@shivaedev/identity 0.2.0 → 0.3.1

package/src/server/adapters/betterAuthSessions.ts

@@ -1,5 +1,6 @@
 import { Effect, Option, Predicate } from "effect";
 import type { Headers } from "effect/http";
+import * as HttpStatus from "effect/http/HttpStatus";
 import { redact } from "@shivaedev/errors/redact.ts";
 import { AuthUnavailable, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
 import type { ProviderAccountValue } from "#identity.ts";
@@ -33,7 +34,7 @@ export function betterAuthSessions<TSession extends SessionShape>(getSession: Ge
 		}).pipe(
 			Effect.catch(
 				(cause): Effect.Effect<never, AuthUnavailable | Unauthorized> =>
-					Predicate.hasProperty(cause, "statusCode") && cause.statusCode === 401
+					Predicate.hasProperty(cause, "statusCode") && cause.statusCode === HttpStatus.fromLiteral("Unauthorized")
 						? Effect.fail(new Unauthorized({ message: "Authentication required" }))
 						: unavailable(cause),
 			),

package/src/server/better-auth/mountRoutes.ts

@@ -1,5 +1,6 @@
 import { Effect } from "effect";
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import * as HttpStatus from "effect/http/HttpStatus";
 import type { RoleSet } from "@shivaedev/access/roleSet.ts";
 import { redact } from "@shivaedev/errors/redact.ts";
 import { type BearerSessionsOptions, cookieSessionResponse, hasSessionCookie, sessionHeaders } from "#server/better-auth/bearerSessions.ts";
@@ -67,7 +68,13 @@ export function mountRoutes(auth: MountedAuth, options: MountRouteOptions) {
 						Effect.tapError((error) => Effect.logError("Authentication provider failed", redact(error.cause))),
 					),
 				);
-			}).pipe(Effect.catch(() => Effect.succeed(HttpServerResponse.text("Authentication is temporarily unavailable", { status: 503 })))),
+			}).pipe(
+				Effect.catch(() =>
+					Effect.succeed(
+						HttpServerResponse.text("Authentication is temporarily unavailable", { status: HttpStatus.fromLiteral("ServiceUnavailable") }),
+					),
+				),
+			),
 		),
 	);
 }

package/src/server/better-auth/sweepExpiredSessions.ts

@@ -0,0 +1,13 @@
+import { Effect, Schema } from "effect";
+import { SqlClient } from "effect/sql";
+
+const SweepResult = Schema.Tuple([Schema.Struct({ removed: Schema.NumberFromString })]);
+
+export const sweepExpiredSessions = Effect.gen(function* () {
+	const sql = yield* SqlClient.SqlClient;
+	const rows = yield* sql`with expired as (
+		delete from "session" where "expiresAt" <= now() returning 1
+	) select count(*)::text as removed from expired`;
+	const [result] = yield* Schema.decodeUnknownEffect(SweepResult)(rows);
+	return result.removed;
+}).pipe(Effect.withSpan("Identity.sweepExpiredSessions"));

package/src/server/better-auth/testDatabase.ts

@@ -3,9 +3,13 @@ import type { Pool } from "pg";
 
 export function authTestDatabase(pool: Pool) {
 	return {
-		expireSessions: Effect.tryPromise(async () => {
-			await pool.query('update "session" set "expiresAt" = now() - interval \'1 second\'');
-		}),
+		expireSessions: (userId?: string) =>
+			Effect.tryPromise(async () => {
+				await pool.query(
+					`update "session" set "expiresAt" = now() - interval '1 second'${userId === undefined ? "" : ' where "userId" = $1'}`,
+					userId === undefined ? [] : [userId],
+				);
+			}),
 		omitImageColumn: Effect.tryPromise(async () => {
 			await pool.query('alter table "user" drop column image');
 		}),

package/src/server/commandChanges.ts

@@ -2,21 +2,18 @@ import { Context, Effect, Option } from "effect";
 import * as Reactivity from "effect/reactivity/Reactivity";
 import type { Rpc } from "effect/rpc";
 import { SqlClient } from "effect/sql";
-import { invalidationKeys } from "@shivaedev/contract/keys.ts";
-import { CommandInvalidation, KeyScope } from "@shivaedev/contract/serverMetadata.ts";
+import { invalidationKeys } from "@shivaedev/changes/keys.ts";
+import { CurrentViewer } from "@shivaedev/contract/readPolicy.ts";
+import { CommandInvalidation } from "@shivaedev/contract/serverMetadata.ts";
 import { ChangeObserver, invalidateOnCommit, transact } from "@shivaedev/sql/transact.ts";
 import { sessionKeyContext } from "#server/sessionKeys.ts";
 
-export function sessionCommandChanges<A, E, R>(effect: Effect.Effect<A, E, R>, rpc: Rpc.AnyWithProps, payload: unknown) {
-	return Option.isSome(Context.getOption(rpc.annotations, KeyScope)) ? commandChanges(effect, rpc, payload) : effect;
-}
-
 export function commandChanges<A, E, R>(effect: Effect.Effect<A, E, R>, rpc: Rpc.AnyWithProps, payload: unknown) {
 	const invalidates = Context.getOption(rpc.annotations, CommandInvalidation);
 	if (Option.isNone(invalidates)) {
 		return effect;
 	}
-	const declared = invalidates.value;
+	const declared = invalidates.value.invalidates;
 	return Effect.gen(function* () {
 		const context = yield* sessionKeyContext(rpc);
 		const sql = yield* Effect.serviceOption(SqlClient.SqlClient);
@@ -36,7 +33,8 @@ export function commandChanges<A, E, R>(effect: Effect.Effect<A, E, R>, rpc: Rpc
 				return observer(event);
 			}),
 		);
-		const keys = invalidationKeys(declared(payload, result), context).filter((key) => !published.has(key));
+		const viewer = yield* CurrentViewer;
+		const keys = invalidationKeys(declared(payload, result, viewer), context).filter((key) => !published.has(key));
 		if (keys.length > 0) {
 			const announce = Option.isNone(sql)
 				? reactivity.value.invalidate(keys)

package/src/server/local.ts

@@ -1,5 +1,6 @@
 import { Effect, Option } from "effect";
 import { HttpServerRequest, HttpServerResponse, HttpTraceContext } from "effect/http";
+import * as HttpStatus from "effect/http/HttpStatus";
 import { RpcSerialization } from "effect/rpc";
 import { proxyAddresses, proxyMatches } from "./trustedProxy.ts";
 import { trustedProxyRanges as normalizedRanges } from "./trustedProxyRanges.ts";
@@ -40,7 +41,7 @@ export function loopbackOnly<E, R>(
 	return (request: HttpServerRequest.HttpServerRequest) =>
 		loopbackHost(request.headers.host) && Option.match(request.remoteAddress, { onNone: () => true, onSome: loopbackAddress })
 			? handler(request)
-			: Effect.succeed(HttpServerResponse.text("Only loopback hosts are served", { status: 403 }));
+			: Effect.succeed(HttpServerResponse.text("Only loopback hosts are served", { status: HttpStatus.fromLiteral("Forbidden") }));
 }
 export function trustedProxyPeer(trustedProxy?: string): (address: string) => boolean {
 	const addresses = trustedProxy === undefined ? undefined : proxyAddresses(trustedProxy);
@@ -86,7 +87,7 @@ export function localRpcGuard<E, R>(
 		const contentType = request.headers["content-type"]?.split(";")[0]?.trim().toLowerCase();
 		return allowed(request) && contentType === serialization.contentType
 			? yield* continueHttpTrace(effect, request)
-			: HttpServerResponse.text("Local same-origin requests only", { status: 403 });
+			: HttpServerResponse.text("Local same-origin requests only", { status: HttpStatus.fromLiteral("Forbidden") });
 	});
 }
 

package/src/server/permissions.ts

@@ -1,11 +1,14 @@
 import { Effect, Layer, Option } from "effect";
 import { type HttpServerRequest, HttpServerResponse } from "effect/http";
+import * as HttpStatus from "effect/http/HttpStatus";
 import type { RpcMiddleware } from "effect/rpc";
 import type { Permission } from "@shivaedev/access/permission.ts";
+import { authorizeReads } from "@shivaedev/contract/readPolicy.ts";
+import type { MissingReadPolicy, QueryReadDenied } from "@shivaedev/contract/readPolicyErrors.ts";
 import { type AuthUnavailable, Forbidden, type Unauthorized } from "@shivaedev/errors/taxonomy.ts";
 import { Identity, type SessionUser } from "#identity.ts";
 import { hasPermission, type permissionMiddleware, requirePermission } from "#permission.ts";
-import { sessionCommandChanges } from "#server/commandChanges.ts";
+import { commandChanges } from "#server/commandChanges.ts";
 import { revalidateStream } from "./revalidateStream.ts";
 import { resolveSession, type SessionPolicy, type UserSessionShape, withSessionUser } from "./session.ts";
 
@@ -14,16 +17,17 @@ export function permissionLayer<TMiddleware, TSession extends UserSessionShape>(
 	policy: SessionPolicy<TSession>,
 ) {
 	const permission = middleware.permission;
-	const guard: RpcMiddleware.RpcMiddleware<Identity | SessionUser, Unauthorized | AuthUnavailable | Forbidden, never> = (
-		effect,
-		{ headers, rpc, payload },
-	) => {
+	const guard: RpcMiddleware.RpcMiddleware<
+		Identity | SessionUser,
+		Unauthorized | AuthUnavailable | Forbidden | MissingReadPolicy | QueryReadDenied,
+		never
+	> = (effect, { headers, rpc, payload }) => {
 		const lookup = Effect.tap(resolveSession(policy, headers, rpc._tag), (session) =>
 			Option.isSome(session) && !hasPermission(session.value.user, permission)
 				? Effect.fail(new Forbidden({ message: `Permission required: ${permission.name} (${permission.strength})` }))
 				: Effect.void,
 		);
-		return sessionCommandChanges(effect, rpc, payload).pipe(
+		return Effect.flatMap(Identity, (viewer) => authorizeReads(commandChanges(effect, rpc, payload), { payload, rpc }, Option.some(viewer))).pipe(
 			(invocation) => Effect.flatMap(Identity, ({ id }) => invocation.pipe(revalidateStream(policy, rpc, id, lookup))),
 			(invocation) => Effect.andThen(requirePermission(permission), invocation),
 			withSessionUser(policy, headers, rpc._tag),
@@ -34,7 +38,11 @@ export function permissionLayer<TMiddleware, TSession extends UserSessionShape>(
 function rejection(error: Unauthorized | Forbidden | AuthUnavailable) {
 	return HttpServerResponse.empty({
 		headers: { "cache-control": "private, no-store" },
-		status: { AuthUnavailable: 503, Forbidden: 403, Unauthorized: 401 }[error._tag],
+		status: {
+			AuthUnavailable: HttpStatus.fromLiteral("ServiceUnavailable"),
+			Forbidden: HttpStatus.fromLiteral("Forbidden"),
+			Unauthorized: HttpStatus.fromLiteral("Unauthorized"),
+		}[error._tag],
 	});
 }
 

package/src/server/session.ts

@@ -2,6 +2,7 @@ import { Duration, Effect, Exit, Layer, Option } from "effect";
 import type { Headers } from "effect/http";
 import type { Permission } from "@shivaedev/access/permission.ts";
 import type { RoleSet } from "@shivaedev/access/roleSet.ts";
+import { authorizeReads } from "@shivaedev/contract/readPolicy.ts";
 import { type AuthUnavailable, Forbidden, Unauthorized } from "@shivaedev/errors/taxonomy.ts";
 import {
 	Identity,
@@ -12,7 +13,7 @@ import {
 	type SessionUserWithProviderAccountsValue,
 } from "#identity.ts";
 import { Authenticated, AuthenticatedUser, AuthenticatedUserWithProviderAccounts, MaybeAuthenticated } from "#middleware.ts";
-import { sessionCommandChanges } from "#server/commandChanges.ts";
+import { commandChanges } from "#server/commandChanges.ts";
 import { type OriginPolicy, originRequest } from "./origin.ts";
 import { resolveRole } from "./resolveRole.ts";
 import { revalidateStream } from "./revalidateStream.ts";
@@ -64,7 +65,7 @@ export function authenticatedLayer<TSession extends SessionShape>(policy: Sessio
 				return yield* new Unauthorized({ message: "Authentication required" });
 			}
 			const id = yield* identified(session.value.user.id);
-			return yield* sessionCommandChanges(effect, rpc, payload).pipe(
+			return yield* authorizeReads(commandChanges(effect, rpc, payload), { payload, rpc }, Option.some({ id })).pipe(
 				revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)),
 				Effect.provideService(Identity, { id }),
 				Effect.annotateLogs({ userId: id }),
@@ -73,14 +74,14 @@ export function authenticatedLayer<TSession extends SessionShape>(policy: Sessio
 	);
 }
 export function maybeAuthenticatedLayer<TSession extends SessionShape>(policy: SessionPolicy<TSession>): Layer.Layer<MaybeAuthenticated> {
-	return Layer.succeed(MaybeAuthenticated, (effect, { headers, rpc }) =>
+	return Layer.succeed(MaybeAuthenticated, (effect, { headers, rpc, payload }) =>
 		Effect.gen(function* () {
 			const session = yield* resolveSession(policy, headers, rpc._tag);
 			if (Option.isNone(session)) {
-				return yield* Effect.provideService(effect, OptionalIdentity, Option.none());
+				return yield* Effect.provideService(authorizeReads(effect, { payload, rpc }, Option.none()), OptionalIdentity, Option.none());
 			}
 			const id = yield* identified(session.value.user.id);
-			return yield* effect.pipe(
+			return yield* authorizeReads(effect, { payload, rpc }, Option.some({ id })).pipe(
 				revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)),
 				Effect.provideService(OptionalIdentity, Option.some({ id })),
 				Effect.annotateLogs({ userId: id }),
@@ -109,7 +110,7 @@ export function withSessionUser<TSession extends UserSessionShape>(policy: Sessi
 }
 export function authenticatedUserLayer<TSession extends UserSessionShape>(policy: SessionPolicy<TSession>): Layer.Layer<AuthenticatedUser> {
 	return Layer.succeed(AuthenticatedUser, (effect, { headers, rpc, payload }) =>
-		sessionCommandChanges(effect, rpc, payload).pipe(
+		Effect.flatMap(Identity, (viewer) => authorizeReads(commandChanges(effect, rpc, payload), { payload, rpc }, Option.some(viewer))).pipe(
 			(invocation) =>
 				Effect.flatMap(Identity, ({ id }) => invocation.pipe(revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)))),
 			withSessionUser(policy, headers, rpc._tag),
@@ -136,7 +137,7 @@ export function authenticatedUserWithProviderAccountsLayer<TSession extends Prov
 			);
 			const user = sessionProfile(session.value.user);
 			yield* identified(id);
-			return yield* sessionCommandChanges(effect, rpc, payload).pipe(
+			return yield* authorizeReads(commandChanges(effect, rpc, payload), { payload, rpc }, Option.some({ id })).pipe(
 				revalidateStream(policy, rpc, id, resolveSession(policy, headers, rpc._tag)),
 				Effect.provideService(Identity, { id }),
 				Effect.provideService(SessionUser, user),

package/src/server/sessionKeys.ts

@@ -1,7 +1,9 @@
 import { Context, Effect, Option } from "effect";
 import type { Rpc } from "effect/rpc";
-import type { KeyContext } from "@shivaedev/contract/keys.ts";
-import { ChangesReads, KeyScope, type QueryReference } from "@shivaedev/contract/serverMetadata.ts";
+import type { KeyContext } from "@shivaedev/changes/keys.ts";
+import { querySubscription } from "@shivaedev/contract/querySubscription.ts";
+import { CurrentViewer } from "@shivaedev/contract/readPolicy.ts";
+import { ChangesQueries, KeyScope, type QueryReference } from "@shivaedev/contract/serverMetadata.ts";
 import { Identity } from "#identity.ts";
 
 export function sessionKeyContext(rpc: Pick<Rpc.AnyWithProps, "annotations">): Effect.Effect<KeyContext | undefined> {
@@ -17,9 +19,11 @@ export function sessionKeyContext(rpc: Pick<Rpc.AnyWithProps, "annotations">): E
 	});
 }
 
-export function resolveChanges(rpc: Pick<Rpc.AnyWithProps, "annotations">, references: readonly QueryReference[]) {
-	return Effect.map(sessionKeyContext(rpc), (context) => ({
-		context,
-		keys: Context.getUnsafe(rpc.annotations, ChangesReads)(references),
-	}));
-}
+export const resolveChanges = Effect.fnUntraced(function* (rpc: Pick<Rpc.AnyWithProps, "annotations">, references: readonly QueryReference[]) {
+	const identity = yield* Effect.serviceOption(Identity);
+	const current = yield* CurrentViewer;
+	const viewer = Option.orElse(identity, () => current);
+	const queries = yield* Context.getUnsafe(rpc.annotations, ChangesQueries).resolve(references);
+	const subscription = yield* querySubscription(queries, viewer);
+	return { context: yield* sessionKeyContext(rpc), subscription };
+});