okengine 0.15.2 → 0.17.0

package/src/kernel/adopt-routes.ts

@@ -8,7 +8,8 @@
 import type { InferSchemaOutput } from "../validation/standard-schema.ts";
 import type { AnyFlowDef, FlowDef, FlowErrorMap } from "./flow.ts";
 import { isFlow } from "./flow.ts";
-import type { HttpTrigger, Trigger } from "./triggers.ts";
+import type { HttpTrigger, LiveHttpTrigger, Trigger } from "./triggers.ts";
+import { httpPathParams } from "./live-http.ts";
 
 /**
  * One flow's route contract on `app.$routes` (compatible with client
@@ -52,6 +53,10 @@ export type AppRouteMap = {
       readonly errors?: unknown;
       readonly method?: string;
       readonly path?: string;
+      readonly live?: string;
+      readonly matchKey?: readonly string[];
+      readonly gates?: readonly string[];
+      readonly stream?: true;
     };
   };
 };
@@ -73,6 +78,28 @@ export type ErrorDataOf<E extends FlowErrorMap> = {
   [K in keyof E]: InferSchemaOutput<E[K]>;
 };
 
+/**
+ * HTTP live exposure on `$routes` so `createClient(app)` types
+ * `api.unit.flow(input, { onEvent })` as subscribe, not JSON RPC.
+ *
+ * @typeParam I - Input
+ * @typeParam O - Output
+ * @typeParam E - Error map
+ * @typeParam M - HTTP method
+ * @typeParam P - Path
+ */
+export type LiveAppFlowRoute<
+  I = unknown,
+  O = unknown,
+  E extends Record<string, unknown> = Record<string, unknown>,
+  M extends string = string,
+  P extends string = string,
+> = AppFlowRoute<I, O, E, M, P> & {
+  readonly live: string;
+  readonly stream: true;
+  readonly matchKey: readonly string[];
+};
+
 /**
  * Derive a client route contract from a {@link FlowDef} (trigger → REST).
  *
@@ -80,9 +107,11 @@ export type ErrorDataOf<E extends FlowErrorMap> = {
  */
 export type RouteFromFlow<F> =
   F extends FlowDef<infer I, infer O, infer E, any, infer T>
-    ? [T] extends [HttpTrigger<infer M, infer P>]
-      ? AppFlowRoute<I, O, ErrorDataOf<E>, M, P>
-      : AppFlowRoute<I, O, ErrorDataOf<E>>
+    ? [T] extends [LiveHttpTrigger<infer M, infer P>]
+      ? LiveAppFlowRoute<I, O, ErrorDataOf<E>, M, P>
+      : [T] extends [HttpTrigger<infer M, infer P>]
+        ? AppFlowRoute<I, O, ErrorDataOf<E>, M, P>
+        : AppFlowRoute<I, O, ErrorDataOf<E>>
     : never;
 
 /**
@@ -130,6 +159,14 @@ export type RoutesFromAdoptArgs<Args extends readonly unknown[]> = Args extends
 export interface RuntimeFlowRoute {
   readonly method?: string;
   readonly path?: string;
+  /** SSE live signal name when the trigger used `.live(signal)`. */
+  readonly live?: string;
+  /** Sorted auto-match path-param names (empty = firehose). */
+  readonly matchKey?: readonly string[];
+  /** Flattened gate names on the HTTP trigger. */
+  readonly gates?: readonly string[];
+  /** True when this flow returns `text/event-stream`. */
+  readonly stream?: true;
 }
 
 /** Runtime `$routes` table (values; types live on {@link OkeApp}). */
@@ -146,10 +183,21 @@ export type RuntimeRouteMap = {
  */
 export function runtimeRouteFromFlow(flowDef: AnyFlowDef): RuntimeFlowRoute {
   const trigger: Trigger | undefined = flowDef.$trigger ?? flowDef.triggers[0];
-  if (trigger?.kind === "http") {
-    return { method: trigger.method, path: trigger.path };
-  }
-  return {};
+  if (trigger?.kind !== "http") return {};
+  const liveName = trigger.liveSignal?.name ?? flowDef.live;
+  const gates = trigger.gates.map((g) => (typeof g === "string" ? g : g.name));
+  return {
+    method: trigger.method,
+    path: trigger.path,
+    ...(liveName !== undefined
+      ? {
+          live: liveName,
+          stream: true as const,
+          matchKey: httpPathParams(trigger.path),
+          ...(gates.length > 0 ? { gates } : {}),
+        }
+      : {}),
+  };
 }
 
 /**

package/src/kernel/api-key-host-persist.test.ts

@@ -0,0 +1,143 @@
+/**
+ * Host API-key durability — standalone `oke()` (no Console).
+ *
+ * Creates a key via `fx.auth.createApiKey`, stops, boots a fresh app against
+ * the same SQL URL, and verifies Bearer on the new `gate.auth.apiKeyStore`.
+ * Production uses postgres + `DATABASE_URL`; this suite uses file-backed
+ * PGlite at that same URL so the restart is hermetic.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { AUTH_TABLES } from "../auth/tables.ts";
+import { gate } from "../elements/gate.ts";
+import { resetStores, store } from "../elements/store/declare.ts";
+import { oke } from "./app.ts";
+import { flow, resetFlowSeq } from "./flow.ts";
+import { on, resetBindings } from "./on.ts";
+import { http } from "./triggers.ts";
+
+const PEPPER = "oke-host-api-key-persist-pepper";
+const member = gate.policy("member", ({ auth }) => !!auth.verified);
+
+function resetIsolated(): void {
+  resetBindings();
+  resetFlowSeq();
+  resetStores();
+}
+
+afterEach(() => {
+  resetIsolated();
+});
+
+describe("host API key persist via store.sql()", () => {
+  test("standalone oke() persists keys across restart; Bearer verifies on a fresh store", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "oke-host-keys-"));
+    const sqlUrl = join(dir, "pgdata");
+    const prevDb = process.env.DATABASE_URL;
+    const prevPglite = process.env.OKE_PGLITE_URL;
+    process.env.DATABASE_URL = sqlUrl;
+    process.env.OKE_PGLITE_URL = sqlUrl;
+
+    try {
+      resetIsolated();
+      const db1 = store.sql("app", { schema: {} });
+      on(
+        http.post("/keys").gate(member),
+        flow("keys.create", {
+          effects: { writes: ["auth:api-keys"] },
+          do: (_input, fx) => fx.auth.createApiKey({ name: "prod-ci", scopes: ["member"] }),
+        }),
+      );
+      on(
+        http.get("/secure").gate(member),
+        flow("secure.ping", {
+          effects: {},
+          do: () => ({ ok: true }),
+        }),
+      );
+
+      const first = oke({
+        name: "host-keys-first",
+        stores: [db1],
+        gate: {
+          auth: { secret: PEPPER, http: false },
+          policies: [member],
+        },
+        env: "test",
+        startScheduler: false,
+      });
+      await first.boot({ env: "test", startScheduler: false });
+      expect(first.apiKeys?.persist).toBeTypeOf("function");
+
+      const created = await first.execute(
+        first.flow("keys.create")!,
+        {},
+        http.post("/keys").gate(member),
+        {
+          principal: {
+            plane: "user",
+            userId: "u_issuer",
+            scopes: new Set(["member"]),
+            verified: true,
+          },
+        },
+      );
+      expect(created.failure).toBeUndefined();
+      const secret = (created.output as { secret?: string } | undefined)?.secret;
+      expect(secret?.startsWith("oke_")).toBe(true);
+
+      const firstStore = first.bootResult?.store;
+      await first.stop();
+      await firstStore?.close();
+
+      resetIsolated();
+      const db2 = store.sql("app", { schema: {} });
+      on(
+        http.get("/secure").gate(member),
+        flow("secure.ping", {
+          effects: {},
+          do: () => ({ ok: true }),
+        }),
+      );
+      const second = oke({
+        name: "host-keys-second",
+        stores: [db2],
+        gate: {
+          auth: { secret: PEPPER, http: false },
+          policies: [member],
+        },
+        env: "test",
+        startScheduler: false,
+      });
+      await second.boot({ env: "test", startScheduler: false });
+      expect(second.apiKeys).not.toBe(first.apiKeys);
+      expect(second.apiKeys?.keys.size).toBeGreaterThan(0);
+
+      const conn = await second.bootResult?.store?.primarySql();
+      const rows = await conn?.query(`SELECT id, name FROM ${AUTH_TABLES.apiKeys}`);
+      expect(rows?.some((r) => r.name === "prod-ci")).toBe(true);
+
+      const res = await second.fetch(
+        new Request("http://localhost/secure", {
+          method: "GET",
+          headers: { authorization: `Bearer ${secret}` },
+        }),
+      );
+      expect(res.status).toBe(200);
+      expect(await res.json()).toEqual({ data: { ok: true }, error: null });
+
+      const secondStore = second.bootResult?.store;
+      await second.stop();
+      await secondStore?.close();
+    } finally {
+      if (prevDb === undefined) delete process.env.DATABASE_URL;
+      else process.env.DATABASE_URL = prevDb;
+      if (prevPglite === undefined) delete process.env.OKE_PGLITE_URL;
+      else process.env.OKE_PGLITE_URL = prevPglite;
+      await rm(dir, { recursive: true, force: true });
+    }
+  }, 20_000);
+});

package/src/kernel/app-tenant.ts

@@ -0,0 +1,122 @@
+/**
+ * App-shell tenancy wiring — lazy chunk.
+ *
+ * One `w` dispatcher so Store-only `oke()` graphs do not spell Clock /
+ * pipeline tenant field names.
+ */
+
+import type { ResolvedTenantAuth } from "../auth/tenant-config.ts";
+import type { TenantStore } from "../auth/tenants.ts";
+import type { ClockDecl } from "../elements/clock/declare.ts";
+import { parsePerTenantCronName } from "./clock-per-tenant-name.ts";
+import { orphanPerTenantCronRows, putPerTenantCronRows } from "./clock-reconcile.ts";
+import type { AnyFlowDef } from "./flow.ts";
+import type { PipelineTenantDeps } from "./pipeline.ts";
+
+function cron(name: string): { readonly tenant: { readonly id: string } } | undefined {
+  const parsed = parsePerTenantCronName(name);
+  return parsed ? { tenant: { id: parsed.tenantId } } : undefined;
+}
+
+function boot(store: TenantStore): { readonly tenantIds: () => string[] } {
+  return { tenantIds: () => [...store.tenants.keys()] };
+}
+
+function clock(
+  tenantStore: TenantStore,
+  clockStore: Parameters<typeof putPerTenantCronRows>[0],
+  templates: readonly ClockDecl[],
+): void {
+  tenantStore.hooks = {
+    onCreate: (row) => putPerTenantCronRows(clockStore, templates, row.id),
+    onDelete: (row) => orphanPerTenantCronRows(clockStore, templates, row.id),
+  };
+}
+
+function resume(auth: { readonly tenant?: unknown; readonly tenantStore?: TenantStore }): {
+  readonly tenantEnabled: boolean;
+  readonly tenantStore: TenantStore | undefined;
+} {
+  return {
+    tenantEnabled: auth.tenant !== undefined,
+    tenantStore: auth.tenantStore,
+  };
+}
+
+function pipe(
+  tenant: ResolvedTenantAuth,
+  store: TenantStore,
+  flowTenantScoped: boolean,
+  flowPlane: AnyFlowDef["plane"],
+): { readonly tenant: PipelineTenantDeps } {
+  return {
+    tenant: {
+      config: tenant,
+      store,
+      flowTenantScoped,
+      flowPlane,
+    },
+  };
+}
+
+function fx(args: {
+  readonly enabled: boolean;
+  readonly store: TenantStore | undefined;
+  readonly scoped: boolean;
+  readonly plane: AnyFlowDef["plane"];
+  readonly tenant: { readonly id: string | null } | undefined;
+  readonly bind?: { readonly secret: string; readonly now: () => number };
+}): {
+  readonly tenantStore: TenantStore | undefined;
+  readonly tenantEnabled: boolean;
+  readonly flowTenantScoped: boolean;
+  readonly flowPlane: AnyFlowDef["plane"];
+  readonly sessionCrypto?: { readonly secret: string; readonly now: () => number };
+  readonly tenant?: { readonly id: string | null };
+} {
+  return {
+    tenantStore: args.store,
+    tenantEnabled: args.enabled,
+    flowTenantScoped: args.scoped,
+    flowPlane: args.plane,
+    ...(args.bind ? { sessionCrypto: { secret: args.bind.secret, now: args.bind.now } } : {}),
+    ...(args.tenant ? { tenant: args.tenant } : {}),
+  };
+}
+
+/**
+ * Dispatch tenancy wiring.
+ *
+ * 0 cron · 1 boot · 2 clock · 3 pipe · 4 fx · 5 resume
+ *
+ * @param kind - Operation
+ * @param args - Kind-specific arguments
+ */
+export function w(kind: number, ...args: unknown[]): unknown {
+  switch (kind) {
+    case 0:
+      return cron(args[0] as string);
+    case 1:
+      return boot(args[0] as TenantStore);
+    case 2:
+      clock(
+        args[0] as TenantStore,
+        args[1] as Parameters<typeof putPerTenantCronRows>[0],
+        args[2] as readonly ClockDecl[],
+      );
+      return undefined;
+    case 3:
+      return pipe(
+        args[0] as ResolvedTenantAuth,
+        args[1] as TenantStore,
+        args[2] as boolean,
+        args[3] as AnyFlowDef["plane"],
+      );
+    case 4:
+      return fx(args[0] as Parameters<typeof fx>[0]);
+    case 5:
+      return resume(args[0] as Parameters<typeof resume>[0]);
+    default:
+      return undefined;
+  }
+}