@kubun/plugin-rpc 0.13.1 → 0.13.2

package/lib/index.d.ts

@@ -33,11 +33,35 @@ export type RPCPluginOptions = {
      */
     methods?: MethodRegistry;
 };
+/**
+ * Parameters for a single `serve()` call.
+ */
+export type RPCServerParams = {
+    /** The server-side transport this server reads and writes. */
+    transport: ServerTransport;
+    /** Aborts the server when signalled. */
+    signal?: AbortSignal;
+    /**
+     * Replaces the plugin-level `accessRules` for THIS server only, letting one
+     * host expose different procedure sets on different transports — e.g. a full
+     * admin transport plus a restricted agent channel that must not reach
+     * `graph/deploy` / `graph/list` / `graph/load`. `false` disables auth for
+     * this serve. Omit to keep the plugin default.
+     *
+     * Enkaku access checks are OR across every matching pattern (a procedure is
+     * admitted by the FIRST rule that allows it; a denying rule merely falls
+     * through), so a restricted rule set must ENUMERATE the procedures it grants
+     * rather than pairing a blanket `'*'` allow with per-procedure denials — a
+     * `'*'` allow re-admits everything. Omitting a procedure from the rules is
+     * what denies it (no matching allow rule).
+     */
+    accessRules?: false | AccessRules;
+};
 /**
  * API provided by the RPC plugin.
  */
 export type RPCPluginAPI = {
-    serve: (transport: ServerTransport, signal?: AbortSignal) => Server<GraphProtocol>;
+    serve: (params: RPCServerParams) => Server<GraphProtocol>;
 };
 /**
  * Creates the RPC plugin.

package/lib/index.js

@@ -40,8 +40,12 @@ import { TransactionManager } from './transaction-manager.js';
             transactionManager
         });
         const api = {
-            serve: (transport, signal)=>{
-                const accessRules = options?.accessRules;
+            serve: (serverParams)=>{
+                const { transport, signal } = serverParams;
+                // A per-serve override replaces the plugin-level rules for this server
+                // only; omitting the key keeps the plugin default, while an explicit
+                // `false` disables auth for this serve.
+                const accessRules = 'accessRules' in serverParams ? serverParams.accessRules : options?.accessRules;
                 const baseParams = {
                     runtime: params.runtime,
                     handlers,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-rpc",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -20,23 +20,23 @@
     "@sozai/runtime": "^0.1.0",
     "graphql": "^16.14.2",
     "@kubun/db": "^0.13.0",
-    "@kubun/mutation": "^0.13.0",
-    "@kubun/engine": "^0.13.1",
-    "@kubun/graphql": "^0.13.1",
     "@kubun/protocol": "^0.13.1",
-    "@kubun/hlc": "^0.13.0"
+    "@kubun/graphql": "^0.13.1",
+    "@kubun/hlc": "^0.13.0",
+    "@kubun/engine": "^0.13.1",
+    "@kubun/mutation": "^0.13.0"
   },
   "devDependencies": {
     "@enkaku/transport": "^0.21.0",
     "@kokuin/capability": "^0.3.0",
     "@kokuin/controller": "^0.1.0",
-    "@kubun/id": "^0.13.0",
     "@kubun/store-controller": "^0.13.0",
-    "@kubun/client": "^0.13.0",
-    "@kubun/store-graph": "^0.13.2",
     "@kubun/store-delegation": "^0.13.0",
-    "@kubun/store-p2p": "^0.13.0",
-    "@kubun/test-utils": "^0.13.0"
+    "@kubun/test-utils": "^0.13.0",
+    "@kubun/id": "^0.13.0",
+    "@kubun/store-graph": "^0.13.2",
+    "@kubun/client": "^0.13.0",
+    "@kubun/store-p2p": "^0.13.0"
   },
   "publishConfig": {
     "access": "public"