@robelest/convex-auth 0.0.4-preview.27 → 0.0.4-preview.28

package/dist/server/auth.js

@@ -1,4 +1,4 @@
-import { createUnauthenticatedAuthContext, getAuthContext } from "./context.js";
+import { assertAuthResolverContext, createAuthContextCustomization, createPublicAuthContext } from "./auth-context.js";
 import { Auth } from "./runtime.js";
 import { ConvexError } from "convex/values";
 
@@ -29,29 +29,6 @@ import { ConvexError } from "convex/values";
 *
 * @see {@link AuthContextConfig}
 */
-async function resolveConfiguredAuthContext(auth, ctx, config) {
-	const fallback = () => getAuthContext(auth, ctx);
-	const authOverride = config?.authResolve ? await config.authResolve(ctx, fallback) : void 0;
-	return authOverride === void 0 ? await fallback() : authOverride;
-}
-function createNotSignedInError() {
-	return new ConvexError({
-		code: "NOT_SIGNED_IN",
-		message: "Authentication required."
-	});
-}
-async function createPublicAuthContext(auth, ctx, config) {
-	const resolved = await resolveConfiguredAuthContext(auth, ctx, config);
-	if (resolved === null) {
-		if (config?.optional !== true) throw createNotSignedInError();
-		return createUnauthenticatedAuthContext();
-	}
-	const extra = config?.resolve ? await config.resolve(ctx, resolved.user, resolved) : {};
-	return {
-		...resolved,
-		...extra
-	};
-}
 function createAuth(component, config) {
 	const authResult = Auth({
 		...config,
@@ -168,81 +145,13 @@ function createAuth(component, config) {
 		invite: authResult.auth.invite,
 		key: authResult.auth.key,
 		http: authResult.auth.http,
-		context: ((ctx, config$1) => createPublicAuthContext(authResult.auth, ctx, config$1)),
+		context: ((ctx, config$1) => {
+			assertAuthResolverContext(ctx);
+			return createPublicAuthContext(authResult.auth, ctx, config$1);
+		}),
 		ctx: ((config$1) => createAuthContextCustomization(authResult.auth, config$1))
 	};
 }
-/**
-* Create a context enrichment for `customQuery` / `customMutation` — optional auth.
-*
-* When `optional: true` is set, unauthenticated requests are allowed.
-* The enriched `ctx.auth` will have `userId: null`, `user: null`,
-* `groupId: null`, `role: null`, and `grants: []` for unauthenticated callers.
-*
-* @param config - Configuration with `optional: true` and an optional
-*   `resolve` callback for attaching extra fields to the auth context.
-* @returns An object with `args` and `input` compatible with Convex
-*   custom function builders.
-*
-* @example
-* ```ts
-* const authCtx = auth.ctx({
-*   optional: true,
-*   resolve: async (_ctx, user) => ({ plan: user.extend?.plan ?? null }),
-* });
-* ```
-*
-* @see {@link createAuth}
-*/
-/**
-* Create a context enrichment for `customQuery` / `customMutation` — required auth (default).
-*
-* When `optional` is omitted or `false`, unauthenticated requests throw a
-* structured `ConvexError` before your handler runs.
-*
-* @param config - Optional configuration with a `resolve` callback
-*   for attaching extra fields to the auth context.
-* @returns An object with `args` and `input` compatible with Convex
-*   custom function builders.
-*
-* @example
-* ```ts
-* const authCtx = auth.ctx({
-*   resolve: async (_ctx, user) => ({ email: user.email }),
-* });
-* ```
-*
-* @see {@link createAuth}
-*/
-function createAuthContextCustomization(auth, config) {
-	return {
-		args: {},
-		input: async (ctx, _args, _extra) => {
-			const nativeAuth = ctx.auth;
-			const getUserIdentity = nativeAuth.getUserIdentity.bind(nativeAuth);
-			const resolved = await resolveConfiguredAuthContext(auth, ctx, config);
-			if (resolved === null) {
-				if (config?.optional !== true) throw createNotSignedInError();
-				return {
-					ctx: { auth: {
-						getUserIdentity,
-						...createUnauthenticatedAuthContext()
-					} },
-					args: {}
-				};
-			}
-			const extra = config?.resolve ? await config.resolve(ctx, resolved.user, resolved) : {};
-			return {
-				ctx: { auth: {
-					getUserIdentity,
-					...resolved,
-					...extra
-				} },
-				args: {}
-			};
-		}
-	};
-}
 
 //#endregion
 export { createAuth };

package/dist/server/componentContext.d.ts

@@ -0,0 +1,12 @@
+import { GenericDataModel, GenericMutationCtx, GenericQueryCtx } from "convex/server";
+
+//#region src/server/componentContext.d.ts
+type ComponentReadCtx = {
+  runQuery: GenericQueryCtx<GenericDataModel>["runQuery"];
+};
+type ComponentCtx = ComponentReadCtx & {
+  runMutation: GenericMutationCtx<GenericDataModel>["runMutation"];
+};
+//#endregion
+export { ComponentCtx, ComponentReadCtx };
+//# sourceMappingURL=componentContext.d.ts.map

package/dist/server/componentContext.js

@@ -0,0 +1 @@
+export {  };

package/dist/server/config.js

@@ -12,17 +12,6 @@ function configDefaults(config_) {
 	};
 }
 /**
-* Materialize a single provider config into its runtime form.
-*/
-function materializeProvider(provider) {
-	const config = {
-		providers: [provider],
-		component: {}
-	};
-	materializeAndDefaultProviders(config);
-	return config.providers[0];
-}
-/**
 * List available provider IDs for error messages.
 */
 function listAvailableProviders(config, allowExtraProviders) {
@@ -67,5 +56,5 @@ function normalizeAuthorizationConfig(authorization) {
 }
 
 //#endregion
-export { configDefaults, listAvailableProviders, materializeProvider };
+export { configDefaults, listAvailableProviders };
 //# sourceMappingURL=config.js.map

package/dist/server/constants.js

@@ -0,0 +1,6 @@
+//#region src/server/constants.ts
+const TOKEN_SUB_CLAIM_DIVIDER = "|";
+
+//#endregion
+export { TOKEN_SUB_CLAIM_DIVIDER };
+//# sourceMappingURL=constants.js.map

package/dist/server/contract.d.ts

@@ -1,5 +1,5 @@
+import "./componentContext.js";
 import "./types.js";
-import { GenericActionCtx, GenericDataModel } from "convex/server";
 
 //#region src/server/contract.d.ts
 type GroupConnectionRecord = {

package/dist/server/core.js

@@ -1,9 +1,7 @@
 import { getSessionUserId } from "./context.js";
-import { materializeProvider } from "./config.js";
 import { generateRandomString, sha256 } from "./random.js";
 import { buildScopeChecker, checkKeyRateLimit, generateApiKey, hashApiKey } from "./keys.js";
-import { TOKEN_SUB_CLAIM_DIVIDER } from "./tokens.js";
-import { signInImpl } from "./signin.js";
+import { TOKEN_SUB_CLAIM_DIVIDER } from "./constants.js";
 import { ConvexError } from "convex/values";
 
 //#region src/server/core.ts
@@ -21,7 +19,7 @@ import { ConvexError } from "convex/values";
 * @returns The core domain namespaces consumed by the auth factory.
 */
 function createCoreDomains(deps) {
-	const { config, callInvalidateSessions, callCreateAccountFromCredentials, callRetrieveAccountWithCredentials, callModifyAccount, getEnrichCtx, inviteTokenAlphabet, inviteTokenLength } = deps;
+	const { config, callInvalidateSessions, callCreateAccountFromCredentials, callRetrieveAccountWithCredentials, callModifyAccount, inviteTokenAlphabet, inviteTokenLength } = deps;
 	const roleDefinitions = config.authorization.roles;
 	const getRoleDefinition = (roleId) => {
 		return roleDefinitions[roleId] ?? null;
@@ -229,16 +227,9 @@ function createCoreDomains(deps) {
 			return { totpId };
 		}
 	};
-	const provider = { signIn: async (ctx, providerConfig, args) => {
-		const result = await signInImpl(getEnrichCtx()(ctx), materializeProvider(providerConfig), args, {
-			generateTokens: false,
-			allowExtraProviders: true
-		});
-		return result.kind === "signedIn" ? result.signedIn !== null ? {
-			userId: result.signedIn.userId,
-			sessionId: result.signedIn.sessionId
-		} : null : null;
-	} };
+	const provider = { signIn: deps.signInForProvider ? async (ctx, providerConfig, args) => {
+		return deps.signInForProvider(ctx, providerConfig, args);
+	} : void 0 };
 	const group = {
 		create: async (ctx, data) => {
 			return { groupId: await ctx.runMutation(config.component.public.groupCreate, data) };

package/dist/server/crypto.js

@@ -1,5 +1,4 @@
 import { ConvexError } from "convex/values";
-import { Effect, Match, Option, pipe } from "effect";
 
 //#region src/server/crypto.ts
 function errorMessage(error) {
@@ -9,29 +8,38 @@ const credentialsError = (code, message) => new ConvexError({
 	code,
 	message
 });
-const asCredentialsProvider = (provider) => Match.value(provider).pipe(Match.when({ type: "credentials" }, (provider$1) => Effect.succeed(provider$1)), Match.orElse((provider$1) => Effect.fail(credentialsError("INVALID_CREDENTIALS_PROVIDER", `Provider ${provider$1.id} is not a credentials provider`))));
+function asCredentialsProvider(provider) {
+	if (provider.type !== "credentials") throw credentialsError("INVALID_CREDENTIALS_PROVIDER", `Provider ${provider.id} is not a credentials provider`);
+	return provider;
+}
 /**
 * Hash a secret using the provider's `crypto.hashSecret` function.
+* @internal
 */
-/** @internal */
-const hash = (provider, secret) => Effect.flatMap(asCredentialsProvider(provider), (provider$1) => pipe(Option.fromNullishOr(provider$1.crypto?.hashSecret), Option.match({
-	onNone: () => Effect.fail(credentialsError("MISSING_CRYPTO_FUNCTION", `Provider ${provider$1.id} does not have a \`crypto.hashSecret\` function`)),
-	onSome: (hashSecret) => Effect.tryPromise({
-		try: () => hashSecret(secret),
-		catch: (error) => credentialsError("INTERNAL_ERROR", `Hash failed: ${errorMessage(error)}`)
-	})
-})));
+async function hash(provider, secret) {
+	const credProvider = asCredentialsProvider(provider);
+	const hashSecret = credProvider.crypto?.hashSecret;
+	if (!hashSecret) throw credentialsError("MISSING_CRYPTO_FUNCTION", `Provider ${credProvider.id} does not have a \`crypto.hashSecret\` function`);
+	try {
+		return await hashSecret(secret);
+	} catch (error) {
+		throw credentialsError("INTERNAL_ERROR", `Hash failed: ${errorMessage(error)}`);
+	}
+}
 /**
 * Verify a secret against a hash using the provider's `crypto.verifySecret` function.
+* @internal
 */
-/** @internal */
-const verify = (provider, secret, hashValue) => Effect.flatMap(asCredentialsProvider(provider), (provider$1) => pipe(Option.fromNullishOr(provider$1.crypto?.verifySecret), Option.match({
-	onNone: () => Effect.fail(credentialsError("MISSING_CRYPTO_FUNCTION", `Provider ${provider$1.id} does not have a \`crypto.verifySecret\` function`)),
-	onSome: (verifySecret) => Effect.tryPromise({
-		try: () => verifySecret(secret, hashValue),
-		catch: (error) => credentialsError("INTERNAL_ERROR", `Verify failed: ${errorMessage(error)}`)
-	})
-})));
+async function verify(provider, secret, hashValue) {
+	const credProvider = asCredentialsProvider(provider);
+	const verifySecret = credProvider.crypto?.verifySecret;
+	if (!verifySecret) throw credentialsError("MISSING_CRYPTO_FUNCTION", `Provider ${credProvider.id} does not have a \`crypto.verifySecret\` function`);
+	try {
+		return await verifySecret(secret, hashValue);
+	} catch (error) {
+		throw credentialsError("INTERNAL_ERROR", `Verify failed: ${errorMessage(error)}`);
+	}
+}
 
 //#endregion
 export { hash, verify };

package/dist/server/db.js

@@ -35,12 +35,16 @@ function authDb(ctx, config) {
 				userId,
 				expirationTime
 			}),
+			issue: (args) => ctx.runMutation(component.public.sessionIssue, args),
 			getById: (sessionId) => ctx.runQuery(component.public.sessionGetById, { sessionId }),
 			delete: (sessionId) => ctx.runMutation(component.public.sessionDelete, { sessionId }),
 			listByUser: (userId) => ctx.runQuery(component.public.sessionListByUser, { userId })
 		},
 		verifiers: {
-			create: (sessionId) => ctx.runMutation(component.public.verifierCreate, { sessionId }),
+			create: (sessionId, signature) => ctx.runMutation(component.public.verifierCreate, {
+				sessionId,
+				signature
+			}),
 			getById: (verifierId) => ctx.runQuery(component.public.verifierGetById, { verifierId }),
 			getBySignature: (signature) => ctx.runQuery(component.public.verifierGetBySignature, { signature }),
 			patch: (verifierId, data) => ctx.runMutation(component.public.verifierPatch, {
@@ -57,6 +61,7 @@ function authDb(ctx, config) {
 		},
 		refreshTokens: {
 			create: (args) => ctx.runMutation(component.public.refreshTokenCreate, args),
+			exchange: (args) => ctx.runMutation(component.public.refreshTokenExchange, args),
 			getById: (refreshTokenId) => ctx.runQuery(component.public.refreshTokenGetById, { refreshTokenId }),
 			patch: (refreshTokenId, data) => ctx.runMutation(component.public.refreshTokenPatch, {
 				refreshTokenId,

package/dist/server/device.js

@@ -1,12 +1,11 @@
 import { userIdFromIdentitySubject } from "./identity.js";
-import { requireEnv } from "./env.js";
 import { generateRandomString, sha256 } from "./random.js";
+import { requireEnv } from "./env.js";
+import { callSignIn } from "./mutations/signin.js";
 import { AuthFlowError, authFlowError } from "../shared/errors.js";
 import { toConvexError } from "./errors.js";
-import { callSignIn } from "./mutations/signin.js";
 import { mutateDeviceAuthorize, mutateDeviceDelete, mutateDeviceInsert, mutateDeviceUpdateLastPolled, queryDeviceByCodeHash, queryDeviceByUserCode } from "./types.js";
 import { ConvexError } from "convex/values";
-import { Effect, Match } from "effect";
 
 //#region src/server/device.ts
 /**
@@ -24,84 +23,95 @@ const assertFlow = (flow) => {
 	if (DEVICE_FLOWS.includes(flow)) return flow;
 	throw deviceError("DEVICE_MISSING_FLOW", "Missing `flow` parameter. Expected one of: create, poll, verify");
 };
+async function handleCreate(ctx, provider) {
+	const deviceCode = generateRandomString(DEVICE_CODE_LENGTH, DEVICE_CODE_ALPHABET);
+	const deviceCodeHash = await sha256(deviceCode);
+	const rawUserCode = generateRandomString(provider.userCodeLength, provider.charset);
+	const mid = Math.floor(rawUserCode.length / 2);
+	const userCode = rawUserCode.slice(0, mid) + "-" + rawUserCode.slice(mid);
+	await mutateDeviceInsert(ctx, {
+		deviceCodeHash,
+		userCode,
+		expiresAt: Date.now() + provider.expiresIn * 1e3,
+		interval: provider.interval,
+		status: "pending"
+	});
+	const verificationUri = provider.verificationUri ?? `${process.env.SITE_URL ?? requireEnv("SITE_URL")}/device`;
+	return {
+		kind: "deviceCode",
+		deviceCode,
+		userCode,
+		verificationUri,
+		verificationUriComplete: `${verificationUri}?code=${encodeURIComponent(userCode)}`,
+		expiresIn: provider.expiresIn,
+		interval: provider.interval
+	};
+}
+async function handlePoll(ctx, params) {
+	if (typeof params.deviceCode !== "string") throw deviceError("DEVICE_MISSING_FLOW", "Missing `deviceCode` parameter for poll flow.");
+	const doc = await queryDeviceByCodeHash(ctx, await sha256(params.deviceCode));
+	if (doc === null) throw deviceError("DEVICE_CODE_EXPIRED", "The device code has expired. Please start a new authorization request.");
+	if (Date.now() > doc.expiresAt) {
+		await mutateDeviceDelete(ctx, doc._id);
+		throw deviceError("DEVICE_CODE_EXPIRED", "The device code has expired. Please start a new authorization request.");
+	}
+	if (doc.lastPolledAt !== void 0 && (Date.now() - doc.lastPolledAt) / 1e3 < doc.interval) throw deviceError("DEVICE_SLOW_DOWN", "Polling too frequently. Increase the interval between requests.");
+	await mutateDeviceUpdateLastPolled(ctx, doc._id, Date.now());
+	if (doc.status === "pending") throw deviceError("DEVICE_AUTHORIZATION_PENDING", "The user has not yet authorized this device.");
+	if (doc.status === "denied") {
+		await mutateDeviceDelete(ctx, doc._id);
+		throw deviceError("DEVICE_CODE_DENIED", "The authorization request was denied.");
+	}
+	if (!doc.userId || !doc.sessionId) throw deviceError("INTERNAL_ERROR", "Authorized device code missing userId or sessionId");
+	await mutateDeviceDelete(ctx, doc._id);
+	return {
+		kind: "signedIn",
+		signedIn: await callSignIn(ctx, {
+			userId: doc.userId,
+			sessionId: doc.sessionId,
+			generateTokens: true
+		})
+	};
+}
+async function handleDeviceVerify(ctx, params) {
+	if (typeof params.userCode !== "string") throw deviceError("DEVICE_INVALID_USER_CODE", "Missing `userCode` parameter for verify flow.");
+	const identity = await ctx.auth.getUserIdentity();
+	if (identity === null) throw deviceError("NOT_SIGNED_IN", "You must be signed in to authorize a device.");
+	const userId = userIdFromIdentitySubject(identity.subject);
+	const doc = await queryDeviceByUserCode(ctx, params.userCode);
+	if (doc === null) throw deviceError("DEVICE_INVALID_USER_CODE", "Invalid or expired user code.");
+	if (Date.now() > doc.expiresAt) {
+		await mutateDeviceDelete(ctx, doc._id);
+		throw deviceError("DEVICE_CODE_EXPIRED", "The device code has expired. Please start a new authorization request.");
+	}
+	if (doc.status !== "pending") throw deviceError("DEVICE_ALREADY_AUTHORIZED", "This device code has already been authorized.");
+	const signInResult = await callSignIn(ctx, {
+		userId,
+		generateTokens: false
+	});
+	await mutateDeviceAuthorize(ctx, doc._id, signInResult.userId, signInResult.sessionId);
+	return {
+		kind: "signedIn",
+		signedIn: null
+	};
+}
 /** @internal */
-const handleDevice = (ctx, provider, args) => Effect.tryPromise({
-	try: async () => {
+const handleDevice = async (ctx, provider, args) => {
+	try {
 		const params = args.params ?? {};
 		const flow = assertFlow(typeof params.flow === "string" ? params.flow : "create");
-		return await Match.value(flow).pipe(Match.when("create", async () => {
-			const deviceCode = generateRandomString(DEVICE_CODE_LENGTH, DEVICE_CODE_ALPHABET);
-			const deviceCodeHash = await sha256(deviceCode);
-			const rawUserCode = generateRandomString(provider.userCodeLength, provider.charset);
-			const mid = Math.floor(rawUserCode.length / 2);
-			const userCode = rawUserCode.slice(0, mid) + "-" + rawUserCode.slice(mid);
-			await mutateDeviceInsert(ctx, {
-				deviceCodeHash,
-				userCode,
-				expiresAt: Date.now() + provider.expiresIn * 1e3,
-				interval: provider.interval,
-				status: "pending"
-			});
-			const verificationUri = provider.verificationUri ?? `${process.env.SITE_URL ?? requireEnv("SITE_URL")}/device`;
-			return {
-				kind: "deviceCode",
-				deviceCode,
-				userCode,
-				verificationUri,
-				verificationUriComplete: `${verificationUri}?code=${encodeURIComponent(userCode)}`,
-				expiresIn: provider.expiresIn,
-				interval: provider.interval
-			};
-		}), Match.when("poll", async () => {
-			if (typeof params.deviceCode !== "string") throw deviceError("DEVICE_MISSING_FLOW", "Missing `deviceCode` parameter for poll flow.");
-			const doc = await queryDeviceByCodeHash(ctx, await sha256(params.deviceCode));
-			if (doc === null) throw deviceError("DEVICE_CODE_EXPIRED", "The device code has expired. Please start a new authorization request.");
-			if (Date.now() > doc.expiresAt) {
-				await mutateDeviceDelete(ctx, doc._id);
-				throw deviceError("DEVICE_CODE_EXPIRED", "The device code has expired. Please start a new authorization request.");
-			}
-			if (doc.lastPolledAt !== void 0 && (Date.now() - doc.lastPolledAt) / 1e3 < doc.interval) throw deviceError("DEVICE_SLOW_DOWN", "Polling too frequently. Increase the interval between requests.");
-			await mutateDeviceUpdateLastPolled(ctx, doc._id, Date.now());
-			if (doc.status === "pending") throw deviceError("DEVICE_AUTHORIZATION_PENDING", "The user has not yet authorized this device.");
-			if (doc.status === "denied") {
-				await mutateDeviceDelete(ctx, doc._id);
-				throw deviceError("DEVICE_CODE_DENIED", "The authorization request was denied.");
-			}
-			if (!doc.userId || !doc.sessionId) throw deviceError("INTERNAL_ERROR", "Authorized device code missing userId or sessionId");
-			await mutateDeviceDelete(ctx, doc._id);
-			return {
-				kind: "signedIn",
-				signedIn: await callSignIn(ctx, {
-					userId: doc.userId,
-					sessionId: doc.sessionId,
-					generateTokens: true
-				})
-			};
-		}), Match.when("verify", async () => {
-			if (typeof params.userCode !== "string") throw deviceError("DEVICE_INVALID_USER_CODE", "Missing `userCode` parameter for verify flow.");
-			const identity = await ctx.auth.getUserIdentity();
-			if (identity === null) throw deviceError("NOT_SIGNED_IN", "You must be signed in to authorize a device.");
-			const userId = userIdFromIdentitySubject(identity.subject);
-			const doc = await queryDeviceByUserCode(ctx, params.userCode);
-			if (doc === null) throw deviceError("DEVICE_INVALID_USER_CODE", "Invalid or expired user code.");
-			if (Date.now() > doc.expiresAt) {
-				await mutateDeviceDelete(ctx, doc._id);
-				throw deviceError("DEVICE_CODE_EXPIRED", "The device code has expired. Please start a new authorization request.");
-			}
-			if (doc.status !== "pending") throw deviceError("DEVICE_ALREADY_AUTHORIZED", "This device code has already been authorized.");
-			const signInResult = await callSignIn(ctx, {
-				userId,
-				generateTokens: false
-			});
-			await mutateDeviceAuthorize(ctx, doc._id, signInResult.userId, signInResult.sessionId);
-			return {
-				kind: "signedIn",
-				signedIn: null
-			};
-		}), Match.exhaustive);
-	},
-	catch: (error) => error instanceof ConvexError ? error : error instanceof AuthFlowError ? toConvexError(error) : error instanceof Error ? toConvexError(authFlowError("INTERNAL_ERROR", `Device flow failed: ${error.message}`)) : toConvexError(error)
-});
+		return await new Map([
+			["create", () => handleCreate(ctx, provider)],
+			["poll", () => handlePoll(ctx, params)],
+			["verify", () => handleDeviceVerify(ctx, params)]
+		]).get(flow)();
+	} catch (error) {
+		if (error instanceof ConvexError) throw error;
+		if (error instanceof AuthFlowError) throw toConvexError(error);
+		if (error instanceof Error) throw toConvexError(authFlowError("INTERNAL_ERROR", `Device flow failed: ${error.message}`));
+		throw toConvexError(error);
+	}
+};
 
 //#endregion
 export { handleDevice };

package/dist/server/http.d.ts

@@ -1,15 +1,16 @@
+import { ComponentReadCtx } from "./componentContext.js";
 import { HttpKeyContext } from "./types.js";
-import { AuthContext, OptionalAuthContext, UserDoc } from "./auth.js";
+import { AuthContext, OptionalAuthContext, UserDoc } from "./auth-context.js";
+import "./auth.js";
 import { GenericActionCtx, GenericDataModel, HttpRouter, UserIdentity } from "convex/server";
 
 //#region src/server/http.d.ts
-type HttpQueryCtx = Pick<GenericActionCtx<GenericDataModel>, "runQuery">;
 type HttpIdentityCtx = {
   auth: {
     getUserIdentity: () => Promise<UserIdentity | null>;
   };
 };
-type HttpContextCtx = HttpIdentityCtx & HttpQueryCtx;
+type HttpContextCtx = HttpIdentityCtx & ComponentReadCtx;
 /**
  * Auth context returned by `auth.http.context(ctx, request)`.
  *