Auth / foldkit-auth

Sync's socket

A browser's WebSocket sends no header of the page's, so an upgrade cannot carry the CSRF header. requests: 'browser' says so: the resolver reads the cookie of an upgrade whose Origin, which every browser sends on one, is trusted, and asks for no header; the rest is unchanged. defineDocumentHost takes the Auth service from its layer, kept while the socket is open, so revalidate can ask the session store again and close a socket whose session ended (4401):

import { DurableObject } from 'cloudflare:workers'
import { defineDocumentHost } from 'foldkit-sync/do'

export class SyncHost extends defineDocumentHost(DurableObject, {
  sync, // Sync.make(…)
  openJournal, // the document's journal, as foldkit-sync's README opens it
  resolvePrincipal: AuthServer.resolver({
    requests: 'browser',
    auth: AppAuth,
    http,
    principal: session => Effect.succeed({ id: session.subjectId }),
  }),
  layer: () => AppAuthLive,
  revalidate: { every: '1 minute' },
}) {}