@gjermundgaraba/clankerauth-sdk 0.12.0 → 0.13.0

package/dist/session.js

@@ -1,11 +1,20 @@
 /**
  * The identity a browser page needs, without any verification code. This entry point is
- * browser-safe: it declares the `session` contract and builds the issuer's sign-out URL,
- * so a page imports it directly and a server answers it with `resource.session`.
+ * browser-safe: it declares the identity a protected contract states, the `whoami` contract
+ * and the issuer's sign-out URL, so contracts, bindings and pages import it directly, and a
+ * server answers `Whoami` with its resource's `session`.
  */
-import { Schema } from "effect";
+import { Context, Schema } from "effect";
 import * as Action from "@gjermundgaraba/effect-actions/Action";
-import * as ActionGroup from "@gjermundgaraba/effect-actions/ActionGroup";
+/**
+ * The caller: what a protected contract states, `caller: CurrentPrincipal`, and what an
+ * authentication descriptor proves,
+ * `Authentication.make("notes.Login", CurrentPrincipal, { error: ProviderUnavailable })`.
+ * Remotely, the resource's provider gives it per request, from the verified credential; on
+ * a trusted local surface, the host gives it the process, `Notes.local(subject)`.
+ */
+export class CurrentPrincipal extends Context.Service()("@clankerauth/CurrentPrincipal") {
+}
 /** The verified credential behind a request, as the resource server read it. */
 export const Principal = Schema.Struct({
     subject: Schema.NonEmptyString,
@@ -13,15 +22,16 @@ export const Principal = Schema.Struct({
     scopes: Schema.Array(Schema.String),
 });
 /**
- * The credential is a transport concern: a process surface has none, so `whoami` is its
- * own group and never an MCP tool. Bind it with `Http.layer([app, resource.session])`.
+ * The credential is a transport concern: a process surface has none, so bind `Whoami` to
+ * HTTP alone, `ActionHttp.layer(Http, [app, Notes.session])`, and leave `Notes.session` out
+ * of MCP.
  */
-export const Session = ActionGroup.make({ name: "session" }, Action.make("whoami", {
+export const Whoami = Action.make("whoami", {
     description: "The verified subject, issuer and scopes behind this request's credential.",
-    access: "read",
+    readOnly: true,
+    caller: CurrentPrincipal,
     success: Principal,
-    mcp: false,
-}));
+});
 /**
  * Sign out at the issuer, which ends its session and every app's forward cookie, then
  * return to `returnTo`. It is a plain link: any page under the cookie domain may use it.

package/dist/testing.js

@@ -29,7 +29,7 @@ export const startFakeIssuer = async (options) => {
         };
         if (request.url === "/api/auth/jwks")
             return send(failure ?? 200, JSON.stringify({ keys: [jwk] }));
-        if (request.url !== "/api/issuer/keyList" || request.method !== "POST")
+        if (request.url !== "/api/keyList" || request.method !== "POST")
             return send(404, "{}");
         lists++;
         if (failure !== undefined)

package/dist/verify.d.ts

@@ -2,6 +2,11 @@ import { Effect } from "effect";
 import { HttpClient } from "effect/http";
 import { ConfigurationError, InsufficientScope, ProviderUnavailable, Unauthorized } from "./errors.ts";
 import type { AuthenticationError } from "./errors.ts";
+/**
+ * What a verified credential proves: an OAuth client's access token or an API key. A request's
+ * caller, `CurrentPrincipal`, is this or, on a trusted local surface, the process itself, which
+ * no verifier produces: `Caller` of the `/session` entry.
+ */
 export interface Principal {
     readonly subject: string;
     readonly scopes: readonly string[];
@@ -28,7 +33,6 @@ export interface Options {
     readonly apiKeys?: boolean;
 }
 export interface Verifier {
-    readonly verify: (authorization: string | null | undefined) => Effect.Effect<Principal, AuthenticationError>;
     readonly verifyToken: (token: string) => Effect.Effect<Principal, AuthenticationError>;
 }
 /**
@@ -55,21 +59,4 @@ export declare const make: (options: Options) => Effect.Effect<{
         };
         expiresAt: number | undefined;
     }, InsufficientScope | ProviderUnavailable | Unauthorized, never>;
-    verify: (authorization: string | null | undefined) => Effect.Effect<{
-        subject: string;
-        scopes: string[];
-        actor: {
-            kind: "client";
-            clientId: string;
-        };
-        expiresAt: number;
-    } | {
-        subject: string;
-        scopes: readonly string[];
-        actor: {
-            kind: "key";
-            keyId: string;
-        };
-        expiresAt: number | undefined;
-    }, InsufficientScope | ProviderUnavailable | Unauthorized, never>;
 }, ConfigurationError, HttpClient.HttpClient>;

package/dist/verify.js

@@ -26,7 +26,7 @@ const Claims = Schema.Struct({
 /** The list document as the issuer's `keyList` action answers it. */
 const KeyListResponse = Schema.Struct({ list: Schema.String });
 const KeyListClaims = KeyList.Claims.pipe(Schema.fieldsAssign({ exp: Schema.Finite }));
-const unauthorized = (cause) => new Unauthorized({ message: "Authentication required", cause });
+const unauthorized = (cause) => new Unauthorized({ cause });
 /** How long a JWKS document answers verification before it is read again. */
 const documentLifetime = "1 minute";
 /**
@@ -50,7 +50,7 @@ export const make = Effect.fn("Verifier.make")(function* (options) {
     const endpoints = yield* Effect.try({
         try: () => ({
             jwks: new URL(`${options.issuer}/jwks`).href,
-            keyList: new URL("/api/issuer/keyList", options.issuer).href,
+            keyList: new URL("/api/keyList", options.issuer).href,
         }),
         catch: () => new ConfigurationError({ message: "Invalid issuer URL" }),
     });
@@ -207,16 +207,8 @@ export const make = Effect.fn("Verifier.make")(function* (options) {
             : verifyJwt(token);
         const missing = options.requiredScopes?.find((scope) => !principal.scopes.includes(scope));
         if (missing !== undefined)
-            return yield* new InsufficientScope({ scope: missing });
+            return yield* new InsufficientScope({ scope: missing, actor: principal.actor });
         return principal;
     });
-    return {
-        verifyToken,
-        verify: Effect.fn("Verifier.verify")(function* (authorization) {
-            const token = /^Bearer ([^\s,]+)$/iu.exec(authorization ?? "")?.[1];
-            if (!token)
-                return yield* unauthorized();
-            return yield* verifyToken(token);
-        }),
-    };
+    return { verifyToken };
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjermundgaraba/clankerauth-sdk",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Effect-native clankerauth access-token and offline API-key verification, with optional effect-actions integration",
   "license": "MIT",
   "repository": {
@@ -46,7 +46,7 @@
     "jose": "6.2.12"
   },
   "devDependencies": {
-    "@gjermundgaraba/effect-actions": "0.9.0",
+    "@gjermundgaraba/effect-actions": "0.10.0",
     "@modelcontextprotocol/client": "2.0.0",
     "@types/node": "26.6.2",
     "effect": "4.0.0",
@@ -55,7 +55,7 @@
     "vite-plus": "1.0.0"
   },
   "peerDependencies": {
-    "@gjermundgaraba/effect-actions": "^0.9.0",
+    "@gjermundgaraba/effect-actions": "^0.10.0",
     "effect": "^4.0.0"
   },
   "peerDependenciesMeta": {