alinea 2.0.0-preview.10 → 2.0.0-preview.12

package/dist/.init/content/pages/welcome.json

@@ -1,5 +1,5 @@
 {
-  "_id": "3K5v72iiSXMjBJwIX9mSIj8QqhI",
+  "_id": "3KPEwd5jxca0cmXOExux5RBSXpo",
   "_type": "Page",
   "_index": "a0",
   "_seeded": "welcome.json",

package/dist/.mcp/later/dev.json

@@ -1 +1 @@
-{"url":"http://localhost:1","pid":3102}
+{"url":"http://localhost:1","pid":2819}

package/dist/.mcp/online/dev.json

@@ -1 +1 @@
-{"url":"http://localhost:40115","pid":3102}
+{"url":"http://localhost:40589","pid":2819}

package/dist/adapter/next/handler.js

@@ -67,8 +67,6 @@ function createHandlerWithDatabase(input, openGeneratedDatabase) {
       return failure(400, "Expected JSON");
     }
     if (!Array.isArray(mutations)) return failure(400, "Expected mutations");
-    const adjusted = await options.beforeCommit?.({ mutations });
-    if (adjusted) mutations = [...adjusted];
     const devServer = new Client({
       config,
       url: context.handlerUrl.href,
@@ -80,15 +78,19 @@ function createHandlerWithDatabase(input, openGeneratedDatabase) {
       }
     });
     let sha;
+    let user;
     try {
-      ;
+      user = await devServer.user();
+      if (!user) return failure(401, "Unauthorized");
+      const adjusted = await options.beforeCommit?.({ mutations, user });
+      if (adjusted) mutations = [...adjusted];
       ({ sha } = await devServer.mutate(mutations));
     } catch (error) {
       if (error instanceof HttpError) return failure(error.code, error.message);
       throw error;
     }
     try {
-      await afterCommit({ mutations, sha });
+      await afterCommit({ mutations, sha, user });
     } catch (error) {
       console.error("Alinea afterCommit hook failed", error);
     }

package/dist/backend/Handler.d.ts

@@ -2,12 +2,15 @@ import type { CMS } from 'alinea/core/CMS';
 import type { AuthedContext, RemoteConnection, RequestContext } from 'alinea/core/Connection';
 import type { LocalStore } from 'alinea/core/db/LocalStore';
 import type { Mutation } from 'alinea/core/db/Mutation';
+import type { User } from 'alinea/core/User';
 export interface Handler {
     (request: Request, context: RequestContext): Promise<Response>;
 }
 export type HookResponse<T = void> = void | T | Promise<void | T>;
 export interface BeforeCommitContext {
     mutations: ReadonlyArray<Mutation>;
+    /** The user committing the mutations */
+    user: User;
 }
 export interface AfterCommitContext extends BeforeCommitContext {
     sha: string;

package/dist/backend/Handler.js

@@ -273,7 +273,10 @@ function createHandler({
         const policy = await user.policy;
         let mutations = await body;
         await local.syncWith(cnx);
-        const adjusted = await hooks.beforeCommit?.({ mutations });
+        const adjusted = await hooks.beforeCommit?.({
+          mutations,
+          user: user.claims
+        });
         if (adjusted) mutations = adjusted;
         const attempt = async (retry = 0) => {
           if (retry > 0) await local.syncWith(cnx);
@@ -297,10 +300,7 @@ function createHandler({
         };
         const sha = await attempt();
         try {
-          await hooks.afterCommit?.({
-            mutations,
-            sha
-          });
+          await hooks.afterCommit?.({ mutations, sha, user: user.claims });
         } catch (error) {
           console.error("Alinea afterCommit hook failed", error);
         }

package/dist/backend/api/OAuth2.js

@@ -1,15 +1,12 @@
 import {
   parse
 } from "../../chunks/chunk-BYJRQTFR.js";
-import {
-  PLazy
-} from "../../chunks/chunk-IKINPSS5.js";
 import "../../chunks/chunk-CQ52GEHY.js";
 
 // src/backend/api/OAuth2.ts
 import { AuthResultType } from "alinea/cloud/AuthResult";
 import { Config } from "alinea/core/Config";
-import { HttpError } from "alinea/core/HttpError";
+import { ErrorCode, HttpError } from "alinea/core/HttpError";
 import { createId } from "alinea/core/Id";
 import { outcome } from "alinea/core/Outcome";
 import { assert } from "alinea/core/util/Assert";
@@ -459,6 +456,7 @@ import {
   MissingCredentialsError
 } from "../Auth.js";
 import { router } from "../router/Router.js";
+import { jwks } from "../util/JWKS.js";
 var COOKIE_VERIFIER = "alinea.cv";
 var COOKIE_ACCESS_TOKEN = "alinea.at";
 var COOKIE_REFRESH_TOKEN = "alinea.rt";
@@ -466,7 +464,7 @@ var OAuth2 = class {
   #context;
   #config;
   #client;
-  #jwks;
+  #jwksUri;
   #validateClaims;
   constructor(context, config, options) {
     assert(
@@ -489,19 +487,16 @@ var OAuth2 = class {
         return response;
       })
     });
-    const loadJwks = async () => {
-      try {
-        const res = await fetch(options.jwksUri);
-        if (res.status !== 200)
-          throw new HttpError(res.status, await res.text());
-        const jwks = await res.json();
-        return jwks.keys;
-      } catch (cause) {
-        this.#jwks = PLazy.from(loadJwks);
-        throw new Error("Remote unavailable", { cause });
-      }
-    };
-    this.#jwks = PLazy.from(loadJwks);
+    this.#jwksUri = options.jwksUri;
+  }
+  async #key(token) {
+    const { header } = decode(token);
+    const keys = await jwks(this.#jwksUri, header.kid).catch((cause) => {
+      throw new HttpError(ErrorCode.ServiceUnavailable, "Remote unavailable", {
+        cause
+      });
+    });
+    return selectKey(keys, header);
   }
   get #redirectUri() {
     const url = new URL(this.#context.handlerUrl);
@@ -612,11 +607,10 @@ var OAuth2 = class {
       [COOKIE_ACCESS_TOKEN]: accessToken,
       [COOKIE_REFRESH_TOKEN]: refreshToken
     } = parse(cookieHeader);
-    const jwks = await this.#jwks;
     try {
       if (!accessToken)
         throw new MissingCredentialsError("Missing access token cookie");
-      const key = selectKey(jwks, accessToken);
+      const key = await this.#key(accessToken);
       const user = await verify(accessToken, key);
       await this.#validateClaims(user);
       assert(user.exp, "Missing exp claim in access token");
@@ -626,13 +620,15 @@ var OAuth2 = class {
       return { ...ctx, user, token: accessToken };
     } catch (error) {
       if (!refreshToken) throw error;
+      if (error instanceof HttpError && error.code === ErrorCode.ServiceUnavailable)
+        throw error;
       const token = { accessToken, refreshToken, expiresAt: null };
       const newToken = await this.#client.refreshToken(token).catch((cause) => {
         throw new InvalidCredentialsError("Failed to refresh token", {
           cause: [cause, error]
         });
       });
-      const key = selectKey(jwks, newToken.accessToken);
+      const key = await this.#key(newToken.accessToken);
       const user = await verify(newToken.accessToken, key, {
         clockTolerance: 30
       }).catch((cause) => {
@@ -653,13 +649,12 @@ var OAuth2 = class {
     }
   }
 };
-function selectKey(jwks, token) {
-  const { header } = decode(token);
+function selectKey(jwks2, header) {
   const kid = header.kid;
   const alg = header.alg;
   if (!kid) {
-    if (jwks.length === 1) {
-      const key2 = jwks[0];
+    if (jwks2.length === 1) {
+      const key2 = jwks2[0];
       if (key2.alg && alg && key2.alg !== alg) {
         throw new Error(
           `Algorithm mismatch: token uses ${alg}, but key specifies ${key2.alg}`
@@ -671,7 +666,7 @@ function selectKey(jwks, token) {
       'Token is missing "kid" header, and JWKS contains multiple keys'
     );
   }
-  const key = jwks.find((k) => k.kid === kid);
+  const key = jwks2.find((k) => k.kid === kid);
   if (!key) throw new Error(`No key found for kid: ${kid}`);
   if (key.alg && alg && key.alg !== alg)
     throw new Error(

package/dist/backend/util/JWKS.d.ts

@@ -0,0 +1,4 @@
+export interface WebKey extends JsonWebKey {
+    kid: string;
+}
+export declare function jwks(uri: string, kid?: string): Promise<Array<WebKey>>;

package/dist/backend/util/JWKS.js

@@ -0,0 +1,40 @@
+import "../../chunks/chunk-CQ52GEHY.js";
+
+// src/backend/util/JWKS.ts
+import { HttpError } from "alinea/core/HttpError";
+import { isRecord } from "alinea/core/util/Objects";
+var lifetime = 10 * 60 * 1e3;
+var refreshInterval = 60 * 1e3;
+var cache = /* @__PURE__ */ new Map();
+async function jwks(uri, kid) {
+  const cached = cache.get(uri);
+  if (!cached || Date.now() >= cached.expires) return load(uri, cached);
+  const keys = await cached.keys;
+  if (!kid || keys.some((key) => key.kid === kid)) return keys;
+  const current = cache.get(uri);
+  if (current && current !== cached) return current.keys;
+  if (Date.now() - cached.loaded < refreshInterval) return keys;
+  return load(uri, cached);
+}
+function load(uri, previous) {
+  const fetched = fetch(uri).then(async (response) => {
+    if (!response.ok) throw new HttpError(response.status);
+    const body = await response.json();
+    if (!isRecord(body) || !Array.isArray(body.keys))
+      throw new Error("Invalid signing keys");
+    return body.keys.filter(isKey);
+  });
+  const keys = previous ? fetched.catch(() => previous.keys) : fetched;
+  const entry = { keys, expires: Date.now() + lifetime, loaded: Date.now() };
+  cache.set(uri, entry);
+  keys.catch(() => {
+    if (cache.get(uri) === entry) cache.delete(uri);
+  });
+  return fetched;
+}
+function isKey(value) {
+  return isRecord(value) && typeof value.kid === "string";
+}
+export {
+  jwks
+};