@kubun/hub 0.14.0 → 0.15.0

package/lib/create-relay.d.ts

@@ -1,6 +1,7 @@
 import type { Identity } from '@kokuin/token';
 import type { Adapter } from '@kubun/db-adapter';
 import { type AdapterInput } from '@kubun/db-provider';
+import type { AuthorizeHook } from '@kumiai/hub-server';
 import { Kysely } from 'kysely';
 import { type HubDatabase, type KubunHubStore } from './hub-store.js';
 import { type RelayObservers } from './observers.js';
@@ -20,6 +21,13 @@ export type CreateRelayOptions = {
     db: AdapterInput;
     identity: Identity;
     auth?: HubAuthConfig;
+    /**
+     * Per-action authorization hook, forwarded verbatim to `@kumiai/hub-server`
+     * `createHub`. Composes with `auth`: the coarse `AccessRules` gate runs first,
+     * then this refines per action and topic. Omitted, the hub allows any
+     * authenticated request (its default).
+     */
+    authorize?: AuthorizeHook;
     allowedOrigin?: string | Array<string>;
     retention?: RelayRetentionConfig;
     defaultRetention?: number;
@@ -38,6 +46,13 @@ export type RelayInternalOptions = {
     adapter: Adapter;
     identity: Identity;
     auth?: HubAuthConfig;
+    /**
+     * Per-action authorization hook, forwarded verbatim to `@kumiai/hub-server`
+     * `createHub`. Composes with `auth`: the coarse `AccessRules` gate runs first,
+     * then this refines per action and topic. Omitted, the hub allows any
+     * authenticated request (its default).
+     */
+    authorize?: AuthorizeHook;
     allowedOrigin?: string | Array<string>;
     retention?: RelayRetentionConfig;
     defaultRetention?: number;

package/lib/create-relay.js

@@ -97,6 +97,7 @@ export async function createRelayInternal(options) {
         store: hubStore,
         identity: options.identity,
         accessRules,
+        authorize: options.authorize,
         purge: false
     });
     if (observers?.onAuthRejected != null) {
@@ -222,6 +223,7 @@ export async function createRelay(options) {
         adapter,
         identity: options.identity,
         auth: options.auth,
+        authorize: options.authorize,
         allowedOrigin: options.allowedOrigin,
         retention: options.retention,
         defaultRetention: options.defaultRetention,

package/lib/index.d.ts

@@ -4,8 +4,10 @@ import type { Kysely } from 'kysely';
 import { type HubAuthConfig, type RelayRetentionConfig } from './create-relay.js';
 import type { HubDatabase } from './hub-store.js';
 import type { RelayObservers } from './observers.js';
+export type { AuthorizeDecision, AuthorizeHook, AuthorizeRequest } from '@kumiai/hub-server';
 export { type CreateRelayOptions, createRelay, createRelayInternal, type HubAuthConfig, type Relay, type RelayRetentionConfig, } from './create-relay.js';
 export { type CreateHubStoreParams, createHubStore, type HubDatabase, type KubunHubStore, type PurgedSubscription, type PurgeSubscriptionsParams, } from './hub-store.js';
+export { type JoinLaneAuthorizeConfig, joinLaneAuthorize } from './join-lane-authorize.js';
 export { createHubMigrations, type MigrationContext } from './migrations.js';
 export { decorateHubStore, type RelayObserverAckInfo, type RelayObserverAuthRejectedInfo, type RelayObserverErrorInfo, type RelayObserverErrorStage, type RelayObserverFetchInfo, type RelayObserverPurgeInfo, type RelayObserverRetentionConfigClampedInfo, type RelayObserverStoreInfo, type RelayObserverSubscriptionPurgeInfo, type RelayObservers, } from './observers.js';
 export type HubOptions = {

package/lib/index.js

@@ -4,6 +4,7 @@ import { Hono } from 'hono';
 import { createRelayInternal } from './create-relay.js';
 export { createRelay, createRelayInternal } from './create-relay.js';
 export { createHubStore } from './hub-store.js';
+export { joinLaneAuthorize } from './join-lane-authorize.js';
 export { createHubMigrations } from './migrations.js';
 export { decorateHubStore } from './observers.js';
 export async function createHub(options) {

package/lib/join-lane-authorize.d.ts

@@ -0,0 +1,13 @@
+import type { AuthorizeHook } from '@kumiai/hub-server';
+export type JoinLaneAuthorizeConfig = {
+    /** The single topic a not-yet-member device may touch. */
+    joinTopic: string;
+    /** Whether a DID is already a member (gets full access). */
+    isMember: (did: string) => boolean | Promise<boolean>;
+};
+/**
+ * Build an `authorize` hook implementing a pre-membership "join lane": a member
+ * DID may do anything; a non-member may only publish/subscribe/fetch exactly the
+ * one join topic, and nothing else. Pair with `createRelay({ authorize })`.
+ */
+export declare function joinLaneAuthorize(config: JoinLaneAuthorizeConfig): AuthorizeHook;

package/lib/join-lane-authorize.js

@@ -0,0 +1,26 @@
+// Actions a non-member is allowed on the join topic — the minimum to post a
+// join request and receive the answer. Everything else is denied.
+const JOIN_LANE_ACTIONS = new Set([
+    'publish',
+    'subscribe',
+    'topic/fetch'
+]);
+/**
+ * Build an `authorize` hook implementing a pre-membership "join lane": a member
+ * DID may do anything; a non-member may only publish/subscribe/fetch exactly the
+ * one join topic, and nothing else. Pair with `createRelay({ authorize })`.
+ */ export function joinLaneAuthorize(config) {
+    return async (req)=>{
+        if (await config.isMember(req.did)) {
+            return true;
+        }
+        const topicID = 'topicID' in req ? req.topicID : undefined;
+        if (JOIN_LANE_ACTIONS.has(req.action) && topicID === config.joinTopic) {
+            return true;
+        }
+        return {
+            allow: false,
+            reason: 'join lane: non-members may only use the join topic'
+        };
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/hub",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -18,26 +18,26 @@
     "@enkaku/server": "^0.21.2",
     "@hono/node-server": "^2.1.1",
     "@kokuin/token": "^0.5.0",
-    "@kubun/db-adapter": "^0.14.0",
-    "@kubun/db-provider": "^0.14.0",
-    "@kubun/http-util": "^0.14.0",
-    "@kumiai/hub-protocol": "^0.7.0",
-    "@kumiai/hub-server": "^0.7.0",
+    "@kubun/db-adapter": "^0.15.0",
+    "@kubun/db-provider": "^0.15.0",
+    "@kubun/http-util": "^0.15.0",
+    "@kumiai/hub-protocol": "^0.8.0",
+    "@kumiai/hub-server": "^0.8.0",
     "@sozai/event": "^0.1.3",
     "get-port": "^7.2.0",
-    "hono": "^4.13.4",
+    "hono": "^4.13.5",
     "kysely": "^0.29.5"
   },
   "devDependencies": {
-    "@enkaku/client": "^0.21.0",
+    "@enkaku/client": "^0.21.1",
     "@enkaku/http-fetch": "^0.21.0",
     "@enkaku/protocol": "^0.21.0",
     "@enkaku/transport": "^0.21.0",
-    "@kubun/db-better-sqlite": "^0.14.0",
-    "@kubun/db-node-sqlite": "^0.14.0",
-    "@kubun/db-postgres": "^0.14.0",
-    "@kumiai/hub-conformance": "^0.7.0",
-    "@kumiai/mls": "^0.7.0",
+    "@kubun/db-better-sqlite": "^0.15.0",
+    "@kubun/db-node-sqlite": "^0.15.0",
+    "@kubun/db-postgres": "^0.15.0",
+    "@kumiai/hub-conformance": "^0.8.0",
+    "@kumiai/mls": "^0.8.0",
     "@sozai/async": "^0.2.1",
     "@testcontainers/postgresql": "^12.1.0"
   },