@spine-event-engine/auth 2.0.0-snapshot.2

package/dist/index.js

@@ -0,0 +1,56 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+import {} from "@spine-event-engine/proto/client";
+/**
+ * Builds the allowlisted transport facts used by authorization and diagnostics.
+ */
+export const TransportFacts = Object.freeze({
+    // prettier-ignore
+    /**
+     * Builds allowlisted facts while omitting credentials and unknown headers.
+     * @param input Supplies raw transport facts and optional headers.
+     * @returns Returns the safe transport context.
+     */
+    from(input) {
+        const headers = Object.fromEntries(Object.entries(input.headers ?? {})
+            .filter((entry) => entry[1] !== undefined)
+            .map(([name, value]) => [name.toLowerCase(), value]));
+        return TransportFactsValues.compact({
+            service: input.service,
+            method: input.method,
+            origin: input.origin,
+            requestId: headers["x-request-id"],
+            correlationId: headers["x-correlation-id"],
+            peerAddress: input.peerAddress,
+            userAgent: input.userAgent,
+        });
+    },
+});
+export { IncomingRequests } from "./request/index.js";
+const TransportFactsValues = Object.freeze({
+    compact(context) {
+        return Object.fromEntries(Object.entries(context).filter(([, value]) => value !== undefined));
+    },
+});
+export { UnaryGateway } from "./gateway/index.js";
+export { OpaqueSessionCookies } from "./sessions/cookies.js";
+export { OpaqueSessions } from "./sessions/opaque.js";
+export { SignedSessions } from "./sessions/signed.js";
+export { OidcFlow } from "./oidc/index.js";
+export { createGitHubProvider, createGoogleProvider, createOidcProvider, discoverOidcProvider, } from "./providers/index.js";
+export { InMemorySubscriptionBindings, SubscriptionGateway } from "./subscriptions/index.js";
+export { createNativeGatewayServices, NativeSubscriptionCreator, SubscriptionUpdateRelay, } from "./native/index.js";
+export { DynamicUnaryForwarder, } from "./gateway/dynamic-unary-forwarder.js";
+export { DynamicSubscriptionCreator } from "./gateway/dynamic-subscription-creator.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,OAAO,EAKN,MAAM,kCAAkC,CAAC;AA8hB1C;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAgC,MAAM,CAAC,MAAM,CAAC;IACvE,kBAAkB;IAElB;;;;OAIG;IACH,IAAI,CAAC,KAA0B;QAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;aAChC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;aACpE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC,CACvD,CAAC;QACF,OAAO,oBAAoB,CAAC,OAAO,CAAC;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC;YAClC,aAAa,EAAE,OAAO,CAAC,kBAAkB,CAAC;YAC1C,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,OAAO,CACL,OACqD;QAErD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAC7B,CAAC;IAC1C,CAAC;CACF,CAAC,CAAC;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAoF3B,OAAO,EACL,qBAAqB,GAGtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC"}

package/dist/native/index.d.ts

@@ -0,0 +1,182 @@
+import { type HandlerContext, type ServiceImpl, type Transport } from "@connectrpc/connect";
+import { CommandService, QueryService, SubscriptionService, type SubscriptionUpdate } from "@spine-event-engine/proto/client";
+import { AuthenticationService } from "@spine-event-engine/proto/auth";
+import type { UnaryForwarder, UnaryGateway } from "../gateway/index.js";
+import type { RequestCredential, TransportRequestContext } from "../index.js";
+import type { BackendSubscriptionEnvelope, PublicSubscriptionWire, SubscriptionAbortSignal, SubscriptionCreator, SubscriptionUpdateSink, SubscriptionUpdateWire, SubscriptionGateway } from "../subscriptions/index.js";
+/**
+ * Finite public-stream bounds. Defaults are 64 messages and 1,048,576 bytes;
+ * supplied bounds must be positive safe integers.
+ */
+export interface SubscriptionRelayLimits {
+    /**
+     * Limits the number of queued updates.
+     */
+    readonly maxMessages?: number;
+    /**
+     * Limits the total queued update bytes.
+     */
+    readonly maxBytes?: number;
+}
+/**
+ * A bounded asynchronous FIFO relay between one private backend stream and one public Connect stream.
+ */
+export declare class SubscriptionUpdateRelay implements AsyncIterable<SubscriptionUpdate> {
+    #private;
+    /**
+     * Creates a bounded FIFO relay.
+     * @param limits The optional message and byte bounds.
+     */
+    constructor(limits?: SubscriptionRelayLimits);
+    /**
+     * Copies and validates an update before FIFO admission. Count precedes bytes;
+     * either bound rejects with `ResourceExhausted`.
+     * @param update The update bytes to admit.
+     * @returns Completes after the update is admitted or rejected.
+     */
+    push(update: SubscriptionUpdateWire): Promise<void>;
+    /**
+     * Starts graceful FIFO drain; later cancellation or failure supersedes it and purges queued bytes.
+     */
+    close(): void;
+    /**
+     * Throws queued and future consumers, purging bytes.
+     * @param reason The terminal failure reason.
+     */
+    fail(reason: unknown): void;
+    /**
+     * Returns the public iterator; `return()` cancels it and purges queued bytes, while `throw()` fails it.
+     * @returns The single public update iterator.
+     */
+    [Symbol.asyncIterator](): AsyncIterator<SubscriptionUpdate>;
+}
+/**
+ * Native Connect adapter. Post/Read use their matching Command/Query descriptors;
+ * Subscribe/Activate/Cancel/Dispose use the shared Subscription descriptors.
+ * Every call receives only an admitted AbortSignal, never browser credentials or facts.
+ */
+export declare class NativeSubscriptionCreator implements SubscriptionCreator, UnaryForwarder {
+    #private;
+    /**
+     * Creates a native adapter over one Connect transport.
+     * @param transport The native Connect transport.
+     */
+    constructor(transport: Transport);
+    /**
+     * Sends an admitted Post or Read envelope through its matching native descriptor.
+     * @param request The admitted unary request envelope.
+     * @returns The encoded native response.
+     */
+    forward(request: {
+        readonly service: string;
+        readonly method: string;
+        readonly value: Uint8Array;
+        readonly signal?: AbortSignal;
+    }): Promise<Uint8Array>;
+    /**
+     * Creates a native subscription with the supplied admitted cancellation signal.
+     * @param request The admitted canonical subscription definition.
+     * @param signal The admitted cancellation signal.
+     * @returns The private backend subscription envelope.
+     */
+    subscribe(request: PublicSubscriptionWire, signal: SubscriptionAbortSignal): Promise<BackendSubscriptionEnvelope>;
+    /**
+     * Streams native Activate updates through the supplied asynchronous public-update sink.
+     * @param request The private native subscription envelope and update sink.
+     * @param signal The admitted cancellation signal.
+     * @returns Completes after native activation ends.
+     */
+    activate(request: {
+        readonly wire: BackendSubscriptionEnvelope;
+        readonly updates: SubscriptionUpdateSink;
+    }, signal: SubscriptionAbortSignal): Promise<void>;
+    /**
+     * Cancels the native subscription represented by the canonical definition.
+     * @param request The canonical subscription definition.
+     * @param signal The admitted cancellation signal.
+     * @returns Completes after native cancellation ends.
+     */
+    cancel(request: {
+        readonly wire: PublicSubscriptionWire;
+    }, signal: SubscriptionAbortSignal): Promise<void>;
+    /**
+     * Performs mandatory native cancellation/disposal compensation for a private envelope.
+     * @param envelope The private backend subscription envelope.
+     * @param signal The admitted cancellation signal.
+     * @returns Completes after native disposal ends.
+     */
+    dispose(envelope: BackendSubscriptionEnvelope, signal: SubscriptionAbortSignal): Promise<void>;
+}
+/**
+ * Application-owned extractor of browser credentials and allowlisted request facts from Connect context.
+ */
+export interface NativeGatewayRequestContext {
+    /**
+     * Reads credentials for the gateway only; they are never forwarded to native services.
+     * @param context The incoming Connect handler context.
+     * @returns The extracted request credential.
+     */
+    credential(context: HandlerContext): RequestCredential | undefined;
+    /**
+     * Reads the allowlisted authorization and diagnostic transport view for the gateway only.
+     * @param context The incoming Connect handler context.
+     * @returns The allowed transport facts.
+     */
+    transport(context: HandlerContext): TransportRequestContext;
+}
+/**
+ * B4 Connect services. Each handler delegates to the reviewed B2/B3 gateway boundary.
+ */
+export interface NativeGatewayServices {
+    /**
+     * Connect AuthenticationService implementation for informational context resolution.
+     */
+    readonly authentication: ServiceImpl<typeof AuthenticationService>;
+    /**
+     * Connect CommandService implementation whose Post handler delegates to the B2 unary gateway.
+     */
+    readonly command: ServiceImpl<typeof CommandService>;
+    /**
+     * Connect QueryService implementation whose Read handler delegates to the B2 unary gateway.
+     */
+    readonly query: ServiceImpl<typeof QueryService>;
+    /**
+     * Connect SubscriptionService implementation whose handlers delegate to the B3 subscription gateway.
+     */
+    readonly subscription: ServiceImpl<typeof SubscriptionService>;
+}
+/**
+ * Named options for {@link createNativeGatewayServices}.
+ */
+export interface NativeGatewayServicesOptions {
+    /**
+     * B2 Post/Read boundary.
+     */
+    readonly unary: UnaryGateway;
+    /**
+     * B3 Subscribe/Activate/Cancel boundary.
+     */
+    readonly subscriptions: SubscriptionGateway;
+    /**
+     * Application-owned context extractor.
+     */
+    readonly requests: NativeGatewayRequestContext;
+    /**
+     * Optional public relay bounds.
+     */
+    readonly relay?: SubscriptionRelayLimits;
+}
+/**
+ * Creates native handlers without exposing private envelopes.
+ *
+ * Unauthenticated requests map to `Unauthenticated`; forbidden or denied requests to
+ * `PermissionDenied`; request/capacity limits to `ResourceExhausted`; busy bindings to `Aborted`;
+ * and unknown operations to `Unimplemented`. Malformed, stale-context, backend-envelope, and other
+ * validation rejections map to `InvalidArgument`. Terminal context/iterator paths abort native
+ * work. Natural completion drains FIFO updates, whereas failure or iterator cancellation purges
+ * them.
+ * @param options The unary, subscription, context, and relay dependencies.
+ * @returns The native Connect service implementations.
+ */
+export declare function createNativeGatewayServices(options: NativeGatewayServicesOptions): NativeGatewayServices;
+//# sourceMappingURL=index.d.ts.map

package/dist/native/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/native/index.ts"],"names":[],"mappings":"AAeA,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,YAAY,EAIZ,mBAAmB,EAInB,KAAK,kBAAkB,EACxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAEvE,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAsB,MAAM,qBAAqB,CAAC;AAC5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,KAAK,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EAEpB,MAAM,2BAA2B,CAAC;AAEnC;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IAGtC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAOD;;GAEG;AACH,qBAAa,uBAAwB,YAAW,aAAa,CAAC,kBAAkB,CAAC;;IAW/E;;;OAGG;gBACS,MAAM,GAAE,uBAA4B;IAIhD;;;;;OAKG;IACH,IAAI,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCnD;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;;OAGG;IACH,IAAI,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAI3B;;;OAGG;IACH,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,kBAAkB,CAAC;CAiE5D;AAaD;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,mBAAmB,EAAE,cAAc;;IAGnF;;;OAGG;gBACS,SAAS,EAAE,SAAS;IAIhC;;;;OAIG;IACG,OAAO,CAAC,OAAO,EAAE;QACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;QAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;KAC/B,GAAG,OAAO,CAAC,UAAU,CAAC;IAoBvB;;;;;OAKG;IACG,SAAS,CACb,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,2BAA2B,CAAC;IAQvC;;;;;OAKG;IACG,QAAQ,CACZ,OAAO,EAAE;QACP,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;QAC3C,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;KAC1C,EACD,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC;IAYhB;;;;;OAKG;IACG,MAAM,CACV,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAA;KAAE,EAClD,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC;IAOhB;;;;;OAKG;IACG,OAAO,CACX,QAAQ,EAAE,2BAA2B,EACrC,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC;CAMjB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAG1C;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,iBAAiB,GAAG,SAAS,CAAC;IAEnE;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,uBAAuB,CAAC;CAC7D;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,OAAO,qBAAqB,CAAC,CAAC;IAEnE;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,cAAc,CAAC,CAAC;IAErD;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,OAAO,YAAY,CAAC,CAAC;IAEjD;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,OAAO,mBAAmB,CAAC,CAAC;CAChE;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAG3C;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;IAE/C;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,uBAAuB,CAAC;CAC1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,qBAAqB,CA0CvB"}