@jskit-ai/auth-core 0.1.157 → 0.1.159

package/src/server/authServiceDecoratorRegistry.js

@@ -1,70 +1,15 @@
-import { registerTaggedSingleton, resolveTaggedEntries } from "@jskit-ai/kernel/server/registries";
-
-const AUTH_SERVICE_DECORATOR_TAG = "jskit.auth.service.decorators";
-
-function normalizeAuthServiceDecorator(entry) {
-  if (typeof entry === "function") {
-    return Object.freeze({
-      decoratorId: String(entry.name || "anonymous"),
-      order: 0,
-      decorateAuthService: entry
-    });
-  }
-
-  if (!entry || typeof entry !== "object" || typeof entry.decorateAuthService !== "function") {
-    return null;
+function registerAuthServiceDecorator(extensions, decorator) {
+  if (!extensions || typeof extensions.registerServiceDecorator !== "function") {
+    throw new TypeError("registerAuthServiceDecorator requires auth.extensions.");
   }
-
-  const decoratorId = String(entry.decoratorId || "anonymous");
-  const order = Number.isFinite(entry.order) ? Number(entry.order) : 0;
-
-  return Object.freeze({
-    ...entry,
-    decoratorId,
-    order,
-    decorateAuthService: entry.decorateAuthService
-  });
+  return extensions.registerServiceDecorator(decorator);
 }
 
-function registerAuthServiceDecorator(app, token, factory) {
-  registerTaggedSingleton(app, token, factory, AUTH_SERVICE_DECORATOR_TAG, {
-    context: "registerAuthServiceDecorator"
-  });
-}
-
-function resolveAuthServiceDecorators(scope) {
-  return resolveTaggedEntries(scope, AUTH_SERVICE_DECORATOR_TAG)
-    .map((entry, index) => ({
-      decorator: normalizeAuthServiceDecorator(entry),
-      index
-    }))
-    .filter((entry) => Boolean(entry.decorator))
-    .sort((left, right) => {
-      if (left.decorator.order !== right.decorator.order) {
-        return left.decorator.order - right.decorator.order;
-      }
-
-      return left.index - right.index;
-    })
-    .map((entry) => entry.decorator);
-}
-
-function applyAuthServiceDecorators(scope, authService) {
-  let decoratedAuthService = authService;
-
-  for (const decorator of resolveAuthServiceDecorators(scope)) {
-    decoratedAuthService = decorator.decorateAuthService(decoratedAuthService);
-    if (!decoratedAuthService || typeof decoratedAuthService !== "object") {
-      throw new Error(`Auth service decorator "${decorator.decoratorId}" must return an auth service object.`);
-    }
+function applyAuthServiceDecorators(extensions, authService) {
+  if (!extensions || typeof extensions.decorateService !== "function") {
+    throw new TypeError("applyAuthServiceDecorators requires auth.extensions.");
   }
-
-  return decoratedAuthService;
+  return extensions.decorateService(authService);
 }
 
-export {
-  AUTH_SERVICE_DECORATOR_TAG,
-  applyAuthServiceDecorators,
-  registerAuthServiceDecorator,
-  resolveAuthServiceDecorators
-};
+export { applyAuthServiceDecorators, registerAuthServiceDecorator };

package/src/server/deferredAuthService.js

@@ -0,0 +1,32 @@
+const attachByHandle = new WeakMap();
+
+function createDeferredAuthService() {
+  let service = null;
+  const handle = new Proxy(Object.create(null), {
+    get(_target, property) {
+      if (property === Symbol.toStringTag) return "AuthService";
+      if (!service) throw new Error("Authentication service is not ready until runtime startup completes.");
+      const value = service[property];
+      return typeof value === "function" ? value.bind(service) : value;
+    },
+    has(_target, property) {
+      return service ? property in service : false;
+    }
+  });
+  attachByHandle.set(handle, (value) => {
+    if (service) throw new Error("Authentication service is already initialized.");
+    service = value;
+  });
+  return handle;
+}
+
+function attachDeferredAuthService(handle, service) {
+  const attach = attachByHandle.get(handle);
+  if (!attach) throw new TypeError("attachDeferredAuthService requires a deferred auth service handle.");
+  if (!service || typeof service !== "object") {
+    throw new TypeError("attachDeferredAuthService requires an auth service object.");
+  }
+  attach(service);
+}
+
+export { attachDeferredAuthService, createDeferredAuthService };

package/src/server/lib/actionContextContributor.js

@@ -3,7 +3,8 @@ import { normalizePermissionList } from "@jskit-ai/kernel/shared/support/permiss
 function createAuthActionContextContributor() {
   return Object.freeze({
     contributorId: "auth.policy.request-context",
-    contribute({ request } = {}) {
+    contribute({ context } = {}) {
+      const request = context?.requestMeta?.request || null;
       const contribution = {};
       const permissions = normalizePermissionList(request?.permissions);
 

package/src/server/providers/{AccessCoreServiceProvider.js → AuthAccessProvider.js}

@@ -1,3 +1,4 @@
+import { defineProvider } from "@jskit-ai/kernel/shared/capabilities";
 import * as authConstraints from "../../shared/authConstraints.js";
 import * as authMethods from "../../shared/authMethods.js";
 import * as oauthProviders from "../../shared/oauthProviders.js";
@@ -7,7 +8,7 @@ import * as inviteTokens from "../inviteTokens.js";
 import * as utils from "../utils.js";
 import * as validators from "../validators.js";
 
-const ACCESS_CORE_API = Object.freeze({
+const access = Object.freeze({
   authConstraints,
   authMethods,
   oauthProviders,
@@ -18,18 +19,14 @@ const ACCESS_CORE_API = Object.freeze({
   validators
 });
 
-class AccessCoreServiceProvider {
-  static id = "auth.access";
-
-  register(app) {
-    if (!app || typeof app.singleton !== "function") {
-      throw new Error("AccessCoreServiceProvider requires application singleton().");
-    }
-
-    app.singleton("auth.access", () => ACCESS_CORE_API);
+const AuthAccessProvider = defineProvider({
+  id: "auth.access",
+  provides: {
+    access: "auth.access"
+  },
+  setup() {
+    return { access };
   }
+});
 
-  boot() {}
-}
-
-export { AccessCoreServiceProvider };
+export { AuthAccessProvider };

package/src/server/providers/AuthExtensionsProvider.js

@@ -0,0 +1,14 @@
+import { defineProvider } from "@jskit-ai/kernel/shared/capabilities";
+import { createAuthExtensions } from "../authExtensions.js";
+
+const AuthExtensionsProvider = defineProvider({
+  id: "auth.extensions",
+  provides: {
+    extensions: "auth.extensions"
+  },
+  setup() {
+    return { extensions: createAuthExtensions() };
+  }
+});
+
+export { AuthExtensionsProvider };

package/src/server/providers/AuthFeature.js

@@ -0,0 +1,15 @@
+import { defineFeature } from "@jskit-ai/kernel/server/features";
+import { buildAuthActions } from "../actions/auth.contributor.js";
+
+const AuthFeature = defineFeature({
+  id: "auth.actions",
+  domain: "auth",
+  optional: {
+    authService: "auth.service"
+  },
+  actions({ authService }) {
+    return authService ? buildAuthActions({ authService }) : [];
+  }
+});
+
+export { AuthFeature };

package/src/server/providers/AuthPolicyProvider.js

@@ -0,0 +1,79 @@
+import { defineProvider } from "@jskit-ai/kernel/shared/capabilities";
+import { parseBooleanFlag } from "../booleanFlag.js";
+import { authPolicyPlugin } from "../lib/plugin.js";
+import { createAuthActionContextContributor } from "../lib/actionContextContributor.js";
+import { createAuthRouteVisibilityResolver } from "../lib/routeVisibilityResolver.js";
+
+function parseList(value) {
+  return String(value || "").split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+
+function defaultHasPermission({ permission, permissions = [] } = {}) {
+  return !permission || (Array.isArray(permissions) && permissions.includes(permission));
+}
+
+function createPolicy({ authService, extensions, env }) {
+  return Object.freeze({
+    async resolveActor(request) {
+      if (authService && typeof authService.authenticateRequest === "function") {
+        return authService.authenticateRequest(request);
+      }
+      return { authenticated: false, actor: null, transientFailure: false };
+    },
+    hasPermission: defaultHasPermission,
+    resolveContext(input = {}) {
+      return extensions.resolvePolicyContext(input);
+    },
+    options: Object.freeze({
+      nodeEnv: String(env.NODE_ENV || "development").trim() || "development",
+      apiPrefix: String(env.AUTH_API_PREFIX || "/api/").trim() || "/api/",
+      unsafeMethods: Object.freeze(parseList(env.AUTH_CSRF_UNSAFE_METHODS)),
+      csrfCookieOpts: Object.freeze({
+        secure: parseBooleanFlag(env.AUTH_CSRF_COOKIE_SECURE, false)
+      })
+    })
+  });
+}
+
+const AuthPolicyProvider = defineProvider({
+  id: "auth.policy",
+  requires: {
+    actions: "runtime.actions",
+    extensions: "auth.extensions",
+    fastify: "runtime.fastify",
+    http: "runtime.http",
+    env: "runtime.env"
+  },
+  optional: {
+    authService: "auth.service"
+  },
+  provides: {
+    policy: "auth.policy"
+  },
+  setup({ actions, authService, extensions, http, env }) {
+    const actionContext = createAuthActionContextContributor();
+    actions.registerContextContributor({
+      id: actionContext.contributorId,
+      contribute: actionContext.contribute
+    });
+    const visibility = createAuthRouteVisibilityResolver();
+    http.registerVisibilityResolver({
+      id: visibility.resolverId,
+      resolve: visibility.resolve
+    });
+    return { policy: createPolicy({ authService, extensions, env }) };
+  },
+  async boot({ fastify }, { outputs }) {
+    const policy = outputs.policy;
+    await authPolicyPlugin(
+      {
+        resolveActor: policy.resolveActor,
+        resolveContext: policy.resolveContext,
+        hasPermission: policy.hasPermission
+      },
+      policy.options
+    )(fastify);
+  }
+});
+
+export { AuthPolicyProvider };

package/test/actionContextContributor.test.js

@@ -6,11 +6,15 @@ test("auth action context contributor skips empty placeholder values", () => {
   const contributor = createAuthActionContextContributor();
 
   const contribution = contributor.contribute({
-    request: {
-      user: null,
-      workspace: null,
-      membership: null,
-      permissions: []
+    context: {
+      requestMeta: {
+        request: {
+          user: null,
+          workspace: null,
+          membership: null,
+          permissions: []
+        }
+      }
     }
   });
 
@@ -33,7 +37,11 @@ test("auth action context contributor contributes real request context values",
     permissions: ["workspace.settings.update", "", "  "]
   };
 
-  const contribution = contributor.contribute({ request });
+  const contribution = contributor.contribute({
+    context: {
+      requestMeta: { request }
+    }
+  });
 
   assert.deepEqual(contribution, {
     actor: request.user,

package/test/authActions.test.js

@@ -1,265 +1,88 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { createSchema } from "json-rest-schema";
-import { createApplication } from "@jskit-ai/kernel/_testable";
-import { ActionRuntimeServiceProvider } from "@jskit-ai/kernel/server/actions";
-import { AuthActionsServiceProvider } from "../src/server/providers/AuthActionsServiceProvider.js";
+import { createActionProvider } from "@jskit-ai/kernel/server/actions";
+import { createCapabilityRuntime, defineProvider } from "@jskit-ai/kernel/shared/capabilities";
 import { buildAuthActions } from "../src/server/actions/auth.contributor.js";
+import { AuthFeature } from "../src/server/providers/AuthFeature.js";
 
-function createAppConfigFixture() {
-  return {
-    surfaceModeAll: "all",
-    surfaceDefaultId: "home",
-    surfaceDefinitions: {
-      home: { id: "home", pagesRoot: "", enabled: true, requiresAuth: false, requiresWorkspace: false },
-      console: {
-        id: "console",
-        pagesRoot: "console",
-        enabled: true,
-        requiresAuth: true,
-        requiresWorkspace: false
-      }
-    }
-  };
-}
-
-test("auth logout action delegates to selected auth provider and notifies session changes", async () => {
-  const action = buildAuthActions().find((definition) => definition.id === "auth.logout");
-  const request = {
-    id: "request-1"
-  };
+test("auth logout action delegates directly to the selected auth service", async () => {
   const calls = [];
-
-  const result = await action.execute(
-    {},
-    {
-      requestMeta: {
-        request
-      }
-    },
-    {
-      authService: {
-        async logout(receivedRequest) {
-          calls.push({
-            type: "logout",
-            request: receivedRequest
-          });
-          return {
-            ok: true,
-            clearSession: true
-          };
-        }
-      },
-      authSessionEventsService: {
-        async notifySessionChanged(payload) {
-          calls.push({
-            type: "notify",
-            context: payload.context
-          });
-        }
-      }
+  const authService = {
+    async logout(request) {
+      calls.push(request);
+      return { ok: true, clearSession: true };
     }
-  );
-
-  assert.deepEqual(result, {
+  };
+  const action = buildAuthActions({ authService }).find((definition) => definition.id === "auth.logout");
+  const request = { id: "request-1" };
+  assert.deepEqual(await action.execute({}, { requestMeta: { request } }), {
     ok: true,
     clearSession: true
   });
-  assert.deepEqual(calls, [
-    {
-      type: "logout",
-      request
-    },
-    {
-      type: "notify",
-      context: {
-        requestMeta: {
-          request
-        }
-      }
-    }
-  ]);
+  assert.deepEqual(calls, [request]);
 });
 
-test("shared dev login-as action passes the trusted request to the selected auth provider", async () => {
-  const action = buildAuthActions().find((definition) => definition.id === "auth.dev.loginAs");
-  const request = {
-    headers: {
-      "x-jskit-dev-auth-secret": "secret"
-    }
-  };
-  const input = {
-    email: "ada@example.com"
-  };
+test("shared dev login-as action passes the trusted request to auth.service", async () => {
+  const input = { email: "ada@example.com" };
+  const request = { headers: { "x-jskit-dev-auth-secret": "secret" } };
   let received = null;
-
-  const result = await action.execute(input, {
-    requestMeta: {
-      request
-    }
-  }, {
+  const action = buildAuthActions({
     authService: {
       async devLoginAs(receivedRequest, receivedInput) {
-        received = {
-          input: receivedInput,
-          request: receivedRequest
-        };
-        return {
-          ok: true
-        };
+        received = { input: receivedInput, request: receivedRequest };
+        return { ok: true };
       }
     }
-  });
-
-  assert.deepEqual(result, { ok: true });
+  }).find((definition) => definition.id === "auth.dev.loginAs");
+  assert.deepEqual(await action.execute(input, { requestMeta: { request } }), { ok: true });
   assert.deepEqual(received, { input, request });
 });
 
-test("AuthActionsServiceProvider registers shared auth actions against auth.provider", async () => {
-  const app = createApplication();
-  const logoutCalls = [];
-  const published = [];
-  class SelectedAuthProvider {
-    static id = "auth.provider";
-
-    register(targetApp) {
-      targetApp.singleton("authService", () => ({
-        async logout(request) {
-          logoutCalls.push(request);
-          return {
-            ok: true,
-            clearSession: true
-          };
-        },
-        async authenticateRequest() {
-          return {
-            authenticated: false,
-            actor: null,
-            transientFailure: false
-          };
+test("AuthFeature contributes actions only when auth.service exists", async () => {
+  let actions = null;
+  const SelectedAuthProvider = defineProvider({
+    id: "test.auth.service",
+    provides: { service: "auth.service" },
+    setup() {
+      return {
+        service: {
+          async authenticateRequest() {
+            return { authenticated: false, actor: null, transientFailure: false };
+          },
+          async logout() {
+            return { ok: true, clearSession: true };
+          }
         }
-      }));
-    }
-  }
-
-  app.instance("appConfig", createAppConfigFixture());
-  app.instance("domainEvents", {
-    async publish(payload) {
-      published.push(payload);
+      };
     }
   });
-
-  await app.start({
-    providers: [ActionRuntimeServiceProvider, SelectedAuthProvider, AuthActionsServiceProvider]
-  });
-
-  const actionExecutor = app.make("actionExecutor");
-  const definitions = actionExecutor.listDefinitions();
-  assert.equal(definitions.some((definition) => definition.id === "auth.login.password"), true);
-  assert.equal(definitions.some((definition) => definition.id === "auth.register"), true);
-  assert.equal(definitions.some((definition) => definition.id === "auth.dev.loginAs"), true);
-  assert.deepEqual(definitions.find((definition) => definition.id === "auth.session.read")?.surfaces, [
-    "home",
-    "console"
-  ]);
-
-  const request = { id: "request-2" };
-  const result = await actionExecutor.execute({
-    actionId: "auth.logout",
-    input: {},
-    context: {
-      channel: "internal",
-      surface: "home",
-      requestMeta: { request },
-      actor: { id: 42 }
+  const ProbeProvider = defineProvider({
+    id: "test.auth.actions.probe",
+    requires: { catalogue: "runtime.actions" },
+    setup({ catalogue }) {
+      actions = catalogue;
+      return {};
     }
   });
-
-  assert.deepEqual(result, {
-    ok: true,
-    clearSession: true
+  const runtime = createCapabilityRuntime({
+    providers: [createActionProvider(), SelectedAuthProvider, AuthFeature, ProbeProvider]
   });
-  assert.deepEqual(logoutCalls, [request]);
-  assert.equal(published.length, 2);
-  assert.deepEqual(
-    published.map((event) => ({
-      source: event.source,
-      entity: event.entity,
-      operation: event.operation,
-      entityId: event.entityId,
-      realtimeEvent: event.meta?.realtime?.event
-    })),
-    [
-      {
-        source: "auth",
-        entity: "session",
-        operation: "updated",
-        entityId: "42",
-        realtimeEvent: "auth.session.changed"
-      },
-      {
-        source: "users",
-        entity: "bootstrap",
-        operation: "updated",
-        entityId: "42",
-        realtimeEvent: "users.bootstrap.changed"
-      }
-    ]
-  );
-});
-
-test("AuthActionsServiceProvider leaves unrelated actions usable when no auth provider is selected", async () => {
-  const app = createApplication();
-
-  class PublicActionProvider {
-    static id = "public.actions";
-
-    static startsAfter = ["runtime.actions"];
-
-    register(targetApp) {
-      targetApp.action({
-        id: "public.ping",
-        domain: "public",
-        version: 1,
-        kind: "query",
-        channels: ["internal"],
-        surfaces: ["home"],
-        permission: { require: "none" },
-        input: {
-          schema: createSchema({}),
-          mode: "patch"
-        },
-        output: null,
-        idempotency: "none",
-        audit: { actionName: "public.ping" },
-        observability: {},
-        async execute() {
-          return { ok: true };
-        }
-      });
+  await runtime.start();
+  assert.equal(actions.listDefinitions().some((definition) => definition.id === "auth.login.password"), true);
+  assert.deepEqual(actions.getDefinition("auth.session.read").surfaces, ["*"]);
+
+  let publicActions = null;
+  const EmptyProbe = defineProvider({
+    id: "test.auth.empty-probe",
+    requires: { catalogue: "runtime.actions" },
+    setup({ catalogue }) {
+      publicActions = catalogue;
+      return {};
     }
-  }
-
-  app.instance("appConfig", createAppConfigFixture());
-
-  await app.start({
-    providers: [ActionRuntimeServiceProvider, AuthActionsServiceProvider, PublicActionProvider]
   });
-
-  const actionExecutor = app.make("actionExecutor");
-  assert.equal(
-    actionExecutor.listDefinitions().some((definition) => definition.id.startsWith("auth.")),
-    false
-  );
-  assert.deepEqual(
-    await actionExecutor.execute({
-      actionId: "public.ping",
-      input: {},
-      context: {
-        channel: "internal",
-        surface: "home"
-      }
-    }),
-    { ok: true }
-  );
+  const noAuthRuntime = createCapabilityRuntime({
+    providers: [createActionProvider(), AuthFeature, EmptyProbe]
+  });
+  await noAuthRuntime.start();
+  assert.deepEqual(publicActions.listDefinitions(), []);
 });