@passlock/node 0.9.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Passlock
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,65 @@
+<div align="center">
+  <a href="https://github.com/passlock-dev/passkeys-frontend">
+    <img src="https://github.com/passlock-dev/passkeys-frontend/assets/208345/53ee00d3-8e6c-49ea-b43c-3f901450c73b" alt="Passlock logo" width="80" height="80">
+  </a>
+</div>
+
+<a name="readme-top"></a>
+<h1 align="center">Serverless Passkeys</h1>
+
+  <p align="center">
+    Node SDK for passkey authentication
+    <br />
+    <a href="https://passlock.dev"><strong>Project website »</strong></a>
+    <br />
+    <a href="https://passlock.dev/#demo">Demo</a>
+    ·
+    <a href="https://docs.passlock.dev">Documentation</a>
+    ·
+    <a href="https://docs.passlock.dev/docs/tutorial/intro">Tutorial</a>
+  </p>
+</div>
+
+<br />
+
+## See also
+
+For frontend usage please see the accompanying [@passlock/client][client] package
+
+## Features
+
+Passkeys and the WebAuthn API are quite complex. We've taken an opinionated approach to the implementation and feature set to simplify things for you. Following the 80/20 principle we've tried to focus on the features most valuable to developers and users. We welcome feature requests so do [get in touch][contact].
+
+1. **🔐 Primary or secondary authentication** - Replace password based logins with passkeys, or use passkeys alongside passwords for secondary authentication.
+
+2. **☝🏻 Biometrics** - We've made it really easy to implement facial or fingerprint recognition in your webapps.
+
+3. **🔐 Step up authentication** - Require biometric or PIN verification for some actions e.g. changing account details, whilst allowing frictionless authentication for others.
+
+4. **🖥️ Full management console** - Manage all security related aspects of your userbase through a web based console.
+
+6. **🕵️ Audit trail** - View a full audit trail for each user: when they add a new passkey, when they login, verify their email address and much more.
+
+## Screenshot
+
+![Passlock user profile](https://github.com/passlock-dev/passkeys/assets/208345/a4a5c4b8-86cb-4076-bd26-7c29ed2151c6)
+<p align="center">Viewing a user's authentication activity on their profile page</p>
+
+## Usage
+
+Generate a secure token in your frontend then use this API to obtain the passkey registration or authentication details:
+
+```typescript
+import { Passlock } from '@passlock/node'
+
+const passlock = new Passlock({ tenancyId, apiKey })
+
+// token comes from your frontend
+const principal = await passlock.fetchPrincipal({ token })
+
+// get the user id
+console.log(principal.subject.id)
+```
+
+[contact]: https://passlock.dev/contact
+[client]: https://www.npmjs.com/package/@passlock/client

package/dist/config/config.d.ts

@@ -0,0 +1,10 @@
+import { Context } from "effect";
+declare const Config_base: Context.TagClass<Config, "Config", {
+    readonly tenancyId: string;
+    readonly apiKey: string;
+    readonly endpoint?: string;
+}>;
+export declare class Config extends Config_base {
+}
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/config/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;;wBAKT,MAAM;qBACT,MAAM;wBACH,MAAM;;AAL9B,qBAAa,MAAO,SAAQ,WAOzB;CAAG"}

package/dist/config/config.js

@@ -0,0 +1,4 @@
+import { Context } from "effect";
+export class Config extends Context.Tag("Config")() {
+}
+//# sourceMappingURL=config.js.map

package/dist/config/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEjC,MAAM,OAAO,MAAO,SAAQ,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAO9C;CAAG"}

package/dist/index.d.ts

@@ -0,0 +1,61 @@
+import { ErrorCode } from "@passlock/shared/dist/error/error.js";
+import { type PrincipalRequest } from "./principal/principal.js";
+export type { PrincipalRequest } from './principal/principal.js';
+export { ErrorCode } from '@passlock/shared/dist/error/error.js';
+export declare class PasslockError extends Error {
+    readonly _tag = "PasslockError";
+    readonly code: ErrorCode;
+    constructor(message: string, code: ErrorCode);
+    static readonly isError: (error: unknown) => error is PasslockError;
+}
+export declare class PasslockUnsafe {
+    private readonly runtime;
+    constructor(config: {
+        tenancyId: string;
+        apiKey: string;
+        endpoint?: string;
+    });
+    private readonly runPromise;
+    fetchPrincipal: (request: PrincipalRequest) => Promise<{
+        readonly token: string;
+        readonly subject: {
+            readonly id: string;
+            readonly firstName: string;
+            readonly lastName: string;
+            readonly email: string;
+            readonly emailVerified: boolean;
+        };
+        readonly authStatement: {
+            readonly authType: "email" | "passkey";
+            readonly userVerified: boolean;
+            readonly authTimestamp: Date;
+        };
+        readonly expireAt: Date;
+    }>;
+}
+export declare class Passlock {
+    private readonly runtime;
+    constructor(config: {
+        tenancyId: string;
+        apiKey: string;
+        endpoint?: string;
+    });
+    private readonly runPromise;
+    fetchPrincipal: (request: PrincipalRequest) => Promise<{
+        readonly token: string;
+        readonly subject: {
+            readonly id: string;
+            readonly firstName: string;
+            readonly lastName: string;
+            readonly email: string;
+            readonly emailVerified: boolean;
+        };
+        readonly authStatement: {
+            readonly authType: "email" | "passkey";
+            readonly userVerified: boolean;
+            readonly authTimestamp: Date;
+        };
+        readonly expireAt: Date;
+    } | PasslockError>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAyE,MAAM,sCAAsC,CAAC;AAExI,OAAO,EAA0C,KAAK,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGzG,YAAY,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAEhE,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AAEjE,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,mBAAkB;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;gBAEZ,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS;IAK5C,MAAM,CAAC,QAAQ,CAAC,OAAO,UAAW,OAAO,4BAOxC;CACF;AA4DD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;gBAE3C,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IAO5E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAQ1B;IAED,cAAc,YAAa,gBAAgB;;;;;;;;;;;;;;;OAKxC;CACJ;AAED,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;gBAE3C,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;IAO5E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAO1B;IAED,cAAc,YAAa,gBAAgB;;;;;;;;;;;;;;;uBAKxC;CACJ"}

package/dist/index.js

@@ -0,0 +1,80 @@
+import { ErrorCode, InternalServerError } from "@passlock/shared/dist/error/error.js";
+import { Effect as E, Layer as L, Runtime, Scope, pipe } from "effect";
+import { PrincipalService, PrincipalServiceLive } from "./principal/principal.js";
+import { Config } from "./config/config.js";
+export { ErrorCode } from '@passlock/shared/dist/error/error.js';
+export class PasslockError extends Error {
+    _tag = 'PasslockError';
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+    }
+    static isError = (error) => {
+        return (typeof error === 'object' &&
+            error !== null &&
+            '_tag' in error &&
+            error['_tag'] === 'PasslockError');
+    };
+}
+const hasMessage = (defect) => {
+    return (typeof defect === 'object' &&
+        defect !== null &&
+        'message' in defect &&
+        typeof defect['message'] === 'string');
+};
+const transformErrors = (effect) => {
+    const withErrorHandling = E.catchTags(effect, {
+        NotFound: e => E.succeed(new PasslockError(e.message, ErrorCode.NotFound)),
+        Unauthorized: e => E.succeed(new PasslockError(e.message, ErrorCode.Unauthorized)),
+        Forbidden: e => E.succeed(new PasslockError(e.message, ErrorCode.Forbidden)),
+        InternalServerError: e => E.succeed(new PasslockError(e.message, ErrorCode.InternalServerError)),
+    });
+    const sandboxed = E.sandbox(withErrorHandling);
+    const withSandboxing = E.catchTags(sandboxed, {
+        Die: ({ defect }) => {
+            return hasMessage(defect)
+                ? E.succeed(new PasslockError(defect.message, ErrorCode.InternalServerError))
+                : E.succeed(new PasslockError('Sorry, something went wrong', ErrorCode.InternalServerError));
+        },
+        Interrupt: () => {
+            return E.succeed(new PasslockError('Operation aborted', ErrorCode.InternalBrowserError));
+        },
+        Sequential: errors => {
+            console.error(errors);
+            return E.succeed(new PasslockError('Sorry, something went wrong', ErrorCode.InternalServerError));
+        },
+        Parallel: errors => {
+            console.error(errors);
+            return E.succeed(new PasslockError('Sorry, something went wrong', ErrorCode.InternalServerError));
+        },
+    });
+    return E.unsandbox(withSandboxing);
+};
+export class PasslockUnsafe {
+    runtime;
+    constructor(config) {
+        const rpcConfig = L.succeed(Config, Config.of(config));
+        const allLayers = pipe(PrincipalServiceLive, L.provide(rpcConfig));
+        const scope = E.runSync(Scope.make());
+        this.runtime = E.runSync(L.toRuntime(allLayers).pipe(Scope.extend(scope)));
+    }
+    runPromise = (effect) => {
+        return pipe(transformErrors(effect), E.flatMap(result => (PasslockError.isError(result) ? E.fail(result) : E.succeed(result))), effect => Runtime.runPromise(this.runtime)(effect));
+    };
+    fetchPrincipal = (request) => pipe(PrincipalService, E.flatMap(service => service.fetchPrincipal(request)), effect => this.runPromise(effect));
+}
+export class Passlock {
+    runtime;
+    constructor(config) {
+        const rpcConfig = L.succeed(Config, Config.of(config));
+        const allLayers = pipe(PrincipalServiceLive, L.provide(rpcConfig));
+        const scope = E.runSync(Scope.make());
+        this.runtime = E.runSync(L.toRuntime(allLayers).pipe(Scope.extend(scope)));
+    }
+    runPromise = (effect) => {
+        return pipe(transformErrors(effect), effect => Runtime.runPromise(this.runtime)(effect));
+    };
+    fetchPrincipal = (request) => pipe(PrincipalService, E.flatMap(service => service.fetchPrincipal(request)), effect => this.runPromise(effect));
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAoD,MAAM,sCAAsC,CAAC;AACxI,OAAO,EAAE,MAAM,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAyB,MAAM,0BAA0B,CAAC;AACzG,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AAEjE,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,IAAI,GAAG,eAAe,CAAA;IACtB,IAAI,CAAW;IAExB,YAAY,OAAe,EAAE,IAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;IAED,MAAM,CAAU,OAAO,GAAG,CAAC,KAAc,EAA0B,EAAE;QACnE,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,MAAM,CAAC,KAAK,eAAe,CAClC,CAAA;IACH,CAAC,CAAA;;AASH,MAAM,UAAU,GAAG,CAAC,MAAe,EAAiC,EAAE;IACpE,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,SAAS,IAAI,MAAM;QACnB,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CACtC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CACtB,MAAsC,EACC,EAAE;IACzC,MAAM,iBAAiB,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE;QAC5C,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC1E,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;QAClF,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAC5E,mBAAmB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC;KACjG,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAE9C,MAAM,cAAc,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE;QAC5C,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;YAClB,OAAO,UAAU,CAAC,MAAM,CAAC;gBACvB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC;gBAC7E,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,6BAA6B,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAA;QAChG,CAAC;QAED,SAAS,EAAE,GAAG,EAAE;YACd,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,mBAAmB,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC,CAAA;QAC1F,CAAC;QAED,UAAU,EAAE,MAAM,CAAC,EAAE;YACnB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACrB,OAAO,CAAC,CAAC,OAAO,CACd,IAAI,aAAa,CAAC,6BAA6B,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAChF,CAAA;QACH,CAAC;QAED,QAAQ,EAAE,MAAM,CAAC,EAAE;YACjB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACrB,OAAO,CAAC,CAAC,OAAO,CACd,IAAI,aAAa,CAAC,6BAA6B,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAChF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;AACpC,CAAC,CAAA;AAID,MAAM,OAAO,cAAc;IACR,OAAO,CAA+B;IAEvD,YAAY,MAAgE;QAC1E,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;QACtD,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;QAClE,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QACrC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5E,CAAC;IAEgB,UAAU,GAAG,CAC5B,MAAsC,EACtC,EAAE;QACF,OAAO,IAAI,CACT,eAAe,CAAC,MAAM,CAAC,EACvB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EACzF,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CACnD,CAAA;IACH,CAAC,CAAA;IAED,cAAc,GAAG,CAAC,OAAyB,EAAE,EAAE,CAC7C,IAAI,CACF,gBAAgB,EAChB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EACrD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAClC,CAAA;CACJ;AAED,MAAM,OAAO,QAAQ;IACF,OAAO,CAA+B;IAEvD,YAAY,MAAgE;QAC1E,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;QACtD,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;QAClE,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QACrC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5E,CAAC;IAEgB,UAAU,GAAG,CAC5B,MAAsC,EACtC,EAAE;QACF,OAAO,IAAI,CACT,eAAe,CAAC,MAAM,CAAC,EACvB,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CACnD,CAAA;IACH,CAAC,CAAA;IAED,cAAc,GAAG,CAAC,OAAyB,EAAE,EAAE,CAC7C,IAAI,CACF,gBAAgB,EAChB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EACrD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAClC,CAAA;CACJ"}

package/dist/principal/principal.d.ts

@@ -0,0 +1,15 @@
+import { Forbidden, InternalServerError, NotFound, Unauthorized } from '@passlock/shared/dist/error/error.js';
+import { Principal } from '@passlock/shared/dist/schema/schema.js';
+import { Context, Effect as E, Layer } from "effect";
+import { Config } from "../config/config.js";
+export type PrincipalErrors = NotFound | Unauthorized | Forbidden | InternalServerError;
+export type PrincipalRequest = {
+    token: string;
+};
+export type PrincipalService = {
+    fetchPrincipal: (request: PrincipalRequest) => E.Effect<Principal, PrincipalErrors>;
+};
+export declare const PrincipalService: Context.Tag<PrincipalService, PrincipalService>;
+export declare const fetchPrincipal: (request: PrincipalRequest) => E.Effect<Principal, PrincipalErrors, Config>;
+export declare const PrincipalServiceLive: Layer.Layer<PrincipalService, never, Config>;
+//# sourceMappingURL=principal.d.ts.map

package/dist/principal/principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.d.ts","sourceRoot":"","sources":["../../src/principal/principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAA;AAC7G,OAAO,EAAE,SAAS,EAAgB,MAAM,wCAAwC,CAAA;AAChF,OAAO,EAAkB,OAAO,EAAE,MAAM,IAAI,CAAC,EAAE,KAAK,EAA0C,MAAM,QAAQ,CAAA;AAE5G,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAI5C,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,mBAAmB,CAAA;AACvF,MAAM,MAAM,gBAAgB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEhD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,cAAc,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;CACpF,CAAA;AAED,eAAO,MAAM,gBAAgB,iDAA8D,CAAA;AAgD3F,eAAO,MAAM,cAAc,YAAa,gBAAgB,KAAG,EAAE,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,CA8BrG,CAAA;AAKD,eAAO,MAAM,oBAAoB,8CAQhC,CAAA"}

package/dist/principal/principal.js

@@ -0,0 +1,62 @@
+import { Forbidden, InternalServerError, NotFound, Unauthorized } from '@passlock/shared/dist/error/error.js';
+import { Principal, createParser } from '@passlock/shared/dist/schema/schema.js';
+import { Chunk, Console, Context, Effect as E, Layer, Option, Stream, StreamEmit, flow, pipe } from "effect";
+import * as https from "https";
+import { Config } from "../config/config.js";
+const parsePrincipal = createParser(Principal);
+export const PrincipalService = Context.GenericTag('@services/Principal');
+const buildOptions = (token) => pipe(Config, E.map(({ endpoint, tenancyId, apiKey }) => ({
+    hostname: endpoint || 'https://api.passlock.dev',
+    port: 443,
+    path: `/${tenancyId}/token/${token}`,
+    method: 'GET',
+    headers: {
+        'Accept': 'application/json',
+        'X-API-KEY': apiKey
+    }
+})));
+const buildError = (res) => {
+    if (res.statusCode === 404)
+        return new NotFound({ message: "Invalid token" });
+    if (res.statusCode === 401)
+        return new Unauthorized({ message: 'Unauthorized' });
+    if (res.statusCode === 403)
+        return new Forbidden({ message: 'Forbidden' });
+    if (res.statusCode && res.statusMessage)
+        return new InternalServerError({ message: `${res.statusCode} - ${res.statusMessage}` });
+    if (res.statusCode)
+        return new InternalServerError({ message: String(res.statusCode) });
+    if (res.statusMessage)
+        return new InternalServerError({ message: res.statusMessage });
+    return new InternalServerError({ message: 'Received non 200 response' });
+};
+const fail = (error) => E.fail(Option.some(error));
+const succeed = (data) => E.succeed(Chunk.of(data));
+const close = E.fail(Option.none());
+const buildStream = (token) => pipe(Stream.fromEffect(buildOptions(token)), Stream.flatMap(options => Stream.async((emit) => {
+    https.request(options, res => {
+        if (200 !== res.statusCode)
+            emit(fail(buildError(res)));
+        res.on('data', data => emit(succeed(data)));
+        res.on('close', () => emit(close));
+        res.on('error', (e) => emit(fail(new InternalServerError({ message: e.message }))));
+    }).end();
+})));
+export const fetchPrincipal = (request) => {
+    const stream = buildStream(request.token);
+    const json = pipe(Stream.runCollect(stream), E.map(Chunk.toReadonlyArray), E.map(Buffer.concat), E.flatMap(buffer => E.try({
+        try: () => buffer.toString(),
+        catch: (e) => new InternalServerError({ message: 'Unable to convert response to string', detail: String(e) })
+    })), E.flatMap(buffer => E.try({
+        try: () => JSON.parse(buffer),
+        catch: (e) => new InternalServerError({ message: 'Unable to parse response to json', detail: String(e) })
+    })), E.tap(json => Console.log(json)), E.flatMap(json => pipe(parsePrincipal(json), E.tapError(error => Console.error(error.detail)), E.mapError(() => new InternalServerError({ message: "Unable to parse response as Principal" })))));
+    return json;
+};
+export const PrincipalServiceLive = Layer.effect(PrincipalService, E.gen(function* (_) {
+    const context = yield* _(E.context());
+    return PrincipalService.of({
+        fetchPrincipal: flow(fetchPrincipal, E.provide(context)),
+    });
+}));
+//# sourceMappingURL=principal.js.map

package/dist/principal/principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["../../src/principal/principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAA;AAC7G,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AAChF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAA;AAC5G,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAE5C,MAAM,cAAc,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;AAS9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAmB,qBAAqB,CAAC,CAAA;AAE3F,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAC1C,MAAM,EACN,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1C,QAAQ,EAAE,QAAQ,IAAI,0BAA0B;IAChD,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,IAAI,SAAS,UAAU,KAAK,EAAE;IACpC,MAAM,EAAE,KAAK;IACb,OAAO,EAAE;QACP,QAAQ,EAAE,kBAAkB;QAC5B,WAAW,EAAE,MAAM;KACpB;CACF,CAAC,CAAC,CACJ,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,GAA4E,EAAE,EAAE;IAClG,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAA;IAC7E,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAA;IAChF,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;IAE1E,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,IAAI,mBAAmB,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,UAAU,MAAM,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;IAChI,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,IAAI,mBAAmB,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IACvF,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,IAAI,mBAAmB,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAA;IAErF,OAAO,IAAI,mBAAmB,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAC,CAAC,CAAA;AACzE,CAAC,CAAA;AAED,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AACnE,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;AAC3D,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;AAEnC,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CACzC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EACtC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CACvB,MAAM,CAAC,KAAK,CAAC,CAAC,IAA2D,EAAE,EAAE;IAC3E,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QAC3B,IAAI,GAAG,KAAK,GAAG,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACvD,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC3C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QAClC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CACzB,IAAI,CAAC,IAAI,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CACtD,CAAC,CAAA;IACJ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;AACV,CAAC,CAAC,CACH,CACF,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAyB,EAAgD,EAAE;IACxG,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAEzC,MAAM,IAAI,GAAG,IAAI,CACf,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EACzB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAC5B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EACpB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CACjB,CAAC,CAAC,GAAG,CAAC;QACJ,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE;QAC5B,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9G,CAAC,CACH,EACD,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CACjB,CAAC,CAAC,GAAG,CAAC;QACJ,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1G,CAAC,CACH,EACD,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAChC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CACf,IAAI,CACF,cAAc,CAAC,IAAI,CAAC,EACpB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAChD,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC,CAChG,CACF,CACF,CAAA;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAKD,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,CAC9C,gBAAgB,EAChB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;IAChB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAU,CAAC,CAAA;IAC7C,OAAO,gBAAgB,CAAC,EAAE,CAAC;QACzB,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;KACzD,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA"}

package/package.json

@@ -0,0 +1,71 @@
+{
+  "name": "@passlock/node",
+  "type": "module",
+  "version": "0.9.2",
+  "description": "Server side passkey library for node/express",
+  "keywords": [
+    "passkey",
+    "passkeys",
+    "webauthn",
+    "node",
+    "express"
+  ],
+  "author": {
+    "name": "Toby Hobson",
+    "email": "toby@passlock.dev"
+  },
+  "license": "MIT",
+  "homepage": "https://passlock.dev",
+  "repository": "github.com/passlock-dev/node",
+  "bugs": {
+    "url": "https://github.com/passlock-dev/node/issues",
+    "email": "team@passlock.dev"
+  },
+  "dependencies": {
+    "effect": "2.4.9",
+    "@passlock/shared": "^0.9.2"
+  },
+  "devDependencies": {
+    "@tsconfig/node16": "^16.1.1",
+    "@types/node": "^20.11.30",
+    "@typescript-eslint/eslint-plugin": "^7.3.1",
+    "@typescript-eslint/parser": "^7.3.1",
+    "@vitest/coverage-v8": "^1.4.0",
+    "@vitest/ui": "^1.4.0",
+    "eslint": "^8.57.0",
+    "eslint-config-prettier": "^9.1.0",
+    "eslint-import-resolver-typescript": "^3.6.1",
+    "eslint-plugin-import": "^2.29.1",
+    "prettier": "^3.2.5",
+    "rimraf": "^5.0.5",
+    "tsx": "^4.7.1",
+    "typescript": "^5.4.2",
+    "vite": "^5.2.2",
+    "vitest": "^1.4.0",
+    "vitest-mock-extended": "^1.3.1"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "src",
+    "dist"
+  ],
+  "scripts": {
+    "clean": "tsc --build --clean",
+    "build": "tsc --build",
+    "test": "vitest run",
+    "test:watch": "vitest dev",
+    "test:ui": "vitest --coverage.enabled=true --ui",
+    "test:coverage": "vitest run --coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint --ext .ts src",
+    "lint:fix": "pnpm run lint --fix",
+    "format": "prettier --write \"src/**/*.+(js|ts|json)\"",
+    "ncu": "ncu -x @passlock/shared",
+    "ncu:save": "ncu -u -x @passlock/shared"
+  }
+}

package/src/config/config.ts

@@ -0,0 +1,10 @@
+import { Context } from "effect";
+
+export class Config extends Context.Tag("Config")<
+  Config,
+  { 
+    readonly tenancyId: string, 
+    readonly apiKey: string, 
+    readonly endpoint?: string 
+  }
+>() {}

package/src/index.ts

@@ -0,0 +1,140 @@
+import { ErrorCode, InternalServerError, type Forbidden, type NotFound, type Unauthorized } from "@passlock/shared/dist/error/error.js";
+import { Effect as E, Layer as L, Runtime, Scope, pipe } from "effect";
+import { PrincipalService, PrincipalServiceLive, type PrincipalRequest } from "./principal/principal.js";
+import { Config } from "./config/config.js";
+
+export type { PrincipalRequest } from './principal/principal.js'
+
+export { ErrorCode } from '@passlock/shared/dist/error/error.js';
+
+export class PasslockError extends Error {
+  readonly _tag = 'PasslockError'
+  readonly code: ErrorCode
+
+  constructor(message: string, code: ErrorCode) {
+    super(message)
+    this.code = code
+  }
+
+  static readonly isError = (error: unknown): error is PasslockError => {
+    return (
+      typeof error === 'object' &&
+      error !== null &&
+      '_tag' in error &&
+      error['_tag'] === 'PasslockError'
+    )
+  }
+}
+
+type PasslockErrors =
+  | NotFound
+  | Unauthorized
+  | Forbidden
+  | InternalServerError
+
+const hasMessage = (defect: unknown): defect is { message: string } => {
+  return (
+    typeof defect === 'object' &&
+    defect !== null &&
+    'message' in defect &&
+    typeof defect['message'] === 'string'
+  )
+}
+
+const transformErrors = <A, R>(
+  effect: E.Effect<A, PasslockErrors, R>,
+): E.Effect<A | PasslockError, never, R> => {
+  const withErrorHandling = E.catchTags(effect, {
+    NotFound: e => E.succeed(new PasslockError(e.message, ErrorCode.NotFound)),
+    Unauthorized: e => E.succeed(new PasslockError(e.message, ErrorCode.Unauthorized)),
+    Forbidden: e => E.succeed(new PasslockError(e.message, ErrorCode.Forbidden)),
+    InternalServerError: e => E.succeed(new PasslockError(e.message, ErrorCode.InternalServerError)),
+  })
+
+  const sandboxed = E.sandbox(withErrorHandling)
+
+  const withSandboxing = E.catchTags(sandboxed, {
+    Die: ({ defect }) => {
+      return hasMessage(defect)
+        ? E.succeed(new PasslockError(defect.message, ErrorCode.InternalServerError))
+        : E.succeed(new PasslockError('Sorry, something went wrong', ErrorCode.InternalServerError))
+    },
+
+    Interrupt: () => {
+      return E.succeed(new PasslockError('Operation aborted', ErrorCode.InternalBrowserError))
+    },
+
+    Sequential: errors => {
+      console.error(errors)
+      return E.succeed(
+        new PasslockError('Sorry, something went wrong', ErrorCode.InternalServerError),
+      )
+    },
+
+    Parallel: errors => {
+      console.error(errors)
+      return E.succeed(
+        new PasslockError('Sorry, something went wrong', ErrorCode.InternalServerError),
+      )
+    },
+  })
+
+  return E.unsandbox(withSandboxing)
+}
+
+type Requirements = PrincipalService
+
+export class PasslockUnsafe {
+  private readonly runtime: Runtime.Runtime<Requirements>
+
+  constructor(config: { tenancyId: string; apiKey: string; endpoint?: string }) {
+    const rpcConfig = L.succeed(Config, Config.of(config))
+    const allLayers = pipe(PrincipalServiceLive, L.provide(rpcConfig))
+    const scope = E.runSync(Scope.make())
+    this.runtime = E.runSync(L.toRuntime(allLayers).pipe(Scope.extend(scope)))
+  }
+
+  private readonly runPromise = <A, R extends Requirements>(
+    effect: E.Effect<A, PasslockErrors, R>,
+  ) => {
+    return pipe(
+      transformErrors(effect),
+      E.flatMap(result => (PasslockError.isError(result) ? E.fail(result) : E.succeed(result))),
+      effect => Runtime.runPromise(this.runtime)(effect),
+    )
+  }
+
+  fetchPrincipal = (request: PrincipalRequest) =>
+    pipe(
+      PrincipalService,
+      E.flatMap(service => service.fetchPrincipal(request)),
+      effect => this.runPromise(effect),
+    )
+}
+
+export class Passlock {
+  private readonly runtime: Runtime.Runtime<Requirements>
+
+  constructor(config: { tenancyId: string; apiKey: string; endpoint?: string }) {
+    const rpcConfig = L.succeed(Config, Config.of(config))
+    const allLayers = pipe(PrincipalServiceLive, L.provide(rpcConfig))
+    const scope = E.runSync(Scope.make())
+    this.runtime = E.runSync(L.toRuntime(allLayers).pipe(Scope.extend(scope)))
+  }
+
+  private readonly runPromise = <A, R extends Requirements>(
+    effect: E.Effect<A, PasslockErrors, R>,
+  ) => {
+    return pipe(
+      transformErrors(effect), 
+      effect => Runtime.runPromise(this.runtime)(effect)
+    )
+  }
+
+  fetchPrincipal = (request: PrincipalRequest) =>
+    pipe(
+      PrincipalService,
+      E.flatMap(service => service.fetchPrincipal(request)),
+      effect => this.runPromise(effect),
+    )
+}

package/src/principal/principal.ts

@@ -0,0 +1,108 @@
+import { Forbidden, InternalServerError, NotFound, Unauthorized } from '@passlock/shared/dist/error/error.js'
+import { Principal, createParser } from '@passlock/shared/dist/schema/schema.js'
+import { Chunk, Console, Context, Effect as E, Layer, Option, Stream, StreamEmit, flow, pipe } from "effect"
+import * as https from "https"
+import { Config } from "../config/config.js"
+
+const parsePrincipal = createParser(Principal)
+
+export type PrincipalErrors = NotFound | Unauthorized | Forbidden | InternalServerError
+export type PrincipalRequest = { token: string }
+
+export type PrincipalService = {
+  fetchPrincipal: (request: PrincipalRequest) => E.Effect<Principal, PrincipalErrors>
+}
+
+export const PrincipalService = Context.GenericTag<PrincipalService>('@services/Principal')
+
+const buildOptions = (token: string) => pipe(
+  Config, 
+  E.map(({ endpoint, tenancyId, apiKey }) => ({
+    hostname: endpoint || 'https://api.passlock.dev',
+    port: 443,
+    path: `/${tenancyId}/token/${token}`,
+    method: 'GET',
+    headers: {
+      'Accept': 'application/json',
+      'X-API-KEY': apiKey
+    }
+  }))
+)
+
+const buildError = (res: { statusCode?: number | undefined, statusMessage?: string | undefined }) => {
+  if (res.statusCode === 404) return new NotFound({ message: "Invalid token" })
+  if (res.statusCode === 401) return new Unauthorized({ message: 'Unauthorized' })
+  if (res.statusCode === 403) return new Forbidden({ message: 'Forbidden' })
+
+  if (res.statusCode && res.statusMessage) return new InternalServerError({ message: `${res.statusCode} - ${res.statusMessage}` })
+  if (res.statusCode) return new InternalServerError({ message: String(res.statusCode) })
+  if (res.statusMessage) return new InternalServerError({ message: res.statusMessage })
+
+  return new InternalServerError({ message: 'Received non 200 response'})
+}
+
+const fail = (error: PrincipalErrors) => E.fail(Option.some(error))
+const succeed = (data: Buffer) => E.succeed(Chunk.of(data))
+const close = E.fail(Option.none())
+
+const buildStream = (token: string) => pipe(
+  Stream.fromEffect(buildOptions(token)),
+  Stream.flatMap(options => 
+    Stream.async((emit: StreamEmit.Emit<never, PrincipalErrors, Buffer, void>) => {
+      https.request(options, res => {
+        if (200 !== res.statusCode) emit(fail(buildError(res)))
+        res.on('data', data => emit(succeed(data)))
+        res.on('close', () => emit(close))
+        res.on('error', (e) => emit(
+          fail(new InternalServerError({ message: e.message }))
+        ))
+      }).end()
+    })
+  )
+)
+
+export const fetchPrincipal = (request: PrincipalRequest): E.Effect<Principal, PrincipalErrors, Config> => {
+  const stream = buildStream(request.token)
+
+  const json = pipe(
+    Stream.runCollect(stream), 
+    E.map(Chunk.toReadonlyArray),
+    E.map(Buffer.concat),
+    E.flatMap(buffer => 
+      E.try({
+        try: () => buffer.toString(),
+        catch: (e) => new InternalServerError({ message: 'Unable to convert response to string', detail: String(e) })
+      })
+    ),
+    E.flatMap(buffer => 
+      E.try({
+        try: () => JSON.parse(buffer),
+        catch: (e) => new InternalServerError({ message: 'Unable to parse response to json', detail: String(e) })
+      })
+    ),
+    E.tap(json => Console.log(json)),
+    E.flatMap(json => 
+      pipe(
+        parsePrincipal(json), 
+        E.tapError(error => Console.error(error.detail)),
+        E.mapError(() => new InternalServerError({ message: "Unable to parse response as Principal" }))
+      )
+    )
+  )
+      
+  return json
+}
+
+/* Live */
+
+/* v8 ignore start */
+export const PrincipalServiceLive = Layer.effect(
+  PrincipalService,
+  E.gen(function* (_) {
+    const context = yield* _(E.context<Config>())
+    return PrincipalService.of({
+      fetchPrincipal: flow(fetchPrincipal, E.provide(context)),
+    })
+  }),
+)
+/* v8 ignore stop */