effect 4.0.0-beta.102 → 4.0.0-beta.103

package/src/unstable/eventlog/EventLogServer.ts

@@ -80,7 +80,8 @@ export const layerRpcHandlers = (options: {
     signingPublicKey: Uint8Array<ArrayBuffer>
   ) => Effect.Effect<Uint8Array<ArrayBuffer>>
   readonly onWrite: (
-    data: Uint8Array<ArrayBuffer>
+    data: Uint8Array<ArrayBuffer>,
+    authenticatedPublicKeys: ReadonlySet<string>
   ) => Effect.Effect<void, EventLogProtocolError>
   readonly changes: (options: {
     readonly publicKey: string
@@ -161,24 +162,46 @@ export const layerRpcHandlers = (options: {
           })
         }
 
+        const authenticatedIdentities = new Set(
+          Context.getOrUndefined(client.annotations, AuthenticatedIdentities)
+        )
+        authenticatedIdentities.add(request.publicKey)
         void client
           .annotate(EventLog.Identity, {
             publicKey: request.publicKey,
             privateKey: constEmptyPrivateKey
           })
+          .annotate(AuthenticatedIdentities, authenticatedIdentities)
           .annotate(ChunkedMessageState, new Map())
       }),
-      "EventLog.WriteSingle": Effect.fnUntraced(function*(request) {
-        yield* options.onWrite(request.data)
+      "EventLog.WriteSingle": Effect.fnUntraced(function*(request, { client }) {
+        yield* options.onWrite(
+          request.data,
+          Context.getOrUndefined(client.annotations, AuthenticatedIdentities) ?? new Set()
+        )
       }),
       "EventLog.WriteChunked": Effect.fnUntraced(function*(request, { client }) {
         const state = Context.get(client.annotations, ChunkedMessageState)
         const data = ChunkedMessage.join(state, request)
         if (!data) return
-        yield* options.onWrite(data)
+        yield* options.onWrite(
+          data,
+          Context.getOrUndefined(client.annotations, AuthenticatedIdentities) ?? new Set()
+        )
       }),
-      "EventLog.Changes": (request) =>
-        options.changes({
+      "EventLog.Changes": (request, { client }) => {
+        const authenticatedIdentities = Context.getOrUndefined(client.annotations, AuthenticatedIdentities)
+        if (!authenticatedIdentities?.has(request.publicKey)) {
+          return Stream.fail(
+            new EventLogProtocolError({
+              requestTag: "Changes",
+              publicKey: request.publicKey,
+              code: "Forbidden",
+              message: "Identity is not authenticated"
+            })
+          )
+        }
+        return options.changes({
           publicKey: request.publicKey,
           storeId: request.storeId,
           startSequence: request.startSequence
@@ -200,6 +223,7 @@ export const layerRpcHandlers = (options: {
             )
           )
         )
+      }
     })
   })).pipe(
     Layer.merge(layerAuthMiddleware)
@@ -214,7 +238,7 @@ export const layerRpcHandlers = (options: {
  * Use to keep per-client chunk assembly state while handling chunked event-log
  * writes.
  *
- * @category chunked message state
+ * @category services
  * @since 4.0.0
  */
 export class ChunkedMessageState extends Context.Reference<
@@ -227,6 +251,16 @@ export class ChunkedMessageState extends Context.Reference<
   defaultValue: () => new Map()
 }) {}
 
+/**
+ * Annotation containing the public keys authenticated on an RPC connection.
+ *
+ * @category services
+ * @since 4.0.0
+ */
+export class AuthenticatedIdentities extends Context.Service<AuthenticatedIdentities, Set<string>>()(
+  "effect/eventlog/EventLogServer/AuthenticatedIdentities"
+) {}
+
 class SessionAuthCacheKey extends Data.Class<{
   readonly publicKey: string
   readonly signingPublicKey: Uint8Array<ArrayBuffer>

package/src/unstable/eventlog/EventLogServerEncrypted.ts

@@ -47,7 +47,7 @@ export const layerRpcHandlers = Layer.unwrap(Effect.gen(function*() {
     remoteId,
     getOrCreateSessionAuthBinding: (publicKey, signingPublicKey) =>
       storage.getOrCreateSessionAuthBinding(publicKey, signingPublicKey),
-    onWrite: Effect.fnUntraced(function*(data) {
+    onWrite: Effect.fnUntraced(function*(data, authenticatedPublicKeys) {
       const request = yield* WriteEntries.decode(data).pipe(
         Effect.mapError((_) =>
           new EventLogProtocolError({
@@ -58,6 +58,14 @@ export const layerRpcHandlers = Layer.unwrap(Effect.gen(function*() {
           })
         )
       )
+      if (!authenticatedPublicKeys.has(request.publicKey)) {
+        return yield* new EventLogProtocolError({
+          requestTag: "WriteEntries",
+          publicKey: request.publicKey,
+          code: "Forbidden",
+          message: "Identity is not authenticated"
+        })
+      }
       if (request.encryptedEntries.length === 0) return
       const entries = request.encryptedEntries.map(({ encryptedEntry, entryId }) =>
         new PersistedEntry({
@@ -116,7 +124,7 @@ export const layer: Layer.Layer<never, never, RpcServer.Protocol | Storage> = Rp
 /**
  * Schema for encrypted entries persisted by the encrypted event-log server.
  *
- * @category storage
+ * @category models
  * @since 4.0.0
  */
 export class PersistedEntry extends Schema.Class<PersistedEntry>(
@@ -150,7 +158,7 @@ export class PersistedEntry extends Schema.Class<PersistedEntry>(
  * persists encrypted entries, and streams encrypted changes for a public key and
  * store id.
  *
- * @category storage
+ * @category services
  * @since 4.0.0
  */
 export class Storage extends Context.Service<Storage, {
@@ -179,7 +187,7 @@ export class Storage extends Context.Service<Storage, {
  * Data, session authentication bindings, and streams are process-local and are
  * released with the surrounding scope.
  *
- * @category storage
+ * @category constructors
  * @since 4.0.0
  */
 export const makeStorageMemory: Effect.Effect<Storage["Service"], never, Scope.Scope> = Effect.gen(function*() {
@@ -255,7 +263,7 @@ export const makeStorageMemory: Effect.Effect<Storage["Service"], never, Scope.S
 /**
  * Provides encrypted server `Storage` using the in-memory implementation.
  *
- * @category storage
+ * @category layers
  * @since 4.0.0
  */
 export const layerStorageMemory: Layer.Layer<Storage> = Layer.effect(Storage)(makeStorageMemory)

package/src/unstable/eventlog/EventLogServerUnencrypted.ts

@@ -74,7 +74,7 @@ export class EventLogServerUnencrypted extends Context.Service<EventLogServerUne
  * Creates a typed server-side write function for events in the supplied
  * `EventLogSchema`.
  *
- * @category EventLogServerUnencrypted
+ * @category constructors
  * @since 4.0.0
  */
 export const makeWrite = <Groups extends EventGroup.Any>(
@@ -146,7 +146,7 @@ export const layerRpcHandlers: Layer.Layer<
     remoteId,
     getOrCreateSessionAuthBinding: (publicKey, signingPublicKey) =>
       storage.getOrCreateSessionAuthBinding(publicKey, signingPublicKey),
-    onWrite: Effect.fnUntraced(function*(data) {
+    onWrite: Effect.fnUntraced(function*(data, authenticatedPublicKeys) {
       const request = yield* WriteEntriesUnencrypted.decode(data).pipe(
         Effect.mapError((_) =>
           new EventLogProtocolError({
@@ -157,6 +157,14 @@ export const layerRpcHandlers: Layer.Layer<
           })
         )
       )
+      if (!authenticatedPublicKeys.has(request.publicKey)) {
+        return yield* new EventLogProtocolError({
+          requestTag: "WriteEntries",
+          publicKey: request.publicKey,
+          code: "Forbidden",
+          message: "Identity is not authenticated"
+        })
+      }
       if (!Arr.isReadonlyArrayNonEmpty(request.entries)) return
 
       const resolvedStoreId = yield* mapping.resolve({
@@ -322,7 +330,7 @@ const toStoreNotFoundError = (options: {
  * Provides a `StoreMapping` that accepts only one configured store id and fails
  * all other store ids as not found.
  *
- * @category store
+ * @category layers
  * @since 4.0.0
  */
 export const layerStoreMappingStatic = (options: {
@@ -352,7 +360,7 @@ export const layerStoreMappingStatic = (options: {
  * allocates remote sequence numbers, persists entries, streams changes, and
  * exposes a transaction boundary.
  *
- * @category storage
+ * @category services
  * @since 4.0.0
  */
 export class Storage extends Context.Service<Storage, {
@@ -556,7 +564,7 @@ export const compactBacklog = Effect.fnUntraced(function*(options: {
  * in memory, publishes live changes, and serializes transactions with a
  * semaphore.
  *
- * @category storage
+ * @category constructors
  * @since 4.0.0
  */
 export const makeStorageMemory: Effect.Effect<Storage["Service"], never, Scope.Scope> = Effect.gen(function*() {
@@ -663,7 +671,7 @@ export const makeStorageMemory: Effect.Effect<Storage["Service"], never, Scope.S
 /**
  * Provides unencrypted server `Storage` using the in-memory implementation.
  *
- * @category storage
+ * @category layers
  * @since 4.0.0
  */
 export const layerStorageMemory: Layer.Layer<Storage> = Layer.effect(Storage)(makeStorageMemory)

package/src/unstable/eventlog/EventLogSessionAuth.ts

@@ -479,7 +479,7 @@ export const verifySessionAuthPayload = (
 /**
  * Generates a random session authentication challenge using `globalThis.crypto`.
  *
- * @category challenge
+ * @category constructors
  * @since 4.0.0
  */
 export const makeSessionAuthChallenge: Effect.Effect<

package/src/unstable/http/Cookies.ts

@@ -28,7 +28,7 @@ const TypeId = "~effect/http/Cookies"
 /**
  * Returns `true` when a value is a `Cookies` collection.
  *
- * @category refinements
+ * @category guards
  * @since 4.0.0
  */
 export const isCookies = (u: unknown): u is Cookies => Predicate.hasProperty(u, TypeId)
@@ -419,13 +419,17 @@ export const empty: Cookies = fromIterable([])
 /**
  * Returns `true` when the `Cookies` collection contains no cookies.
  *
- * @category refinements
+ * @category predicates
  * @since 4.0.0
  */
 export const isEmpty = (self: Cookies): boolean => Record.isEmptyRecord(self.cookies)
 
 // oxlint-disable-next-line no-control-regex
 const fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/
+const cookieNameRegExp = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/
+// oxlint-disable-next-line no-control-regex
+const cookieDomainRegExp = /^[\u0009\u0020-\u003a\u003c-\u007e\u0080-\u00ff]+$/
+const cookiePathRegExp = /^[\u0020-\u003a\u003c-\u007e]+$/
 
 const CookieProto = {
   [CookieTypeId]: CookieTypeId,
@@ -455,26 +459,10 @@ export function makeCookie(
   value: string,
   options?: Cookie["options"] | undefined
 ): Result.Result<Cookie, CookiesError> {
-  if (!fieldContentRegExp.test(name)) {
-    return Result.fail(CookiesError.fromReason("InvalidCookieName"))
-  }
   const encodedValue = encodeURIComponent(value)
-  if (encodedValue && !fieldContentRegExp.test(encodedValue)) {
-    return Result.fail(CookiesError.fromReason("InvalidCookieValue"))
-  }
-
-  if (options !== undefined) {
-    if (options.domain !== undefined && !fieldContentRegExp.test(options.domain)) {
-      return Result.fail(CookiesError.fromReason("InvalidCookieDomain"))
-    }
-
-    if (options.path !== undefined && !fieldContentRegExp.test(options.path)) {
-      return Result.fail(CookiesError.fromReason("InvalidCookiePath"))
-    }
-
-    if (options.maxAge !== undefined && !Duration.isFinite(Duration.fromInputUnsafe(options.maxAge))) {
-      return Result.fail(CookiesError.fromReason("CookieInfinityMaxAge"))
-    }
+  const error = validateCookie(name, encodedValue, options)
+  if (error !== undefined) {
+    return Result.fail(error)
   }
 
   return Result.succeed(Object.assign(Object.create(CookieProto), {
@@ -485,6 +473,28 @@ export function makeCookie(
   }))
 }
 
+function validateCookie(
+  name: string,
+  encodedValue: string,
+  options: Cookie["options"] | undefined
+): CookiesError | undefined {
+  if (!cookieNameRegExp.test(name)) {
+    return CookiesError.fromReason("InvalidCookieName")
+  }
+  if (encodedValue && !fieldContentRegExp.test(encodedValue)) {
+    return CookiesError.fromReason("InvalidCookieValue")
+  }
+  if (options?.domain !== undefined && !cookieDomainRegExp.test(options.domain)) {
+    return CookiesError.fromReason("InvalidCookieDomain")
+  }
+  if (options?.path !== undefined && !cookiePathRegExp.test(options.path)) {
+    return CookiesError.fromReason("InvalidCookiePath")
+  }
+  if (options?.maxAge !== undefined && !Duration.isFinite(Duration.fromInputUnsafe(options.maxAge))) {
+    return CookiesError.fromReason("CookieInfinityMaxAge")
+  }
+}
+
 /**
  * Create a new cookie, throwing an error if invalid
  *
@@ -942,6 +952,10 @@ export const setAllUnsafe: {
  * @since 4.0.0
  */
 export function serializeCookie(self: Cookie): string {
+  const error = validateCookie(self.name, self.valueEncoded, self.options)
+  if (error !== undefined) {
+    throw error
+  }
   let str = self.name + "=" + self.valueEncoded
 
   if (self.options === undefined) {

package/src/unstable/http/Etag.ts

@@ -71,7 +71,7 @@ export const toString = (self: Etag): string => {
 /**
  * Service for generating ETags from filesystem file information or Web `File`-like metadata.
  *
- * @category models
+ * @category services
  * @since 4.0.0
  */
 export class Generator extends Context.Service<Generator, {

package/src/unstable/http/FetchHttpClient.ts

@@ -53,7 +53,9 @@ export class RequestInit extends Context.Service<RequestInit, globalThis.Request
 const fetch: HttpClient.HttpClient = HttpClient.make((request, url, signal, fiber) => {
   const fetch = fiber.getRef(Fetch)
   const options: globalThis.RequestInit = fiber.context.mapUnsafe.get(RequestInit.key) ?? {}
-  let headers = options.headers ? Headers.merge(Headers.fromInput(options.headers), request.headers) : request.headers
+  let headers = options.headers
+    ? Headers.merge(Headers.fromInput(options.headers as Headers.Input), request.headers)
+    : request.headers
   if (headers["content-length"]) {
     headers = Headers.remove(headers, "content-length")
   }

package/src/unstable/http/Headers.ts

@@ -42,7 +42,7 @@ export type TypeId = typeof TypeId
 /**
  * Returns `true` if the provided value is a `Headers` value.
  *
- * @category refinements
+ * @category guards
  * @since 4.0.0
  */
 export const isHeaders = (u: unknown): u is Headers => Predicate.hasProperty(u, TypeId)
@@ -718,7 +718,7 @@ export const redact: {
  *
  * Defaults include `authorization`, `cookie`, `set-cookie`, and `x-api-key`.
  *
- * @category fiber refs
+ * @category services
  * @since 4.0.0
  */
 export const CurrentRedactedNames = Context.Reference<

package/src/unstable/http/HttpBody.ts

@@ -30,7 +30,7 @@ const TypeId = "~effect/http/HttpBody"
 /**
  * Returns `true` if the provided value is an `HttpBody`.
  *
- * @category refinements
+ * @category guards
  * @since 4.0.0
  */
 export const isHttpBody = (u: unknown): u is HttpBody => Predicate.hasProperty(u, TypeId)
@@ -484,12 +484,26 @@ export const stream = (
   contentLength?: number
 ): Stream => new Stream(body, contentType ?? "application/octet-stream", contentLength)
 
+const fileContentLength = (
+  size: FileSystem.SizeInput,
+  options?: {
+    readonly bytesToRead?: FileSystem.SizeInput | undefined
+    readonly offset?: FileSystem.SizeInput | undefined
+  }
+): number => {
+  const available = Math.max(0, Number(size) - Number(options?.offset ?? 0))
+  return options?.bytesToRead === undefined
+    ? available
+    : Math.min(available, Math.max(0, Number(options.bytesToRead)))
+}
+
 /**
  * Creates a streaming HTTP body for a file path.
  *
  * **Details**
  *
- * The effect requires `FileSystem`, stats the file to set the content length, and can fail with `PlatformError`.
+ * The effect requires `FileSystem`, stats the file to set the selected content length, and can fail with
+ * `PlatformError`.
  *
  * @category constructors
  * @since 4.0.0
@@ -510,7 +524,7 @@ export const file = (
         stream(
           fs.stream(path, options),
           options?.contentType,
-          Number(info.size)
+          fileContentLength(info.size, options)
         ))
   )
 
@@ -519,7 +533,8 @@ export const file = (
  *
  * **Details**
  *
- * The effect requires `FileSystem`, uses the provided file size as the content length, and can fail with `PlatformError`.
+ * The effect requires `FileSystem`, uses the provided file size to determine the selected content length, and can
+ * fail with `PlatformError`.
  *
  * @category constructors
  * @since 4.0.0
@@ -540,6 +555,6 @@ export const fileFromInfo = (
       stream(
         fs.stream(path, options),
         options?.contentType,
-        Number(info.size)
+        fileContentLength(info.size, options)
       )
   )