@stamprally/server 0.16.0 → 0.17.0

package/dist/index.d.cts

@@ -2,6 +2,16 @@ import * as _stamprally_core from '@stamprally/core';
 import { UserRallyState, AdminRallyConfig } from '@stamprally/core';
 export { UserRallyState } from '@stamprally/core';
 
+/** Authentication already verified by the host application's middleware. */
+interface TrustedAuthContext {
+    readonly authenticatedUserId: string;
+    readonly isAnonymous?: boolean;
+    readonly sessionId?: string;
+    readonly claims?: Record<string, unknown>;
+}
+/** @deprecated Use TrustedAuthContext. */
+type AuthenticationContext = TrustedAuthContext;
+
 interface UserClaimRecord {
     readonly rallyId: string;
     readonly userId: string;
@@ -39,6 +49,16 @@ interface ClaimRewardTransactionMutation {
     /** A domain rejection is committed as an audit/idempotency record without mutations. */
     readonly error?: string;
 }
+interface ClaimRewardMutationContext {
+    readonly rewardStock: number | null;
+    readonly sharedStock: number | null;
+    readonly primaryStock: number | null;
+    readonly secondaryStock: number | null;
+    /** @deprecated Use rewardStock. */
+    readonly stock: number | null;
+    readonly claimCount: number;
+    readonly userState: UserRallyState;
+}
 interface CheckInTransactionParams {
     readonly rallyId: string;
     readonly userId: string;
@@ -67,12 +87,7 @@ interface ServerPersistenceAdapter {
      * Atomically commits stock, user state, claim count, audit log, and idempotency data.
      * Adapters must roll back every write when the callback or any commit operation fails.
      */
-    executeClaimRewardTransaction(params: ClaimRewardTransactionParams, mutation: (current: {
-        readonly stock: number | null;
-        readonly secondaryStock: number | null;
-        readonly claimCount: number;
-        readonly userState: UserRallyState;
-    }) => ClaimRewardTransactionMutation): Promise<{
+    executeClaimRewardTransaction(params: ClaimRewardTransactionParams, mutation: (current: ClaimRewardMutationContext) => ClaimRewardTransactionMutation): Promise<{
         readonly success: boolean;
         readonly error?: string;
     }>;
@@ -101,7 +116,7 @@ interface InMemoryServerPersistenceOptions {
 }
 declare class InMemoryServerPersistenceAdapter implements ServerPersistenceAdapter {
     #private;
-    readonly supportsRewardStock = true;
+    readonly supportsRewardStock: boolean;
     constructor(options?: InMemoryServerPersistenceOptions);
     acquireLock(rallyId: string, key: string, ttlMs: number): Promise<boolean>;
     releaseLock(rallyId: string, key: string): Promise<void>;
@@ -111,12 +126,7 @@ declare class InMemoryServerPersistenceAdapter implements ServerPersistenceAdapt
         remainingStock: number;
     }>;
     restoreRewardStock(rallyId: string, rewardId: string, count?: number): Promise<void>;
-    executeClaimRewardTransaction(params: ClaimRewardTransactionParams, mutation: (current: {
-        readonly stock: number | null;
-        readonly secondaryStock: number | null;
-        readonly claimCount: number;
-        readonly userState: UserRallyState;
-    }) => ClaimRewardTransactionMutation): Promise<{
+    executeClaimRewardTransaction(params: ClaimRewardTransactionParams, mutation: (current: ClaimRewardMutationContext) => ClaimRewardTransactionMutation): Promise<{
         readonly success: boolean;
         readonly error?: string;
     }>;
@@ -175,11 +185,7 @@ interface SqlClaimRewardStore<Tx> {
  * while unexpected write failures reject the transaction and roll everything
  * back.
  */
-declare function executeClaimRewardTransaction<Tx>(database: SqlTransactionDatabase<Tx>, store: SqlClaimRewardStore<Tx>, params: ClaimRewardTransactionParams, mutation: (current: {
-    readonly stock: number | null;
-    readonly claimCount: number;
-    readonly userState: UserRallyState;
-}) => ClaimRewardTransactionMutation): Promise<{
+declare function executeClaimRewardTransaction<Tx>(database: SqlTransactionDatabase<Tx>, store: SqlClaimRewardStore<Tx>, params: ClaimRewardTransactionParams, mutation: (current: ClaimRewardMutationContext) => ClaimRewardTransactionMutation): Promise<{
     readonly success: boolean;
     readonly error?: string;
 }>;
@@ -263,8 +269,8 @@ declare class StampRallyServer {
     handleCheckIn(request: Request): Promise<Response>;
     handleClaimReward(request: Request): Promise<Response>;
     handleSync(request: Request): Promise<Response>;
-    checkIn(request: CheckInRequest): Promise<CheckInResponse>;
-    claimReward(request: ClaimRewardRequest): Promise<ClaimResponse>;
+    checkIn(request: CheckInRequest, authContext?: TrustedAuthContext): Promise<CheckInResponse>;
+    claimReward(request: ClaimRewardRequest, authContext?: TrustedAuthContext): Promise<ClaimResponse>;
     sync(rallyId: string, userId: string): Promise<UserRallyState>;
     syncProgress(request: {
         readonly rallyId: string;
@@ -323,13 +329,10 @@ type CheckInResponse = {
 interface ServerOptions {
     readonly lockTtlMs?: number;
     readonly idempotencyTtlMs?: number;
-    readonly authenticate?: (request: Request) => Promise<string | AuthenticationContext | null> | string | AuthenticationContext | null;
+    readonly authenticate?: (request: Request) => Promise<string | TrustedAuthContext | null> | string | TrustedAuthContext | null;
     readonly customValidators?: Readonly<Record<string, _stamprally_core.Validator>>;
     readonly now?: () => string;
     readonly anonymousPolicy?: "session_scoped" | "reject" | "shared_global_opt_in_insecure";
 }
-interface AuthenticationContext {
-    readonly authenticatedUserId: string;
-}
 
-export { type AuditLog, type AuthenticationContext, type CheckInRequest, type CheckInResponse, type CheckInTransactionMutation, type CheckInTransactionParams, type ClaimRewardRequest, type ClaimRewardTransactionMutation, type ClaimRewardTransactionParams, InMemoryServerPersistenceAdapter, type InMemoryServerPersistenceOptions, type RedisMultiExecutor, type RequestValidationError, RequestValidationException, type RequestValidationResult, type ServerOptions, type ServerPersistenceAdapter, type SqlCheckInStore, type SqlClaimRewardStore, type SqlTransactionDatabase, StampRallyServer, type SyncOperationStatus, type UserClaimRecord, assertValidCheckInParams, assertValidClaimParams, assertValidSyncParams, executeCheckInTransaction, executeClaimRewardTransaction, executeRedisTransaction, runPersistenceAdapterComplianceTests, validateCheckInRequest, validateClaimRewardRequest, validateSyncRequest };
+export { type AuditLog, type AuthenticationContext, type CheckInRequest, type CheckInResponse, type CheckInTransactionMutation, type CheckInTransactionParams, type ClaimRewardMutationContext, type ClaimRewardRequest, type ClaimRewardTransactionMutation, type ClaimRewardTransactionParams, InMemoryServerPersistenceAdapter, type InMemoryServerPersistenceOptions, type RedisMultiExecutor, type RequestValidationError, RequestValidationException, type RequestValidationResult, type ServerOptions, type ServerPersistenceAdapter, type SqlCheckInStore, type SqlClaimRewardStore, type SqlTransactionDatabase, StampRallyServer, type SyncOperationStatus, type TrustedAuthContext, type UserClaimRecord, assertValidCheckInParams, assertValidClaimParams, assertValidSyncParams, executeCheckInTransaction, executeClaimRewardTransaction, executeRedisTransaction, runPersistenceAdapterComplianceTests, validateCheckInRequest, validateClaimRewardRequest, validateSyncRequest };

package/dist/index.d.ts

@@ -2,6 +2,16 @@ import * as _stamprally_core from '@stamprally/core';
 import { UserRallyState, AdminRallyConfig } from '@stamprally/core';
 export { UserRallyState } from '@stamprally/core';
 
+/** Authentication already verified by the host application's middleware. */
+interface TrustedAuthContext {
+    readonly authenticatedUserId: string;
+    readonly isAnonymous?: boolean;
+    readonly sessionId?: string;
+    readonly claims?: Record<string, unknown>;
+}
+/** @deprecated Use TrustedAuthContext. */
+type AuthenticationContext = TrustedAuthContext;
+
 interface UserClaimRecord {
     readonly rallyId: string;
     readonly userId: string;
@@ -39,6 +49,16 @@ interface ClaimRewardTransactionMutation {
     /** A domain rejection is committed as an audit/idempotency record without mutations. */
     readonly error?: string;
 }
+interface ClaimRewardMutationContext {
+    readonly rewardStock: number | null;
+    readonly sharedStock: number | null;
+    readonly primaryStock: number | null;
+    readonly secondaryStock: number | null;
+    /** @deprecated Use rewardStock. */
+    readonly stock: number | null;
+    readonly claimCount: number;
+    readonly userState: UserRallyState;
+}
 interface CheckInTransactionParams {
     readonly rallyId: string;
     readonly userId: string;
@@ -67,12 +87,7 @@ interface ServerPersistenceAdapter {
      * Atomically commits stock, user state, claim count, audit log, and idempotency data.
      * Adapters must roll back every write when the callback or any commit operation fails.
      */
-    executeClaimRewardTransaction(params: ClaimRewardTransactionParams, mutation: (current: {
-        readonly stock: number | null;
-        readonly secondaryStock: number | null;
-        readonly claimCount: number;
-        readonly userState: UserRallyState;
-    }) => ClaimRewardTransactionMutation): Promise<{
+    executeClaimRewardTransaction(params: ClaimRewardTransactionParams, mutation: (current: ClaimRewardMutationContext) => ClaimRewardTransactionMutation): Promise<{
         readonly success: boolean;
         readonly error?: string;
     }>;
@@ -101,7 +116,7 @@ interface InMemoryServerPersistenceOptions {
 }
 declare class InMemoryServerPersistenceAdapter implements ServerPersistenceAdapter {
     #private;
-    readonly supportsRewardStock = true;
+    readonly supportsRewardStock: boolean;
     constructor(options?: InMemoryServerPersistenceOptions);
     acquireLock(rallyId: string, key: string, ttlMs: number): Promise<boolean>;
     releaseLock(rallyId: string, key: string): Promise<void>;
@@ -111,12 +126,7 @@ declare class InMemoryServerPersistenceAdapter implements ServerPersistenceAdapt
         remainingStock: number;
     }>;
     restoreRewardStock(rallyId: string, rewardId: string, count?: number): Promise<void>;
-    executeClaimRewardTransaction(params: ClaimRewardTransactionParams, mutation: (current: {
-        readonly stock: number | null;
-        readonly secondaryStock: number | null;
-        readonly claimCount: number;
-        readonly userState: UserRallyState;
-    }) => ClaimRewardTransactionMutation): Promise<{
+    executeClaimRewardTransaction(params: ClaimRewardTransactionParams, mutation: (current: ClaimRewardMutationContext) => ClaimRewardTransactionMutation): Promise<{
         readonly success: boolean;
         readonly error?: string;
     }>;
@@ -175,11 +185,7 @@ interface SqlClaimRewardStore<Tx> {
  * while unexpected write failures reject the transaction and roll everything
  * back.
  */
-declare function executeClaimRewardTransaction<Tx>(database: SqlTransactionDatabase<Tx>, store: SqlClaimRewardStore<Tx>, params: ClaimRewardTransactionParams, mutation: (current: {
-    readonly stock: number | null;
-    readonly claimCount: number;
-    readonly userState: UserRallyState;
-}) => ClaimRewardTransactionMutation): Promise<{
+declare function executeClaimRewardTransaction<Tx>(database: SqlTransactionDatabase<Tx>, store: SqlClaimRewardStore<Tx>, params: ClaimRewardTransactionParams, mutation: (current: ClaimRewardMutationContext) => ClaimRewardTransactionMutation): Promise<{
     readonly success: boolean;
     readonly error?: string;
 }>;
@@ -263,8 +269,8 @@ declare class StampRallyServer {
     handleCheckIn(request: Request): Promise<Response>;
     handleClaimReward(request: Request): Promise<Response>;
     handleSync(request: Request): Promise<Response>;
-    checkIn(request: CheckInRequest): Promise<CheckInResponse>;
-    claimReward(request: ClaimRewardRequest): Promise<ClaimResponse>;
+    checkIn(request: CheckInRequest, authContext?: TrustedAuthContext): Promise<CheckInResponse>;
+    claimReward(request: ClaimRewardRequest, authContext?: TrustedAuthContext): Promise<ClaimResponse>;
     sync(rallyId: string, userId: string): Promise<UserRallyState>;
     syncProgress(request: {
         readonly rallyId: string;
@@ -323,13 +329,10 @@ type CheckInResponse = {
 interface ServerOptions {
     readonly lockTtlMs?: number;
     readonly idempotencyTtlMs?: number;
-    readonly authenticate?: (request: Request) => Promise<string | AuthenticationContext | null> | string | AuthenticationContext | null;
+    readonly authenticate?: (request: Request) => Promise<string | TrustedAuthContext | null> | string | TrustedAuthContext | null;
     readonly customValidators?: Readonly<Record<string, _stamprally_core.Validator>>;
     readonly now?: () => string;
     readonly anonymousPolicy?: "session_scoped" | "reject" | "shared_global_opt_in_insecure";
 }
-interface AuthenticationContext {
-    readonly authenticatedUserId: string;
-}
 
-export { type AuditLog, type AuthenticationContext, type CheckInRequest, type CheckInResponse, type CheckInTransactionMutation, type CheckInTransactionParams, type ClaimRewardRequest, type ClaimRewardTransactionMutation, type ClaimRewardTransactionParams, InMemoryServerPersistenceAdapter, type InMemoryServerPersistenceOptions, type RedisMultiExecutor, type RequestValidationError, RequestValidationException, type RequestValidationResult, type ServerOptions, type ServerPersistenceAdapter, type SqlCheckInStore, type SqlClaimRewardStore, type SqlTransactionDatabase, StampRallyServer, type SyncOperationStatus, type UserClaimRecord, assertValidCheckInParams, assertValidClaimParams, assertValidSyncParams, executeCheckInTransaction, executeClaimRewardTransaction, executeRedisTransaction, runPersistenceAdapterComplianceTests, validateCheckInRequest, validateClaimRewardRequest, validateSyncRequest };
+export { type AuditLog, type AuthenticationContext, type CheckInRequest, type CheckInResponse, type CheckInTransactionMutation, type CheckInTransactionParams, type ClaimRewardMutationContext, type ClaimRewardRequest, type ClaimRewardTransactionMutation, type ClaimRewardTransactionParams, InMemoryServerPersistenceAdapter, type InMemoryServerPersistenceOptions, type RedisMultiExecutor, type RequestValidationError, RequestValidationException, type RequestValidationResult, type ServerOptions, type ServerPersistenceAdapter, type SqlCheckInStore, type SqlClaimRewardStore, type SqlTransactionDatabase, StampRallyServer, type SyncOperationStatus, type TrustedAuthContext, type UserClaimRecord, assertValidCheckInParams, assertValidClaimParams, assertValidSyncParams, executeCheckInTransaction, executeClaimRewardTransaction, executeRedisTransaction, runPersistenceAdapterComplianceTests, validateCheckInRequest, validateClaimRewardRequest, validateSyncRequest };

package/dist/index.js

@@ -5,7 +5,16 @@ async function executeClaimRewardTransaction(database, store, params2, mutation2
   try {
     return await database.transaction(async (transaction) => {
       const current = await store.readContext(transaction, params2);
-      const next = mutation2(current);
+      const secondaryStock = current.secondaryStock ?? null;
+      const rewardStock2 = params2.stockKey === "__shared__" ? secondaryStock : current.stock;
+      const next = mutation2({
+        ...current,
+        rewardStock: rewardStock2,
+        sharedStock: params2.stockKey === "__shared__" ? current.stock : null,
+        primaryStock: rewardStock2,
+        secondaryStock,
+        stock: current.stock
+      });
       if (next.error !== void 0) {
         await store.writeAudit(transaction, next.auditLog);
         if (params2.idempotencyKey !== void 0 && next.result !== void 0)
@@ -13,7 +22,7 @@ async function executeClaimRewardTransaction(database, store, params2, mutation2
         return { success: false, error: next.error };
       }
       if (next.nextSecondaryStock !== void 0 && store.writeSecondaryStock === void 0)
-        return { success: false, error: "INVENTORY_NOT_SUPPORTED" };
+        return { success: false, error: "INVENTORY_STORAGE_NOT_IMPLEMENTED" };
       if (next.nextStock !== null) await store.writeStock(transaction, params2, next.nextStock);
       if (next.nextSecondaryStock !== void 0 && store.writeSecondaryStock !== void 0) {
         if (next.nextSecondaryStock !== null)
@@ -144,9 +153,16 @@ var InMemoryServerPersistenceAdapter = class {
           params2.stockKey ?? params2.rewardId
         );
         const storedSecondaryStock = params2.secondaryStockKey === void 0 ? null : await this.getRewardStock(params2.rallyId, params2.secondaryStockKey);
+        const stock = storedStock ?? initialStock;
+        const secondaryStock = storedSecondaryStock ?? initialSecondaryStock;
+        const rewardStock2 = params2.stockKey === "__shared__" ? secondaryStock : stock;
+        const sharedStock2 = params2.stockKey === "__shared__" ? stock : null;
         const mutationResult = mutation2({
-          stock: storedStock ?? initialStock,
-          secondaryStock: storedSecondaryStock ?? initialSecondaryStock,
+          rewardStock: rewardStock2,
+          sharedStock: sharedStock2,
+          primaryStock: rewardStock2,
+          secondaryStock,
+          stock,
           claimCount: await this.getUserClaimCount(params2.rallyId, params2.userId, params2.rewardId),
           userState
         });
@@ -678,7 +694,18 @@ function operationStatus(result) {
   if (result.ok) return "ACCEPTED";
   return result.code === "CONFLICT" || result.code === "PERSISTENCE_FAILED" ? "RETRYABLE_ERROR" : "REJECTED_PERMANENT";
 }
-function withDirectIdentity(request) {
+function withDirectIdentity(request, authContext) {
+  if (authContext !== void 0) {
+    if (authContext.authenticatedUserId.trim() === "")
+      throw new RequestValidationException([
+        {
+          path: "authContext.authenticatedUserId",
+          message: "An authenticated userId is required.",
+          code: "REQUIRED"
+        }
+      ]);
+    return { ...request, userId: authContext.authenticatedUserId };
+  }
   if (request.userId !== void 0) return { ...request, userId: request.userId };
   if (request.anonymousSessionId !== void 0 && isUuidV4(request.anonymousSessionId))
     return { ...request, userId: request.anonymousSessionId };
@@ -808,8 +835,8 @@ var StampRallyServer = class {
       throw error;
     }
   }
-  async checkIn(request) {
-    const directRequest = withDirectIdentity(request);
+  async checkIn(request, authContext) {
+    const directRequest = withDirectIdentity(request, authContext);
     assertValidCheckInParams(directRequest, this.#config);
     const { userId } = directRequest;
     const key = `check-in:${request.rallyId}:${userId}:${request.idempotencyKey}`;
@@ -942,8 +969,8 @@ var StampRallyServer = class {
       await this.#persistence.releaseLock(request.rallyId, lockKey);
     }
   }
-  async claimReward(request) {
-    const directRequest = withDirectIdentity(request);
+  async claimReward(request, authContext) {
+    const directRequest = withDirectIdentity(request, authContext);
     assertValidClaimParams(directRequest, this.#config);
     const { userId } = directRequest;
     const key = `claim:${request.rallyId}:${userId}:${request.rewardId}:${request.idempotencyKey}`;
@@ -961,13 +988,14 @@ var StampRallyServer = class {
         now(this.#options)
       );
     const plan = inventoryPlan(this.#config, reward.id, reward.stockLimit);
-    if (rewardStock(this.#config, reward.id, reward.stockLimit) !== null && (this.#persistence.supportsRewardStock === false || typeof this.#persistence.getRewardStock !== "function"))
+    const inventoryEnabled = plan.primaryInitial !== null || plan.secondaryInitial !== void 0 && plan.secondaryInitial !== null;
+    if (inventoryEnabled && (this.#persistence.supportsRewardStock === false || typeof this.#persistence.getRewardStock !== "function" || typeof this.#persistence.executeClaimRewardTransaction !== "function"))
       return this.#rememberClaim(
         key,
         {
           ok: false,
-          code: "INVENTORY_NOT_SUPPORTED",
-          message: "This persistence adapter cannot store per-reward inventory."
+          code: "INVENTORY_STORAGE_NOT_IMPLEMENTED",
+          message: "This persistence adapter cannot atomically store inventory."
         },
         directRequest,
         now(this.#options)
@@ -1098,11 +1126,11 @@ var StampRallyServer = class {
       const response = responseHolder.value;
       if (!result.success) {
         if (response !== null && !response.ok && response.code === result.error) return response;
-        if (result.error === "INVENTORY_NOT_SUPPORTED")
+        if (result.error === "INVENTORY_STORAGE_NOT_IMPLEMENTED")
           return {
             ok: false,
-            code: "INVENTORY_NOT_SUPPORTED",
-            message: "This persistence adapter cannot store per-reward inventory."
+            code: "INVENTORY_STORAGE_NOT_IMPLEMENTED",
+            message: "This persistence adapter cannot atomically store inventory."
           };
         return {
           ok: false,
@@ -1310,6 +1338,15 @@ async function runPersistenceAdapterComplianceTests(createAdapter) {
     await adapter.getRewardStock("compliance-rally", "reward") === 0,
     "per-reward stock was not decremented atomically"
   );
+  const exhausted = await adapter.executeClaimRewardTransaction(
+    params("carol", "boundary"),
+    mutation
+  );
+  assert(!exhausted.success, "a zero-stock claim was accepted");
+  assert(
+    await adapter.getRewardStock("compliance-rally", "__shared__") === 0 && await adapter.getRewardStock("compliance-rally", "reward") === 0,
+    "zero-stock rejection did not preserve both stock boundaries"
+  );
   const idempotentAdapter = await createAdapter();
   const idempotentParams = params("alice", "same-key");
   const firstClaim = await idempotentAdapter.executeClaimRewardTransaction(
@@ -1325,6 +1362,10 @@ async function runPersistenceAdapterComplianceTests(createAdapter) {
     await idempotentAdapter.getRewardStock("compliance-rally", "__shared__") === 0,
     "idempotent retry decremented shared stock twice"
   );
+  assert(
+    await idempotentAdapter.getRewardStock("compliance-rally", "reward") === 0,
+    "idempotent retry decremented per-reward stock twice"
+  );
   const rollbackAdapter = await createAdapter();
   const rollbackParams = params("alice", "rollback");
   const rollback = await rollbackAdapter.executeClaimRewardTransaction(rollbackParams, () => {