npm - @webpieces/http-routing - Versions diffs - 0.4.959 → 0.4.960 - Mend

@webpieces/http-routing 0.4.959 → 0.4.960

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/package.json +7 -7
package/src/AuthHooksCompileAssertions.js +7 -4
package/src/AuthHooksCompileAssertions.js.map +1 -1

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/http-routing",
-  "version": "0.4.959",
+  "version": "0.4.960",
   "description": "Decorator-based routing with auto-wiring for WebPieces",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -22,14 +22,14 @@
   },
   "dependencies": {
     "@inversifyjs/binding-decorators": "1.1.5",
-    "@webpieces/core-context": "0.4.959",
-    "@webpieces/core-util": "0.4.959",
-    "@webpieces/gcp-identity": "0.4.959",
+    "@webpieces/core-context": "0.4.960",
+    "@webpieces/core-util": "0.4.960",
+    "@webpieces/gcp-identity": "0.4.960",
     "inversify": "7.10.4",
     "jsonwebtoken": "9.0.2",
     "minimatch": "10.0.1",
-    "@webpieces/http-client-core": "0.4.959",
-    "@webpieces/http-client-node": "0.4.959",
-    "@webpieces/cloudtasks-client": "0.4.959"
+    "@webpieces/http-client-core": "0.4.960",
+    "@webpieces/http-client-node": "0.4.960",
+    "@webpieces/cloudtasks-client": "0.4.960"
   }
 }

package/src/AuthHooksCompileAssertions.js CHANGED Viewed

@@ -3,7 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthHooksCompileAssertions = void 0;
 const core_context_1 = require("@webpieces/core-context");
 const core_context_2 = require("@webpieces/core-context");
+// @ts-expect-error WEBHOOK_AUTH_CALLBACK is REPLACED by VENDOR_AUTH_HOOK.
 const AuthHooks_1 = require("./AuthHooks");
+const AuthHooks_2 = require("./AuthHooks");
 const AuthConfig_1 = require("./AuthConfig");
 /**
  * COMPILE-TIME assertions that the four auth hooks share ONE shape, and that every spelling this
@@ -33,6 +35,7 @@ class AuthHooksCompileAssertions {
         void headerReaderIsGone;
         void authValuesIsGone;
         void webhookAuthCallbackIsGone;
+        void AuthHooks_1.WEBHOOK_AUTH_CALLBACK;
     }
     /** The ALIGNED spellings must keep compiling; asserted by the ABSENCE of an error. */
     legitimate() {
@@ -49,7 +52,7 @@ class AuthHooksCompileAssertions {
                 return new AuthConfig_1.AuthenticatedCaller(`sentry:${bytes.length}`);
             }
         };
-        void class extends AuthHooks_1.ApiKeyHook {
+        void class extends AuthHooks_2.ApiKeyHook {
             async verifyApiKey(_name, request) {
                 // Both of these were UNREACHABLE through the deleted one-method HeaderReader.
                 const all = request.getHeaderValues('x-api-key');
@@ -92,20 +95,20 @@ class AuthHooksCompileAssertions {
      * must not compile.
      */
     oidcHookTakesTheMethods() {
-        void class extends AuthHooks_1.OidcHook {
+        void class extends AuthHooks_2.OidcHook {
             async verifyOidc(_token, methods) {
                 const first = methods[0];
                 const named = first.callerScope === 'services' ? first.callers[0] : 'same-project';
                 return new AuthConfig_1.AuthenticatedMachineIdentity('oidc', named);
             }
         };
-        void class extends AuthHooks_1.OidcHook {
+        void class extends AuthHooks_2.OidcHook {
             // @ts-expect-error verifyOidc takes the endpoint's OidcAuthMethods; the deleted caller-list override must not compile
             async verifyOidc(_token, _callers) {
                 return new AuthConfig_1.AuthenticatedMachineIdentity('oidc', 'caller@example.test');
             }
         };
-        void class extends AuthHooks_1.OidcHook {
+        void class extends AuthHooks_2.OidcHook {
             // @ts-expect-error verifyOidc takes every OIDC method of the endpoint, not one, so a pair is verified once
             async verifyOidc(_token, _method) {
                 return new AuthConfig_1.AuthenticatedMachineIdentity('oidc', 'caller@example.test');

package/src/AuthHooksCompileAssertions.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AuthHooksCompileAssertions.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/AuthHooksCompileAssertions.ts"],"names":[],"mappings":";;;AAAA,0DAAkF;AAOlF,0DAAyD;AAGzD,2CAAmD;AACnD,6CAAiF;AAEjF;;;;;;;;;;;;;GAaG;AACH,MAAa,0BAA0B;IACnC;;;;OAIG;IACH,wIAAwI;IACxI,YAAY;QACR,MAAM,kBAAkB,GAA6B,SAAS,CAAC;QAC/D,MAAM,gBAAgB,GAA2B,SAAS,CAAC;QAC3D,MAAM,yBAAyB,GAAoC,SAAS,CAAC;QAC7E,KAAK,kBAAkB,CAAC;QACxB,KAAK,gBAAgB,CAAC;QACtB,KAAK,yBAAyB,CAAC;IACnC,CAAC;IAED,sFAAsF;IACtF,UAAU;QACN,KAAK,KAAM,SAAQ,6BAAc;YACpB,KAAK,CAAC,IAAI;gBACf,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;YACpD,CAAC;YAEQ,KAAK,CAAC,OAAO;gBAClB,8BAA8B;YAClC,CAAC;YAEQ,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAAuB;gBACxD,oFAAoF;gBACpF,MAAM,KAAK,GAAW,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBAC1C,OAAO,IAAI,gCAAmB,CAAC,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7D,CAAC;SACJ,CAAC;QACF,KAAK,KAAM,SAAQ,sBAAU;YAChB,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,OAAoB;gBAC3D,8EAA8E;gBAC9E,MAAM,GAAG,GAAyB,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;gBACvE,OAAO,IAAI,gCAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC;YAC5D,CAAC;SACJ,CAAC;IACN,CAAC;IAED,iEAAiE;IACjE,QAAQ;QACJ,KAAK,KAAM,SAAQ,6BAAc;YACpB,KAAK,CAAC,IAAI;gBACf,OAAO,IAAI,GAAG,EAAE,CAAC;YACrB,CAAC;YAEQ,KAAK,CAAC,OAAO;gBAClB,8BAA8B;YAClC,CAAC;YAED,6FAA6F;YACpF,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAqB,EAAE,IAAgB;gBACxE,OAAO,IAAI,gCAAmB,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;SACJ,CAAC;QACF,KAAK,KAAM,SAAQ,6BAAc;YACpB,KAAK,CAAC,IAAI;gBACf,OAAO,IAAI,GAAG,EAAE,CAAC;YACrB,CAAC;YAEQ,KAAK,CAAC,OAAO;gBAClB,8BAA8B;YAClC,CAAC;YAED,yFAAyF;YAChF,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAwB;gBACzD,iEAAiE;YACrE,CAAC;SACJ,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACH,uBAAuB;QACnB,KAAK,KAAM,SAAQ,oBAAQ;YACd,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAAwB;gBAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBACzB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;gBACnF,OAAO,IAAI,yCAA4B,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3D,CAAC;SACJ,CAAC;QACF,KAAK,KAAM,SAAQ,oBAAQ;YACvB,sHAAsH;YAC7G,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,QAAkB;gBACxD,OAAO,IAAI,yCAA4B,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;YAC3E,CAAC;SACJ,CAAC;QACF,KAAK,KAAM,SAAQ,oBAAQ;YACvB,2GAA2G;YAClG,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAAuB;gBAC7D,OAAO,IAAI,yCAA4B,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;YAC3E,CAAC;SACJ,CAAC;IACN,CAAC;IAED;;;OAGG;IACH,gBAAgB;QACZ,MAAM,QAAQ,GAAG,IAAI,0BAAW,CAAC,MAAM,EAAE,oBAAoB,EAAE,IAAI,GAAG,EAAoB,CAAC,CAAC;QAC5F,0FAA0F;QAC1F,MAAM,QAAQ,GAAmB,QAAQ,CAAC;QAC1C,KAAK,QAAQ,CAAC;QAEd,4FAA4F;QAC5F,MAAM,MAAM,GAAG,IAAI,0BAAW,CAC1B,MAAM,EACN,oBAAoB,EACpB,IAAI,GAAG,EAAoB,EAC3B,IAAI,yBAAU,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CACjE,CAAC;QACpB,MAAM,OAAO,GAAgB,MAAM,CAAC;QACpC,KAAK,OAAO,CAAC;IACjB,CAAC;CACJ;AA3HD,gEA2HC","sourcesContent":["import { HttpRequest, RawHttpRequest, RawRequest } from '@webpieces/core-context';\n// @ts-expect-error HeaderReader is DELETED — an ApiKeyHook now receives the whole HttpRequest, so it\n// reaches getHeaderValues and the ContextKey overload of getHeader that the narrow reader hid.\nimport type { HeaderReader } from './AuthHooks';\n// @ts-expect-error AuthValues is RENAMED to AuthenticatedCaller — there is no alias, by policy.\nimport type { AuthValues } from './AuthConfig';\nimport { OidcAuthMethod, OidcAuthMethods } from '@webpieces/core-util';\nimport { VendorAuthHook } from '@webpieces/core-context';\n// @ts-expect-error WebhookAuthCallback is REPLACED by VendorAuthHook (mint/refresh/verify) — no alias, by policy.\nimport type { WebhookAuthCallback } from './AuthHooks';\nimport { ApiKeyHook, OidcHook } from './AuthHooks';\nimport { AuthenticatedCaller, AuthenticatedMachineIdentity } from './AuthConfig';\n\n/*\n COMPILE-TIME assertions that the four auth hooks share ONE shape, and that every spelling this\n * change deleted has actually stopped compiling. Each `@ts-expect-error` FAILS THE BUILD (TS2578,\n * \"unused '@ts-expect-error' directive\") the moment the thing it guards starts compiling again.\n \n WHY THIS IS NOT A `.spec.ts` FILE — the same reason as {@link JwtHookCompileAssertions}:\n * tsconfig.lib.json EXCLUDES specs and vitest strips types with esbuild, so a `@ts-expect-error` in a\n * spec is inert and the suite passes either way. A type-level guarantee has to be asserted in a file\n * the type-checker actually compiles.\n \n WHY IT MATTERS HERE. This repo ships no backwards-compatibility shims: the compile error IS the\n * migration. An implementor that kept `verify(name, request, raw)` or a `HeaderReader` parameter\n * would otherwise sit there compiling, and an accepted shape is never migrated.\n /\nexport class AuthHooksCompileAssertions {\n /\n The DELETED type names, kept referenced so the two `@ts-expect-error`s above are load-bearing\n * rather than decorative. Both resolve to `any` under the suppressed error; the assertion is the\n * IMPORT failing, not what these aliases denote.\n /\n // webpieces-disable no-any-unknown -- a suppressed import of a deleted symbol resolves to any; the assertion is the import error itself\n deletedNames(): void {\n const headerReaderIsGone: HeaderReader \| undefined = undefined;\n const authValuesIsGone: AuthValues \| undefined = undefined;\n const webhookAuthCallbackIsGone: WebhookAuthCallback \| undefined = undefined;\n void headerReaderIsGone;\n void authValuesIsGone;\n void webhookAuthCallbackIsGone;\n }\n\n /* The ALIGNED spellings must keep compiling; asserted by the ABSENCE of an error. /\n legitimate(): void {\n void class extends VendorAuthHook {\n override async mint(): Promise<Map<string, string>> {\n return new Map([['Authorization', 'Bearer t']]);\n }\n\n override async refresh(): Promise<void> {\n // renew the vendor credential\n }\n\n override async verify(_name: string, request: RawHttpRequest): Promise<AuthenticatedCaller> {\n // No `raw!`, no `if (!raw) throw`: AuthFilter checked once and the TYPE carries it.\n const bytes: Buffer = request.raw.rawBody;\n return new AuthenticatedCaller(`sentry:${bytes.length}`);\n }\n };\n void class extends ApiKeyHook {\n override async verifyApiKey(_name: string, request: HttpRequest): Promise<AuthenticatedCaller> {\n // Both of these were UNREACHABLE through the deleted one-method HeaderReader.\n const all: string[] \| undefined = request.getHeaderValues('x-api-key');\n return new AuthenticatedCaller(all?.[0] ?? 'anonymous');\n }\n };\n }\n\n /* Every spelling this change deleted must now be UNWRITABLE. /\n rejected(): void {\n void class extends VendorAuthHook {\n override async mint(): Promise<Map<string, string>> {\n return new Map();\n }\n\n override async refresh(): Promise<void> {\n // renew the vendor credential\n }\n\n // @ts-expect-error verify takes (name, RawHttpRequest): the three-parameter spelling is gone\n override async verify(_name: string, _request: HttpRequest, _raw: RawRequest): Promise<AuthenticatedCaller> {\n return new AuthenticatedCaller('u1');\n }\n };\n void class extends VendorAuthHook {\n override async mint(): Promise<Map<string, string>> {\n return new Map();\n }\n\n override async refresh(): Promise<void> {\n // renew the vendor credential\n }\n\n // @ts-expect-error verify returns the caller it proved: a void override must not compile\n override async verify(_name: string, _request: RawHttpRequest): Promise<void> {\n // a hook that verifies and then has no way to say what it proved\n }\n };\n }\n\n /\n {@link OidcHook.verifyOidc} receives EVERY OIDC method the endpoint declares ({@link OidcAuthMethods}),\n * so a hook verifies the token once and can tell `oidcSameProject()` from `oidcSvcs([...])`. The\n * caller-list override this change deletes (`callers: string[]`, where an EMPTY list meant \"any\n * Google-signed caller\") and a one-method override, which could not see the other scope of a pair,\n * must not compile.\n /\n oidcHookTakesTheMethods(): void {\n void class extends OidcHook {\n override async verifyOidc(_token: string, methods: OidcAuthMethods): Promise<AuthenticatedMachineIdentity> {\n const first = methods[0];\n const named = first.callerScope === 'services' ? first.callers[0] : 'same-project';\n return new AuthenticatedMachineIdentity('oidc', named);\n }\n };\n void class extends OidcHook {\n // @ts-expect-error verifyOidc takes the endpoint's OidcAuthMethods; the deleted caller-list override must not compile\n override async verifyOidc(_token: string, _callers: string[]): Promise<AuthenticatedMachineIdentity> {\n return new AuthenticatedMachineIdentity('oidc', 'caller@example.test');\n }\n };\n void class extends OidcHook {\n // @ts-expect-error verifyOidc takes every OIDC method of the endpoint, not one, so a pair is verified once\n override async verifyOidc(_token: string, _method: OidcAuthMethod): Promise<AuthenticatedMachineIdentity> {\n return new AuthenticatedMachineIdentity('oidc', 'caller@example.test');\n }\n };\n }\n\n /\n An {@link HttpRequest} whose `raw` is merely OPTIONAL is NOT a {@link RawHttpRequest}. This is\n * the assignment that makes the narrowing real: without it, `RawHttpRequest` would be a comment.\n */\n rawIsNotOptional(): void {\n const maybeRaw = new HttpRequest('POST', '/hook/sentry/issue', new Map<string, string[]>());\n // @ts-expect-error HttpRequest.raw is optional, so it is not assignable to RawHttpRequest\n const narrowed: RawHttpRequest = maybeRaw;\n void narrowed;\n\n // The other direction is free: a RawHttpRequest IS an HttpRequest everywhere one is wanted.\n const proven = new HttpRequest(\n 'POST',\n '/hook/sentry/issue',\n new Map<string, string[]>(),\n new RawRequest('https://example.com/hook', Buffer.from('{}', 'utf8'), '1.2.3.4'),\n ) as RawHttpRequest;\n const widened: HttpRequest = proven;\n void widened;\n }\n}\n"]}
1	+ {"version":3,"file":"AuthHooksCompileAssertions.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/AuthHooksCompileAssertions.ts"],"names":[],"mappings":";;;AAAA,0DAAkF;AAOlF,0DAAyD;AAGzD,0EAA0E;AAC1E,2CAAoD;AACpD,2CAAmD;AACnD,6CAAiF;AAEjF;;;;;;;;;;;;;GAaG;AACH,MAAa,0BAA0B;IACnC;;;;OAIG;IACH,wIAAwI;IACxI,YAAY;QACR,MAAM,kBAAkB,GAA6B,SAAS,CAAC;QAC/D,MAAM,gBAAgB,GAA2B,SAAS,CAAC;QAC3D,MAAM,yBAAyB,GAAoC,SAAS,CAAC;QAC7E,KAAK,kBAAkB,CAAC;QACxB,KAAK,gBAAgB,CAAC;QACtB,KAAK,yBAAyB,CAAC;QAC/B,KAAK,iCAAqB,CAAC;IAC/B,CAAC;IAED,sFAAsF;IACtF,UAAU;QACN,KAAK,KAAM,SAAQ,6BAAc;YACpB,KAAK,CAAC,IAAI;gBACf,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;YACpD,CAAC;YAEQ,KAAK,CAAC,OAAO;gBAClB,8BAA8B;YAClC,CAAC;YAEQ,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAAuB;gBACxD,oFAAoF;gBACpF,MAAM,KAAK,GAAW,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBAC1C,OAAO,IAAI,gCAAmB,CAAC,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7D,CAAC;SACJ,CAAC;QACF,KAAK,KAAM,SAAQ,sBAAU;YAChB,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,OAAoB;gBAC3D,8EAA8E;gBAC9E,MAAM,GAAG,GAAyB,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;gBACvE,OAAO,IAAI,gCAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC;YAC5D,CAAC;SACJ,CAAC;IACN,CAAC;IAED,iEAAiE;IACjE,QAAQ;QACJ,KAAK,KAAM,SAAQ,6BAAc;YACpB,KAAK,CAAC,IAAI;gBACf,OAAO,IAAI,GAAG,EAAE,CAAC;YACrB,CAAC;YAEQ,KAAK,CAAC,OAAO;gBAClB,8BAA8B;YAClC,CAAC;YAED,6FAA6F;YACpF,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAqB,EAAE,IAAgB;gBACxE,OAAO,IAAI,gCAAmB,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;SACJ,CAAC;QACF,KAAK,KAAM,SAAQ,6BAAc;YACpB,KAAK,CAAC,IAAI;gBACf,OAAO,IAAI,GAAG,EAAE,CAAC;YACrB,CAAC;YAEQ,KAAK,CAAC,OAAO;gBAClB,8BAA8B;YAClC,CAAC;YAED,yFAAyF;YAChF,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAwB;gBACzD,iEAAiE;YACrE,CAAC;SACJ,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACH,uBAAuB;QACnB,KAAK,KAAM,SAAQ,oBAAQ;YACd,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAAwB;gBAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBACzB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;gBACnF,OAAO,IAAI,yCAA4B,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC3D,CAAC;SACJ,CAAC;QACF,KAAK,KAAM,SAAQ,oBAAQ;YACvB,sHAAsH;YAC7G,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,QAAkB;gBACxD,OAAO,IAAI,yCAA4B,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;YAC3E,CAAC;SACJ,CAAC;QACF,KAAK,KAAM,SAAQ,oBAAQ;YACvB,2GAA2G;YAClG,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAAuB;gBAC7D,OAAO,IAAI,yCAA4B,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;YAC3E,CAAC;SACJ,CAAC;IACN,CAAC;IAED;;;OAGG;IACH,gBAAgB;QACZ,MAAM,QAAQ,GAAG,IAAI,0BAAW,CAAC,MAAM,EAAE,oBAAoB,EAAE,IAAI,GAAG,EAAoB,CAAC,CAAC;QAC5F,0FAA0F;QAC1F,MAAM,QAAQ,GAAmB,QAAQ,CAAC;QAC1C,KAAK,QAAQ,CAAC;QAEd,4FAA4F;QAC5F,MAAM,MAAM,GAAG,IAAI,0BAAW,CAC1B,MAAM,EACN,oBAAoB,EACpB,IAAI,GAAG,EAAoB,EAC3B,IAAI,yBAAU,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CACjE,CAAC;QACpB,MAAM,OAAO,GAAgB,MAAM,CAAC;QACpC,KAAK,OAAO,CAAC;IACjB,CAAC;CACJ;AA5HD,gEA4HC","sourcesContent":["import { HttpRequest, RawHttpRequest, RawRequest } from '@webpieces/core-context';\n// @ts-expect-error HeaderReader is DELETED — an ApiKeyHook now receives the whole HttpRequest, so it\n// reaches getHeaderValues and the ContextKey overload of getHeader that the narrow reader hid.\nimport type { HeaderReader } from './AuthHooks';\n// @ts-expect-error AuthValues is RENAMED to AuthenticatedCaller — there is no alias, by policy.\nimport type { AuthValues } from './AuthConfig';\nimport { OidcAuthMethod, OidcAuthMethods } from '@webpieces/core-util';\nimport { VendorAuthHook } from '@webpieces/core-context';\n// @ts-expect-error WebhookAuthCallback is REPLACED by VendorAuthHook (mint/refresh/verify) — no alias, by policy.\nimport type { WebhookAuthCallback } from './AuthHooks';\n// @ts-expect-error WEBHOOK_AUTH_CALLBACK is REPLACED by VENDOR_AUTH_HOOK.\nimport { WEBHOOK_AUTH_CALLBACK } from './AuthHooks';\nimport { ApiKeyHook, OidcHook } from './AuthHooks';\nimport { AuthenticatedCaller, AuthenticatedMachineIdentity } from './AuthConfig';\n\n/*\n COMPILE-TIME assertions that the four auth hooks share ONE shape, and that every spelling this\n * change deleted has actually stopped compiling. Each `@ts-expect-error` FAILS THE BUILD (TS2578,\n * \"unused '@ts-expect-error' directive\") the moment the thing it guards starts compiling again.\n \n WHY THIS IS NOT A `.spec.ts` FILE — the same reason as {@link JwtHookCompileAssertions}:\n * tsconfig.lib.json EXCLUDES specs and vitest strips types with esbuild, so a `@ts-expect-error` in a\n * spec is inert and the suite passes either way. A type-level guarantee has to be asserted in a file\n * the type-checker actually compiles.\n \n WHY IT MATTERS HERE. This repo ships no backwards-compatibility shims: the compile error IS the\n * migration. An implementor that kept `verify(name, request, raw)` or a `HeaderReader` parameter\n * would otherwise sit there compiling, and an accepted shape is never migrated.\n /\nexport class AuthHooksCompileAssertions {\n /\n The DELETED type names, kept referenced so the two `@ts-expect-error`s above are load-bearing\n * rather than decorative. Both resolve to `any` under the suppressed error; the assertion is the\n * IMPORT failing, not what these aliases denote.\n /\n // webpieces-disable no-any-unknown -- a suppressed import of a deleted symbol resolves to any; the assertion is the import error itself\n deletedNames(): void {\n const headerReaderIsGone: HeaderReader \| undefined = undefined;\n const authValuesIsGone: AuthValues \| undefined = undefined;\n const webhookAuthCallbackIsGone: WebhookAuthCallback \| undefined = undefined;\n void headerReaderIsGone;\n void authValuesIsGone;\n void webhookAuthCallbackIsGone;\n void WEBHOOK_AUTH_CALLBACK;\n }\n\n /* The ALIGNED spellings must keep compiling; asserted by the ABSENCE of an error. /\n legitimate(): void {\n void class extends VendorAuthHook {\n override async mint(): Promise<Map<string, string>> {\n return new Map([['Authorization', 'Bearer t']]);\n }\n\n override async refresh(): Promise<void> {\n // renew the vendor credential\n }\n\n override async verify(_name: string, request: RawHttpRequest): Promise<AuthenticatedCaller> {\n // No `raw!`, no `if (!raw) throw`: AuthFilter checked once and the TYPE carries it.\n const bytes: Buffer = request.raw.rawBody;\n return new AuthenticatedCaller(`sentry:${bytes.length}`);\n }\n };\n void class extends ApiKeyHook {\n override async verifyApiKey(_name: string, request: HttpRequest): Promise<AuthenticatedCaller> {\n // Both of these were UNREACHABLE through the deleted one-method HeaderReader.\n const all: string[] \| undefined = request.getHeaderValues('x-api-key');\n return new AuthenticatedCaller(all?.[0] ?? 'anonymous');\n }\n };\n }\n\n /* Every spelling this change deleted must now be UNWRITABLE. /\n rejected(): void {\n void class extends VendorAuthHook {\n override async mint(): Promise<Map<string, string>> {\n return new Map();\n }\n\n override async refresh(): Promise<void> {\n // renew the vendor credential\n }\n\n // @ts-expect-error verify takes (name, RawHttpRequest): the three-parameter spelling is gone\n override async verify(_name: string, _request: HttpRequest, _raw: RawRequest): Promise<AuthenticatedCaller> {\n return new AuthenticatedCaller('u1');\n }\n };\n void class extends VendorAuthHook {\n override async mint(): Promise<Map<string, string>> {\n return new Map();\n }\n\n override async refresh(): Promise<void> {\n // renew the vendor credential\n }\n\n // @ts-expect-error verify returns the caller it proved: a void override must not compile\n override async verify(_name: string, _request: RawHttpRequest): Promise<void> {\n // a hook that verifies and then has no way to say what it proved\n }\n };\n }\n\n /\n {@link OidcHook.verifyOidc} receives EVERY OIDC method the endpoint declares ({@link OidcAuthMethods}),\n * so a hook verifies the token once and can tell `oidcSameProject()` from `oidcSvcs([...])`. The\n * caller-list override this change deletes (`callers: string[]`, where an EMPTY list meant \"any\n * Google-signed caller\") and a one-method override, which could not see the other scope of a pair,\n * must not compile.\n /\n oidcHookTakesTheMethods(): void {\n void class extends OidcHook {\n override async verifyOidc(_token: string, methods: OidcAuthMethods): Promise<AuthenticatedMachineIdentity> {\n const first = methods[0];\n const named = first.callerScope === 'services' ? first.callers[0] : 'same-project';\n return new AuthenticatedMachineIdentity('oidc', named);\n }\n };\n void class extends OidcHook {\n // @ts-expect-error verifyOidc takes the endpoint's OidcAuthMethods; the deleted caller-list override must not compile\n override async verifyOidc(_token: string, _callers: string[]): Promise<AuthenticatedMachineIdentity> {\n return new AuthenticatedMachineIdentity('oidc', 'caller@example.test');\n }\n };\n void class extends OidcHook {\n // @ts-expect-error verifyOidc takes every OIDC method of the endpoint, not one, so a pair is verified once\n override async verifyOidc(_token: string, _method: OidcAuthMethod): Promise<AuthenticatedMachineIdentity> {\n return new AuthenticatedMachineIdentity('oidc', 'caller@example.test');\n }\n };\n }\n\n /\n An {@link HttpRequest} whose `raw` is merely OPTIONAL is NOT a {@link RawHttpRequest}. This is\n * the assignment that makes the narrowing real: without it, `RawHttpRequest` would be a comment.\n */\n rawIsNotOptional(): void {\n const maybeRaw = new HttpRequest('POST', '/hook/sentry/issue', new Map<string, string[]>());\n // @ts-expect-error HttpRequest.raw is optional, so it is not assignable to RawHttpRequest\n const narrowed: RawHttpRequest = maybeRaw;\n void narrowed;\n\n // The other direction is free: a RawHttpRequest IS an HttpRequest everywhere one is wanted.\n const proven = new HttpRequest(\n 'POST',\n '/hook/sentry/issue',\n new Map<string, string[]>(),\n new RawRequest('https://example.com/hook', Buffer.from('{}', 'utf8'), '1.2.3.4'),\n ) as RawHttpRequest;\n const widened: HttpRequest = proven;\n void widened;\n }\n}\n"]}