@shivaedev/identity 0.0.0 → 0.1.0

package/src/server/better-auth/testing.ts

@@ -0,0 +1,35 @@
+import type { AuthContext } from "better-auth";
+import type { testUtils } from "better-auth/plugins";
+
+type TestContext = ReturnType<ReturnType<typeof testUtils>["init"]>["context"];
+type AccountContext = Pick<AuthContext, "internalAdapter">;
+
+export async function signedInUser(
+	auth: { readonly $context: Promise<TestContext & AccountContext> },
+	{
+		providerAccounts = [],
+		...fields
+	}: Parameters<TestContext["test"]["createUser"]>[0] & {
+		readonly providerAccounts?: readonly { readonly providerId: string; readonly accountId: string }[];
+	},
+) {
+	const { test, internalAdapter } = await auth.$context;
+	const user = await test.saveUser(test.createUser(fields));
+	for (const { providerId, accountId } of providerAccounts) {
+		await internalAdapter.createAccount({ accountId, providerId, userId: user.id });
+	}
+	return test.login({ userId: user.id });
+}
+
+export async function storedProviderAccounts(auth: { readonly $context: Promise<AccountContext> }, userId: string) {
+	const { internalAdapter } = await auth.$context;
+	const accounts = await internalAdapter.findAccounts(userId);
+	return accounts.map(({ providerId, accountId, accessToken, refreshToken, idToken, password }) => ({
+		accountId,
+		hasAccessToken: Boolean(accessToken),
+		hasIdToken: Boolean(idToken),
+		hasPassword: Boolean(password),
+		hasRefreshToken: Boolean(refreshToken),
+		providerId,
+	}));
+}

package/src/server/better-auth/userProfiles.ts

@@ -0,0 +1,37 @@
+import type { Auth } from "better-auth";
+import { Effect } from "effect";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+
+export interface UserProfile {
+	readonly id: string;
+	readonly image: string | null;
+	readonly name: string;
+}
+
+export const userProfiles = Effect.fn("Platform.userProfiles")(function* (
+	auth: { readonly $context: Promise<{ readonly adapter: Pick<Awaited<Auth["$context"]>["adapter"], "findMany"> }> },
+	userIds: readonly string[],
+): Effect.fn.Return<readonly UserProfile[], AuthUnavailable> {
+	const ids = [...new Set(userIds)];
+	if (ids.length === 0) {
+		return [];
+	}
+	const users = yield* Effect.tryPromise(async () => {
+		const { adapter } = await auth.$context;
+		return adapter.findMany<UserProfile>({
+			limit: ids.length,
+			model: "user",
+			select: ["id", "name", "image"],
+			where: [{ field: "id", operator: "in", value: ids }],
+		});
+	}).pipe(
+		Effect.catch((error) =>
+			Effect.andThen(
+				Effect.logError("Authentication provider failed", redact(error.cause)),
+				Effect.fail(new AuthUnavailable({ message: "Authentication is temporarily unavailable" })),
+			),
+		),
+	);
+	return users.map(({ id, name, image }) => ({ id, image: image ?? null, name }));
+});

package/src/server/commandChanges.ts

@@ -0,0 +1,52 @@
+import { Context, Effect, Option } from "effect";
+import * as Reactivity from "effect/reactivity/Reactivity";
+import type { Rpc } from "effect/rpc";
+import { SqlClient } from "effect/sql";
+import { invalidationKeys } from "@shivaedev/contract/keys.ts";
+import { CommandInvalidation, KeyScope } from "@shivaedev/contract/serverMetadata.ts";
+import { ChangeObserver, invalidateOnCommit, transact } from "@shivaedev/sql/transact.ts";
+import { sessionKeyContext } from "#server/sessionKeys.ts";
+
+export function sessionCommandChanges<A, E, R>(effect: Effect.Effect<A, E, R>, rpc: Rpc.AnyWithProps, payload: unknown) {
+	return Option.isSome(Context.getOption(rpc.annotations, KeyScope)) ? commandChanges(effect, rpc, payload) : effect;
+}
+
+export function commandChanges<A, E, R>(effect: Effect.Effect<A, E, R>, rpc: Rpc.AnyWithProps, payload: unknown) {
+	const invalidates = Context.getOption(rpc.annotations, CommandInvalidation);
+	if (Option.isNone(invalidates)) {
+		return effect;
+	}
+	const declared = invalidates.value;
+	return Effect.gen(function* () {
+		const context = yield* sessionKeyContext(rpc);
+		const sql = yield* Effect.serviceOption(SqlClient.SqlClient);
+		const reactivity = yield* Effect.serviceOption(Reactivity.Reactivity);
+		if (Option.isNone(reactivity)) {
+			return yield* effect;
+		}
+		const published = new Set<unknown>();
+		const observer = yield* ChangeObserver;
+		const result = yield* effect.pipe(
+			Effect.provideService(ChangeObserver, (event) => {
+				if (event._tag === "Published") {
+					for (const key of event.changes) {
+						published.add(key);
+					}
+				}
+				return observer(event);
+			}),
+		);
+		const keys = invalidationKeys(declared(payload, result), context).filter((key) => !published.has(key));
+		if (keys.length > 0) {
+			const announce = Option.isNone(sql)
+				? reactivity.value.invalidate(keys)
+				: invalidateOnCommit(keys).pipe(
+						transact({ onSqlError: (error) => error }),
+						Effect.provideService(SqlClient.SqlClient, sql.value),
+						Effect.provideService(Reactivity.Reactivity, reactivity.value),
+					);
+			yield* announce.pipe(Effect.catchCause((cause) => Effect.logError("Committed command invalidation failed", cause)));
+		}
+		return result;
+	});
+}

package/src/server/local.ts

@@ -0,0 +1,100 @@
+import { Effect, Option } from "effect";
+import { HttpServerRequest, HttpServerResponse, HttpTraceContext } from "effect/http";
+import { RpcSerialization } from "effect/rpc";
+import { proxyAddresses, proxyMatches } from "./trustedProxy.ts";
+import { trustedProxyRanges as normalizedRanges } from "./trustedProxyRanges.ts";
+
+function loopbackAddress(address: string): boolean {
+	const unmapped = unmapAddress(address);
+	return unmapped === "::1" || (/^127(?:\.\d{1,3}){3}$/u.test(unmapped) && unmapped.split(".").every((part) => Number(part) <= 255));
+}
+function unmapAddress(address: string): string {
+	return address.replace(/^::ffff:/iu, "");
+}
+function loopbackHost(host: string | undefined): boolean {
+	if (host === undefined) {
+		return false;
+	}
+	const authority = /^(?<hostname>\[[^\]]+\]|[^:]+)(?::(?<port>\d{1,5}))?$/u.exec(host)?.groups;
+	if (authority === undefined || (authority.port !== undefined && Number(authority.port) > 65_535)) {
+		return false;
+	}
+	const hostname = authority.hostname?.toLowerCase();
+	return hostname !== undefined && (hostname === "localhost" || hostname === "[::1]" || loopbackAddress(hostname));
+}
+export function sameOrigin(request: HttpServerRequest.HttpServerRequest): boolean {
+	const origin = request.headers.origin;
+	if (origin === undefined) {
+		return true;
+	}
+	try {
+		const url = new URL(origin);
+		return url.protocol === "http:" && url.origin === origin && url.host === request.headers.host;
+	} catch {
+		return false;
+	}
+}
+export function loopbackOnly<E, R>(
+	handler: (request: HttpServerRequest.HttpServerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>,
+) {
+	return (request: HttpServerRequest.HttpServerRequest) =>
+		loopbackHost(request.headers.host) && Option.match(request.remoteAddress, { onNone: () => true, onSome: loopbackAddress })
+			? handler(request)
+			: Effect.succeed(HttpServerResponse.text("Only loopback hosts are served", { status: 403 }));
+}
+export function trustedProxyPeer(trustedProxy?: string): (address: string) => boolean {
+	const addresses = trustedProxy === undefined ? undefined : proxyAddresses(trustedProxy);
+	return (address) => addresses !== undefined && proxyMatches(addresses, address);
+}
+export function trustedProxyRanges(trustedProxy?: string): string[] {
+	return normalizedRanges(trustedProxy);
+}
+
+function proxyOrigin(request: HttpServerRequest.HttpServerRequest, isTrustedProxy: (address: string) => boolean, native: boolean): boolean {
+	if (!Option.exists(request.remoteAddress, isTrustedProxy)) {
+		return false;
+	}
+	const host = request.headers["x-forwarded-host"];
+	const protocol = request.headers["x-forwarded-proto"];
+	if (host === undefined || !/^(?:\[[\da-f:]+\]|[\da-z.-]+)(?::\d{1,5})?$/iu.test(host) || (protocol !== "http" && protocol !== "https")) {
+		return false;
+	}
+	try {
+		const url = new URL(`${protocol}://${host}`);
+		return native || request.headers.origin === undefined || request.headers.origin === url.origin;
+	} catch {
+		return false;
+	}
+}
+export function localTransport(trustedProxy?: string, nativeOrigins: readonly string[] = []) {
+	const isTrustedProxy = trustedProxyPeer(trustedProxy);
+	return (request: HttpServerRequest.HttpServerRequest): boolean => {
+		const native = nativeOrigins.includes(request.headers.origin ?? "");
+		const local = loopbackHost(request.headers.host) && Option.exists(request.remoteAddress, loopbackAddress);
+		return (local && (native || sameOrigin(request))) || proxyOrigin(request, isTrustedProxy, native);
+	};
+}
+export function localRpcGuard<E, R>(
+	effect: Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>,
+	trustedProxy?: string,
+	nativeOrigins: readonly string[] = [],
+) {
+	const allowed = localTransport(trustedProxy, nativeOrigins);
+	return Effect.gen(function* () {
+		const request = yield* HttpServerRequest.HttpServerRequest;
+		const serialization = yield* RpcSerialization.RpcSerialization;
+		const contentType = request.headers["content-type"]?.split(";")[0]?.trim().toLowerCase();
+		return allowed(request) && contentType === serialization.contentType
+			? yield* continueHttpTrace(effect, request)
+			: HttpServerResponse.text("Local same-origin requests only", { status: 403 });
+	});
+}
+
+const continueHttpTrace = Effect.fnUntraced(function* <A, E, R>(effect: Effect.Effect<A, E, R>, request: HttpServerRequest.HttpServerRequest) {
+	const incoming = HttpTraceContext.w3c(request.headers);
+	if (Option.isNone(incoming)) {
+		return yield* effect;
+	}
+	const parent = Option.getOrElse(yield* Effect.option(Effect.currentParentSpan), () => incoming.value);
+	return yield* Effect.withParentSpan(effect, parent);
+});

package/src/server/origin.ts

@@ -0,0 +1,26 @@
+import { Option } from "effect";
+import { Headers } from "effect/http";
+export interface OriginRequest {
+	readonly headers: Headers.Headers;
+	readonly origin: Option.Option<string>;
+	readonly rpc: string;
+}
+export type OriginPolicy = (request: OriginRequest) => boolean;
+export interface TrustedOriginsOptions {
+	readonly allow: readonly string[];
+	readonly missing: "allow" | "reject";
+}
+export function trustedOrigins(options: TrustedOriginsOptions): OriginPolicy {
+	return ({ origin }) =>
+		Option.match(origin, {
+			onNone: () => options.missing === "allow",
+			onSome: (value) => options.allow.includes(value),
+		});
+}
+export function originRequest(headers: Headers.Headers, rpc: string): OriginRequest {
+	return {
+		headers,
+		origin: Headers.get(headers, "origin"),
+		rpc,
+	};
+}

package/src/server/permissions.ts

@@ -0,0 +1,51 @@
+import { Effect, Layer, Option } from "effect";
+import { type HttpServerRequest, HttpServerResponse } from "effect/http";
+import type { RpcMiddleware } from "effect/rpc";
+import type { Permission } from "@shivaedev/access/permission.ts";
+import { type AuthUnavailable, Forbidden, type Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import { Identity, type SessionUser } from "#identity.ts";
+import { hasPermission, type permissionMiddleware, requirePermission } from "#permission.ts";
+import { sessionCommandChanges } from "#server/commandChanges.ts";
+import { revalidateStream } from "./revalidateStream.ts";
+import { resolveSession, type SessionPolicy, type UserSessionShape, withSessionUser } from "./session.ts";
+
+export function permissionLayer<TMiddleware, TSession extends UserSessionShape>(
+	middleware: ReturnType<ReturnType<typeof permissionMiddleware<TMiddleware>>>,
+	policy: SessionPolicy<TSession>,
+) {
+	const permission = middleware.permission;
+	const guard: RpcMiddleware.RpcMiddleware<Identity | SessionUser, Unauthorized | AuthUnavailable | Forbidden, never> = (
+		effect,
+		{ headers, rpc, payload },
+	) => {
+		const lookup = Effect.tap(resolveSession(policy, headers, rpc._tag), (session) =>
+			Option.isSome(session) && !hasPermission(session.value.user, permission)
+				? Effect.fail(new Forbidden({ message: `Permission required: ${permission.name} (${permission.strength})` }))
+				: Effect.void,
+		);
+		return sessionCommandChanges(effect, rpc, payload).pipe(
+			(invocation) => Effect.flatMap(Identity, ({ id }) => invocation.pipe(revalidateStream(policy, rpc, id, lookup))),
+			(invocation) => Effect.andThen(requirePermission(permission), invocation),
+			withSessionUser(policy, headers, rpc._tag),
+		);
+	};
+	return Layer.succeed(middleware, guard);
+}
+function rejection(error: Unauthorized | Forbidden | AuthUnavailable) {
+	return HttpServerResponse.empty({
+		headers: { "cache-control": "private, no-store" },
+		status: { AuthUnavailable: 503, Forbidden: 403, Unauthorized: 401 }[error._tag],
+	});
+}
+
+export function permissionRoute<TSession extends UserSessionShape>(policy: SessionPolicy<TSession>, permission: Permission) {
+	return <E, R>(handler: (request: HttpServerRequest.HttpServerRequest) => Effect.Effect<HttpServerResponse.HttpServerResponse, E, R>) =>
+		(request: HttpServerRequest.HttpServerRequest): Effect.Effect<HttpServerResponse.HttpServerResponse, E, Exclude<R, Identity | SessionUser>> =>
+			Effect.andThen(requirePermission(permission), Effect.context<Identity | SessionUser>()).pipe(
+				withSessionUser(policy, request.headers, request.url),
+				Effect.matchEffect({
+					onFailure: (error) => Effect.succeed(rejection(error)),
+					onSuccess: (context) => Effect.provideContext(handler(request), context),
+				}),
+			);
+}

package/src/server/proxyRanges.ts

@@ -0,0 +1,61 @@
+import { BlockList, isIP } from "node:net";
+
+export function addProxyAddress(addresses: BlockList, entry: string): boolean {
+	const parts = entry.trim().split("/");
+	const address = parts[0] ?? "";
+	const family = isIP(address);
+	if (family === 0 || address.includes("%") || parts.length > 2) {
+		return false;
+	}
+	const type = family === 4 ? "ipv4" : "ipv6";
+	const prefix = parts[1];
+	if (prefix === undefined) {
+		addresses.addAddress(address, type);
+	} else {
+		if (!/^\d+$/u.test(prefix) || Number(prefix) > (family === 4 ? 32 : 128)) {
+			return false;
+		}
+		addresses.addSubnet(address, Number(prefix), type);
+	}
+	return true;
+}
+function mappedIpv4(address: string): string | undefined {
+	const groups = /^\[::ffff:(?<high>[\da-f]+):(?<low>[\da-f]+)\]$/u.exec(new URL(`http://[${address}]`).hostname)?.groups;
+	if (groups?.high === undefined || groups.low === undefined) {
+		return undefined;
+	}
+	const high = Number.parseInt(groups.high, 16);
+	const low = Number.parseInt(groups.low, 16);
+	return [high >>> 8, high & 255, low >>> 8, low & 255].join(".");
+}
+function normalizedProxyRange(entry: string): string[] | undefined {
+	const range = new BlockList();
+	if (!addProxyAddress(range, entry)) {
+		return undefined;
+	}
+	const [address = "", prefix] = entry.split("/");
+	if (isIP(address) !== 6) {
+		return [entry];
+	}
+	const ipv4 = mappedIpv4(address);
+	const bits = prefix === undefined ? 128 : Number(prefix);
+	if (ipv4 !== undefined) {
+		if (bits >= 96) {
+			return [prefix === undefined ? ipv4 : `${ipv4}/${bits - 96}`];
+		}
+		const network = bits <= 80 ? "::" : `::${((0xff_ff << (96 - bits)) & 0xff_ff).toString(16)}:0:0`;
+		return [`${network}/${bits}`, "0.0.0.0/0"];
+	}
+	return bits < 96 && range.check("::ffff:0:0", "ipv6") ? [entry, "0.0.0.0/0"] : [entry];
+}
+export function proxyRanges(value: string): string[] | undefined {
+	const ranges: string[] = [];
+	for (const entry of value.split(",")) {
+		const normalized = normalizedProxyRange(entry.trim());
+		if (normalized === undefined) {
+			return undefined;
+		}
+		ranges.push(...normalized);
+	}
+	return ranges;
+}

package/src/server/resolveRole.ts

@@ -0,0 +1,7 @@
+import { Effect } from "effect";
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import { AuthUnavailable } from "@shivaedev/errors/taxonomy.ts";
+
+export function resolveRole(roles: RoleSet, stored: unknown) {
+	return roles.resolve(stored).pipe(Effect.mapError(() => new AuthUnavailable({ message: "Stored user role is not declared by the application" })));
+}

package/src/server/revalidateStream.ts

@@ -0,0 +1,25 @@
+import { Effect, Option } from "effect";
+import { type Rpc, RpcSchema } from "effect/rpc";
+import { type AuthUnavailable, type Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import type { SessionPolicy, SessionShape } from "./session.ts";
+
+export function revalidateStream<TSession extends SessionShape>(
+	policy: SessionPolicy<TSession>,
+	rpc: Rpc.AnyWithProps,
+	id: string,
+	lookup: Effect.Effect<Option.Option<TSession>, AuthUnavailable | Forbidden>,
+) {
+	return <A, E, R>(effect: Effect.Effect<A, E, R>) => {
+		if (!RpcSchema.isStreamSchema(rpc.successSchema)) {
+			return effect;
+		}
+		const check = Effect.gen(function* () {
+			yield* Effect.sleep(policy.streamRevalidationInterval ?? "30 seconds");
+			const session = yield* lookup.pipe(Effect.catchTag("AuthUnavailable", () => Effect.succeed(undefined)));
+			if (session !== undefined && (Option.isNone(session) || session.value.user.id !== id)) {
+				return yield* new Unauthorized({ message: "Authentication required" });
+			}
+		});
+		return Effect.raceFirst(effect, Effect.forever(check));
+	};
+}

package/src/server/session.ts

@@ -0,0 +1,148 @@
+import { Duration, Effect, Exit, Layer, Option } from "effect";
+import type { Headers } from "effect/http";
+import type { Permission } from "@shivaedev/access/permission.ts";
+import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import { type AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import {
+	Identity,
+	OptionalIdentity,
+	SessionUser,
+	type SessionUserValue,
+	SessionUserWithProviderAccounts,
+	type SessionUserWithProviderAccountsValue,
+} from "#identity.ts";
+import { Authenticated, AuthenticatedUser, AuthenticatedUserWithProviderAccounts, MaybeAuthenticated } from "#middleware.ts";
+import { sessionCommandChanges } from "#server/commandChanges.ts";
+import { type OriginPolicy, originRequest } from "./origin.ts";
+import { resolveRole } from "./resolveRole.ts";
+import { revalidateStream } from "./revalidateStream.ts";
+import { sessionProfile } from "./sessionProfile.ts";
+import { transportHeaders } from "./transportHeaders.ts";
+export interface SessionShape {
+	readonly user: {
+		readonly id: string;
+	};
+}
+export interface SessionProvider<TSession extends SessionShape> {
+	readonly get: (headers: Headers.Headers) => Effect.Effect<Option.Option<TSession>, AuthUnavailable>;
+}
+export interface SessionPolicy<TSession extends SessionShape> {
+	readonly origin: OriginPolicy;
+	readonly provider: SessionProvider<TSession>;
+	readonly roles?: RoleSet;
+	readonly streamRevalidationInterval?: Duration.Input | undefined;
+}
+export const resolveSession: <TSession extends SessionShape>(
+	policy: SessionPolicy<TSession>,
+	headers: Headers.Headers,
+	rpc: string,
+) => Effect.Effect<Option.Option<TSession & { readonly user: { readonly permissions?: readonly Permission[] } }>, AuthUnavailable | Forbidden> =
+	Effect.fn("PlatformRpc.resolveSession")(function* <TSession extends SessionShape>(
+		policy: SessionPolicy<TSession>,
+		headers: Headers.Headers,
+		rpc: string,
+	) {
+		const transport = yield* transportHeaders(headers);
+		if (!policy.origin(originRequest(transport, rpc))) {
+			return yield* new Forbidden({ message: "Origin not allowed" });
+		}
+		const session = yield* policy.provider.get(transport);
+		if (Option.isNone(session) || policy.roles === undefined) {
+			return session;
+		}
+		const access = yield* resolveRole(policy.roles, Reflect.get(session.value.user, "role"));
+		return Option.some({ ...session.value, user: { ...session.value.user, ...access } });
+	});
+function identified(id: string) {
+	return Effect.andThen(Effect.annotateCurrentSpan("user.id", id), Effect.succeed(id));
+}
+export function authenticatedLayer<TSession extends SessionShape>(policy: SessionPolicy<TSession>): Layer.Layer<Authenticated> {
+	return Layer.succeed(Authenticated, (effect, { headers, rpc, payload }) =>
+		Effect.gen(function* () {
+			const session = yield* resolveSession(policy, headers, rpc._tag);
+			if (Option.isNone(session)) {
+				return yield* new Unauthorized({ message: "Authentication required" });
+			}
+			const id = yield* identified(session.value.user.id);
+			return yield* sessionCommandChanges(effect, rpc, payload).pipe(
+				revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)),
+				Effect.provideService(Identity, { id }),
+				Effect.annotateLogs({ userId: id }),
+			);
+		}),
+	);
+}
+export function maybeAuthenticatedLayer<TSession extends SessionShape>(policy: SessionPolicy<TSession>): Layer.Layer<MaybeAuthenticated> {
+	return Layer.succeed(MaybeAuthenticated, (effect, { headers, rpc }) =>
+		Effect.gen(function* () {
+			const session = yield* resolveSession(policy, headers, rpc._tag);
+			if (Option.isNone(session)) {
+				return yield* Effect.provideService(effect, OptionalIdentity, Option.none());
+			}
+			const id = yield* identified(session.value.user.id);
+			return yield* effect.pipe(
+				revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)),
+				Effect.provideService(OptionalIdentity, Option.some({ id })),
+				Effect.annotateLogs({ userId: id }),
+			);
+		}),
+	);
+}
+export interface UserSessionShape extends SessionShape {
+	readonly user: SessionUserValue;
+}
+export function withSessionUser<TSession extends UserSessionShape>(policy: SessionPolicy<TSession>, headers: Headers.Headers, operation: string) {
+	return <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+		Effect.gen(function* () {
+			const session = yield* resolveSession(policy, headers, operation);
+			if (Option.isNone(session)) {
+				return yield* new Unauthorized({ message: "Authentication required" });
+			}
+			const user = sessionProfile(session.value.user);
+			const id = yield* identified(session.value.user.id);
+			return yield* effect.pipe(
+				Effect.provideService(Identity, { id }),
+				Effect.provideService(SessionUser, user),
+				Effect.annotateLogs({ userId: id }),
+			);
+		});
+}
+export function authenticatedUserLayer<TSession extends UserSessionShape>(policy: SessionPolicy<TSession>): Layer.Layer<AuthenticatedUser> {
+	return Layer.succeed(AuthenticatedUser, (effect, { headers, rpc, payload }) =>
+		sessionCommandChanges(effect, rpc, payload).pipe(
+			(invocation) =>
+				Effect.flatMap(Identity, ({ id }) => invocation.pipe(revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)))),
+			withSessionUser(policy, headers, rpc._tag),
+		),
+	);
+}
+
+export interface ProviderAccountsSessionShape extends UserSessionShape {
+	readonly user: SessionUserWithProviderAccountsValue;
+}
+export function authenticatedUserWithProviderAccountsLayer<TSession extends ProviderAccountsSessionShape>(
+	policy: SessionPolicy<TSession>,
+): Layer.Layer<AuthenticatedUserWithProviderAccounts> {
+	return Layer.succeed(AuthenticatedUserWithProviderAccounts, (effect, { headers, rpc, payload }) =>
+		Effect.gen(function* () {
+			const session = yield* resolveSession(policy, headers, rpc._tag);
+			if (Option.isNone(session)) {
+				return yield* new Unauthorized({ message: "Authentication required" });
+			}
+			const { id, providerAccounts } = session.value.user;
+			const accounts = yield* Effect.cachedWithTTL(
+				Effect.map(providerAccounts, (values) => values.map(({ accountId, providerId }) => ({ accountId, providerId }))),
+				(exit) => (Exit.isSuccess(exit) ? Duration.infinity : Duration.zero),
+			);
+			const user = sessionProfile(session.value.user);
+			yield* identified(id);
+			return yield* sessionCommandChanges(effect, rpc, payload).pipe(
+				revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)),
+				Effect.provideService(Identity, { id }),
+				Effect.provideService(SessionUser, user),
+				Effect.provideService(SessionUserWithProviderAccounts, { ...user, providerAccounts: accounts }),
+				Effect.annotateLogs({ userId: id }),
+			);
+		}),
+	);
+}

package/src/server/sessionKeys.ts

@@ -0,0 +1,25 @@
+import { Context, Effect, Option } from "effect";
+import type { Rpc } from "effect/rpc";
+import type { KeyContext } from "@shivaedev/contract/keys.ts";
+import { ChangesReads, KeyScope, type QueryReference } from "@shivaedev/contract/serverMetadata.ts";
+import { Identity } from "#identity.ts";
+
+export function sessionKeyContext(rpc: Pick<Rpc.AnyWithProps, "annotations">): Effect.Effect<KeyContext | undefined> {
+	if (Option.isNone(Context.getOption(rpc.annotations, KeyScope))) {
+		return Effect.succeed(undefined);
+	}
+	return Effect.gen(function* () {
+		const identity = yield* Effect.serviceOption(Identity);
+		if (Option.isNone(identity)) {
+			return yield* Effect.die(new Error("Session-scoped contract keys require request-local Identity"));
+		}
+		return { scope: identity.value.id };
+	});
+}
+
+export function resolveChanges(rpc: Pick<Rpc.AnyWithProps, "annotations">, references: readonly QueryReference[]) {
+	return Effect.map(sessionKeyContext(rpc), (context) => ({
+		context,
+		keys: Context.getUnsafe(rpc.annotations, ChangesReads)(references),
+	}));
+}

package/src/server/sessionProfile.ts

@@ -0,0 +1,5 @@
+import type { SessionUserValue } from "#identity.ts";
+
+export function sessionProfile({ id, name, email, role, permissions }: SessionUserValue): SessionUserValue {
+	return { email, id, name, ...(role === undefined ? {} : { role }), ...(permissions === undefined ? {} : { permissions }) };
+}

package/src/server/tracing.ts

@@ -0,0 +1,68 @@
+import { Cause, Context, Effect, Exit, Layer, Option, Predicate, Random } from "effect";
+import { Headers } from "effect/http";
+import { KeyScope } from "@shivaedev/contract/serverMetadata.ts";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { redactCause } from "@shivaedev/errors/redactCause.ts";
+import { isSensitiveKey, REDACTED, redactText, type SensitiveKey } from "@shivaedev/errors/sensitive.ts";
+import { RequestId } from "#identity.ts";
+import { RequestTracing } from "#middleware.ts";
+import { commandChanges } from "#server/commandChanges.ts";
+export interface RequestTracingOptions {
+	readonly header?: string;
+	readonly sensitive?: SensitiveKey;
+}
+const ACCEPTED_REQUEST_ID = /^[A-Za-z0-9._:-]{1,128}$/u;
+function hex(byte: number): string {
+	return byte.toString(16).padStart(2, "0");
+}
+const generateRequestId = Effect.map(Effect.all(Array.from({ length: 16 }, () => Random.nextIntBetween(0, 255))), (bytes) => bytes.map(hex).join(""));
+function requestIdOf(headers: Headers.Headers, header: string): Effect.Effect<string> {
+	return Option.match(
+		Option.filter(Headers.get(headers, header), (value) => ACCEPTED_REQUEST_ID.test(value)),
+		{
+			onNone: () => generateRequestId,
+			onSome: Effect.succeed,
+		},
+	);
+}
+function failureTag(cause: Cause.Cause<unknown>, sensitive: SensitiveKey = isSensitiveKey): string {
+	return Option.match(Cause.findErrorOption(cause), {
+		onNone: () => "unknown",
+		onSome: (error) => {
+			if (!(Predicate.hasProperty(error, "_tag") && Predicate.isString(error._tag))) {
+				return "unknown";
+			}
+			return sensitive("_tag") ? REDACTED : redactText(error._tag, sensitive);
+		},
+	});
+}
+function logFailure(cause: Cause.Cause<unknown>, payload: unknown, sensitive: SensitiveKey | undefined): Effect.Effect<void> {
+	if (Cause.hasInterruptsOnly(cause)) {
+		return Effect.annotateCurrentSpan("rpc.interrupted", true).pipe(
+			Effect.andThen(Effect.logDebug("RPC interrupted")),
+			Effect.annotateLogs({ "rpc.payload": redact(payload, sensitive) }),
+		);
+	}
+	const annotations = { "rpc.payload": redact(payload, sensitive) };
+	if (!Cause.hasDies(cause)) {
+		return Effect.annotateLogs(Effect.logInfo("RPC failure"), { ...annotations, "rpc.failure": failureTag(cause, sensitive) });
+	}
+	const defects = cause.reasons.filter(Cause.isDieReason).map((reason) => redact(reason.defect, sensitive));
+	return Effect.annotateLogs(Effect.logError("RPC defect"), { ...annotations, "rpc.defect": defects });
+}
+export function requestTracingLayer(options: RequestTracingOptions = {}): Layer.Layer<RequestTracing> {
+	return Layer.succeed(RequestTracing, (effect, { headers, payload, rpc }) =>
+		Effect.gen(function* () {
+			const requestId = yield* requestIdOf(headers, options.header ?? "x-request-id");
+			yield* Effect.annotateCurrentSpan({ "request.id": requestId, "rpc.method": rpc._tag });
+			const invocation = Option.isSome(Context.getOption(rpc.annotations, KeyScope)) ? effect : commandChanges(effect, rpc, payload);
+			return yield* invocation.pipe(
+				Effect.catchCauseIf(Cause.hasDies, (cause) => Effect.failCause(redactCause(cause, options.sensitive))),
+				Effect.onExit((exit) => (Exit.isFailure(exit) ? logFailure(exit.cause, payload, options.sensitive) : Effect.void)),
+				Effect.provideService(RequestId, requestId),
+				Effect.annotateLogs({ requestId, "rpc.method": rpc._tag }),
+				Effect.withLogSpan("rpc.duration"),
+			);
+		}),
+	);
+}

package/src/server/transportHeaders.ts

@@ -0,0 +1,8 @@
+import { Effect, Option } from "effect";
+import { type Headers, HttpServerRequest } from "effect/http";
+export function transportHeaders(rpcHeaders: Headers.Headers): Effect.Effect<Headers.Headers> {
+	return Effect.map(
+		Effect.serviceOption(HttpServerRequest.HttpServerRequest),
+		Option.match({ onNone: () => rpcHeaders, onSome: (request) => request.headers }),
+	);
+}