@uploadista/server 0.0.3

package/dist/auth/jwt/validate.test.js

@@ -0,0 +1,492 @@
+import { SignJWT } from "jose";
+import { describe, expect, it } from "vitest";
+import { extractAuthContextFromJwt, validateJwtToken } from "./validate";
+// Helper to create test JWTs
+async function createTestJWT(payload, secret, algorithm = "HS256", expiresIn = "1h") {
+    const secretKey = new TextEncoder().encode(secret);
+    const jwt = new SignJWT(payload)
+        .setProtectedHeader({ alg: algorithm })
+        .setIssuedAt();
+    if (expiresIn !== "none") {
+        if (expiresIn.endsWith("s")) {
+            const seconds = Number.parseInt(expiresIn.slice(0, -1));
+            jwt.setExpirationTime(Math.floor(Date.now() / 1000) + seconds);
+        }
+        else if (expiresIn.endsWith("m")) {
+            const minutes = Number.parseInt(expiresIn.slice(0, -1));
+            jwt.setExpirationTime(Math.floor(Date.now() / 1000) + minutes * 60);
+        }
+        else if (expiresIn.endsWith("h")) {
+            const hours = Number.parseInt(expiresIn.slice(0, -1));
+            jwt.setExpirationTime(Math.floor(Date.now() / 1000) + hours * 3600);
+        }
+    }
+    return await jwt.sign(secretKey);
+}
+// Helper to create expired JWT
+async function createExpiredJWT(payload, secret) {
+    const secretKey = new TextEncoder().encode(secret);
+    const jwt = new SignJWT(payload)
+        .setProtectedHeader({ alg: "HS256" })
+        .setIssuedAt()
+        .setExpirationTime(Math.floor(Date.now() / 1000) - 3600); // Expired 1 hour ago
+    return await jwt.sign(secretKey);
+}
+describe("validateJwtToken", () => {
+    const testSecret = "test-secret-key-min-32-chars-long";
+    const wrongSecret = "wrong-secret-key-min-32-chars-long";
+    describe("Valid token scenarios", () => {
+        it("should successfully validate a valid token with minimal claims", async () => {
+            const token = await createTestJWT({ sub: "user-123" }, testSecret, "HS256", "1h");
+            const result = await validateJwtToken(token, { secret: testSecret });
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.userId).toBe("user-123");
+                expect(result.claims.sub).toBe("user-123");
+            }
+        });
+        it("should successfully validate token with custom claims", async () => {
+            const token = await createTestJWT({
+                sub: "user-456",
+                role: "admin",
+                department: "engineering",
+                permissions: ["upload:create", "flow:execute"],
+            }, testSecret, "HS256", "1h");
+            const result = await validateJwtToken(token, { secret: testSecret });
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.userId).toBe("user-456");
+                expect(result.claims.role).toBe("admin");
+                expect(result.claims.department).toBe("engineering");
+                expect(result.claims.permissions).toEqual([
+                    "upload:create",
+                    "flow:execute",
+                ]);
+            }
+        });
+        it("should validate token with issuer when issuer matches", async () => {
+            const token = await createTestJWT({ sub: "user-789" }, testSecret, "HS256", "1h");
+            const jwt = new SignJWT({ sub: "user-789" })
+                .setProtectedHeader({ alg: "HS256" })
+                .setIssuer("https://auth.example.com")
+                .setIssuedAt()
+                .setExpirationTime(Math.floor(Date.now() / 1000) + 3600);
+            const tokenWithIssuer = await jwt.sign(new TextEncoder().encode(testSecret));
+            const result = await validateJwtToken(tokenWithIssuer, {
+                secret: testSecret,
+                issuer: "https://auth.example.com",
+            });
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.userId).toBe("user-789");
+            }
+        });
+        it("should validate token with audience when audience matches", async () => {
+            const jwt = new SignJWT({ sub: "user-101" })
+                .setProtectedHeader({ alg: "HS256" })
+                .setAudience("uploadista-api")
+                .setIssuedAt()
+                .setExpirationTime(Math.floor(Date.now() / 1000) + 3600);
+            const token = await jwt.sign(new TextEncoder().encode(testSecret));
+            const result = await validateJwtToken(token, {
+                secret: testSecret,
+                audience: "uploadista-api",
+            });
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.userId).toBe("user-101");
+            }
+        });
+        it("should validate token with HS256 algorithm when explicitly specified", async () => {
+            const token = await createTestJWT({ sub: "user-111" }, testSecret, "HS256", "1h");
+            const result = await validateJwtToken(token, {
+                secret: testSecret,
+                algorithms: ["HS256"],
+            });
+            expect(result.success).toBe(true);
+        });
+        it("should validate token with custom clock tolerance", async () => {
+            // Create a token that expires in 30 seconds
+            const jwt = new SignJWT({ sub: "user-222" })
+                .setProtectedHeader({ alg: "HS256" })
+                .setIssuedAt()
+                .setExpirationTime(Math.floor(Date.now() / 1000) + 30);
+            const token = await jwt.sign(new TextEncoder().encode(testSecret));
+            const result = await validateJwtToken(token, {
+                secret: testSecret,
+                clockTolerance: 120, // 2 minutes tolerance
+            });
+            expect(result.success).toBe(true);
+        });
+    });
+    describe("Expired token scenarios", () => {
+        it("should reject expired token", async () => {
+            const token = await createExpiredJWT({ sub: "user-expired" }, testSecret);
+            const result = await validateJwtToken(token, { secret: testSecret });
+            expect(result.success).toBe(false);
+            if (!result.success) {
+                expect(result.error.type).toBe("EXPIRED");
+                expect(result.error.message).toContain("expired");
+            }
+        });
+        it("should reject token expired beyond clock tolerance", async () => {
+            const token = await createExpiredJWT({ sub: "user-very-expired" }, testSecret);
+            const result = await validateJwtToken(token, {
+                secret: testSecret,
+                clockTolerance: 30, // 30 seconds tolerance, but token expired 1 hour ago
+            });
+            expect(result.success).toBe(false);
+            if (!result.success) {
+                expect(result.error.type).toBe("EXPIRED");
+            }
+        });
+    });
+    describe("Invalid signature scenarios", () => {
+        it("should reject token with invalid signature", async () => {
+            const token = await createTestJWT({ sub: "user-wrong-sig" }, testSecret, "HS256", "1h");
+            const result = await validateJwtToken(token, { secret: wrongSecret });
+            expect(result.success).toBe(false);
+            if (!result.success) {
+                expect(result.error.type).toBe("INVALID_SIGNATURE");
+                expect(result.error.message).toContain("signature");
+            }
+        });
+        it("should reject malformed token", async () => {
+            const result = await validateJwtToken("not.a.jwt", {
+                secret: testSecret,
+            });
+            expect(result.success).toBe(false);
+            if (!result.success) {
+                expect(result.error.type).toBe("INVALID_TOKEN");
+            }
+        });
+        it("should reject completely invalid token string", async () => {
+            const result = await validateJwtToken("invalid-token-string", {
+                secret: testSecret,
+            });
+            expect(result.success).toBe(false);
+            if (!result.success) {
+                expect(result.error.type).toBe("INVALID_TOKEN");
+            }
+        });
+    });
+    describe("Algorithm validation scenarios", () => {
+        it("should reject token with wrong algorithm when algorithms specified", async () => {
+            const token = await createTestJWT({ sub: "user-wrong-alg" }, testSecret, "HS256", "1h");
+            const result = await validateJwtToken(token, {
+                secret: testSecret,
+                algorithms: ["HS384", "HS512"], // Expecting HS384 or HS512, but token is HS256
+            });
+            expect(result.success).toBe(false);
+            if (!result.success) {
+                // jose's jwtVerify rejects with INVALID_TOKEN before algorithm check
+                expect(["INVALID_TOKEN", "INVALID_ALGORITHM"]).toContain(result.error.type);
+            }
+        });
+        it("should accept token with correct algorithm from allowed list", async () => {
+            const token = await createTestJWT({ sub: "user-correct-alg" }, testSecret, "HS256", "1h");
+            const result = await validateJwtToken(token, {
+                secret: testSecret,
+                algorithms: ["HS256", "HS384"],
+            });
+            expect(result.success).toBe(true);
+        });
+    });
+    describe("Issuer validation scenarios", () => {
+        it("should reject token with wrong issuer", async () => {
+            const jwt = new SignJWT({ sub: "user-wrong-iss" })
+                .setProtectedHeader({ alg: "HS256" })
+                .setIssuer("https://wrong-issuer.com")
+                .setIssuedAt()
+                .setExpirationTime(Math.floor(Date.now() / 1000) + 3600); // 1 hour from now
+            const token = await jwt.sign(new TextEncoder().encode(testSecret));
+            const result = await validateJwtToken(token, {
+                secret: testSecret,
+                issuer: "https://expected-issuer.com",
+            });
+            expect(result.success).toBe(false);
+            if (!result.success) {
+                expect(result.error.type).toBe("INVALID_ISSUER");
+                expect(result.error.message).toContain("issuer");
+            }
+        });
+    });
+    describe("Audience validation scenarios", () => {
+        it("should reject token with wrong audience", async () => {
+            const jwt = new SignJWT({ sub: "user-wrong-aud" })
+                .setProtectedHeader({ alg: "HS256" })
+                .setAudience("wrong-audience")
+                .setIssuedAt()
+                .setExpirationTime(Math.floor(Date.now() / 1000) + 3600); // 1 hour from now
+            const token = await jwt.sign(new TextEncoder().encode(testSecret));
+            const result = await validateJwtToken(token, {
+                secret: testSecret,
+                audience: "expected-audience",
+            });
+            expect(result.success).toBe(false);
+            if (!result.success) {
+                expect(result.error.type).toBe("INVALID_AUDIENCE");
+                expect(result.error.message).toContain("audience");
+            }
+        });
+    });
+    describe("Missing subject scenarios", () => {
+        it("should reject token without subject claim", async () => {
+            const jwt = new SignJWT({ role: "admin" }) // No 'sub' claim
+                .setProtectedHeader({ alg: "HS256" })
+                .setIssuedAt()
+                .setExpirationTime(Math.floor(Date.now() / 1000) + 3600);
+            const token = await jwt.sign(new TextEncoder().encode(testSecret));
+            const result = await validateJwtToken(token, { secret: testSecret });
+            expect(result.success).toBe(false);
+            if (!result.success) {
+                expect(result.error.type).toBe("MISSING_SUBJECT");
+                expect(result.error.message).toContain("sub");
+            }
+        });
+    });
+    describe("Edge cases", () => {
+        it("should handle Uint8Array secret", async () => {
+            const secretBytes = new TextEncoder().encode(testSecret);
+            const token = await createTestJWT({ sub: "user-bytes" }, testSecret, "HS256", "1h");
+            const result = await validateJwtToken(token, { secret: secretBytes });
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.userId).toBe("user-bytes");
+            }
+        });
+        it("should handle empty metadata gracefully", async () => {
+            const token = await createTestJWT({ sub: "user-empty" }, testSecret, "HS256", "1h");
+            const result = await validateJwtToken(token, { secret: testSecret });
+            expect(result.success).toBe(true);
+            if (result.success) {
+                expect(result.userId).toBe("user-empty");
+            }
+        });
+        it("should use default clock tolerance when not specified", async () => {
+            const token = await createTestJWT({ sub: "user-default" }, testSecret, "HS256", "1h");
+            const result = await validateJwtToken(token, { secret: testSecret });
+            expect(result.success).toBe(true);
+        });
+    });
+});
+describe("extractAuthContextFromJwt", () => {
+    const testSecret = "test-secret-key-min-32-chars-long";
+    describe("Successful extraction scenarios", () => {
+        it("should extract minimal AuthContext from valid token", async () => {
+            const token = await createTestJWT({ sub: "user-123" }, testSecret, "HS256", "1h");
+            const authContext = await extractAuthContextFromJwt(token, {
+                secret: testSecret,
+            });
+            expect(authContext).not.toBeNull();
+            expect(authContext?.userId).toBe("user-123");
+            expect(authContext?.metadata).toBeUndefined();
+            expect(authContext?.permissions).toBeUndefined();
+        });
+        it("should extract AuthContext with permissions from token", async () => {
+            const token = await createTestJWT({
+                sub: "user-456",
+                permissions: ["upload:create", "flow:execute", "admin:read"],
+            }, testSecret, "HS256", "1h");
+            const authContext = await extractAuthContextFromJwt(token, {
+                secret: testSecret,
+            });
+            expect(authContext).not.toBeNull();
+            expect(authContext?.userId).toBe("user-456");
+            expect(authContext?.permissions).toEqual([
+                "upload:create",
+                "flow:execute",
+                "admin:read",
+            ]);
+        });
+        it("should extract AuthContext with custom metadata", async () => {
+            const token = await createTestJWT({
+                sub: "user-789",
+                role: "admin",
+                department: "engineering",
+                tier: "premium",
+                customField: "custom-value",
+            }, testSecret, "HS256", "1h");
+            const authContext = await extractAuthContextFromJwt(token, {
+                secret: testSecret,
+            });
+            expect(authContext).not.toBeNull();
+            expect(authContext?.userId).toBe("user-789");
+            expect(authContext?.metadata).toEqual({
+                role: "admin",
+                department: "engineering",
+                tier: "premium",
+                customField: "custom-value",
+            });
+        });
+        it("should extract full AuthContext with both permissions and metadata", async () => {
+            const token = await createTestJWT({
+                sub: "user-full",
+                permissions: ["upload:create", "flow:execute"],
+                role: "admin",
+                department: "engineering",
+            }, testSecret, "HS256", "1h");
+            const authContext = await extractAuthContextFromJwt(token, {
+                secret: testSecret,
+            });
+            expect(authContext).not.toBeNull();
+            const ctx = authContext;
+            expect(ctx.userId).toBe("user-full");
+            expect(ctx.permissions).toEqual(["upload:create", "flow:execute"]);
+            expect(ctx.metadata).toEqual({
+                role: "admin",
+                department: "engineering",
+            });
+        });
+        it("should exclude standard JWT claims from metadata", async () => {
+            const jwt = new SignJWT({
+                sub: "user-standard",
+                role: "admin",
+                customClaim: "custom-value",
+            })
+                .setProtectedHeader({ alg: "HS256" })
+                .setIssuer("https://auth.example.com")
+                .setAudience("uploadista-api")
+                .setIssuedAt()
+                .setExpirationTime(Math.floor(Date.now() / 1000) + 3600)
+                .setJti("jwt-id-123");
+            const token = await jwt.sign(new TextEncoder().encode(testSecret));
+            const authContext = await extractAuthContextFromJwt(token, {
+                secret: testSecret,
+                issuer: "https://auth.example.com",
+                audience: "uploadista-api",
+            });
+            expect(authContext).not.toBeNull();
+            const ctx = authContext;
+            expect(ctx.userId).toBe("user-standard");
+            expect(ctx.metadata).toEqual({
+                role: "admin",
+                customClaim: "custom-value",
+            });
+            // Standard claims should not be in metadata
+            expect(ctx.metadata).not.toHaveProperty("iss");
+            expect(ctx.metadata).not.toHaveProperty("sub");
+            expect(ctx.metadata).not.toHaveProperty("aud");
+            expect(ctx.metadata).not.toHaveProperty("exp");
+            expect(ctx.metadata).not.toHaveProperty("iat");
+            expect(ctx.metadata).not.toHaveProperty("jti");
+        });
+        it("should handle empty metadata when only standard claims present", async () => {
+            const jwt = new SignJWT({ sub: "user-only-standard" })
+                .setProtectedHeader({ alg: "HS256" })
+                .setIssuedAt()
+                .setExpirationTime(Math.floor(Date.now() / 1000) + 3600);
+            const token = await jwt.sign(new TextEncoder().encode(testSecret));
+            const authContext = await extractAuthContextFromJwt(token, {
+                secret: testSecret,
+            });
+            expect(authContext).not.toBeNull();
+            const ctx = authContext;
+            expect(ctx.userId).toBe("user-only-standard");
+            expect(ctx.metadata).toBeUndefined();
+        });
+    });
+    describe("Failed extraction scenarios", () => {
+        it("should return null for invalid token", async () => {
+            const authContext = await extractAuthContextFromJwt("invalid.jwt.token", {
+                secret: testSecret,
+            });
+            expect(authContext).toBeNull();
+        });
+        it("should return null for expired token", async () => {
+            const token = await createExpiredJWT({ sub: "user-expired" }, testSecret);
+            const authContext = await extractAuthContextFromJwt(token, {
+                secret: testSecret,
+            });
+            expect(authContext).toBeNull();
+        });
+        it("should return null for token with wrong signature", async () => {
+            const token = await createTestJWT({ sub: "user-wrong" }, testSecret, "HS256", "1h");
+            const authContext = await extractAuthContextFromJwt(token, {
+                secret: "wrong-secret-key-min-32-chars-long",
+            });
+            expect(authContext).toBeNull();
+        });
+        it("should return null for token missing subject", async () => {
+            const jwt = new SignJWT({ role: "admin" })
+                .setProtectedHeader({ alg: "HS256" })
+                .setIssuedAt()
+                .setExpirationTime(Math.floor(Date.now() / 1000) + 3600);
+            const token = await jwt.sign(new TextEncoder().encode(testSecret));
+            const authContext = await extractAuthContextFromJwt(token, {
+                secret: testSecret,
+            });
+            expect(authContext).toBeNull();
+        });
+        it("should return null for token with wrong issuer", async () => {
+            const jwt = new SignJWT({ sub: "user-iss" })
+                .setProtectedHeader({ alg: "HS256" })
+                .setIssuer("https://wrong.com")
+                .setIssuedAt()
+                .setExpirationTime(Math.floor(Date.now() / 1000) + 3600);
+            const token = await jwt.sign(new TextEncoder().encode(testSecret));
+            const authContext = await extractAuthContextFromJwt(token, {
+                secret: testSecret,
+                issuer: "https://expected.com",
+            });
+            expect(authContext).toBeNull();
+        });
+        it("should return null for token with wrong audience", async () => {
+            const jwt = new SignJWT({ sub: "user-aud" })
+                .setProtectedHeader({ alg: "HS256" })
+                .setAudience("wrong-audience")
+                .setIssuedAt()
+                .setExpirationTime(Math.floor(Date.now() / 1000) + 3600);
+            const token = await jwt.sign(new TextEncoder().encode(testSecret));
+            const authContext = await extractAuthContextFromJwt(token, {
+                secret: testSecret,
+                audience: "expected-audience",
+            });
+            expect(authContext).toBeNull();
+        });
+    });
+    describe("Edge cases", () => {
+        it("should handle non-array permissions claim", async () => {
+            const token = await createTestJWT({
+                sub: "user-bad-perms",
+                permissions: "not-an-array", // Invalid permissions format
+            }, testSecret, "HS256", "1h");
+            const authContext = await extractAuthContextFromJwt(token, {
+                secret: testSecret,
+            });
+            expect(authContext).not.toBeNull();
+            const ctx = authContext;
+            expect(ctx.userId).toBe("user-bad-perms");
+            expect(ctx.permissions).toBeUndefined(); // Should be undefined since it's not an array
+        });
+        it("should handle complex metadata types", async () => {
+            const token = await createTestJWT({
+                sub: "user-complex",
+                nested: {
+                    level1: {
+                        level2: "deep-value",
+                    },
+                },
+                arrayField: [1, 2, 3],
+                boolField: true,
+                numberField: 42,
+            }, testSecret, "HS256", "1h");
+            const authContext = await extractAuthContextFromJwt(token, {
+                secret: testSecret,
+            });
+            expect(authContext).not.toBeNull();
+            const ctx = authContext;
+            expect(ctx.userId).toBe("user-complex");
+            expect(ctx.metadata).toEqual({
+                nested: {
+                    level1: {
+                        level2: "deep-value",
+                    },
+                },
+                arrayField: [1, 2, 3],
+                boolField: true,
+                numberField: 42,
+            });
+        });
+    });
+});

package/dist/auth/service.d.ts

@@ -0,0 +1,63 @@
+import { Context, Effect, Layer } from "effect";
+import type { AuthContext } from "./types";
+declare const AuthContextService_base: Context.TagClass<AuthContextService, "AuthContextService", {
+    /**
+     * Get the current client ID from auth context.
+     * Returns null if no authentication context is available.
+     */
+    readonly getClientId: () => Effect.Effect<string | null>;
+    /**
+     * Get the current auth metadata.
+     * Returns empty object if no authentication context or no metadata.
+     */
+    readonly getMetadata: () => Effect.Effect<Record<string, unknown>>;
+    /**
+     * Check if the current client has a specific permission.
+     * Returns false if no authentication context or permission not found.
+     */
+    readonly hasPermission: (permission: string) => Effect.Effect<boolean>;
+    /**
+     * Get the full authentication context if available.
+     * Returns null if no authentication context is available.
+     */
+    readonly getAuthContext: () => Effect.Effect<AuthContext | null>;
+}>;
+/**
+ * Authentication Context Service
+ *
+ * Provides access to the current authentication context throughout
+ * the upload and flow processing pipeline. The service is provided
+ * via Effect Layer and can be accessed using Effect.service().
+ *
+ * @example
+ * ```typescript
+ * import { Effect } from "effect";
+ * import { AuthContextService } from "@uploadista/server";
+ *
+ * const uploadHandler = Effect.gen(function* () {
+ *   const authService = yield* AuthContextService;
+ *   const clientId = yield* authService.getClientId();
+ *   if (clientId) {
+ *     console.log(`Processing upload for client: ${clientId}`);
+ *   }
+ * });
+ * ```
+ */
+export declare class AuthContextService extends AuthContextService_base {
+}
+/**
+ * Creates an AuthContextService Layer from an AuthContext.
+ * This is typically called by adapters after successful authentication.
+ *
+ * @param authContext - The authentication context from middleware
+ * @returns Effect Layer providing AuthContextService
+ */
+export declare const AuthContextServiceLive: (authContext: AuthContext | null) => Layer.Layer<AuthContextService>;
+/**
+ * No-auth implementation of AuthContextService.
+ * Returns null/empty values for all operations.
+ * Used when no authentication middleware is configured (backward compatibility).
+ */
+export declare const NoAuthContextServiceLive: Layer.Layer<AuthContextService>;
+export {};
+//# sourceMappingURL=service.d.ts.map

package/dist/auth/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/auth/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;;IA0BvC;;;OAGG;0BACmB,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;IAExD;;;OAGG;0BACmB,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAElE;;;OAGG;4BACqB,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAEtE;;;OAGG;6BACsB,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;;AA9CpE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,kBAAmB,SAAQ,uBA2BrC;CAAG;AAEN;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GACjC,aAAa,WAAW,GAAG,IAAI,KAC9B,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAO7B,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAAC,kBAAkB,CACvC,CAAC"}

package/dist/auth/service.js

@@ -0,0 +1,43 @@
+import { Context, Effect, Layer } from "effect";
+/**
+ * Authentication Context Service
+ *
+ * Provides access to the current authentication context throughout
+ * the upload and flow processing pipeline. The service is provided
+ * via Effect Layer and can be accessed using Effect.service().
+ *
+ * @example
+ * ```typescript
+ * import { Effect } from "effect";
+ * import { AuthContextService } from "@uploadista/server";
+ *
+ * const uploadHandler = Effect.gen(function* () {
+ *   const authService = yield* AuthContextService;
+ *   const clientId = yield* authService.getClientId();
+ *   if (clientId) {
+ *     console.log(`Processing upload for client: ${clientId}`);
+ *   }
+ * });
+ * ```
+ */
+export class AuthContextService extends Context.Tag("AuthContextService")() {
+}
+/**
+ * Creates an AuthContextService Layer from an AuthContext.
+ * This is typically called by adapters after successful authentication.
+ *
+ * @param authContext - The authentication context from middleware
+ * @returns Effect Layer providing AuthContextService
+ */
+export const AuthContextServiceLive = (authContext) => Layer.succeed(AuthContextService, {
+    getClientId: () => Effect.succeed(authContext?.clientId ?? null),
+    getMetadata: () => Effect.succeed(authContext?.metadata ?? {}),
+    hasPermission: (permission) => Effect.succeed(authContext?.permissions?.includes(permission) ?? false),
+    getAuthContext: () => Effect.succeed(authContext),
+});
+/**
+ * No-auth implementation of AuthContextService.
+ * Returns null/empty values for all operations.
+ * Used when no authentication middleware is configured (backward compatibility).
+ */
+export const NoAuthContextServiceLive = AuthContextServiceLive(null);

package/dist/auth/service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=service.test.d.ts.map

package/dist/auth/service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.test.d.ts","sourceRoot":"","sources":["../../src/auth/service.test.ts"],"names":[],"mappings":""}