@zudojs/rpc 1.1.0 → 1.2.0

package/README.md

@@ -2,6 +2,12 @@
 
 Type-safe RPC — define procedures, apply middleware, dispatch calls, and serve them over your own transport.
 
+<!-- zudo-docs:start -->
+
+**Documentation:** [zudojs.oyinlola.site/docs/packages-rpc](https://zudojs.oyinlola.site/docs/packages-rpc) · **For AI agents:** [Markdown version](https://zudojs.oyinlola.site/docs/packages-rpc.md), [llms.txt](https://zudojs.oyinlola.site/llms.txt)
+
+<!-- zudo-docs:end -->
+
 ## When to use
 
 Import this when you need:
@@ -100,25 +106,38 @@ A failed call rejects with a typed error rebuilt from the wire code
 (`RPCTimeoutError`, `RPCCancelledError`, `RPCUnavailableError`, or an
 `RPCError` carrying the server's `code` and `details`).
 
-### Middleware
+### Middleware and trusted identity
+
+Everything in a frame, `metadata` included, is written by the caller: any
+client can send `metadata: { userId: "admin" }`. Never authorise on it.
+Identity your transport has verified (a checked bearer token, an mTLS peer,
+a server-side session) goes in the second argument of `handle`, and reaches
+middleware and handlers as the frozen `context.auth`:
 
 ```typescript
 import { RPCMiddlewareStack, RPCAuthenticationError } from "@zudojs/rpc";
 
 const stack = new RPCMiddlewareStack([
   async (context, next) => {
-    if (context.metadata.userId === undefined) {
+    if (typeof context.auth?.userId !== "string") {
       throw new RPCAuthenticationError("Sign in first.");
     }
+    context.set("actor", context.auth.userId);
     return next();
   },
 ]);
 
 const server = new RPCServer(undefined, stack);
+
+// In the transport, after verifying the caller's credentials yourself:
+await server.handle(frame, { auth: { userId: verifiedUserId } });
 ```
 
 Each middleware may call `next()` once. Input validation runs before the
-stack, so middleware sees a payload the procedure's schema has accepted.
+stack. `context.input` holds the payload as the procedure's schema parsed
+it (unknown keys stripped, defaults applied, values coerced), so authorise
+on `context.input`, not on `context.request.payload`, which stays the raw
+frame value.
 
 ## Errors
 

package/dist/index.d.ts

@@ -29,7 +29,7 @@ export { RPCError, RPCProcedureNotFoundError, RPCInvalidRequestError, RPCValidat
 export type { RPCHandler, RPCProcedure, RPCProcedureOptions, } from "./rpc/procedure/index.js";
 export { createRPCProcedure } from "./rpc/procedure/index.js";
 export { RPCProcedureRegistry, RPCProcedureRouter, } from "./rpc/procedure/index.js";
-export type { RPCContext } from "./rpc/context/index.js";
+export type { RPCAuthContext, RPCContext, RPCContextOptions, } from "./rpc/context/index.js";
 export { createRPCContext } from "./rpc/context/index.js";
 export type { RPCMiddleware } from "./rpc/middleware/index.js";
 export { RPCMiddlewareStack } from "./rpc/middleware/index.js";

package/dist/rpc/context/index.d.ts

@@ -1,3 +1,7 @@
-export type { RPCContext } from "./rpcContext.type.js";
+/**
+ * RPC execution context: per-call state, the caller's (untrusted) frame
+ * metadata, the transport's trusted `auth`, and the validated `input`.
+ */
+export type { RPCAuthContext, RPCContext, RPCContextOptions, } from "./rpcContext.type.js";
 export { createRPCContext } from "./rpcContext.type.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/rpc/context/index.js

@@ -1,2 +1,6 @@
+/**
+ * RPC execution context: per-call state, the caller's (untrusted) frame
+ * metadata, the transport's trusted `auth`, and the validated `input`.
+ */
 export { createRPCContext } from "./rpcContext.type.js";
 //# sourceMappingURL=index.js.map

package/dist/rpc/context/rpcContext.type.d.ts

@@ -1,18 +1,57 @@
 import type { RPCMetadata } from "../types/rpcMetadata.type.js";
 import type { RPCRequest } from "../types/rpcRequest.type.js";
+/**
+ * Identity and other facts established by the transport (a verified
+ * bearer token, an mTLS peer, a session looked up server-side).
+ *
+ * Unlike frame `metadata`, which the caller writes, this is supplied by
+ * the server's own code through `RPCServer.handle(request, { auth })`, so
+ * it is the only context field safe to authorise on.
+ */
+export type RPCAuthContext = Readonly<Record<string, unknown>>;
+/**
+ * Extra, server-supplied values for {@link createRPCContext}.
+ */
+export interface RPCContextOptions {
+    /** Trusted, transport-derived identity. See {@link RPCAuthContext}. */
+    readonly auth?: RPCAuthContext;
+}
 /**
  * Context passed through the RPC execution pipeline.
  */
 export interface RPCContext {
     readonly request: RPCRequest;
+    /**
+     * Frame metadata exactly as the caller sent it. Untrusted: any client
+     * can set `userId`, `tenantId` or any other key. Authorise on
+     * {@link RPCContext.auth} instead.
+     */
     readonly metadata: RPCMetadata;
+    /**
+     * Trusted identity supplied by the transport through
+     * `RPCServer.handle(request, { auth })`; `undefined` when none was given.
+     */
+    readonly auth: RPCAuthContext | undefined;
+    /**
+     * The payload after the procedure's input schema has parsed it
+     * (stripped, defaulted, coerced), or the raw payload when the procedure
+     * declares no input schema. `undefined` until validation has run, i.e.
+     * in an interceptor before it calls `next()`. `request.payload` always
+     * stays the raw, unvalidated value.
+     */
+    readonly input: unknown;
     readonly signal: AbortSignal;
     readonly state: Map<string, unknown>;
     get<T>(key: string): T | undefined;
     set<T>(key: string, value: T): void;
 }
+/**
+ * Records the validated input on a context. Called by the dispatcher
+ * once, after input validation and before the middleware stack runs.
+ */
+export declare function bindRPCContextInput(context: RPCContext, input: unknown): void;
 /**
  * Creates a new RPC context.
  */
-export declare function createRPCContext(request: RPCRequest, signal: AbortSignal): RPCContext;
+export declare function createRPCContext(request: RPCRequest, signal: AbortSignal, options?: RPCContextOptions): RPCContext;
 //# sourceMappingURL=rpcContext.type.d.ts.map

package/dist/rpc/context/rpcContext.type.js

@@ -1,13 +1,26 @@
+const inputs = new WeakMap();
+/**
+ * Records the validated input on a context. Called by the dispatcher
+ * once, after input validation and before the middleware stack runs.
+ */
+export function bindRPCContextInput(context, input) {
+    inputs.set(context, input);
+}
 /**
  * Creates a new RPC context.
  */
-export function createRPCContext(request, signal) {
+export function createRPCContext(request, signal, options = {}) {
     const state = new Map();
+    const auth = options.auth === undefined ? undefined : Object.freeze({ ...options.auth });
     const context = {
         request,
         // A frame decoded from JSON may omit `metadata`; middleware reads
         // `context.metadata.userId` and the like without guarding.
         metadata: request.metadata ?? {},
+        auth,
+        get input() {
+            return inputs.get(context);
+        },
         signal,
         state,
         get(key) {

package/dist/rpc/dispatcher/rpcDispatcher.core.d.ts

@@ -3,6 +3,7 @@ import type { RPCResponse } from "../types/rpcResponse.type.js";
 import type { RPCProcedure } from "../procedure/rpcProcedure.type.js";
 import type { RPCMiddlewareStack } from "../middleware/rpcMiddleware.core.js";
 import type { RPCInterceptor } from "../interceptor/rpcInterceptor.type.js";
+import type { RPCContextOptions } from "../context/rpcContext.type.js";
 /**
  * Options controlling dispatch.
  */
@@ -46,8 +47,12 @@ export declare class RPCDispatcher {
     }, middleware: RPCMiddlewareStack, options?: RPCDispatcherOptions);
     /**
      * Dispatches an RPC request.
+     *
+     * `trusted` carries server-supplied context (`auth`) that the caller
+     * cannot forge; it is exposed to middleware and handlers as
+     * `context.auth`.
      */
-    dispatch(input: RPCRequest): Promise<RPCResponse>;
+    dispatch(input: RPCRequest, trusted?: RPCContextOptions): Promise<RPCResponse>;
     /**
      * Runs the interceptor chain around the dispatch.
      *

package/dist/rpc/dispatcher/rpcDispatcher.core.js

@@ -1,4 +1,4 @@
-import { createRPCContext } from "../context/rpcContext.type.js";
+import { bindRPCContextInput, createRPCContext, } from "../context/rpcContext.type.js";
 import { createRPCResponse } from "../types/rpcResponse.type.js";
 import { RPCCancelledError } from "../errors/rpc.errors.js";
 import { DEFAULT_RPC_TIMEOUT } from "../constants/rpcConstants.core.js";
@@ -26,15 +26,19 @@ export class RPCDispatcher {
     }
     /**
      * Dispatches an RPC request.
+     *
+     * `trusted` carries server-supplied context (`auth`) that the caller
+     * cannot forge; it is exposed to middleware and handlers as
+     * `context.auth`.
      */
-    async dispatch(input) {
+    async dispatch(input, trusted = {}) {
         // Tolerate a frame without `metadata`: the field is optional when a
         // request is built by hand or decoded from JSON, and everything below
         // — deadline reading, the context's `metadata` — reads it as an object.
         const request = input.metadata === undefined ? { ...input, metadata: {} } : input;
         const procedure = this.registry.require(request.procedure);
         const controller = new AbortController();
-        const context = createRPCContext(request, controller.signal);
+        const context = createRPCContext(request, controller.signal, trusted);
         const timeoutMs = this.resolveTimeout(request, procedure);
         // A deadline already in the past is rejected before any work runs.
         if (this.options.honourDeadline ?? true) {
@@ -49,6 +53,7 @@ export class RPCDispatcher {
                 const input = procedure.options?.input
                     ? parseInput(procedure.options.input, request.payload, request.procedure)
                     : request.payload;
+                bindRPCContextInput(context, input);
                 const result = await this.middleware.execute(context, async () => {
                     return procedure.handler(input, context);
                 });

package/dist/rpc/server/rpcServer.core.d.ts

@@ -3,6 +3,7 @@ import type { RPCResponse } from "../types/rpcResponse.type.js";
 import type { RPCProcedure } from "../procedure/rpcProcedure.type.js";
 import { RPCProcedureRegistry } from "../procedure/rpcProcedureRegistry.core.js";
 import { RPCMiddlewareStack } from "../middleware/rpcMiddleware.core.js";
+import type { RPCContextOptions } from "../context/rpcContext.type.js";
 import type { RPCDispatcherOptions } from "../dispatcher/rpcDispatcher.core.js";
 import type { RPCRequestLimits } from "../validation/rpcValidation.core.js";
 /**
@@ -49,8 +50,13 @@ export declare class RPCServer {
      * `onInternalError` and answered with a fixed message: internal
      * exception text can name hosts, paths, credentials or queries, and
      * the caller is an untrusted peer.
+     *
+     * Everything in `request` comes from that peer, including
+     * `request.metadata.userId`. Identity the transport has verified goes
+     * in `trusted.auth` and reaches middleware and handlers as
+     * `context.auth`; authorise on that, never on frame metadata.
      */
-    handle(request: RPCRequest): Promise<RPCResponse>;
+    handle(request: RPCRequest, trusted?: RPCContextOptions): Promise<RPCResponse>;
     /**
      * Returns the procedure registry.
      */

package/dist/rpc/server/rpcServer.core.js

@@ -65,8 +65,13 @@ export class RPCServer {
      * `onInternalError` and answered with a fixed message: internal
      * exception text can name hosts, paths, credentials or queries, and
      * the caller is an untrusted peer.
+     *
+     * Everything in `request` comes from that peer, including
+     * `request.metadata.userId`. Identity the transport has verified goes
+     * in `trusted.auth` and reaches middleware and handlers as
+     * `context.auth`; authorise on that, never on frame metadata.
      */
-    async handle(request) {
+    async handle(request, trusted = {}) {
         const requestId = typeof request?.id === "string"
             ? request.id
             : "";
@@ -77,7 +82,7 @@ export class RPCServer {
             // reads it as an object, so a frame without it used to fail with a
             // TypeError reported as an internal error.
             const frame = request.metadata === undefined ? { ...request, metadata: {} } : request;
-            return await this.dispatcher.dispatch(frame);
+            return await this.dispatcher.dispatch(frame, trusted);
         }
         catch (error) {
             const mapped = this.mapError(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/rpc",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Remote procedure call infrastructure for Zudojs applications.",
   "license": "MIT",
   "author": {
@@ -27,10 +27,10 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@zudojs/errors": "1.0.1",
-    "@zudojs/constants": "1.0.1",
-    "@zudojs/types": "1.0.0",
-    "@zudojs/schema": "1.0.1"
+    "@zudojs/errors": "1.1.0",
+    "@zudojs/constants": "1.1.0",
+    "@zudojs/types": "1.1.0",
+    "@zudojs/schema": "1.1.0"
   },
   "devDependencies": {
     "typescript": "7.0.2",