lecodes-sdk 2.0.4 → 2.0.5

package/src/server/auth/api.ts

@@ -0,0 +1,94 @@
+/**
+ * `db.auth` — the BUNDLE side of sign-in, what `*.server.ts` code calls on a db made with
+ * `defineDb({...}).withAuth({ model: "User" })`:
+ *
+ *   const db = defineDb({ User, Post }).withAuth({ model: "User" })
+ *
+ *   export async function register(login: string, password: string, name: string) {
+ *     await db.auth.signUpWithPassword(login, password, { name })
+ *   }
+ *   export async function me()                { return db.auth.user().select({ id: true, name: true }) }
+ *   export async function removePost(id: number) {
+ *     await db.auth.requireUser({ role: "admin" }).select({ id: true })
+ *     …
+ *   }
+ *
+ * The platform knows a request's session and the ID of its user (the host resolved the token before
+ * the endpoint ran). Everything else about a user is a row of the project's own model, and is READ:
+ * `user()` / `requireUser()` are queries over that model — typed by it, run when awaited — narrowed to
+ * the user of the request. Sign-in operations forward to the host's `AuthOps` on
+ * `globalThis.__lecodesAuth` (a seam: the compiled bundle carries its own SDK copy).
+ */
+
+import { currentRequest, type RequestContext } from "../context"
+import { ApiError } from "../errors"
+import type { AuthOps, AuthState } from "./types"
+
+/** The collections of a db with auth, by role (defineDb.ts). */
+export type AuthCollections = { model: string, user: any, session: any, identity: any }
+
+const seam = globalThis as unknown as { __lecodesAuth?: AuthOps }
+const ops = (): AuthOps => {
+  const o = seam.__lecodesAuth
+  if (!o) throw new Error("db.auth: not available — the host did not install the auth runtime (globalThis.__lecodesAuth)")
+  return o
+}
+const ctx = (): RequestContext => {
+  const c = currentRequest()
+  if (!c) throw new Error("db.auth: no current request — it is only available while handling an endpoint or a channel join")
+  return c
+}
+const state = (): AuthState => {
+  const s = ctx().auth as AuthState | undefined
+  if (!s) throw new Error("db.auth: the request carries no session — the host runs no auth for this db")
+  return s
+}
+
+/** A select of the id alone: the answer is in the session already. */
+const onlyId = (shape: Record<string, unknown> | undefined): boolean => {
+  if (!shape) return false
+  const keys = Object.keys(shape)
+  return keys.length === 1 && keys[0] === "id" && shape.id === true
+}
+
+export const createAuthApi = (tables: () => AuthCollections) => {
+  // The user of the request as a query: nothing runs until it is awaited. `required` = a guest is a
+  // 401 instead of null; `where` narrows it (a check of access: no row is a 403).
+  // The request is taken when the query is MADE (inside the endpoint), not when it is awaited: an endpoint
+  // may hand the query back unawaited (`me = () => db.auth.user()`), and it then runs outside the request's scope.
+  const userQuery = (of: RequestContext | undefined, required: boolean, where?: Record<string, unknown>, shape?: Record<string, unknown>): any => {
+    const run = async () => {
+      const s = (of?.auth as AuthState | undefined) ?? state()
+      if (s.userId === null) {
+        if (required) throw new ApiError(401, "Sign in required")
+        return null
+      }
+      if (!where && onlyId(shape)) return { id: s.userId }
+      let q = tables().user.where({ id: s.userId })
+      if (where) q = q.where(where)
+      const row = await (shape ? q.select(shape) : q).first()
+      if (!row && required) throw new ApiError(where ? 403 : 401, where ? "Forbidden" : "Sign in required")
+      return row
+    }
+    return {
+      select: (next: Record<string, unknown>) => userQuery(of, required, where, next),
+      then: (onFulfilled?: any, onRejected?: any) => run().then(onFulfilled, onRejected),
+    }
+  }
+
+  return {
+    user: () => userQuery(currentRequest(), false),
+    requireUser: (where?: Record<string, unknown>) => userQuery(currentRequest(), true, where),
+    get sessionId(): number { return state().sessionId },
+
+    signUpWithPassword: (login: string, password: string, data?: Record<string, unknown>) => ops().signUpWithPassword(ctx(), login, password, data),
+    signInWithPassword: (login: string, password: string) => ops().signInWithPassword(ctx(), login, password),
+    setPassword: (password: string) => ops().setPassword(ctx(), password),
+    sendCode: (email: string) => ops().sendCode(ctx(), email),
+    signInWithCode: (email: string, code: string) => ops().signInWithCode(ctx(), email, code),
+    signIn: (userId: number) => ops().signIn(ctx(), userId),
+    signOut: () => ops().signOut(ctx()),
+    get sessions() { return ops().sessions(ctx()) },
+    get identities() { return ops().identities(ctx()) },
+  }
+}

package/src/server/auth/appConfig.ts

@@ -1,12 +1,11 @@
 /**
- * The project's `app.json` subset the server runtime reads (name, auth providers).
+ * The project's `app.json` subset the server runtime reads: the app's name (the sign-in mail).
  *
  * This module is a placeholder the COMPILER REPLACES: `compileServerBundle({ app })` puts a module with the
  * real values at this same path in chisel's file map (project files win over SDK files), so every SDK module
  * that imports `app` gets the project's config as a plain dependency — no globals, no evaluation-order games.
  * Outside a compiled bundle (tests, tooling) `globalThis.__lecodesApp` can stand in.
  */
-export type AuthProvider = "email" | "google" | "apple" | "yandex" | "vk"
-export type AppConfig = { name?: string, auth?: { providers?: AuthProvider[] } }
+export type AppConfig = { name?: string }
 
 export const app: AppConfig = {}