@voltro/protocol 0.32.0 → 0.34.0

package/dist/auth-CXMrvPyX.js

@@ -1,90 +0,0 @@
-import { Context as e, Schema as t } from "effect";
-import { RpcMiddleware as n } from "@effect/rpc";
-//#region src/auth.ts
-var r = t.Record({
-	key: t.String,
-	value: t.Unknown
-}), i = t.optional(t.Array(t.String)), a = t.Struct({
-	type: t.Literal("user"),
-	id: t.String,
-	tenantId: t.String,
-	scopes: i,
-	metadata: t.optional(r)
-}), o = t.Struct({
-	type: t.Literal("apiKey"),
-	id: t.String,
-	tenantId: t.String,
-	scopes: i,
-	metadata: t.optional(r)
-}), s = t.Struct({
-	type: t.Literal("serviceAccount"),
-	id: t.String,
-	tenantId: t.String,
-	scopes: i,
-	metadata: t.optional(r)
-}), c = t.Struct({
-	type: t.Literal("anonymous"),
-	id: t.Null,
-	tenantId: t.NullOr(t.String)
-}), l = t.Struct({
-	type: t.Literal("system"),
-	id: t.String,
-	tenantId: t.Null,
-	scopes: i,
-	metadata: t.optional(r)
-}), u = t.Union(a, o, s, c, l), d = (e) => ({
-	type: "anonymous",
-	id: null,
-	tenantId: e
-}), f = (e, t = ["admin:full"]) => ({
-	type: "system",
-	id: e,
-	tenantId: null,
-	scopes: t
-}), p = (e, t) => {
-	let n = e;
-	return {
-		type: "serviceAccount",
-		id: e.id ?? "system",
-		tenantId: t,
-		scopes: n.scopes ?? ["admin:full"],
-		...n.metadata === void 0 ? {} : { metadata: n.metadata }
-	};
-}, m = (e) => e.type === "system", h = class extends e.Tag("@voltro/Subject")() {}, g = class extends e.Tag("@voltro/ConnectionInfo")() {}, _ = class extends n.Tag()("@voltro/AuthMiddleware", { provides: h }) {}, v = class extends n.Tag()("@voltro/ConnectionInfoMiddleware", { provides: g }) {}, y = (e) => typeof e.mountRoutes == "function", b = (e, t) => {
-	if (t.length === 0) return e;
-	let n = [.../* @__PURE__ */ new Set([...e.scopes ?? [], ...t])];
-	return {
-		...e,
-		scopes: n
-	};
-}, x = (e, t) => async (n) => {
-	let r = t?.getStore?.(), i = r === void 0 ? n : {
-		...n,
-		store: r
-	};
-	for (let n of e) {
-		let e = await n.resolve(i);
-		if (e.kind === "matched") {
-			let n = t?.resolveScopes === void 0 ? e.subject : b(e.subject, await t.resolveScopes(e.subject, i));
-			return e.credentialExpiresAt === void 0 ? { subject: n } : {
-				subject: n,
-				credentialExpiresAt: e.credentialExpiresAt
-			};
-		}
-		if (e.kind === "failed") {
-			t?.onStrategyFailed?.({
-				strategyId: n.id,
-				reason: e.reason
-			});
-			break;
-		}
-	}
-	if (t?.fallback) return { subject: await t.fallback(i) };
-	let a = i.headers["x-tenant"] ?? null;
-	if (a === null && t?.anonymousTenantRequired === !0) throw new S({ reason: "tenant required (x-tenant header missing)" });
-	return { subject: d(a) };
-}, S = class extends t.TaggedError()("Unauthenticated", { reason: t.optional(t.String) }) {}, C = (e, t) => {
-	if (e.type === "anonymous") throw new S(t === void 0 ? {} : { reason: t });
-};
-//#endregion
-export { h as a, C as c, m as d, f, u as i, x as l, g as n, S as o, p, v as r, d as s, _ as t, y as u };

package/dist/serverErrorBus-C3JTqgIc.js

@@ -1,157 +0,0 @@
-import { Effect as e, Schema as t } from "effect";
-//#region src/scopes.ts
-var n = "admin:full", r = "apikeys:issue:self", i = "apikeys:issue:org", a = "apikeys:issue:other", o = class extends t.TaggedError()("ScopeError", {
-	required: t.String,
-	message: t.String
-}) {}, s = (e) => "scopes" in e && e.scopes ? e.scopes : [], c = /* @__PURE__ */ new WeakMap(), l = (e, t) => {
-	typeof e == "object" && e && c.set(e, t);
-}, u = (e) => {
-	if (typeof e == "object" && e) {
-		let t = c.get(e);
-		if (t) return t;
-	}
-	return s(e);
-}, d = (e, t) => {
-	let n = u(e);
-	return n.includes("admin:full") || n.includes(t);
-}, f = (e, t) => {
-	let n = s(e);
-	return n.includes("admin:full") || n.includes(t);
-}, p = (t, n) => d(t, n) ? e.void : e.fail(new o({
-	required: n,
-	message: `missing required scope '${n}'`
-})), m = (e) => typeof e.action == "string" && typeof e.resourceType == "string", h = (e) => typeof e == "string" ? [e] : e, g, _ = (e) => {
-	g = e;
-}, v = (e) => g === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !m(e) && e.resource !== void 0)).map((e) => e.tag) : [], y = (e) => [
-	`${e.length} procedure${e.length === 1 ? "" : "s"} declare a per-resource guard that nothing enforces:`,
-	...e.slice(0, 10).map((e) => `    ${e}`),
-	...e.length > 10 ? [`    … and ${e.length - 10} more`] : [],
-	"",
-	"  `guards: [{ scope, resource }]` reads as \"may you do this to THIS resource\",",
-	"  but with no resource-scope resolver registered the extractor is advisory and",
-	"  the check runs against the caller's GLOBAL scopes. For an app whose",
-	"  authorization is per-resource, that guard passes callers it should refuse.",
-	"",
-	"  Fix it one of two ways:",
-	"    • setResourceScopeResolver((req) => Effect<boolean>) — answers \"does this",
-	"      subject hold `req.scope` on `req.resource`\" from your own tables.",
-	"    • Drop the `resource` extractor if a global scope check is what you meant."
-].join("\n"), b = () => g, x, S = (e) => {
-	x = e;
-}, C = () => x, w = (e, t) => {
-	if (!t || t.length === 0) return null;
-	for (let n of t) {
-		if (m(n)) {
-			if (d(e, "admin:full")) continue;
-			return new o({
-				required: `${n.resourceType}:${n.action}`,
-				message: `relationship guard '${n.action}' on '${n.resourceType}' cannot be checked synchronously`
-			});
-		}
-		let t = h(n.scope);
-		if (t.length === 0) continue;
-		let r = t.filter((t) => d(e, t));
-		if (!((n.mode ?? "all") === "any" ? r.length > 0 : r.length === t.length)) {
-			let r = (n.mode ?? "all") === "any" ? t[0] : t.find((t) => !d(e, t));
-			return new o({
-				required: r,
-				message: (n.mode ?? "all") === "any" ? `missing all of required scopes [${t.join(", ")}]` : `missing required scope '${r}'`
-			});
-		}
-	}
-	return null;
-}, T = (t, n, r) => {
-	let i = (e) => new o({
-		required: `${n.resourceType}:${n.action}`,
-		message: e
-	});
-	if (d(t, "admin:full")) return e.succeed(null);
-	let a = x;
-	if (a === void 0) return e.succeed(i(`no policy resolver registered — cannot authorize '${n.action}' on '${n.resourceType}'`));
-	let s = n.resource(r);
-	return s === void 0 || s === "" ? e.succeed(i(`input does not identify a '${n.resourceType}' to authorize`)) : e.suspend(() => a({
-		subject: t,
-		action: n.action,
-		resourceType: n.resourceType,
-		resourceId: s
-	})).pipe(e.catchAllCause(() => e.succeed(!1)), e.map((e) => e ? null : i(`no '${n.action}' relation on ${n.resourceType}:${s}`)));
-}, E = (t, n, r) => {
-	if (!n || n.length === 0) return e.succeed(null);
-	let i = g;
-	return !n.some(m) && (!i || !n.some((e) => e.resource !== void 0)) ? e.succeed(w(t, n)) : e.gen(function* () {
-		for (let a of n) {
-			if (m(a)) {
-				let e = yield* T(t, a, r);
-				if (e) return e;
-				continue;
-			}
-			let n = h(a.scope);
-			if (n.length === 0) continue;
-			let s = a.resource ? a.resource(r) : void 0, c = [];
-			for (let r of n) {
-				if (d(t, r)) {
-					c.push(!0);
-					continue;
-				}
-				if (s !== void 0 && i !== void 0) {
-					let n = yield* e.suspend(() => i({
-						subject: t,
-						scope: r,
-						resource: s
-					})).pipe(e.catchAllCause(() => e.succeed(!1)));
-					c.push(n);
-				} else c.push(!1);
-			}
-			let l = a.mode ?? "all";
-			if (!(l === "any" ? c.some(Boolean) : c.every(Boolean))) {
-				let e = l === "any" ? n[0] : n[n.findIndex((e, t) => !c[t])];
-				return new o({
-					required: e,
-					message: l === "any" ? `missing all of required scopes [${n.join(", ")}]` : `missing required scope '${e}'` + (s === void 0 ? "" : ` on resource '${s}'`)
-				});
-			}
-		}
-		return null;
-	});
-}, D = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, O = (e, t, n) => `${e ?? "(global)"}|${t ?? "(anon)"}|WS|${n}`, k = async (e, t, n, r, i) => {
-	let a = await e.claim(t, n, i, r);
-	return a === "claimed" ? { kind: "fresh" } : a.status === "completed" && a.response ? {
-		kind: "replay",
-		response: a.response
-	} : { kind: "conflict" };
-}, A = (e, t, n, r, i) => e.complete(t, n, r, i), j = (e, t, n) => e.release(t, n), M = () => {
-	let e = /* @__PURE__ */ new Map(), t = (e, t) => `${e}\u0000${t}`;
-	return {
-		get: async (n, r) => e.get(t(n, r)) ?? null,
-		claim: async (n, r, i, a) => {
-			let o = e.get(t(n, r));
-			return o && i - o.createdAt < a ? o : (e.set(t(n, r), {
-				scope: n,
-				key: r,
-				status: "in_flight",
-				response: null,
-				createdAt: i
-			}), "claimed");
-		},
-		complete: async (n, r, i, a) => {
-			e.set(t(n, r), {
-				scope: n,
-				key: r,
-				status: "completed",
-				response: i,
-				createdAt: a
-			});
-		},
-		release: async (n, r) => {
-			e.delete(t(n, r));
-		}
-	};
-}, N = /* @__PURE__ */ new Set(), P = (e) => {
-	for (let t of N) try {
-		t(e);
-	} catch {}
-}, F = (e) => (N.add(e), () => {
-	N.delete(e);
-});
-//#endregion
-export { m as C, _ as D, S as E, s as O, f as S, l as T, u as _, A as a, b, O as c, a as d, r as f, E as g, w as h, j as i, n as l, y as m, F as n, D as o, o as p, k as r, M as s, P as t, i as u, v, p as w, d as x, C as y };