@jskit-ai/auth-core 0.1.157 → 0.1.158

package/test/authPolicyContextResolverRegistry.test.js

@@ -1,75 +1,21 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { createApplication } from "@jskit-ai/kernel/_testable";
+import { createAuthExtensions } from "../src/server/authExtensions.js";
 import {
-  AUTH_POLICY_CONTEXT_RESOLVER_TAG,
-  composeAuthPolicyContextResolvers,
   registerAuthPolicyContextResolver,
-  resolveAuthPolicyContextResolvers,
   resolveComposedAuthPolicyContextResolver
 } from "../src/server/authPolicyContextResolverRegistry.js";
 
-test("auth policy context resolver registry resolves resolvers in order", async () => {
-  const app = createApplication();
-
-  registerAuthPolicyContextResolver(app, "test.auth.policy.context.permissions", () => ({
+test("auth.extensions composes policy context resolvers in order", async () => {
+  const extensions = createAuthExtensions();
+  registerAuthPolicyContextResolver(extensions, {
     resolverId: "permissions",
     order: 20,
     async resolveAuthPolicyContext() {
-      return {
-        permissions: ["alpha.read"]
-      };
+      return { permissions: ["alpha.read"] };
     }
-  }));
-
-  registerAuthPolicyContextResolver(app, "test.auth.policy.context.workspace", () => ({
-    resolverId: "workspace",
-    order: 10,
-    async resolveAuthPolicyContext() {
-      return {
-        workspace: { id: "11" },
-        membership: { roleSid: "member" },
-        permissions: ["workspace.read"]
-      };
-    }
-  }));
-
-  const resolvers = resolveAuthPolicyContextResolvers(app);
-  assert.deepEqual(
-    resolvers.map((entry) => entry.resolverId),
-    ["workspace", "permissions"]
-  );
-
-  const resolveContext = composeAuthPolicyContextResolvers(resolvers);
-  const context = await resolveContext({
-    actor: { id: "7" }
-  });
-
-  assert.deepEqual(context, {
-    workspace: { id: "11" },
-    membership: { roleSid: "member" },
-    permissions: ["workspace.read", "alpha.read"]
   });
-});
-
-test("auth policy context resolver registry exports canonical tag", () => {
-  assert.equal(AUTH_POLICY_CONTEXT_RESOLVER_TAG, "jskit.auth.policy.context.resolvers");
-});
-
-test("auth policy context resolver registry resolves composed resolver directly from scope", async () => {
-  const app = createApplication();
-
-  registerAuthPolicyContextResolver(app, "test.auth.policy.context.permissions", () => ({
-    resolverId: "permissions",
-    order: 20,
-    async resolveAuthPolicyContext() {
-      return {
-        permissions: ["alpha.read"]
-      };
-    }
-  }));
-
-  registerAuthPolicyContextResolver(app, "test.auth.policy.context.workspace", () => ({
+  registerAuthPolicyContextResolver(extensions, {
     resolverId: "workspace",
     order: 10,
     async resolveAuthPolicyContext() {
@@ -79,16 +25,12 @@ test("auth policy context resolver registry resolves composed resolver directly
         permissions: ["workspace.read"]
       };
     }
-  }));
-
-  const resolveContext = resolveComposedAuthPolicyContextResolver(app);
-  const context = await resolveContext({
-    actor: { id: "7" }
   });
-
-  assert.deepEqual(context, {
+  const resolveContext = resolveComposedAuthPolicyContextResolver(extensions);
+  assert.deepEqual(await resolveContext({ actor: { id: "7" } }), {
     workspace: { id: "11" },
     membership: { roleSid: "member" },
     permissions: ["workspace.read", "alpha.read"]
   });
+  assert.deepEqual(extensions.diagnostics().policyContextResolverIds, ["workspace", "permissions"]);
 });

package/test/authServiceDecoratorRegistry.test.js

@@ -1,65 +1,39 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { createApplication } from "@jskit-ai/kernel/_testable";
-import {
-  AUTH_SERVICE_DECORATOR_TAG,
-  applyAuthServiceDecorators,
-  registerAuthServiceDecorator,
-  resolveAuthServiceDecorators
-} from "../src/server/authServiceDecoratorRegistry.js";
+import { createAuthExtensions } from "../src/server/authExtensions.js";
+import { applyAuthServiceDecorators, registerAuthServiceDecorator } from "../src/server/authServiceDecoratorRegistry.js";
 
-test("auth service decorator registry resolves decorators in order", () => {
-  const app = createApplication();
-
-  registerAuthServiceDecorator(app, "test.auth.decorator.zeta", () => ({
+test("auth.extensions applies service decorators in declared order", () => {
+  const extensions = createAuthExtensions();
+  registerAuthServiceDecorator(extensions, {
     decoratorId: "zeta",
     order: 50,
     decorateAuthService(service) {
-      return {
-        ...service,
-        trace: [...service.trace, "zeta"]
-      };
+      return { ...service, trace: [...service.trace, "zeta"] };
     }
-  }));
-
-  registerAuthServiceDecorator(app, "test.auth.decorator.alpha", () => ({
+  });
+  registerAuthServiceDecorator(extensions, {
     decoratorId: "alpha",
     order: 10,
     decorateAuthService(service) {
-      return {
-        ...service,
-        trace: [...service.trace, "alpha"]
-      };
+      return { ...service, trace: [...service.trace, "alpha"] };
     }
-  }));
-
-  const decorators = resolveAuthServiceDecorators(app);
-  assert.equal(decorators.length, 2);
-  assert.deepEqual(
-    decorators.map((entry) => entry.decoratorId),
-    ["alpha", "zeta"]
-  );
-
-  const decorated = applyAuthServiceDecorators(app, { trace: [] });
-  assert.deepEqual(decorated.trace, ["alpha", "zeta"]);
+  });
+  assert.deepEqual(applyAuthServiceDecorators(extensions, { trace: [] }).trace, ["alpha", "zeta"]);
+  assert.deepEqual(extensions.diagnostics().serviceDecoratorIds, ["alpha", "zeta"]);
 });
 
-test("auth service decorator registry rejects invalid decorated services", () => {
-  const app = createApplication();
-
-  registerAuthServiceDecorator(app, "test.auth.decorator.invalid", () => ({
+test("auth.extensions rejects invalid results and late registration", () => {
+  const extensions = createAuthExtensions();
+  registerAuthServiceDecorator(extensions, {
     decoratorId: "invalid",
     decorateAuthService() {
       return null;
     }
-  }));
-
-  assert.throws(
-    () => applyAuthServiceDecorators(app, {}),
-    /Auth service decorator "invalid" must return an auth service object/
-  );
-});
-
-test("auth service decorator registry exports canonical tag", () => {
-  assert.equal(AUTH_SERVICE_DECORATOR_TAG, "jskit.auth.service.decorators");
+  });
+  assert.throws(() => applyAuthServiceDecorators(extensions, {}), /must return an auth service object/);
+  assert.throws(() => registerAuthServiceDecorator(extensions, {
+    decoratorId: "late",
+    decorateAuthService(service) { return service; }
+  }), /registration is closed/);
 });

package/test/providerRuntime.test.js

@@ -1,122 +1,94 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { createApplication } from "@jskit-ai/kernel/_testable";
-import { ActionRuntimeServiceProvider } from "@jskit-ai/kernel/server/actions";
-import { AccessCoreServiceProvider } from "../src/server/providers/AccessCoreServiceProvider.js";
-import { AuthActionsServiceProvider } from "../src/server/providers/AuthActionsServiceProvider.js";
-import { FastifyAuthPolicyServiceProvider } from "../src/server/providers/FastifyAuthPolicyServiceProvider.js";
-import { AUTH_POLICY_CONTEXT_RESOLVER_TAG } from "../src/server/authPolicyContextResolverRegistry.js";
+import { createActionProvider } from "@jskit-ai/kernel/server/actions";
+import { createCapabilityRuntime, defineProvider } from "@jskit-ai/kernel/shared/capabilities";
+import { HttpProvider } from "@jskit-ai/kernel/server/http";
 import { createFakeFastifyPolicyRuntime } from "../../../tooling/testUtils/fakeFastify.mjs";
-
-test("FastifyAuthPolicyServiceProvider registers auth policy plugin through provider boot", async () => {
-  const { fastify, state } = createFakeFastifyPolicyRuntime();
-  const bag = new Map([
-    ["jskit.fastify", fastify],
-    ["jskit.env", { NODE_ENV: "test" }],
-    ["jskit.logger", console],
-    [
-      "authService",
-      {
-        async authenticateRequest() {
-          return {
-            authenticated: false,
-            actor: null,
-            transientFailure: false
-          };
-        }
-      }
-    ]
-  ]);
-
-  const app = {
-    has(token) {
-      return bag.has(token);
-    },
-    make(token) {
-      if (!bag.has(token)) {
-        throw new Error(`Missing token ${String(token)}`);
-      }
-      return bag.get(token);
-    }
+import { AuthExtensionsProvider } from "../src/server/providers/AuthExtensionsProvider.js";
+import { AuthFeature } from "../src/server/providers/AuthFeature.js";
+import { AuthPolicyProvider } from "../src/server/providers/AuthPolicyProvider.js";
+
+function createFastify() {
+  const fixture = createFakeFastifyPolicyRuntime();
+  fixture.fastify.route = () => {};
+  fixture.fastify.setErrorHandler = () => {};
+  return fixture;
+}
+
+function runtimeInputs(fastify) {
+  return {
+    "runtime.env": { NODE_ENV: "test" },
+    "runtime.fastify": fastify
   };
+}
 
-  const provider = new FastifyAuthPolicyServiceProvider();
-  provider.register(app);
-  await provider.boot(app);
-
+test("AuthPolicyProvider installs Fastify policy and explicit action/visibility contributors", async () => {
+  const { fastify, state } = createFastify();
+  const runtime = createCapabilityRuntime({
+    inputs: runtimeInputs(fastify),
+    providers: [
+      createActionProvider(),
+      HttpProvider,
+      AuthExtensionsProvider,
+      AuthFeature,
+      AuthPolicyProvider
+    ]
+  });
+  await runtime.start();
   assert.ok(state.requestDecorators.has("user"));
   assert.ok(state.requestDecorators.has("workspace"));
   assert.ok(state.requestDecorators.has("membership"));
   assert.ok(state.requestDecorators.has("permissions"));
   assert.equal(typeof state.preHandler, "function");
   assert.ok(state.registeredPlugins.length >= 3);
+  assert.ok(runtime.diagnostics().capabilityIds.includes("auth.policy"));
 });
 
-test("FastifyAuthPolicyServiceProvider wires optional auth policy context resolver", async () => {
-  const { fastify, state } = createFakeFastifyPolicyRuntime();
-  const makeCalls = [];
-  const resolveTagCalls = [];
-  const bag = new Map([
-    ["jskit.fastify", fastify],
-    ["jskit.env", { NODE_ENV: "test" }],
-    ["jskit.logger", console],
-    [
-      "authService",
-      {
-        async authenticateRequest() {
+test("AuthPolicyProvider resolves registered workspace context without a service container", async () => {
+  const { fastify, state } = createFastify();
+  const AuthService = defineProvider({
+    id: "test.auth.service",
+    provides: { service: "auth.service" },
+    setup() {
+      return {
+        service: {
+          async authenticateRequest() {
+            return { authenticated: true, actor: { id: 7 }, transientFailure: false };
+          }
+        }
+      };
+    }
+  });
+  const WorkspaceContext = defineProvider({
+    id: "test.workspace-auth-context",
+    requires: { extensions: "auth.extensions" },
+    setup({ extensions }) {
+      extensions.registerPolicyContextResolver({
+        resolverId: "workspace",
+        async resolveAuthPolicyContext({ actor, request }) {
           return {
-            authenticated: true,
-            actor: { id: 7 },
-            transientFailure: false
+            workspace: { id: 11, slug: String(request?.params?.workspaceSlug || "").toLowerCase() },
+            membership: { roleSid: "member" },
+            permissions: actor?.id === 7 ? ["projects.read"] : []
           };
         }
-      }
-    ]
-  ]);
-
-  const app = {
-    has(token) {
-      return bag.has(token);
-    },
-    make(token) {
-      makeCalls.push(String(token));
-      if (!bag.has(token)) {
-        throw new Error(`Missing token ${String(token)}`);
-      }
-      return bag.get(token);
-    },
-    resolveTag(tag) {
-      resolveTagCalls.push(String(tag));
-      if (tag !== AUTH_POLICY_CONTEXT_RESOLVER_TAG) {
-        return [];
-      }
-
-      return [
-        {
-          resolverId: "workspace",
-          order: 10,
-          async resolveAuthPolicyContext({ actor, request }) {
-            return {
-              workspace: { id: 11, slug: String(request?.params?.workspaceSlug || "").toLowerCase() },
-              membership: { roleSid: "member" },
-              permissions: actor?.id === 7 ? ["projects.read"] : []
-            };
-          }
-        },
-        async () => ({
-          permissions: ["settings.manage"]
-        })
-      ];
+      });
+      return {};
     }
-  };
-
-  const provider = new FastifyAuthPolicyServiceProvider();
-  provider.register(app);
-  await provider.boot(app);
-
-  assert.deepEqual(makeCalls, ["jskit.env", "jskit.fastify"]);
-  assert.deepEqual(resolveTagCalls, []);
-
+  });
+  const runtime = createCapabilityRuntime({
+    inputs: runtimeInputs(fastify),
+    providers: [
+      createActionProvider(),
+      HttpProvider,
+      AuthExtensionsProvider,
+      AuthService,
+      WorkspaceContext,
+      AuthFeature,
+      AuthPolicyProvider
+    ]
+  });
+  await runtime.start();
   const request = {
     method: "GET",
     raw: { url: "/api/w/acme/projects" },
@@ -129,51 +101,28 @@ test("FastifyAuthPolicyServiceProvider wires optional auth policy context resolv
       }
     }
   };
-
   await state.preHandler(request, {});
-  assert.ok(makeCalls.includes("authService"));
-  assert.deepEqual(resolveTagCalls, [AUTH_POLICY_CONTEXT_RESOLVER_TAG]);
-  assert.equal(request.workspace?.id, 11);
-  assert.equal(request.workspace?.slug, "acme");
-  assert.equal(request.membership?.roleSid, "member");
-  assert.deepEqual(request.permissions, ["settings.manage", "projects.read"]);
+  assert.deepEqual(request.workspace, { id: 11, slug: "acme" });
+  assert.deepEqual(request.membership, { roleSid: "member" });
+  assert.deepEqual(request.permissions, ["projects.read"]);
 });
 
-test("auth-core providers boot without a selected provider and deny protected API requests", async () => {
-  const { fastify, state } = createFakeFastifyPolicyRuntime();
-  const app = createApplication();
-
-  app.instance("appConfig", {
-    surfaceModeAll: "all",
-    surfaceDefaultId: "home",
-    surfaceDefinitions: {
-      home: { id: "home", pagesRoot: "", enabled: true, requiresAuth: false, requiresWorkspace: false }
-    }
-  });
-  app.instance("jskit.fastify", fastify);
-  app.instance("jskit.env", { NODE_ENV: "test" });
-
-  await app.start({
+test("auth policy denies protected routes when no auth service is installed", async () => {
+  const { fastify, state } = createFastify();
+  const runtime = createCapabilityRuntime({
+    inputs: runtimeInputs(fastify),
     providers: [
-      ActionRuntimeServiceProvider,
-      AccessCoreServiceProvider,
-      AuthActionsServiceProvider,
-      FastifyAuthPolicyServiceProvider
+      createActionProvider(),
+      HttpProvider,
+      AuthExtensionsProvider,
+      AuthFeature,
+      AuthPolicyProvider
     ]
   });
-
-  const request = {
+  await runtime.start();
+  await assert.rejects(() => state.preHandler({
     method: "GET",
     raw: { url: "/api/protected" },
-    routeOptions: {
-      config: {
-        authPolicy: "required"
-      }
-    }
-  };
-
-  await assert.rejects(
-    () => state.preHandler(request, {}),
-    /Authentication required/
-  );
+    routeOptions: { config: { authPolicy: "required" } }
+  }, {}), /Authentication required/);
 });

package/src/client/providers/FastifyAuthPolicyClientProvider.js

@@ -1,13 +0,0 @@
-class FastifyAuthPolicyClientProvider {
-  static id = "auth.policy.client";
-
-  register(app) {
-    if (!app || typeof app.singleton !== "function") {
-      throw new Error("FastifyAuthPolicyClientProvider requires application singleton().");
-    }
-  }
-
-  boot() {}
-}
-
-export { FastifyAuthPolicyClientProvider };

package/src/server/providers/AuthActionsServiceProvider.js

@@ -1,76 +0,0 @@
-import { withActionDefaults } from "@jskit-ai/kernel/shared/actions";
-import { buildAuthActions } from "../actions/auth.contributor.js";
-import { createAuthSessionEventsService } from "../services/authSessionEventsService.js";
-
-class AuthActionsServiceProvider {
-  static id = "auth.actions";
-
-  static startsAfter = ["runtime.actions"];
-
-  register(app) {
-    if (
-      !app ||
-      typeof app.actions !== "function" ||
-      typeof app.has !== "function" ||
-      typeof app.service !== "function"
-    ) {
-      throw new Error("AuthActionsServiceProvider requires application actions()/has()/service().");
-    }
-
-    if (!app.has("auth.session.events.service")) {
-      app.service(
-        "auth.session.events.service",
-        () => createAuthSessionEventsService(),
-        {
-          events: {
-            notifySessionChanged: [
-              {
-                type: "entity.changed",
-                source: "auth",
-                entity: "session",
-                operation: "updated",
-                entityId: ({ result }) => result?.id,
-                realtime: {
-                  event: "auth.session.changed",
-                  audience: "actor_user"
-                }
-              },
-              {
-                type: "entity.changed",
-                source: "users",
-                entity: "bootstrap",
-                operation: "updated",
-                entityId: ({ result }) => result?.id,
-                realtime: {
-                  event: "users.bootstrap.changed",
-                  audience: "actor_user"
-                }
-              }
-            ]
-          }
-        }
-      );
-    }
-  }
-
-  boot(app) {
-    // auth-core also owns the request policy used by deliberately public apps.
-    // Only contribute executable auth actions when one of the provider packages
-    // registered the service those actions require.
-    if (!app.has("authService")) {
-      return;
-    }
-
-    app.actions(
-      withActionDefaults(buildAuthActions(), {
-        domain: "auth",
-        dependencies: {
-          authService: "authService",
-          authSessionEventsService: "auth.session.events.service"
-        }
-      })
-    );
-  }
-}
-
-export { AuthActionsServiceProvider };

package/src/server/providers/FastifyAuthPolicyServiceProvider.js

@@ -1,108 +0,0 @@
-import { registerActionContextContributor } from "@jskit-ai/kernel/server/actions";
-import { registerRouteVisibilityResolver } from "@jskit-ai/kernel/server/http";
-import {
-  resolveComposedAuthPolicyContextResolver
-} from "../authPolicyContextResolverRegistry.js";
-import { parseBooleanFlag } from "../booleanFlag.js";
-import { authPolicyPlugin } from "../lib/plugin.js";
-import { createAuthActionContextContributor } from "../lib/actionContextContributor.js";
-import { createAuthRouteVisibilityResolver } from "../lib/routeVisibilityResolver.js";
-
-function parseList(value) {
-  return String(value || "")
-    .split(",")
-    .map((entry) => entry.trim())
-    .filter(Boolean);
-}
-
-function defaultHasPermission({ permission, permissions = [] } = {}) {
-  if (!permission) {
-    return true;
-  }
-  return Array.isArray(permissions) ? permissions.includes(permission) : false;
-}
-
-class FastifyAuthPolicyServiceProvider {
-  static id = "auth.policy.fastify";
-
-  register(app) {
-    if (!app || typeof app.has !== "function") {
-      throw new Error("FastifyAuthPolicyServiceProvider requires application has().");
-    }
-
-    if (
-      !app.has("auth.policy.actionContextContributor") &&
-      typeof app.singleton === "function" &&
-      typeof app.tag === "function"
-    ) {
-      registerActionContextContributor(app, "auth.policy.actionContextContributor", () =>
-        createAuthActionContextContributor()
-      );
-    }
-
-    if (
-      !app.has("auth.policy.routeVisibilityResolver") &&
-      typeof app.singleton === "function" &&
-      typeof app.tag === "function"
-    ) {
-      registerRouteVisibilityResolver(app, "auth.policy.routeVisibilityResolver", () =>
-        createAuthRouteVisibilityResolver()
-      );
-    }
-  }
-
-  async boot(app) {
-    if (!app || typeof app.make !== "function" || typeof app.has !== "function") {
-      throw new Error("FastifyAuthPolicyServiceProvider requires application make()/has().");
-    }
-    const env = app.has("jskit.env") ? app.make("jskit.env") : {};
-    const fastify = app.make("jskit.fastify");
-
-    const pluginDeps = {
-      resolveActor: async (request) => {
-        if (!app.has("authService")) {
-          return {
-            authenticated: false,
-            actor: null,
-            transientFailure: false
-          };
-        }
-        const authService = app.make("authService");
-        if (authService && typeof authService.authenticateRequest === "function") {
-          return authService.authenticateRequest(request);
-        }
-        return {
-          authenticated: false,
-          actor: null,
-          transientFailure: false
-        };
-      },
-      hasPermission: defaultHasPermission,
-      resolveContext: async (input = {}) => {
-        const resolveContext = resolveComposedAuthPolicyContextResolver(app);
-
-        if (typeof resolveContext !== "function") {
-          return null;
-        }
-
-        return resolveContext(input);
-      }
-    };
-
-    const plugin = authPolicyPlugin(
-      pluginDeps,
-      {
-        nodeEnv: String(env.NODE_ENV || "development").trim() || "development",
-        apiPrefix: String(env.AUTH_API_PREFIX || "/api/").trim() || "/api/",
-        unsafeMethods: parseList(env.AUTH_CSRF_UNSAFE_METHODS),
-        csrfCookieOpts: {
-          secure: parseBooleanFlag(env.AUTH_CSRF_COOKIE_SECURE, false)
-        }
-      }
-    );
-
-    await plugin(fastify);
-  }
-}
-
-export { FastifyAuthPolicyServiceProvider };

package/src/server/services/authSessionEventsService.js

@@ -1,29 +0,0 @@
-import { normalizeOpaqueId } from "@jskit-ai/kernel/shared/support/normalize";
-
-function resolveActorId(context = {}) {
-  return normalizeOpaqueId(
-    context?.actor?.id ||
-      context?.actor?.appUserId ||
-      context?.actor?.providerUserId,
-    { fallback: null }
-  );
-}
-
-function createAuthSessionEventsService() {
-  async function notifySessionChanged(options = {}) {
-    const actorId = resolveActorId(options?.context || {});
-    if (!actorId) {
-      return null;
-    }
-
-    return {
-      id: actorId
-    };
-  }
-
-  return Object.freeze({
-    notifySessionChanged
-  });
-}
-
-export { createAuthSessionEventsService };