Auth / foldkit-auth/server

ResolverConfig

interface · packages/auth/src/server.ts:76

interface ResolverConfig<I, S extends VerifiedSession, User, R> {
  readonly auth: Context.Key<I, SessionVerifier<S>>
  readonly http: HttpOptions
  readonly principal: (
    session: S,
  ) => Effect.Effect<User, RemoteUnauthenticated, R>
  readonly requests?: 'scripted' | 'browser' | undefined
  readonly key?: ((user: User) => string) | undefined
}

What AuthServer.resolver takes.

Members

ResolverConfig.auth

property · packages/auth/src/server.ts:78

readonly auth: Context.Key<I, SessionVerifier<S>>

The Auth.make(…) service, which the host's layer provides.

ResolverConfig.http

property · packages/auth/src/server.ts:80

readonly http: HttpOptions

The options given Http.make: the cookie's name, trusted origins and CSRF header.

ResolverConfig.principal

property · packages/auth/src/server.ts:82

readonly principal: (
  session: S,
) => Effect.Effect<User, RemoteUnauthenticated, R>

The application's principal for a verified session; it may refuse it.

ResolverConfig.requests

property · packages/auth/src/server.ts:90

readonly requests?: 'scripted' | 'browser' | undefined

Who makes the requests this resolves. 'scripted' (the default): the page's own fetch, which sends Yielded's CSRF header beside a trusted Origin. 'browser': what a browser sends on the page's behalf, a WebSocket upgrade or a posted form, which carries no header of the page's; its Origin, which every browser sends on one, vouches alone.

ResolverConfig.key

property · packages/auth/src/server.ts:96

readonly key?: ((user: User) => string) | undefined

Who the principal is, for the x-foldkit-subject check: the client says who it believes it is by this, as foldkit-guard's Me shows it (key: Policy.key). Without it, the session's subjectId.