@kubun/plugin-service-server 0.17.0 → 0.17.1

package/lib/index.d.ts

@@ -1,7 +1,7 @@
 import { type Server } from '@enkaku/server';
 import { type DIDResolver, type MethodRegistry } from '@kokuin/token';
 import type { KubunPlugin, PluginFactoryParams } from '@kubun/engine';
-import type { ServiceHandler, ServiceProtocol, ServiceServerServeParams } from '@kubun/plugin-service-api';
+import type { ServiceAuthorizer, ServiceHandler, ServiceProtocol, ServiceServerServeParams } from '@kubun/plugin-service-api';
 export type { AccessRules, Handlers, ServiceAuthorizer, ServiceConfig, ServiceHandler, ServiceHandlerContext, ServiceProviderImpl, ServiceServerServeParams, } from '@kubun/plugin-service-api';
 export { type AuthorizeParams, type AuthorizeReadParams, authorizeRead, authorizeWrite, type CreateCallerMayActForParams, createCallerMayActFor, SERVICE_ACT_FOR_ACTION, ServiceAuthorizationError, serviceUserResource, } from './authorizer.js';
 /**
@@ -67,6 +67,17 @@ export type ServiceServerPluginAPI = {
  * verification (`methods = [controllerResolverFor(db)]`, pre-transaction).
  */
 export declare function createServiceServerPlugin(options?: ServiceServerPluginOptions): (params: PluginFactoryParams) => KubunPlugin;
+/** Params for {@link wrapHandler}. */
+export type WrapHandlerParams = {
+    /** Fully-qualified procedure name, e.g. `echo/ping`. */
+    procedure: string;
+    /** The service handler to wrap. */
+    handler: ServiceHandler;
+    /** The per-serve authorizer; absent falls back to {@link selfOnlyAuthorizer}. */
+    authorizer?: ServiceAuthorizer;
+    /** The per-serve group id, forwarded to the handler's context. */
+    groupID?: string;
+};
 /**
  * Wrap a service handler so the host — not the caller — supplies the verified
  * `iss` and the `procedure` name to the per-serve authorizer, and so a forged
@@ -78,4 +89,4 @@ export declare function createServiceServerPlugin(options?: ServiceServerPluginO
  * receives a bound `authorize(subject)` that calls the per-serve authorizer with
  * host-supplied `{ iss, procedure }`; a handler cannot spoof either.
  */
-export declare function wrapHandler(procedure: string, handler: ServiceHandler, authorizer: ServiceServerServeParams['authorizer']): ServiceHandler;
+export declare function wrapHandler(params: WrapHandlerParams): ServiceHandler;

package/lib/index.js

@@ -114,7 +114,7 @@ const SERVICE_KIND = 'service';
         ];
         const api = {
             serve: (serveParams)=>{
-                const { transport, services, authorizer, signal, requireAuth, cache } = serveParams;
+                const { transport, services, authorizer, signal, requireAuth, cache, groupID } = serveParams;
                 const providerList = engine.getProvidersSync(SERVICE_KIND);
                 const providers = new Map();
                 for (const provider of providerList){
@@ -134,7 +134,12 @@ const SERVICE_KIND = 'service';
                         if (procedure in mergedHandlers) {
                             throw new ServiceProcedureCollisionError(procedure);
                         }
-                        mergedHandlers[procedure] = wrapHandler(procedure, handler, authorizer);
+                        mergedHandlers[procedure] = wrapHandler({
+                            procedure,
+                            handler,
+                            authorizer,
+                            groupID
+                        });
                     }
                     Object.assign(mergedRules, selected.rules);
                 }
@@ -208,7 +213,8 @@ const selfOnlyAuthorizer = ({ iss, subject })=>subject == null || normalizeDID(i
  * rejected outright, mirroring the RPC plugin's `resolveViewerDID`. The handler
  * receives a bound `authorize(subject)` that calls the per-serve authorizer with
  * host-supplied `{ iss, procedure }`; a handler cannot spoof either.
- */ export function wrapHandler(procedure, handler, authorizer) {
+ */ export function wrapHandler(params) {
+    const { procedure, handler, authorizer, groupID } = params;
     const check = authorizer ?? selfOnlyAuthorizer;
     return async (context)=>{
         // One gate: apply authz context, then translate on throw. A refusal carrying a
@@ -236,7 +242,8 @@ const selfOnlyAuthorizer = ({ iss, subject })=>subject == null || normalizeDID(i
             return await handler({
                 ...context,
                 iss,
-                authorize
+                authorize,
+                groupID
             });
         } catch (cause) {
             throw toHandlerError(cause);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-service-server",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -18,9 +18,9 @@
     "@enkaku/server": "^0.21.2",
     "@kokuin/capability": "^0.3.0",
     "@kokuin/token": "^0.5.0",
-    "@kubun/engine": "^0.17.0",
-    "@kubun/plugin-service-api": "^0.17.0",
-    "@kubun/protocol": "^0.17.0"
+    "@kubun/engine": "^0.17.2",
+    "@kubun/plugin-service-api": "^0.17.1",
+    "@kubun/protocol": "^0.17.1"
   },
   "devDependencies": {
     "@enkaku/client": "^0.21.2",
@@ -28,7 +28,7 @@
     "@kokuin/controller": "^0.1.0",
     "@kubun/db": "^0.17.0",
     "@kubun/store-controller": "^0.17.0",
-    "@kubun/store-graph": "^0.17.0",
+    "@kubun/store-graph": "^0.17.1",
     "@kubun/test-utils": "^0.0.0"
   },
   "publishConfig": {