ClintchizandClaude Opus 5
e01915823a
Brings the uncommitted body of work under version control so it cannot be
lost. Gates are green: 152 tests pass across rpc/router/dev-server,
typecheck, lint, format and check:public-api all clean.
NOT YET REVIEWED. None of Tasks 5-11 has had an independent task review, and
Task 4's second fix round was never re-reviewed either.
Known gaps against the plan, recorded here rather than discovered later:
- packages/rpc/test/{transport,server,client}.test.ts are ABSENT. The plan
required a test file for each. server.ts holds the fail-closed identity and
permission checks and currently has no direct coverage at all.
- rpc-endpoint.test.ts has 3 tests where the plan specified 9. Missing:
unknown service, non-POST, malformed body, non-rpc passthrough, and the
isInternalCaller sweep. This is the task where a reachable
/__wrnexus/rpc/* makes every permission check in the workspace bypassable.
- http.test.ts has 3 of 7; integration.test.ts 2 of 3;
services-discovery.test.ts 1 of 4.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
45 lines
1.4 KiB
Markdown
45 lines
1.4 KiB
Markdown
# `@wrnexus/rpc`
|
|
|
|
Define a service contract in a shared workspace package, then import that same contract from the caller and callee.
|
|
|
|
```ts
|
|
import {
|
|
defineService,
|
|
implement,
|
|
inProcessTransport,
|
|
procedure,
|
|
serviceClient,
|
|
} from "@wrnexus/rpc";
|
|
import { v } from "@wrnexus/validation";
|
|
|
|
const greeter = defineService({
|
|
name: "greeter",
|
|
procedures: {
|
|
greet: procedure
|
|
.input(v.object({ name: v.string() }))
|
|
.output<{ message: string }>()
|
|
.build(),
|
|
},
|
|
});
|
|
|
|
const service = implement(
|
|
greeter,
|
|
{ greet: async ({ name }) => ({ message: `Hello, ${name}` }) },
|
|
{ selfApp: "greeter" },
|
|
);
|
|
|
|
const client = serviceClient(greeter, {
|
|
app: "greeter",
|
|
transport: inProcessTransport({
|
|
"greeter/greet": (input, identity) => service.invoke("greet", input, identity),
|
|
}),
|
|
});
|
|
await client.greet({ name: "Ada" });
|
|
```
|
|
|
|
Service files default-export `implement(...)` from `app/services`. The development server mounts them under the private `/__wrnexus/rpc` prefix.
|
|
|
|
Pass `{ as: ctx }` to `serviceClient` to propagate the subject. The signed token contains only subject and tenant identifiers; permissions are always checked by the callee. Set `WRNEXUS_RPC_SECRET` in every app, use at least 32 characters, and never reuse the session secret.
|
|
|
|
Calls time out by default. Retrying is intentionally deferred; when introduced, only procedures marked `.idempotent()` may be retried.
|