@gjermundgaraba/clankerauth-admin-api 0.27.0 → 0.28.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +7 -4
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -14,10 +14,10 @@ Effect 4.0, from 4.0.4, and effect-actions are peers, shared with the program.
|
|
|
14
14
|
|
|
15
15
|
## Call administration from a program
|
|
16
16
|
|
|
17
|
-
`OwnerHttp` is the binding served at `/api/owner/<action>`, authenticated by an owner's access token for the administration resource, the issuer's origin root. The owner's sign-in that `clankerauth login <issuer>` keeps gives
|
|
17
|
+
`OwnerHttp` is the binding served at `/api/owner/<action>`, authenticated by an owner's access token for the administration resource, the issuer's origin root, or by an administration key: an API key granted `clankerauth:read` or `clankerauth:write` on that resource. The owner's sign-in that `clankerauth login <issuer>` keeps gives a token: `authorizing` of [`@gjermundgaraba/clankerauth-sdk/credentials`](../sdk/README.md) sends it with each request, refreshed as it expires, and the methods fail with `SignInRequired` when there is none. Given `token`, `authorizing` sends what the environment holds instead, so the program below runs unattended with an administration key in `CLANKERAUTH_TOKEN`, the variable the `clankerauth` command reads too, and with the owner's sign-in when it is unset.
|
|
18
18
|
|
|
19
19
|
```ts
|
|
20
|
-
import { Effect } from "effect";
|
|
20
|
+
import { Config, Effect } from "effect";
|
|
21
21
|
import { FetchHttpClient } from "effect/http";
|
|
22
22
|
import * as ActionHttp from "@gjermundgaraba/effect-actions/ActionHttp";
|
|
23
23
|
import * as Credentials from "@gjermundgaraba/clankerauth-sdk/credentials";
|
|
@@ -28,7 +28,10 @@ const issuer = "https://clankerauth.home.example";
|
|
|
28
28
|
const program = Effect.gen(function* () {
|
|
29
29
|
const admin = yield* ActionHttp.client(OwnerHttp, {
|
|
30
30
|
baseUrl: issuer,
|
|
31
|
-
transformClient: Credentials.authorizing({
|
|
31
|
+
transformClient: Credentials.authorizing({
|
|
32
|
+
url: issuer,
|
|
33
|
+
token: Config.Redacted("CLANKERAUTH_TOKEN"),
|
|
34
|
+
}),
|
|
32
35
|
});
|
|
33
36
|
|
|
34
37
|
const { created } = yield* admin.putResource({
|
|
@@ -43,6 +46,6 @@ const program = Effect.gen(function* () {
|
|
|
43
46
|
|
|
44
47
|
A refusal fails with its tagged error, such as `ResourceNotFound` from `getResource` or `deleteResource`; each action declares the ones it can produce. `getResource` reads one resource, `putResource` creates or updates one to exactly the name and scopes given, so a deployment tool states what it wants without choosing between create and update, and `deleteResource` removes one.
|
|
45
48
|
|
|
46
|
-
|
|
49
|
+
The owner creates an administration key with `clankerauth create-api-key --name deployer --permissions '{"https://clankerauth.home.example/":["clankerauth:read","clankerauth:write"]}' --expires-at null`, or in the dashboard. What it may do, and when a change to it applies, is in [the issuer's README](../../README.md#administer-unattended-with-an-api-key).
|
|
47
50
|
|
|
48
51
|
MIT licensed.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@gjermundgaraba/clankerauth-admin-api",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.28.1",
|
|
4
4
|
"description": "The clankerauth administration contract: its effect-actions actions, schemas, errors and HTTP bindings, for administering an issuer from a program.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"repository": {
|