type.auth_public_principal: A route that anyone may call, with authentication: RouteAuthentication.none, passes on the signed-in caller, though it never looks for one

A route that anyone may call, with authentication: RouteAuthentication.none, passes on the signed-in caller, though it never looks for one.

Area 8, Sign-in and identity; not declinable; the next step is usually the human's.

Why Jadpo refuses it

authentication: RouteAuthentication.none lets anyone call a route, and the route doesn't look for a session or token. So it never knows who is calling, and current_principal, the signed-in caller, has nothing in it. A query or action that takes a caller would be handed nobody.

Jadpo won't choose the fix for you. Either callers sign in, so the route knows who they are, or the route stays open and stops depending on who is calling, and that decides who can reach the data it reads.

What it looks like

main.jadpo:

example

principal {    user: {        subject: Member.handle    }}authentication {    browser_session: {        cookie: "session"    }}type Handle = Text {    max_length: 40}entity Member {    id: Uuid    handle: Handle {        unique: true    }}type MemberView = Output {    handle: Handle}type MemberNotFound = Failure {    kind: FailureKind.not_found}query whoami(caller: Principal.user) fails MemberNotFound -> MemberView {    from: Member    where: Member.id == caller.id    missing: MemberNotFound}routes Members {    prefix: /members    GET /me {        authentication: RouteAuthentication.none        output: MemberView        run: whoami(current_principal.user)    }}

jadpo checkcheck failed: 1 error, 1 file

error A route anyone may call passes current_principal

--> main.jadpo:44:21

   |44 |         run: whoami(current_principal.user)   |                     ^^^^^^^^^^^^^^^^^ no one is signed in here

reason: authentication: RouteAuthentication.none reads no credential, so the route has no caller to pass on, and nothing it runs may use one.
next: Remove authentication: RouteAuthentication.none so callers sign in, or stop passing current_principal (human)
rule: type.auth_public_principal
help: https://jadpo.dev/docs/errors/type.auth_public_principal

(human) at the end of the next: line tells your coding agent to stop and ask you which fix you want, because the choice is yours to make: it decides whether people must sign in to read a member.

How to fix it

The question is whether the route is about who is calling.

If it is, so callers must sign in, remove the authentication: RouteAuthentication.none line. whoami reads a Member, so Member also needs a grant that lets each person read their own record:

example

    GET /me {        output: MemberView        run: whoami(current_principal.user)    }

example

    policy: {        read: [id]    }

GET /members/me now needs a session cookie, and answers each caller with their own handle. A request without a valid session gets 401.

If anyone may read a member, signed in or not, keep the route open and name the member in the path instead of taking the caller. Its query finds the member by id, and Member grants read to Access.public:

example

query find_member(member_id: Member.id) fails MemberNotFound -> MemberView {    from: Member    where: Member.id == member_id    missing: MemberNotFound}

example

    GET /{member_id: Member.id} {        authentication: RouteAuthentication.none        output: MemberView        run: find_member(member_id)    }

example

    policy: {        read: [Access.public]    }

GET /members/{member_id} answers anyone with that member's handle, and never knows who is asking.

Why Jadpo refuses it

What it looks like

How to fix it

Related