@stamprally/server 0.20.0 → 0.21.0

package/README.md

@@ -1,4 +1,4 @@
-# @stamprally/server v0.20.0
+# @stamprally/server v0.21.0
 
 Web Standard `Request` / `Response` handlers for server-authoritative check-ins and reward claims.
 
@@ -33,9 +33,15 @@ timestamp, preserving FIFO order for equal timestamps, and returns
 `{ results, currentState, syncTimestamp }`. A permanently rejected
 operation does not stop unrelated operations; a later operation depending on that
 resource receives `REJECTED_PREREQUISITE_FAILED`. Retryable failures are returned
-as `FAILED_RETRYABLE` so the client can retain them for the next request.
+as `FAILED_RETRYABLE` so the client can retain them for the next request. The
+server catches unexpected exceptions at each operation boundary, returns the
+affected operation as `FAILED_RETRYABLE`, and continues independent operations.
 
-Direct server calls require a verified `TrustedAuthContext`:
+Direct `checkIn`, `claimReward`, and `syncProgress` calls accept a verified
+`TrustedAuthContext`, `{ userId: string }`, or a string `userId` for simplified
+trusted calls. The latter two forms are normalized to
+`{ authenticatedUserId: userId, isAnonymous: false }`; production integrations
+should pass `TrustedAuthContext` from authentication middleware:
 
 ```ts
 const progress = await server.syncProgress(

package/dist/index.cjs

@@ -641,6 +641,15 @@ function validateSyncRequest(value) {
     data: value
   };
 }
+
+// src/types.ts
+function normalizeAuthContext(auth) {
+  if (typeof auth === "string") return { authenticatedUserId: auth, isAnonymous: false };
+  if ("authenticatedUserId" in auth) return auth;
+  return { authenticatedUserId: auth.userId, isAnonymous: false };
+}
+
+// src/server.ts
 function json(body, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
@@ -791,8 +800,17 @@ function syncOperationResult(operation, userId, result) {
     reason: result.ok ? "The operation was rejected." : result.message
   };
 }
-function withDirectIdentity(request, authContext) {
-  if (authContext !== void 0) {
+function syncOperationError(operation, userId, error) {
+  return {
+    operationId: syncOperationId(operation, userId),
+    status: "FAILED_RETRYABLE",
+    resourceId: operation.kind === "checkIn" ? operation.request.spotId : operation.request.rewardId,
+    error: error instanceof Error ? error.message : "Unknown server error"
+  };
+}
+function withDirectIdentity(request, authInput) {
+  if (authInput !== void 0) {
+    const authContext = normalizeAuthContext(authInput);
     if (authContext.authenticatedUserId.trim() === "")
       throw new RequestValidationException([
         {
@@ -940,8 +958,8 @@ var StampRallyServer = class {
       throw error;
     }
   }
-  async checkIn(request, authContext) {
-    const directRequest = withDirectIdentity(request, authContext);
+  async checkIn(request, authInput) {
+    const directRequest = withDirectIdentity(request, authInput);
     assertValidCheckInParams(directRequest, this.#config);
     const { userId } = directRequest;
     const key = `check-in:${request.rallyId}:${userId}:${request.idempotencyKey}`;
@@ -1074,8 +1092,8 @@ var StampRallyServer = class {
       await this.#persistence.releaseLock(request.rallyId, lockKey);
     }
   }
-  async claimReward(request, authContext) {
-    const directRequest = withDirectIdentity(request, authContext);
+  async claimReward(request, authInput) {
+    const directRequest = withDirectIdentity(request, authInput);
     assertValidClaimParams(directRequest, this.#config);
     const { userId } = directRequest;
     const key = `claim:${request.rallyId}:${userId}:${request.rewardId}:${request.idempotencyKey}`;
@@ -1267,35 +1285,47 @@ var StampRallyServer = class {
     const state2 = await this.#persistence.getUserState(rallyId, userId) ?? initialState(this.#config, userId, now(this.#options));
     return this.#attachInventory(state2);
   }
-  async syncProgress(request, authContext) {
-    const directRequest = withDirectIdentity(request, authContext);
-    assertValidSyncParams(directRequest, this.#config);
+  async syncProgress(request, authInput) {
+    const directRequest = withDirectIdentity(request, authInput);
+    const authContext = normalizeAuthContext(authInput);
+    assertValidSyncParams(
+      {
+        rallyId: directRequest.rallyId,
+        userId: directRequest.userId,
+        ...directRequest.anonymousSessionId === void 0 ? {} : { anonymousSessionId: directRequest.anonymousSessionId }
+      },
+      this.#config
+    );
     const results = [];
     const rejectedCheckIns = /* @__PURE__ */ new Set();
     const operations = [...request.operations ?? []].map((operation, index) => ({ operation, index })).sort(
       (left, right) => operationTimestamp(left.operation) - operationTimestamp(right.operation) || left.index - right.index
     ).map(({ operation }) => operation);
     for (const operation of operations) {
-      const resourceId = operation.kind === "checkIn" ? operation.request.spotId : operation.request.rewardId;
-      if (operation.kind === "checkIn") {
-        const spot = this.#config.spots.find((candidate) => candidate.id === resourceId);
-        if (spot?.prerequisites?.some((prerequisite) => rejectedCheckIns.has(prerequisite))) {
-          results.push({
-            operationId: syncOperationId(operation, directRequest.userId),
-            status: "REJECTED_PERMANENT",
-            resourceId,
-            errorCode: "REJECTED_PREREQUISITE_FAILED",
-            reason: "A prerequisite operation was rejected by the server."
-          });
-          rejectedCheckIns.add(resourceId);
-          continue;
+      try {
+        const resourceId = operation.kind === "checkIn" ? operation.request.spotId : operation.request.rewardId;
+        if (operation.kind === "checkIn") {
+          const spot = this.#config.spots.find((candidate) => candidate.id === resourceId);
+          if (spot?.prerequisites?.some((prerequisite) => rejectedCheckIns.has(prerequisite))) {
+            results.push({
+              operationId: syncOperationId(operation, directRequest.userId),
+              status: "REJECTED_PERMANENT",
+              resourceId,
+              errorCode: "REJECTED_PREREQUISITE_FAILED",
+              reason: "A prerequisite operation was rejected by the server."
+            });
+            rejectedCheckIns.add(resourceId);
+            continue;
+          }
         }
+        const result = operation.kind === "checkIn" ? await this.checkIn(operation.request, authContext) : await this.claimReward(operation.request, authContext);
+        const operationResult = syncOperationResult(operation, directRequest.userId, result);
+        results.push(operationResult);
+        if (operation.kind === "checkIn" && operationResult.status === "REJECTED_PERMANENT")
+          rejectedCheckIns.add(resourceId);
+      } catch (error) {
+        results.push(syncOperationError(operation, directRequest.userId, error));
       }
-      const result = operation.kind === "checkIn" ? await this.checkIn(operation.request, authContext) : await this.claimReward(operation.request, authContext);
-      const operationResult = syncOperationResult(operation, directRequest.userId, result);
-      results.push(operationResult);
-      if (operation.kind === "checkIn" && operationResult.status === "REJECTED_PERMANENT")
-        rejectedCheckIns.add(resourceId);
     }
     const currentState = await this.sync(directRequest.rallyId, authContext);
     return {
@@ -1533,6 +1563,7 @@ exports.assertValidSyncParams = assertValidSyncParams;
 exports.executeCheckInTransaction = executeCheckInTransaction;
 exports.executeClaimRewardTransaction = executeClaimRewardTransaction;
 exports.executeRedisTransaction = executeRedisTransaction;
+exports.normalizeAuthContext = normalizeAuthContext;
 exports.runPersistenceAdapterComplianceTests = runPersistenceAdapterComplianceTests;
 exports.validateCheckInRequest = validateCheckInRequest;
 exports.validateClaimRewardRequest = validateClaimRewardRequest;