@ic-reactor/mcp 0.0.0-stage → 0.0.0

package/examples/vite-wallet/src/auth/wallet-auth.test.ts

@@ -0,0 +1,159 @@
+// Scenarios 2 and 3: one client whose `auth` offers Internet Identity and the
+// dev account. A real `createClient` reads the auth here; it makes no call
+// (its `fetch` refuses), since what is tested is who the client says calls,
+// and what its keys are built for.
+//
+// Internet Identity is stood in for by the sign-in of `createTestClient()`,
+// which has an AuthClient's surface: borrowed from a test client that is
+// never used, as `@ic-reactor/core/testing` allows.
+import { createClient, type Client } from "@ic-reactor/core"
+import { createTestClient } from "@ic-reactor/core/testing"
+import { afterEach, describe, expect, it, vi } from "vitest"
+import { actor, type Actor } from "../canisters/ledger.ts"
+import { SEED_1 } from "../test/test-wallet.tsx"
+import { ICP_LEDGER } from "../use-canisters.ts"
+import { createDevAccounts, type AccountStorage } from "./dev-accounts.ts"
+import { createWalletAuth } from "./wallet-auth.ts"
+
+const memoryStorage = (): AccountStorage => {
+  const map = new Map<string, string>()
+  return {
+    getItem: (key) => map.get(key) ?? null,
+    setItem: (key, value) => void map.set(key, value),
+  }
+}
+
+/** A sign-in shaped like `AuthClient`, signed out, owned by nobody yet. */
+function borrowedInternetIdentity() {
+  const unused = createTestClient({ signedIn: false })
+  unused.client.dispose()
+  return unused.auth
+}
+
+const noNetwork: typeof fetch = async () => {
+  throw new Error("this test makes no call")
+}
+
+let client: Client | undefined
+afterEach(() => client?.dispose())
+
+function setUp(options: { devAccounts?: boolean } = {}) {
+  const internetIdentity = borrowedInternetIdentity()
+  const devAccounts =
+    options.devAccounts === false
+      ? undefined
+      : createDevAccounts(memoryStorage())
+  client = createClient({
+    network: "env",
+    auth: () => createWalletAuth({ internetIdentity, devAccounts }),
+    fetch: noNetwork,
+  })
+  const ledger = client.canister<Actor>(actor, { id: ICP_LEDGER })
+  /** The caller segment of the keys the client builds now. */
+  const keyCaller = () => String(client?.queryKey(ledger)[2])
+  return { client, internetIdentity, devAccounts, keyCaller }
+}
+
+describe("the wallet's auth", () => {
+  it("starts anonymous: reads keyed by the anonymous principal, no write allowed", () => {
+    const { client, keyCaller } = setUp()
+    expect(client.authState()).toEqual({
+      status: "anonymous",
+      principal: "2vxsx-fae",
+    })
+    expect(keyCaller()).toBe("2vxsx-fae")
+  })
+
+  it("signs in with Internet Identity when the options say so", async () => {
+    const { client, keyCaller } = setUp()
+    await client.signIn({ with: "internet-identity" })
+    // `toMatchObject`: a session's `expiresAt` comes with it.
+    expect(client.authState()).toMatchObject({
+      status: "signed-in",
+      principal: SEED_1,
+    })
+    expect(keyCaller()).toBe(SEED_1)
+  })
+
+  it("signs in with a dev account, and signs Internet Identity out", async () => {
+    const { client, internetIdentity, devAccounts, keyCaller } = setUp()
+    await client.signIn({ with: "internet-identity" })
+
+    await client.signIn({ with: "dev-account" })
+
+    const dev = devAccounts?.list()[0]?.principal
+    expect(client.caller()).toBe(dev)
+    expect(keyCaller()).toBe(dev)
+    expect(internetIdentity.getStatus().state).toBe("signed-out")
+  })
+
+  it("switches dev accounts with one change of caller, never anonymous in between", async () => {
+    const { client, devAccounts } = setUp()
+    await client.signIn({ with: "dev-account", account: 1 })
+    const seen: string[] = []
+    client.subscribe(() => seen.push(client.authState().principal))
+
+    await client.signIn({ with: "dev-account", account: 2 })
+
+    const second = devAccounts?.list()[1]?.principal
+    expect(second).toBeDefined()
+    expect(seen).toEqual([second])
+    expect(client.caller()).toBe(second)
+  })
+
+  it("keeps the dev account until an Internet Identity sign-in has succeeded", async () => {
+    const { client, internetIdentity, devAccounts } = setUp()
+    await client.signIn({ with: "dev-account" })
+    const dev = client.caller()
+    // The Internet Identity window is closed without signing in.
+    const closed = vi
+      .spyOn(internetIdentity, "signIn")
+      .mockRejectedValueOnce(new Error("the window was closed"))
+
+    await expect(client.signIn({ with: "internet-identity" })).rejects.toThrow(
+      "the window was closed"
+    )
+    expect(client.caller()).toBe(dev)
+
+    closed.mockRestore()
+    await client.signIn({ with: "internet-identity" })
+    expect(client.caller()).toBe(SEED_1)
+    expect(devAccounts?.getStatus().state).toBe("signed-out")
+  })
+
+  it("signs out of whichever source is signed in", async () => {
+    const { client, devAccounts } = setUp()
+    await client.signIn({ with: "dev-account" })
+    await client.signOut()
+    expect(client.authState().status).toBe("anonymous")
+    expect(devAccounts?.getStatus().state).toBe("signed-out")
+  })
+
+  it("reports an expired Internet Identity session as expired, calling anonymously", async () => {
+    const { client, internetIdentity } = setUp()
+    await client.signIn({ with: "internet-identity" })
+    internetIdentity.expire()
+    expect(client.authState()).toEqual({
+      status: "expired",
+      principal: "2vxsx-fae",
+    })
+  })
+
+  it("offers no dev account where there is none (a deployed page)", async () => {
+    const { client } = setUp({ devAccounts: false })
+    await expect(client.signIn({ with: "dev-account" })).rejects.toThrow(
+      "The dev account is offered on a local page only."
+    )
+    await expect(client.signIn({ with: "passkey" })).rejects.toThrow(TypeError)
+    expect(client.authState().status).toBe("anonymous")
+  })
+
+  it("is disposed with the client: Internet Identity with it, the tab's dev accounts not", async () => {
+    const { client, internetIdentity, devAccounts } = setUp()
+    await client.signIn({ with: "dev-account" })
+    client.dispose()
+    expect(internetIdentity.disposed).toBe(true)
+    // The accounts outlive the client: the next client of the tab uses them.
+    expect(devAccounts?.getStatus().state).toBe("signed-in")
+  })
+})

package/examples/vite-wallet/src/auth/wallet-auth.ts

@@ -0,0 +1,131 @@
+// Scenarios 2 and 3: one client, two ways to sign in.
+//
+// A client has exactly one `auth`. To offer Internet Identity and the dev
+// account side by side, this `AuthLike` holds both and answers for whichever
+// one is signed in. Which one a sign-in uses travels in its options:
+// `client.signIn(options)` (and `useAuth().signIn(options)`) hand `options`
+// to the auth as they are, so
+//
+//   signIn({ with: "internet-identity" })
+//   signIn({ with: "dev-account", account: 2 })
+//
+// pick the source. Signing in with one signs the other out, so a reload never
+// finds two sessions. Whoever this auth reports is who every call is signed
+// by, and the query keys carry their principal: after a switch from one
+// account to another (scenario 3), the next account's reads never use the
+// keys of the previous account's answers.
+import type { AuthLike } from "@ic-reactor/core"
+import { AnonymousIdentity } from "@icp-sdk/core/agent"
+import type { DevAccounts } from "./dev-accounts.ts"
+
+/** What `signIn` takes: which source, and for the dev account, which account. */
+export type SignInChoice =
+  | { readonly with: "internet-identity" }
+  | { readonly with: "dev-account"; readonly account?: number }
+
+type Source = SignInChoice["with"]
+
+/** The choice `options` makes; no options is Internet Identity. */
+function readChoice(options: unknown): SignInChoice {
+  if (options === undefined) return { with: "internet-identity" }
+  const choice = options as { with?: unknown; account?: unknown }
+  if (choice.with === "internet-identity") return { with: "internet-identity" }
+  if (choice.with === "dev-account") {
+    return typeof choice.account === "number"
+      ? { with: "dev-account", account: choice.account }
+      : { with: "dev-account" }
+  }
+  throw new TypeError(
+    `Sign in with { with: "internet-identity" } or { with: "dev-account", account? }, got ${JSON.stringify(options)}.`
+  )
+}
+
+/**
+ * The auth of the wallet's client.
+ *
+ * @param sources.internetIdentity - Internet Identity's sign-in: an
+ * `AuthClient` in the app. This auth owns it and disposes it.
+ * @param sources.devAccounts - The tab's dev accounts, on a local page only.
+ * They belong to the tab and are not disposed here.
+ */
+export function createWalletAuth(sources: {
+  readonly internetIdentity: AuthLike
+  readonly devAccounts?: DevAccounts
+}): AuthLike {
+  const { internetIdentity, devAccounts } = sources
+  const anonymous = new AnonymousIdentity()
+
+  const sourceOf = (which: Source): AuthLike | undefined =>
+    which === "dev-account" ? devAccounts : internetIdentity
+  const other = (which: Source): Source =>
+    which === "dev-account" ? "internet-identity" : "dev-account"
+  const holdsSession = (source: AuthLike | undefined): boolean =>
+    source !== undefined && source.getStatus().state !== "signed-out"
+
+  /** The source asked for last; on load, a dev account wins (it is this tab's). */
+  let preferred: Source =
+    devAccounts?.getStatus().state === "signed-in"
+      ? "dev-account"
+      : "internet-identity"
+
+  /**
+   * The source this auth answers for: the preferred one while it holds a
+   * session (an expired one included, so the page can say it expired), else
+   * the other one while that does, else none.
+   */
+  const active = (): AuthLike | undefined => {
+    const first = sourceOf(preferred)
+    if (holdsSession(first)) return first
+    const second = sourceOf(other(preferred))
+    return holdsSession(second) ? second : undefined
+  }
+
+  return {
+    getPrincipal: () => active()?.getPrincipal(),
+    getStatus: () => active()?.getStatus() ?? { state: "signed-out" },
+    getIdentity: () => active()?.getIdentity() ?? Promise.resolve(anonymous),
+    subscribe(listener) {
+      const stops = [
+        internetIdentity.subscribe(listener),
+        devAccounts?.subscribe(listener),
+      ]
+      return () => {
+        for (const stop of stops) stop?.()
+      }
+    },
+    async signIn(options) {
+      const choice = readChoice(options)
+      if (choice.with === "dev-account") {
+        if (devAccounts === undefined) {
+          throw new Error("The dev account is offered on a local page only.")
+        }
+        // Preferred first, so that the dev account's own notification
+        // already reports it, and the session it replaces never shows again.
+        preferred = "dev-account"
+        await devAccounts.signIn({ account: choice.account })
+        if (holdsSession(internetIdentity)) {
+          // The dev account answers already; ending the Internet Identity
+          // session is housekeeping, and its failure (the revoke call did
+          // not get through) must not undo a sign-in that happened.
+          await internetIdentity.signOut().catch(() => undefined)
+        }
+        return
+      }
+      // Started before anything else is awaited: the Internet Identity
+      // window opens from the click that asked for it. Until it resolves the
+      // dev account, if one is signed in, keeps answering.
+      await internetIdentity.signIn()
+      preferred = "internet-identity"
+      if (devAccounts?.getStatus().state === "signed-in") {
+        await devAccounts.signOut()
+      }
+    },
+    async signOut(options) {
+      // AuthClient's `{ returnTo }` passes through; the dev account takes none.
+      await active()?.signOut(options)
+    },
+    dispose() {
+      internetIdentity.dispose?.()
+    },
+  }
+}

package/examples/vite-wallet/src/canisters/backend.envelope.json

@@ -0,0 +1,275 @@
+{
+  "contract": {
+    "actor": {
+      "kind": "service",
+      "service": 0
+    },
+    "canonicalization_profile": "candid-core-canon-1",
+    "declarations": [
+      {
+        "name": "Contact",
+        "type": 3
+      },
+      {
+        "name": "Profile",
+        "type": 13
+      },
+      {
+        "name": "Refusal",
+        "type": 9
+      }
+    ],
+    "format": "candid-core",
+    "format_version": 1,
+    "identities": {
+      "contract": "candid-core:contract:v1:sha256:98c1678c38d6f52ba76d4c05ffea6243cb9e30cb948df457e353d55bd9c64af9",
+      "interface": "candid-core:interface:v1:sha256:f26e149843a1777cca4b5019187b4d932d957796f2d884bbc06bee8a8562e0ad"
+    },
+    "producer": {
+      "candid_parser_version": "0.4.0",
+      "candid_version": "0.10.30",
+      "name": "meant",
+      "version": "0.1.0"
+    },
+    "semantics_profile": "candid-1",
+    "types": [
+      {
+        "kind": "service",
+        "methods": [
+          {
+            "function": 1,
+            "id": 745984467,
+            "name": "contacts"
+          },
+          {
+            "function": 6,
+            "id": 1137792101,
+            "name": "remove_contact"
+          },
+          {
+            "function": 11,
+            "id": 1998030664,
+            "name": "set_name"
+          },
+          {
+            "function": 14,
+            "id": 2034477376,
+            "name": "get_profile"
+          },
+          {
+            "function": 16,
+            "id": 2866237250,
+            "name": "add_contact"
+          }
+        ]
+      },
+      {
+        "args": [],
+        "kind": "func",
+        "mode": "query",
+        "results": [
+          2
+        ]
+      },
+      {
+        "inner": 3,
+        "kind": "vec"
+      },
+      {
+        "fields": [
+          {
+            "id": 947296307,
+            "type": 4
+          },
+          {
+            "id": 1224700491,
+            "type": 5
+          }
+        ],
+        "kind": "record"
+      },
+      {
+        "kind": "primitive",
+        "primitive": "principal"
+      },
+      {
+        "kind": "primitive",
+        "primitive": "text"
+      },
+      {
+        "args": [
+          5
+        ],
+        "kind": "func",
+        "mode": "update",
+        "results": [
+          7
+        ]
+      },
+      {
+        "fields": [
+          {
+            "id": 17724,
+            "type": 8
+          },
+          {
+            "id": 3456837,
+            "type": 9
+          }
+        ],
+        "kind": "variant"
+      },
+      {
+        "kind": "primitive",
+        "primitive": "null"
+      },
+      {
+        "fields": [
+          {
+            "id": 434500685,
+            "type": 8
+          },
+          {
+            "id": 782112175,
+            "type": 10
+          },
+          {
+            "id": 909586774,
+            "type": 5
+          },
+          {
+            "id": 1851232335,
+            "type": 5
+          },
+          {
+            "id": 2504087746,
+            "type": 5
+          }
+        ],
+        "kind": "variant"
+      },
+      {
+        "kind": "primitive",
+        "primitive": "nat32"
+      },
+      {
+        "args": [
+          5
+        ],
+        "kind": "func",
+        "mode": "update",
+        "results": [
+          12
+        ]
+      },
+      {
+        "fields": [
+          {
+            "id": 17724,
+            "type": 13
+          },
+          {
+            "id": 3456837,
+            "type": 9
+          }
+        ],
+        "kind": "variant"
+      },
+      {
+        "fields": [
+          {
+            "id": 1224700491,
+            "type": 5
+          }
+        ],
+        "kind": "record"
+      },
+      {
+        "args": [],
+        "kind": "func",
+        "mode": "query",
+        "results": [
+          15
+        ]
+      },
+      {
+        "inner": 13,
+        "kind": "opt"
+      },
+      {
+        "args": [
+          3
+        ],
+        "kind": "func",
+        "mode": "update",
+        "results": [
+          7
+        ]
+      }
+    ]
+  },
+  "extensions": {
+    "org.candid-core.field-names/v1": [
+      [
+        3,
+        947296307,
+        "owner"
+      ],
+      [
+        3,
+        1224700491,
+        "name"
+      ],
+      [
+        7,
+        17724,
+        "Ok"
+      ],
+      [
+        7,
+        3456837,
+        "Err"
+      ],
+      [
+        9,
+        434500685,
+        "Anonymous"
+      ],
+      [
+        9,
+        782112175,
+        "Full"
+      ],
+      [
+        9,
+        909586774,
+        "DuplicateName"
+      ],
+      [
+        9,
+        1851232335,
+        "NotFound"
+      ],
+      [
+        9,
+        2504087746,
+        "InvalidName"
+      ],
+      [
+        12,
+        17724,
+        "Ok"
+      ],
+      [
+        12,
+        3456837,
+        "Err"
+      ],
+      [
+        13,
+        1224700491,
+        "name"
+      ]
+    ]
+  }
+}

package/examples/vite-wallet/src/canisters/backend.ts

@@ -0,0 +1,58 @@
+// Generated by Meant from a Meant Contract. Do not edit.
+import * as $ from "@meantjs/schema";
+
+export type Contact = { owner: $.Principal; name: string };
+const $Contact: $.Schema<Contact> = $.c.rec(() => $.c.record({ owner: $.c.principal, name: $.c.text }));
+export { $Contact as Contact };
+
+export type Profile = { name: string };
+const $Profile: $.Schema<Profile> = $.c.rec(() => $.c.record({ name: $.c.text }));
+export { $Profile as Profile };
+
+/**
+ * Why a write was refused. ic-reactor rejects such a reply as a
+ * `canister_err`, with this value in its `err`.
+ */
+export type Refusal =
+  | {
+      /** The caller is the anonymous principal. */
+      tag: "Anonymous";
+    }
+  | {
+      /** The address book holds at most this many contacts. */
+      tag: "Full";
+      value: number;
+    }
+  | {
+      /** The address book already has a contact of this name. */
+      tag: "DuplicateName";
+      value: string;
+    }
+  | {
+      /** The address book has no contact of this name. */
+      tag: "NotFound";
+      value: string;
+    }
+  | {
+      /** The name is empty, longer than 32 characters, or has a control character. */
+      tag: "InvalidName";
+      value: string;
+    };
+/**
+ * Why a write was refused. ic-reactor rejects such a reply as a
+ * `canister_err`, with this value in its `err`.
+ */
+const $Refusal: $.Schema<Refusal> = $.c.rec(() => $.c.variant({ Anonymous: $.c.null, Full: $.c.nat32, DuplicateName: $.c.text, NotFound: $.c.text, InvalidName: $.c.text }));
+export { $Refusal as Refusal };
+
+const $actor: $.Schema<$.Principal> = $.c.rec(() => $.c.service({ contacts: $.c.func([], [$.c.vec($Contact)], "query"), remove_contact: $.c.func([$.c.text], [$.c.variant({ Ok: $.c.null, Err: $Refusal })], "update"), set_name: $.c.func([$.c.text], [$.c.variant({ Ok: $Profile, Err: $Refusal })], "update"), get_profile: $.c.func([], [$.c.opt($Profile)], "query"), add_contact: $.c.func([$Contact], [$.c.variant({ Ok: $.c.null, Err: $Refusal })], "update") }));
+export type Actor = {
+  /** The caller's contacts, in the order they were added. */
+  contacts: (() => Promise<Array<Contact>>) & $.WithMode<"query">;
+  remove_contact: ((arg0: string) => Promise<{ tag: "Ok" } | { tag: "Err"; value: Refusal }>) & $.WithMode<"update">;
+  set_name: ((arg0: string) => Promise<{ tag: "Ok"; value: Profile } | { tag: "Err"; value: Refusal }>) & $.WithMode<"update">;
+  /** The caller's profile, or null before their first set_name. */
+  get_profile: (() => Promise<Profile | null>) & $.WithMode<"query">;
+  add_contact: ((arg0: Contact) => Promise<{ tag: "Ok" } | { tag: "Err"; value: Refusal }>) & $.WithMode<"update">;
+};
+export { $actor as actor };