Merge pull request #1342 from cipherstash/docs/unwrap-oidc-federation-result

docs(stack): unwrap the OidcFederationStrategy Result in the README example

Author: coderdan

.changeset/readme-unwrap-oidc-federation-result.md

@@ -0,0 +1,6 @@
+---
+"@cipherstash/stack": patch
+---
+
+Fix the README's OIDC federation example, which passed the `Result` from `OidcFederationStrategy.create()` straight to `config.authStrategy` and failed in `Encryption()` with `opts.strategy.getToken is missing`.
+It now unwraps the `Result` and passes `strategy.data`, and so does the `LockContext` JSDoc example.

README.md

@@ -121,10 +121,14 @@ const client = await Encryption({ schemas: [users] });
 // strategy serves every user. (On this native entry the client calls getJwt
 // from a background task, so a request read from AsyncLocalStorage is not
 // visible there yet — pass it in, or build the client per request; see
-// cipherstash/stack#1065.)
+// cipherstash/stack#1065.) create() returns a Result: unwrap it and pass the
+// strategy itself, not the Result envelope.
+const strategy = OidcFederationStrategy.create(workspaceCrn, () => getUserJwt(req));
+if (strategy.failure) throw new Error(strategy.failure.error.message);
+
 const client = await Encryption({
   schemas: [users],
-  config: { authStrategy: OidcFederationStrategy.create(workspaceCrn, () => getUserJwt(req)) },
+  config: { authStrategy: strategy.data },
 });
 ```
 

languages/typescript/packages/stack/README.md

@@ -121,10 +121,14 @@ const client = await Encryption({ schemas: [users] });
 // strategy serves every user. (On this native entry the client calls getJwt
 // from a background task, so a request read from AsyncLocalStorage is not
 // visible there yet — pass it in, or build the client per request; see
-// cipherstash/stack#1065.)
+// cipherstash/stack#1065.) create() returns a Result: unwrap it and pass the
+// strategy itself, not the Result envelope.
+const strategy = OidcFederationStrategy.create(workspaceCrn, () => getUserJwt(req));
+if (strategy.failure) throw new Error(strategy.failure.error.message);
+
 const client = await Encryption({
   schemas: [users],
-  config: { authStrategy: OidcFederationStrategy.create(workspaceCrn, () => getUserJwt(req)) },
+  config: { authStrategy: strategy.data },
 });
 ```
 

languages/typescript/packages/stack/src/identity/index.ts

@@ -186,10 +186,14 @@ export function resolveLockContext(input: LockContextInput): Context {
  * import { OidcFederationStrategy } from "@cipherstash/auth"
  *
  * // Authenticate the client as the end user (replaces the old identify() flow).
+ * // `create()` returns a `Result` — unwrap it before passing the strategy.
+ * const strategy = OidcFederationStrategy.create(workspaceCrn, () => getJwt())
+ * if (strategy.failure) throw new Error(strategy.failure.error.message)
+ *
  * const client = await Encryption({
  *   schemas,
  *   config: {
- *     authStrategy: OidcFederationStrategy.create(workspaceCrn, () => getJwt()),
+ *     authStrategy: strategy.data,
  *   },
  * })
  *