@zudojs/tenancy 1.3.0 → 1.3.1

package/README.md

@@ -45,12 +45,19 @@ const resolver = createResolverChain([
 // (default "verified"), then runs the rest of the request inside the tenant
 // context. acme.example.com reaches t-1001 through its slug.
 const middleware = createResolveTenantMiddleware({
-  resolver: resolver.asResolver(),
+  resolver, // a chain as it is, or a single resolver
   repository,
   storage,
 });
 ```
 
+`resolver` takes a chain directly. Before 1.3.1 it took only a single
+`TenantResolver`, so a chain had to go through `chain.asResolver()`: passing
+the chain itself was a type error, and cast through, every request was
+refused, because a chain's `resolve` returns `{ resolution, candidates,
+conflict }` rather than a resolution. The middleware now recognises a chain by
+its `asResolver` method and adapts it. `resolver.asResolver()` still works.
+
 The chain's context type is inferred from its resolvers — what the JWT,
 domain and subdomain resolvers read, which `HttpResolverContext` provides — so
 the call needs no type argument and no casts. (Before 1.3 it failed with
@@ -67,6 +74,25 @@ into a route's `middleware` list:
 router.get("/projects", listProjects, { middleware: [middleware] });
 ```
 
+`getClaims` reads verified token claims for the JWT resolver (by default they
+come from the `tenancy:claims` state key). It may be typed with
+`@zudojs/http`'s own `HttpMiddlewareContext`, so a helper your auth layer
+already has plugs in without a cast:
+
+```typescript
+import type { HttpMiddlewareContext } from "@zudojs/http";
+import type { TenantClaims } from "@zudojs/tenancy";
+
+const claimsOf = (context: HttpMiddlewareContext) =>
+  context.state.get<TenantClaims>("auth:claims");
+
+createResolveTenantMiddleware({ resolver, repository, storage, getClaims: claimsOf });
+```
+
+The option is generic over the context it reads, bounded by this package's
+structural mirror, which the real context satisfies. A reader for something
+that is not a middleware context, such as a bare request, is still refused.
+
 A refusal — 400, 401, 403, 404 — is a `GuardResponse` (`createGuardResponse`
 from `@zudojs/middleware`), which `@zudojs/http` sends with that status. The
 helpers `createBadRequest`, `createUnauthorized`, `createForbidden`,

package/dist/http/httpResolverContext.d.ts

@@ -20,6 +20,16 @@ export interface HttpResolverContext {
     getPath(): string | undefined;
     getClaims(): TenantClaims | undefined;
 }
+/**
+ * Reads verified token claims for a request.
+ *
+ * Generic over the middleware context it reads, so a helper written against
+ * `@zudojs/http`'s own `HttpMiddlewareContext` is accepted as it is. The
+ * constraint is this package's structural mirror, which the real context
+ * satisfies; tenancy cannot depend on http (a higher tier), so the mirror is
+ * the only shape it can name.
+ */
+export type TenantClaimsReader<Context extends HttpMiddlewareContext = HttpMiddlewareContext> = (context: Context) => TenantClaims | undefined;
 /** State key under which upstream auth middleware publishes token claims. */
 export declare const TENANT_CLAIMS_STATE_KEY = "tenancy:claims";
 /**
@@ -31,5 +41,5 @@ export declare const TENANT_CLAIMS_STATE_KEY = "tenancy:claims";
  *   an authentication middleware is expected to publish them.
  * @returns An accessor object every shipped resolver understands.
  */
-export declare function createHttpResolverContext(context: HttpMiddlewareContext, getClaims?: (context: HttpMiddlewareContext) => TenantClaims | undefined): HttpResolverContext;
+export declare function createHttpResolverContext<Context extends HttpMiddlewareContext = HttpMiddlewareContext>(context: Context, getClaims?: TenantClaimsReader<Context>): HttpResolverContext;
 //# sourceMappingURL=httpResolverContext.d.ts.map

package/dist/http/httpSupport/index.d.ts

@@ -1,9 +1,11 @@
 /**
- * Support for the tenancy HTTP middleware: portable header reads, and loading
- * the tenant a resolution names (by id, then by slug).
+ * Support for the tenancy HTTP middleware: portable header reads, loading
+ * the tenant a resolution names (by id, then by slug), and adapting a
+ * resolver chain passed where a resolver is expected.
  *
  * @module http/httpSupport
  */
 export { readRequestHeader } from "./httpRequest.helper.js";
 export { loadResolvedTenant } from "./tenancyMiddleware.lookup.js";
+export { toTenantResolver, type TenantResolverSource, } from "./tenancyMiddleware.resolver.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/http/httpSupport/index.js

@@ -1,9 +1,11 @@
 /**
- * Support for the tenancy HTTP middleware: portable header reads, and loading
- * the tenant a resolution names (by id, then by slug).
+ * Support for the tenancy HTTP middleware: portable header reads, loading
+ * the tenant a resolution names (by id, then by slug), and adapting a
+ * resolver chain passed where a resolver is expected.
  *
  * @module http/httpSupport
  */
 export { readRequestHeader } from "./httpRequest.helper.js";
 export { loadResolvedTenant } from "./tenancyMiddleware.lookup.js";
+export { toTenantResolver, } from "./tenancyMiddleware.resolver.js";
 //# sourceMappingURL=index.js.map

package/dist/http/httpSupport/tenancyMiddleware.resolver.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Normalises what `createResolveTenantMiddleware` accepts as its resolver.
+ *
+ * @module http/httpSupport/tenancyMiddleware.resolver
+ */
+import type { TenantResolver } from "../../tenancyTypes/resolverTypes.js";
+import type { TenantResolverChain } from "../../resolver/resolverChain.core.js";
+/**
+ * A single resolver, or a resolver chain passed as it is.
+ *
+ * A chain's `resolve` returns the full `TenantResolutionResult`
+ * (`{ resolution, candidates, conflict }`), not a `TenantResolution`, so it
+ * is not itself a `TenantResolver`. The middleware used to take only the
+ * resolver form: passing a chain was a type error, and cast through at
+ * runtime every request was refused because the result object carries no
+ * `trust`. Both forms are accepted now.
+ */
+export type TenantResolverSource<Context> = TenantResolver<Context> | TenantResolverChain<Context>;
+/**
+ * Turn a resolver or a resolver chain into a `TenantResolver`.
+ *
+ * A chain is recognised structurally, by its `asResolver` method, so a chain
+ * built by another copy of this package is adapted too. Anything else is
+ * used as it is.
+ *
+ * @param source - A resolver, or a chain from `createResolverChain`.
+ * @returns A resolver that yields the winning `TenantResolution`.
+ */
+export declare function toTenantResolver<Context>(source: TenantResolverSource<Context>): TenantResolver<Context>;
+//# sourceMappingURL=tenancyMiddleware.resolver.d.ts.map

package/dist/http/httpSupport/tenancyMiddleware.resolver.js

@@ -0,0 +1,25 @@
+/**
+ * Normalises what `createResolveTenantMiddleware` accepts as its resolver.
+ *
+ * @module http/httpSupport/tenancyMiddleware.resolver
+ */
+/**
+ * Turn a resolver or a resolver chain into a `TenantResolver`.
+ *
+ * A chain is recognised structurally, by its `asResolver` method, so a chain
+ * built by another copy of this package is adapted too. Anything else is
+ * used as it is.
+ *
+ * @param source - A resolver, or a chain from `createResolverChain`.
+ * @returns A resolver that yields the winning `TenantResolution`.
+ */
+export function toTenantResolver(source) {
+    if (isResolverChain(source))
+        return source.asResolver();
+    return source;
+}
+function isResolverChain(source) {
+    return (typeof source.asResolver ===
+        "function");
+}
+//# sourceMappingURL=tenancyMiddleware.resolver.js.map

package/dist/http/index.d.ts

@@ -6,8 +6,9 @@ export type { RequireTenantMiddlewareOptions, ResolveTenantMiddlewareOptions, }
 export { createTenantGuardMiddleware, createTenantPropagationMiddleware, } from "./tenancyMiddleware.guard.js";
 export type { TenantGuardMiddlewareOptions } from "./tenancyMiddleware.guard.js";
 export { TENANT_CLAIMS_STATE_KEY, createHttpResolverContext, } from "./httpResolverContext.js";
-export type { HttpResolverContext, TenantClaims, } from "./httpResolverContext.js";
+export type { HttpResolverContext, TenantClaims, TenantClaimsReader, } from "./httpResolverContext.js";
 export { readRequestHeader } from "./httpSupport/index.js";
+export type { TenantResolverSource } from "./httpSupport/index.js";
 export { createBadRequest, createForbidden, createJsonErrorResponse, createJsonResponse, createNotFound, createUnauthorized, } from "./httpHelpers.js";
 export type * from "./httpTypes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/http/tenancyMiddleware.core.d.ts

@@ -8,19 +8,30 @@
  * Composes with the @zudojs/http pipeline structurally; no dependency on it.
  */
 import type { Tenant, TenantRequirement, TenantTrustLevel } from "../tenancyTypes/tenantInterface.js";
-import type { TenantResolver, TenantResolution } from "../tenancyTypes/resolverTypes.js";
+import type { TenantResolution } from "../tenancyTypes/resolverTypes.js";
 import type { TenantRepository } from "../tenancyTypes/repositoryTypes.js";
 import type { TenantContextStorage } from "../context/contextStorage.core.js";
 import type { HttpMiddleware, HttpMiddlewareContext } from "./httpTypes.js";
-import type { HttpResolverContext, TenantClaims } from "./httpResolverContext.js";
+import type { HttpResolverContext, TenantClaimsReader } from "./httpResolverContext.js";
+import { type TenantResolverSource } from "./httpSupport/index.js";
 /** State key for the resolved tenant. */
 export declare const TENANT_STATE_KEY = "tenancy:tenant";
 /** State key for the tenant context. */
 export declare const TENANT_CONTEXT_STATE_KEY = "tenancy:context";
-/** Options for the resolve tenant middleware. */
-export interface ResolveTenantMiddlewareOptions {
-    /** Resolver chain or single resolver to determine tenant. */
-    readonly resolver: TenantResolver<HttpResolverContext>;
+/**
+ * Options for the resolve tenant middleware.
+ *
+ * `Context` is the middleware context `getClaims` reads. It defaults to this
+ * package's mirror; a `getClaims` typed with `@zudojs/http`'s
+ * `HttpMiddlewareContext` sets it to that, with no cast.
+ */
+export interface ResolveTenantMiddlewareOptions<Context extends HttpMiddlewareContext = HttpMiddlewareContext> {
+    /**
+     * A single resolver, or a resolver chain from `createResolverChain` passed
+     * as it is. A chain is adapted with its `asResolver()`, so calling that
+     * yourself is no longer needed (it still works).
+     */
+    readonly resolver: TenantResolverSource<HttpResolverContext>;
     /** Repository to load the full tenant after resolution. */
     readonly repository: TenantRepository;
     /** Tenant context storage for propagation. */
@@ -58,8 +69,11 @@ export interface ResolveTenantMiddlewareOptions {
      * suspended tenant is refused whether or not this is set.
      */
     readonly optional?: boolean;
-    /** Reads verified token claims for the JWT resolver. */
-    readonly getClaims?: (context: HttpMiddlewareContext) => TenantClaims | undefined;
+    /**
+     * Reads verified token claims for the JWT resolver. Defaults to the
+     * `tenancy:claims` state key. May be typed with `@zudojs/http`'s context.
+     */
+    readonly getClaims?: TenantClaimsReader<Context>;
     /** Custom error response for missing tenant. */
     readonly notFoundResponse?: (resolution: TenantResolution | undefined) => unknown;
 }
@@ -77,7 +91,7 @@ export interface RequireTenantMiddlewareOptions {
  * Enforces trust and tenant status itself rather than relying on a second
  * middleware being installed: the safe behaviour has to be the default.
  */
-export declare function createResolveTenantMiddleware(options: ResolveTenantMiddlewareOptions): HttpMiddleware;
+export declare function createResolveTenantMiddleware<Context extends HttpMiddlewareContext = HttpMiddlewareContext>(options: ResolveTenantMiddlewareOptions<Context>): HttpMiddleware;
 /**
  * Create middleware that enforces tenant presence.
  *

package/dist/http/tenancyMiddleware.core.js

@@ -10,7 +10,7 @@
 import { createHttpResolverContext } from "./httpResolverContext.js";
 import { createBadRequest, createForbidden, createJsonResponse, createNotFound, createUnauthorized, } from "./httpHelpers.js";
 import { meetsTrustLevel } from "../security/guard.core.js";
-import { loadResolvedTenant } from "./httpSupport/index.js";
+import { loadResolvedTenant, toTenantResolver, } from "./httpSupport/index.js";
 import { TenantResolutionConflictError, TenantResolutionError, } from "../tenancyErrors/tenancyError.types.js";
 // ─── State Keys ───────────────────────────────────────────────────────────
 /** State key for the resolved tenant. */
@@ -26,6 +26,7 @@ export const TENANT_CONTEXT_STATE_KEY = "tenancy:context";
  * middleware being installed: the safe behaviour has to be the default.
  */
 export function createResolveTenantMiddleware(options) {
+    const resolver = toTenantResolver(options.resolver);
     const minimumTrust = options.minimumTrust ?? "verified";
     const slugLookup = options.slugLookup !== false;
     // Unknown and unavailable tenants get the same answer, so a caller cannot
@@ -36,7 +37,7 @@ export function createResolveTenantMiddleware(options) {
     return async (context, next) => {
         let resolution;
         try {
-            resolution = await options.resolver.resolve(createHttpResolverContext(context, options.getClaims));
+            resolution = await resolver.resolve(createHttpResolverContext(context, options.getClaims));
         }
         catch (error) {
             // A resolver chain throws when a credential was rejected or when two

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/tenancy",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Multi-tenant context and isolation with tenant resolution, AsyncLocalStorage propagation, resolver chains, trust levels, and guard middleware.",
   "license": "MIT",
   "author": {