@pylonsync/functions 0.10.0 → 0.11.0

package/dist/ssr-runtime.d.ts

@@ -59,6 +59,7 @@ export interface RenderRouteMessage {
         is_admin: boolean;
         tenant_id: string | null;
         roles: string[];
+        is_guest?: boolean;
     };
     /**
      * Whether the request carried a session cookie (presence, not identity) —

package/dist/types.d.ts

@@ -44,6 +44,17 @@ export interface AuthInfo<R extends AuthRequirement = "optional"> {
      *  not imply `member` or `admin`; compare explicitly or use
      *  `ctx.requireMember` for an authoritative membership lookup. */
     roles: string[];
+    /**
+     * True for an anonymous guest session. `userId` is set for these — a
+     * stable id, not an account — so `userId != null` alone does not mean
+     * the caller is signed in. `auth: "user"` and `auth: "admin"` handlers
+     * never see a guest; `auth: "public"` and `auth: "guest"` do.
+     *
+     * Check it wherever the answer depends on the caller having an account
+     * they can sign back into: entitlements, purchases, anything keyed to
+     * identity rather than to a device.
+     */
+    isGuest: boolean;
     /**
      * Promote the call's auth context after the handler has done its
      * own authentication check (HMAC signature verification on a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pylonsync/functions",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "TypeScript function runtime for pylon — defines server-side queries, mutations, and actions.",
   "type": "module",
   "main": "src/index.ts",

package/src/auth.test.ts

@@ -15,9 +15,31 @@ describe("function auth normalization", () => {
       isAdmin: false,
       tenantId: "org_1",
       roles: ["reviewer"],
+      isGuest: false,
     });
   });
 
+  test("a guest session is marked as one", () => {
+    // The guest id is a real string, so a handler checking only
+    // `userId != null` cannot tell it from an account without this flag.
+    expect(
+      normalizeAuthClaims({ user_id: "guest_a1b2", is_guest: true }),
+    ).toEqual({
+      userId: "guest_a1b2",
+      isAdmin: false,
+      tenantId: null,
+      roles: [],
+      isGuest: true,
+    });
+    expect(normalizeAuthClaims({ userId: "guest_a1b2", isGuest: true }).isGuest).toBe(
+      true,
+    );
+  });
+
+  test("a payload from before the field existed reads as not-a-guest", () => {
+    expect(normalizeAuthClaims({ user_id: "u1" }).isGuest).toBe(false);
+  });
+
   test("defaults missing roles to an empty array and drops non-strings", () => {
     expect(normalizeAuthClaims({}).roles).toEqual([]);
     expect(normalizeAuthClaims({ roles: ["billing", 42, null] }).roles).toEqual([

package/src/auth.ts

@@ -15,5 +15,6 @@ export function normalizeAuthClaims(
     roles: Array.isArray(raw.roles)
       ? raw.roles.filter((role): role is string => typeof role === "string")
       : [],
+    isGuest: Boolean(raw.isGuest ?? raw.is_guest),
   };
 }

package/src/ssr-runtime.ts

@@ -78,6 +78,7 @@ export interface RenderRouteMessage {
     is_admin: boolean;
     tenant_id: string | null;
     roles: string[];
+    is_guest?: boolean;
   };
   /**
    * Whether the request carried a session cookie (presence, not identity) —

package/src/types.ts

@@ -51,6 +51,17 @@ export interface AuthInfo<R extends AuthRequirement = "optional"> {
    *  not imply `member` or `admin`; compare explicitly or use
    *  `ctx.requireMember` for an authoritative membership lookup. */
   roles: string[];
+  /**
+   * True for an anonymous guest session. `userId` is set for these — a
+   * stable id, not an account — so `userId != null` alone does not mean
+   * the caller is signed in. `auth: "user"` and `auth: "admin"` handlers
+   * never see a guest; `auth: "public"` and `auth: "guest"` do.
+   *
+   * Check it wherever the answer depends on the caller having an account
+   * they can sign back into: entitlements, purchases, anything keyed to
+   * identity rather than to a device.
+   */
+  isGuest: boolean;
   /**
    * Promote the call's auth context after the handler has done its
    * own authentication check (HMAC signature verification on a