@gjermundgaraba/clankerauth-sdk 0.12.0 → 0.14.0

package/dist/session.js

@@ -1,11 +1,20 @@
 /**
  * The identity a browser page needs, without any verification code. This entry point is
- * browser-safe: it declares the `session` contract and builds the issuer's sign-out URL,
- * so a page imports it directly and a server answers it with `resource.session`.
+ * browser-safe: it declares the identity a protected contract states, the `whoami` contract
+ * and the issuer's sign-out URL, so contracts, bindings and pages import it directly, and a
+ * server answers `Whoami` with its resource's `session`.
  */
-import { Schema } from "effect";
+import { Context, Schema } from "effect";
 import * as Action from "@gjermundgaraba/effect-actions/Action";
-import * as ActionGroup from "@gjermundgaraba/effect-actions/ActionGroup";
+/**
+ * The caller: what a protected contract states, `caller: CurrentPrincipal`, and what an
+ * authentication descriptor proves,
+ * `Authentication.make("notes.Login", CurrentPrincipal, { error: ProviderUnavailable })`.
+ * Remotely, the resource's provider gives it per request, from the verified credential; on
+ * a trusted local surface, the host gives it the process, `Notes.local(subject)`.
+ */
+export class CurrentPrincipal extends Context.Service()("@clankerauth/CurrentPrincipal") {
+}
 /** The verified credential behind a request, as the resource server read it. */
 export const Principal = Schema.Struct({
     subject: Schema.NonEmptyString,
@@ -13,15 +22,16 @@ export const Principal = Schema.Struct({
     scopes: Schema.Array(Schema.String),
 });
 /**
- * The credential is a transport concern: a process surface has none, so `whoami` is its
- * own group and never an MCP tool. Bind it with `Http.layer([app, resource.session])`.
+ * The credential is a transport concern: a process surface has none, so bind `Whoami` to
+ * HTTP alone, `ActionHttp.layer(Http, [app, Notes.session])`, and leave `Notes.session` out
+ * of MCP.
  */
-export const Session = ActionGroup.make({ name: "session" }, Action.make("whoami", {
+export const Whoami = Action.make("whoami", {
     description: "The verified subject, issuer and scopes behind this request's credential.",
-    access: "read",
+    readOnly: true,
+    caller: CurrentPrincipal,
     success: Principal,
-    mcp: false,
-}));
+});
 /**
  * Sign out at the issuer, which ends its session and every app's forward cookie, then
  * return to `returnTo`. It is a plain link: any page under the cookie domain may use it.

package/dist/testing.js

@@ -29,7 +29,7 @@ export const startFakeIssuer = async (options) => {
         };
         if (request.url === "/api/auth/jwks")
             return send(failure ?? 200, JSON.stringify({ keys: [jwk] }));
-        if (request.url !== "/api/issuer/keyList" || request.method !== "POST")
+        if (request.url !== "/api/keyList" || request.method !== "POST")
             return send(404, "{}");
         lists++;
         if (failure !== undefined)

package/dist/verify.d.ts

@@ -2,6 +2,11 @@ import { Effect } from "effect";
 import { HttpClient } from "effect/http";
 import { ConfigurationError, InsufficientScope, ProviderUnavailable, Unauthorized } from "./errors.ts";
 import type { AuthenticationError } from "./errors.ts";
+/**
+ * What a verified credential proves: an OAuth client's access token or an API key. A request's
+ * caller, `CurrentPrincipal`, is this or, on a trusted local surface, the process itself, which
+ * no verifier produces: `Caller` of the `/session` entry.
+ */
 export interface Principal {
     readonly subject: string;
     readonly scopes: readonly string[];
@@ -28,7 +33,6 @@ export interface Options {
     readonly apiKeys?: boolean;
 }
 export interface Verifier {
-    readonly verify: (authorization: string | null | undefined) => Effect.Effect<Principal, AuthenticationError>;
     readonly verifyToken: (token: string) => Effect.Effect<Principal, AuthenticationError>;
 }
 /**
@@ -55,21 +59,4 @@ export declare const make: (options: Options) => Effect.Effect<{
         };
         expiresAt: number | undefined;
     }, InsufficientScope | ProviderUnavailable | Unauthorized, never>;
-    verify: (authorization: string | null | undefined) => Effect.Effect<{
-        subject: string;
-        scopes: string[];
-        actor: {
-            kind: "client";
-            clientId: string;
-        };
-        expiresAt: number;
-    } | {
-        subject: string;
-        scopes: readonly string[];
-        actor: {
-            kind: "key";
-            keyId: string;
-        };
-        expiresAt: number | undefined;
-    }, InsufficientScope | ProviderUnavailable | Unauthorized, never>;
 }, ConfigurationError, HttpClient.HttpClient>;

package/dist/verify.js

@@ -1,4 +1,4 @@
-import { Cause, Clock, Duration, Effect, Exit, Ref, Result, Schema } from "effect";
+import { Clock, Duration, Effect, Exit, Ref, Result, Schema } from "effect";
 import { createLocalJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
 import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/http";
 import { ConfigurationError, InsufficientScope, ProviderUnavailable, Unauthorized, } from "./errors.js";
@@ -26,7 +26,7 @@ const Claims = Schema.Struct({
 /** The list document as the issuer's `keyList` action answers it. */
 const KeyListResponse = Schema.Struct({ list: Schema.String });
 const KeyListClaims = KeyList.Claims.pipe(Schema.fieldsAssign({ exp: Schema.Finite }));
-const unauthorized = (cause) => new Unauthorized({ message: "Authentication required", cause });
+const unauthorized = (cause) => new Unauthorized({ cause });
 /** How long a JWKS document answers verification before it is read again. */
 const documentLifetime = "1 minute";
 /**
@@ -50,7 +50,7 @@ export const make = Effect.fn("Verifier.make")(function* (options) {
     const endpoints = yield* Effect.try({
         try: () => ({
             jwks: new URL(`${options.issuer}/jwks`).href,
-            keyList: new URL("/api/issuer/keyList", options.issuer).href,
+            keyList: new URL("/api/keyList", options.issuer).href,
         }),
         catch: () => new ConfigurationError({ message: "Invalid issuer URL" }),
     });
@@ -66,15 +66,10 @@ export const make = Effect.fn("Verifier.make")(function* (options) {
             keys: jwks.keys.map(({ key_ops, ...key }) => key_ops ? { ...key, key_ops: [...key_ops] } : key),
         });
     }, Effect.scoped);
-    // One read serves every key identifier until it expires, whatever its outcome, so an
-    // unknown `kid` in an unauthenticated request never becomes traffic at the issuer.
-    const read = yield* Effect.cachedWithTTL(document(), (exit) => Exit.isSuccess(exit) ? documentLifetime : cooldown);
-    // Replaying a read must not hand a later request the interruption of an earlier
-    // one's deadline; within the window the issuer simply was not reached.
-    const replayed = (cached, operation) => Effect.catchCause(cached, (cause) => Cause.hasInterrupts(cause)
-        ? Effect.fail(new ProviderUnavailable({ operation }))
-        : Effect.failCause(cause));
-    const keys = replayed(read, "jwks.refresh");
+    // One read serves every key identifier until it expires, or for the cooldown if it
+    // failed, so an unknown `kid` in an unauthenticated request never becomes traffic at
+    // the issuer. A read every caller gave up on is dropped, and the next caller reads again.
+    const keys = yield* Effect.cachedWithTTL(document(), (exit) => Exit.isSuccess(exit) ? documentLifetime : cooldown);
     const signingKey = Effect.fn("Verifier.signingKey")(function* (kid) {
         const resolve = yield* keys;
         return yield* Effect.tryPromise({
@@ -159,7 +154,7 @@ export const make = Effect.fn("Verifier.make")(function* (options) {
     const held = yield* Ref.make(undefined);
     /** The list read now, or within the cooldown, or else the held one, while inside its window. */
     const latest = Effect.gen(function* () {
-        const fetched = yield* Effect.result(replayed(readList, "key-list.refresh"));
+        const fetched = yield* Effect.result(readList);
         if (Result.isSuccess(fetched))
             yield* Ref.set(held, fetched.success);
         const list = yield* Ref.get(held);
@@ -207,16 +202,8 @@ export const make = Effect.fn("Verifier.make")(function* (options) {
             : verifyJwt(token);
         const missing = options.requiredScopes?.find((scope) => !principal.scopes.includes(scope));
         if (missing !== undefined)
-            return yield* new InsufficientScope({ scope: missing });
+            return yield* new InsufficientScope({ scope: missing, actor: principal.actor });
         return principal;
     });
-    return {
-        verifyToken,
-        verify: Effect.fn("Verifier.verify")(function* (authorization) {
-            const token = /^Bearer ([^\s,]+)$/iu.exec(authorization ?? "")?.[1];
-            if (!token)
-                return yield* unauthorized();
-            return yield* verifyToken(token);
-        }),
-    };
+    return { verifyToken };
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjermundgaraba/clankerauth-sdk",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Effect-native clankerauth access-token and offline API-key verification, with optional effect-actions integration",
   "license": "MIT",
   "repository": {
@@ -46,17 +46,17 @@
     "jose": "6.2.12"
   },
   "devDependencies": {
-    "@gjermundgaraba/effect-actions": "0.9.0",
-    "@modelcontextprotocol/client": "2.0.0",
-    "@types/node": "26.6.2",
-    "effect": "4.0.0",
+    "@gjermundgaraba/effect-actions": "0.11.0",
+    "@modelcontextprotocol/client": "2.3.1",
+    "@types/node": "26.6.4",
+    "effect": "4.0.2",
     "typescript": "7.0.2",
-    "vite": "npm:@voidzero-dev/vite-plus-core@1.0.0",
-    "vite-plus": "1.0.0"
+    "vite": "npm:@voidzero-dev/vite-plus-core@1.1.0",
+    "vite-plus": "1.1.0"
   },
   "peerDependencies": {
-    "@gjermundgaraba/effect-actions": "^0.9.0",
-    "effect": "^4.0.0"
+    "@gjermundgaraba/effect-actions": "^0.11.0",
+    "effect": "^4.0.2"
   },
   "peerDependenciesMeta": {
     "@gjermundgaraba/effect-actions": {