@kubun/plugin-rpc 0.13.0 → 0.13.2

package/lib/handlers.js

@@ -55,7 +55,8 @@ export function createGraphHandlers(params) {
                 clusters: ctx.param.clusters,
                 id: ctx.param.id,
                 name: ctx.param.name,
-                plugins: ctx.param.plugins
+                plugins: ctx.param.plugins,
+                search: ctx.param.search
             });
         },
         'graph/list': async ()=>{

package/lib/index.d.ts

@@ -1,5 +1,6 @@
 import type { ServerTransportOf } from '@enkaku/protocol';
 import { type AccessRules, type Server } from '@enkaku/server';
+import { type DIDResolver, type MethodRegistry } from '@kokuin/token';
 import type { KubunPlugin, PluginFactoryParams } from '@kubun/engine';
 import type { GraphProtocol } from '@kubun/protocol';
 import { type TransactionManagerOptions } from './transaction-manager.js';
@@ -18,12 +19,49 @@ export type RPCPluginOptions = {
     allowDelegatedMutations?: boolean;
     /** Configuration for the transaction manager. */
     transactionConfig?: TransactionManagerOptions;
+    /**
+     * DID resolver forwarded to Enkaku's transport-level message-signature
+     * verification. Rarely needed — supply one only to resolve a DID method the
+     * default `methods` registry does not cover.
+     */
+    resolver?: DIDResolver;
+    /**
+     * Method registry forwarded to Enkaku's transport-level message-signature
+     * verification. Defaults to the engine's own `did:kokuin:` controller
+     * resolver so a `did:kokuin:`-signed message over an authenticated socket
+     * verifies out of the box; pass a registry here to override that default.
+     */
+    methods?: MethodRegistry;
+};
+/**
+ * Parameters for a single `serve()` call.
+ */
+export type RPCServerParams = {
+    /** The server-side transport this server reads and writes. */
+    transport: ServerTransport;
+    /** Aborts the server when signalled. */
+    signal?: AbortSignal;
+    /**
+     * Replaces the plugin-level `accessRules` for THIS server only, letting one
+     * host expose different procedure sets on different transports — e.g. a full
+     * admin transport plus a restricted agent channel that must not reach
+     * `graph/deploy` / `graph/list` / `graph/load`. `false` disables auth for
+     * this serve. Omit to keep the plugin default.
+     *
+     * Enkaku access checks are OR across every matching pattern (a procedure is
+     * admitted by the FIRST rule that allows it; a denying rule merely falls
+     * through), so a restricted rule set must ENUMERATE the procedures it grants
+     * rather than pairing a blanket `'*'` allow with per-procedure denials — a
+     * `'*'` allow re-admits everything. Omitting a procedure from the rules is
+     * what denies it (no matching allow rule).
+     */
+    accessRules?: false | AccessRules;
 };
 /**
  * API provided by the RPC plugin.
  */
 export type RPCPluginAPI = {
-    serve: (transport: ServerTransport, signal?: AbortSignal) => Server<GraphProtocol>;
+    serve: (params: RPCServerParams) => Server<GraphProtocol>;
 };
 /**
  * Creates the RPC plugin.

package/lib/index.js

@@ -16,6 +16,15 @@ import { TransactionManager } from './transaction-manager.js';
     return (params)=>{
         const servers = [];
         const signer = isSigningIdentity(params.identity) ? params.identity : null;
+        // Transport-level message-signature verification (Enkaku's `verifyToken`)
+        // runs per message, before any handler opens a write transaction — the same
+        // pre-transaction position as the engine's own `#controllerResolver`. So a
+        // `did:kokuin:` resolver over the base db is correct and deadlock-free here:
+        // it reads the controller store on the main connection while no write tx is
+        // held. A host may override the default via `options.methods`.
+        const methods = options?.methods ?? [
+            params.controllerResolverFor(params.db)
+        ];
         const transactionManager = new TransactionManager({
             runtime: params.runtime,
             ...options?.transactionConfig
@@ -31,14 +40,20 @@ import { TransactionManager } from './transaction-manager.js';
             transactionManager
         });
         const api = {
-            serve: (transport, signal)=>{
-                const accessRules = options?.accessRules;
+            serve: (serverParams)=>{
+                const { transport, signal } = serverParams;
+                // A per-serve override replaces the plugin-level rules for this server
+                // only; omitting the key keeps the plugin default, while an explicit
+                // `false` disables auth for this serve.
+                const accessRules = 'accessRules' in serverParams ? serverParams.accessRules : options?.accessRules;
                 const baseParams = {
                     runtime: params.runtime,
                     handlers,
                     logger: params.getLogger('rpc-server'),
                     signal,
-                    transport
+                    transport,
+                    resolver: options?.resolver,
+                    methods
                 };
                 const serveParams = accessRules === false ? {
                     ...baseParams,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-rpc",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -20,21 +20,23 @@
     "@sozai/runtime": "^0.1.0",
     "graphql": "^16.14.2",
     "@kubun/db": "^0.13.0",
-    "@kubun/engine": "^0.13.0",
-    "@kubun/mutation": "^0.13.0",
-    "@kubun/protocol": "^0.13.0",
+    "@kubun/protocol": "^0.13.1",
+    "@kubun/graphql": "^0.13.1",
     "@kubun/hlc": "^0.13.0",
-    "@kubun/graphql": "^0.13.0"
+    "@kubun/engine": "^0.13.1",
+    "@kubun/mutation": "^0.13.0"
   },
   "devDependencies": {
     "@enkaku/transport": "^0.21.0",
     "@kokuin/capability": "^0.3.0",
-    "@kubun/client": "^0.13.0",
+    "@kokuin/controller": "^0.1.0",
+    "@kubun/store-controller": "^0.13.0",
     "@kubun/store-delegation": "^0.13.0",
+    "@kubun/test-utils": "^0.13.0",
     "@kubun/id": "^0.13.0",
-    "@kubun/store-p2p": "^0.13.0",
-    "@kubun/store-graph": "^0.13.0",
-    "@kubun/test-utils": "^0.13.0"
+    "@kubun/store-graph": "^0.13.2",
+    "@kubun/client": "^0.13.0",
+    "@kubun/store-p2p": "^0.13.0"
   },
   "publishConfig": {
     "access": "public"