@volter/twin-xidentity 0.1.1 → 0.1.2

package/dist/src/xidentity-server.js

@@ -10,8 +10,9 @@
 //   • it serves the authorize page's own assets under the twin-namespaced `/_twin/assets/*`.
 //
 // It also tells the handler its OWN origin, so the consent form's action points BACK AT THE TWIN.
-import { serveHttp } from '@volter/world-core';
+import { isReadOnlyRequest, serveHttp, withRequestScopes } from '@volter/world-core';
 import { CONSENT_CLIENT_CSS, CONSENT_CLIENT_JS, CONSENT_SCRIPT_PATH, CONSENT_STYLE_PATH } from "./xidentity-consent-ui.js";
+import { oauthError } from "./xidentity-problems.js";
 import { worldNow, statefulTwinManifest, twinPublicBase } from '@volter/world-core';
 import { handleXIdentityTwinRequest } from "./xidentity-twin.js";
 /**
@@ -28,8 +29,12 @@ import { handleXIdentityTwinRequest } from "./xidentity-twin.js";
  * plane by `scripts/consent-clients.ts`) — no build and no disk read on the fetch path.
  */
 export function createXIdentityTwinFetch(options = {}) {
-    const readOnly = options.readOnly ?? false;
-    return async function xIdentityTwinFetch(request) {
+    // a read-only request (x-volter-read-only, a World's read token) is a request to a read-only twin: the
+    // authorize screen never signs anyone in or mints a code, no token is minted or revoked, GET
+    // /2/users/me is served without spending the app's rate window (D3), and the kernel refuses any write
+    // that slips past as X's own flat OAuth error
+    return withRequestScopes(async function xIdentityTwinFetch(request) {
+        const readOnly = (options.readOnly ?? false) || isReadOnlyRequest(request);
         const url = new URL(request.url);
         // GET /twin — the discovery manifest (education inside the twin).
         if (request.method === 'GET' && url.pathname.replace(/\/+$/, '') === '/twin') {
@@ -67,7 +72,12 @@ export function createXIdentityTwinFetch(options = {}) {
         }
         out['content-type'] = out['content-type'] ?? 'application/json; charset=utf-8';
         return new Response(JSON.stringify(res.body), { status: res.status, headers: out });
-    };
+    }, {
+        refuse: () => {
+            const refused = oauthError('temporarily_unavailable', 'this request is read-only', 405);
+            return Response.json(refused.body, { status: refused.status, headers: refused.headers });
+        },
+    });
 }
 export async function createXIdentityTwinServer(options) {
     const server = await serveHttp({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-xidentity",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Local X (Twitter) identity twin — the real x.com authorize screen, the full OAuth 2.0 authorization-code + PKCE round trip (token, refresh, revoke), and GET /2/users/me with X's real field/expansion/problem envelopes, so an unmodified X client completes sign-in-with-X against it. Built on @volter/world-core.",
   "keywords": [
     "twin",
@@ -56,10 +56,10 @@
     "react-dom": "^19.2.7"
   },
   "peerDependencies": {
-    "@volter/world-core": "2.0.1"
+    "@volter/world-core": "2.0.2"
   },
   "devDependencies": {
-    "@volter/world-core": "2.0.1",
+    "@volter/world-core": "2.0.2",
     "@volter/world-tooling": "0.1.0",
     "@xdevplatform/xdk": "^0.6.6",
     "@types/bun": "^1.2.20",

package/src/xidentity-server.ts

@@ -10,8 +10,9 @@
 //   • it serves the authorize page's own assets under the twin-namespaced `/_twin/assets/*`.
 //
 // It also tells the handler its OWN origin, so the consent form's action points BACK AT THE TWIN.
-import { serveHttp } from '@volter/world-core';
+import { isReadOnlyRequest, serveHttp, withRequestScopes } from '@volter/world-core';
 import { CONSENT_CLIENT_CSS, CONSENT_CLIENT_JS, CONSENT_SCRIPT_PATH, CONSENT_STYLE_PATH } from './xidentity-consent-ui.ts';
+import { oauthError } from './xidentity-problems.ts';
 import { worldNow, statefulTwinManifest, twinPublicBase } from '@volter/world-core';
 import { handleXIdentityTwinRequest } from './xidentity-twin.ts';
 
@@ -35,8 +36,12 @@ export interface XIdentityTwinFetchOptions {
  * plane by `scripts/consent-clients.ts`) — no build and no disk read on the fetch path.
  */
 export function createXIdentityTwinFetch(options: XIdentityTwinFetchOptions = {}): (request: Request) => Promise<Response> {
-  const readOnly = options.readOnly ?? false;
-  return async function xIdentityTwinFetch(request: Request): Promise<Response> {
+  // a read-only request (x-volter-read-only, a World's read token) is a request to a read-only twin: the
+  // authorize screen never signs anyone in or mints a code, no token is minted or revoked, GET
+  // /2/users/me is served without spending the app's rate window (D3), and the kernel refuses any write
+  // that slips past as X's own flat OAuth error
+  return withRequestScopes(async function xIdentityTwinFetch(request: Request): Promise<Response> {
+    const readOnly = (options.readOnly ?? false) || isReadOnlyRequest(request);
     const url = new URL(request.url);
     // GET /twin — the discovery manifest (education inside the twin).
     if (request.method === 'GET' && url.pathname.replace(/\/+$/, '') === '/twin') {
@@ -77,7 +82,12 @@ export function createXIdentityTwinFetch(options: XIdentityTwinFetchOptions = {}
     }
     out['content-type'] = out['content-type'] ?? 'application/json; charset=utf-8';
     return new Response(JSON.stringify(res.body), { status: res.status, headers: out });
-  };
+  }, {
+    refuse: () => {
+      const refused = oauthError('temporarily_unavailable', 'this request is read-only', 405);
+      return Response.json(refused.body, { status: refused.status, headers: refused.headers });
+    },
+  });
 }
 
 export async function createXIdentityTwinServer(options: { root?: string; port?: number; readOnly?: boolean }): Promise<{ port: number; stop: () => void }> {