dist/ui/ui_format.js +1 -1
- package/package.json +4 -4
- package/dist/uuid.d.ts +0 -12
- package/dist/uuid.d.ts.map +0 -1
- package/dist/uuid.js +0 -9
|
@@ -1,4 +1,3 @@
|
|
|
1
|
-
import { z } from 'zod';
|
|
2
1
|
import type { ActionSpecUnion, ActionEventPhase } from './action_spec.js';
|
|
3
2
|
/**
|
|
4
3
|
* Represents an import item with its kind (type, value, or namespace).
|
|
@@ -102,14 +101,6 @@ export declare const create_banner: (origin_path: string) => string;
|
|
|
102
101
|
export declare const to_action_spec_identifier: (method: string) => string;
|
|
103
102
|
export declare const to_action_spec_input_identifier: (method: string) => string;
|
|
104
103
|
export declare const to_action_spec_output_identifier: (method: string) => string;
|
|
105
|
-
/**
|
|
106
|
-
* Gets the innermost type of a Zod schema by unwrapping wrappers like transforms, `ZodOptional`, `ZodDefault`, etc.
|
|
107
|
-
*
|
|
108
|
-
* @param schema - the schema to unwrap
|
|
109
|
-
* @returns the innermost schema without wrappers
|
|
110
|
-
*/
|
|
111
|
-
export declare const get_innermost_type: (schema: z.ZodType) => z.ZodType;
|
|
112
|
-
export declare const get_innermost_type_name: (schema: z.ZodType) => string;
|
|
113
104
|
/**
|
|
114
105
|
* Generates one method line of the typed `ActionsApi` interface for a single
|
|
115
106
|
* spec. Encapsulates the input/options/return-type signature shape so the
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"action_codegen.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_codegen.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"action_codegen.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_codegen.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,eAAe,EAAE,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AAOxE;;GAEG;AACH,UAAU,UAAU;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,aAAa;;IACzB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAa;IAE1D;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAQrC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAI1C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI;IAOrD;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI;IAgCtD;;;OAGG;IACH,KAAK,IAAI,MAAM;IAIf;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;OAGG;IACH,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC;IAIxB;;OAEG;IACH,KAAK,IAAI,IAAI;CAqDb;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,eAAe,EACrB,UAAU,UAAU,GAAG,SAAS,KAC9B,KAAK,CAAC,gBAAgB,CA4DxB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,eAAe,EACrB,OAAO,gBAAgB,EACvB,SAAS,aAAa,EACtB,aAAa,MAAM,KACjB,MAkBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,eAAe,EACrB,UAAU,UAAU,GAAG,SAAS,EAChC,SAAS,aAAa,EACtB,UAAU;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAC,KACpC,MA4BF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,GAAI,aAAa,MAAM,KAAG,MACU,CAAC;AAG/D,eAAO,MAAM,yBAAyB,GAAI,QAAQ,MAAM,KAAG,MAAiC,CAAC;AAC7F,eAAO,MAAM,+BAA+B,GAAI,QAAQ,MAAM,KAAG,MACpB,CAAC;AAC9C,eAAO,MAAM,gCAAgC,GAAI,QAAQ,MAAM,KAAG,MACpB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,eAAe,EACrB,UAAU;IAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAC,KACtC,MAoBF,CAAC"}
|
|
@@ -1,6 +1,5 @@
|
|
|
1
1
|
import { UnreachableError } from '@fuzdev/fuz_util/error.js';
|
|
2
|
-
import {
|
|
3
|
-
import { zod_to_subschema } from '@fuzdev/fuz_util/zod.js';
|
|
2
|
+
import { zod_get_base_type } from '@fuzdev/fuz_util/zod.js';
|
|
4
3
|
/**
|
|
5
4
|
* Manages imports for generated code, building them on demand.
|
|
6
5
|
* Automatically optimizes type-only imports to use `import type` syntax.
|
|
@@ -284,38 +283,6 @@ export const create_banner = (origin_path) => `generated by ${origin_path} - DO
|
|
|
284
283
|
export const to_action_spec_identifier = (method) => `${method}_action_spec`;
|
|
285
284
|
export const to_action_spec_input_identifier = (method) => `${to_action_spec_identifier(method)}.input`;
|
|
286
285
|
export const to_action_spec_output_identifier = (method) => `${to_action_spec_identifier(method)}.output`;
|
|
287
|
-
/**
|
|
288
|
-
* Gets the innermost type of a Zod schema by unwrapping wrappers like transforms, `ZodOptional`, `ZodDefault`, etc.
|
|
289
|
-
*
|
|
290
|
-
* @param schema - the schema to unwrap
|
|
291
|
-
* @returns the innermost schema without wrappers
|
|
292
|
-
*/
|
|
293
|
-
export const get_innermost_type = (schema) => {
|
|
294
|
-
const def = schema.def;
|
|
295
|
-
// Handle wrapper types that need unwrapping
|
|
296
|
-
if (schema instanceof z.ZodOptional || schema instanceof z.ZodNullable) {
|
|
297
|
-
return get_innermost_type(schema.unwrap());
|
|
298
|
-
}
|
|
299
|
-
if (schema instanceof z.ZodDefault) {
|
|
300
|
-
const subschema = zod_to_subschema(def);
|
|
301
|
-
if (subschema) {
|
|
302
|
-
return get_innermost_type(subschema);
|
|
303
|
-
}
|
|
304
|
-
}
|
|
305
|
-
// Handle transforms, pipes, and other wrappers
|
|
306
|
-
if (def.type === 'transform' || def.type === 'pipe' || def.type === 'prefault') {
|
|
307
|
-
const subschema = zod_to_subschema(def);
|
|
308
|
-
if (subschema) {
|
|
309
|
-
return get_innermost_type(subschema);
|
|
310
|
-
}
|
|
311
|
-
}
|
|
312
|
-
return schema;
|
|
313
|
-
};
|
|
314
|
-
export const get_innermost_type_name = (schema) => {
|
|
315
|
-
const innermost = get_innermost_type(schema);
|
|
316
|
-
const def = innermost.def;
|
|
317
|
-
return def.type;
|
|
318
|
-
};
|
|
319
286
|
/**
|
|
320
287
|
* Generates one method line of the typed `ActionsApi` interface for a single
|
|
321
288
|
* spec. Encapsulates the input/options/return-type signature shape so the
|
|
@@ -346,7 +313,7 @@ export const get_innermost_type_name = (schema) => {
|
|
|
346
313
|
*/
|
|
347
314
|
export const generate_actions_api_method_signature = (spec, options) => {
|
|
348
315
|
const sync_returns_value = options?.sync_returns_value ?? true;
|
|
349
|
-
const innermost_type_name =
|
|
316
|
+
const innermost_type_name = zod_get_base_type(spec.input);
|
|
350
317
|
const has_input = innermost_type_name !== 'null' && innermost_type_name !== 'void';
|
|
351
318
|
const input_param = has_input
|
|
352
319
|
? `input${spec.input.safeParse(undefined).success ? '?' : ''}: ActionInputs['${spec.method}']`
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"action_event.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_event.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;
|
|
1
|
+
{"version":3,"file":"action_event.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_event.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAC,gBAAgB,EAAc,eAAe,EAAC,MAAM,kBAAkB,CAAC;AAWpF,OAAO,KAAK,EACX,cAAc,EACd,sBAAsB,EACtB,mBAAmB,EAEnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAC,sBAAsB,EAAE,eAAe,EAAC,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAkB,KAAK,oBAAoB,EAAC,MAAM,wBAAwB,CAAC;AAclF,MAAM,MAAM,yBAAyB,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI,CACxE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC,EACvC,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC,EACvC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,KACvB,IAAI,CAAC;AAEV;;GAEG;AACH,qBAAa,WAAW,CACvB,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,MAAM,SAAS,gBAAgB,GAAG,gBAAgB,EAClD,KAAK,SAAS,eAAe,GAAG,eAAe;;IAK/C,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAE/B,IAAI,IAAI,IAAI,oBAAoB,CAAC,OAAO,CAAC,GAAG;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,KAAK,CAAA;KAAC,CAEvE;gBAGA,WAAW,EAAE,sBAAsB,EACnC,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE,oBAAoB,CAAC,OAAO,CAAC;IAOpC,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC;IAMvC,OAAO,CAAC,QAAQ,EAAE,yBAAyB,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI;IAKjE,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,IAAI;IAUvD;;OAEG;IACH,KAAK,IAAI,IAAI;IA8Cb;;OAEG;IAGG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IA0CnC;;OAEG;IACH,WAAW,IAAI,IAAI;IAkCnB;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI;IAezC,WAAW,IAAI,OAAO;IAItB,eAAe,CAAC,QAAQ,EAAE,OAAO,GAAG,IAAI;IAIxC,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAQ1C,YAAY,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI;IAUpD,gBAAgB,CAAC,YAAY,EAAE,mBAAmB,GAAG,IAAI;CAyKzD;AAGD;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,SAAS,MAAM,GAAG,MAAM,EAClE,aAAa,sBAAsB,EACnC,MAAM,eAAe,EACrB,OAAO,OAAO,EACd,gBAAgB,gBAAgB,KAC9B,WAAW,CAAC,OAAO,CAiBrB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,6BAA6B,GAAI,OAAO,SAAS,MAAM,GAAG,MAAM,EAC5E,MAAM,oBAAoB,CAAC,OAAO,CAAC,EACnC,aAAa,sBAAsB,KACjC,WAAW,CAAC,OAAO,CAOrB,CAAC;AAIF,eAAO,MAAM,kBAAkB,GAC9B,UAAU,OAAO,EACjB,aAAa,sBAAsB,KACjC,WAGF,CAAC"}
|
|
@@ -7,11 +7,11 @@
|
|
|
7
7
|
* @module
|
|
8
8
|
*/
|
|
9
9
|
import { z } from 'zod';
|
|
10
|
+
import { create_uuid } from '@fuzdev/fuz_util/id.js';
|
|
10
11
|
import { create_jsonrpc_request, create_jsonrpc_response, create_jsonrpc_error_response, create_jsonrpc_notification, to_jsonrpc_params, to_jsonrpc_result, is_jsonrpc_error_response, } from '../http/jsonrpc_helpers.js';
|
|
11
12
|
import { jsonrpc_error_messages, ThrownJsonrpcError } from '../http/jsonrpc_errors.js';
|
|
12
13
|
import { ActionEventData } from './action_event_data.js';
|
|
13
14
|
import { validate_step_transition, validate_phase_transition, should_validate_output, is_action_complete, create_initial_data, get_initial_phase, is_request_response, is_send_request_with_parsed_input, is_notification_send_with_parsed_input, } from './action_event_helpers.js';
|
|
14
|
-
import { create_uuid } from '../uuid.js';
|
|
15
15
|
/**
|
|
16
16
|
* Action event that manages the lifecycle of an action through its state machine.
|
|
17
17
|
*/
|
|
@@ -8,8 +8,8 @@
|
|
|
8
8
|
*
|
|
9
9
|
* @module
|
|
10
10
|
*/
|
|
11
|
+
import type { Uuid } from '@fuzdev/fuz_util/id.js';
|
|
11
12
|
import type { JsonrpcRequestId } from '../http/jsonrpc.js';
|
|
12
|
-
import type { Uuid } from '../uuid.js';
|
|
13
13
|
import type { ActionSpecUnion } from './action_spec.js';
|
|
14
14
|
/**
|
|
15
15
|
* Minimum per-request context every server-side WS handler receives.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"action_types.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAC,
|
|
1
|
+
{"version":3,"file":"action_types.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAEjD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,kBAAkB,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IAClC,kEAAkE;IAClE,UAAU,EAAE,gBAAgB,CAAC;IAC7B;;;;;;;OAOG;IACH,aAAa,EAAE,IAAI,CAAC;IACpB;;;;OAIG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,CAAC,IAAI,SAAS,kBAAkB,GAAG,kBAAkB,IAAI,CACnF,KAAK,EAAE,OAAO,EACd,GAAG,EAAE,IAAI,KACL,OAAO,CAAC;AAEb;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,MAAM,CAAC,IAAI,SAAS,kBAAkB,GAAG,kBAAkB;IAC3E,IAAI,EAAE,eAAe,CAAC;IACtB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;CAChC"}
|
|
@@ -31,7 +31,7 @@
|
|
|
31
31
|
import type { Context, Hono } from 'hono';
|
|
32
32
|
import type { UpgradeWebSocket, WSContext } from 'hono/ws';
|
|
33
33
|
import { type Logger as LoggerType } from '@fuzdev/fuz_util/log.js';
|
|
34
|
-
import type { Uuid } from '
|
|
34
|
+
import type { Uuid } from '@fuzdev/fuz_util/id.js';
|
|
35
35
|
import { type Action, type BaseHandlerContext, type WsActionHandler } from './action_types.js';
|
|
36
36
|
import { BackendWebsocketTransport, type ConnectionIdentity } from './transports_ws_backend.js';
|
|
37
37
|
export type { Action, BaseHandlerContext, WsActionHandler };
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"register_action_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_action_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,KAAK,EAAC,OAAO,EAAE,IAAI,EAAC,MAAM,MAAM,CAAC;AACxC,OAAO,KAAK,EAAC,gBAAgB,EAAE,SAAS,EAAC,MAAM,SAAS,CAAC;AAEzD,OAAO,EAAS,KAAK,MAAM,IAAI,UAAU,EAAC,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"register_action_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_action_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,KAAK,EAAC,OAAO,EAAE,IAAI,EAAC,MAAM,MAAM,CAAC;AACxC,OAAO,KAAK,EAAC,gBAAgB,EAAE,SAAS,EAAC,MAAM,SAAS,CAAC;AAEzD,OAAO,EAAS,KAAK,MAAM,IAAI,UAAU,EAAC,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAiBjD,OAAO,EAAC,KAAK,MAAM,EAAE,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAC,MAAM,mBAAmB,CAAC;AAG7F,OAAO,EAAC,yBAAyB,EAAE,KAAK,kBAAkB,EAAC,MAAM,4BAA4B,CAAC;AAE9F,YAAY,EAAC,MAAM,EAAE,kBAAkB,EAAE,eAAe,EAAC,CAAC;AAE1D,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IACjC,qFAAqF;IACrF,EAAE,EAAE,SAAS,CAAC;IACd,4EAA4E;IAC5E,aAAa,EAAE,IAAI,CAAC;IACpB,oDAAoD;IACpD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD,wFAAwF;IACxF,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IAClC,+CAA+C;IAC/C,EAAE,EAAE,SAAS,CAAC;IACd,2CAA2C;IAC3C,aAAa,EAAE,IAAI,CAAC;IACpB,kGAAkG;IAClG,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB,CAAC,IAAI,SAAS,kBAAkB;IACvE,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,IAAI,CAAC;IACV,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;OAMG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC;;;;;OAKG;IACH,cAAc,EAAE,CAAC,IAAI,EAAE,kBAAkB,EAAE,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC/D;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACtC,yEAAyE;IACzE,SAAS,EAAE,yBAAyB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,GAAI,IAAI,SAAS,kBAAkB,EACjE,SAAS,uBAAuB,CAAC,IAAI,CAAC,KACpC,sBA8WF,CAAC"}
|
|
@@ -5,8 +5,8 @@
|
|
|
5
5
|
* @module
|
|
6
6
|
*/
|
|
7
7
|
import type { WSContext } from 'hono/ws';
|
|
8
|
+
import { type Uuid } from '@fuzdev/fuz_util/id.js';
|
|
8
9
|
import type { JsonrpcMessageFromServerToClient, JsonrpcNotification, JsonrpcRequest, JsonrpcResponseOrError, JsonrpcErrorResponse } from '../http/jsonrpc.js';
|
|
9
|
-
import { type Uuid } from '../uuid.js';
|
|
10
10
|
import { type Transport, type TransportSendOptions } from './transports.js';
|
|
11
11
|
/**
|
|
12
12
|
* Auth identity attached to a single WebSocket connection.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"transports_ws_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports_ws_backend.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"transports_ws_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports_ws_backend.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,SAAS,CAAC;AACvC,OAAO,EAAc,KAAK,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAEX,gCAAgC,EAChC,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EAA2B,KAAK,SAAS,EAAE,KAAK,oBAAoB,EAAC,MAAM,iBAAiB,CAAC;AAIpG;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IAClC,sEAAsE;IACtE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,4CAA4C;IAC5C,UAAU,EAAE,IAAI,CAAC;IACjB,sEAAsE;IACtE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA6B,SAAQ,SAAS;IAC9D,kBAAkB,EAAE,CACnB,OAAO,EAAE,gCAAgC,EACzC,SAAS,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,KAChD,MAAM,CAAC;CACZ;AAED,qDAAqD;AACrD,eAAO,MAAM,iCAAiC,GAC7C,WAAW,SAAS,KAClB,SAAS,IAAI,4BAEqE,CAAC;AAEtF,qBAAa,yBAA0B,YAAW,4BAA4B;;IAC7E,QAAQ,CAAC,cAAc,EAAG,uBAAuB,CAAU;IAY3D;;;;;;;;OAQG;IACH,cAAc,CACb,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,IAAI,EAChB,YAAY,GAAE,MAAM,GAAG,IAAW,GAChC,IAAI;IAQP;;;OAGG;IACH,iBAAiB,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI;IA0BtC;;;;OAIG;IACH,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAIrD;;;;OAIG;IACH,yBAAyB,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM;IAInD;;;;;;;;OAQG;IACH,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAsB/C,IAAI,CACT,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAC5B,IAAI,CACT,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA6CvC;;;;;;;;;OASG;IACH,kBAAkB,CACjB,OAAO,EAAE,gCAAgC,EACzC,SAAS,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,GAClD,MAAM;IAoBT;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,gCAAgC,GAAG,MAAM;IAIpF,QAAQ,IAAI,OAAO;IAInB;;;;;;;OAOG;IACH,oBAAoB,IAAI,MAAM;CAG9B"}
|
|
@@ -4,9 +4,9 @@
|
|
|
4
4
|
*
|
|
5
5
|
* @module
|
|
6
6
|
*/
|
|
7
|
+
import { create_uuid } from '@fuzdev/fuz_util/id.js';
|
|
7
8
|
import { jsonrpc_error_messages } from '../http/jsonrpc_errors.js';
|
|
8
9
|
import { create_jsonrpc_error_response, to_jsonrpc_message_id, is_jsonrpc_request, } from '../http/jsonrpc_helpers.js';
|
|
9
|
-
import { create_uuid } from '../uuid.js';
|
|
10
10
|
import { WS_CLOSE_SESSION_REVOKED } from './transports.js';
|
|
11
11
|
/** Type guard for `FilterableBroadcastTransport`. */
|
|
12
12
|
export const is_filterable_broadcast_transport = (transport) => 'broadcast_filtered' in transport &&
|
package/dist/auth/CLAUDE.md
CHANGED
|
@@ -89,7 +89,7 @@ Design notes:
|
|
|
89
89
|
actor — carries `scope_id`, `source_offer_id`, `revoked_reason`),
|
|
90
90
|
`AuthSession` (server-side, keyed by blake3), `ApiToken`.
|
|
91
91
|
- Every `id` / `*_id` field on entity interfaces, `*Json` schemas, and
|
|
92
|
-
`*Input` types is branded `Uuid` (from
|
|
92
|
+
`*Input` types is branded `Uuid` (from `@fuzdev/fuz_util/uuid.js`), except
|
|
93
93
|
`AuthSessionJson.id` (`Blake3Hash`) and `ClientApiTokenJson.id`
|
|
94
94
|
(`ApiTokenId` — `tok_`-prefixed).
|
|
95
95
|
- `Username`: `[a-zA-Z][0-9a-zA-Z_-]*[0-9a-zA-Z]` (3–39, GitHub parity).
|
|
@@ -163,14 +163,23 @@ Separated from runtime types to isolate DDL concerns. Consumed by
|
|
|
163
163
|
- `AuditEventType` (Zod enum), `AuditOutcome` (`'success' | 'failure'`).
|
|
164
164
|
- `AUDIT_METADATA_SCHEMAS` — per-type `z.looseObject`. Notable shapes:
|
|
165
165
|
- `permit_grant` — `scope_id`, optional `permit_id` (failed grants
|
|
166
|
-
omit — `web_grantable` denial never produces a row), optional
|
|
167
|
-
|
|
166
|
+
omit — `web_grantable` denial never produces a row), optional
|
|
167
|
+
`source_offer_id`, optional `self_service` (set by
|
|
168
|
+
`self_service_role_actions.ts`; declared on the schema rather than
|
|
169
|
+
riding on `z.looseObject` so the field is part of the documented surface).
|
|
170
|
+
- `permit_revoke` — `scope_id`, optional `reason`, optional
|
|
171
|
+
`self_service` (same self-service toggle).
|
|
168
172
|
- `permit_offer_create` — optional `offer_id` (failed creates omit).
|
|
169
|
-
- `permit_offer_supersede` — `reason: 'sibling_accepted' | 'permit_revoked'`
|
|
170
|
-
plus `cause_id` (accepted offer id
|
|
173
|
+
- `permit_offer_supersede` — `reason: 'sibling_accepted' | 'permit_revoked' | 'scope_destroyed'`
|
|
174
|
+
plus `cause_id` (accepted offer id, revoked permit id, or destroyed
|
|
175
|
+
parent scope row id respectively). The `scope_destroyed` variant is
|
|
176
|
+
emitted by callers of `query_permit_revoke_for_scope` when a polymorphic
|
|
177
|
+
parent scope row is deleted.
|
|
171
178
|
- `AuditLogEvent` (row); `AuditLogInput<T extends string = AuditEventType>`
|
|
172
179
|
(narrow metadata when `T` is builtin, generic record otherwise);
|
|
173
|
-
`AuditLogListOptions` (supports `since_seq` for SSE reconnection gap fill)
|
|
180
|
+
`AuditLogListOptions` (supports `since_seq` for SSE reconnection gap fill);
|
|
181
|
+
`AUDIT_LOG_DEFAULT_LIMIT = 50` (default page size, lives on the schema
|
|
182
|
+
side so client codegen can import it without dragging in the query layer).
|
|
174
183
|
- Client-safe: `AuditLogEventJson`, `AuditLogEventWithUsernamesJson`,
|
|
175
184
|
`PermitHistoryEventJson`, `AdminSessionJson`.
|
|
176
185
|
- `get_audit_metadata(event)` type-narrows after checking `event_type`.
|
|
@@ -179,13 +188,22 @@ Separated from runtime types to isolate DDL concerns. Consumed by
|
|
|
179
188
|
- **Consumer extensibility**: `create_audit_log_config({extra_events})`
|
|
180
189
|
builds an `AuditLogConfig` merging builtins with consumer event-type
|
|
181
190
|
strings keyed to a Zod schema (validates metadata) or `null` (registers
|
|
182
|
-
without validation). Pass the result
|
|
183
|
-
|
|
184
|
-
|
|
191
|
+
without validation). Pass the result to `create_app_backend({audit_log_config})`
|
|
192
|
+
— it lands on `AppDeps.audit_log_config` and `audit_log_fire_and_forget`
|
|
193
|
+
reads it off the deps bundle automatically (defaults to
|
|
194
|
+
`BUILTIN_AUDIT_LOG_CONFIG` when absent). `query_audit_log` still accepts
|
|
195
|
+
the trailing `config` positional arg for in-transaction emit sites that
|
|
196
|
+
don't have `AppDeps`. Builtin collisions and `AuditEventTypeName`
|
|
185
197
|
format failures throw at construction. The DB column is `TEXT NOT NULL`
|
|
186
|
-
(no enum), so consumer types round-trip through list queries
|
|
187
|
-
|
|
188
|
-
|
|
198
|
+
(no enum), so consumer types round-trip through list queries, the
|
|
199
|
+
`audit_log_list` RPC, and SSE identically to builtins.
|
|
200
|
+
`AuditLogEvent.event_type` (row interface), `AuditLogEventJson.event_type`,
|
|
201
|
+
and the `audit_log_list` filter input are all `AuditEventTypeName`
|
|
202
|
+
(regex-validated string) — widened from the closed enum so consumer rows
|
|
203
|
+
round-trip through DB queries, `on_audit_event` callbacks, and
|
|
204
|
+
`spec.output.safeParse` identically to builtins. `AuditLogInput<T>` and
|
|
205
|
+
`AuditMetadataMap` stay closed-enum on the write side — metadata-narrowing
|
|
206
|
+
helpers like `get_audit_metadata` continue to require a builtin type guard.
|
|
189
207
|
- **Drift counters**: `audit_metadata_validation_failures` (schema mismatch)
|
|
190
208
|
and `audit_unknown_event_type_failures` (`event_type` not in active
|
|
191
209
|
config). Both fail-open. Independent in implementation; under the
|
|
@@ -320,6 +338,19 @@ CRUD + listing:
|
|
|
320
338
|
- `query_permit_revoke_role(deps, actor_id, role, ...)` — revokes every
|
|
321
339
|
active permit for `(actor, role)` across all scopes and supersedes all
|
|
322
340
|
matching pending offers. Returns `RevokeRoleResult = {revoked, superseded_offers}`.
|
|
341
|
+
- **`query_permit_revoke_for_scope(deps, scope_id, revoked_by, reason?)`** —
|
|
342
|
+
parent-scope cascade for polymorphic `scope_id` consumers. Revokes every
|
|
343
|
+
active permit at `scope_id` (role-agnostic) and supersedes every pending
|
|
344
|
+
offer at `scope_id` (tuple-matched and orphan, undifferentiated) in the
|
|
345
|
+
caller's transaction. Returns `RevokeForScopeResult = {revoked, superseded_offers}`
|
|
346
|
+
— `revoked` carries `account_id` for `permit_revoke` fan-out;
|
|
347
|
+
`superseded_offers` carries `from_account_id`. Caller emits
|
|
348
|
+
`permit_offer_supersede` audits with `reason: 'scope_destroyed'` and
|
|
349
|
+
`cause_id: <destroyed scope row id>` per superseded offer (the cause is
|
|
350
|
+
the scope deletion, not any individual permit revoke). Use from a
|
|
351
|
+
consumer's parent-row delete handler when `permit.scope_id` /
|
|
352
|
+
`permit_offer.scope_id` reference rows in a polymorphic table the
|
|
353
|
+
consumer is about to drop.
|
|
323
354
|
|
|
324
355
|
### `permit_offer_queries.ts`
|
|
325
356
|
|
|
@@ -439,7 +470,6 @@ run'` if the seed somehow missed (defensive — migrations always seed).
|
|
|
439
470
|
|
|
440
471
|
### `audit_log_queries.ts`
|
|
441
472
|
|
|
442
|
-
- `AUDIT_LOG_DEFAULT_LIMIT = 50`.
|
|
443
473
|
- `query_audit_log<T>(deps, input, config?)` — `config` defaults to
|
|
444
474
|
`BUILTIN_AUDIT_LOG_CONFIG`. Membership check runs against
|
|
445
475
|
`config.event_types`; metadata validation runs independently against
|
|
@@ -457,12 +487,17 @@ run'` if the seed somehow missed (defensive — migrations always seed).
|
|
|
457
487
|
- `query_audit_log_list_for_account`, `query_audit_log_list_permit_history`
|
|
458
488
|
(filters to `permit_grant` / `permit_revoke`).
|
|
459
489
|
- `query_audit_log_cleanup_before`.
|
|
460
|
-
- **`audit_log_fire_and_forget(route, input,
|
|
490
|
+
- **`audit_log_fire_and_forget(route, input, deps)`** —
|
|
461
491
|
writes to `route.background_db` (pool-level), so audit entries persist
|
|
462
|
-
even when the request transaction rolls back.
|
|
463
|
-
|
|
464
|
-
|
|
465
|
-
|
|
492
|
+
even when the request transaction rolls back. `deps` is an
|
|
493
|
+
`AuditLogFireAndForgetDeps` bundle (`{log, on_audit_event, audit_log_config?}`)
|
|
494
|
+
— structurally compatible with `Pick<AppDeps, 'log' | 'on_audit_event' | 'audit_log_config'>`,
|
|
495
|
+
so call sites pass the surrounding deps object directly. Bundling
|
|
496
|
+
replaces the prior 5-arg positional signature; consumers that forgot
|
|
497
|
+
the trailing `config` would silently fall back to
|
|
498
|
+
`BUILTIN_AUDIT_LOG_CONFIG`. Write and `on_audit_event` callback
|
|
499
|
+
failures are logged separately. Pushes onto `route.pending_effects`
|
|
500
|
+
for test flushing.
|
|
466
501
|
|
|
467
502
|
### `migrations.ts`
|
|
468
503
|
|
|
@@ -777,7 +812,7 @@ Closure state:
|
|
|
777
812
|
`all_admin_action_specs: Array<RequestResponseActionSpec>` — codegen-ready
|
|
778
813
|
registry of all eleven specs (always includes the two app-settings specs).
|
|
779
814
|
|
|
780
|
-
Deps: `AdminActionDeps = Pick<RouteFactoryDeps, 'log' | 'on_audit_event'>`.
|
|
815
|
+
Deps: `AdminActionDeps = Pick<RouteFactoryDeps, 'log' | 'on_audit_event' | 'audit_log_config'>`. The `audit_log_config` slot flows through to `audit_log_fire_and_forget` so consumer-extended event-type metadata gets validated.
|
|
781
816
|
|
|
782
817
|
### `permit_offer_action_specs.ts` + `permit_offer_actions.ts` — seven RPC actions
|
|
783
818
|
|
|
@@ -857,7 +892,7 @@ can't starve others; see `../http/CLAUDE.md` §Pending Effects):
|
|
|
857
892
|
- Revoke → `permit_revoke` to revokee + one `permit_offer_supersede` per
|
|
858
893
|
superseded sibling.
|
|
859
894
|
|
|
860
|
-
Deps: `PermitOfferActionDeps extends Pick<RouteFactoryDeps, 'log' | 'on_audit_event'> & {notification_sender?: NotificationSender | null}`.
|
|
895
|
+
Deps: `PermitOfferActionDeps extends Pick<RouteFactoryDeps, 'log' | 'on_audit_event' | 'audit_log_config'> & {notification_sender?: NotificationSender | null}`.
|
|
861
896
|
Notification sender is optional — when absent, WS fan-out is silently
|
|
862
897
|
skipped (DB-only side effects still happen).
|
|
863
898
|
|
|
@@ -870,6 +905,13 @@ Options:
|
|
|
870
905
|
- `authorize?: PermitOfferCreateAuthorize` — custom policy for
|
|
871
906
|
`permit_offer_create`. Signature:
|
|
872
907
|
`(auth, input: {to_account_id, role, scope_id}, deps: Pick<RouteFactoryDeps, 'log'>, ctx: ActionContext) => boolean | Promise<boolean>`.
|
|
908
|
+
Pre-built option: `authorize_admin_or_holder` admits any admin and
|
|
909
|
+
otherwise falls back to the symmetric default (caller must hold the
|
|
910
|
+
offered role globally). Drop into
|
|
911
|
+
`create_permit_offer_actions({authorize: authorize_admin_or_holder})`
|
|
912
|
+
or any factory that forwards `authorize` (e.g. `create_standard_rpc_actions`)
|
|
913
|
+
for the common "admins offer anything web_grantable; users offer what
|
|
914
|
+
they hold" pattern.
|
|
873
915
|
|
|
874
916
|
`all_permit_offer_action_specs: Array<RequestResponseActionSpec>` —
|
|
875
917
|
codegen-ready registry.
|
|
@@ -945,13 +987,61 @@ Audit events emitted (via `audit_log_fire_and_forget` with `ip: ctx.client_ip`):
|
|
|
945
987
|
IP is the resolved trusted-proxy value from `ActionContext.client_ip`,
|
|
946
988
|
matching the REST handler convention.
|
|
947
989
|
|
|
948
|
-
Deps: `AccountActionDeps = Pick<RouteFactoryDeps, 'log' | 'on_audit_event'>`.
|
|
990
|
+
Deps: `AccountActionDeps = Pick<RouteFactoryDeps, 'log' | 'on_audit_event' | 'audit_log_config'>`.
|
|
949
991
|
Options: `{max_tokens?: number | null}` — defaults to `DEFAULT_MAX_TOKENS`
|
|
950
992
|
from `account_routes.ts`; `null` disables the cap.
|
|
951
993
|
|
|
952
994
|
`all_account_action_specs: Array<RequestResponseActionSpec>` — codegen-ready
|
|
953
995
|
registry of all seven specs.
|
|
954
996
|
|
|
997
|
+
### `self_service_role_action_specs.ts` + `self_service_role_actions.ts` — opt-in self-service role toggle
|
|
998
|
+
|
|
999
|
+
Same split as the other registries: `*_action_specs.ts` holds the input/output
|
|
1000
|
+
Zod schemas, the two `satisfies RequestResponseActionSpec` literals, the
|
|
1001
|
+
`ERROR_ROLE_NOT_SELF_SERVICE_ELIGIBLE` reason constant, and the
|
|
1002
|
+
`all_self_service_role_action_specs` registry — all client-safe. The
|
|
1003
|
+
`*_actions.ts` factory imports the specs and pairs them with handlers.
|
|
1004
|
+
|
|
1005
|
+
Two static `request_response` actions — `self_service_role_grant` and
|
|
1006
|
+
`self_service_role_revoke` — that take `{role}` as input and toggle a
|
|
1007
|
+
global permit on the caller. Both are idempotent: `granted: false` when
|
|
1008
|
+
the caller already holds the role, `revoked: false` when they don't.
|
|
1009
|
+
Audit metadata carries `self_service: true` so admin reviewers can
|
|
1010
|
+
distinguish self-toggled permits from admin grants/offers. The
|
|
1011
|
+
`permit_grant` / `permit_revoke` metadata schemas declare
|
|
1012
|
+
`self_service: z.boolean().optional()` explicitly, so the field is
|
|
1013
|
+
part of the documented surface rather than riding on `z.looseObject`
|
|
1014
|
+
permissiveness.
|
|
1015
|
+
|
|
1016
|
+
Method names are static — `role` lives in the input, not the method
|
|
1017
|
+
name. Mirrors the `permit_offer_create({role})` precedent. Per-role
|
|
1018
|
+
parameterized methods would break the `satisfies RequestResponseActionSpec`
|
|
1019
|
+
codegen invariant and grow the surface linearly per role.
|
|
1020
|
+
|
|
1021
|
+
`create_self_service_role_actions(deps, options)`:
|
|
1022
|
+
|
|
1023
|
+
- `eligible_roles: ReadonlyArray<string>` — required allowlist. Roles
|
|
1024
|
+
outside the list are rejected with `forbidden` + reason
|
|
1025
|
+
`role_not_self_service_eligible` (exported as
|
|
1026
|
+
`ERROR_ROLE_NOT_SELF_SERVICE_ELIGIBLE`).
|
|
1027
|
+
- `roles?: RoleSchemaResult` — optional. When supplied, every entry in
|
|
1028
|
+
`eligible_roles` is checked against `roles.role_options` at factory
|
|
1029
|
+
time so typos throw at startup instead of at first call.
|
|
1030
|
+
|
|
1031
|
+
Grant path uses `query_permit_has_role` for a benign-TOCTOU pre-check
|
|
1032
|
+
(distinguishes new grant from idempotent re-grant), then
|
|
1033
|
+
`query_grant_permit` for the actual insert. Revoke path filters
|
|
1034
|
+
`query_permit_find_active_for_actor` in JS for the matching
|
|
1035
|
+
`(actor, role, scope_id IS NULL)` row before calling
|
|
1036
|
+
`query_revoke_permit`. Bundle is **not** included in
|
|
1037
|
+
`create_standard_rpc_actions` — `eligible_roles` is app-specific, opt-in,
|
|
1038
|
+
spread alongside the standard bundle when needed.
|
|
1039
|
+
|
|
1040
|
+
Deps: `SelfServiceRoleActionDeps = Pick<RouteFactoryDeps, 'log' | 'on_audit_event' | 'audit_log_config'>`.
|
|
1041
|
+
|
|
1042
|
+
`all_self_service_role_action_specs: Array<RequestResponseActionSpec>` —
|
|
1043
|
+
codegen-ready registry of both specs.
|
|
1044
|
+
|
|
955
1045
|
## Cleanup
|
|
956
1046
|
|
|
957
1047
|
`cleanup.ts` — periodic auth maintenance:
|
|
@@ -978,7 +1068,7 @@ resulting permit.
|
|
|
978
1068
|
|
|
979
1069
|
`deps.ts` defines:
|
|
980
1070
|
|
|
981
|
-
- **`AppDeps`** — the stateless capabilities bundle.
|
|
1071
|
+
- **`AppDeps`** — the stateless capabilities bundle. Eight members:
|
|
982
1072
|
- `stat`, `read_text_file`, `delete_file` — filesystem.
|
|
983
1073
|
- `keyring: Keyring` — HMAC-SHA256 signing.
|
|
984
1074
|
- `password: PasswordHashDeps` — use `argon2_password_deps` in production.
|
|
@@ -989,6 +1079,11 @@ resulting permit.
|
|
|
989
1079
|
INSERT. Wire to SSE broadcast for realtime audit streams. Defaults to
|
|
990
1080
|
noop when unwired. Flows automatically through every factory that
|
|
991
1081
|
receives `deps` / `RouteFactoryDeps`.
|
|
1082
|
+
- `audit_log_config?: AuditLogConfig` — optional consumer-extended audit
|
|
1083
|
+
config from `create_audit_log_config({extra_events})`. Wired into
|
|
1084
|
+
`audit_log_fire_and_forget` via the deps bundle so consumer event-type
|
|
1085
|
+
metadata gets validated. Absent → defaults to `BUILTIN_AUDIT_LOG_CONFIG`.
|
|
1086
|
+
Pass at the backend via `create_app_backend({audit_log_config})`.
|
|
992
1087
|
- **`RouteFactoryDeps = Omit<AppDeps, 'db'>`** — for route factories. Route
|
|
993
1088
|
handlers receive DB access via `RouteContext`, so factories don't capture
|
|
994
1089
|
a pool-level `Db`.
|
|
@@ -37,13 +37,15 @@ export interface AccountActionOptions {
|
|
|
37
37
|
* Dependencies for `create_account_actions`.
|
|
38
38
|
*
|
|
39
39
|
* Shares shape with `AdminActionDeps` / `PermitOfferActionDeps` so consumers
|
|
40
|
-
* can pass the same deps to every action factory.
|
|
40
|
+
* can pass the same deps to every action factory. `audit_log_config` is
|
|
41
|
+
* carried through `AppDeps` and consumed by `audit_log_fire_and_forget`;
|
|
42
|
+
* absent → defaults to `BUILTIN_AUDIT_LOG_CONFIG`.
|
|
41
43
|
*/
|
|
42
|
-
export type AccountActionDeps = Pick<RouteFactoryDeps, 'log' | 'on_audit_event'>;
|
|
44
|
+
export type AccountActionDeps = Pick<RouteFactoryDeps, 'log' | 'on_audit_event' | 'audit_log_config'>;
|
|
43
45
|
/**
|
|
44
46
|
* Create the self-service account RPC actions.
|
|
45
47
|
*
|
|
46
|
-
* @param deps -
|
|
48
|
+
* @param deps - `AccountActionDeps` slice of `AppDeps` (`log`, `on_audit_event`, optional `audit_log_config`)
|
|
47
49
|
* @param options - per-factory configuration
|
|
48
50
|
* @returns the `RpcAction` array to spread into a `create_rpc_endpoint` call
|
|
49
51
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"account_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAiC,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAgBxF,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAwBhD,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED
|
|
1
|
+
{"version":3,"file":"account_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAiC,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAgBxF,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAwBhD,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CACnC,gBAAgB,EAChB,KAAK,GAAG,gBAAgB,GAAG,kBAAkB,CAC7C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,iBAAiB,EACvB,UAAS,oBAAyB,KAChC,KAAK,CAAC,SAAS,CAyHjB,CAAC"}
|
|
@@ -32,12 +32,11 @@ import { account_verify_action_spec, account_session_list_action_spec, account_s
|
|
|
32
32
|
/**
|
|
33
33
|
* Create the self-service account RPC actions.
|
|
34
34
|
*
|
|
35
|
-
* @param deps -
|
|
35
|
+
* @param deps - `AccountActionDeps` slice of `AppDeps` (`log`, `on_audit_event`, optional `audit_log_config`)
|
|
36
36
|
* @param options - per-factory configuration
|
|
37
37
|
* @returns the `RpcAction` array to spread into a `create_rpc_endpoint` call
|
|
38
38
|
*/
|
|
39
39
|
export const create_account_actions = (deps, options = {}) => {
|
|
40
|
-
const { log, on_audit_event } = deps;
|
|
41
40
|
const { max_tokens = DEFAULT_MAX_TOKENS } = options;
|
|
42
41
|
const verify_handler = (_input, ctx) => {
|
|
43
42
|
const auth = ctx.auth;
|
|
@@ -58,7 +57,7 @@ export const create_account_actions = (deps, options = {}) => {
|
|
|
58
57
|
account_id: auth.account.id,
|
|
59
58
|
ip: ctx.client_ip,
|
|
60
59
|
metadata: { session_id: input.session_id },
|
|
61
|
-
},
|
|
60
|
+
}, deps);
|
|
62
61
|
return { ok: true, revoked };
|
|
63
62
|
};
|
|
64
63
|
const session_revoke_all_handler = async (_input, ctx) => {
|
|
@@ -70,7 +69,7 @@ export const create_account_actions = (deps, options = {}) => {
|
|
|
70
69
|
account_id: auth.account.id,
|
|
71
70
|
ip: ctx.client_ip,
|
|
72
71
|
metadata: { count },
|
|
73
|
-
},
|
|
72
|
+
}, deps);
|
|
74
73
|
return { ok: true, count };
|
|
75
74
|
};
|
|
76
75
|
const token_create_handler = async (input, ctx) => {
|
|
@@ -86,7 +85,7 @@ export const create_account_actions = (deps, options = {}) => {
|
|
|
86
85
|
account_id: auth.account.id,
|
|
87
86
|
ip: ctx.client_ip,
|
|
88
87
|
metadata: { token_id: id, name: input.name },
|
|
89
|
-
},
|
|
88
|
+
}, deps);
|
|
90
89
|
return { ok: true, token, id, name: input.name };
|
|
91
90
|
};
|
|
92
91
|
const token_list_handler = async (_input, ctx) => {
|
|
@@ -104,7 +103,7 @@ export const create_account_actions = (deps, options = {}) => {
|
|
|
104
103
|
account_id: auth.account.id,
|
|
105
104
|
ip: ctx.client_ip,
|
|
106
105
|
metadata: { token_id: input.token_id },
|
|
107
|
-
},
|
|
106
|
+
}, deps);
|
|
108
107
|
return { ok: true, revoked };
|
|
109
108
|
};
|
|
110
109
|
return [
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"account_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;
|
|
1
|
+
{"version":3,"file":"account_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAEN,KAAK,OAAO,EACZ,KAAK,KAAK,EACV,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,MAAM,qBAAqB,CAAC;AAE7B;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,OAAO,kBAAkB,KACvB,OAAO,CAAC,OAAO,CAQjB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,OAAO,GAAG,SAAS,CAE7B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,UAAU,MAAM,KACd,OAAO,CAAC,OAAO,GAAG,SAAS,CAI7B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,OAAO,MAAM,KACX,OAAO,CAAC,OAAO,GAAG,SAAS,CAI7B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,GAC9C,MAAM,SAAS,EACf,OAAO,MAAM,KACX,OAAO,CAAC,OAAO,GAAG,SAAS,CAS7B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,eAAe,MAAM,EACrB,YAAY,MAAM,GAAG,IAAI,KACvB,OAAO,CAAC,IAAI,CAKd,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAAU,MAAM,SAAS,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC,OAAO,CAKvF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,OAAO,CAK5E,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAC9B,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,MAAM,MAAM,KACV,OAAO,CAAC,KAAK,CAMf,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,KAAK,GAAG,SAAS,CAE3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,KAAK,GAAG,SAAS,CAE3B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,SAAS,EACf,OAAO,kBAAkB,KACvB,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAC,CAI1C,CAAC;AAyBF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,SAAS,KACb,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CA+EtC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"account_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,qBAAqB,CAAC;AAsBxD,OAAO,EAAkB,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAA+B,KAAK,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAElF,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAQhD,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;kBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAAI,UAAU,oBAAoB,KAAG,SAmChF,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACpC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,CAAC;CACxC;AAED,4CAA4C;AAC5C,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAQ/C;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kFAAkF;IAClF,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IACnE,4FAA4F;IAC5F,0BAA0B,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAID,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;kBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,wFAAwF;AACxF,eAAO,MAAM,WAAW;;kBAEtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,2EAA2E;AAC3E,eAAO,MAAM,WAAW,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,wFAAwF;AACxF,eAAO,MAAM,YAAY;;;kBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,sHAAsH;AACtH,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,uGAAuG;AACvG,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,gBAAgB,EACtB,SAAS,mBAAmB,KAC1B,KAAK,CAAC,SAAS,
|
|
1
|
+
{"version":3,"file":"account_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,qBAAqB,CAAC;AAsBxD,OAAO,EAAkB,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAA+B,KAAK,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAElF,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAQhD,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;kBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC;;;iBAG5C,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAAI,UAAU,oBAAoB,KAAG,SAmChF,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACpC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,CAAC;CACxC;AAED,4CAA4C;AAC5C,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAQ/C;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kFAAkF;IAClF,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IACnE,4FAA4F;IAC5F,0BAA0B,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAID,oFAAoF;AACpF,eAAO,MAAM,UAAU;;;kBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,wFAAwF;AACxF,eAAO,MAAM,WAAW;;kBAEtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,2EAA2E;AAC3E,eAAO,MAAM,WAAW,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,wFAAwF;AACxF,eAAO,MAAM,YAAY;;;kBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,sHAAsH;AACtH,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,uGAAuG;AACvG,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,gBAAgB,EACtB,SAAS,mBAAmB,KAC1B,KAAK,CAAC,SAAS,CAgPjB,CAAC"}
|
|
@@ -174,7 +174,7 @@ export const PasswordChangeOutput = z.strictObject({
|
|
|
174
174
|
* @returns route specs (not yet applied to Hono)
|
|
175
175
|
*/
|
|
176
176
|
export const create_account_route_specs = (deps, options) => {
|
|
177
|
-
const { keyring, password
|
|
177
|
+
const { keyring, password } = deps;
|
|
178
178
|
const { session_options, ip_rate_limiter, login_account_rate_limiter, max_sessions = DEFAULT_MAX_SESSIONS, login_fail_floor_ms = DEFAULT_LOGIN_FAIL_FLOOR_MS, login_fail_jitter_ms = DEFAULT_LOGIN_FAIL_JITTER_MS, } = options;
|
|
179
179
|
return [
|
|
180
180
|
{
|
|
@@ -243,7 +243,7 @@ export const create_account_route_specs = (deps, options) => {
|
|
|
243
243
|
outcome: 'failure',
|
|
244
244
|
ip: get_client_ip(c),
|
|
245
245
|
metadata: { username },
|
|
246
|
-
}, deps
|
|
246
|
+
}, deps);
|
|
247
247
|
await delay;
|
|
248
248
|
return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
|
|
249
249
|
}
|
|
@@ -259,7 +259,7 @@ export const create_account_route_specs = (deps, options) => {
|
|
|
259
259
|
account_id: account.id,
|
|
260
260
|
ip: get_client_ip(c),
|
|
261
261
|
metadata: { username },
|
|
262
|
-
}, deps
|
|
262
|
+
}, deps);
|
|
263
263
|
await delay;
|
|
264
264
|
return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
|
|
265
265
|
}
|
|
@@ -280,7 +280,7 @@ export const create_account_route_specs = (deps, options) => {
|
|
|
280
280
|
event_type: 'login',
|
|
281
281
|
account_id: account.id,
|
|
282
282
|
ip: get_client_ip(c),
|
|
283
|
-
}, deps
|
|
283
|
+
}, deps);
|
|
284
284
|
return c.json({ ok: true });
|
|
285
285
|
},
|
|
286
286
|
},
|
|
@@ -304,7 +304,7 @@ export const create_account_route_specs = (deps, options) => {
|
|
|
304
304
|
actor_id: ctx.actor.id,
|
|
305
305
|
account_id: ctx.account.id,
|
|
306
306
|
ip: get_client_ip(c),
|
|
307
|
-
}, deps
|
|
307
|
+
}, deps);
|
|
308
308
|
return c.json({ ok: true, username: ctx.account.username });
|
|
309
309
|
},
|
|
310
310
|
},
|
|
@@ -351,7 +351,7 @@ export const create_account_route_specs = (deps, options) => {
|
|
|
351
351
|
actor_id: ctx.actor.id,
|
|
352
352
|
account_id: ctx.account.id,
|
|
353
353
|
ip: get_client_ip(c),
|
|
354
|
-
}, deps
|
|
354
|
+
}, deps);
|
|
355
355
|
return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
|
|
356
356
|
}
|
|
357
357
|
// successful verification — reset rate limiters
|
|
@@ -371,7 +371,7 @@ export const create_account_route_specs = (deps, options) => {
|
|
|
371
371
|
account_id: ctx.account.id,
|
|
372
372
|
ip: get_client_ip(c),
|
|
373
373
|
metadata: { sessions_revoked, tokens_revoked },
|
|
374
|
-
}, deps
|
|
374
|
+
}, deps);
|
|
375
375
|
return c.json({ ok: true, sessions_revoked, tokens_revoked });
|
|
376
376
|
},
|
|
377
377
|
},
|
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
* @module
|
|
11
11
|
*/
|
|
12
12
|
import { z } from 'zod';
|
|
13
|
-
import { Uuid } from '
|
|
13
|
+
import { Uuid } from '@fuzdev/fuz_util/id.js';
|
|
14
14
|
/** Minimum username length (must have start + middle + end characters). */
|
|
15
15
|
export declare const USERNAME_LENGTH_MIN = 3;
|
|
16
16
|
/** Maximum username length (matches GitHub's limit). */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"account_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"account_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AACtB,OAAO,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAI5C,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC,gKAAgK;AAChK,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD,0IAA0I;AAC1I,eAAO,MAAM,QAAQ,aAIyB,CAAC;AAC/C,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,oHAAoH;AACpH,eAAO,MAAM,gBAAgB,aAAsD,CAAC;AACpF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,wBAAwB;AACxB,eAAO,MAAM,KAAK,YAAY,CAAC;AAC/B,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAI1C,mEAAmE;AACnE,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,wFAAwF;AACxF,MAAM,WAAW,KAAK;IACrB,EAAE,EAAE,IAAI,CAAC;IACT,UAAU,EAAE,IAAI,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,MAAM,CAAC;AAEpD,oEAAoE;AACpE,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,IAAI,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,4GAA4G;IAC5G,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,+FAA+F;IAC/F,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;CAC7B;AAED,eAAO,MAAM,gBAAgB,GAC5B,GAAG;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAC,EAC1D,MAAK,IAAiB,KACpB,OAA2E,CAAC;AAE/E,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACrB;AAED,6CAA6C;AAC7C,MAAM,WAAW,QAAQ;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,IAAI,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACnB;AAID,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB;;;;;;kBAM7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,6EAA6E;AAC7E,eAAO,MAAM,eAAe;;;;;;kBAM1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB;;;;;;;;kBAQ7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB;;;;;;;kBAO5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB;;;kBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,iGAAiG;AACjG,eAAO,MAAM,gBAAgB;;;;;;;;kBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;kBAQlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAKhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E,MAAM,WAAW,kBAAkB;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,IAAI,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,sGAAsG;IACtG,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,OAAO,KAAG,cAMpD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,KAAG,gBAIlD,CAAC"}
|