eve/dist/src/runtime/connections/principal.js

Filesystem-first framework for durable backend AI agents that run anywhere.

import{isVercelOidcIssuer}from"#shared/vercel-project.js";import{contextStorage}from"#context/container.js";import{AuthKey}from"#context/keys.js";import{ConnectionAuthorizationFailedError}from"#connections/errors.js";function principalKey(e){return e.type===`app`?`app`:e.issuer===void 0?`user:${e.id}`:`user:${e.issuer}:${e.id}`}function resolveConnectionPrincipal(e,t,n=contextStorage.getStore()){return resolveConnectionPrincipalFromAuth(e,t,n?.get(AuthKey),n)}function resolveConnectionPrincipalFromAuth(e,t,n,r){if(t.principalType===`app`)return{type:`app`};if(n==null||n.principalType!==`user`)throw new ConnectionAuthorizationFailedError(e,{message:buildUserPrincipalRequiredMessage(e,t,r,n),reason:`principal_required`,retryable:!1});return t.vercelConnect!==void 0&&isVercelDevelopmentUser(n)?{attributes:n.attributes,id:n.subject??n.principalId,type:`user`}:{attributes:n.attributes,id:n.principalId,issuer:n.issuer??n.authenticator,type:`user`}}function isVercelDevelopmentUser(e){return e.authenticator===`oidc`&&isVercelOidcIssuer(e.issuer)&&e.attributes.environment===`development`&&e.subject===e.attributes.user_id}function buildUserPrincipalRequiredMessage(e,t,n,r){let i;return i=n===void 0?`it was invoked outside an eve context, so no authenticated user can be resolved.`:r==null?`the active session has no authenticated user.`:t.vercelConnect!==void 0&&r.authenticator===`local-dev`?`the local request fell back to local development access instead of authenticating a Vercel user. Ensure this directory is linked and the Vercel CLI can mint a Vercel OIDC token, then retry.`:`the active session is scoped to "${r.principalType}", not an authenticated user.`,`Connection "${e}" is user-scoped, but ${i} User-scoped connections require route auth that resolves an authenticated user. If this connection should use credentials shared by the agent instead, configure it as an app-scoped connection.`}export{principalKey,resolveConnectionPrincipal,resolveConnectionPrincipalFromAuth};