Auth / foldkit-auth
foldkit-auth
Who is signed in, for a Foldkit Plus server: a Yielded Auth
session read from the request and handed to Remote's serveFetch and Sync's
document host as their principal.
What it is
Yielded Auth signs people in and keeps their sessions. serveFetch, Remote's
Web handler, and defineDocumentHost, Sync's Durable Object, each ask "who
is this request?" through a resolvePrincipal Effect, as SSR's posted forms
do through their resources. AuthServer.resolver is
that Effect for an application on Yielded: it reads the session cookie
Yielded set, verifies it with the application's own Auth service, and
gives back the application's principal, a visitor, or a refusal the client
decodes.
What it owns, and what it does not
| Fact | Owner |
|---|---|
| Credentials, sign-in, sessions, the cookie, renewing a session | Yielded Auth (Auth.make, Http.make) |
| Which session a request carries, and whether the request may use it | AuthServer.resolver |
Who the session is in the application's terms (a guard set's User) | the application's principal function, per request |
| Who may do what | foldkit-guard, given the principal |
It does not sign anyone in, set, renew or clear a cookie, or serve Yielded's
routes: the application mounts Http.layer(AppAuth, http) itself. It does
not authorize either: the principal it returns is what foldkit-guard
decides on.