@jskit-ai/auth-core 0.1.144 → 0.1.145

package/package.descriptor.mjs

@@ -1,7 +1,7 @@
 export default Object.freeze({
   "packageVersion": 1,
   "packageId": "@jskit-ai/auth-core",
-  "version": "0.1.144",
+  "version": "0.1.145",
   "kind": "runtime",
   "dependsOn": [
     "@jskit-ai/value-app-config-shared"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-core",
-  "version": "0.1.144",
+  "version": "0.1.145",
   "type": "module",
   "scripts": {
     "test": "node --test"

package/src/server/providers/AuthActionsServiceProvider.js

@@ -51,6 +51,15 @@ class AuthActionsServiceProvider {
         }
       );
     }
+  }
+
+  boot(app) {
+    // auth-core also owns the request policy used by deliberately public apps.
+    // Only contribute executable auth actions when one of the provider packages
+    // registered the service those actions require.
+    if (!app.has("authService")) {
+      return;
+    }
 
     app.actions(
       withActionDefaults(buildAuthActions(), {

package/test/authActions.test.js

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import test from "node:test";
+import { createSchema } from "json-rest-schema";
 import { createApplication } from "@jskit-ai/kernel/_testable";
 import { ActionRuntimeServiceProvider } from "@jskit-ai/kernel/server/actions";
 import { AuthActionsServiceProvider } from "../src/server/providers/AuthActionsServiceProvider.js";
@@ -206,3 +207,59 @@ test("AuthActionsServiceProvider registers shared auth actions against auth.prov
     ]
   );
 });
+
+test("AuthActionsServiceProvider leaves unrelated actions usable when no auth provider is selected", async () => {
+  const app = createApplication();
+
+  class PublicActionProvider {
+    static id = "public.actions";
+
+    static dependsOn = ["runtime.actions"];
+
+    register(targetApp) {
+      targetApp.action({
+        id: "public.ping",
+        domain: "public",
+        version: 1,
+        kind: "query",
+        channels: ["internal"],
+        surfaces: ["home"],
+        permission: { require: "none" },
+        input: {
+          schema: createSchema({}),
+          mode: "patch"
+        },
+        output: null,
+        idempotency: "none",
+        audit: { actionName: "public.ping" },
+        observability: {},
+        async execute() {
+          return { ok: true };
+        }
+      });
+    }
+  }
+
+  app.instance("appConfig", createAppConfigFixture());
+
+  await app.start({
+    providers: [ActionRuntimeServiceProvider, AuthActionsServiceProvider, PublicActionProvider]
+  });
+
+  const actionExecutor = app.make("actionExecutor");
+  assert.equal(
+    actionExecutor.listDefinitions().some((definition) => definition.id.startsWith("auth.")),
+    false
+  );
+  assert.deepEqual(
+    await actionExecutor.execute({
+      actionId: "public.ping",
+      input: {},
+      context: {
+        channel: "internal",
+        surface: "home"
+      }
+    }),
+    { ok: true }
+  );
+});