@jskit-ai/auth-core 0.1.157 → 0.1.159

package/package.json

@@ -1,21 +1,23 @@
 {
   "name": "@jskit-ai/auth-core",
-  "version": "0.1.157",
+  "version": "0.1.159",
   "type": "module",
   "scripts": {
     "test": "node --test"
   },
   "exports": {
-    "./server/providers/AccessCoreServiceProvider": "./src/server/providers/AccessCoreServiceProvider.js",
-    "./server/providers/FastifyAuthPolicyServiceProvider": "./src/server/providers/FastifyAuthPolicyServiceProvider.js",
-    "./server/providers/AuthActionsServiceProvider": "./src/server/providers/AuthActionsServiceProvider.js",
+    "./server/providers/AuthAccessProvider": "./src/server/providers/AuthAccessProvider.js",
+    "./server/providers/AuthExtensionsProvider": "./src/server/providers/AuthExtensionsProvider.js",
+    "./server/providers/AuthFeature": "./src/server/providers/AuthFeature.js",
+    "./server/providers/AuthPolicyProvider": "./src/server/providers/AuthPolicyProvider.js",
     "./server/actions/auth.contributor": "./src/server/actions/auth.contributor.js",
-    "./server/services/authSessionEventsService": "./src/server/services/authSessionEventsService.js",
+    "./server/authExtensions": "./src/server/authExtensions.js",
     "./server/authPolicyContextResolverRegistry": "./src/server/authPolicyContextResolverRegistry.js",
     "./server/authServiceDecoratorRegistry": "./src/server/authServiceDecoratorRegistry.js",
     "./server/authActor": "./src/server/authActor.js",
     "./server/booleanFlag": "./src/server/booleanFlag.js",
     "./server/devAuth": "./src/server/devAuth.js",
+    "./server/deferredAuthService": "./src/server/deferredAuthService.js",
     "./server/unsupportedOperation": "./src/server/unsupportedOperation.js",
     "./server/utils": "./src/server/utils.js",
     "./server/validators": "./src/server/validators.js",
@@ -59,7 +61,7 @@
     "@fastify/cookie": "^11.0.2",
     "@fastify/csrf-protection": "^7.1.0",
     "@fastify/rate-limit": "^10.3.0",
-    "@jskit-ai/kernel": "0.1.159",
+    "@jskit-ai/kernel": "0.1.161",
     "json-rest-schema": "^1.0.17"
   },
   "jskit": {
@@ -67,25 +69,35 @@
     "capabilities": {
       "provides": [
         "auth.access",
+        "auth.extensions",
         "auth.policy"
       ],
-      "requires": []
+      "requires": [
+        "runtime.actions",
+        "runtime.env",
+        "runtime.fastify",
+        "runtime.http"
+      ]
     },
     "runtime": {
       "server": {
-        "providerEntrypoint": "src/server/providers/AccessCoreServiceProvider.js",
+        "providerEntrypoint": "src/server/providers/AuthAccessProvider.js",
         "providers": [
           {
-            "entrypoint": "src/server/providers/AccessCoreServiceProvider.js",
-            "export": "AccessCoreServiceProvider"
+            "entrypoint": "src/server/providers/AuthAccessProvider.js",
+            "export": "AuthAccessProvider"
           },
           {
-            "entrypoint": "src/server/providers/AuthActionsServiceProvider.js",
-            "export": "AuthActionsServiceProvider"
+            "entrypoint": "src/server/providers/AuthExtensionsProvider.js",
+            "export": "AuthExtensionsProvider"
           },
           {
-            "entrypoint": "src/server/providers/FastifyAuthPolicyServiceProvider.js",
-            "export": "FastifyAuthPolicyServiceProvider"
+            "entrypoint": "src/server/providers/AuthFeature.js",
+            "export": "AuthFeature"
+          },
+          {
+            "entrypoint": "src/server/providers/AuthPolicyProvider.js",
+            "export": "AuthPolicyProvider"
           }
         ]
       },
@@ -94,10 +106,6 @@
           {
             "entrypoint": "src/client/providers/AccessCoreClientProvider.js",
             "export": "AccessCoreClientProvider"
-          },
-          {
-            "entrypoint": "src/client/providers/FastifyAuthPolicyClientProvider.js",
-            "export": "FastifyAuthPolicyClientProvider"
           }
         ]
       }
@@ -107,7 +115,7 @@
         "surfaces": [
           {
             "subpath": "./client",
-            "summary": "Exports client auth access APIs plus AccessCoreClientProvider/FastifyAuthPolicyClientProvider."
+            "summary": "Exports the client auth access API and its capability provider."
           },
           {
             "subpath": "./server",
@@ -118,33 +126,10 @@
             "summary": "Exports shared auth client helpers (createApi and runAuthSignOutFlow), with structured subpaths at ./shared/authApi and ./shared/signOutFlow."
           }
         ],
-        "containerTokens": {
-          "server": [
-            "auth.access",
-            "auth.session.events.service"
-          ],
-          "client": [
-            "auth.access.client"
-          ]
-        }
+        "clientCapabilities": [
+          "auth.access.client"
+        ]
       }
-    },
-    "mutations": {
-      "dependencies": {
-        "runtime": {
-          "@jskit-ai/kernel": "0.1.159",
-          "@fastify/cookie": "^11.0.2",
-          "@fastify/csrf-protection": "^7.1.0",
-          "@fastify/rate-limit": "^10.3.0"
-        },
-        "dev": {}
-      },
-      "packageJson": {
-        "scripts": {}
-      },
-      "procfile": {},
-      "files": [],
-      "text": []
     }
   }
 }

package/src/client/index.js

@@ -1,2 +1 @@
 export { AccessCoreClientProvider } from "./providers/AccessCoreClientProvider.js";
-export { FastifyAuthPolicyClientProvider } from "./providers/FastifyAuthPolicyClientProvider.js";

package/src/client/providers/AccessCoreClientProvider.js

@@ -1,3 +1,4 @@
+import { defineProvider } from "@jskit-ai/kernel/shared/capabilities";
 import { createApi as createAuthApi } from "../authApi.js";
 import { runAuthSignOutFlow } from "../signOutFlow.js";
 
@@ -6,18 +7,16 @@ const CLIENT_API = Object.freeze({
   runAuthSignOutFlow
 });
 
-class AccessCoreClientProvider {
-  static id = "auth.access.client";
-
-  register(app) {
-    if (!app || typeof app.singleton !== "function") {
-      throw new Error("AccessCoreClientProvider requires application singleton().");
-    }
-
-    app.singleton("auth.access.client", () => CLIENT_API);
+const AccessCoreClientProvider = defineProvider({
+  id: "auth.access.client",
+  provides: {
+    auth: "auth.access.client"
+  },
+  setup() {
+    return {
+      auth: CLIENT_API
+    };
   }
-
-  boot() {}
-}
+});
 
 export { AccessCoreClientProvider };

package/src/server/actions/auth.contributor.js

@@ -45,7 +45,7 @@ function requireRequestContext(context, actionId) {
   throw new Error(`${actionId} requires request context.`);
 }
 
-const baseAuthActions = Object.freeze([
+const authActionSpecifications = Object.freeze([
   {
     id: "auth.register",
     version: 1,
@@ -58,8 +58,8 @@ const baseAuthActions = Object.freeze([
       actionName: "auth.register"
     },
     observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.register(input);
+    async run(authService, input) {
+      return authService.register(input);
     }
   },
   {
@@ -74,8 +74,8 @@ const baseAuthActions = Object.freeze([
       actionName: "auth.register.confirmation.resend"
     },
     observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.resendRegisterConfirmation(input);
+    async run(authService, input) {
+      return authService.resendRegisterConfirmation(input);
     }
   },
   {
@@ -90,8 +90,8 @@ const baseAuthActions = Object.freeze([
       actionName: "auth.login.password"
     },
     observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.login(input);
+    async run(authService, input) {
+      return authService.login(input);
     }
   },
   {
@@ -106,8 +106,8 @@ const baseAuthActions = Object.freeze([
       actionName: "auth.login.otp.request"
     },
     observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.requestOtpLogin(input);
+    async run(authService, input) {
+      return authService.requestOtpLogin(input);
     }
   },
   {
@@ -122,8 +122,8 @@ const baseAuthActions = Object.freeze([
       actionName: "auth.login.otp.verify"
     },
     observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.verifyOtpLogin(input);
+    async run(authService, input) {
+      return authService.verifyOtpLogin(input);
     }
   },
   {
@@ -138,8 +138,8 @@ const baseAuthActions = Object.freeze([
       actionName: "auth.login.oauth.start"
     },
     observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.oauthStart(input);
+    async run(authService, input) {
+      return authService.oauthStart(input);
     }
   },
   {
@@ -154,8 +154,8 @@ const baseAuthActions = Object.freeze([
       actionName: "auth.login.oauth.complete"
     },
     observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.oauthComplete(input);
+    async run(authService, input) {
+      return authService.oauthComplete(input);
     }
   },
   {
@@ -170,8 +170,8 @@ const baseAuthActions = Object.freeze([
       actionName: "auth.dev.loginAs"
     },
     observability: {},
-    async execute(input, context, deps) {
-      return deps.authService.devLoginAs(
+    async run(authService, input, context) {
+      return authService.devLoginAs(
         requireRequestContext(context, "auth.dev.loginAs"),
         input
       );
@@ -189,8 +189,8 @@ const baseAuthActions = Object.freeze([
       actionName: "auth.password.reset.request"
     },
     observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.requestPasswordReset(input);
+    async run(authService, input) {
+      return authService.requestPasswordReset(input);
     }
   },
   {
@@ -205,8 +205,8 @@ const baseAuthActions = Object.freeze([
       actionName: "auth.password.recovery.complete"
     },
     observability: {},
-    async execute(input, _context, deps) {
-      return deps.authService.completePasswordRecovery(input);
+    async run(authService, input) {
+      return authService.completePasswordRecovery(input);
     }
   },
   {
@@ -221,8 +221,8 @@ const baseAuthActions = Object.freeze([
       actionName: "auth.password.reset"
     },
     observability: {},
-    async execute(input, context, deps) {
-      return deps.authService.resetPassword(requireRequestContext(context, "auth.password.reset"), input);
+    async run(authService, input, context) {
+      return authService.resetPassword(requireRequestContext(context, "auth.password.reset"), input);
     }
   },
   {
@@ -238,19 +238,13 @@ const baseAuthActions = Object.freeze([
       actionName: "auth.logout"
     },
     observability: {},
-    async execute(_input, context, deps) {
+    async run(authService, _input, context) {
       let logoutResult = {
         ok: true,
         clearSession: true
       };
-      if (deps.authService && typeof deps.authService.logout === "function") {
-        logoutResult = await deps.authService.logout(requireRequestContext(context, "auth.logout"));
-      }
-
-      if (deps.authSessionEventsService && typeof deps.authSessionEventsService.notifySessionChanged === "function") {
-        await deps.authSessionEventsService.notifySessionChanged({
-          context
-        });
+      if (typeof authService.logout === "function") {
+        logoutResult = await authService.logout(requireRequestContext(context, "auth.logout"));
       }
       return {
         ok: logoutResult?.ok !== false,
@@ -270,14 +264,23 @@ const baseAuthActions = Object.freeze([
       actionName: "auth.session.read"
     },
     observability: {},
-    async execute(_input, context, deps) {
-      return deps.authService.authenticateRequest(requireRequestContext(context, "auth.session.read"));
+    async run(authService, _input, context) {
+      return authService.authenticateRequest(requireRequestContext(context, "auth.session.read"));
     }
   }
 ]);
 
-function buildAuthActions() {
-  return baseAuthActions;
+function buildAuthActions({ authService } = {}) {
+  if (!authService || typeof authService !== "object") {
+    throw new TypeError("buildAuthActions requires authService.");
+  }
+  return Object.freeze(authActionSpecifications.map(({ run, surfacesFrom: _surfaceSource, ...definition }) => Object.freeze({
+    ...definition,
+    surfaces: ["*"],
+    execute(input, context) {
+      return run(authService, input, context);
+    }
+  })));
 }
 
-export { baseAuthActions, buildAuthActions, requireRequestContext };
+export { authActionSpecifications, buildAuthActions, requireRequestContext };

package/src/server/authExtensions.js

@@ -0,0 +1,155 @@
+import { normalizePermissionList } from "@jskit-ai/kernel/shared/support/permissions";
+
+function normalizeOrderedExtension(value, { idField, method, label } = {}) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || typeof value[method] !== "function") {
+    throw new TypeError(`${label} requires ${method}().`);
+  }
+  const id = String(value[idField] || "").trim();
+  if (!id) {
+    throw new TypeError(`${label} requires ${idField}.`);
+  }
+  return Object.freeze({
+    ...value,
+    [idField]: id,
+    order: Number.isFinite(value.order) ? Number(value.order) : 0,
+    [method]: value[method]
+  });
+}
+
+function ordered(values) {
+  return values
+    .map((value, index) => ({ value, index }))
+    .sort((left, right) => left.value.order - right.value.order || left.index - right.index)
+    .map(({ value }) => value);
+}
+
+function mergePolicyContexts(contexts = []) {
+  const merged = {};
+  const permissions = new Set();
+  for (const context of contexts) {
+    if (!context || typeof context !== "object" || Array.isArray(context)) continue;
+    for (const [key, value] of Object.entries(context)) {
+      if (key === "permissions") {
+        for (const permission of normalizePermissionList(value)) permissions.add(permission);
+      } else if (value !== undefined) {
+        merged[key] = value;
+      }
+    }
+  }
+  if (permissions.size > 0) merged.permissions = Object.freeze([...permissions]);
+  return Object.keys(merged).length > 0 ? Object.freeze(merged) : null;
+}
+
+function createAuthExtensions() {
+  const serviceDecorators = [];
+  const policyContextResolvers = [];
+  const profileProjectors = [];
+  const invitationContextResolvers = [];
+  const ids = new Set();
+  let sealed = false;
+
+  function register(collection, extension, options) {
+    if (sealed) throw new Error("Auth extension registration is closed after authentication starts.");
+    const normalized = normalizeOrderedExtension(extension, options);
+    const qualifiedId = `${options.label}:${normalized[options.idField]}`;
+    if (ids.has(qualifiedId)) throw new Error(`${options.label} "${normalized[options.idField]}" is duplicated.`);
+    ids.add(qualifiedId);
+    collection.push(normalized);
+    return api;
+  }
+
+  function registerServiceDecorator(extension) {
+    return register(serviceDecorators, extension, {
+      idField: "decoratorId",
+      method: "decorateAuthService",
+      label: "Auth service decorator"
+    });
+  }
+
+  function registerPolicyContextResolver(extension) {
+    return register(policyContextResolvers, extension, {
+      idField: "resolverId",
+      method: "resolveAuthPolicyContext",
+      label: "Auth policy context resolver"
+    });
+  }
+
+  function registerProfileProjector(extension) {
+    return register(profileProjectors, extension, {
+      idField: "projectorId",
+      method: "syncIdentityProfile",
+      label: "Auth profile projector"
+    });
+  }
+
+  function registerInvitationContextResolver(extension) {
+    return register(invitationContextResolvers, extension, {
+      idField: "resolverId",
+      method: "resolveInvitationContext",
+      label: "Auth invitation context resolver"
+    });
+  }
+
+  function resolveSingle(collection, label) {
+    sealed = true;
+    const entries = ordered(collection);
+    if (entries.length > 1) {
+      throw new Error(`${label} is ambiguous: ${entries.map((entry) => entry.projectorId || entry.resolverId).join(", ")}.`);
+    }
+    return entries[0] || null;
+  }
+
+  function resolveProfileProjector() {
+    return resolveSingle(profileProjectors, "Auth profile projector");
+  }
+
+  function resolveInvitationContextResolver() {
+    return resolveSingle(invitationContextResolvers, "Auth invitation context resolver");
+  }
+
+  function decorateService(authService) {
+    sealed = true;
+    let decorated = authService;
+    for (const decorator of ordered(serviceDecorators)) {
+      decorated = decorator.decorateAuthService(decorated);
+      if (!decorated || typeof decorated !== "object") {
+        throw new Error(`Auth service decorator "${decorator.decoratorId}" must return an auth service object.`);
+      }
+    }
+    return decorated;
+  }
+
+  async function resolvePolicyContext(input = {}) {
+    sealed = true;
+    const contexts = [];
+    for (const resolver of ordered(policyContextResolvers)) {
+      contexts.push(await resolver.resolveAuthPolicyContext(input));
+    }
+    return mergePolicyContexts(contexts);
+  }
+
+  function diagnostics() {
+    return Object.freeze({
+      sealed,
+      serviceDecoratorIds: Object.freeze(ordered(serviceDecorators).map((entry) => entry.decoratorId)),
+      policyContextResolverIds: Object.freeze(ordered(policyContextResolvers).map((entry) => entry.resolverId)),
+      profileProjectorIds: Object.freeze(ordered(profileProjectors).map((entry) => entry.projectorId)),
+      invitationContextResolverIds: Object.freeze(ordered(invitationContextResolvers).map((entry) => entry.resolverId))
+    });
+  }
+
+  const api = Object.freeze({
+    registerServiceDecorator,
+    registerPolicyContextResolver,
+    registerProfileProjector,
+    registerInvitationContextResolver,
+    decorateService,
+    resolvePolicyContext,
+    resolveProfileProjector,
+    resolveInvitationContextResolver,
+    diagnostics
+  });
+  return api;
+}
+
+export { createAuthExtensions, mergePolicyContexts };

package/src/server/authPolicyContextResolverRegistry.js

@@ -1,130 +1,19 @@
-import { normalizePermissionList } from "@jskit-ai/kernel/shared/support/permissions";
-import { registerTaggedSingleton, resolveTaggedEntries } from "@jskit-ai/kernel/server/registries";
+import { mergePolicyContexts } from "./authExtensions.js";
 
-const AUTH_POLICY_CONTEXT_RESOLVER_TAG = "jskit.auth.policy.context.resolvers";
-
-function normalizeAuthPolicyContextResolver(entry) {
-  if (typeof entry === "function") {
-    return Object.freeze({
-      resolverId: String(entry.name || "anonymous"),
-      order: 0,
-      resolveAuthPolicyContext: entry
-    });
-  }
-
-  if (!entry || typeof entry !== "object" || typeof entry.resolveAuthPolicyContext !== "function") {
-    return null;
-  }
-
-  const resolverId = String(entry.resolverId || "anonymous");
-  const order = Number.isFinite(entry.order) ? Number(entry.order) : 0;
-
-  return Object.freeze({
-    ...entry,
-    resolverId,
-    order,
-    resolveAuthPolicyContext: entry.resolveAuthPolicyContext
-  });
-}
-
-function registerAuthPolicyContextResolver(app, token, factory) {
-  registerTaggedSingleton(app, token, factory, AUTH_POLICY_CONTEXT_RESOLVER_TAG, {
-    context: "registerAuthPolicyContextResolver"
-  });
-}
-
-function resolveAuthPolicyContextResolvers(scope) {
-  return resolveTaggedEntries(scope, AUTH_POLICY_CONTEXT_RESOLVER_TAG)
-    .map((entry, index) => ({
-      resolver: normalizeAuthPolicyContextResolver(entry),
-      index
-    }))
-    .filter((entry) => Boolean(entry.resolver))
-    .sort((left, right) => {
-      if (left.resolver.order !== right.resolver.order) {
-        return left.resolver.order - right.resolver.order;
-      }
-
-      return left.index - right.index;
-    })
-    .map((entry) => entry.resolver);
-}
-
-function resolveComposedAuthPolicyContextResolver(scope) {
-  return composeAuthPolicyContextResolvers(resolveAuthPolicyContextResolvers(scope));
-}
-
-function mergeAuthPolicyContexts(contexts = []) {
-  const merged = {};
-  let hasValues = false;
-  const permissions = new Set();
-
-  for (const context of Array.isArray(contexts) ? contexts : [contexts]) {
-    if (!context || typeof context !== "object") {
-      continue;
-    }
-
-    for (const [key, value] of Object.entries(context)) {
-      if (key === "permissions") {
-        for (const permission of normalizePermissionList(value)) {
-          permissions.add(permission);
-        }
-        continue;
-      }
-
-      if (value === undefined) {
-        continue;
-      }
-
-      merged[key] = value;
-      hasValues = true;
-    }
-  }
-
-  if (permissions.size > 0) {
-    merged.permissions = Object.freeze([...permissions]);
-    hasValues = true;
+function registerAuthPolicyContextResolver(extensions, resolver) {
+  if (!extensions || typeof extensions.registerPolicyContextResolver !== "function") {
+    throw new TypeError("registerAuthPolicyContextResolver requires auth.extensions.");
   }
-
-  return hasValues ? Object.freeze(merged) : null;
+  return extensions.registerPolicyContextResolver(resolver);
 }
 
-function composeAuthPolicyContextResolvers(resolvers = []) {
-  const normalizedResolvers = (Array.isArray(resolvers) ? resolvers : [resolvers])
-    .map((entry, index) => ({
-      resolver: normalizeAuthPolicyContextResolver(entry),
-      index
-    }))
-    .filter((entry) => Boolean(entry.resolver))
-    .sort((left, right) => {
-      if (left.resolver.order !== right.resolver.order) {
-        return left.resolver.order - right.resolver.order;
-      }
-
-      return left.index - right.index;
-    })
-    .map((entry) => entry.resolver);
-
-  if (normalizedResolvers.length < 1) {
-    return null;
-  }
-
-  return async function resolveComposedAuthPolicyContext(input = {}) {
-    const contexts = [];
-
-    for (const resolver of normalizedResolvers) {
-      contexts.push(await resolver.resolveAuthPolicyContext(input));
-    }
-
-    return mergeAuthPolicyContexts(contexts);
-  };
+function resolveComposedAuthPolicyContextResolver(extensions) {
+  if (!extensions || typeof extensions.resolvePolicyContext !== "function") return null;
+  return (input = {}) => extensions.resolvePolicyContext(input);
 }
 
 export {
-  AUTH_POLICY_CONTEXT_RESOLVER_TAG,
   registerAuthPolicyContextResolver,
-  resolveAuthPolicyContextResolvers,
   resolveComposedAuthPolicyContextResolver,
-  mergeAuthPolicyContexts,
-  composeAuthPolicyContextResolvers
+  mergePolicyContexts
 };