@shivaedev/identity 0.0.0 → 0.1.0

package/dist/server/resolveRole.js

@@ -0,0 +1,6 @@
+import { Effect } from "effect";
+import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+export function resolveRole(roles, stored) {
+    return roles.resolve(stored).pipe(Effect.mapError(() => new AuthUnavailable({ message: "Stored user role is not declared by the application" })));
+}
+//# sourceMappingURL=resolveRole.js.map

package/dist/server/resolveRole.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveRole.js","sourceRoot":"","sources":["../../src/server/resolveRole.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,MAAe;IAC1D,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAC,CAAC,CAAC;AACnJ,CAAC"}

package/dist/server/revalidateStream.d.ts

@@ -0,0 +1,6 @@
+import { Effect, Option } from "effect";
+import { type Rpc } from "effect/rpc";
+import { type AuthUnavailable, type Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import type { SessionPolicy, SessionShape } from "./session.ts";
+export declare function revalidateStream<TSession extends SessionShape>(policy: SessionPolicy<TSession>, rpc: Rpc.AnyWithProps, id: string, lookup: Effect.Effect<Option.Option<TSession>, AuthUnavailable | Forbidden>): <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E | Forbidden | Unauthorized, R>;
+//# sourceMappingURL=revalidateStream.d.ts.map

package/dist/server/revalidateStream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revalidateStream.d.ts","sourceRoot":"","sources":["../../src/server/revalidateStream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,KAAK,GAAG,EAAa,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACnG,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEhE,wBAAgB,gBAAgB,CAAC,QAAQ,SAAS,YAAY,EAC7D,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,EAC/B,GAAG,EAAE,GAAG,CAAC,YAAY,EACrB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC,IAEnE,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,uDAa/C"}

package/dist/server/revalidateStream.js

@@ -0,0 +1,19 @@
+import { Effect, Option } from "effect";
+import { RpcSchema } from "effect/rpc";
+import { Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+export function revalidateStream(policy, rpc, id, lookup) {
+    return (effect) => {
+        if (!RpcSchema.isStreamSchema(rpc.successSchema)) {
+            return effect;
+        }
+        const check = Effect.gen(function* () {
+            yield* Effect.sleep(policy.streamRevalidationInterval ?? "30 seconds");
+            const session = yield* lookup.pipe(Effect.catchTag("AuthUnavailable", () => Effect.succeed(undefined)));
+            if (session !== undefined && (Option.isNone(session) || session.value.user.id !== id)) {
+                return yield* new Unauthorized({ message: "Authentication required" });
+            }
+        });
+        return Effect.raceFirst(effect, Effect.forever(check));
+    };
+}
+//# sourceMappingURL=revalidateStream.js.map

package/dist/server/revalidateStream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revalidateStream.js","sourceRoot":"","sources":["../../src/server/revalidateStream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAY,SAAS,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAwC,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAGnG,MAAM,UAAU,gBAAgB,CAC/B,MAA+B,EAC/B,GAAqB,EACrB,EAAU,EACV,MAA2E;IAE3E,OAAO,CAAU,MAA8B,EAAE,EAAE;QAClD,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YAClD,OAAO,MAAM,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACjC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,IAAI,YAAY,CAAC,CAAC;YACvE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACxG,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACvF,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACxE,CAAC;QACF,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC;AACH,CAAC"}

package/dist/server/session.d.ts

@@ -0,0 +1,39 @@
+import { Duration, Effect, Layer, Option } from "effect";
+import type { Headers } from "effect/http";
+import type { Permission } from "@shivaedev/access/permission.ts";
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import { type AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import { Identity, SessionUser, type SessionUserValue, type SessionUserWithProviderAccountsValue } from "#identity.ts";
+import { Authenticated, AuthenticatedUser, AuthenticatedUserWithProviderAccounts, MaybeAuthenticated } from "#middleware.ts";
+import { type OriginPolicy } from "./origin.ts";
+export interface SessionShape {
+    readonly user: {
+        readonly id: string;
+    };
+}
+export interface SessionProvider<TSession extends SessionShape> {
+    readonly get: (headers: Headers.Headers) => Effect.Effect<Option.Option<TSession>, AuthUnavailable>;
+}
+export interface SessionPolicy<TSession extends SessionShape> {
+    readonly origin: OriginPolicy;
+    readonly provider: SessionProvider<TSession>;
+    readonly roles?: RoleSet;
+    readonly streamRevalidationInterval?: Duration.Input | undefined;
+}
+export declare const resolveSession: <TSession extends SessionShape>(policy: SessionPolicy<TSession>, headers: Headers.Headers, rpc: string) => Effect.Effect<Option.Option<TSession & {
+    readonly user: {
+        readonly permissions?: readonly Permission[];
+    };
+}>, AuthUnavailable | Forbidden>;
+export declare function authenticatedLayer<TSession extends SessionShape>(policy: SessionPolicy<TSession>): Layer.Layer<Authenticated>;
+export declare function maybeAuthenticatedLayer<TSession extends SessionShape>(policy: SessionPolicy<TSession>): Layer.Layer<MaybeAuthenticated>;
+export interface UserSessionShape extends SessionShape {
+    readonly user: SessionUserValue;
+}
+export declare function withSessionUser<TSession extends UserSessionShape>(policy: SessionPolicy<TSession>, headers: Headers.Headers, operation: string): <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E | AuthUnavailable | Forbidden | Unauthorized, Exclude<Exclude<R, Identity>, SessionUser>>;
+export declare function authenticatedUserLayer<TSession extends UserSessionShape>(policy: SessionPolicy<TSession>): Layer.Layer<AuthenticatedUser>;
+export interface ProviderAccountsSessionShape extends UserSessionShape {
+    readonly user: SessionUserWithProviderAccountsValue;
+}
+export declare function authenticatedUserWithProviderAccountsLayer<TSession extends ProviderAccountsSessionShape>(policy: SessionPolicy<TSession>): Layer.Layer<AuthenticatedUserWithProviderAccounts>;
+//# sourceMappingURL=session.d.ts.map

package/dist/server/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAQ,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC/D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,KAAK,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,EACN,QAAQ,EAER,WAAW,EACX,KAAK,gBAAgB,EAErB,KAAK,oCAAoC,EACzC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,qCAAqC,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE7H,OAAO,EAAE,KAAK,YAAY,EAAiB,MAAM,aAAa,CAAC;AAK/D,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE;QACd,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;KACpB,CAAC;CACF;AACD,MAAM,WAAW,eAAe,CAAC,QAAQ,SAAS,YAAY;IAC7D,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAC;CACpG;AACD,MAAM,WAAW,aAAa,CAAC,QAAQ,SAAS,YAAY;IAC3D,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,0BAA0B,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC;CACjE;AACD,eAAO,MAAM,cAAc,EAAE,CAAC,QAAQ,SAAS,YAAY,EAC1D,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,EAC/B,OAAO,EAAE,OAAO,CAAC,OAAO,EACxB,GAAG,EAAE,MAAM,KACP,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;KAAE,CAAA;CAAE,CAAC,EAAE,eAAe,GAAG,SAAS,CAgB1I,CAAC;AAIJ,wBAAgB,kBAAkB,CAAC,QAAQ,SAAS,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAe7H;AACD,wBAAgB,uBAAuB,CAAC,QAAQ,SAAS,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAevI;AACD,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACrD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;CAChC;AACD,wBAAgB,eAAe,CAAC,QAAQ,SAAS,gBAAgB,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,IACtI,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,kHAc/C;AACD,wBAAgB,sBAAsB,CAAC,QAAQ,SAAS,gBAAgB,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAQzI;AAED,MAAM,WAAW,4BAA6B,SAAQ,gBAAgB;IACrE,QAAQ,CAAC,IAAI,EAAE,oCAAoC,CAAC;CACpD;AACD,wBAAgB,0CAA0C,CAAC,QAAQ,SAAS,4BAA4B,EACvG,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAC7B,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAuBpD"}

package/dist/server/session.js

@@ -0,0 +1,73 @@
+import { Duration, Effect, Exit, Layer, Option } from "effect";
+import { Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import { Identity, OptionalIdentity, SessionUser, SessionUserWithProviderAccounts, } from "#identity.ts";
+import { Authenticated, AuthenticatedUser, AuthenticatedUserWithProviderAccounts, MaybeAuthenticated } from "#middleware.ts";
+import { sessionCommandChanges } from "#server/commandChanges.ts";
+import { originRequest } from "./origin.js";
+import { resolveRole } from "./resolveRole.js";
+import { revalidateStream } from "./revalidateStream.js";
+import { sessionProfile } from "./sessionProfile.js";
+import { transportHeaders } from "./transportHeaders.js";
+export const resolveSession = Effect.fn("PlatformRpc.resolveSession")(function* (policy, headers, rpc) {
+    const transport = yield* transportHeaders(headers);
+    if (!policy.origin(originRequest(transport, rpc))) {
+        return yield* new Forbidden({ message: "Origin not allowed" });
+    }
+    const session = yield* policy.provider.get(transport);
+    if (Option.isNone(session) || policy.roles === undefined) {
+        return session;
+    }
+    const access = yield* resolveRole(policy.roles, Reflect.get(session.value.user, "role"));
+    return Option.some({ ...session.value, user: { ...session.value.user, ...access } });
+});
+function identified(id) {
+    return Effect.andThen(Effect.annotateCurrentSpan("user.id", id), Effect.succeed(id));
+}
+export function authenticatedLayer(policy) {
+    return Layer.succeed(Authenticated, (effect, { headers, rpc, payload }) => Effect.gen(function* () {
+        const session = yield* resolveSession(policy, headers, rpc._tag);
+        if (Option.isNone(session)) {
+            return yield* new Unauthorized({ message: "Authentication required" });
+        }
+        const id = yield* identified(session.value.user.id);
+        return yield* sessionCommandChanges(effect, rpc, payload).pipe(revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)), Effect.provideService(Identity, { id }), Effect.annotateLogs({ userId: id }));
+    }));
+}
+export function maybeAuthenticatedLayer(policy) {
+    return Layer.succeed(MaybeAuthenticated, (effect, { headers, rpc }) => Effect.gen(function* () {
+        const session = yield* resolveSession(policy, headers, rpc._tag);
+        if (Option.isNone(session)) {
+            return yield* Effect.provideService(effect, OptionalIdentity, Option.none());
+        }
+        const id = yield* identified(session.value.user.id);
+        return yield* effect.pipe(revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)), Effect.provideService(OptionalIdentity, Option.some({ id })), Effect.annotateLogs({ userId: id }));
+    }));
+}
+export function withSessionUser(policy, headers, operation) {
+    return (effect) => Effect.gen(function* () {
+        const session = yield* resolveSession(policy, headers, operation);
+        if (Option.isNone(session)) {
+            return yield* new Unauthorized({ message: "Authentication required" });
+        }
+        const user = sessionProfile(session.value.user);
+        const id = yield* identified(session.value.user.id);
+        return yield* effect.pipe(Effect.provideService(Identity, { id }), Effect.provideService(SessionUser, user), Effect.annotateLogs({ userId: id }));
+    });
+}
+export function authenticatedUserLayer(policy) {
+    return Layer.succeed(AuthenticatedUser, (effect, { headers, rpc, payload }) => sessionCommandChanges(effect, rpc, payload).pipe((invocation) => Effect.flatMap(Identity, ({ id }) => invocation.pipe(revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)))), withSessionUser(policy, headers, rpc._tag)));
+}
+export function authenticatedUserWithProviderAccountsLayer(policy) {
+    return Layer.succeed(AuthenticatedUserWithProviderAccounts, (effect, { headers, rpc, payload }) => Effect.gen(function* () {
+        const session = yield* resolveSession(policy, headers, rpc._tag);
+        if (Option.isNone(session)) {
+            return yield* new Unauthorized({ message: "Authentication required" });
+        }
+        const { id, providerAccounts } = session.value.user;
+        const accounts = yield* Effect.cachedWithTTL(Effect.map(providerAccounts, (values) => values.map(({ accountId, providerId }) => ({ accountId, providerId }))), (exit) => (Exit.isSuccess(exit) ? Duration.infinity : Duration.zero));
+        const user = sessionProfile(session.value.user);
+        yield* identified(id);
+        return yield* sessionCommandChanges(effect, rpc, payload).pipe(revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)), Effect.provideService(Identity, { id }), Effect.provideService(SessionUser, user), Effect.provideService(SessionUserWithProviderAccounts, { ...user, providerAccounts: accounts }), Effect.annotateLogs({ userId: id }));
+    }));
+}
+//# sourceMappingURL=session.js.map

package/dist/server/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAI/D,OAAO,EAAwB,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,EACN,QAAQ,EACR,gBAAgB,EAChB,WAAW,EAEX,+BAA+B,GAE/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,qCAAqC,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC7H,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAqB,aAAa,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAezD,MAAM,CAAC,MAAM,cAAc,GAK1B,MAAM,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,EAChD,MAA+B,EAC/B,OAAwB,EACxB,GAAW;IAEX,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,OAAO,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzF,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;AACtF,CAAC,CAAC,CAAC;AACJ,SAAS,UAAU,CAAC,EAAU;IAC7B,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC;AACD,MAAM,UAAU,kBAAkB,CAAgC,MAA+B;IAChG,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CACzE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,CAAC,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,CAC7D,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAC5E,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EACvC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CACnC,CAAC;IACH,CAAC,CAAC,CACF,CAAC;AACH,CAAC;AACD,MAAM,UAAU,uBAAuB,CAAgC,MAA+B;IACrG,OAAO,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CACrE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACxB,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAC5E,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAC5D,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CACnC,CAAC;IACH,CAAC,CAAC,CACF,CAAC;AACH,CAAC;AAID,MAAM,UAAU,eAAe,CAAoC,MAA+B,EAAE,OAAwB,EAAE,SAAiB;IAC9I,OAAO,CAAU,MAA8B,EAAE,EAAE,CAClD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACxB,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EACvC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,EACxC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CACnC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,UAAU,sBAAsB,CAAoC,MAA+B;IACxG,OAAO,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7E,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,CAC/C,CAAC,UAAU,EAAE,EAAE,CACd,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EACpI,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAC1C,CACD,CAAC;AACH,CAAC;AAKD,MAAM,UAAU,0CAA0C,CACzD,MAA+B;IAE/B,OAAO,KAAK,CAAC,OAAO,CAAC,qCAAqC,EAAE,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CACjG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,EAAE,EAAE,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAC3C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAChH,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACpE,CAAC;QACF,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC,CAAC,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,CAC7D,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAC5E,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EACvC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,EACxC,MAAM,CAAC,cAAc,CAAC,+BAA+B,EAAE,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAC/F,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CACnC,CAAC;IACH,CAAC,CAAC,CACF,CAAC;AACH,CAAC"}

package/dist/server/sessionKeys.d.ts

@@ -0,0 +1,10 @@
+import { Effect } from "effect";
+import type { Rpc } from "effect/rpc";
+import type { KeyContext } from "@shivaedev/contract/keys.ts";
+import { type QueryReference } from "@shivaedev/contract/serverMetadata.ts";
+export declare function sessionKeyContext(rpc: Pick<Rpc.AnyWithProps, "annotations">): Effect.Effect<KeyContext | undefined>;
+export declare function resolveChanges(rpc: Pick<Rpc.AnyWithProps, "annotations">, references: readonly QueryReference[]): Effect.Effect<{
+    context: KeyContext | undefined;
+    keys: readonly import("@shivaedev/contract/keys.ts").Key[];
+}, never, never>;
+//# sourceMappingURL=sessionKeys.d.ts.map

package/dist/server/sessionKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionKeys.d.ts","sourceRoot":"","sources":["../../src/server/sessionKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,MAAM,EAAU,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAGpG,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,aAAa,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC,CAWnH;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,UAAU,EAAE,SAAS,cAAc,EAAE;;;iBAK/G"}

package/dist/server/sessionKeys.js

@@ -0,0 +1,22 @@
+import { Context, Effect, Option } from "effect";
+import { ChangesReads, KeyScope } from "@shivaedev/contract/serverMetadata.ts";
+import { Identity } from "#identity.ts";
+export function sessionKeyContext(rpc) {
+    if (Option.isNone(Context.getOption(rpc.annotations, KeyScope))) {
+        return Effect.succeed(undefined);
+    }
+    return Effect.gen(function* () {
+        const identity = yield* Effect.serviceOption(Identity);
+        if (Option.isNone(identity)) {
+            return yield* Effect.die(new Error("Session-scoped contract keys require request-local Identity"));
+        }
+        return { scope: identity.value.id };
+    });
+}
+export function resolveChanges(rpc, references) {
+    return Effect.map(sessionKeyContext(rpc), (context) => ({
+        context,
+        keys: Context.getUnsafe(rpc.annotations, ChangesReads)(references),
+    }));
+}
+//# sourceMappingURL=sessionKeys.js.map

package/dist/server/sessionKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionKeys.js","sourceRoot":"","sources":["../../src/server/sessionKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGjD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAuB,MAAM,uCAAuC,CAAC;AACpG,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,MAAM,UAAU,iBAAiB,CAAC,GAA0C;IAC3E,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAA0C,EAAE,UAAqC;IAC/G,OAAO,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvD,OAAO;QACP,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,UAAU,CAAC;KAClE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/sessionProfile.d.ts

@@ -0,0 +1,3 @@
+import type { SessionUserValue } from "#identity.ts";
+export declare function sessionProfile({ id, name, email, role, permissions }: SessionUserValue): SessionUserValue;
+//# sourceMappingURL=sessionProfile.d.ts.map

package/dist/server/sessionProfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionProfile.d.ts","sourceRoot":"","sources":["../../src/server/sessionProfile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,wBAAgB,cAAc,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,gBAAgB,GAAG,gBAAgB,CAEzG"}

package/dist/server/sessionProfile.js

@@ -0,0 +1,4 @@
+export function sessionProfile({ id, name, email, role, permissions }) {
+    return { email, id, name, ...(role === undefined ? {} : { role }), ...(permissions === undefined ? {} : { permissions }) };
+}
+//# sourceMappingURL=sessionProfile.js.map

package/dist/server/sessionProfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionProfile.js","sourceRoot":"","sources":["../../src/server/sessionProfile.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,cAAc,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAoB;IACtF,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AAC5H,CAAC"}

package/dist/server/tracing.d.ts

@@ -0,0 +1,9 @@
+import { Layer } from "effect";
+import { type SensitiveKey } from "@shivaedev/errors/sensitive.ts";
+import { RequestTracing } from "#middleware.ts";
+export interface RequestTracingOptions {
+    readonly header?: string;
+    readonly sensitive?: SensitiveKey;
+}
+export declare function requestTracingLayer(options?: RequestTracingOptions): Layer.Layer<RequestTracing>;
+//# sourceMappingURL=tracing.d.ts.map

package/dist/server/tracing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing.d.ts","sourceRoot":"","sources":["../../src/server/tracing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgC,KAAK,EAA6B,MAAM,QAAQ,CAAC;AAKxF,OAAO,EAAwC,KAAK,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAEzG,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC;CAClC;AAwCD,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,qBAA0B,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAepG"}

package/dist/server/tracing.js

@@ -0,0 +1,51 @@
+import { Cause, Context, Effect, Exit, Layer, Option, Predicate, Random } from "effect";
+import { Headers } from "effect/http";
+import { KeyScope } from "@shivaedev/contract/serverMetadata.ts";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { redactCause } from "@shivaedev/errors/redactCause.ts";
+import { isSensitiveKey, REDACTED, redactText } from "@shivaedev/errors/sensitive.ts";
+import { RequestId } from "#identity.ts";
+import { RequestTracing } from "#middleware.ts";
+import { commandChanges } from "#server/commandChanges.ts";
+const ACCEPTED_REQUEST_ID = /^[A-Za-z0-9._:-]{1,128}$/u;
+function hex(byte) {
+    return byte.toString(16).padStart(2, "0");
+}
+const generateRequestId = Effect.map(Effect.all(Array.from({ length: 16 }, () => Random.nextIntBetween(0, 255))), (bytes) => bytes.map(hex).join(""));
+function requestIdOf(headers, header) {
+    return Option.match(Option.filter(Headers.get(headers, header), (value) => ACCEPTED_REQUEST_ID.test(value)), {
+        onNone: () => generateRequestId,
+        onSome: Effect.succeed,
+    });
+}
+function failureTag(cause, sensitive = isSensitiveKey) {
+    return Option.match(Cause.findErrorOption(cause), {
+        onNone: () => "unknown",
+        onSome: (error) => {
+            if (!(Predicate.hasProperty(error, "_tag") && Predicate.isString(error._tag))) {
+                return "unknown";
+            }
+            return sensitive("_tag") ? REDACTED : redactText(error._tag, sensitive);
+        },
+    });
+}
+function logFailure(cause, payload, sensitive) {
+    if (Cause.hasInterruptsOnly(cause)) {
+        return Effect.annotateCurrentSpan("rpc.interrupted", true).pipe(Effect.andThen(Effect.logDebug("RPC interrupted")), Effect.annotateLogs({ "rpc.payload": redact(payload, sensitive) }));
+    }
+    const annotations = { "rpc.payload": redact(payload, sensitive) };
+    if (!Cause.hasDies(cause)) {
+        return Effect.annotateLogs(Effect.logInfo("RPC failure"), { ...annotations, "rpc.failure": failureTag(cause, sensitive) });
+    }
+    const defects = cause.reasons.filter(Cause.isDieReason).map((reason) => redact(reason.defect, sensitive));
+    return Effect.annotateLogs(Effect.logError("RPC defect"), { ...annotations, "rpc.defect": defects });
+}
+export function requestTracingLayer(options = {}) {
+    return Layer.succeed(RequestTracing, (effect, { headers, payload, rpc }) => Effect.gen(function* () {
+        const requestId = yield* requestIdOf(headers, options.header ?? "x-request-id");
+        yield* Effect.annotateCurrentSpan({ "request.id": requestId, "rpc.method": rpc._tag });
+        const invocation = Option.isSome(Context.getOption(rpc.annotations, KeyScope)) ? effect : commandChanges(effect, rpc, payload);
+        return yield* invocation.pipe(Effect.catchCauseIf(Cause.hasDies, (cause) => Effect.failCause(redactCause(cause, options.sensitive))), Effect.onExit((exit) => (Exit.isFailure(exit) ? logFailure(exit.cause, payload, options.sensitive) : Effect.void)), Effect.provideService(RequestId, requestId), Effect.annotateLogs({ requestId, "rpc.method": rpc._tag }), Effect.withLogSpan("rpc.duration"));
+    }));
+}
+//# sourceMappingURL=tracing.js.map

package/dist/server/tracing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../../src/server/tracing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAqB,MAAM,gCAAgC,CAAC;AACzG,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAK3D,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AACxD,SAAS,GAAG,CAAC,IAAY;IACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACtJ,SAAS,WAAW,CAAC,OAAwB,EAAE,MAAc;IAC5D,OAAO,MAAM,CAAC,KAAK,CAClB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EACvF;QACC,MAAM,EAAE,GAAG,EAAE,CAAC,iBAAiB;QAC/B,MAAM,EAAE,MAAM,CAAC,OAAO;KACtB,CACD,CAAC;AACH,CAAC;AACD,SAAS,UAAU,CAAC,KAA2B,EAAE,SAAS,GAAiB,cAAc;IACxF,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;QACvB,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC/E,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACzE,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AACD,SAAS,UAAU,CAAC,KAA2B,EAAE,OAAgB,EAAE,SAAmC;IACrG,IAAI,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,IAAI,CAC9D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAClD,MAAM,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,CAClE,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;IAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1G,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AACtG,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,OAAO,GAA0B,EAAE;IACtE,OAAO,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAC1E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC;QAChF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACvF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/H,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAC5B,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EACtG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAClH,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,EAC3C,MAAM,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAC1D,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,CAClC,CAAC;IACH,CAAC,CAAC,CACF,CAAC;AACH,CAAC"}

package/dist/server/transportHeaders.d.ts

@@ -0,0 +1,4 @@
+import { Effect } from "effect";
+import { type Headers } from "effect/http";
+export declare function transportHeaders(rpcHeaders: Headers.Headers): Effect.Effect<Headers.Headers>;
+//# sourceMappingURL=transportHeaders.d.ts.map

package/dist/server/transportHeaders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transportHeaders.d.ts","sourceRoot":"","sources":["../../src/server/transportHeaders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,KAAK,OAAO,EAAqB,MAAM,aAAa,CAAC;AAC9D,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAK5F"}

package/dist/server/transportHeaders.js

@@ -0,0 +1,6 @@
+import { Effect, Option } from "effect";
+import { HttpServerRequest } from "effect/http";
+export function transportHeaders(rpcHeaders) {
+    return Effect.map(Effect.serviceOption(HttpServerRequest.HttpServerRequest), Option.match({ onNone: () => rpcHeaders, onSome: (request) => request.headers }));
+}
+//# sourceMappingURL=transportHeaders.js.map

package/dist/server/transportHeaders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transportHeaders.js","sourceRoot":"","sources":["../../src/server/transportHeaders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAgB,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC9D,MAAM,UAAU,gBAAgB,CAAC,UAA2B;IAC3D,OAAO,MAAM,CAAC,GAAG,CAChB,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EACzD,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAChF,CAAC;AACH,CAAC"}

package/dist/server/trustedProxy.d.ts

@@ -0,0 +1,7 @@
+import { BlockList } from "node:net";
+import { Schema } from "effect";
+export declare function proxyRanges(value: string): string[] | undefined;
+export declare function proxyAddresses(value: string): BlockList | undefined;
+export declare const TrustedProxy: Schema.String;
+export declare function proxyMatches(addresses: BlockList, address: string): boolean;
+//# sourceMappingURL=trustedProxy.d.ts.map

package/dist/server/trustedProxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedProxy.d.ts","sourceRoot":"","sources":["../../src/server/trustedProxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAQ,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGhC,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAE/D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAGnE;AACD,eAAO,MAAM,YAAY,eAIxB,CAAC;AACF,wBAAgB,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAI3E"}

package/dist/server/trustedProxy.js

@@ -0,0 +1,19 @@
+import { BlockList, isIP } from "node:net";
+import { Schema } from "effect";
+import { addProxyAddress, proxyRanges as normalizedRanges } from "./proxyRanges.js";
+export function proxyRanges(value) {
+    return normalizedRanges(value);
+}
+export function proxyAddresses(value) {
+    const addresses = new BlockList();
+    return proxyRanges(value)?.every((entry) => addProxyAddress(addresses, entry)) ? addresses : undefined;
+}
+export const TrustedProxy = Schema.String.check(Schema.makeFilter((value) => proxyAddresses(value) !== undefined, {
+    message: "Expected a comma-separated list of IPv4 or IPv6 addresses or CIDR ranges",
+}));
+export function proxyMatches(addresses, address) {
+    const unmapped = address.replace(/^::ffff:(?=\d+\.)/iu, "");
+    const family = isIP(unmapped);
+    return family !== 0 && !unmapped.includes("%") && addresses.check(unmapped, family === 4 ? "ipv4" : "ipv6");
+}
+//# sourceMappingURL=trustedProxy.js.map

package/dist/server/trustedProxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedProxy.js","sourceRoot":"","sources":["../../src/server/trustedProxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,WAAW,IAAI,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpF,MAAM,UAAU,WAAW,CAAC,KAAa;IACxC,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC3C,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACxG,CAAC;AACD,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAC9C,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE;IACjE,OAAO,EAAE,0EAA0E;CACnF,CAAC,CACF,CAAC;AACF,MAAM,UAAU,YAAY,CAAC,SAAoB,EAAE,OAAe;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC7G,CAAC"}

package/dist/server/trustedProxyRanges.d.ts

@@ -0,0 +1,2 @@
+export declare function trustedProxyRanges(trustedProxy?: string): string[];
+//# sourceMappingURL=trustedProxyRanges.d.ts.map

package/dist/server/trustedProxyRanges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedProxyRanges.d.ts","sourceRoot":"","sources":["../../src/server/trustedProxyRanges.ts"],"names":[],"mappings":"AAEA,wBAAgB,kBAAkB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAElE"}

package/dist/server/trustedProxyRanges.js

@@ -0,0 +1,5 @@
+import { proxyRanges } from "./proxyRanges.js";
+export function trustedProxyRanges(trustedProxy) {
+    return trustedProxy === undefined ? [] : (proxyRanges(trustedProxy) ?? []);
+}
+//# sourceMappingURL=trustedProxyRanges.js.map

package/dist/server/trustedProxyRanges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedProxyRanges.js","sourceRoot":"","sources":["../../src/server/trustedProxyRanges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,UAAU,kBAAkB,CAAC,YAAqB;IACvD,OAAO,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5E,CAAC"}

package/package.json

@@ -1,10 +1,92 @@
 {
   "name": "@shivaedev/identity",
-  "version": "0.0.0",
-  "description": "Placeholder for the ShivaeDev identity package.",
-  "license": "MIT",
+  "version": "0.1.0",
+  "description": "Request identity, sessions, transport trust and permission enforcement for Effect RPC servers",
+  "keywords": [
+    "effect"
+  ],
+  "homepage": "https://github.com/ShivaeDev/platform/tree/main/packages/identity#readme",
+  "bugs": {
+    "url": "https://github.com/ShivaeDev/platform/issues"
+  },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/ShivaeDev/platform.git"
+    "url": "git+https://github.com/ShivaeDev/platform.git",
+    "directory": "packages/identity"
+  },
+  "license": "MIT",
+  "sideEffects": false,
+  "type": "module",
+  "imports": {
+    "#test/*": "./src/test-support/*",
+    "#*.ts": {
+      "source": "./src/*.ts",
+      "types": "./dist/*.d.ts",
+      "default": "./dist/*.js"
+    }
+  },
+  "exports": {
+    "./*.ts": {
+      "source": "./src/*.ts",
+      "types": "./dist/*.d.ts",
+      "default": "./dist/*.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.ts",
+    "!src/**/*.test.tsx",
+    "!src/**/*.spec.ts",
+    "!src/**/*.spec.tsx",
+    "!src/**/test-support",
+    "README.md"
+  ],
+  "dependencies": {
+    "@shivaedev/access": "0.1.1",
+    "@shivaedev/contract": "0.17.0",
+    "@shivaedev/errors": "0.1.0",
+    "@shivaedev/sql": "0.22.0"
+  },
+  "devDependencies": {
+    "@effect/platform-node": "4.0.5",
+    "@effect/sql-pg": "4.0.5",
+    "@shivaedev/quality": "0.42.0",
+    "@shivaedev/test-sql": "0.10.0",
+    "@shivaedev/test-story": "0.21.0",
+    "@types/node": "24.19.2",
+    "@types/pg": "8.20.0",
+    "better-auth": "1.7.11",
+    "effect": "4.0.5",
+    "pg": "8.23.0",
+    "typescript": "7.0.2",
+    "vitest": "5.0.5"
+  },
+  "peerDependencies": {
+    "better-auth": "1.7.11",
+    "effect": "4.0.5",
+    "pg": "8.23.0"
+  },
+  "peerDependenciesMeta": {
+    "better-auth": {
+      "optional": true
+    },
+    "pg": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "node --eval \"import('node:fs').then(({ rmSync }) => rmSync('dist', { force: true, recursive: true }))\" && tsc --project tsconfig.build.json",
+    "ready": "pnpm typecheck && pnpm test && pnpm build",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
   }
 }

package/src/identity.ts

@@ -0,0 +1,26 @@
+import { Context, type Effect, type Option } from "effect";
+import type { Permission } from "@shivaedev/access/permission.ts";
+import type { AuthUnavailable, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+export class RequestId extends Context.Service<RequestId, string>()("@shivaedev/identity/RequestId") {}
+export interface IdentityValue {
+	readonly id: string;
+}
+export class Identity extends Context.Service<Identity, IdentityValue>()("@shivaedev/identity/Identity") {}
+export class OptionalIdentity extends Context.Service<OptionalIdentity, Option.Option<IdentityValue>>()("@shivaedev/identity/OptionalIdentity") {}
+export interface ProviderAccountValue {
+	readonly accountId: string;
+	readonly providerId: string;
+}
+export interface SessionUserValue extends IdentityValue {
+	readonly email: string;
+	readonly name: string;
+	readonly permissions?: readonly Permission[];
+	readonly role?: string | null | undefined;
+}
+export class SessionUser extends Context.Service<SessionUser, SessionUserValue>()("@shivaedev/identity/SessionUser") {}
+export interface SessionUserWithProviderAccountsValue extends SessionUserValue {
+	readonly providerAccounts: Effect.Effect<readonly ProviderAccountValue[], AuthUnavailable | Unauthorized>;
+}
+export class SessionUserWithProviderAccounts extends Context.Service<SessionUserWithProviderAccounts, SessionUserWithProviderAccountsValue>()(
+	"@shivaedev/identity/SessionUserWithProviderAccounts",
+) {}

package/src/middleware.ts

@@ -0,0 +1,38 @@
+import { Schema } from "effect";
+import { RpcMiddleware } from "effect/rpc";
+import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import type { Identity, OptionalIdentity, RequestId, SessionUser, SessionUserWithProviderAccounts } from "./identity.ts";
+export class RequestTracing extends RpcMiddleware.Service<
+	RequestTracing,
+	{
+		provides: RequestId;
+	}
+>()("@shivaedev/identity/RequestTracing") {}
+export class Authenticated extends RpcMiddleware.Service<
+	Authenticated,
+	{
+		provides: Identity;
+	}
+>()("@shivaedev/identity/Authenticated", {
+	error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
+}) {}
+export class MaybeAuthenticated extends RpcMiddleware.Service<
+	MaybeAuthenticated,
+	{
+		provides: OptionalIdentity;
+	}
+>()("@shivaedev/identity/MaybeAuthenticated", { error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]) }) {}
+export class AuthenticatedUser extends RpcMiddleware.Service<
+	AuthenticatedUser,
+	{
+		provides: Identity | SessionUser;
+	}
+>()("@shivaedev/identity/AuthenticatedUser", {
+	error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
+}) {}
+export class AuthenticatedUserWithProviderAccounts extends RpcMiddleware.Service<
+	AuthenticatedUserWithProviderAccounts,
+	{ provides: Identity | SessionUser | SessionUserWithProviderAccounts }
+>()("@shivaedev/identity/AuthenticatedUserWithProviderAccounts", {
+	error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
+}) {}

package/src/permission.ts

@@ -0,0 +1,24 @@
+import { Effect, Schema } from "effect";
+import { RpcMiddleware } from "effect/rpc";
+import type { Permission } from "@shivaedev/access/permission.ts";
+import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import { type Identity, SessionUser, type SessionUserValue } from "./identity.ts";
+
+const Failures = Schema.Union([Unauthorized, AuthUnavailable, Forbidden]);
+
+export function permissionMiddleware<TSelf>() {
+	return <const TName extends string>(name: TName, permission: Permission) =>
+		Object.assign(RpcMiddleware.Service<TSelf, { provides: Identity | SessionUser }>()(name, { error: Failures }), { permission });
+}
+
+export function hasPermission(user: Pick<SessionUserValue, "id" | "permissions">, permission: Permission): boolean {
+	return user.permissions?.some((grant) => grant.name === permission.name && grant.strength === permission.strength) ?? false;
+}
+
+export function requirePermission(permission: Permission) {
+	return Effect.flatMap(SessionUser, (user) =>
+		hasPermission(user, permission)
+			? Effect.succeed(user)
+			: Effect.fail(new Forbidden({ message: `Permission required: ${permission.name} (${permission.strength})` })),
+	);
+}