build: migrate effect v3 → v4 (beta.103) #747
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,10 +4,14 @@ | |
| * This software may be modified and distributed under the terms | ||
| * of the MIT license. See the LICENSE file for details. | ||
| */ | ||
| import { Effect, Layer } from 'effect'; | ||
| import { NodeHttpServer, NodeRuntime } from '@effect/platform-node'; | ||
| import { MockApi } from './spec.js'; | ||
| import { HttpApiBuilder, HttpApiSwagger } from 'effect/unstable/httpapi'; | ||
| import * as HttpMiddleware from 'effect/unstable/http/HttpMiddleware'; | ||
| import * as HttpRouter from 'effect/unstable/http/HttpRouter'; | ||
| import * as HttpServer from 'effect/unstable/http/HttpServer'; | ||
| import type { ServeError } from 'effect/unstable/http/HttpServerError'; | ||
| import { createServer } from 'node:http'; | ||
| import { HealthCheckLive } from './handlers/healthcheck.handler.js'; | ||
| import { OpenidConfigMock } from './handlers/open-id-configuration.handler.js'; | ||
|
|
@@ -26,47 +30,63 @@ import { BatchSpanProcessor, ConsoleSpanExporter } from '@opentelemetry/sdk-trac | |
| import { EndSessionHandlerMock } from './handlers/end-session.handler.js'; | ||
| import { RevokeTokenHandler } from './handlers/revoke.handler.js'; | ||
|
|
||
| const NodeSdkLive = NodeSdk.layer(() => ({ | ||
| resource: { serviceName: 'Mock-Api' }, | ||
| spanProcessor: new BatchSpanProcessor(new ConsoleSpanExporter()), | ||
| })); | ||
|
|
||
| // Wire SessionStorage into SessionMiddlewareMock | ||
| const SessionLayer = Layer.provide( | ||
| SessionMiddlewareMock, | ||
| Layer.effect(SessionStorage, SessionStorage.make), | ||
| ); | ||
|
|
||
| // Merge all group handlers | ||
| const HandlersLayer = Layer.mergeAll( | ||
| HealthCheckLive, | ||
| OpenidConfigMock, | ||
| AuthorizeHandlerMock, | ||
| TokensHandler, | ||
| CapabilitiesHandlerMock, | ||
| UserInfoMockHandler, | ||
| EndSessionHandlerMock, | ||
| RevokeTokenHandler, | ||
| ); | ||
|
|
||
| // Merge all services | ||
| const ServicesLayer = Layer.mergeAll( | ||
| TokensMock, | ||
| IncrementStepIndexMock, | ||
| AuthorizationMock, | ||
| UserInfoMockService, | ||
| SessionLayer, | ||
| ); | ||
|
|
||
| // Build application routes layer with all handlers and services provided in one step each | ||
| const AppLayer = HttpApiBuilder.layer(MockApi).pipe( | ||
| Layer.provide(HandlersLayer), | ||
| Layer.provide(ServicesLayer), | ||
| ); | ||
|
|
||
| // Compose app + swagger, then provide the router service | ||
| const AppWithSwagger = Layer.merge(AppLayer, HttpApiSwagger.layer(MockApi)).pipe( | ||
| Layer.provide(HttpRouter.layer), | ||
| ); | ||
|
|
||
| const ServerMock = HttpRouter.serve(AppWithSwagger, { | ||
| middleware: (app) => | ||
| HttpMiddleware.cors({ | ||
| allowedMethods: ['GET', 'PUT', 'POST', 'OPTIONS'], | ||
| allowedOrigins: ['*'], | ||
| credentials: true, | ||
| maxAge: 3600, | ||
|
Comment on lines
+78
to
82
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🌐 Web query:
💡 Result: In Effect 4.0.0-beta.103, providing Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
# Locate the affected file and inspect package versions / HttpMiddleware.cors usage.
printf 'Files:\n'
git ls-files | rg '(^|/)package.json$|e2e/mock-api-v2/src/main.ts|HttpMiddleware' || true
printf '\nAffected file context:\n'
sed -n '1,140p' e2e/mock-api-v2/src/main.ts
printf '\nRoot/package effect versions:\n'
node - <<'JS'
const fs = require('fs');
for (const p of ['package.json','package-lock.json','pnpm-lock.yaml','yarn.lock']) {
if (fs.existsSync(p)) {
console.log(`\n--- ${p} ---`);
const s = fs.readFileSync(p, 'utf8');
if (p.endsWith('.json')) {
const j = JSON.parse(s);
if (j.dependencies?.effect || j.devDependencies?.effect || j.dependencies?.'`@effect/platform`' || j.devDependencies?.'`@effect/platform`') {
console.log(JSON.stringify({deps:j.dependencies, devDeps:j.devDependencies}, null, 2).slice(0, 2000));
}
} else {
for (const m of ['effect','`@effect/platform`']) {
const idx = s.indexOf(m + '@');
console.log(m, idx >= 0 ? s.slice(idx, idx + 200) : 'not found');
}
}
}
}
JS
printf '\nLockfile effect platform refs:\n'
rg -n '"?effect( |-|@)?/?platform"?|effect@.*4\.0\.0-beta\.103|HttpMiddleware\.cors|allowedOrigins' package* e2e -S || trueRepository: ForgeRock/ping-javascript-sdk Length of output: 5774 🏁 Script executed: #!/bin/bash
set -fu
printf 'Root/package effect version references:\n'
rg -n --no-heading '"?effect( |-|@)?/?platform"?|`@effect/platform`|effect@|HttpMiddleware\.cors|allowedOrigins' package.json e2e/mock-api-v2/package.json packages/*/package.json e2e/*/package.json -S || true
printf '\nPackage json versions if present:\n'
node - <<'JS'
const fs = require('fs');
const files = ['package.json','e2e/mock-api-v2/package.json'];
for (const f of files) {
if (!fs.existsSync(f)) continue;
const j = JSON.parse(fs.readFileSync(f, 'utf8'));
console.log(`\n--- ${f} ---`);
console.log(JSON.stringify({ dependencies: j.dependencies, devDependencies: j.devDependencies }, null, 2));
}
JS
printf '\nSource availability check for effect package files:\n'
for d in node_modules/effect node_modules/@effect/platform node_modules/cache?; do
if [ -d "$d" ]; then echo "$d"; find "$d" -maxdepth 2 -type f | head -30; fi
doneRepository: ForgeRock/ping-javascript-sdk Length of output: 3404 🌐 Web query:
💡 Result: In Effect.ts, the Citations:
🌐 Web query:
💡 Result: In the Effect.ts platform library, the CORS middleware is configured via HttpMiddleware.cors [1][2]. According to the official documentation, if the allowedOrigins option is left as an empty array (which is the default behavior), the middleware will allow all origins by setting the Access-Control-Allow-Origin response header to the wildcard value * [2][3]. Regarding the browser's handling of the wildcard * in the Origin header or CORS response: 1. Functionality: The Access-Control-Allow-Origin: * header instructs the browser that any origin may access the resource, provided the request does not include credentials (such as cookies, authorization headers, or TLS client certificates) [4][5]. 2. Credentials Constraint: If a request includes credentials, the browser will block the response if the server returns Access-Control-Allow-Origin: * [5][6]. In such cases, the server must instead specify an explicit, single origin (e.g., Access-Control-Allow-Origin: https://example.com) [4][5][7]. 3. Security: Using the * wildcard is appropriate only for public, non-credentialed resources [8][6]. If your application requires credentialed access, you must configure allowedOrigins to a specific list or a predicate function to dynamically validate the Origin request header against your allowlist [1][2][5]. When using a dynamic predicate for allowedOrigins in Effect.ts, it is recommended practice to include the Vary: Origin response header to inform browsers that the response depends on the Origin request header [4][5]. Citations:
Configure trusted localhost origins instead of
🤖 Prompt for AI Agents |
||
| })(HttpMiddleware.logger(app)), | ||
| }).pipe( | ||
| HttpServer.withLogAddress, | ||
| Layer.provide(NodeSdkLive), | ||
| Layer.provide(NodeHttpServer.layer(createServer, { port: 9443, host: 'localhost' })), | ||
| ); | ||
|
|
||
| // TypeScript cannot fully resolve complex Effect layer generic compositions; | ||
| // all requirements ARE satisfied at runtime — NodeHttpServer provides FileSystem, Path, HttpPlatform, Etag. | ||
| NodeRuntime.runMain(Layer.launch(ServerMock) as Effect.Effect<never, ServeError, never>); | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: ForgeRock/ping-javascript-sdk
Length of output: 5674
🌐 Web query:
effect 2.4 Layer.provideMerge Layer.provide outputs consumed semantics💡 Result:
In Effect, Layer.provide and Layer.provideMerge are both combinators used for composing layers, but they differ in how they handle the resulting service environment [1][2][3]. Layer.provide Use Layer.provide when you want to satisfy a layer's internal dependencies using another layer without exposing those dependencies to the rest of the application [2][4]. Semantics: It wires the provided layer to satisfy the requirements of the base layer [4]. Once satisfied, those dependencies are "consumed" internally, meaning they are no longer available in the context of the resulting layer [2][4]. This is ideal for encapsulating implementation details [2]. Layer.provideMerge Use Layer.provideMerge when you want to satisfy a layer's dependencies while also keeping those dependencies available for use elsewhere in your program [4][3]. Semantics: It wires the provided layer to satisfy the requirements of the base layer, but crucially, it merges the output of the provided layer into the output of the resulting layer [2][3]. As a result, both the original services and the provided services remain accessible in the final context [4][3]. This is particularly common in testing scenarios where you need access to multiple services simultaneously [4]. Summary Comparison | Method | Deps Satisfied | Available to Program | Use When | |--------|---------------|---------------------|----------| | Layer.provide | Yes | No | Internal dependency satisfaction / Encapsulation [2][4] | | Layer.provideMerge | Yes | Yes | Exposing multiple services / Testing [4][3] | In essence, while both methods fulfill requirements, Layer.provide acts as a form of private dependency injection, whereas Layer.provideMerge acts as a union of available services [2][4][3].
Citations:
🏁 Script executed:
Repository: ForgeRock/ping-javascript-sdk
Length of output: 167
Expose
SessionStoragefromSessionLayer.Layer.providesatisfiesSessionMiddlewareMockand consumes theSessionStorageoutput, soHandlersLayer→ServicesLayerhas no provider foryield* SessionStorageinEndSessionHandlerMock. UseLayer.provideMergehere to satisfy the middleware and keepSessionStorageavailable to handlers.Proposed fix
📝 Committable suggestion
🤖 Prompt for AI Agents