@yielded/auth 0.1.0-beta.2 → 0.1.0-beta.3

package/src/GitHub.ts

@@ -9,6 +9,7 @@ export { OpenIdClientConfigurationError } from "./oauth/openid-client/models";
 export {
   gitHubOAuthAppConnectedProtocolLayer,
   gitHubOAuthAppProtocolLayer,
+  gitHubOAuthAppProvider,
   makeGitHubOAuthAppConnectedProtocol,
   makeGitHubOAuthAppProtocol,
 } from "./oauth/github/protocol";

package/src/oauth/github/protocol.ts

@@ -6,6 +6,7 @@ import { OAuthConnectedProtocol } from "../OAuthConnectedProtocol";
 import { OAuthProtocol } from "../OAuthProtocol";
 import {
   DefiniteTokenRejection,
+  tokenCompatibility,
   type ConnectedCompatibility,
 } from "../openid-client/compatibility";
 import { makeConnectedProtocolWithCompatibility } from "../openid-client/connected/protocol";
@@ -13,7 +14,7 @@ import {
   OpenIdClientConfigurationError,
   type OpenIdClientOAuthProvider,
 } from "../openid-client/models";
-import { makeOAuthProtocolWithCompatibility } from "../openid-client/protocol";
+import { makeOpenIdClientOAuthProtocol } from "../openid-client/protocol";
 import { ProviderRevocation } from "../openid-client/ProviderRevocation";
 import { boundedFetch } from "../openid-client/transport";
 import { OAuthUnavailable } from "../signInErrors";
@@ -265,6 +266,27 @@ const revocationLayer = (
   );
 };
 
+/** A GitHub.com OAuth App generation for the same provider list as generic OIDC.
+ * Retains GitHub receipt/error rules and requests read:user, with no repository access.
+ * Construction performs no I/O; invalid configuration throws the typed configuration error. */
+export const gitHubOAuthAppProvider = (
+  registration: GitHubOAuthAppGeneration,
+): OpenIdClientOAuthProvider => {
+  let saved: GitHubOAuthAppGeneration;
+
+  try {
+    saved = snapshotOAuthSync(generation, registration);
+  } catch {
+    throw invalid();
+  }
+
+  return {
+    ...provider(saved),
+    scopes: ["read:user"],
+    [tokenCompatibility]: compatibility,
+  };
+};
+
 export const makeGitHubOAuthAppProtocol = Effect.fn("makeGitHubOAuthAppProtocol")(function* (
   options: GitHubOAuthAppProtocolOptions,
 ) {
@@ -273,13 +295,10 @@ export const makeGitHubOAuthAppProtocol = Effect.fn("makeGitHubOAuthAppProtocol"
   if (saved.registrations.filter((item) => item.issuance === "active").length !== 1)
     return yield* invalid();
 
-  return yield* makeOAuthProtocolWithCompatibility(
-    {
-      ...saved,
-      providers: saved.registrations.map((item) => ({ ...provider(item), scopes: ["read:user"] })),
-    },
-    compatibility,
-  );
+  return yield* makeOpenIdClientOAuthProtocol({
+    ...saved,
+    providers: saved.registrations.map(gitHubOAuthAppProvider),
+  });
 });
 
 export const makeGitHubOAuthAppConnectedProtocol = Effect.fn("makeGitHubOAuthAppConnectedProtocol")(

package/src/oauth/openid-client/compatibility.ts

@@ -1,3 +1,5 @@
+import { Predicate, Schema } from "effect";
+
 import type {
   OpenIdClientConnectedOAuthProvider,
   OpenIdClientConnectedProtocolOptions,
@@ -19,6 +21,17 @@ export interface TokenCompatibility {
   ) => void;
 }
 
+/** First-party rules travel with the exact provider generation. The symbol stays
+ * private so generic provider options do not expose grant-bearing hooks. */
+export const tokenCompatibility = Symbol("effect-auth/OpenIdClient/tokenCompatibility");
+
+export const TokenCompatibility = Schema.declare<TokenCompatibility>(
+  (input): input is TokenCompatibility =>
+    Predicate.isObject(input) &&
+    "inspectReceipt" in input &&
+    Predicate.isFunction(input.inspectReceipt),
+);
+
 export class DefiniteTokenRejection extends Error {}
 
 export interface ConnectedCompatibility extends TokenCompatibility {

package/src/oauth/openid-client/configuration.ts

@@ -11,6 +11,7 @@ import {
   OAuthRedirectUri,
 } from "../signInModels";
 import { freezeOAuth } from "../signInSnapshot";
+import { TokenCompatibility, tokenCompatibility } from "./compatibility";
 import {
   OpenIdClientConfigurationError,
   type OpenIdClientAuthentication,
@@ -70,6 +71,7 @@ const optionsSchema = <R>() =>
           Schema.Struct({
             ...common,
             protocol: Schema.Literal("oauth"),
+            [tokenCompatibility]: Schema.optionalKey(TokenCompatibility),
             authorizationEndpoint: boundedString(2048),
             tokenEndpoint: boundedString(2048),
             pkceS256: Schema.Literal(true),

package/src/oauth/openid-client/models.ts

@@ -3,6 +3,7 @@ import type { CustomFetch } from "openid-client";
 
 import type { OAuthProtocolRejected } from "../signInErrors";
 import type { OAuthProtocolConfiguration, OAuthVerifiedExternalIdentity } from "../signInModels";
+import type { TokenCompatibility, tokenCompatibility } from "./compatibility";
 
 export class OpenIdClientConfigurationError extends Schema.TaggedError<OpenIdClientConfigurationError>()(
   "OpenIdClientConfigurationError",
@@ -55,6 +56,8 @@ export interface OpenIdClientOidcProvider extends ProviderGeneration {
 }
 
 export interface OpenIdClientOAuthProvider<R = never> extends ProviderGeneration {
+  /** @internal First-party provider behavior, retained by the configuration codec. */
+  readonly [tokenCompatibility]?: TokenCompatibility;
   readonly protocol: "oauth";
   readonly authorizationEndpoint: string;
   readonly tokenEndpoint: string;

package/src/oauth/openid-client/protocol.ts

@@ -16,7 +16,7 @@ import {
   OAuthVerifiedExternalIdentity,
 } from "../signInModels";
 import { snapshotOAuth } from "../signInSnapshot";
-import { DefiniteTokenRejection, type TokenCompatibility } from "./compatibility";
+import { DefiniteTokenRejection, tokenCompatibility } from "./compatibility";
 import {
   clientAuthentication,
   installConfigurations,
@@ -110,9 +110,9 @@ const privateConfiguration = <R>(
   timeout: number,
   fetch: client.CustomFetch,
   signal: AbortSignal,
-  compatibility?: TokenCompatibility,
 ) => {
   const provider = entry.provider;
+  const compatibility = provider.protocol === "oauth" ? provider[tokenCompatibility] : undefined;
 
   const configuration = new client.Configuration(
     entry.metadata,
@@ -158,10 +158,10 @@ const privateConfiguration = <R>(
   return configuration;
 };
 
-export const makeOAuthProtocolWithCompatibility = Effect.fn("makeOpenIdClientOAuthProtocol")(
+export const makeOpenIdClientOAuthProtocol = Effect.fn("makeOpenIdClientOAuthProtocol")(
+  // Capture one provider table; each generation retains its own receipt rules.
   function* <R = never>(
     options: OpenIdClientOAuthProtocolOptions<R>,
-    compatibility?: TokenCompatibility,
   ): Effect.fn.Return<
     OAuthProtocol["Service"],
     OpenIdClientConfigurationError | OAuthUnavailable,
@@ -192,13 +192,7 @@ export const makeOAuthProtocolWithCompatibility = Effect.fn("makeOpenIdClientOAu
 
       const result = yield* Effect.tryPromise({
         try: async (signal) => {
-          const configuration = privateConfiguration(
-            entry,
-            timeoutSeconds,
-            fetch,
-            signal,
-            compatibility,
-          );
+          const configuration = privateConfiguration(entry, timeoutSeconds, fetch, signal);
 
           const state = client.randomState();
           const verifier = client.randomPKCECodeVerifier();
@@ -281,13 +275,7 @@ export const makeOAuthProtocolWithCompatibility = Effect.fn("makeOpenIdClientOAu
 
         const exchanged = yield* Effect.tryPromise({
           try: async (signal) => {
-            const configuration = privateConfiguration(
-              entry,
-              timeoutSeconds,
-              fetch,
-              signal,
-              compatibility,
-            );
+            const configuration = privateConfiguration(entry, timeoutSeconds, fetch, signal);
 
             const currentUrl = new URL(saved.redirectUri);
 
@@ -428,10 +416,6 @@ export const makeOAuthProtocolWithCompatibility = Effect.fn("makeOpenIdClientOAu
   unavailableOnDefect,
 );
 
-export const makeOpenIdClientOAuthProtocol = <R = never>(
-  options: OpenIdClientOAuthProtocolOptions<R>,
-) => makeOAuthProtocolWithCompatibility(options);
-
 export const openIdClientOAuthProtocolLayer = <R = never>(
   options: OpenIdClientOAuthProtocolOptions<R>,
 ) => Layer.effect(OAuthProtocol, makeOpenIdClientOAuthProtocol(options));