Auth / foldkit-auth

SSR's posted forms

A form foldkit-ssr handles without scripts is a browser request too. SSR.entry's origins answers a post from anywhere else 403 before its body is read; its resources give the post's Commands who posted, from a resolver built once with requests: 'browser':

import { SSR } from 'foldkit-ssr'

class Principal extends Context.Service<Principal, Option.Option<{ readonly id: string }>>()(
  'app/Principal',
) {}
const whoPosted = AuthServer.resolver({
  requests: 'browser',
  auth: AppAuth,
  http,
  principal: session => Effect.succeed({ id: session.subjectId }),
})

export const entry = SSR.entry(config, plan, {
  buildId: 'b1',
  origins: [http.origin],
  resources: request =>
    Layer.effect(Principal, whoPosted(request)).pipe(Layer.provide(AppAuthLive), Layer.orDie),
})

That Layer cannot fail, so a post whose session ended is a 500 for now, not a way back to sign-in. Resolve the session in the host before calling renderPage, as Site.access's 303 does, to answer it with a redirect.