@raybase/emdash 0.0.0 → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Itself & Co
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/auth.d.ts

@@ -0,0 +1,3 @@
+import type { AuthResult } from "emdash";
+export declare function authenticate(request: Request, config: unknown): Promise<AuthResult>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAKzC,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAwBzF"}

package/dist/auth.js

@@ -0,0 +1,31 @@
+import { verifyHandoff } from "@raybase/core/handoff-consumer";
+import { resolveRaybaseEmDashRole } from "./roles.js";
+export async function authenticate(request, config) {
+    const authConfig = config;
+    const principal = await verifyHandoff(request, authConfig);
+    if (!principal)
+        throw new Error("No Raybase handoff token present");
+    // A pass shows someone a thing; it never makes them an editor of it. Only an
+    // SSO handoff for a verified person carries the app roles the CMS grades by,
+    // so anything else — a link pass, a machine pass, a roleless identity — is
+    // refused here rather than mapped onto a default level.
+    if (principal.kind !== "identity")
+        throw new Error("Raybase handoff principal is not an identity");
+    if (!principal.roles?.length)
+        throw new Error("Raybase handoff principal carries no app roles");
+    const email = principal.email || `${principal.sub}@raybase.local`;
+    return {
+        email,
+        name: principal.name || email.split("@")[0] || "Raybase user",
+        role: resolveRaybaseEmDashRole(principal, authConfig),
+        subject: principal.sub,
+        metadata: {
+            appId: principal.appId,
+            resource: principal.resource,
+            issuer: principal.issuer,
+            roles: principal.roles,
+            jti: principal.jti
+        }
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAgB,EAAE,MAAe;IAClE,MAAM,UAAU,GAAG,MAAiC,CAAC;IACrD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACpE,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,wDAAwD;IACxD,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACnG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,IAAI,GAAG,SAAS,CAAC,GAAG,gBAAgB,CAAC;IAClE,OAAO;QACL,KAAK;QACL,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,cAAc;QAC7D,IAAI,EAAE,wBAAwB,CAAC,SAAS,EAAE,UAAU,CAAC;QACrD,OAAO,EAAE,SAAS,CAAC,GAAG;QACtB,QAAQ,EAAE;YACR,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,GAAG,EAAE,SAAS,CAAC,GAAG;SACnB;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+import type { AuthDescriptor } from "emdash";
+import type { RaybaseHandoffConsumerConfig } from "@raybase/core/handoff-consumer";
+import type { RaybaseEmDashRoleConfig } from "./roles.js";
+export type { RaybaseEmDashRoleConfig, RaybaseEmDashRoleName } from "./roles.js";
+export { resolveRaybaseEmDashRole } from "./roles.js";
+/**
+ * The CMS is an SSO resource: an editor signs into a thing they belong to, so
+ * the handoff consumer config carries the role mapping the CMS grades them by.
+ */
+export type RaybaseEmDashAuthConfig = RaybaseHandoffConsumerConfig & RaybaseEmDashRoleConfig;
+export declare function raybaseAuth(config: RaybaseEmDashAuthConfig): AuthDescriptor;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,YAAY,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtD;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG,4BAA4B,GAAG,uBAAuB,CAAC;AAE7F,wBAAgB,WAAW,CAAC,MAAM,EAAE,uBAAuB,GAAG,cAAc,CAM3E"}

package/dist/index.js

@@ -0,0 +1,9 @@
+export { resolveRaybaseEmDashRole } from "./roles.js";
+export function raybaseAuth(config) {
+    return {
+        type: "raybase",
+        entrypoint: "@raybase/emdash/auth",
+        config
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAQtD,MAAM,UAAU,WAAW,CAAC,MAA+B;IACzD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,sBAAsB;QAClC,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/roles.d.ts

@@ -0,0 +1,12 @@
+import type { RaybaseHandoffPrincipal } from "@raybase/core/handoff-consumer";
+export type RaybaseEmDashRoleName = "subscriber" | "contributor" | "author" | "editor" | "admin";
+export type RaybaseEmDashRoleConfig = {
+    roleMapping?: Record<string, number | RaybaseEmDashRoleName>;
+    defaultRole?: number | RaybaseEmDashRoleName;
+};
+/**
+ * Map an SSO handoff principal's app roles onto an EmDash level. A person with
+ * several mapped roles gets the highest one they hold.
+ */
+export declare function resolveRaybaseEmDashRole(principal: RaybaseHandoffPrincipal, config: RaybaseEmDashRoleConfig): number;
+//# sourceMappingURL=roles.d.ts.map

package/dist/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../src/roles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAE9E,MAAM,MAAM,qBAAqB,GAAG,YAAY,GAAG,aAAa,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEjG,MAAM,MAAM,uBAAuB,GAAG;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAAC,CAAC;IAC7D,WAAW,CAAC,EAAE,MAAM,GAAG,qBAAqB,CAAC;CAC9C,CAAC;AAoBF;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,uBAAuB,EAAE,MAAM,EAAE,uBAAuB,GAAG,MAAM,CAWpH"}

package/dist/roles.js

@@ -0,0 +1,37 @@
+// EmDash grades its users by level, not by name; these are the levels the CMS
+// itself ships. Apps map Raybase app roles onto them in `roleMapping`.
+const roleLevels = {
+    subscriber: 10,
+    contributor: 20,
+    author: 30,
+    editor: 40,
+    admin: 50
+};
+const validRoleLevels = new Set(Object.values(roleLevels));
+function roleLevel(value) {
+    if (typeof value === "string")
+        return roleLevels[value] ?? null;
+    if (typeof value === "number" && validRoleLevels.has(value))
+        return value;
+    return null;
+}
+/**
+ * Map an SSO handoff principal's app roles onto an EmDash level. A person with
+ * several mapped roles gets the highest one they hold.
+ */
+export function resolveRaybaseEmDashRole(principal, config) {
+    const mapping = config.roleMapping ?? {};
+    let role = null;
+    for (const claim of principal.roles ?? []) {
+        const mapped = roleLevel(mapping[claim]);
+        if (mapped)
+            role = role ? Math.max(role, mapped) : mapped;
+    }
+    if (role)
+        return role;
+    const fallback = roleLevel(config.defaultRole);
+    if (fallback)
+        return fallback;
+    throw new Error("Raybase handoff principal does not map to an EmDash role");
+}
+//# sourceMappingURL=roles.js.map

package/dist/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../src/roles.ts"],"names":[],"mappings":"AASA,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,UAAU,GAA0C;IACxD,UAAU,EAAE,EAAE;IACd,WAAW,EAAE,EAAE;IACf,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,EAAE;CACV,CAAC;AAEF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;AAE3D,SAAS,SAAS,CAAC,KAAiD;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAkC,EAAE,MAA+B;IAC1G,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IACzC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,CAAC;IACD,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;AAC9E,CAAC"}

package/dist/setup-guard.d.ts

@@ -0,0 +1,11 @@
+import type { RaybaseEmDashAuthConfig } from "./index.js";
+export type RaybaseEmDashSetupGuardOptions = {
+    allowDevBypass?: boolean;
+};
+/**
+ * EmDash's first-run setup would otherwise mint a CMS owner for whoever finds
+ * it first. Guard it with the same handoff the rest of the CMS uses: a
+ * navigation bounces to the hub, anything else gets a 401.
+ */
+export declare function guardRaybaseEmDashSetup(request: Request, config: RaybaseEmDashAuthConfig, options?: RaybaseEmDashSetupGuardOptions): Promise<Response | null>;
+//# sourceMappingURL=setup-guard.d.ts.map

package/dist/setup-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-guard.d.ts","sourceRoot":"","sources":["../src/setup-guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,MAAM,8BAA8B,GAAG;IAC3C,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAQF;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,uBAAuB,EAC/B,OAAO,GAAE,8BAAmC,GAC3C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAI1B"}

package/dist/setup-guard.js

@@ -0,0 +1,20 @@
+import { requireHandoff } from "@raybase/core/handoff-consumer";
+function isEmDashSetupPath(pathname, allowDevBypass) {
+    if (pathname === "/_emdash/admin/setup" || pathname.startsWith("/_emdash/admin/setup/"))
+        return true;
+    if (allowDevBypass && pathname === "/_emdash/api/setup/dev-bypass")
+        return false;
+    return pathname === "/_emdash/api/setup" || pathname.startsWith("/_emdash/api/setup/");
+}
+/**
+ * EmDash's first-run setup would otherwise mint a CMS owner for whoever finds
+ * it first. Guard it with the same handoff the rest of the CMS uses: a
+ * navigation bounces to the hub, anything else gets a 401.
+ */
+export async function guardRaybaseEmDashSetup(request, config, options = {}) {
+    const url = new URL(request.url);
+    if (!isEmDashSetupPath(url.pathname, options.allowDevBypass ?? false))
+        return null;
+    return requireHandoff(request, config);
+}
+//# sourceMappingURL=setup-guard.js.map

package/dist/setup-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-guard.js","sourceRoot":"","sources":["../src/setup-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAOhE,SAAS,iBAAiB,CAAC,QAAgB,EAAE,cAAuB;IAClE,IAAI,QAAQ,KAAK,sBAAsB,IAAI,QAAQ,CAAC,UAAU,CAAC,uBAAuB,CAAC;QAAE,OAAO,IAAI,CAAC;IACrG,IAAI,cAAc,IAAI,QAAQ,KAAK,+BAA+B;QAAE,OAAO,KAAK,CAAC;IACjF,OAAO,QAAQ,KAAK,oBAAoB,IAAI,QAAQ,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,MAA+B,EAC/B,UAA0C,EAAE;IAE5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnF,OAAO,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC"}

package/package.json

@@ -1,16 +1,48 @@
 {
   "name": "@raybase/emdash",
-  "version": "0.0.0",
-  "description": "Reserved for Raybase. Nothing is released under this name yet.",
-  "license": "UNLICENSED",
+  "version": "0.1.0",
+  "description": "Raybase SSO adapter for EmDash sites: verifies a Raybase handoff and hands EmDash the editor.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./auth": {
+      "types": "./dist/auth.d.ts",
+      "default": "./dist/auth.js"
+    },
+    "./setup-guard": {
+      "types": "./dist/setup-guard.d.ts",
+      "default": "./dist/setup-guard.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@raybase/core": "0.3.3"
+  },
+  "peerDependencies": {
+    "emdash": "^0.23.0"
+  },
+  "devDependencies": {
+    "emdash": "0.23.0",
+    "typescript": "^5.8.3"
+  },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/raybasedev/raybase.git"
+    "url": "git+https://github.com/raybasedev/raybase.git",
+    "directory": "packages/emdash"
   },
   "publishConfig": {
     "access": "public"
   },
-  "files": [
-    "README.md"
-  ]
-}
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check": "tsc -p tsconfig.json --noEmit"
+  }
+}

package/README.md

@@ -1,3 +0,0 @@
-# @raybase/emdash
-
-This name is reserved for Raybase. Nothing is released under it yet, and this package holds no code.