@nxgt/janus-graphql 0.1.1 → 0.3.0

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACN,oBAAoB,EACpB,KAAK,sBAAsB,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,KAAK,UAAU,EACf,MAAM,EACN,iBAAiB,EACjB,cAAc,EACd,KAAK,SAAS,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,GAAG,EAAE,KAAK,kBAAkB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,YAAY,EACX,IAAI,EACJ,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,UAAU,GACV,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,YAAY,EACX,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,oBAAoB,EACpB,KAAK,sBAAsB,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,KAAK,UAAU,EACf,MAAM,EACN,iBAAiB,EACjB,cAAc,EACd,KAAK,SAAS,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,KAAK,kBAAkB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,YAAY,EACX,IAAI,EACJ,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,UAAU,GACV,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC"}

package/dist/index.js

@@ -1,6 +1,7 @@
-// src/directives/apply.ts
-import { MapperKind, mapSchema } from "@graphql-tools/utils";
-import { defaultFieldResolver } from "graphql";
+// src/context.ts
+import {
+  systemClock
+} from "@nxgt/janus";
 
 // src/memo.ts
 var NOTATION = /[@#]/;
@@ -32,14 +33,15 @@ function memoized(access) {
 
 // src/context.ts
 var checks = new WeakMap;
+var clocks = new WeakMap;
 function createJanusContext(request, options) {
-  const { auth, access, type } = options;
+  const { auth, access, type, clock, caller = "useJanus()" } = options;
   let answer;
   let asked = false;
   const authenticated = () => {
     if (!asked) {
       asked = true;
-      answer = request === undefined ? Promise.reject(new TypeError("useJanus(): the GraphQL context has no request to authenticate — build the context from an HTTP request")) : auth.authenticate(request, type === undefined ? undefined : { type });
+      answer = request === undefined ? Promise.reject(new TypeError(`${caller}: the GraphQL context has no request to authenticate — build the context from an HTTP request, or accept a graphql-ws connection with janusConnection().onConnect`)) : auth.authenticate(request, type === undefined ? undefined : { type });
     }
     return answer;
   };
@@ -55,8 +57,13 @@ function createJanusContext(request, options) {
       fresh: (...args) => can.apply(access, args)
     });
   }
+  if (clock !== undefined)
+    clocks.set(janus, clock);
   return janus;
 }
+function clockOf(janus) {
+  return clocks.get(janus) ?? systemClock;
+}
 function checkOf(janus, fresh = false) {
   const built = checks.get(janus);
   if (built !== undefined)
@@ -72,6 +79,83 @@ function janusOf(ctx, caller) {
   return janus;
 }
 
+// src/options.ts
+function checkWiring(caller, { auth, access, clock }) {
+  if (typeof auth?.authenticate !== "function") {
+    throw new TypeError(`${caller}: auth is not what janus() answered — pass { auth }`);
+  }
+  if (access !== undefined && typeof access?.can !== "function") {
+    throw new TypeError(`${caller}: access is not what permissions() answered — pass { auth, access }`);
+  }
+  if (clock !== undefined && typeof clock?.now !== "function") {
+    throw new TypeError(`${caller}: clock is not a Clock — pass the clock given to janus(), or leave it out for the system clock`);
+  }
+}
+
+// src/connection/credential.ts
+var BEARER = /^\s*bearer(?:\s|$)/i;
+function credentialOf(ctx, upgrade) {
+  const params = ctx.connectionParams;
+  if (params !== undefined && Object.hasOwn(params, "authorization")) {
+    const { authorization } = params;
+    if (typeof authorization !== "string")
+      return null;
+    if (BEARER.test(authorization))
+      return { authorization };
+  }
+  const request = upgrade === undefined ? ctx.extra?.request : upgrade(ctx);
+  return request ?? null;
+}
+var accepted = new WeakMap;
+function accept(ctx, credential) {
+  const { extra } = ctx;
+  if (typeof extra !== "object" || extra === null) {
+    throw new TypeError("janusConnection(): the connection's extra is not an object — pass the context graphql-ws gave onConnect");
+  }
+  accepted.set(extra, credential);
+}
+function acceptedOf(context) {
+  const extra = context?.extra;
+  if (typeof extra !== "object" || extra === null)
+    return;
+  return accepted.get(extra);
+}
+
+// src/connection/connection.ts
+function janusConnection(options) {
+  const { auth, access, type, clock } = options;
+  checkWiring("janusConnection()", { auth, access, clock });
+  if (options.upgrade !== undefined && typeof options.upgrade !== "function") {
+    throw new TypeError("janusConnection(): upgrade is not a function — pass (ctx) => the upgrade request, or leave it out to read ctx.extra.request");
+  }
+  const upgrade = options.upgrade?.bind(options);
+  const wiring = {
+    auth,
+    access,
+    type,
+    clock,
+    caller: "janusConnection().context"
+  };
+  return {
+    onConnect: async (ctx) => {
+      const credential = credentialOf(ctx, upgrade);
+      if (credential === null)
+        return false;
+      const current = await auth.authenticate(credential, type === undefined ? undefined : { type });
+      if (current === null)
+        return false;
+      accept(ctx, credential);
+      return true;
+    },
+    context: (ctx) => ({
+      janus: createJanusContext(acceptedOf(ctx), wiring)
+    })
+  };
+}
+// src/directives/apply.ts
+import { MapperKind, mapSchema } from "@graphql-tools/utils";
+import { defaultFieldResolver } from "graphql";
+
 // src/errors.ts
 import { JanusError, statusOf } from "@nxgt/janus";
 import { GraphQLError } from "graphql";
@@ -165,6 +249,30 @@ function masked(error, message) {
   });
 }
 
+// src/fresh.ts
+import {
+  assertFresh,
+  parseDuration
+} from "@nxgt/janus";
+async function freshSession(janus, maxAgeMs) {
+  const session = await janus.session().then(undefined, rethrown);
+  if (session === null)
+    throw denial("UNAUTHENTICATED");
+  try {
+    assertFresh(session, maxAgeMs, clockOf(janus));
+  } catch (error) {
+    rethrown(error);
+  }
+  return session;
+}
+async function requireFresh(ctx, maxAge) {
+  if (typeof maxAge !== "string") {
+    throw new TypeError("requireFresh(): maxAge is a duration with its unit, such as '10m' — a bare number would be milliseconds, where @fresh reads seconds");
+  }
+  const maxAgeMs = parseDuration(maxAge, "requireFresh(): maxAge");
+  return freshSession(janusOf(ctx, "requireFresh()"), maxAgeMs);
+}
+
 // src/directives/permission/path.ts
 var NAME = /^[_A-Za-z][_0-9A-Za-z]*$/;
 function parsePath(text) {
@@ -278,6 +386,9 @@ async function enforce(requirement, { parent, args, ctx, fresh }) {
   if (requirement.types !== null && !requirement.types.has(user.type)) {
     throw denial("FORBIDDEN");
   }
+  if (requirement.maxAgeMs !== null) {
+    await freshSession(janus, requirement.maxAgeMs);
+  }
   const [first] = requirement.permissions;
   if (first === undefined)
     return;
@@ -326,12 +437,16 @@ function locations(schema, field, fieldName, typeName) {
 }
 function readField(schema, field, fieldName, typeName) {
   const authenticated = [];
+  const fresh = [];
   const permission = [];
   for (const { where, onType, node } of locations(schema, field, fieldName, typeName)) {
     for (const args of getDirective(schema, node, "authenticated") ?? []) {
       const types = args.type;
       authenticated.push({ where, types: types ?? null });
     }
+    for (const args of getDirective(schema, node, "fresh") ?? []) {
+      fresh.push({ where, maxAge: args.maxAge });
+    }
     for (const args of getDirective(schema, node, "permission") ?? []) {
       permission.push({
         where,
@@ -343,7 +458,7 @@ function readField(schema, field, fieldName, typeName) {
       });
     }
   }
-  return { authenticated, permission };
+  return { authenticated, fresh, permission };
 }
 
 // src/directives/words.ts
@@ -473,15 +588,15 @@ function conditionOf(model, use, wiring, refuse) {
 
 // src/directives/validate.ts
 function requirementOf(field, directives, known, wiring) {
-  const { authenticated, permission } = directives;
-  if (authenticated.length === 0 && permission.length === 0)
+  const { authenticated, fresh, permission } = directives;
+  const [name, first] = firstOf(directives);
+  if (first === undefined)
     return null;
-  const [first] = authenticated.length > 0 ? authenticated : permission;
-  const name = authenticated.length > 0 ? "@authenticated" : "@permission";
   return {
     where: field.name,
-    label: `${name} on ${on(first?.where ?? field.name, field.name)}`,
+    label: `${name} on ${on(first.where, field.name)}`,
     types: typesOf(field.name, authenticated, known),
+    maxAgeMs: maxAgeOf(field.name, fresh),
     permissions: permission.map((use) => permissionCheckOf(use, field, wiring))
   };
 }
@@ -505,6 +620,27 @@ function typesOf(field, uses, known) {
   }
   return types;
 }
+function firstOf({
+  authenticated,
+  fresh,
+  permission
+}) {
+  if (authenticated.length > 0)
+    return ["@authenticated", authenticated[0]];
+  if (fresh.length > 0)
+    return ["@fresh", fresh[0]];
+  return ["@permission", permission[0]];
+}
+function maxAgeOf(field, uses) {
+  let seconds = null;
+  for (const { where, maxAge } of uses) {
+    if (!Number.isSafeInteger(maxAge) || maxAge <= 0) {
+      throw new TypeError(`${PREFIX}: @fresh on ${on(where, field)} asks maxAge: ${maxAge} — write a number of seconds above zero, such as maxAge: 600 for ten minutes`);
+    }
+    seconds = seconds === null ? maxAge : Math.min(seconds, maxAge);
+  }
+  return seconds === null ? null : seconds * 1000;
+}
 
 // src/directives/apply.ts
 function applyJanusDirectives(schema, options) {
@@ -517,10 +653,15 @@ function applyJanusDirectives(schema, options) {
       }, readField(schema, field, fieldName, typeName), known, options);
       if (requirement === null)
         return field;
+      const resolve = field.resolve ?? defaultFieldResolver;
+      if (field.subscribe === undefined) {
+        return { ...field, resolve: guarded(resolve, requirement) };
+      }
+      const onEvent = { ...requirement, maxAgeMs: null };
       return {
         ...field,
-        resolve: guarded(field.resolve ?? defaultFieldResolver, requirement),
-        ...field.subscribe === undefined ? {} : { subscribe: guarded(field.subscribe, requirement) }
+        subscribe: guarded(field.subscribe, requirement),
+        resolve: guarded(resolve, onEvent)
       };
     }
   });
@@ -559,21 +700,17 @@ async function can(ctx, permission, object, ...options) {
 }
 // src/plugin.ts
 function useJanus(options) {
-  const { auth, access, type, loaders, conditions } = options;
-  if (typeof auth?.authenticate !== "function") {
-    throw new TypeError("useJanus(): auth is not what janus() answered — pass { auth }");
-  }
-  if (access !== undefined && typeof access?.can !== "function") {
-    throw new TypeError("useJanus(): access is not what permissions() answered — pass { auth, access }");
-  }
+  const { auth, access, type, clock, loaders, conditions } = options;
+  checkWiring("useJanus()", { auth, access, clock });
   const applied = new WeakSet;
   return {
     onContextBuilding: ({ context, extendContext }) => {
       const { request } = context;
-      const janus = createJanusContext(request, {
+      const janus = createJanusContext(request ?? acceptedOf(context), {
         auth,
         access,
-        type
+        type,
+        clock
       });
       extendContext({ janus });
     },
@@ -602,6 +739,14 @@ directive @authenticated(
 	type: [String!]
 ) on OBJECT | INTERFACE | FIELD_DEFINITION
 
+"""
+Only a session that proved who it is less than \`maxAge\` seconds ago reaches
+this field, or every field of this type or interface: signed in, or confirmed
+since by a step-up. Anonymous is answered UNAUTHENTICATED, an older session
+STEP_UP_REQUIRED. Where several apply, the smallest \`maxAge\` holds.
+"""
+directive @fresh(maxAge: Int!) on OBJECT | INTERFACE | FIELD_DEFINITION
+
 """
 What a denied \`@permission\` answers.
 """
@@ -634,12 +779,14 @@ export {
   applyJanusDirectives,
   can,
   denial,
+  janusConnection,
   janusGraphQLError,
   janusMaskError,
   janusTypeDefs,
+  requireFresh,
   requireUser,
   useJanus
 };
 
-//# debugId=D0DEC0D35AFB92A464756E2164756E21
+//# debugId=C6BF0BFA8BF13A9C64756E2164756E21
 //# sourceMappingURL=index.js.map