refactor(auth): extract AuthService

Move auth file I/O and key normalization into an Effect service so auth can migrate like account while the existing Auth facade stays stable for callers. Document the broader Effect rollout and instance-state migration strategy to guide follow-on extractions.

packages/opencode/src/auth/index.ts

@@ -1,73 +1,41 @@
-import path from "path"
-import { Global } from "../global"
-import z from "zod"
-import { Filesystem } from "../util/filesystem"
+import { Effect } from "effect"
+import { runtime } from "@/effect/runtime"
+import {
+  Api as ApiSchema,
+  AuthService,
+  type AuthServiceError,
+  Info as InfoSchema,
+  Oauth as OauthSchema,
+  WellKnown as WellKnownSchema,
+  type Info as AuthInfo,
+} from "./service"
 
-export const OAUTH_DUMMY_KEY = "opencode-oauth-dummy-key"
+export { OAUTH_DUMMY_KEY } from "./service"
+
+function runPromise<A>(f: (service: AuthService.Service) => Effect.Effect<A, AuthServiceError>) {
+  return runtime.runPromise(AuthService.use(f))
+}
 
 export namespace Auth {
-  export const Oauth = z
-    .object({
-      type: z.literal("oauth"),
-      refresh: z.string(),
-      access: z.string(),
-      expires: z.number(),
-      accountId: z.string().optional(),
-      enterpriseUrl: z.string().optional(),
-    })
-    .meta({ ref: "OAuth" })
-
-  export const Api = z
-    .object({
-      type: z.literal("api"),
-      key: z.string(),
-    })
-    .meta({ ref: "ApiAuth" })
-
-  export const WellKnown = z
-    .object({
-      type: z.literal("wellknown"),
-      key: z.string(),
-      token: z.string(),
-    })
-    .meta({ ref: "WellKnownAuth" })
-
-  export const Info = z.discriminatedUnion("type", [Oauth, Api, WellKnown]).meta({ ref: "Auth" })
-  export type Info = z.infer<typeof Info>
-
-  const filepath = path.join(Global.Path.data, "auth.json")
+  export const Oauth = OauthSchema
+  export const Api = ApiSchema
+  export const WellKnown = WellKnownSchema
+  export const Info = InfoSchema
+  export type Info = AuthInfo
 
   export async function get(providerID: string) {
-    const auth = await all()
-    return auth[providerID]
+    return runPromise((service) => service.get(providerID))
   }
 
   export async function all(): Promise<Record<string, Info>> {
-    const data = await Filesystem.readJson<Record<string, unknown>>(filepath).catch(() => ({}))
-    return Object.entries(data).reduce(
-      (acc, [key, value]) => {
-        const parsed = Info.safeParse(value)
-        if (!parsed.success) return acc
-        acc[key] = parsed.data
-        return acc
-      },
-      {} as Record<string, Info>,
-    )
+    return runPromise((service) => service.all())
   }
 
   export async function set(key: string, info: Info) {
-    const normalized = key.replace(/\/+$/, "")
-    const data = await all()
-    if (normalized !== key) delete data[key]
-    delete data[normalized + "/"]
-    await Filesystem.writeJson(filepath, { ...data, [normalized]: info }, 0o600)
+    return runPromise((service) => service.set(key, info))
   }
 
   export async function remove(key: string) {
-    const normalized = key.replace(/\/+$/, "")
-    const data = await all()
-    delete data[key]
-    delete data[normalized]
-    await Filesystem.writeJson(filepath, data, 0o600)
+    return runPromise((service) => service.remove(key))
   }
 }

packages/opencode/src/auth/service.ts

@@ -0,0 +1,114 @@
+import path from "path"
+import { Effect, Layer, Schema, ServiceMap } from "effect"
+import z from "zod"
+import { Global } from "../global"
+import { Filesystem } from "../util/filesystem"
+
+export const OAUTH_DUMMY_KEY = "opencode-oauth-dummy-key"
+
+export const Oauth = z
+  .object({
+    type: z.literal("oauth"),
+    refresh: z.string(),
+    access: z.string(),
+    expires: z.number(),
+    accountId: z.string().optional(),
+    enterpriseUrl: z.string().optional(),
+  })
+  .meta({ ref: "OAuth" })
+
+export const Api = z
+  .object({
+    type: z.literal("api"),
+    key: z.string(),
+  })
+  .meta({ ref: "ApiAuth" })
+
+export const WellKnown = z
+  .object({
+    type: z.literal("wellknown"),
+    key: z.string(),
+    token: z.string(),
+  })
+  .meta({ ref: "WellKnownAuth" })
+
+export const Info = z.discriminatedUnion("type", [Oauth, Api, WellKnown]).meta({ ref: "Auth" })
+export type Info = z.infer<typeof Info>
+
+export class AuthServiceError extends Schema.TaggedErrorClass<AuthServiceError>()("AuthServiceError", {
+  message: Schema.String,
+  cause: Schema.optional(Schema.Defect),
+}) {}
+
+const file = path.join(Global.Path.data, "auth.json")
+
+const fail = (message: string) => (cause: unknown) => new AuthServiceError({ message, cause })
+
+export namespace AuthService {
+  export interface Service {
+    readonly get: (providerID: string) => Effect.Effect<Info | undefined, AuthServiceError>
+    readonly all: () => Effect.Effect<Record<string, Info>, AuthServiceError>
+    readonly set: (key: string, info: Info) => Effect.Effect<void, AuthServiceError>
+    readonly remove: (key: string) => Effect.Effect<void, AuthServiceError>
+  }
+}
+
+export class AuthService extends ServiceMap.Service<AuthService, AuthService.Service>()("@opencode/Auth") {
+  static readonly layer = Layer.effect(
+    AuthService,
+    Effect.gen(function* () {
+      const all = Effect.fn("AuthService.all")(() =>
+        Effect.tryPromise({
+          try: async () => {
+            const data = await Filesystem.readJson<Record<string, unknown>>(file).catch(() => ({}))
+            return Object.entries(data).reduce(
+              (acc, [key, value]) => {
+                const parsed = Info.safeParse(value)
+                if (!parsed.success) return acc
+                acc[key] = parsed.data
+                return acc
+              },
+              {} as Record<string, Info>,
+            )
+          },
+          catch: fail("Failed to read auth data"),
+        }),
+      )
+
+      const get = Effect.fn("AuthService.get")(function* (providerID: string) {
+        return (yield* all())[providerID]
+      })
+
+      const set = Effect.fn("AuthService.set")(function* (key: string, info: Info) {
+        const norm = key.replace(/\/+$/, "")
+        const data = yield* all()
+        if (norm !== key) delete data[key]
+        delete data[norm + "/"]
+        yield* Effect.tryPromise({
+          try: () => Filesystem.writeJson(file, { ...data, [norm]: info }, 0o600),
+          catch: fail("Failed to write auth data"),
+        })
+      })
+
+      const remove = Effect.fn("AuthService.remove")(function* (key: string) {
+        const norm = key.replace(/\/+$/, "")
+        const data = yield* all()
+        delete data[key]
+        delete data[norm]
+        yield* Effect.tryPromise({
+          try: () => Filesystem.writeJson(file, data, 0o600),
+          catch: fail("Failed to write auth data"),
+        })
+      })
+
+      return AuthService.of({
+        get,
+        all,
+        set,
+        remove,
+      })
+    }),
+  )
+
+  static readonly defaultLayer = AuthService.layer
+}

packages/opencode/src/effect/runtime.ts

@@ -1,4 +1,5 @@
-import { ManagedRuntime } from "effect"
+import { Layer, ManagedRuntime } from "effect"
 import { AccountService } from "@/account/service"
+import { AuthService } from "@/auth/service"
 
-export const runtime = ManagedRuntime.make(AccountService.defaultLayer)
+export const runtime = ManagedRuntime.make(Layer.mergeAll(AccountService.defaultLayer, AuthService.defaultLayer))