@runlot/access 0.1.0-rc.100

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+export type AccessMode = "public" | "org" | "password" | "bypass";
+export type OrgRole = "admin" | "member" | "viewer";
+export interface Identity {
+    /** The mode the front decided. When it is `public`, the rest is empty. */
+    mode: AccessMode;
+    /** The user id. In `password` mode it is `pw:…`, in `bypass` it is
+     *  `bypass`. */
+    subject: string | null;
+    email: string | null;
+    orgRole: OrgRole | null;
+}
+/**
+ * The identity of the request. When the headers are absent entirely (running
+ * outside the front — local `wrangler dev` and the like) it reads as `public`:
+ * the front **always** attaches Mode, so its absence means "there was no
+ * decision", and that is the same as open.
+ */
+export declare function identity(request: Request): Identity;
+/** Is there a login — somebody who is neither `public` nor `bypass`. */
+export declare function isSignedIn(who: Identity): boolean;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC;AAClE,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEpD,MAAM,WAAW,QAAQ;IACvB,0EAA0E;IAC1E,IAAI,EAAE,UAAU,CAAC;IACjB;oBACgB;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CACzB;AAKD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CAYnD;AAED,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAEjD"}

package/dist/index.js

@@ -0,0 +1,40 @@
+// `identity(request)` — reads the identity the front attached
+// (docs/access.md §4.2).
+//
+// Reading it from the request rather than from `env.auth` is a constraint, not
+// a taste: `env` is a bundle fixed for the lifetime of the worker, and the
+// identity is a different value on every request. Reading it from the request
+// means the problem of an implicit store (AsyncLocalStorage) being cut at a
+// streaming or waitUntil boundary does not exist at all.
+//
+// The headers cannot be forged, because the front attaches them after erasing
+// every inbound `Runlot-*` (proto/front-headers.md). This function **trusts**
+// that — there is no deployment where a worker is opened directly without
+// passing through the front.
+const MODES = new Set(["public", "org", "password", "bypass"]);
+const ROLES = new Set(["admin", "member", "viewer"]);
+/**
+ * The identity of the request. When the headers are absent entirely (running
+ * outside the front — local `wrangler dev` and the like) it reads as `public`:
+ * the front **always** attaches Mode, so its absence means "there was no
+ * decision", and that is the same as open.
+ */
+export function identity(request) {
+    const h = request.headers;
+    const rawMode = h.get("Runlot-Access-Mode") ?? "public";
+    const mode = (MODES.has(rawMode) ? rawMode : "public");
+    if (mode === "public")
+        return { mode, subject: null, email: null, orgRole: null };
+    const rawRole = h.get("Runlot-Access-Org-Role");
+    return {
+        mode,
+        subject: h.get("Runlot-Access-Subject"),
+        email: h.get("Runlot-Access-Email"),
+        orgRole: rawRole !== null && ROLES.has(rawRole) ? rawRole : null,
+    };
+}
+/** Is there a login — somebody who is neither `public` nor `bypass`. */
+export function isSignedIn(who) {
+    return who.mode === "org";
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,yBAAyB;AACzB,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,4EAA4E;AAC5E,yDAAyD;AACzD,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,6BAA6B;AAe7B,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpF,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAgB;IACvC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,QAAQ,CAAC;IACxD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAe,CAAC;IACrE,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAClF,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAChD,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACvC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACnC,OAAO,EAAE,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAmB,CAAC,CAAC,CAAC,IAAI;KAC9E,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAC,GAAa;IACtC,OAAO,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC;AAC5B,CAAC"}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@runlot/access",
+  "version": "0.1.0-rc.100",
+  "description": "Reads the access identity (Runlot-Access-* headers) that Runlot attaches to a request",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/runlot/runlot",
+    "directory": "web/packages/access"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "esbuild": "^0.24.2",
+    "typescript": "^5.7.2",
+    "@runlot/config": "0.1.0-rc.100"
+  },
+  "scripts": {
+    "test": "node build.mjs",
+    "typecheck": "tsc --noEmit",
+    "build": "tsc -p tsconfig.build.json"
+  }
+}