@travetto/auth-web 6.0.3 → 7.0.0-rc.1

package/README.md

@@ -107,10 +107,10 @@ export class AppConfig {
 }
 ```
 
-The symbol `FB_AUTH` is what will be used to reference providers at runtime.  This was chosen, over `class` references due to the fact that most providers will not be defined via a new class, but via an [@InjectableFactory](https://github.com/travetto/travetto/tree/main/module/di/src/decorator.ts#L70) method.
+The symbol `FB_AUTH` is what will be used to reference providers at runtime.  This was chosen, over `class` references due to the fact that most providers will not be defined via a new class, but via an [@InjectableFactory](https://github.com/travetto/travetto/tree/main/module/di/src/decorator.ts#L47) method.
 
 ## Maintaining Auth Context
-The [AuthContextInterceptor](https://github.com/travetto/travetto/tree/main/module/auth-web/src/interceptors/context.ts#L19) acts as the bridge between the [Authentication](https://github.com/travetto/travetto/tree/main/module/auth#readme "Authentication scaffolding for the Travetto framework") and [Web API](https://github.com/travetto/travetto/tree/main/module/web#readme "Declarative support for creating Web Applications") modules.  It serves to take an authenticated principal (via the [WebRequest](https://github.com/travetto/travetto/tree/main/module/web/src/types/request.ts#L11)/[WebResponse](https://github.com/travetto/travetto/tree/main/module/web/src/types/response.ts#L3)) and integrate it into the [AuthContext](https://github.com/travetto/travetto/tree/main/module/auth/src/context.ts#L14). Leveraging [WebAuthConfig](https://github.com/travetto/travetto/tree/main/module/auth-web/src/config.ts#L8)'s configuration allows for basic control of how the principal is encoded and decoded, primarily with the choice between using a header or a cookie, and which header, or cookie value is specifically referenced.  Additionally, the encoding process allows for auto-renewing of the token (on by default). The information is encoded into the [JWT](https://jwt.io/) appropriately, and when encoding using cookies, is also  set as the expiry time for the cookie.  
+The [AuthContextInterceptor](https://github.com/travetto/travetto/tree/main/module/auth-web/src/interceptors/context.ts#L20) acts as the bridge between the [Authentication](https://github.com/travetto/travetto/tree/main/module/auth#readme "Authentication scaffolding for the Travetto framework") and [Web API](https://github.com/travetto/travetto/tree/main/module/web#readme "Declarative support for creating Web Applications") modules.  It serves to take an authenticated principal (via the [WebRequest](https://github.com/travetto/travetto/tree/main/module/web/src/types/request.ts#L11)/[WebResponse](https://github.com/travetto/travetto/tree/main/module/web/src/types/response.ts#L3)) and integrate it into the [AuthContext](https://github.com/travetto/travetto/tree/main/module/auth/src/context.ts#L14). Leveraging [WebAuthConfig](https://github.com/travetto/travetto/tree/main/module/auth-web/src/config.ts#L8)'s configuration allows for basic control of how the principal is encoded and decoded, primarily with the choice between using a header or a cookie, and which header, or cookie value is specifically referenced.  Additionally, the encoding process allows for auto-renewing of the token (on by default). The information is encoded into the [JWT](https://jwt.io/) appropriately, and when encoding using cookies, is also  set as the expiry time for the cookie.  
 
 **Note for Cookie Use:** The automatic renewal, update, seamless receipt and transmission of the [Principal](https://github.com/travetto/travetto/tree/main/module/auth/src/types/principal.ts#L7) cookie act as a light-weight session.  Generally the goal is to keep the token as small as possible, but for small amounts of data, this pattern proves to be fairly sufficient at maintaining a decentralized state. 
 
@@ -287,7 +287,7 @@ export class SampleAuth {
 }
 ```
 
-[@Authenticated](https://github.com/travetto/travetto/tree/main/module/auth-web/src/decorator.ts#L29) and [@Unauthenticated](https://github.com/travetto/travetto/tree/main/module/auth-web/src/decorator.ts#L45) will simply enforce whether or not a user is logged in and throw the appropriate error messages as needed. Additionally, the [Principal](https://github.com/travetto/travetto/tree/main/module/auth/src/types/principal.ts#L7) is accessible as a resource that can be exposed as a [@ContextParam](https://github.com/travetto/travetto/tree/main/module/web/src/decorator/param.ts#L61) on an [@Injectable](https://github.com/travetto/travetto/tree/main/module/di/src/decorator.ts#L29) class.
+[@Authenticated](https://github.com/travetto/travetto/tree/main/module/auth-web/src/decorator.ts#L29) and [@Unauthenticated](https://github.com/travetto/travetto/tree/main/module/auth-web/src/decorator.ts#L45) will simply enforce whether or not a user is logged in and throw the appropriate error messages as needed. Additionally, the [Principal](https://github.com/travetto/travetto/tree/main/module/auth/src/types/principal.ts#L7) is accessible as a resource that can be exposed as a [@ContextParam](https://github.com/travetto/travetto/tree/main/module/web/src/decorator/param.ts#L66) on an [@Injectable](https://github.com/travetto/travetto/tree/main/module/di/src/decorator.ts#L15) class.
 
 ## Multi-Step Login
 When authenticating, with a multi-step process, it is useful to share information between steps.  The `authenticatorState` of [AuthContext](https://github.com/travetto/travetto/tree/main/module/auth/src/context.ts#L14) field is intended to be a location in which that information is persisted. Currently only [passport](http://passportjs.org) support is included, when dealing with multi-step logins. This information can also be injected into a web endpoint method, using the [AuthenticatorState](https://github.com/travetto/travetto/tree/main/module/auth/src/types/authenticator.ts#L9) type;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@travetto/auth-web",
-  "version": "6.0.3",
+  "version": "7.0.0-rc.1",
   "description": "Web authentication integration support for the Travetto framework",
   "keywords": [
     "authentication",
@@ -26,13 +26,13 @@
     "directory": "module/auth-web"
   },
   "dependencies": {
-    "@travetto/auth": "^6.0.1",
-    "@travetto/config": "^6.0.1",
-    "@travetto/web": "^6.0.3",
+    "@travetto/auth": "^7.0.0-rc.0",
+    "@travetto/config": "^7.0.0-rc.0",
+    "@travetto/web": "^7.0.0-rc.1",
     "njwt": "^2.0.1"
   },
   "peerDependencies": {
-    "@travetto/test": "^6.0.2"
+    "@travetto/test": "^7.0.0-rc.0"
   },
   "peerDependenciesMeta": {
     "@travetto/test": {

package/src/decorator.ts

@@ -1,4 +1,4 @@
-import { ControllerRegistry, EndpointDecorator } from '@travetto/web';
+import { ControllerRegistryIndex, EndpointDecorator } from '@travetto/web';
 
 import { AuthVerifyInterceptor } from './interceptors/verify.ts';
 import { AuthLoginInterceptor } from './interceptors/login.ts';
@@ -8,10 +8,10 @@ import { AuthLogoutInterceptor } from './interceptors/logout.ts';
  * Authenticate an endpoint with a list of available identity sources
  * @param source The symbol to target the specific authenticator
  * @param sources Additional providers to support
- * @augments `@travetto/auth:Authenticate`
+ * @kind decorator
  */
 export function Login(source: symbol, ...sources: symbol[]): EndpointDecorator {
-  return ControllerRegistry.createInterceptorConfigDecorator(AuthLoginInterceptor, {
+  return ControllerRegistryIndex.createInterceptorConfigDecorator(AuthLoginInterceptor, {
     providers: [source, ...sources],
     applies: true
   }, {
@@ -24,10 +24,10 @@ export function Login(source: symbol, ...sources: symbol[]): EndpointDecorator {
 /**
  * Ensure the controller/endpoint is authenticated, give a set of permissions
  * @param permissions Set of required/disallowed permissions
- * @augments `@travetto/auth:Authenticated`
+ * @kind decorator
  */
 export function Authenticated(permissions: string[] = []): EndpointDecorator {
-  return ControllerRegistry.createInterceptorConfigDecorator(AuthVerifyInterceptor, {
+  return ControllerRegistryIndex.createInterceptorConfigDecorator(AuthVerifyInterceptor, {
     state: 'authenticated',
     permissions,
     applies: true,
@@ -40,10 +40,10 @@ export function Authenticated(permissions: string[] = []): EndpointDecorator {
 
 /**
  * Require the controller/endpoint to be unauthenticated
- * @augments `@travetto/auth:Unauthenticated`
+ * @kind decorator
  */
 export function Unauthenticated(): EndpointDecorator {
-  return ControllerRegistry.createInterceptorConfigDecorator(AuthVerifyInterceptor, {
+  return ControllerRegistryIndex.createInterceptorConfigDecorator(AuthVerifyInterceptor, {
     state: 'unauthenticated',
     applies: true
   });
@@ -51,10 +51,10 @@ export function Unauthenticated(): EndpointDecorator {
 
 /**
  * Logs a user out of the auth state
- * @augments `@travetto/auth:Logout`
+ * @kind decorator
  */
 export function Logout(): EndpointDecorator {
-  return ControllerRegistry.createInterceptorConfigDecorator(AuthLogoutInterceptor, { applies: true }, {
+  return ControllerRegistryIndex.createInterceptorConfigDecorator(AuthLogoutInterceptor, { applies: true }, {
     responseContext: {
       isPrivate: true
     }

package/src/interceptors/context.ts

@@ -1,7 +1,8 @@
 import { toConcrete } from '@travetto/runtime';
 import { WebInterceptor, WebAsyncContext, WebInterceptorCategory, WebChainedContext, WebResponse } from '@travetto/web';
-import { Injectable, Inject, DependencyRegistry } from '@travetto/di';
+import { Injectable, Inject, DependencyRegistryIndex } from '@travetto/di';
 import { AuthContext, AuthService, AuthToken, Principal } from '@travetto/auth';
+import { Required } from '@travetto/schema';
 
 import { CommonPrincipalCodecSymbol, PrincipalCodec } from '../types.ts';
 import { WebAuthConfig } from '../config.ts';
@@ -20,7 +21,8 @@ export class AuthContextInterceptor implements WebInterceptor {
 
   category: WebInterceptorCategory = 'application';
 
-  @Inject({ optional: true })
+  @Inject()
+  @Required(false)
   codec: PrincipalCodec;
 
   @Inject()
@@ -36,7 +38,7 @@ export class AuthContextInterceptor implements WebInterceptor {
   webAsyncContext: WebAsyncContext;
 
   async postConstruct(): Promise<void> {
-    this.codec ??= await DependencyRegistry.getInstance(toConcrete<PrincipalCodec>(), CommonPrincipalCodecSymbol);
+    this.codec ??= await DependencyRegistryIndex.getInstance(toConcrete<PrincipalCodec>(), CommonPrincipalCodecSymbol);
     this.webAsyncContext.registerSource(toConcrete<Principal>(), () => this.authContext.principal);
     this.webAsyncContext.registerSource(toConcrete<AuthToken>(), () => this.authContext.authToken);
   }

package/src/internal/principal-schema.ts

@@ -1,5 +1,5 @@
-import { Schema, SchemaRegistry } from '@travetto/schema';
-import { toConcrete, AnyMap, asFull } from '@travetto/runtime';
+import { Schema, SchemaRegistryIndex } from '@travetto/schema';
+import { toConcrete, AnyMap } from '@travetto/runtime';
 import { Principal } from '@travetto/auth';
 
 @Schema()
@@ -13,7 +13,6 @@ export class PrincipalSchema implements Principal {
   permissions?: string[] | undefined;
 }
 
-SchemaRegistry.mergeConfigs(
-  asFull(SchemaRegistry.getOrCreatePending(toConcrete<Principal>())),
-  SchemaRegistry.getOrCreatePending(PrincipalSchema)
+SchemaRegistryIndex.getForRegister(toConcrete<Principal>()).register(
+  SchemaRegistryIndex.getConfig(PrincipalSchema)
 );

package/support/test/server.ts

@@ -3,7 +3,7 @@ import assert from 'node:assert';
 
 import { Controller, Get, WebHeaders, WebResponse, Post, Cookie, CookieJar } from '@travetto/web';
 import { Suite, Test } from '@travetto/test';
-import { DependencyRegistry, Inject, InjectableFactory } from '@travetto/di';
+import { DependencyRegistryIndex, Inject, InjectableFactory } from '@travetto/di';
 import { AuthenticationError, Authenticator, AuthContext, AuthConfig } from '@travetto/auth';
 
 import { InjectableSuite } from '@travetto/di/support/test/suite.ts';
@@ -235,7 +235,7 @@ export abstract class AuthWebServerSuite extends BaseWebSuite {
     assert(lastStatus === 200);
     assert(typeof body === 'string');
 
-    const codec = await DependencyRegistry.getInstance(JWTPrincipalCodec, CommonPrincipalCodecSymbol);
+    const codec = await DependencyRegistryIndex.getInstance(JWTPrincipalCodec, CommonPrincipalCodecSymbol);
     await assert.doesNotReject(() => codec.verify(body));
   }