Auth on Palmyra

AuthDecorator

Mon, 01 Jan 0001 00:00:00 +0000

AuthDecorator#

@palmyralabs/palmyra-wire · lib/palmyra/store/AsyncStore.ts

Overview#

One-method interface for attaching credentials to an outgoing request — Basic auth header, OAuth bearer token, custom cookie, signed URL parameter, etc. Every store reaches its decorator through the shared factory, so a single decorator implementation covers every endpoint in the app.

Interface#

interface AuthDecorator {
  decorate(request: any): void;
}

The request argument is the raw object passed to the underlying axios call — mutate its headers, params, or auth in place.

NOOPDecorator

Mon, 01 Jan 0001 00:00:00 +0000

NOOPDecorator#

@palmyralabs/palmyra-wire · lib/palmyra/store/auth/NoopDecorator.ts

Overview#

No-operation AuthDecorator — its decorate() method does nothing. Exported as a singleton (not a class) so every store can share the same instance without construction cost. This is the default decorator when none is supplied.

Use it when:

Your API is session-cookie-based (the browser attaches Set-Cookie credentials automatically).
The backend and frontend share an origin / proxy, so no explicit auth header is needed.
You’re adding auth via an axiosCustomizer on StoreOptions instead.

Source#

class NoAuthDecorator implements AuthDecorator {
  decorate(_request: any): void { }
}

const NOOPDecorator = new NoAuthDecorator();
export { NOOPDecorator };

Example#

import { NOOPDecorator } from '@palmyralabs/palmyra-wire';

// Explicit — the same thing the factory falls back to when no decorator is set.
const request: any = { url: '/user', headers: {} };
NOOPDecorator.decorate(request);
// request is unchanged.

BasicAuthProvider

Mon, 01 Jan 0001 00:00:00 +0000

BasicAuthProvider#

@palmyralabs/palmyra-wire · lib/palmyra/store/auth/AuthProviders.ts

Overview#

HTTP Basic authentication decorator — stub. The class is declared with username / password fields and a decorate(request) method, but the current implementation does not populate the Authorization header. Treat it as a placeholder for upstream work.

If you need Basic auth today, implement AuthDecorator directly (see the example at the bottom of this page).

Source#

class BasicAuthProvider implements AuthDecorator {
  username: string;
  password: string;

  BasicAuthProvider(username: string, password: string) {  // NB: not a TS constructor
    this.username = username;
    this.password = password;
  }

  decorate(request: any): void { }
}

export { BasicAuthProvider };

Known limitations#

No real constructor. BasicAuthProvider(username, password) is declared as a named method, not constructor(username, password). new BasicAuthProvider('u', 'p') in TypeScript does not assign the fields — you get an instance whose username / password are undefined.
decorate() is empty. Even with populated fields, the method doesn’t attach an Authorization header today.

Workaround — roll your own decorator#

import type { AuthDecorator } from '@palmyralabs/palmyra-wire';

export class BasicAuth implements AuthDecorator {
  constructor(private readonly username: string, private readonly password: string) {}

  decorate(request: any): void {
    const token = btoa(`${this.username}:${this.password}`);
    request.headers = { ...(request.headers ?? {}), Authorization: `Basic ${token}` };
  }
}

Wire it through a custom factory wrapper, or install it as an axios interceptor via StoreOptions.axiosCustomizer (see PalmyraStoreFactory).

OauthProvider

Mon, 01 Jan 0001 00:00:00 +0000

OauthProvider#

@palmyralabs/palmyra-wire · lib/palmyra/store/auth/AuthProviders.ts

Overview#

OAuth / bearer-token decorator — stub. The class declares implements AuthDecorator but the decorate() body is empty. No token is attached to outgoing requests. Treat as a placeholder until the upstream implementation lands.

For OAuth today, implement AuthDecorator yourself — the workaround below covers the common cases (bearer token from session storage, silent refresh, multi-tenant token lookup).

Source#

class OauthProvider implements AuthDecorator {
  decorate(request: any): void { }
}

export { OauthProvider };

Workaround — bearer-token decorator#

import type { AuthDecorator } from '@palmyralabs/palmyra-wire';

export class BearerTokenDecorator implements AuthDecorator {
  constructor(private readonly getToken: () => string | undefined) {}

  decorate(request: any): void {
    const token = this.getToken();
    if (token) {
      request.headers = { ...(request.headers ?? {}), Authorization: `Bearer ${token}` };
    }
  }
}

// Usage — read from session storage, or from whatever your auth state hook exposes.
const decorator = new BearerTokenDecorator(() => sessionStorage.getItem('access_token') ?? undefined);

For silent refresh, install a 401 response interceptor on the factory’s axios instance (via StoreOptions.axiosCustomizer) that swaps the token and retries the original request.