@lushly-dev/afd-auth 2.1.0 → 2.2.0

package/README.md

@@ -40,7 +40,7 @@ const middleware = createAuthMiddleware(adapter, { exclude: ['public-cmd'] });
 | `unauthenticated` | `UNAUTHORIZED`, not retryable |
 | `loading` | `UNAUTHORIZED`, retryable |
 | `authenticated`, `session.expiresAt` at or before now (or not a valid date) | `TOKEN_EXPIRED`, retryable |
-| `authenticated` | sets `context.auth` and runs the command |
+| `authenticated` | sets `context.auth`, fills `context.actor` from the session user and runs the command |
 
 - The built-in commands `auth-sign-in`, `auth-sign-out` and `auth-session-get`
   (`AUTH_COMMAND_NAMES`) always run, so a signed-out caller can sign in.
@@ -48,6 +48,10 @@ const middleware = createAuthMiddleware(adapter, { exclude: ['public-cmd'] });
 - The middleware sets or deletes `context.auth` on every call, excluded
   commands included. A handler never sees a `context.auth` that the caller
   supplied.
+- With a verified session, a `human` (or missing) `context.actor` becomes
+  `{ kind: 'human', id: user.id, label: user.name }`. An `agent`, `service` or
+  `script` actor keeps its identity and gets `onBehalfOf: user.id`, replacing any
+  `onBehalfOf` the caller set.
 - Importing the package types `context.auth` as
   `AuthenticatedSessionState | undefined` through a `CommandContext` module
   augmentation.
@@ -187,15 +191,17 @@ callbacks, refresh of upstream OAuth tokens, simultaneous refresh-lock atomicity
 other browsers or Convex deployment behavior. Those deployment-specific checks
 remain tracked in [#362](https://github.com/lushly-dev/afd/issues/362).
 
-For an optional provider/browser validation run, provision a disposable staging
-application with its HTTPS origin and callback URL registered with the provider,
-a dedicated test account, test OAuth client configuration (or a dedicated Convex
-deployment) and a short session lifetime. Use two tabs in one fresh browser profile:
-complete OAuth through the actual callback, verify the adapter user/session in both
-tabs, trigger provider refresh across expiry, then sign out and verify both tabs
-and an independent session endpoint reject the previous session. Record deployment
-revision, provider/client version, cookie attributes, timing and each observed
-outcome without recording tokens. Revoke test sessions, delete the test account
-and disposable deployment, and close the profile. Missing configuration means
-**not run**; the local test cannot satisfy those checks. Production credentials
-are unnecessary for the default gate.
+The additional [Better Auth HTTPS/OAuth fixture](hosted/better-auth/README.md)
+uses a local test OAuth provider and SQLite-backed Better Auth. It exercises the
+callback, Secure cookies and restart persistence without a hosted account. The
+[Convex fixture](hosted/convex/README.md) bundles actual React/provider SDKs and
+deployable backend functions; its local checks do not execute a Convex deployment.
+
+After installing Chromium, run `pnpm test:hosted:local` from the repository root
+on Node 24. It also runs the durable REST/view-state lifecycle. Separate opt-in
+commands `test:hosted:better-auth` and `test:hosted:convex` require the fixture's
+explicit disposable-service configuration and fail preflight when it is missing.
+See the [hosted verification handoff](../../docs/operations/hosted-verification.md)
+for local evidence, provisioning order, receipt requirements and cleanup. External
+OAuth grants, deployment restart and actual Convex authentication remain pending
+under #362; a local fixture pass does not close them.

package/dist/middleware.d.ts

@@ -28,7 +28,7 @@ export interface AuthMiddlewareOptions {
  * - Unauthenticated → failure with UNAUTHORIZED
  * - Loading → failure with UNAUTHORIZED (retryable)
  * - Authenticated but `expiresAt` reached → failure with TOKEN_EXPIRED (retryable)
- * - Authenticated → sets `context.auth` and calls next()
+ * - Authenticated → sets `context.auth`, fills `context.actor` from the session user and calls next()
  *
  * Excluded commands, and the built-in auth commands, always run. They see
  * `context.auth` only when the adapter holds an unexpired session.

package/dist/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAI9D,OAAO,KAAK,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAEzE,OAAO,QAAQ,sBAAsB,CAAC;IACrC,UAAU,cAAc;QACvB;;;;;WAKG;QACH,IAAI,CAAC,EAAE,yBAAyB,CAAC;KACjC;CACD;AAED,MAAM,WAAW,qBAAqB;IACrC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,qBAA0B,GACjC,iBAAiB,CA6CnB"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAS,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAIrE,OAAO,KAAK,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAEzE,OAAO,QAAQ,sBAAsB,CAAC;IACrC,UAAU,cAAc;QACvB;;;;;WAKG;QACH,IAAI,CAAC,EAAE,yBAAyB,CAAC;KACjC;CACD;AAED,MAAM,WAAW,qBAAqB;IACrC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAgBD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,qBAA0B,GACjC,iBAAiB,CA8CnB"}

package/dist/middleware.js

@@ -4,13 +4,26 @@
 import { failure } from '@lushly-dev/afd-core';
 import { AUTH_COMMAND_NAMES } from './command-names.js';
 import { isSessionExpired } from './session-state.js';
+/**
+ * The actor for a call made with a verified session. A human (or unset) actor becomes the
+ * session user (`id`, and `label` from the user's name). An agent, service or script keeps
+ * its own identity and acts on behalf of the session user; a caller-supplied `onBehalfOf`
+ * is replaced, so it can never name someone other than the verified user.
+ */
+function actorForSession(actor, session) {
+    const { user } = session;
+    if (!actor || actor.kind === 'human') {
+        return { kind: 'human', id: user.id, ...(user.name ? { label: user.name } : {}) };
+    }
+    return { ...actor, onBehalfOf: user.id };
+}
 /**
  * Create middleware that gates commands behind authentication.
  *
  * - Unauthenticated → failure with UNAUTHORIZED
  * - Loading → failure with UNAUTHORIZED (retryable)
  * - Authenticated but `expiresAt` reached → failure with TOKEN_EXPIRED (retryable)
- * - Authenticated → sets `context.auth` and calls next()
+ * - Authenticated → sets `context.auth`, fills `context.actor` from the session user and calls next()
  *
  * Excluded commands, and the built-in auth commands, always run. They see
  * `context.auth` only when the adapter holds an unexpired session.
@@ -23,6 +36,7 @@ export function createAuthMiddleware(adapter, options = {}) {
         // Overwrite or remove whatever the caller put in the context.
         if (verified) {
             context.auth = verified;
+            context.actor = actorForSession(context.actor, verified);
         }
         else {
             delete context.auth;

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAwBtD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CACnC,OAAoB,EACpB,UAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAEtF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GACb,KAAK,CAAC,MAAM,KAAK,eAAe,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1F,8DAA8D;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC;QACzB,CAAC;aAAM,CAAC;YACP,OAAO,OAAO,CAAC,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,QAAQ,EAAE,CAAC;YAC3C,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC;gBACd,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,iCAAiC;gBAC1C,UAAU,EAAE,mDAAmD;gBAC/D,SAAS,EAAE,IAAI;aACf,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,OAAO,CAAC;gBACd,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,qBAAqB;gBAC9B,UAAU,EACT,gGAAgG;gBACjG,SAAS,EAAE,IAAI;aACf,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;YACd,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,yBAAyB;YAClC,UAAU,EAAE,kDAAkD;YAC9D,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC,CAAC;AACH,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAwBtD;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAwB,EAAE,OAAkC;IACpF,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACzB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CACnC,OAAoB,EACpB,UAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAEtF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GACb,KAAK,CAAC,MAAM,KAAK,eAAe,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1F,8DAA8D;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC;YACxB,OAAO,CAAC,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACP,OAAO,OAAO,CAAC,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,QAAQ,EAAE,CAAC;YAC3C,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC;gBACd,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,iCAAiC;gBAC1C,UAAU,EAAE,mDAAmD;gBAC/D,SAAS,EAAE,IAAI;aACf,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,OAAO,CAAC;gBACd,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,qBAAqB;gBAC9B,UAAU,EACT,gGAAgG;gBACjG,SAAS,EAAE,IAAI;aACf,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;YACd,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,yBAAyB;YAClC,UAAU,EAAE,kDAAkD;YAC9D,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lushly-dev/afd-auth",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "Provider-agnostic authentication adapter for AFD applications",
   "type": "module",
   "main": "./dist/index.js",
@@ -24,14 +24,14 @@
     "README.md"
   ],
   "dependencies": {
-    "@lushly-dev/afd-core": "2.1.0"
+    "@lushly-dev/afd-core": "2.2.0"
   },
   "peerDependencies": {
     "@convex-dev/auth": ">=0.0.95",
     "better-auth": "^1.6.22",
     "react": "^18.0.0 || ^19.0.0",
     "zod": "^4.0.0",
-    "@lushly-dev/afd-server": "^2.1.0"
+    "@lushly-dev/afd-server": "^2.2.0"
   },
   "peerDependenciesMeta": {
     "@lushly-dev/afd-server": {
@@ -52,20 +52,21 @@
   },
   "devDependencies": {
     "@auth/core": "^0.41.3",
-    "better-auth": "^1.6.22",
     "@testing-library/react": "^16.3.3",
     "@types/react": "^19.3.0",
+    "@types/react-dom": "19.3.0",
     "@vitest/coverage-v8": "^4.1.11",
+    "better-auth": "^1.6.22",
+    "convex": "1.32.0",
+    "esbuild": "0.28.2",
     "jsdom": "^30.1.0",
+    "playwright": "1.64.0",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11",
-    "zod": "^4.5.4",
-    "esbuild": "0.28.2",
-    "playwright": "1.64.0",
-    "@types/react-dom": "19.3.0",
-    "@lushly-dev/afd-server": "2.1.0"
+    "zod": "^4.6.6",
+    "@lushly-dev/afd-server": "2.2.0"
   },
   "keywords": [
     "afd",
@@ -99,6 +100,8 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "clean": "rm -rf dist",
-    "test:browser": "vitest run --config browser/vitest.config.ts"
+    "test:browser": "vitest run --config browser/vitest.config.ts",
+    "test:hosted:better-auth": "node hosted/better-auth/run.mjs --hosted",
+    "test:hosted:convex": "node hosted/convex/run.mjs --hosted"
   }
 }