alchemy 2.0.0-beta.3 → 2.0.0-beta.4

package/src/Cloudflare/Auth/OAuthClient.ts

@@ -0,0 +1,315 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import crypto from "node:crypto";
+import http from "node:http";
+import {
+  OAUTH_CLIENT_ID,
+  OAUTH_ENDPOINTS,
+  OAUTH_REDIRECT_URI,
+} from "./AuthProvider.ts";
+
+export class OAuthError extends Data.TaggedError("OAuthError")<{
+  error: string;
+  errorDescription: string;
+}> {}
+
+export interface OAuthCredentials {
+  type: "oauth";
+  access: string;
+  refresh: string;
+  expires: number;
+  scopes: string[];
+}
+
+export interface Authorization {
+  url: string;
+  state: string;
+  verifier: string;
+}
+
+function generateState(length = 32): string {
+  return crypto.randomBytes(length).toString("base64url");
+}
+
+function generatePKCE(length = 96): {
+  verifier: string;
+  challenge: string;
+} {
+  const verifier = crypto.randomBytes(length).toString("base64url");
+  const challenge = crypto
+    .createHash("sha256")
+    .update(verifier)
+    .digest("base64url");
+  return { verifier, challenge };
+}
+
+function extractCredentials(json: {
+  access_token: string;
+  refresh_token: string;
+  expires_in: number;
+  scope: string;
+}): OAuthCredentials {
+  return {
+    type: "oauth",
+    access: json.access_token,
+    refresh: json.refresh_token,
+    expires: Date.now() + json.expires_in * 1000,
+    scopes: json.scope.split(" "),
+  };
+}
+
+const tokenRequest = (
+  body: Record<string, string>,
+): Effect.Effect<OAuthCredentials, OAuthError> =>
+  Effect.gen(function* () {
+    const res = yield* Effect.tryPromise({
+      try: () =>
+        fetch(OAUTH_ENDPOINTS.token, {
+          method: "POST",
+          headers: {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded",
+          },
+          body: new URLSearchParams(body).toString(),
+        }),
+      catch: (err) =>
+        new OAuthError({
+          error: "network_error",
+          errorDescription: `Token request failed: ${err}`,
+        }),
+    });
+
+    if (!res.ok) {
+      const json = yield* Effect.tryPromise({
+        try: () =>
+          res.json() as Promise<{ error: string; error_description: string }>,
+        catch: () =>
+          new OAuthError({
+            error: "parse_error",
+            errorDescription: `Token endpoint returned ${res.status}`,
+          }),
+      });
+      return yield* new OAuthError({
+        error: json.error,
+        errorDescription: json.error_description,
+      });
+    }
+
+    const json = yield* Effect.tryPromise({
+      try: () =>
+        res.json() as Promise<{
+          access_token: string;
+          refresh_token: string;
+          expires_in: number;
+          scope: string;
+        }>,
+      catch: () =>
+        new OAuthError({
+          error: "parse_error",
+          errorDescription: "Failed to parse token response",
+        }),
+    });
+    return extractCredentials(json);
+  });
+
+/**
+ * Generate an authorization URL with PKCE for the given scopes.
+ */
+export function authorize(scopes: string[]): Authorization {
+  const state = generateState();
+  const pkce = generatePKCE();
+  const url = new URL(OAUTH_ENDPOINTS.authorize);
+  url.searchParams.set("client_id", OAUTH_CLIENT_ID);
+  url.searchParams.set("redirect_uri", OAUTH_REDIRECT_URI);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("scope", scopes.join(" "));
+  url.searchParams.set("state", state);
+  url.searchParams.set("code_challenge", pkce.challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return { url: url.toString(), state, verifier: pkce.verifier };
+}
+
+/**
+ * Exchange an authorization code for OAuth credentials.
+ */
+export const exchange = (
+  code: string,
+  verifier: string,
+): Effect.Effect<OAuthCredentials, OAuthError> =>
+  tokenRequest({
+    grant_type: "authorization_code",
+    code,
+    code_verifier: verifier,
+    client_id: OAUTH_CLIENT_ID,
+    redirect_uri: OAUTH_REDIRECT_URI,
+  });
+
+/**
+ * Refresh expired OAuth credentials.
+ */
+export const refresh = (
+  credentials: OAuthCredentials,
+): Effect.Effect<OAuthCredentials, OAuthError> =>
+  tokenRequest({
+    grant_type: "refresh_token",
+    refresh_token: credentials.refresh,
+    client_id: OAUTH_CLIENT_ID,
+    redirect_uri: OAUTH_REDIRECT_URI,
+  });
+
+/**
+ * Revoke OAuth credentials.
+ */
+export const revoke = (
+  credentials: OAuthCredentials,
+): Effect.Effect<void, OAuthError> =>
+  Effect.gen(function* () {
+    yield* Effect.tryPromise({
+      try: () =>
+        fetch(OAUTH_ENDPOINTS.revoke, {
+          method: "POST",
+          headers: {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded",
+          },
+          body: new URLSearchParams({
+            refresh_token: credentials.refresh,
+            client_id: OAUTH_CLIENT_ID,
+            redirect_uri: OAUTH_REDIRECT_URI,
+          }).toString(),
+        }),
+      catch: (err) =>
+        new OAuthError({
+          error: "network_error",
+          errorDescription: `Revoke request failed: ${err}`,
+        }),
+    });
+  });
+
+/**
+ * Start a local HTTP server to listen for the OAuth callback, exchange
+ * the authorization code, and return the credentials.
+ *
+ * Times out after 5 minutes.
+ */
+export const callback = (
+  authorization: Authorization,
+): Effect.Effect<OAuthCredentials, OAuthError> =>
+  Effect.tryPromise({
+    try: () => callbackPromise(authorization),
+    catch: (err) => {
+      if (err instanceof OAuthError) return err;
+      return new OAuthError({
+        error: "callback_error",
+        errorDescription: `OAuth callback failed: ${err}`,
+      });
+    },
+  });
+
+function callbackPromise(
+  authorization: Authorization,
+): Promise<OAuthCredentials> {
+  const { pathname, port } = new URL(OAUTH_REDIRECT_URI);
+
+  return new Promise<OAuthCredentials>((resolve, reject) => {
+    const server = http.createServer(async (req, res) => {
+      const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
+
+      if (url.pathname !== pathname) {
+        res.statusCode = 404;
+        res.end("Not Found");
+        return;
+      }
+
+      const error = url.searchParams.get("error");
+      const errorDescription = url.searchParams.get("error_description");
+      if (error) {
+        res.writeHead(302, { Location: "https://alchemy.run/auth/error" });
+        res.end();
+        cleanup();
+        reject(
+          new OAuthError({
+            error,
+            errorDescription: errorDescription ?? "An unknown error occurred.",
+          }),
+        );
+        return;
+      }
+
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      if (!code || !state) {
+        res.writeHead(302, { Location: "https://alchemy.run/auth/error" });
+        res.end();
+        cleanup();
+        reject(
+          new OAuthError({
+            error: "invalid_request",
+            errorDescription: "Missing code or state",
+          }),
+        );
+        return;
+      }
+
+      if (state !== authorization.state) {
+        res.writeHead(302, { Location: "https://alchemy.run/auth/error" });
+        res.end();
+        cleanup();
+        reject(
+          new OAuthError({
+            error: "invalid_request",
+            errorDescription: "Invalid state",
+          }),
+        );
+        return;
+      }
+
+      try {
+        const credentials = await Effect.runPromise(
+          exchange(code, authorization.verifier),
+        );
+        res.writeHead(302, {
+          Location: "https://alchemy.run/auth/success",
+        });
+        res.end();
+        cleanup();
+        resolve(credentials);
+      } catch (err) {
+        res.writeHead(302, { Location: "https://alchemy.run/auth/error" });
+        res.end();
+        cleanup();
+        reject(err);
+      }
+    });
+
+    const timeout = setTimeout(
+      () => {
+        cleanup();
+        reject(
+          new OAuthError({
+            error: "timeout",
+            errorDescription: "The authorization process timed out.",
+          }),
+        );
+      },
+      5 * 60 * 1000,
+    );
+
+    function cleanup() {
+      clearTimeout(timeout);
+      server.close();
+    }
+
+    server.on("error", (err) => {
+      cleanup();
+      reject(
+        new OAuthError({
+          error: "server_error",
+          errorDescription: `Failed to start callback server: ${err.message}`,
+        }),
+      );
+    });
+
+    server.listen(Number(port));
+  });
+}

package/src/Cloudflare/Container/ContainerApplication.ts

@@ -483,16 +483,16 @@ ${
   runtime === "bun"
     ? `
 import { BunServices } from "@effect/platform-bun";
-import { BunHttpServer } from "alchemy-effect/Http";
+import { BunHttpServer } from "alchemy/Http";
 const HttpServer = BunHttpServer;
 `
     : `
 import { NodeServices } from "@effect/platform-node";
-import { NodeHttpServer } from "alchemy-effect/Http";
+import { NodeHttpServer } from "alchemy/Http";
 const HttpServer = NodeHttpServer;
 `
 }
-import { Stack } from "alchemy-effect/Stack";
+import { Stack } from "alchemy/Stack";
 import * as Effect from "effect/Effect";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import * as Layer from "effect/Layer";

package/src/Cloudflare/Container/ContainerBinding.ts

@@ -5,10 +5,8 @@ import {
   toCloudflareFetcher,
   type Fetcher,
 } from "../Fetcher.ts";
-import {
-  DurableObjectNamespace,
-  DurableObjectState,
-} from "../Workers/DurableObjectNamespace.ts";
+import { DurableObjectNamespace } from "../Workers/DurableObjectNamespace.ts";
+import { DurableObjectState } from "../Workers/DurableObjectState.ts";
 import { Worker } from "../Workers/Worker.ts";
 import type { Container } from "./Container.ts";
 import type { ContainerApplication } from "./ContainerApplication.ts";

package/src/Cloudflare/Container/StartContainer.ts

@@ -6,7 +6,7 @@ import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
 import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
 import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
 import { type Fetcher } from "../Fetcher.ts";
-import { DurableObjectState } from "../Workers/DurableObjectNamespace.ts";
+import { DurableObjectState } from "../Workers/DurableObjectState.ts";
 import { type Container, ContainerError } from "./Container.ts";
 
 /**

package/src/Cloudflare/Providers.ts

@@ -10,7 +10,6 @@ import * as Containers from "./Container/index.ts";
 import * as D1 from "./D1/index.ts";
 import * as KV from "./KV/index.ts";
 import * as R2 from "./R2/index.ts";
-import * as Assets from "./Workers/Assets.ts";
 import * as Workers from "./Workers/index.ts";
 import * as Workflows from "./Workers/Workflow.ts";
 
@@ -60,11 +59,7 @@ export const providers = () =>
       ),
     ),
     Layer.provideMerge(
-      Layer.mergeAll(
-        Assets.AssetsProvider(),
-        Build.CommandProvider(),
-        RandomProvider(),
-      ),
+      Layer.mergeAll(Build.CommandProvider(), RandomProvider()),
     ),
     Layer.provideMerge(
       Layer.mergeAll(

package/src/Cloudflare/R2/R2Bucket.ts

@@ -6,7 +6,7 @@ import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import { Account } from "../Account.ts";
-import type { Providers } from "../Providers.ts";
+import type * as Cloudflare from "../Providers.ts";
 import { R2BucketBinding } from "./R2BucketBinding.ts";
 
 export type R2BucketName = string;
@@ -44,7 +44,7 @@ export type R2Bucket = Resource<
     accountId: string;
   },
   never,
-  Providers
+  Cloudflare.Providers
 >;
 
 /**

package/src/Cloudflare/Website/StaticSite.ts

@@ -3,10 +3,17 @@ import { Command, type CommandProps } from "../../Build/Command.ts";
 import type { InputProps } from "../../Input.ts";
 import * as Namespace from "../../Namespace.ts";
 import type { AssetsConfig } from "../Workers/Assets.ts";
-import { Worker, type WorkerProps } from "../Workers/Worker.ts";
+import {
+  Worker,
+  type WorkerAssetsConfig,
+  type WorkerBindingProps,
+  type WorkerProps,
+} from "../Workers/Worker.ts";
 
-export interface StaticSiteProps
-  extends Omit<WorkerProps, "assets">, Omit<CommandProps, "env"> {
+export interface StaticSiteProps<Bindings extends WorkerBindingProps = {}>
+  extends
+    Omit<WorkerProps<Bindings, WorkerAssetsConfig>, "assets">,
+    Omit<CommandProps, "env"> {
   /**
    * Optional configuration for static asset routing behavior.
    * Supports `runWorkerFirst`, `htmlHandling`, `notFoundHandling`, etc.
@@ -76,19 +83,41 @@ export type StaticSite = ReturnType<typeof StaticSite>;
  * });
  * ```
  */
-export const StaticSite = (id: string, props: InputProps<StaticSiteProps>) =>
+export const StaticSite = <
+  const Bindings extends WorkerBindingProps = {},
+  Req = never,
+>(
+  id: string,
+  propsEff:
+    | InputProps<StaticSiteProps<Bindings>>
+    | Effect.Effect<InputProps<StaticSiteProps<Bindings>>, never, Req>,
+) =>
   Effect.gen(function* () {
-    // TODO(sam): local dev/hmr support?
-    const build = yield* Command("Build", props);
+    const props = Effect.isEffect(propsEff)
+      ? propsEff
+      : Effect.succeed(propsEff);
 
-    const worker = yield* Worker("Worker", {
-      ...props,
-      assets: {
-        path: build.outdir,
-        hash: build.hash,
-        config: props.assetsConfig,
-      },
-    });
+    // TODO(sam): local dev/hmr support?
+    const build = yield* Command(
+      "Build",
+      Effect.map(props, (props) => ({
+        command: props.command,
+        cwd: props.cwd,
+        memo: props.memo,
+        outdir: props.outdir,
+        env: props.env,
+      })),
+    );
 
-    return worker;
+    return yield* Worker<Bindings, WorkerAssetsConfig, Req>(
+      "Worker",
+      Effect.map(props, (props) => ({
+        ...props,
+        assets: {
+          path: build.outdir,
+          hash: build.hash,
+          config: props.assetsConfig,
+        },
+      })),
+    );
   }).pipe(Namespace.push(id));

package/src/Cloudflare/Website/Vite.ts

@@ -1,8 +1,16 @@
-import type { InputProps } from "../../Input.ts";
+import * as Effect from "effect/Effect";
 import type { MemoOptions } from "../../Build/Memo.ts";
-import { Worker, type WorkerProps } from "../Workers/Worker.ts";
+import type { InputProps } from "../../Input.ts";
+import {
+  Worker,
+  type WorkerAssetsConfig,
+  type WorkerBindingProps,
+  type WorkerProps,
+} from "../Workers/Worker.ts";
 
-export interface ViteProps extends Omit<WorkerProps, "vite" | "main"> {
+export interface ViteProps<
+  Bindings extends WorkerBindingProps = {},
+> extends Omit<WorkerProps<Bindings>, "vite" | "main"> {
   /**
    * Root directory passed to Vite's `root` option.
    * Defaults to the current working directory (`process.cwd()`).
@@ -99,12 +107,26 @@ export interface ViteProps extends Omit<WorkerProps, "vite" | "main"> {
  * });
  * ```
  */
-export const Vite = (id: string, props: InputProps<ViteProps> = {}) =>
-  Worker(id, {
-    ...props,
-    main: undefined!,
-    vite: {
-      rootDir: props.rootDir,
-      memo: props.memo,
-    },
-  });
+export const Vite = <
+  const Bindings extends WorkerBindingProps = {},
+  Req = never,
+>(
+  id: string,
+  propsEff?:
+    | InputProps<ViteProps<Bindings>>
+    | Effect.Effect<InputProps<ViteProps<Bindings>>, never, Req>,
+) =>
+  Worker<Bindings, WorkerAssetsConfig, Req>(
+    id,
+    Effect.map(
+      Effect.isEffect(propsEff) ? propsEff : Effect.succeed(propsEff),
+      (props) => ({
+        ...props,
+        main: undefined!,
+        vite: {
+          rootDir: props?.rootDir,
+          memo: props?.memo,
+        },
+      }),
+    ),
+  );