t3code-cli 0.3.0 → 0.4.0

package/src/auth/schema.ts

@@ -1,13 +1,21 @@
 import * as Schema from "effect/Schema";
 
-export const AuthBearerBootstrapResultSchema = Schema.Struct({
-  authenticated: Schema.Literal(true),
-  role: Schema.Literals(["owner", "client"]),
-  sessionMethod: Schema.Literal("bearer-session-token"),
-  expiresAt: Schema.String,
-  sessionToken: Schema.String,
+export const AuthAccessTokenResultSchema = Schema.Struct({
+  access_token: Schema.String,
+  issued_token_type: Schema.String,
+  token_type: Schema.Literal("Bearer"),
+  expires_in: Schema.Number,
+  scope: Schema.String,
 });
-export type AuthBearerBootstrapResult = typeof AuthBearerBootstrapResultSchema.Type;
+export type AuthAccessTokenResult = typeof AuthAccessTokenResultSchema.Type;
+
+export type AuthBearerBootstrapResult = {
+  readonly authenticated: true;
+  readonly role: "owner" | "client";
+  readonly sessionMethod: "bearer-access-token";
+  readonly expiresAt: string;
+  readonly sessionToken: string;
+};
 
 export const AuthSessionStateSchema = Schema.Struct({
   authenticated: Schema.Boolean,
@@ -17,18 +25,11 @@ export const AuthSessionStateSchema = Schema.Struct({
 });
 export type AuthSessionState = typeof AuthSessionStateSchema.Type;
 
-export const AuthWebSocketTokenResultSchema = Schema.Struct({
-  token: Schema.String,
-  expiresAt: Schema.String,
-});
-export type AuthWebSocketTokenResult = typeof AuthWebSocketTokenResultSchema.Type;
-
-export const AuthLocalSessionIssueResultSchema = Schema.Struct({
-  token: Schema.String,
-  role: Schema.Literals(["owner", "client"]),
+export const AuthWebSocketTicketResultSchema = Schema.Struct({
+  ticket: Schema.String,
   expiresAt: Schema.String,
 });
-export type AuthLocalSessionIssueResult = typeof AuthLocalSessionIssueResultSchema.Type;
+export type AuthWebSocketTicketResult = typeof AuthWebSocketTicketResultSchema.Type;
 
 export const AuthLocalRuntimeStateSchema = Schema.Struct({
   version: Schema.Literal(1),
@@ -36,20 +37,12 @@ export const AuthLocalRuntimeStateSchema = Schema.Struct({
 });
 export type AuthLocalRuntimeState = typeof AuthLocalRuntimeStateSchema.Type;
 
-export const decodeAuthBearerBootstrapResult = Schema.decodeUnknownEffect(
-  AuthBearerBootstrapResultSchema,
-);
+export const decodeAuthAccessTokenResult = Schema.decodeUnknownEffect(AuthAccessTokenResultSchema);
 export const decodeAuthSessionState = Schema.decodeUnknownEffect(AuthSessionStateSchema);
-export const decodeAuthWebSocketTokenResult = Schema.decodeUnknownEffect(
-  AuthWebSocketTokenResultSchema,
-);
-export const decodeAuthLocalSessionIssueResult = Schema.decodeUnknownEffect(
-  AuthLocalSessionIssueResultSchema,
+export const decodeAuthWebSocketTicketResult = Schema.decodeUnknownEffect(
+  AuthWebSocketTicketResultSchema,
 );
 export const decodeAuthLocalRuntimeState = Schema.decodeUnknownEffect(AuthLocalRuntimeStateSchema);
-export const decodeAuthLocalSessionIssueResultFromJson = Schema.decodeUnknownEffect(
-  Schema.fromJsonString(AuthLocalSessionIssueResultSchema),
-);
 export const decodeAuthLocalRuntimeStateFromJson = Schema.decodeUnknownEffect(
   Schema.fromJsonString(AuthLocalRuntimeStateSchema),
 );

package/src/auth/service.ts

@@ -1,7 +1,7 @@
 import * as Context from "effect/Context";
 import type * as Effect from "effect/Effect";
 
-import type { AuthSessionState, AuthWebSocketTokenResult } from "./schema.ts";
+import type { AuthSessionState, AuthWebSocketTicketResult } from "./schema.ts";
 import type { AuthError } from "./error.ts";
 import type { LocalAuthInput, LocalAuthResult, PairResult } from "./type.ts";
 
@@ -11,6 +11,6 @@ export class T3Auth extends Context.Service<
     readonly pair: (value: string) => Effect.Effect<PairResult, AuthError>;
     readonly local: (input: LocalAuthInput) => Effect.Effect<LocalAuthResult, AuthError>;
     readonly status: () => Effect.Effect<AuthSessionState, AuthError>;
-    readonly issueWebSocketToken: () => Effect.Effect<AuthWebSocketTokenResult, AuthError>;
+    readonly issueWebSocketTicket: () => Effect.Effect<AuthWebSocketTicketResult, AuthError>;
   }
 >()("t3cli/T3Auth") {}

package/src/auth/transport.ts

@@ -1,26 +1,58 @@
+import {
+  AuthAccessTokenType,
+  AuthEnvironmentBootstrapTokenType,
+  AuthTokenExchangeGrantType,
+} from "#t3tools/contracts";
+import * as Context from "effect/Context";
+import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
 import { HttpClient, HttpClientError, HttpClientRequest } from "effect/unstable/http";
 
 import type { ResolvedConfig } from "../config/service.ts";
 import { toHttpEndpointUrl } from "../config/url.ts";
 import { AuthTransportError } from "./error.ts";
 import {
-  decodeAuthBearerBootstrapResult,
+  type AuthBearerBootstrapResult,
+  decodeAuthAccessTokenResult,
+  type AuthSessionState,
   decodeAuthSessionState,
-  decodeAuthWebSocketTokenResult,
+  type AuthWebSocketTicketResult,
+  decodeAuthWebSocketTicketResult,
 } from "./schema.ts";
 
-export const makeAuthTransport = Effect.fn("makeAuthTransport")(function* () {
+export class T3AuthTransport extends Context.Service<
+  T3AuthTransport,
+  {
+    readonly bootstrapBearer: (input: {
+      readonly baseUrl: string;
+      readonly credential: string;
+    }) => Effect.Effect<AuthBearerBootstrapResult, AuthTransportError>;
+    readonly getSession: (
+      config: ResolvedConfig,
+    ) => Effect.Effect<AuthSessionState, AuthTransportError>;
+    readonly issueWebSocketTicket: (
+      config: ResolvedConfig,
+    ) => Effect.Effect<AuthWebSocketTicketResult, AuthTransportError>;
+  }
+>()("t3cli/T3AuthTransport") {}
+
+const makeT3AuthTransport = Effect.fn("makeT3AuthTransport")(function* () {
   const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
 
   const bootstrapBearer = Effect.fn("AuthTransport.bootstrapBearer")(function* (input: {
     readonly baseUrl: string;
     readonly credential: string;
   }) {
-    const url = yield* makeHttpEndpointUrl(input.baseUrl, "/api/auth/bootstrap/bearer");
+    const url = yield* makeHttpEndpointUrl(input.baseUrl, "/oauth/token");
     const request = HttpClientRequest.post(url).pipe(
       HttpClientRequest.acceptJson,
-      HttpClientRequest.bodyJsonUnsafe({ credential: input.credential }),
+      HttpClientRequest.bodyUrlParams({
+        grant_type: AuthTokenExchangeGrantType,
+        subject_token: input.credential,
+        subject_token_type: AuthEnvironmentBootstrapTokenType,
+        requested_token_type: AuthAccessTokenType,
+      }),
     );
     const response = yield* client.execute(request).pipe(
       Effect.catchTags({
@@ -33,8 +65,8 @@ export const makeAuthTransport = Effect.fn("makeAuthTransport")(function* () {
           ),
       }),
     );
-    return yield* response.json.pipe(
-      Effect.flatMap(decodeAuthBearerBootstrapResult),
+    const result = yield* response.json.pipe(
+      Effect.flatMap(decodeAuthAccessTokenResult),
       Effect.catchTags({
         HttpClientError: (error) =>
           Effect.fail(
@@ -49,10 +81,19 @@ export const makeAuthTransport = Effect.fn("makeAuthTransport")(function* () {
           ),
       }),
     );
+    const now = yield* DateTime.now;
+    return {
+      authenticated: true,
+      role: result.scope.split(/\s+/u).includes("access:write") ? "owner" : "client",
+      sessionMethod: "bearer-access-token",
+      expiresAt: DateTime.formatIso(DateTime.add(now, { seconds: result.expires_in })),
+      sessionToken: result.access_token,
+    } satisfies AuthBearerBootstrapResult;
   });
 
   const getSession = Effect.fn("AuthTransport.getSession")(function* (config: ResolvedConfig) {
-    const request = yield* authenticatedRequest(config, "/api/auth/session", "get");
+    const url = yield* makeHttpEndpointUrl(config.url, "/api/auth/session");
+    const request = HttpClientRequest.get(url).pipe(authenticatedRequest(config));
     const response = yield* client.execute(request).pipe(
       Effect.catchTags({
         HttpClientError: (error) =>
@@ -82,10 +123,11 @@ export const makeAuthTransport = Effect.fn("makeAuthTransport")(function* () {
     );
   });
 
-  const issueWebSocketToken = Effect.fn("AuthTransport.issueWebSocketToken")(function* (
+  const issueWebSocketTicket = Effect.fn("AuthTransport.issueWebSocketTicket")(function* (
     config: ResolvedConfig,
   ) {
-    const request = yield* authenticatedRequest(config, "/api/auth/ws-token", "post");
+    const url = yield* makeHttpEndpointUrl(config.url, "/api/auth/websocket-ticket");
+    const request = HttpClientRequest.post(url).pipe(authenticatedRequest(config));
     const response = yield* client.execute(request).pipe(
       Effect.catchTags({
         HttpClientError: (error) =>
@@ -98,7 +140,7 @@ export const makeAuthTransport = Effect.fn("makeAuthTransport")(function* () {
       }),
     );
     return yield* response.json.pipe(
-      Effect.flatMap(decodeAuthWebSocketTokenResult),
+      Effect.flatMap(decodeAuthWebSocketTicketResult),
       Effect.catchTags({
         HttpClientError: (error) =>
           Effect.fail(
@@ -118,20 +160,15 @@ export const makeAuthTransport = Effect.fn("makeAuthTransport")(function* () {
   return {
     bootstrapBearer,
     getSession,
-    issueWebSocketToken,
+    issueWebSocketTicket,
   };
 });
 
-function authenticatedRequest(config: ResolvedConfig, path: string, method: "get" | "post") {
-  return makeHttpEndpointUrl(config.url, path).pipe(
-    Effect.map((url) =>
-      method === "get" ? HttpClientRequest.get(url) : HttpClientRequest.post(url),
-    ),
-    Effect.map((request) =>
-      request.pipe(HttpClientRequest.acceptJson, HttpClientRequest.bearerToken(config.token)),
-    ),
-  );
-}
+export const T3AuthTransportLive = Layer.effect(T3AuthTransport, makeT3AuthTransport());
+
+const authenticatedRequest =
+  (config: ResolvedConfig) => (request: HttpClientRequest.HttpClientRequest) =>
+    request.pipe(HttpClientRequest.acceptJson, HttpClientRequest.bearerToken(config.token));
 
 function makeHttpEndpointUrl(baseUrl: string, path: string) {
   return toHttpEndpointUrl(baseUrl, path).pipe(

package/src/auth/type.ts

@@ -15,7 +15,6 @@ export type PairResult = {
 
 export type LocalAuthInput = {
   readonly baseDir?: string;
-  readonly t3Command?: string;
   readonly origin?: string;
   readonly role: AuthSessionRole;
   readonly label: string;

package/src/cli/auth.ts

@@ -47,14 +47,13 @@ const localCommand = Command.make(
   "local",
   {
     baseDir: Flag.string("base-dir").pipe(Flag.optional),
-    t3Command: Flag.string("t3-command").pipe(Flag.optional),
     origin: Flag.string("origin").pipe(Flag.optional),
     role: Flag.choice("role", ["owner", "client"] as const).pipe(Flag.withDefault("owner")),
     label: Flag.string("label").pipe(Flag.withDefault("t3cli")),
     subject: Flag.string("subject").pipe(Flag.withDefault("t3cli-local")),
     format: Flag.choice("format", humanJsonFormatChoices).pipe(Flag.withDefault("auto")),
   },
-  ({ baseDir, t3Command, origin, role, label, subject, format }) =>
+  ({ baseDir, origin, role, label, subject, format }) =>
     Effect.gen(function* () {
       const auth = yield* T3Auth;
       const environment = yield* Environment;
@@ -64,7 +63,6 @@ const localCommand = Command.make(
         role,
         label,
         subject,
-        ...(Option.isSome(t3Command) ? { t3Command: t3Command.value } : {}),
         ...(Option.isSome(baseDir) ? { baseDir: baseDir.value } : {}),
         ...(Option.isSome(origin) ? { origin: origin.value } : {}),
       });

package/src/rpc/layer.ts

@@ -76,10 +76,10 @@ const makeWsUrl = Effect.fn("makeWsUrl")(function* (input: {
   readonly auth: T3Auth["Service"];
 }) {
   const resolved = yield* input.config.resolve();
-  const wsToken = yield* input.auth.issueWebSocketToken();
+  const wsTicket = yield* input.auth.issueWebSocketTicket();
   const wsUrl = yield* toWebSocketEndpointUrl(resolved.url, "/ws");
   const request = HttpClientRequest.get(wsUrl).pipe(
-    HttpClientRequest.setUrlParam("wsToken", wsToken.token),
+    HttpClientRequest.setUrlParam("wsTicket", wsTicket.ticket),
   );
   return Option.getOrThrow(HttpClientRequest.toUrl(request)).toString();
 });

package/src/runtime.ts

@@ -3,13 +3,26 @@ import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient";
 import * as NodeSocket from "@effect/platform-node/NodeSocket";
 
 import { T3AuthLive } from "./auth/layer.ts";
+import { T3LocalAuthLive } from "./auth/local.ts";
+import { T3AuthPairingLive } from "./auth/pairing.ts";
+import { T3AuthTransportLive } from "./auth/transport.ts";
 import { T3ConfigLive } from "./config/layer.ts";
 import { T3ApplicationLive } from "./application/layer.ts";
 import { T3OrchestrationLive } from "./orchestration/layer.ts";
 import { T3RpcLive } from "./rpc/layer.ts";
+import { NodeSqlClientFactoryLive } from "./sql/node-sqlite-client.ts";
 
+const T3AuthTransportLayer = T3AuthTransportLive.pipe(Layer.provide(NodeHttpClient.layerUndici));
+const T3LocalAuthLayer = T3LocalAuthLive.pipe(
+  Layer.provide(Layer.mergeAll(T3ConfigLive, NodeSqlClientFactoryLive)),
+);
+const T3AuthPairingLayer = T3AuthPairingLive.pipe(
+  Layer.provide(Layer.mergeAll(T3ConfigLive, T3AuthTransportLayer)),
+);
 const T3AuthLayer = T3AuthLive.pipe(
-  Layer.provide(Layer.mergeAll(T3ConfigLive, NodeHttpClient.layerUndici)),
+  Layer.provide(
+    Layer.mergeAll(T3ConfigLive, T3AuthTransportLayer, T3LocalAuthLayer, T3AuthPairingLayer),
+  ),
 );
 const T3RpcLayer = T3RpcLive.pipe(
   Layer.provide(Layer.mergeAll(T3ConfigLive, T3AuthLayer, NodeSocket.layerWebSocketConstructor)),

package/src/sql/node-sqlite-client.ts

@@ -0,0 +1,141 @@
+import { DatabaseSync, type SQLInputValue } from "node:sqlite";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import { identity } from "effect/Function";
+import * as Layer from "effect/Layer";
+import * as Scope from "effect/Scope";
+import * as Stream from "effect/Stream";
+import * as Reactivity from "effect/unstable/reactivity/Reactivity";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+import type { Connection } from "effect/unstable/sql/SqlConnection";
+import { classifySqliteError, SqlError } from "effect/unstable/sql/SqlError";
+import * as Statement from "effect/unstable/sql/Statement";
+
+import { SqlClientFactory, type SqliteClientConfig } from "./service.ts";
+
+const ATTR_DB_SYSTEM_NAME = "db.system.name";
+
+const classifyError = (cause: unknown, message: string, operation: string) =>
+  classifySqliteError(cause, { message, operation });
+
+export const makeNodeSqliteClient = Effect.fn("makeNodeSqliteClient")(function* (
+  config: SqliteClientConfig,
+) {
+  const compiler = Statement.makeCompilerSqlite(config.transformQueryNames);
+  const transformRows =
+    config.transformResultNames === undefined
+      ? undefined
+      : Statement.defaultTransforms(config.transformResultNames).array;
+  const scope = yield* Effect.scope;
+  const db = yield* Effect.try({
+    try: () => new DatabaseSync(config.filename),
+    catch: (cause) =>
+      new SqlError({
+        reason: classifyError(cause, "Failed to open sqlite database", "connect"),
+      }),
+  });
+  yield* Scope.addFinalizer(
+    scope,
+    Effect.sync(() => {
+      try {
+        db.close();
+      } catch {
+        // Ignore close failures after the scoped client is done.
+      }
+    }),
+  );
+
+  const runRows = (sql: string, params: ReadonlyArray<unknown>) =>
+    Effect.try({
+      try: () => {
+        const statement = db.prepare(sql);
+        const bound = params.map(toSqlInputValue);
+        if (statement.columns().length > 0) {
+          return statement.all(...bound);
+        }
+        statement.run(...bound);
+        return [];
+      },
+      catch: (cause) =>
+        new SqlError({
+          reason: classifyError(cause, "Failed to execute sqlite statement", "execute"),
+        }),
+    });
+
+  const runRaw = (sql: string, params: ReadonlyArray<unknown>) =>
+    Effect.try({
+      try: () => {
+        const statement = db.prepare(sql);
+        const bound = params.map(toSqlInputValue);
+        return statement.columns().length > 0 ? statement.all(...bound) : statement.run(...bound);
+      },
+      catch: (cause) =>
+        new SqlError({
+          reason: classifyError(cause, "Failed to execute sqlite statement", "execute"),
+        }),
+    });
+
+  const runValues = (sql: string, params: ReadonlyArray<unknown>) =>
+    Effect.map(runRows(sql, params), (rows) =>
+      rows.map((row) => Object.values(row as Record<string, unknown>)),
+    );
+
+  const connection = identity<Connection>({
+    execute(sql, params, rowTransform) {
+      const effect = runRows(sql, params);
+      return rowTransform === undefined ? effect : Effect.map(effect, rowTransform);
+    },
+    executeRaw(sql, params) {
+      return runRaw(sql, params);
+    },
+    executeValues(sql, params) {
+      return runValues(sql, params);
+    },
+    executeUnprepared(sql, params, rowTransform) {
+      const effect = runRows(sql, params);
+      return rowTransform === undefined ? effect : Effect.map(effect, rowTransform);
+    },
+    executeStream(sql, params, rowTransform) {
+      return Stream.fromIterableEffect(this.execute(sql, params, rowTransform));
+    },
+  });
+
+  const acquirer = Effect.succeed(connection);
+  return yield* SqlClient.make({
+    acquirer,
+    compiler,
+    spanAttributes: [[ATTR_DB_SYSTEM_NAME, "sqlite"]],
+    transformRows,
+  });
+});
+
+export const NodeSqliteClientLive = (config: SqliteClientConfig) =>
+  Layer.effectContext(
+    Effect.map(makeNodeSqliteClient(config), (client) => Context.make(SqlClient.SqlClient, client)),
+  ).pipe(Layer.provide(Reactivity.layer));
+
+export const NodeSqlClientFactoryLive = Layer.succeed(SqlClientFactory, {
+  sqliteClient: (config) => makeNodeSqliteClient(config).pipe(Effect.provide(Reactivity.layer)),
+});
+
+function toSqlInputValue(value: unknown): SQLInputValue {
+  if (value === undefined || value === null) {
+    return null;
+  }
+  if (typeof value === "string" || typeof value === "number" || typeof value === "bigint") {
+    return value;
+  }
+  if (typeof value === "boolean") {
+    return value ? 1 : 0;
+  }
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  if (ArrayBuffer.isView(value)) {
+    const bytes = new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+    const copy = new Uint8Array(bytes.byteLength);
+    copy.set(bytes);
+    return copy;
+  }
+  return JSON.stringify(value) ?? null;
+}

package/src/sql/service.ts

@@ -0,0 +1,21 @@
+import type * as Effect from "effect/Effect";
+import * as Context from "effect/Context";
+import type * as Scope from "effect/Scope";
+import type * as SqlClient from "effect/unstable/sql/SqlClient";
+import type { SqlError } from "effect/unstable/sql/SqlError";
+
+export type SqliteClientConfig = {
+  readonly filename: string;
+  readonly transformResultNames?: ((str: string) => string) | undefined;
+  readonly transformQueryNames?: ((str: string) => string) | undefined;
+};
+
+export type SqlClientFactoryShape = {
+  readonly sqliteClient: (
+    config: SqliteClientConfig,
+  ) => Effect.Effect<SqlClient.SqlClient, SqlError, Scope.Scope>;
+};
+
+export class SqlClientFactory extends Context.Service<SqlClientFactory, SqlClientFactoryShape>()(
+  "t3cli/SqlClientFactory",
+) {}