@shivaedev/identity 0.1.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +20 -12
- package/dist/middleware.d.ts +5 -4
- package/dist/middleware.d.ts.map +1 -1
- package/dist/middleware.js +7 -4
- package/dist/middleware.js.map +1 -1
- package/dist/permission.d.ts +2 -1
- package/dist/permission.d.ts.map +1 -1
- package/dist/permission.js +2 -1
- package/dist/permission.js.map +1 -1
- package/dist/server/adapters/betterAuthSessions.d.ts.map +1 -1
- package/dist/server/adapters/betterAuthSessions.js +2 -1
- package/dist/server/adapters/betterAuthSessions.js.map +1 -1
- package/dist/server/better-auth/clientIp.d.ts +8 -0
- package/dist/server/better-auth/clientIp.d.ts.map +1 -0
- package/dist/server/better-auth/clientIp.js +28 -0
- package/dist/server/better-auth/clientIp.js.map +1 -0
- package/dist/server/better-auth/mount.d.ts +1 -1
- package/dist/server/better-auth/mount.d.ts.map +1 -1
- package/dist/server/better-auth/mount.js +6 -6
- package/dist/server/better-auth/mount.js.map +1 -1
- package/dist/server/better-auth/mountRoutes.d.ts +1 -0
- package/dist/server/better-auth/mountRoutes.d.ts.map +1 -1
- package/dist/server/better-auth/mountRoutes.js +6 -8
- package/dist/server/better-auth/mountRoutes.js.map +1 -1
- package/dist/server/better-auth/sweepExpiredSessions.d.ts +4 -0
- package/dist/server/better-auth/sweepExpiredSessions.d.ts.map +1 -0
- package/dist/server/better-auth/sweepExpiredSessions.js +12 -0
- package/dist/server/better-auth/sweepExpiredSessions.js.map +1 -0
- package/dist/server/better-auth/testDatabase.d.ts +1 -1
- package/dist/server/better-auth/testDatabase.d.ts.map +1 -1
- package/dist/server/better-auth/testDatabase.js +2 -2
- package/dist/server/better-auth/testDatabase.js.map +1 -1
- package/dist/server/commandChanges.d.ts +0 -1
- package/dist/server/commandChanges.d.ts.map +1 -1
- package/dist/server/commandChanges.js +6 -7
- package/dist/server/commandChanges.js.map +1 -1
- package/dist/server/local.d.ts.map +1 -1
- package/dist/server/local.js +3 -2
- package/dist/server/local.js.map +1 -1
- package/dist/server/permissions.d.ts.map +1 -1
- package/dist/server/permissions.js +9 -3
- package/dist/server/permissions.js.map +1 -1
- package/dist/server/session.d.ts.map +1 -1
- package/dist/server/session.js +8 -7
- package/dist/server/session.js.map +1 -1
- package/dist/server/sessionKeys.d.ts +8 -4
- package/dist/server/sessionKeys.d.ts.map +1 -1
- package/dist/server/sessionKeys.js +11 -7
- package/dist/server/sessionKeys.js.map +1 -1
- package/package.json +9 -8
- package/src/middleware.ts +7 -4
- package/src/permission.ts +2 -1
- package/src/server/adapters/betterAuthSessions.ts +2 -1
- package/src/server/better-auth/clientIp.ts +34 -0
- package/src/server/better-auth/mount.ts +7 -6
- package/src/server/better-auth/mountRoutes.ts +13 -8
- package/src/server/better-auth/sweepExpiredSessions.ts +13 -0
- package/src/server/better-auth/testDatabase.ts +7 -3
- package/src/server/commandChanges.ts +6 -8
- package/src/server/local.ts +3 -2
- package/src/server/permissions.ts +15 -7
- package/src/server/session.ts +8 -7
- package/src/server/sessionKeys.ts +12 -8
|
@@ -1,19 +1,17 @@
|
|
|
1
1
|
import { Context, Effect, Option } from "effect";
|
|
2
2
|
import * as Reactivity from "effect/reactivity/Reactivity";
|
|
3
3
|
import { SqlClient } from "effect/sql";
|
|
4
|
-
import { invalidationKeys } from "@shivaedev/
|
|
5
|
-
import {
|
|
4
|
+
import { invalidationKeys } from "@shivaedev/changes/keys.ts";
|
|
5
|
+
import { CurrentViewer } from "@shivaedev/contract/readPolicy.ts";
|
|
6
|
+
import { CommandInvalidation } from "@shivaedev/contract/serverMetadata.ts";
|
|
6
7
|
import { ChangeObserver, invalidateOnCommit, transact } from "@shivaedev/sql/transact.ts";
|
|
7
8
|
import { sessionKeyContext } from "#server/sessionKeys.ts";
|
|
8
|
-
export function sessionCommandChanges(effect, rpc, payload) {
|
|
9
|
-
return Option.isSome(Context.getOption(rpc.annotations, KeyScope)) ? commandChanges(effect, rpc, payload) : effect;
|
|
10
|
-
}
|
|
11
9
|
export function commandChanges(effect, rpc, payload) {
|
|
12
10
|
const invalidates = Context.getOption(rpc.annotations, CommandInvalidation);
|
|
13
11
|
if (Option.isNone(invalidates)) {
|
|
14
12
|
return effect;
|
|
15
13
|
}
|
|
16
|
-
const declared = invalidates.value;
|
|
14
|
+
const declared = invalidates.value.invalidates;
|
|
17
15
|
return Effect.gen(function* () {
|
|
18
16
|
const context = yield* sessionKeyContext(rpc);
|
|
19
17
|
const sql = yield* Effect.serviceOption(SqlClient.SqlClient);
|
|
@@ -31,7 +29,8 @@ export function commandChanges(effect, rpc, payload) {
|
|
|
31
29
|
}
|
|
32
30
|
return observer(event);
|
|
33
31
|
}));
|
|
34
|
-
const
|
|
32
|
+
const viewer = yield* CurrentViewer;
|
|
33
|
+
const keys = invalidationKeys(declared(payload, result, viewer), context).filter((key) => !published.has(key));
|
|
35
34
|
if (keys.length > 0) {
|
|
36
35
|
const announce = Option.isNone(sql)
|
|
37
36
|
? reactivity.value.invalidate(keys)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"commandChanges.js","sourceRoot":"","sources":["../../src/server/commandChanges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"commandChanges.js","sourceRoot":"","sources":["../../src/server/commandChanges.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,UAAU,cAAc,CAAU,MAA8B,EAAE,GAAqB,EAAE,OAAgB;IAC9G,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC;IAC/C,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC;QACtB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAW,CAAC;QACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAChC,MAAM,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE;YAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAChC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;oBACjC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACpB,CAAC;YACF,CAAC;YACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,CACF,CAAC;QACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;QACpC,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/G,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;gBAClC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;gBACnC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,CAC7B,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,EAC1C,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,EACrD,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAC9D,CAAC;YACJ,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACrH,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC,CAAC,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/server/local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAoB,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/server/local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAoB,MAAM,aAAa,CAAC;AAEtF,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAsB9C,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,GAAG,OAAO,CAWhF;AACD,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,KAAK,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC,aAEpG,iBAAiB,CAAC,iBAAiB,gEAIpD;AACD,wBAAgB,gBAAgB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAGpF;AACD,wBAAgB,kBAAkB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAElE;AAkBD,wBAAgB,cAAc,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,aAAa,GAAE,SAAS,MAAM,EAAO,aAEzE,iBAAiB,CAAC,iBAAiB,KAAG,OAAO,CAK9D;AACD,wBAAgB,aAAa,CAAC,CAAC,EAAE,CAAC,EACjC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC,EAClE,YAAY,CAAC,EAAE,MAAM,EACrB,aAAa,GAAE,SAAS,MAAM,EAAO,wIAWrC"}
|
package/dist/server/local.js
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { Effect, Option } from "effect";
|
|
2
2
|
import { HttpServerRequest, HttpServerResponse, HttpTraceContext } from "effect/http";
|
|
3
|
+
import * as HttpStatus from "effect/http/HttpStatus";
|
|
3
4
|
import { RpcSerialization } from "effect/rpc";
|
|
4
5
|
import { proxyAddresses, proxyMatches } from "./trustedProxy.js";
|
|
5
6
|
import { trustedProxyRanges as normalizedRanges } from "./trustedProxyRanges.js";
|
|
@@ -37,7 +38,7 @@ export function sameOrigin(request) {
|
|
|
37
38
|
export function loopbackOnly(handler) {
|
|
38
39
|
return (request) => loopbackHost(request.headers.host) && Option.match(request.remoteAddress, { onNone: () => true, onSome: loopbackAddress })
|
|
39
40
|
? handler(request)
|
|
40
|
-
: Effect.succeed(HttpServerResponse.text("Only loopback hosts are served", { status:
|
|
41
|
+
: Effect.succeed(HttpServerResponse.text("Only loopback hosts are served", { status: HttpStatus.fromLiteral("Forbidden") }));
|
|
41
42
|
}
|
|
42
43
|
export function trustedProxyPeer(trustedProxy) {
|
|
43
44
|
const addresses = trustedProxy === undefined ? undefined : proxyAddresses(trustedProxy);
|
|
@@ -79,7 +80,7 @@ export function localRpcGuard(effect, trustedProxy, nativeOrigins = []) {
|
|
|
79
80
|
const contentType = request.headers["content-type"]?.split(";")[0]?.trim().toLowerCase();
|
|
80
81
|
return allowed(request) && contentType === serialization.contentType
|
|
81
82
|
? yield* continueHttpTrace(effect, request)
|
|
82
|
-
: HttpServerResponse.text("Local same-origin requests only", { status:
|
|
83
|
+
: HttpServerResponse.text("Local same-origin requests only", { status: HttpStatus.fromLiteral("Forbidden") });
|
|
83
84
|
});
|
|
84
85
|
}
|
|
85
86
|
const continueHttpTrace = Effect.fnUntraced(function* (effect, request) {
|
package/dist/server/local.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/server/local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,kBAAkB,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEjF,SAAS,eAAe,CAAC,OAAe;IACvC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,QAAQ,KAAK,KAAK,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;AACpI,CAAC;AACD,SAAS,YAAY,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AACD,SAAS,YAAY,CAAC,IAAwB;IAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAC9F,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;QAClG,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACnD,OAAO,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClH,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,OAA4C;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AACD,MAAM,UAAU,YAAY,CAC3B,OAAqH;IAErH,OAAO,CAAC,OAA4C,EAAE,EAAE,CACvD,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACzH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAClB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,
|
|
1
|
+
{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/server/local.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,kBAAkB,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEjF,SAAS,eAAe,CAAC,OAAe;IACvC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,QAAQ,KAAK,KAAK,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;AACpI,CAAC;AACD,SAAS,YAAY,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AACD,SAAS,YAAY,CAAC,IAAwB;IAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAC9F,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;QAClG,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACnD,OAAO,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClH,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,OAA4C;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AACD,MAAM,UAAU,YAAY,CAC3B,OAAqH;IAErH,OAAO,CAAC,OAA4C,EAAE,EAAE,CACvD,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACzH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAClB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AAChI,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,YAAqB;IACrD,MAAM,SAAS,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACxF,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AACjF,CAAC;AACD,MAAM,UAAU,kBAAkB,CAAC,YAAqB;IACvD,OAAO,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,WAAW,CAAC,OAA4C,EAAE,cAA4C,EAAE,MAAe;IAC/H,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QACxI,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,YAAqB,EAAE,aAAa,GAAsB,EAAE;IAC1F,MAAM,cAAc,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACtD,OAAO,CAAC,OAA4C,EAAW,EAAE;QAChE,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QAC1G,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IACnG,CAAC,CAAC;AACH,CAAC;AACD,MAAM,UAAU,aAAa,CAC5B,MAAkE,EAClE,YAAqB,EACrB,aAAa,GAAsB,EAAE;IAErC,MAAM,OAAO,GAAG,cAAc,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QAC3D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;QAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzF,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,WAAW,KAAK,aAAa,CAAC,WAAW;YACnE,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC;YAC3C,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAW,MAA8B,EAAE,OAA4C;IAC3I,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC;IACtB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtG,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/server/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,QAAQ,CAAC;AAC/C,OAAO,EAAE,KAAK,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/server/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,QAAQ,CAAC;AAC/C,OAAO,EAAE,KAAK,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAIlE,OAAO,EAAE,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAiB,KAAK,oBAAoB,EAAqB,MAAM,gBAAgB,CAAC;AAG7F,OAAO,EAAkB,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAmB,MAAM,cAAc,CAAC;AAE1G,wBAAgB,eAAe,CAAC,WAAW,EAAE,QAAQ,SAAS,gBAAgB,EAC7E,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,EAC5E,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,0CAoB/B;AAYD,wBAAgB,eAAe,CAAC,QAAQ,SAAS,gBAAgB,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,UAAU,IACjH,CAAC,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC,iBAAiB,KAAK,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC,eACxH,iBAAiB,CAAC,iBAAiB,KAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC,CAAC,CAQ5I"}
|
|
@@ -1,9 +1,11 @@
|
|
|
1
1
|
import { Effect, Layer, Option } from "effect";
|
|
2
2
|
import { HttpServerResponse } from "effect/http";
|
|
3
|
+
import * as HttpStatus from "effect/http/HttpStatus";
|
|
4
|
+
import { authorizeReads } from "@shivaedev/contract/readPolicy.ts";
|
|
3
5
|
import { Forbidden } from "@shivaedev/errors/taxonomy.ts";
|
|
4
6
|
import { Identity } from "#identity.ts";
|
|
5
7
|
import { hasPermission, requirePermission } from "#permission.ts";
|
|
6
|
-
import {
|
|
8
|
+
import { commandChanges } from "#server/commandChanges.ts";
|
|
7
9
|
import { revalidateStream } from "./revalidateStream.js";
|
|
8
10
|
import { resolveSession, withSessionUser } from "./session.js";
|
|
9
11
|
export function permissionLayer(middleware, policy) {
|
|
@@ -12,14 +14,18 @@ export function permissionLayer(middleware, policy) {
|
|
|
12
14
|
const lookup = Effect.tap(resolveSession(policy, headers, rpc._tag), (session) => Option.isSome(session) && !hasPermission(session.value.user, permission)
|
|
13
15
|
? Effect.fail(new Forbidden({ message: `Permission required: ${permission.name} (${permission.strength})` }))
|
|
14
16
|
: Effect.void);
|
|
15
|
-
return
|
|
17
|
+
return Effect.flatMap(Identity, (viewer) => authorizeReads(commandChanges(effect, rpc, payload), { payload, rpc }, Option.some(viewer))).pipe((invocation) => Effect.flatMap(Identity, ({ id }) => invocation.pipe(revalidateStream(policy, rpc, id, lookup))), (invocation) => Effect.andThen(requirePermission(permission), invocation), withSessionUser(policy, headers, rpc._tag));
|
|
16
18
|
};
|
|
17
19
|
return Layer.succeed(middleware, guard);
|
|
18
20
|
}
|
|
19
21
|
function rejection(error) {
|
|
20
22
|
return HttpServerResponse.empty({
|
|
21
23
|
headers: { "cache-control": "private, no-store" },
|
|
22
|
-
status: {
|
|
24
|
+
status: {
|
|
25
|
+
AuthUnavailable: HttpStatus.fromLiteral("ServiceUnavailable"),
|
|
26
|
+
Forbidden: HttpStatus.fromLiteral("Forbidden"),
|
|
27
|
+
Unauthorized: HttpStatus.fromLiteral("Unauthorized"),
|
|
28
|
+
}[error._tag],
|
|
23
29
|
});
|
|
24
30
|
}
|
|
25
31
|
export function permissionRoute(policy, permission) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/server/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EAA0B,kBAAkB,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/server/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EAA0B,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAGrD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEnE,OAAO,EAAwB,SAAS,EAAqB,MAAM,+BAA+B,CAAC;AACnG,OAAO,EAAE,QAAQ,EAAoB,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,aAAa,EAA6B,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,cAAc,EAA6C,eAAe,EAAE,MAAM,cAAc,CAAC;AAE1G,MAAM,UAAU,eAAe,CAC9B,UAA4E,EAC5E,MAA+B;IAE/B,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IACzC,MAAM,KAAK,GAIP,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAChF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC;YACvE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;YAC7G,CAAC,CAAC,MAAM,CAAC,IAAI,CACd,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAC5I,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAChH,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,EACzE,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAC1C,CAAC;IACH,CAAC,CAAC;IACF,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AACD,SAAS,SAAS,CAAC,KAAiD;IACnE,OAAO,kBAAkB,CAAC,KAAK,CAAC;QAC/B,OAAO,EAAE,EAAE,eAAe,EAAE,mBAAmB,EAAE;QACjD,MAAM,EAAE;YACP,eAAe,EAAE,UAAU,CAAC,WAAW,CAAC,oBAAoB,CAAC;YAC7D,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC;YAC9C,YAAY,EAAE,UAAU,CAAC,WAAW,CAAC,cAAc,CAAC;SACpD,CAAC,KAAK,CAAC,IAAI,CAAC;KACb,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAoC,MAA+B,EAAE,UAAsB;IACzH,OAAO,CAAO,OAAqH,EAAE,EAAE,CACtI,CAAC,OAA4C,EAA+F,EAAE,CAC7I,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,EAA0B,CAAC,CAAC,IAAI,CAC3F,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EACrD,MAAM,CAAC,WAAW,CAAC;QAClB,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtD,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;KACxE,CAAC,CACF,CAAC;AACL,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAQ,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC/D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;
|
|
1
|
+
{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAQ,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC/D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAE5D,OAAO,EAAE,KAAK,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,EACN,QAAQ,EAER,WAAW,EACX,KAAK,gBAAgB,EAErB,KAAK,oCAAoC,EACzC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,qCAAqC,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE7H,OAAO,EAAE,KAAK,YAAY,EAAiB,MAAM,aAAa,CAAC;AAK/D,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE;QACd,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;KACpB,CAAC;CACF;AACD,MAAM,WAAW,eAAe,CAAC,QAAQ,SAAS,YAAY;IAC7D,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAC;CACpG;AACD,MAAM,WAAW,aAAa,CAAC,QAAQ,SAAS,YAAY;IAC3D,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,0BAA0B,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC;CACjE;AACD,eAAO,MAAM,cAAc,EAAE,CAAC,QAAQ,SAAS,YAAY,EAC1D,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,EAC/B,OAAO,EAAE,OAAO,CAAC,OAAO,EACxB,GAAG,EAAE,MAAM,KACP,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;KAAE,CAAA;CAAE,CAAC,EAAE,eAAe,GAAG,SAAS,CAgB1I,CAAC;AAIJ,wBAAgB,kBAAkB,CAAC,QAAQ,SAAS,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAe7H;AACD,wBAAgB,uBAAuB,CAAC,QAAQ,SAAS,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAevI;AACD,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACrD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;CAChC;AACD,wBAAgB,eAAe,CAAC,QAAQ,SAAS,gBAAgB,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,IACtI,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,kHAc/C;AACD,wBAAgB,sBAAsB,CAAC,QAAQ,SAAS,gBAAgB,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAQzI;AAED,MAAM,WAAW,4BAA6B,SAAQ,gBAAgB;IACrE,QAAQ,CAAC,IAAI,EAAE,oCAAoC,CAAC;CACpD;AACD,wBAAgB,0CAA0C,CAAC,QAAQ,SAAS,4BAA4B,EACvG,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,GAC7B,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAuBpD"}
|
package/dist/server/session.js
CHANGED
|
@@ -1,8 +1,9 @@
|
|
|
1
1
|
import { Duration, Effect, Exit, Layer, Option } from "effect";
|
|
2
|
+
import { authorizeReads } from "@shivaedev/contract/readPolicy.ts";
|
|
2
3
|
import { Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
|
|
3
4
|
import { Identity, OptionalIdentity, SessionUser, SessionUserWithProviderAccounts, } from "#identity.ts";
|
|
4
5
|
import { Authenticated, AuthenticatedUser, AuthenticatedUserWithProviderAccounts, MaybeAuthenticated } from "#middleware.ts";
|
|
5
|
-
import {
|
|
6
|
+
import { commandChanges } from "#server/commandChanges.ts";
|
|
6
7
|
import { originRequest } from "./origin.js";
|
|
7
8
|
import { resolveRole } from "./resolveRole.js";
|
|
8
9
|
import { revalidateStream } from "./revalidateStream.js";
|
|
@@ -30,17 +31,17 @@ export function authenticatedLayer(policy) {
|
|
|
30
31
|
return yield* new Unauthorized({ message: "Authentication required" });
|
|
31
32
|
}
|
|
32
33
|
const id = yield* identified(session.value.user.id);
|
|
33
|
-
return yield*
|
|
34
|
+
return yield* authorizeReads(commandChanges(effect, rpc, payload), { payload, rpc }, Option.some({ id })).pipe(revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)), Effect.provideService(Identity, { id }), Effect.annotateLogs({ userId: id }));
|
|
34
35
|
}));
|
|
35
36
|
}
|
|
36
37
|
export function maybeAuthenticatedLayer(policy) {
|
|
37
|
-
return Layer.succeed(MaybeAuthenticated, (effect, { headers, rpc }) => Effect.gen(function* () {
|
|
38
|
+
return Layer.succeed(MaybeAuthenticated, (effect, { headers, rpc, payload }) => Effect.gen(function* () {
|
|
38
39
|
const session = yield* resolveSession(policy, headers, rpc._tag);
|
|
39
40
|
if (Option.isNone(session)) {
|
|
40
|
-
return yield* Effect.provideService(effect, OptionalIdentity, Option.none());
|
|
41
|
+
return yield* Effect.provideService(authorizeReads(effect, { payload, rpc }, Option.none()), OptionalIdentity, Option.none());
|
|
41
42
|
}
|
|
42
43
|
const id = yield* identified(session.value.user.id);
|
|
43
|
-
return yield* effect.pipe(revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)), Effect.provideService(OptionalIdentity, Option.some({ id })), Effect.annotateLogs({ userId: id }));
|
|
44
|
+
return yield* authorizeReads(effect, { payload, rpc }, Option.some({ id })).pipe(revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)), Effect.provideService(OptionalIdentity, Option.some({ id })), Effect.annotateLogs({ userId: id }));
|
|
44
45
|
}));
|
|
45
46
|
}
|
|
46
47
|
export function withSessionUser(policy, headers, operation) {
|
|
@@ -55,7 +56,7 @@ export function withSessionUser(policy, headers, operation) {
|
|
|
55
56
|
});
|
|
56
57
|
}
|
|
57
58
|
export function authenticatedUserLayer(policy) {
|
|
58
|
-
return Layer.succeed(AuthenticatedUser, (effect, { headers, rpc, payload }) =>
|
|
59
|
+
return Layer.succeed(AuthenticatedUser, (effect, { headers, rpc, payload }) => Effect.flatMap(Identity, (viewer) => authorizeReads(commandChanges(effect, rpc, payload), { payload, rpc }, Option.some(viewer))).pipe((invocation) => Effect.flatMap(Identity, ({ id }) => invocation.pipe(revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)))), withSessionUser(policy, headers, rpc._tag)));
|
|
59
60
|
}
|
|
60
61
|
export function authenticatedUserWithProviderAccountsLayer(policy) {
|
|
61
62
|
return Layer.succeed(AuthenticatedUserWithProviderAccounts, (effect, { headers, rpc, payload }) => Effect.gen(function* () {
|
|
@@ -67,7 +68,7 @@ export function authenticatedUserWithProviderAccountsLayer(policy) {
|
|
|
67
68
|
const accounts = yield* Effect.cachedWithTTL(Effect.map(providerAccounts, (values) => values.map(({ accountId, providerId }) => ({ accountId, providerId }))), (exit) => (Exit.isSuccess(exit) ? Duration.infinity : Duration.zero));
|
|
68
69
|
const user = sessionProfile(session.value.user);
|
|
69
70
|
yield* identified(id);
|
|
70
|
-
return yield*
|
|
71
|
+
return yield* authorizeReads(commandChanges(effect, rpc, payload), { payload, rpc }, Option.some({ id })).pipe(revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)), Effect.provideService(Identity, { id }), Effect.provideService(SessionUser, user), Effect.provideService(SessionUserWithProviderAccounts, { ...user, providerAccounts: accounts }), Effect.annotateLogs({ userId: id }));
|
|
71
72
|
}));
|
|
72
73
|
}
|
|
73
74
|
//# sourceMappingURL=session.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAI/D,OAAO,EAAwB,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,EACN,QAAQ,EACR,gBAAgB,EAChB,WAAW,EAEX,+BAA+B,GAE/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,qCAAqC,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC7H,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/server/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAI/D,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAwB,SAAS,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,EACN,QAAQ,EACR,gBAAgB,EAChB,WAAW,EAEX,+BAA+B,GAE/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,qCAAqC,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC7H,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAqB,aAAa,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAezD,MAAM,CAAC,MAAM,cAAc,GAK1B,MAAM,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,EAChD,MAA+B,EAC/B,OAAwB,EACxB,GAAW;IAEX,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,OAAO,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzF,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;AACtF,CAAC,CAAC,CAAC;AACJ,SAAS,UAAU,CAAC,EAAU;IAC7B,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC;AACD,MAAM,UAAU,kBAAkB,CAAgC,MAA+B;IAChG,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CACzE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,CAAC,cAAc,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAC7G,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAC5E,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EACvC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CACnC,CAAC;IACH,CAAC,CAAC,CACF,CAAC;AACH,CAAC;AACD,MAAM,UAAU,uBAAuB,CAAgC,MAA+B;IACrG,OAAO,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAC9E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/H,CAAC;QACD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAC/E,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAC5E,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAC5D,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CACnC,CAAC;IACH,CAAC,CAAC,CACF,CAAC;AACH,CAAC;AAID,MAAM,UAAU,eAAe,CAAoC,MAA+B,EAAE,OAAwB,EAAE,SAAiB;IAC9I,OAAO,CAAU,MAA8B,EAAE,EAAE,CAClD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACxB,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EACvC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,EACxC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CACnC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,UAAU,sBAAsB,CAAoC,MAA+B;IACxG,OAAO,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7E,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CACrI,CAAC,UAAU,EAAE,EAAE,CACd,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EACpI,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAC1C,CACD,CAAC;AACH,CAAC;AAKD,MAAM,UAAU,0CAA0C,CACzD,MAA+B;IAE/B,OAAO,KAAK,CAAC,OAAO,CAAC,qCAAqC,EAAE,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CACjG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,EAAE,EAAE,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAC3C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAChH,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACpE,CAAC;QACF,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC,CAAC,cAAc,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAC7G,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAC5E,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EACvC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,EACxC,MAAM,CAAC,cAAc,CAAC,+BAA+B,EAAE,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAC/F,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CACnC,CAAC;IACH,CAAC,CAAC,CACF,CAAC;AACH,CAAC"}
|
|
@@ -1,10 +1,14 @@
|
|
|
1
1
|
import { Effect } from "effect";
|
|
2
2
|
import type { Rpc } from "effect/rpc";
|
|
3
|
-
import type { KeyContext } from "@shivaedev/
|
|
3
|
+
import type { KeyContext } from "@shivaedev/changes/keys.ts";
|
|
4
4
|
import { type QueryReference } from "@shivaedev/contract/serverMetadata.ts";
|
|
5
5
|
export declare function sessionKeyContext(rpc: Pick<Rpc.AnyWithProps, "annotations">): Effect.Effect<KeyContext | undefined>;
|
|
6
|
-
export declare
|
|
6
|
+
export declare const resolveChanges: (rpc: Pick<Rpc.AnyWithProps, "annotations">, references: readonly QueryReference[]) => Effect.Effect<{
|
|
7
7
|
context: KeyContext | undefined;
|
|
8
|
-
|
|
9
|
-
|
|
8
|
+
subscription: {
|
|
9
|
+
authorized: Effect.Effect<boolean, never, never>;
|
|
10
|
+
keys: import("@shivaedev/changes/keys.ts").Key[];
|
|
11
|
+
scopes: (readonly import("@shivaedev/changes/keys.ts").Key[])[];
|
|
12
|
+
};
|
|
13
|
+
}, import("@shivaedev/contract/readPolicyErrors.ts").MissingReadPolicy | import("@shivaedev/contract/readPolicyErrors.ts").QueryReadDenied, never>;
|
|
10
14
|
//# sourceMappingURL=sessionKeys.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sessionKeys.d.ts","sourceRoot":"","sources":["../../src/server/sessionKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,MAAM,EAAU,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"sessionKeys.d.ts","sourceRoot":"","sources":["../../src/server/sessionKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,MAAM,EAAU,MAAM,QAAQ,CAAC;AACjD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAG7D,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAGtG,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,aAAa,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC,CAWnH;AAED,eAAO,MAAM,cAAc;;;;;;;kJAOzB,CAAC"}
|
|
@@ -1,5 +1,7 @@
|
|
|
1
1
|
import { Context, Effect, Option } from "effect";
|
|
2
|
-
import {
|
|
2
|
+
import { querySubscription } from "@shivaedev/contract/querySubscription.ts";
|
|
3
|
+
import { CurrentViewer } from "@shivaedev/contract/readPolicy.ts";
|
|
4
|
+
import { ChangesQueries, KeyScope } from "@shivaedev/contract/serverMetadata.ts";
|
|
3
5
|
import { Identity } from "#identity.ts";
|
|
4
6
|
export function sessionKeyContext(rpc) {
|
|
5
7
|
if (Option.isNone(Context.getOption(rpc.annotations, KeyScope))) {
|
|
@@ -13,10 +15,12 @@ export function sessionKeyContext(rpc) {
|
|
|
13
15
|
return { scope: identity.value.id };
|
|
14
16
|
});
|
|
15
17
|
}
|
|
16
|
-
export
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
18
|
+
export const resolveChanges = Effect.fnUntraced(function* (rpc, references) {
|
|
19
|
+
const identity = yield* Effect.serviceOption(Identity);
|
|
20
|
+
const current = yield* CurrentViewer;
|
|
21
|
+
const viewer = Option.orElse(identity, () => current);
|
|
22
|
+
const queries = yield* Context.getUnsafe(rpc.annotations, ChangesQueries).resolve(references);
|
|
23
|
+
const subscription = yield* querySubscription(queries, viewer);
|
|
24
|
+
return { context: yield* sessionKeyContext(rpc), subscription };
|
|
25
|
+
});
|
|
22
26
|
//# sourceMappingURL=sessionKeys.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sessionKeys.js","sourceRoot":"","sources":["../../src/server/sessionKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGjD,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"sessionKeys.js","sourceRoot":"","sources":["../../src/server/sessionKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAuB,MAAM,uCAAuC,CAAC;AACtG,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,MAAM,UAAU,iBAAiB,CAAC,GAA0C;IAC3E,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,GAA0C,EAAE,UAAqC;IAC3I,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9F,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC;AACjE,CAAC,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@shivaedev/identity",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.3.0",
|
|
4
4
|
"description": "Request identity, sessions, transport trust and permission enforcement for Effect RPC servers",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"effect"
|
|
@@ -45,26 +45,27 @@
|
|
|
45
45
|
],
|
|
46
46
|
"dependencies": {
|
|
47
47
|
"@shivaedev/access": "0.1.1",
|
|
48
|
-
"@shivaedev/
|
|
48
|
+
"@shivaedev/changes": "0.5.0",
|
|
49
|
+
"@shivaedev/contract": "0.19.0",
|
|
49
50
|
"@shivaedev/errors": "0.1.0",
|
|
50
|
-
"@shivaedev/sql": "0.
|
|
51
|
+
"@shivaedev/sql": "0.24.0"
|
|
51
52
|
},
|
|
52
53
|
"devDependencies": {
|
|
53
54
|
"@effect/platform-node": "4.0.5",
|
|
54
55
|
"@effect/sql-pg": "4.0.5",
|
|
55
|
-
"@shivaedev/quality": "0.
|
|
56
|
-
"@shivaedev/test-sql": "0.10.
|
|
57
|
-
"@shivaedev/test-story": "0.
|
|
56
|
+
"@shivaedev/quality": "0.43.0",
|
|
57
|
+
"@shivaedev/test-sql": "0.10.2",
|
|
58
|
+
"@shivaedev/test-story": "0.22.0",
|
|
58
59
|
"@types/node": "24.19.2",
|
|
59
60
|
"@types/pg": "8.20.0",
|
|
60
|
-
"better-auth": "1.7.
|
|
61
|
+
"better-auth": "1.7.12",
|
|
61
62
|
"effect": "4.0.5",
|
|
62
63
|
"pg": "8.23.0",
|
|
63
64
|
"typescript": "7.0.2",
|
|
64
65
|
"vitest": "5.0.5"
|
|
65
66
|
},
|
|
66
67
|
"peerDependencies": {
|
|
67
|
-
"better-auth": "1.7.
|
|
68
|
+
"better-auth": "1.7.12",
|
|
68
69
|
"effect": "4.0.5",
|
|
69
70
|
"pg": "8.23.0"
|
|
70
71
|
},
|
package/src/middleware.ts
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { Schema } from "effect";
|
|
2
2
|
import { RpcMiddleware } from "effect/rpc";
|
|
3
|
+
import { MissingReadPolicy, QueryReadDenied } from "@shivaedev/contract/readPolicyErrors.ts";
|
|
3
4
|
import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
|
|
4
5
|
import type { Identity, OptionalIdentity, RequestId, SessionUser, SessionUserWithProviderAccounts } from "./identity.ts";
|
|
5
6
|
export class RequestTracing extends RpcMiddleware.Service<
|
|
@@ -14,25 +15,27 @@ export class Authenticated extends RpcMiddleware.Service<
|
|
|
14
15
|
provides: Identity;
|
|
15
16
|
}
|
|
16
17
|
>()("@shivaedev/identity/Authenticated", {
|
|
17
|
-
error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
|
|
18
|
+
error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden, MissingReadPolicy, QueryReadDenied]),
|
|
18
19
|
}) {}
|
|
19
20
|
export class MaybeAuthenticated extends RpcMiddleware.Service<
|
|
20
21
|
MaybeAuthenticated,
|
|
21
22
|
{
|
|
22
23
|
provides: OptionalIdentity;
|
|
23
24
|
}
|
|
24
|
-
>()("@shivaedev/identity/MaybeAuthenticated", {
|
|
25
|
+
>()("@shivaedev/identity/MaybeAuthenticated", {
|
|
26
|
+
error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden, MissingReadPolicy, QueryReadDenied]),
|
|
27
|
+
}) {}
|
|
25
28
|
export class AuthenticatedUser extends RpcMiddleware.Service<
|
|
26
29
|
AuthenticatedUser,
|
|
27
30
|
{
|
|
28
31
|
provides: Identity | SessionUser;
|
|
29
32
|
}
|
|
30
33
|
>()("@shivaedev/identity/AuthenticatedUser", {
|
|
31
|
-
error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
|
|
34
|
+
error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden, MissingReadPolicy, QueryReadDenied]),
|
|
32
35
|
}) {}
|
|
33
36
|
export class AuthenticatedUserWithProviderAccounts extends RpcMiddleware.Service<
|
|
34
37
|
AuthenticatedUserWithProviderAccounts,
|
|
35
38
|
{ provides: Identity | SessionUser | SessionUserWithProviderAccounts }
|
|
36
39
|
>()("@shivaedev/identity/AuthenticatedUserWithProviderAccounts", {
|
|
37
|
-
error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden]),
|
|
40
|
+
error: Schema.Union([Unauthorized, AuthUnavailable, Forbidden, MissingReadPolicy, QueryReadDenied]),
|
|
38
41
|
}) {}
|
package/src/permission.ts
CHANGED
|
@@ -1,10 +1,11 @@
|
|
|
1
1
|
import { Effect, Schema } from "effect";
|
|
2
2
|
import { RpcMiddleware } from "effect/rpc";
|
|
3
3
|
import type { Permission } from "@shivaedev/access/permission.ts";
|
|
4
|
+
import { MissingReadPolicy, QueryReadDenied } from "@shivaedev/contract/readPolicyErrors.ts";
|
|
4
5
|
import { AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
|
|
5
6
|
import { type Identity, SessionUser, type SessionUserValue } from "./identity.ts";
|
|
6
7
|
|
|
7
|
-
const Failures = Schema.Union([Unauthorized, AuthUnavailable, Forbidden]);
|
|
8
|
+
const Failures = Schema.Union([Unauthorized, AuthUnavailable, Forbidden, MissingReadPolicy, QueryReadDenied]);
|
|
8
9
|
|
|
9
10
|
export function permissionMiddleware<TSelf>() {
|
|
10
11
|
return <const TName extends string>(name: TName, permission: Permission) =>
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { Effect, Option, Predicate } from "effect";
|
|
2
2
|
import type { Headers } from "effect/http";
|
|
3
|
+
import * as HttpStatus from "effect/http/HttpStatus";
|
|
3
4
|
import { redact } from "@shivaedev/errors/redact.ts";
|
|
4
5
|
import { AuthUnavailable, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
|
|
5
6
|
import type { ProviderAccountValue } from "#identity.ts";
|
|
@@ -33,7 +34,7 @@ export function betterAuthSessions<TSession extends SessionShape>(getSession: Ge
|
|
|
33
34
|
}).pipe(
|
|
34
35
|
Effect.catch(
|
|
35
36
|
(cause): Effect.Effect<never, AuthUnavailable | Unauthorized> =>
|
|
36
|
-
Predicate.hasProperty(cause, "statusCode") && cause.statusCode ===
|
|
37
|
+
Predicate.hasProperty(cause, "statusCode") && cause.statusCode === HttpStatus.fromLiteral("Unauthorized")
|
|
37
38
|
? Effect.fail(new Unauthorized({ message: "Authentication required" }))
|
|
38
39
|
: unavailable(cause),
|
|
39
40
|
),
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
import { getIP } from "better-auth/api";
|
|
2
|
+
import { Option } from "effect";
|
|
3
|
+
import type { HttpServerRequest } from "effect/http";
|
|
4
|
+
import { trustedProxyPeer, trustedProxyRanges } from "#server/local.ts";
|
|
5
|
+
|
|
6
|
+
export const PEER_IP_HEADER = "x-platform-client-ip";
|
|
7
|
+
|
|
8
|
+
export function clientIpHeaders(options: {
|
|
9
|
+
readonly clientIpHeader: string;
|
|
10
|
+
readonly ipv6Subnet?: number | undefined;
|
|
11
|
+
readonly trustedProxy?: string | undefined;
|
|
12
|
+
}) {
|
|
13
|
+
const trustedPeer = trustedProxyPeer(options.trustedProxy);
|
|
14
|
+
const advanced = {
|
|
15
|
+
ipAddress: {
|
|
16
|
+
ipAddressHeaders: [options.clientIpHeader],
|
|
17
|
+
...(options.ipv6Subnet === undefined ? {} : { ipv6Subnet: options.ipv6Subnet }),
|
|
18
|
+
trustedProxies: trustedProxyRanges(options.trustedProxy),
|
|
19
|
+
},
|
|
20
|
+
};
|
|
21
|
+
return (request: HttpServerRequest.HttpServerRequest, web: Request) => {
|
|
22
|
+
web.headers.delete(PEER_IP_HEADER);
|
|
23
|
+
const trusted = Option.exists(request.remoteAddress, trustedPeer);
|
|
24
|
+
const forwardedIp = trusted ? getIP(web, { advanced }) : null;
|
|
25
|
+
if (!trusted) {
|
|
26
|
+
web.headers.delete("x-forwarded-for");
|
|
27
|
+
web.headers.delete(options.clientIpHeader);
|
|
28
|
+
}
|
|
29
|
+
const address = forwardedIp ?? Option.getOrUndefined(request.remoteAddress);
|
|
30
|
+
if (address !== undefined) {
|
|
31
|
+
web.headers.set(PEER_IP_HEADER, address);
|
|
32
|
+
}
|
|
33
|
+
};
|
|
34
|
+
}
|
|
@@ -4,12 +4,12 @@ import { Pool, type PoolClient, type PoolConfig } from "pg";
|
|
|
4
4
|
import type { RoleSet } from "@shivaedev/access/roleSet.ts";
|
|
5
5
|
import type { GetSession } from "#server/adapters/betterAuthSessions.ts";
|
|
6
6
|
import { type BearerSessionsOptions, sessionHeaders, withBearerSessions } from "#server/better-auth/bearerSessions.ts";
|
|
7
|
+
import { PEER_IP_HEADER } from "#server/better-auth/clientIp.ts";
|
|
7
8
|
import { memoryRateLimit } from "#server/better-auth/memoryRateLimit.ts";
|
|
8
9
|
import { mountRoutes } from "#server/better-auth/mountRoutes.ts";
|
|
9
10
|
import { type RevokeUnadmitted, revokeUnadmitted } from "#server/better-auth/revokeUnadmitted.ts";
|
|
10
11
|
import { type PolicyStorage, type SignInPolicy, signInGate } from "#server/better-auth/signInGate.ts";
|
|
11
12
|
import { signInPolicyOptions } from "#server/better-auth/signInPolicy.ts";
|
|
12
|
-
import { trustedProxyRanges } from "#server/local.ts";
|
|
13
13
|
import type { SessionShape } from "#server/session.ts";
|
|
14
14
|
import { mountedSessions } from "./mountedSessions.ts";
|
|
15
15
|
|
|
@@ -29,7 +29,6 @@ export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* <
|
|
|
29
29
|
const trustedProxy = Option.getOrUndefined(yield* Config.String("TRUSTED_PROXY").pipe(Config.option));
|
|
30
30
|
const clientIpHeader = yield* Config.String("AUTH_CLIENT_IP_HEADER").pipe(Config.withDefault("x-forwarded-for"));
|
|
31
31
|
const rateLimitEnabled = yield* Config.Boolean("AUTH_RATE_LIMIT_ENABLED").pipe(Config.withDefault(true));
|
|
32
|
-
const trustedProxies = trustedProxyRanges(trustedProxy);
|
|
33
32
|
const context = yield* Effect.context<R>();
|
|
34
33
|
const run = Effect.runPromiseWith(context);
|
|
35
34
|
const policy = mount.signIn ?? {};
|
|
@@ -48,14 +47,14 @@ export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* <
|
|
|
48
47
|
...options.advanced,
|
|
49
48
|
ipAddress: {
|
|
50
49
|
...options.advanced?.ipAddress,
|
|
51
|
-
ipAddressHeaders:
|
|
52
|
-
trustedProxies,
|
|
50
|
+
ipAddressHeaders: [PEER_IP_HEADER],
|
|
51
|
+
trustedProxies: [],
|
|
53
52
|
},
|
|
54
53
|
},
|
|
55
54
|
"baseURL":
|
|
56
55
|
options.baseURL
|
|
57
56
|
?? Option.getOrElse(origin, () => ({
|
|
58
|
-
allowedHosts: ["127.0.0.1:*"],
|
|
57
|
+
allowedHosts: ["127.0.0.1:*", "localhost:*"],
|
|
59
58
|
protocol: "http" as const,
|
|
60
59
|
})),
|
|
61
60
|
databaseHooks: gate.active ? gated.databaseHooks : options.databaseHooks,
|
|
@@ -65,12 +64,14 @@ export const betterAuthMount = Effect.fn("Platform.betterAuthMount")(function* <
|
|
|
65
64
|
enabled: rateLimitEnabled,
|
|
66
65
|
},
|
|
67
66
|
secret,
|
|
68
|
-
trustedOrigins:
|
|
67
|
+
trustedOrigins:
|
|
68
|
+
options.trustedOrigins ?? Option.match(origin, { onNone: () => ["http://127.0.0.1:*", "http://localhost:*"], onSome: (url) => [url] }),
|
|
69
69
|
user: gate.active ? gated.user : options.user,
|
|
70
70
|
});
|
|
71
71
|
const authRoutes = mountRoutes(auth, {
|
|
72
72
|
bearerSessions: mount.bearerSessions,
|
|
73
73
|
clientIpHeader,
|
|
74
|
+
ipv6Subnet: options.advanced?.ipAddress?.ipv6Subnet,
|
|
74
75
|
roles: mount.roles,
|
|
75
76
|
trustedProxy,
|
|
76
77
|
});
|
|
@@ -1,9 +1,10 @@
|
|
|
1
|
-
import { Effect
|
|
1
|
+
import { Effect } from "effect";
|
|
2
2
|
import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
|
|
3
|
+
import * as HttpStatus from "effect/http/HttpStatus";
|
|
3
4
|
import type { RoleSet } from "@shivaedev/access/roleSet.ts";
|
|
4
5
|
import { redact } from "@shivaedev/errors/redact.ts";
|
|
5
6
|
import { type BearerSessionsOptions, cookieSessionResponse, hasSessionCookie, sessionHeaders } from "#server/better-auth/bearerSessions.ts";
|
|
6
|
-
import {
|
|
7
|
+
import { clientIpHeaders } from "./clientIp.ts";
|
|
7
8
|
import { sessionPermissions } from "./sessionPermissions.ts";
|
|
8
9
|
|
|
9
10
|
interface MountedAuth {
|
|
@@ -13,6 +14,7 @@ interface MountedAuth {
|
|
|
13
14
|
interface MountRouteOptions {
|
|
14
15
|
readonly bearerSessions?: BearerSessionsOptions | undefined;
|
|
15
16
|
readonly clientIpHeader: string;
|
|
17
|
+
readonly ipv6Subnet?: number | undefined;
|
|
16
18
|
readonly roles?: RoleSet | undefined;
|
|
17
19
|
readonly trustedProxy?: string | undefined;
|
|
18
20
|
}
|
|
@@ -55,21 +57,24 @@ async function authResponse(auth: MountedAuth, web: Request, options: MountRoute
|
|
|
55
57
|
return sessionRequest && response.ok && options.roles !== undefined ? sessionPermissions(response, options.roles) : response;
|
|
56
58
|
}
|
|
57
59
|
export function mountRoutes(auth: MountedAuth, options: MountRouteOptions) {
|
|
58
|
-
const
|
|
60
|
+
const setClientIp = clientIpHeaders(options);
|
|
59
61
|
return HttpRouter.use((router) =>
|
|
60
62
|
router.add("*", "/api/auth/*", (request) =>
|
|
61
63
|
Effect.gen(function* () {
|
|
62
64
|
const web = yield* HttpServerRequest.toWeb(request);
|
|
63
|
-
|
|
64
|
-
web.headers.delete("x-forwarded-for");
|
|
65
|
-
web.headers.delete(options.clientIpHeader);
|
|
66
|
-
}
|
|
65
|
+
setClientIp(request, web);
|
|
67
66
|
return HttpServerResponse.fromWeb(
|
|
68
67
|
yield* Effect.tryPromise(() => authResponse(auth, web, options)).pipe(
|
|
69
68
|
Effect.tapError((error) => Effect.logError("Authentication provider failed", redact(error.cause))),
|
|
70
69
|
),
|
|
71
70
|
);
|
|
72
|
-
}).pipe(
|
|
71
|
+
}).pipe(
|
|
72
|
+
Effect.catch(() =>
|
|
73
|
+
Effect.succeed(
|
|
74
|
+
HttpServerResponse.text("Authentication is temporarily unavailable", { status: HttpStatus.fromLiteral("ServiceUnavailable") }),
|
|
75
|
+
),
|
|
76
|
+
),
|
|
77
|
+
),
|
|
73
78
|
),
|
|
74
79
|
);
|
|
75
80
|
}
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
import { Effect, Schema } from "effect";
|
|
2
|
+
import { SqlClient } from "effect/sql";
|
|
3
|
+
|
|
4
|
+
const SweepResult = Schema.Tuple([Schema.Struct({ removed: Schema.NumberFromString })]);
|
|
5
|
+
|
|
6
|
+
export const sweepExpiredSessions = Effect.gen(function* () {
|
|
7
|
+
const sql = yield* SqlClient.SqlClient;
|
|
8
|
+
const rows = yield* sql`with expired as (
|
|
9
|
+
delete from "session" where "expiresAt" <= now() returning 1
|
|
10
|
+
) select count(*)::text as removed from expired`;
|
|
11
|
+
const [result] = yield* Schema.decodeUnknownEffect(SweepResult)(rows);
|
|
12
|
+
return result.removed;
|
|
13
|
+
}).pipe(Effect.withSpan("Identity.sweepExpiredSessions"));
|