larvit/plainpages
3
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Name exactly one gate on every declaration, and own a shift by identity id

Browse Source
This commit is contained in:
Lilleman auf Larv
2026-09-02 14:00:04 +02:00
parent dfb043c3bd
commit 6a0d11d9d3
14 changed files with 98 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/auth/gate.test.ts
+1 -1
View File
@@ -23,6 +23,6 @@ test("gatesSet names the gates a declaration sets, so discovery can refuse more
assert.deepEqual(gatesSet({ session: true }), ["session"]);
assert.deepEqual(gatesSet({ permission: "x:read", public: true }), ["public", "permission"]);
assert.deepEqual(gatesSet({ permission: "x:read", public: true, session: true }), ["public", "session", "permission"]);
// `false` is not a gate — only a set one counts, so { session: false } is an ungated route.
// Only `true` sets a gate, so a manifest spelling one `false` names none — which discovery refuses.
assert.deepEqual(gatesSet({ public: false, session: false }), []);
});
src/auth/routes.ts
+8 -8
View File
@@ -240,20 +240,20 @@ export function buildAuthRoutes({ hydra, keto, kratos, kratosAdmin, menu, secure
const routes: BuiltinRoute[] = [];
if (kratos) {
for (const [path, flowType] of Object.entries(AUTH_FLOWS)) {
routes.push({ handler: flowPage(kratos, flowType, secureCookies), method: "GET", path });
routes.push({ handler: flowPage(kratos, flowType, secureCookies), method: "GET", path, public: true });
}
routes.push({ handler: logout(kratos, secureCookies), method: "POST", path: "/logout" });
routes.push({ handler: logout(kratos, secureCookies), method: "POST", path: "/logout", public: true });
}
if (hydra && kratos) {
const provider = { hydra, kratos };
routes.push({ handler: oauthLogin(provider, secureCookies), method: "GET", path: "/oauth2/login" });
routes.push({ handler: consentScreen(provider, menu.branding.name), method: "GET", path: "/oauth2/consent" });
routes.push({ handler: consentDecision(provider), method: "POST", path: "/oauth2/consent" });
routes.push({ handler: oauthLogin(provider, secureCookies), method: "GET", path: "/oauth2/login", public: true });
routes.push({ handler: consentScreen(provider, menu.branding.name), method: "GET", path: "/oauth2/consent", public: true });
routes.push({ handler: consentDecision(provider), method: "POST", path: "/oauth2/consent", public: true });
}
if (hydra) routes.push({ handler: oauthLogout(hydra), method: "GET", path: "/oauth2/logout" });
if (hydra) routes.push({ handler: oauthLogout(hydra), method: "GET", path: "/oauth2/logout", public: true });
if (kratos && kratosAdmin && keto) {
routes.push({ handler: completeAuth({ keto, kratosAdmin, kratosPublic: kratos }, secureCookies), method: "GET", path: "/auth/complete" });
routes.push({ handler: completeAuth({ keto, kratosAdmin, kratosPublic: kratos }, secureCookies), method: "GET", path: "/auth/complete", public: true });
}
routes.push({ handler: errorSink, method: "GET", path: "/error" });
routes.push({ handler: errorSink, method: "GET", path: "/error", public: true });
return routes;
}