bazis 0.98.26 → 0.98.27

package/core/http/Authorization/anyOf.ts

@@ -0,0 +1,37 @@
+import { JwtError } from "../../../library/jwt/errors";
+import { ForbiddenError, UnauthorizedError } from "../Errors/HttpError";
+import type { AuthorizeCheck } from "./metadata";
+
+/**
+ * A check that passes when any of `checks` passes (`@Authorize(a, b)` needs
+ * all of them). Checks run in order and stop at the first that passes. When
+ * none passes, the request is `401` if every check failed as "not signed in"
+ * (`UnauthorizedError`, `JwtError`), otherwise `403`. Any other error of a
+ * check is a bug and propagates unchanged.
+ */
+export function anyOf(...checks: AuthorizeCheck[]): AuthorizeCheck {
+  if (checks.length === 0) throw new TypeError("anyOf() needs at least one check");
+  return async (ctx) => {
+    let unauthenticated: UnauthorizedError | undefined;
+    let forbidden = false;
+    for (const check of checks) {
+      try {
+        if (await check(ctx)) return true;
+        forbidden = true;
+      } catch (error) {
+        if (error instanceof ForbiddenError) { forbidden = true; continue; }
+        if (error instanceof UnauthorizedError) { unauthenticated ??= error; continue; }
+        if (error instanceof JwtError) {
+          if (unauthenticated === undefined) {
+            unauthenticated = new UnauthorizedError();
+            Object.defineProperty(unauthenticated, "cause", { value: error, configurable: true, writable: true });
+          }
+          continue;
+        }
+        throw error;
+      }
+    }
+    if (forbidden) return false;
+    throw unauthenticated ?? new UnauthorizedError();
+  };
+}

package/core/http/index.ts

@@ -35,6 +35,7 @@ export { PRINCIPAL_STATE_KEY, type RequestPrincipal } from "./HttpContext/princi
 export { Authorize, AllowAnonymous } from "./Authorization/Authorize";
 export { createAuthorizeComposer } from "./Authorization/authorizeComposer";
 export { bearerToken } from "./Authorization/bearerToken";
+export { anyOf } from "./Authorization/anyOf";
 export {
   resolveAuthorizeMeta,
   type AuthorizeCheck,

package/core/infra/connectors/codex/CodexAppServerClient.ts

@@ -232,7 +232,7 @@ export class CodexAppServerClient implements CodexClient {
         if (method === "account/updated") this.modelCache = undefined;
       }, () => { this.clearLogin(); this.modelCache = undefined; });
       const initialized = await client.request("initialize", {
-        clientInfo: { name: "bazis", title: "Bazis", version: "0.98.26" }, capabilities: { experimentalApi: true },
+        clientInfo: { name: "bazis", title: "Bazis", version: "0.98.27" }, capabilities: { experimentalApi: true },
       }, 15_000, signal);
       if (resolve(text(initialized.codexHome, 4096)) !== this.paths.home) throw new CodexError("PROTOCOL_ERROR");
       client.notify("initialized");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.98.26",
+  "version": "0.98.27",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",