1
import { eg, type TypeFromCodec } from "@cloudflare/util-en-garde";
2
 
3
export const UserSession = eg.object({
4
  type: eg.literal("user"),
5
  address: eg.string,
6
});
7
export type UserSession = TypeFromCodec<typeof UserSession>;
8
 
9
export const AdminSession = eg.object({
10
  type: eg.literal("admin"),
11
  // The verified OIDC `sub` claim from tessera. Persisted in KV so
12
  // requireAdmin can re-check the operator allowlist on every request,
13
  // failing closed when an operator is removed from
14
  // TESSERA_OPERATOR_SUBS mid-session (instead of waiting for KV TTL).
15
  sub: eg.string,
16
});
17
export type AdminSession = TypeFromCodec<typeof AdminSession>;
18
 
19
export const SessionRecord = eg.union([UserSession, AdminSession]);
20
export type SessionRecord = TypeFromCodec<typeof SessionRecord>;
21
 
22
export const WebSocketTicketRecord = eg.object({
23
  address: eg.string,
24
  session: SessionRecord,
25
});
26
export type WebSocketTicketRecord = TypeFromCodec<typeof WebSocketTicketRecord>;