@shivaedev/identity 0.0.0 → 0.2.0

package/dist/server/tracing.js

@@ -0,0 +1,51 @@
+import { Cause, Context, Effect, Exit, Layer, Option, Predicate, Random } from "effect";
+import { Headers } from "effect/http";
+import { KeyScope } from "@shivaedev/contract/serverMetadata.ts";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { redactCause } from "@shivaedev/errors/redactCause.ts";
+import { isSensitiveKey, REDACTED, redactText } from "@shivaedev/errors/sensitive.ts";
+import { RequestId } from "#identity.ts";
+import { RequestTracing } from "#middleware.ts";
+import { commandChanges } from "#server/commandChanges.ts";
+const ACCEPTED_REQUEST_ID = /^[A-Za-z0-9._:-]{1,128}$/u;
+function hex(byte) {
+    return byte.toString(16).padStart(2, "0");
+}
+const generateRequestId = Effect.map(Effect.all(Array.from({ length: 16 }, () => Random.nextIntBetween(0, 255))), (bytes) => bytes.map(hex).join(""));
+function requestIdOf(headers, header) {
+    return Option.match(Option.filter(Headers.get(headers, header), (value) => ACCEPTED_REQUEST_ID.test(value)), {
+        onNone: () => generateRequestId,
+        onSome: Effect.succeed,
+    });
+}
+function failureTag(cause, sensitive = isSensitiveKey) {
+    return Option.match(Cause.findErrorOption(cause), {
+        onNone: () => "unknown",
+        onSome: (error) => {
+            if (!(Predicate.hasProperty(error, "_tag") && Predicate.isString(error._tag))) {
+                return "unknown";
+            }
+            return sensitive("_tag") ? REDACTED : redactText(error._tag, sensitive);
+        },
+    });
+}
+function logFailure(cause, payload, sensitive) {
+    if (Cause.hasInterruptsOnly(cause)) {
+        return Effect.annotateCurrentSpan("rpc.interrupted", true).pipe(Effect.andThen(Effect.logDebug("RPC interrupted")), Effect.annotateLogs({ "rpc.payload": redact(payload, sensitive) }));
+    }
+    const annotations = { "rpc.payload": redact(payload, sensitive) };
+    if (!Cause.hasDies(cause)) {
+        return Effect.annotateLogs(Effect.logInfo("RPC failure"), { ...annotations, "rpc.failure": failureTag(cause, sensitive) });
+    }
+    const defects = cause.reasons.filter(Cause.isDieReason).map((reason) => redact(reason.defect, sensitive));
+    return Effect.annotateLogs(Effect.logError("RPC defect"), { ...annotations, "rpc.defect": defects });
+}
+export function requestTracingLayer(options = {}) {
+    return Layer.succeed(RequestTracing, (effect, { headers, payload, rpc }) => Effect.gen(function* () {
+        const requestId = yield* requestIdOf(headers, options.header ?? "x-request-id");
+        yield* Effect.annotateCurrentSpan({ "request.id": requestId, "rpc.method": rpc._tag });
+        const invocation = Option.isSome(Context.getOption(rpc.annotations, KeyScope)) ? effect : commandChanges(effect, rpc, payload);
+        return yield* invocation.pipe(Effect.catchCauseIf(Cause.hasDies, (cause) => Effect.failCause(redactCause(cause, options.sensitive))), Effect.onExit((exit) => (Exit.isFailure(exit) ? logFailure(exit.cause, payload, options.sensitive) : Effect.void)), Effect.provideService(RequestId, requestId), Effect.annotateLogs({ requestId, "rpc.method": rpc._tag }), Effect.withLogSpan("rpc.duration"));
+    }));
+}
+//# sourceMappingURL=tracing.js.map

package/dist/server/tracing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../../src/server/tracing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAqB,MAAM,gCAAgC,CAAC;AACzG,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAK3D,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AACxD,SAAS,GAAG,CAAC,IAAY;IACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACtJ,SAAS,WAAW,CAAC,OAAwB,EAAE,MAAc;IAC5D,OAAO,MAAM,CAAC,KAAK,CAClB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EACvF;QACC,MAAM,EAAE,GAAG,EAAE,CAAC,iBAAiB;QAC/B,MAAM,EAAE,MAAM,CAAC,OAAO;KACtB,CACD,CAAC;AACH,CAAC;AACD,SAAS,UAAU,CAAC,KAA2B,EAAE,SAAS,GAAiB,cAAc;IACxF,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE;QACjD,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;QACvB,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC/E,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACzE,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AACD,SAAS,UAAU,CAAC,KAA2B,EAAE,OAAgB,EAAE,SAAmC;IACrG,IAAI,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,IAAI,CAC9D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,EAClD,MAAM,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,CAClE,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;IAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1G,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AACtG,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,OAAO,GAA0B,EAAE;IACtE,OAAO,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAC1E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC;QAChF,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACvF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/H,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAC5B,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EACtG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAClH,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,EAC3C,MAAM,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAC1D,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,CAClC,CAAC;IACH,CAAC,CAAC,CACF,CAAC;AACH,CAAC"}

package/dist/server/transportHeaders.d.ts

@@ -0,0 +1,4 @@
+import { Effect } from "effect";
+import { type Headers } from "effect/http";
+export declare function transportHeaders(rpcHeaders: Headers.Headers): Effect.Effect<Headers.Headers>;
+//# sourceMappingURL=transportHeaders.d.ts.map

package/dist/server/transportHeaders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transportHeaders.d.ts","sourceRoot":"","sources":["../../src/server/transportHeaders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,KAAK,OAAO,EAAqB,MAAM,aAAa,CAAC;AAC9D,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAK5F"}

package/dist/server/transportHeaders.js

@@ -0,0 +1,6 @@
+import { Effect, Option } from "effect";
+import { HttpServerRequest } from "effect/http";
+export function transportHeaders(rpcHeaders) {
+    return Effect.map(Effect.serviceOption(HttpServerRequest.HttpServerRequest), Option.match({ onNone: () => rpcHeaders, onSome: (request) => request.headers }));
+}
+//# sourceMappingURL=transportHeaders.js.map

package/dist/server/transportHeaders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transportHeaders.js","sourceRoot":"","sources":["../../src/server/transportHeaders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAgB,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC9D,MAAM,UAAU,gBAAgB,CAAC,UAA2B;IAC3D,OAAO,MAAM,CAAC,GAAG,CAChB,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EACzD,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAChF,CAAC;AACH,CAAC"}

package/dist/server/trustedProxy.d.ts

@@ -0,0 +1,7 @@
+import { BlockList } from "node:net";
+import { Schema } from "effect";
+export declare function proxyRanges(value: string): string[] | undefined;
+export declare function proxyAddresses(value: string): BlockList | undefined;
+export declare const TrustedProxy: Schema.String;
+export declare function proxyMatches(addresses: BlockList, address: string): boolean;
+//# sourceMappingURL=trustedProxy.d.ts.map

package/dist/server/trustedProxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedProxy.d.ts","sourceRoot":"","sources":["../../src/server/trustedProxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAQ,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGhC,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAE/D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAGnE;AACD,eAAO,MAAM,YAAY,eAIxB,CAAC;AACF,wBAAgB,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAI3E"}

package/dist/server/trustedProxy.js

@@ -0,0 +1,19 @@
+import { BlockList, isIP } from "node:net";
+import { Schema } from "effect";
+import { addProxyAddress, proxyRanges as normalizedRanges } from "./proxyRanges.js";
+export function proxyRanges(value) {
+    return normalizedRanges(value);
+}
+export function proxyAddresses(value) {
+    const addresses = new BlockList();
+    return proxyRanges(value)?.every((entry) => addProxyAddress(addresses, entry)) ? addresses : undefined;
+}
+export const TrustedProxy = Schema.String.check(Schema.makeFilter((value) => proxyAddresses(value) !== undefined, {
+    message: "Expected a comma-separated list of IPv4 or IPv6 addresses or CIDR ranges",
+}));
+export function proxyMatches(addresses, address) {
+    const unmapped = address.replace(/^::ffff:(?=\d+\.)/iu, "");
+    const family = isIP(unmapped);
+    return family !== 0 && !unmapped.includes("%") && addresses.check(unmapped, family === 4 ? "ipv4" : "ipv6");
+}
+//# sourceMappingURL=trustedProxy.js.map

package/dist/server/trustedProxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedProxy.js","sourceRoot":"","sources":["../../src/server/trustedProxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,WAAW,IAAI,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpF,MAAM,UAAU,WAAW,CAAC,KAAa;IACxC,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC3C,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACxG,CAAC;AACD,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAC9C,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE;IACjE,OAAO,EAAE,0EAA0E;CACnF,CAAC,CACF,CAAC;AACF,MAAM,UAAU,YAAY,CAAC,SAAoB,EAAE,OAAe;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC7G,CAAC"}

package/dist/server/trustedProxyRanges.d.ts

@@ -0,0 +1,2 @@
+export declare function trustedProxyRanges(trustedProxy?: string): string[];
+//# sourceMappingURL=trustedProxyRanges.d.ts.map

package/dist/server/trustedProxyRanges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedProxyRanges.d.ts","sourceRoot":"","sources":["../../src/server/trustedProxyRanges.ts"],"names":[],"mappings":"AAEA,wBAAgB,kBAAkB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAElE"}

package/dist/server/trustedProxyRanges.js

@@ -0,0 +1,5 @@
+import { proxyRanges } from "./proxyRanges.js";
+export function trustedProxyRanges(trustedProxy) {
+    return trustedProxy === undefined ? [] : (proxyRanges(trustedProxy) ?? []);
+}
+//# sourceMappingURL=trustedProxyRanges.js.map

package/dist/server/trustedProxyRanges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trustedProxyRanges.js","sourceRoot":"","sources":["../../src/server/trustedProxyRanges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,UAAU,kBAAkB,CAAC,YAAqB;IACvD,OAAO,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5E,CAAC"}

package/package.json

@@ -1,10 +1,92 @@
 {
   "name": "@shivaedev/identity",
-  "version": "0.0.0",
-  "description": "Placeholder for the ShivaeDev identity package.",
-  "license": "MIT",
+  "version": "0.2.0",
+  "description": "Request identity, sessions, transport trust and permission enforcement for Effect RPC servers",
+  "keywords": [
+    "effect"
+  ],
+  "homepage": "https://github.com/ShivaeDev/platform/tree/main/packages/identity#readme",
+  "bugs": {
+    "url": "https://github.com/ShivaeDev/platform/issues"
+  },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/ShivaeDev/platform.git"
+    "url": "git+https://github.com/ShivaeDev/platform.git",
+    "directory": "packages/identity"
+  },
+  "license": "MIT",
+  "sideEffects": false,
+  "type": "module",
+  "imports": {
+    "#test/*": "./src/test-support/*",
+    "#*.ts": {
+      "source": "./src/*.ts",
+      "types": "./dist/*.d.ts",
+      "default": "./dist/*.js"
+    }
+  },
+  "exports": {
+    "./*.ts": {
+      "source": "./src/*.ts",
+      "types": "./dist/*.d.ts",
+      "default": "./dist/*.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.ts",
+    "!src/**/*.test.tsx",
+    "!src/**/*.spec.ts",
+    "!src/**/*.spec.tsx",
+    "!src/**/test-support",
+    "README.md"
+  ],
+  "dependencies": {
+    "@shivaedev/access": "0.1.1",
+    "@shivaedev/contract": "0.18.0",
+    "@shivaedev/errors": "0.1.0",
+    "@shivaedev/sql": "0.23.0"
+  },
+  "devDependencies": {
+    "@effect/platform-node": "4.0.5",
+    "@effect/sql-pg": "4.0.5",
+    "@shivaedev/quality": "0.42.0",
+    "@shivaedev/test-sql": "0.10.1",
+    "@shivaedev/test-story": "0.21.1",
+    "@types/node": "24.19.2",
+    "@types/pg": "8.20.0",
+    "better-auth": "1.7.11",
+    "effect": "4.0.5",
+    "pg": "8.23.0",
+    "typescript": "7.0.2",
+    "vitest": "5.0.5"
+  },
+  "peerDependencies": {
+    "better-auth": "1.7.11",
+    "effect": "4.0.5",
+    "pg": "8.23.0"
+  },
+  "peerDependenciesMeta": {
+    "better-auth": {
+      "optional": true
+    },
+    "pg": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "node --eval \"import('node:fs').then(({ rmSync }) => rmSync('dist', { force: true, recursive: true }))\" && tsc --project tsconfig.build.json",
+    "ready": "pnpm typecheck && pnpm test && pnpm build",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
   }
 }

package/src/identity.ts

@@ -0,0 +1,26 @@
+import { Context, type Effect, type Option } from "effect";
+import type { Permission } from "@shivaedev/access/permission.ts";
+import type { AuthUnavailable, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+export class RequestId extends Context.Service<RequestId, string>()("@shivaedev/identity/RequestId") {}
+export interface IdentityValue {
+	readonly id: string;
+}
+export class Identity extends Context.Service<Identity, IdentityValue>()("@shivaedev/identity/Identity") {}
+export class OptionalIdentity extends Context.Service<OptionalIdentity, Option.Option<IdentityValue>>()("@shivaedev/identity/OptionalIdentity") {}
+export interface ProviderAccountValue {
+	readonly accountId: string;
+	readonly providerId: string;
+}
+export interface SessionUserValue extends IdentityValue {
+	readonly email: string;
+	readonly name: string;
+	readonly permissions?: readonly Permission[];
+	readonly role?: string | null | undefined;
+}
+export class SessionUser extends Context.Service<SessionUser, SessionUserValue>()("@shivaedev/identity/SessionUser") {}
+export interface SessionUserWithProviderAccountsValue extends SessionUserValue {
+	readonly providerAccounts: Effect.Effect<readonly ProviderAccountValue[], AuthUnavailable | Unauthorized>;
+}
+export class SessionUserWithProviderAccounts extends Context.Service<SessionUserWithProviderAccounts, SessionUserWithProviderAccountsValue>()(
+	"@shivaedev/identity/SessionUserWithProviderAccounts",
+) {}

package/src/middleware.ts

@@ -0,0 +1,38 @@
+import { Schema } from "effect";
+import { RpcMiddleware } from "effect/rpc";
+import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import type { Identity, OptionalIdentity, RequestId, SessionUser, SessionUserWithProviderAccounts } from "./identity.ts";
+export class RequestTracing extends RpcMiddleware.Service<
+	RequestTracing,
+	{
+		provides: RequestId;
+	}
+>()("@shivaedev/identity/RequestTracing") {}
+export class Authenticated extends RpcMiddleware.Service<
+	Authenticated,
+	{
+		provides: Identity;
+	}
+>()("@shivaedev/identity/Authenticated", {
+	error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
+}) {}
+export class MaybeAuthenticated extends RpcMiddleware.Service<
+	MaybeAuthenticated,
+	{
+		provides: OptionalIdentity;
+	}
+>()("@shivaedev/identity/MaybeAuthenticated", { error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]) }) {}
+export class AuthenticatedUser extends RpcMiddleware.Service<
+	AuthenticatedUser,
+	{
+		provides: Identity | SessionUser;
+	}
+>()("@shivaedev/identity/AuthenticatedUser", {
+	error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
+}) {}
+export class AuthenticatedUserWithProviderAccounts extends RpcMiddleware.Service<
+	AuthenticatedUserWithProviderAccounts,
+	{ provides: Identity | SessionUser | SessionUserWithProviderAccounts }
+>()("@shivaedev/identity/AuthenticatedUserWithProviderAccounts", {
+	error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
+}) {}

package/src/permission.ts

@@ -0,0 +1,24 @@
+import { Effect, Schema } from "effect";
+import { RpcMiddleware } from "effect/rpc";
+import type { Permission } from "@shivaedev/access/permission.ts";
+import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import { type Identity, SessionUser, type SessionUserValue } from "./identity.ts";
+
+const Failures = Schema.Union([Unauthorized, AuthUnavailable, Forbidden]);
+
+export function permissionMiddleware<TSelf>() {
+	return <const TName extends string>(name: TName, permission: Permission) =>
+		Object.assign(RpcMiddleware.Service<TSelf, { provides: Identity | SessionUser }>()(name, { error: Failures }), { permission });
+}
+
+export function hasPermission(user: Pick<SessionUserValue, "id" | "permissions">, permission: Permission): boolean {
+	return user.permissions?.some((grant) => grant.name === permission.name && grant.strength === permission.strength) ?? false;
+}
+
+export function requirePermission(permission: Permission) {
+	return Effect.flatMap(SessionUser, (user) =>
+		hasPermission(user, permission)
+			? Effect.succeed(user)
+			: Effect.fail(new Forbidden({ message: `Permission required: ${permission.name} (${permission.strength})` })),
+	);
+}

package/src/server/adapters/betterAuthSessions.ts

@@ -0,0 +1,44 @@
+import { Effect, Option, Predicate } from "effect";
+import type { Headers } from "effect/http";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { AuthUnavailable, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import type { ProviderAccountValue } from "#identity.ts";
+import type { SessionProvider, SessionShape } from "#server/session.ts";
+export type GetSession<TSession extends SessionShape> = (headers: globalThis.Headers) => Promise<TSession | null>;
+export type GetProviderAccounts = (headers: globalThis.Headers) => Promise<readonly ProviderAccountValue[]>;
+export type SessionWithProviderAccounts<TSession extends SessionShape> = TSession & {
+	readonly user: TSession["user"] & { readonly providerAccounts: Effect.Effect<readonly ProviderAccountValue[], AuthUnavailable | Unauthorized> };
+};
+function unavailable(cause: unknown) {
+	return Effect.andThen(
+		Effect.logError("Authentication provider failed", redact(cause)),
+		Effect.fail(new AuthUnavailable({ message: "Authentication is temporarily unavailable" })),
+	);
+}
+export function betterAuthSessions<TSession extends SessionShape>(getSession: GetSession<TSession>): SessionProvider<TSession>;
+export function betterAuthSessions<TSession extends SessionShape>(
+	getSession: GetSession<TSession>,
+	getProviderAccounts: GetProviderAccounts,
+): SessionProvider<SessionWithProviderAccounts<TSession>>;
+export function betterAuthSessions<TSession extends SessionShape>(getSession: GetSession<TSession>, getProviderAccounts?: GetProviderAccounts) {
+	const betterAuthSession = Effect.fn("PlatformRpc.betterAuthSession")(function* (headers: Headers.Headers) {
+		const transport = new globalThis.Headers(headers);
+		const session = yield* Effect.tryPromise(() => getSession(transport)).pipe(Effect.catch((error) => unavailable(error.cause)));
+		if (session === null || getProviderAccounts === undefined) {
+			return Option.fromNullishOr(session);
+		}
+		const providerAccounts = Effect.tryPromise({
+			catch: (cause) => cause,
+			try: () => getProviderAccounts(transport),
+		}).pipe(
+			Effect.catch(
+				(cause): Effect.Effect<never, AuthUnavailable | Unauthorized> =>
+					Predicate.hasProperty(cause, "statusCode") && cause.statusCode === 401
+						? Effect.fail(new Unauthorized({ message: "Authentication required" }))
+						: unavailable(cause),
+			),
+		);
+		return Option.some({ ...session, user: { ...session.user, providerAccounts } });
+	});
+	return { get: betterAuthSession };
+}

package/src/server/better-auth/allowedAccounts.ts

@@ -0,0 +1,29 @@
+import { Config, Schema, SchemaGetter } from "effect";
+
+const ProviderAccount = Schema.Struct({ accountId: Schema.NonEmptyString, providerId: Schema.NonEmptyString });
+
+const AccountEntry = Schema.String.pipe(
+	Schema.decodeTo(ProviderAccount, {
+		decode: SchemaGetter.transform((entry) => {
+			const separator = entry.indexOf(":");
+			return separator < 0
+				? { accountId: "", providerId: entry }
+				: { accountId: entry.slice(separator + 1).trim(), providerId: entry.slice(0, separator).trim() };
+		}),
+		encode: SchemaGetter.transform(({ accountId, providerId }) => `${providerId}:${accountId}`),
+	}),
+);
+
+export const AllowedAccounts = Schema.String.pipe(
+	Schema.decodeTo(Schema.Array(AccountEntry).check(Schema.isMinLength(1)), {
+		decode: SchemaGetter.transform((value) =>
+			value
+				.split(",")
+				.map((entry) => entry.trim())
+				.filter((entry) => entry.length > 0),
+		),
+		encode: SchemaGetter.transform((entries) => entries.join(",")),
+	}),
+);
+
+export const allowedAccounts = Config.schema(AllowedAccounts, "AUTH_ALLOWED_ACCOUNTS");

package/src/server/better-auth/bearerSessions.ts

@@ -0,0 +1,50 @@
+import type { BetterAuthOptions } from "better-auth";
+import { bearer } from "better-auth/plugins/bearer";
+
+export interface BearerSessionsOptions {
+	readonly origins: readonly string[];
+}
+
+export function withBearerSessions<TOptions extends BetterAuthOptions>(options: TOptions, enabled: boolean): TOptions {
+	return enabled ? { ...options, plugins: [...(options.plugins ?? []), bearer({ requireSignature: true })] } : options;
+}
+
+export function hasSessionCookie(headers: Headers, cookieName: string): boolean {
+	return (
+		headers
+			.get("cookie")
+			?.split(";")
+			.some((cookie) => cookie.trim().startsWith(`${cookieName}=`)) === true
+	);
+}
+
+export function sessionHeaders(headers: Headers, cookieName: string): Headers {
+	const result = new Headers(headers);
+	if (hasSessionCookie(headers, cookieName)) {
+		result.delete("authorization");
+	} else if (/^bearer\s/iu.test(headers.get("authorization") ?? "")) {
+		result.delete("cookie");
+	}
+	return result;
+}
+
+export async function cookieSessionResponse(response: Response): Promise<Response> {
+	const headers = new Headers(response.headers);
+	headers.delete("set-auth-token");
+	const exposed = headers.get("access-control-expose-headers");
+	if (exposed !== null) {
+		headers.set(
+			"access-control-expose-headers",
+			exposed
+				.split(",")
+				.filter((header) => header.trim().toLowerCase() !== "set-auth-token")
+				.join(","),
+		);
+	}
+	if (!headers.get("content-type")?.includes("application/json")) {
+		return new Response(response.body, { headers, status: response.status });
+	}
+	const body: unknown = JSON.parse(await response.text(), (key, value: unknown) => (key === "token" ? undefined : value));
+	headers.delete("content-length");
+	return Response.json(body, { headers, status: response.status });
+}

package/src/server/better-auth/clientIp.ts

@@ -0,0 +1,34 @@
+import { getIP } from "better-auth/api";
+import { Option } from "effect";
+import type { HttpServerRequest } from "effect/http";
+import { trustedProxyPeer, trustedProxyRanges } from "#server/local.ts";
+
+export const PEER_IP_HEADER = "x-platform-client-ip";
+
+export function clientIpHeaders(options: {
+	readonly clientIpHeader: string;
+	readonly ipv6Subnet?: number | undefined;
+	readonly trustedProxy?: string | undefined;
+}) {
+	const trustedPeer = trustedProxyPeer(options.trustedProxy);
+	const advanced = {
+		ipAddress: {
+			ipAddressHeaders: [options.clientIpHeader],
+			...(options.ipv6Subnet === undefined ? {} : { ipv6Subnet: options.ipv6Subnet }),
+			trustedProxies: trustedProxyRanges(options.trustedProxy),
+		},
+	};
+	return (request: HttpServerRequest.HttpServerRequest, web: Request) => {
+		web.headers.delete(PEER_IP_HEADER);
+		const trusted = Option.exists(request.remoteAddress, trustedPeer);
+		const forwardedIp = trusted ? getIP(web, { advanced }) : null;
+		if (!trusted) {
+			web.headers.delete("x-forwarded-for");
+			web.headers.delete(options.clientIpHeader);
+		}
+		const address = forwardedIp ?? Option.getOrUndefined(request.remoteAddress);
+		if (address !== undefined) {
+			web.headers.set(PEER_IP_HEADER, address);
+		}
+	};
+}

package/src/server/better-auth/memoryRateLimit.ts

@@ -0,0 +1,56 @@
+import type { BetterAuthRateLimitOptions } from "better-auth";
+import { Clock, Effect } from "effect";
+
+interface Bucket {
+	readonly count: number;
+	readonly expiresAt: number;
+	readonly lastRequest: number;
+}
+
+const MAX_ENTRIES = 100_000;
+
+export const memoryRateLimit = Effect.gen(function* () {
+	const clock = yield* Clock.Clock;
+	const buckets = yield* Effect.acquireRelease(
+		Effect.sync(() => new Map<string, Bucket>()),
+		(entries) => Effect.sync(() => entries.clear()),
+	);
+	let nextExpiry = Number.POSITIVE_INFINITY;
+	function prune(now: number) {
+		if (now >= nextExpiry) {
+			nextExpiry = Number.POSITIVE_INFINITY;
+			for (const [entryKey, entry] of buckets) {
+				if (now >= entry.expiresAt) {
+					buckets.delete(entryKey);
+				} else {
+					nextExpiry = Math.min(nextExpiry, entry.expiresAt);
+				}
+			}
+		}
+	}
+	const storage: NonNullable<BetterAuthRateLimitOptions["customStorage"]> = {
+		consume(key, rule) {
+			const now = clock.currentTimeMillisUnsafe();
+			prune(now);
+			const bucket = buckets.get(key);
+			const window = rule.window * 1000;
+			if (bucket !== undefined && now - bucket.lastRequest < window && bucket.count >= rule.max) {
+				return Promise.resolve({ allowed: false, retryAfter: Math.ceil((bucket.lastRequest + window - now) / 1000) });
+			}
+			nextExpiry = Math.min(nextExpiry, now + window);
+			buckets.set(key, {
+				count: bucket === undefined || now - bucket.lastRequest >= window ? 1 : bucket.count + 1,
+				expiresAt: now + window,
+				lastRequest: now,
+			});
+			if (buckets.size > MAX_ENTRIES) {
+				for (const oldest of buckets.keys()) {
+					buckets.delete(oldest);
+					break;
+				}
+			}
+			return Promise.resolve({ allowed: true, retryAfter: null });
+		},
+	};
+	return storage;
+});