@bajustone/fortress 1.0.0-rc.1

package/src/core/http/call.test.ts

@@ -0,0 +1,148 @@
+import type { authEndpoints } from '../auth/auth-endpoints';
+import type { InferEndpointCallInput, InferEndpointSuccessResponse } from '../endpoint';
+import type { Fortress } from '../fortress';
+import { describe, expect, expectTypeOf, it } from 'vitest';
+import { createTestAdapter } from '../../testing';
+import { FortressError } from '../errors';
+import { createFortress } from '../fortress';
+import { assertSuccess } from '../types';
+
+const SECRET = 'call-test-secret-at-least-32-bytes-long!!';
+
+function makeFortress(): Fortress {
+  return createFortress({
+    jwt: { key: SECRET, issuer: 'call-test' },
+    database: createTestAdapter(),
+  }) as unknown as Fortress;
+}
+
+describe('fortress.call', () => {
+  describe('type inference', () => {
+    it('infers login input shape', () => {
+      // Compile-time only — verifies the generic flow.
+      expectTypeOf<InferEndpointCallInput<typeof authEndpoints.login>>().toEqualTypeOf<{
+        identifier: string;
+        password: string;
+        trustedDeviceToken?: string;
+      }>();
+    });
+
+    it('infers revokeSession params shape', () => {
+      expectTypeOf<InferEndpointCallInput<typeof authEndpoints.revokeSession>>().toEqualTypeOf<{
+        id: string;
+      }>();
+    });
+
+    it('infers login success response carries a tagged union', () => {
+      type R = InferEndpointSuccessResponse<typeof authEndpoints.login>;
+      // The AuthResult oneOf collapses to a discriminated union — exercise
+      // that at least one variant has an accessToken string.
+      expectTypeOf<R>().not.toBeNever();
+      expectTypeOf<R>().not.toBeUnknown();
+    });
+
+    it('infers me endpoint takes no input', () => {
+      // `me` has no body/query/params, so the inferred call input collapses
+      // to the empty intersection — we assert it's not `never` and not `unknown`.
+      expectTypeOf<InferEndpointCallInput<typeof authEndpoints.me>>().not.toBeNever();
+      expectTypeOf<InferEndpointCallInput<typeof authEndpoints.me>>().not.toBeUnknown();
+    });
+  });
+
+  describe('runtime: happy path', () => {
+    it('creates a user via call.createUser and logs in via call.login', async () => {
+      const fortress = makeFortress();
+
+      // Direct service call to create the user — createUser over HTTP uses
+      // a different password-policy path than we want to exercise here.
+      await fortress.auth.createUser({
+        email: 'call@example.com',
+        name: 'Call Test',
+        password: 'password-123456',
+      });
+
+      const result = await (fortress.call as any).login({
+        identifier: 'call@example.com',
+        password: 'password-123456',
+      });
+
+      expect(result).toBeDefined();
+      expect(typeof result.accessToken).toBe('string');
+      expect(typeof result.refreshToken).toBe('string');
+      expect(result.user.email).toBe('call@example.com');
+    });
+
+    it('substitutes :id from a params input', async () => {
+      const fortress = makeFortress();
+      await fortress.auth.createUser({
+        email: 'sessions@example.com',
+        name: 'Sessions',
+        password: 'password-123456',
+      });
+      const loginResult = await fortress.auth.login(
+        'sessions@example.com',
+        'password-123456',
+      );
+      assertSuccess(loginResult);
+      const accessToken = loginResult.accessToken;
+      expect(typeof accessToken).toBe('string');
+      if (accessToken === null)
+        throw new Error('expected accessToken');
+
+      // Rotate so we have a sessions row to revoke. Then call.revokeSession
+      // using params substitution.
+      const sessions = await fortress.auth.listSessions(
+        (await fortress.auth.verifyToken(accessToken)).sub,
+      );
+      expect(sessions.length).toBeGreaterThan(0);
+      const sessionId = sessions[0].id;
+
+      // revokeSession requires bearer auth. Pass it via options.headers.
+      await expect(
+        (fortress.call as any).revokeSession(
+          { id: sessionId },
+          { headers: { authorization: `Bearer ${accessToken}` } },
+        ),
+      ).resolves.toEqual({ ok: true });
+    });
+  });
+
+  describe('runtime: error path', () => {
+    it('throws FortressError on non-2xx', async () => {
+      const fortress = makeFortress();
+      await fortress.auth.createUser({
+        email: 'bad@example.com',
+        name: 'Bad',
+        password: 'password-123456',
+      });
+
+      await expect((fortress.call as any).login({
+        identifier: 'bad@example.com',
+        password: 'wrong-password',
+      })).rejects.toBeInstanceOf(FortressError);
+    });
+
+    it('preserves the error code from the JSON body', async () => {
+      const fortress = makeFortress();
+      await fortress.auth.createUser({
+        email: 'coded@example.com',
+        name: 'Coded',
+        password: 'password-123456',
+      });
+
+      try {
+        await (fortress.call as any).login({
+          identifier: 'coded@example.com',
+          password: 'wrong',
+        });
+        expect.fail('expected call to throw');
+      }
+      catch (err) {
+        expect(err).toBeInstanceOf(FortressError);
+        const fe = err as FortressError;
+        expect(fe.code).toBe('UNAUTHORIZED');
+        expect(fe.statusCode).toBe(401);
+      }
+    });
+  });
+});

package/src/core/http/call.ts

@@ -0,0 +1,149 @@
+/**
+ * Typed in-process client for fortress endpoints.
+ *
+ * `buildCall` takes a flat map of `EndpointDefinition`s (keyed by handler
+ * name) and returns an object with one callable per entry. Each callable:
+ *
+ * 1. Splits the flat input object into `body`, `query`, and `params` based
+ *    on the endpoint's declared schemas.
+ * 2. Substitutes `:param` placeholders in the path.
+ * 3. Serializes the query string.
+ * 4. Builds a web-standard `Request` with a JSON body (when applicable).
+ * 5. Delegates to `fortress.handleRequest`, exercising the full pipeline
+ *    (plugin middleware → token verification → RBAC → validation →
+ *    dispatch → cookie attachment).
+ * 6. Parses the JSON response body. On non-2xx, throws a structured
+ *    `FortressError` reconstructed via `Errors.fromHttpResponse`.
+ *
+ * This is the foundation of the typed client SDK: the same code works
+ * in-process today and will work over the network tomorrow by swapping
+ * `handleRequest` for `fetch`. All of the type machinery lives on the
+ * `EndpointDefinition` generic parameters and the `InferEndpoint*` helpers
+ * in `src/core/endpoint.ts`.
+ *
+ * **Authentication.** Protected endpoints expect a bearer token. Callers
+ * pass it via the optional second argument: `call.me({}, { headers:
+ * { authorization: 'Bearer …' } })`. The in-process client does not share
+ * state with any active session; it is purely a typed wire formatter.
+ *
+ * **Runs the full pipeline.** Because each call lands in
+ * `fortress.handleRequest`, the following all fire: plugin middleware (incl.
+ * rate limits), principal resolution, RBAC, JSON Schema / Standard Schema
+ * validation, auth observers, IAM observers, OpenTelemetry spans, and any
+ * `wrapAdapter` hooks. This is intentional — it's the same code path a
+ * network client would hit, so tests that exercise `fortress.call.*` give
+ * the same behavioral guarantees as production traffic.
+ *
+ * **Bypassing hooks in tests.** If a test fixture needs to create users or
+ * log in *without* tripping rate limits, emitting audit entries, or running
+ * observers, call the service layer directly — `fortress.auth.createUser`,
+ * `fortress.auth.login`, `fortress.iam.createRole` — instead of the typed
+ * call surface. The service layer still validates inputs but skips the
+ * middleware chain.
+ */
+
+import type { EndpointDefinition } from '../endpoint';
+import type { Fortress } from '../fortress';
+import { Errors } from '../errors';
+
+/** Optional per-call options. */
+export interface CallOptions {
+  /** Extra headers to attach to the synthesized request (e.g. bearer auth). */
+  headers?: Record<string, string>;
+}
+
+/** Extract the top-level keys of an input JSON Schema so input can be split into body/query/params. */
+function schemaKeys(schema: unknown): Set<string> {
+  if (!schema || typeof schema !== 'object')
+    return new Set();
+  const props = (schema as { properties?: Record<string, unknown> }).properties;
+  if (!props)
+    return new Set();
+  return new Set(Object.keys(props));
+}
+
+/**
+ * Build an object of typed callables from a keyed {@link EndpointDefinition}
+ * map. Each callable invokes `fortress.handleRequest` with a synthesized
+ * `Request` and returns the parsed JSON body on success.
+ *
+ * The returned type is intentionally loose (`Record<string, ...>`). The
+ * strong typing happens at the call site via the `TypedCall` helper in
+ * `src/core/fortress.ts`, which layers a mapped type over the runtime
+ * callable map to expose per-handler inferred I/O.
+ */
+export function buildCall(
+  fortress: Fortress,
+  endpoints: Record<string, EndpointDefinition>,
+): Record<string, (input?: Record<string, unknown>, options?: CallOptions) => Promise<unknown>> {
+  const out: Record<string, (input?: Record<string, unknown>, options?: CallOptions) => Promise<unknown>> = {};
+
+  for (const [key, ep] of Object.entries(endpoints)) {
+    const bodyKeys = schemaKeys(ep.input?.body);
+    const queryKeys = schemaKeys(ep.input?.query);
+    const paramsKeys = schemaKeys(ep.input?.params);
+
+    out[key] = async (input: Record<string, unknown> = {}, options: CallOptions = {}): Promise<unknown> => {
+      // Split the flat input into body/query/params by schema membership.
+      // Params take priority (path substitution), then query, then body.
+      const body: Record<string, unknown> = {};
+      const query: Record<string, unknown> = {};
+      const params: Record<string, unknown> = {};
+      for (const [k, v] of Object.entries(input)) {
+        if (paramsKeys.has(k))
+          params[k] = v;
+        else if (queryKeys.has(k))
+          query[k] = v;
+        else if (bodyKeys.has(k))
+          body[k] = v;
+        else
+          // Unknown key — default to body so callers can pass extra fields
+          // without tripping the splitter. Server-side validation is the
+          // authority on accepted shapes.
+          body[k] = v;
+      }
+
+      // Substitute `:param` placeholders in the path.
+      let path = ep.path;
+      for (const [k, v] of Object.entries(params)) {
+        path = path.replace(`:${k}`, encodeURIComponent(String(v)));
+      }
+
+      // Build URL with query string. `http://fortress.local` is a dummy
+      // origin — `handleRequest` only reads `url.pathname` + `searchParams`.
+      const url = new URL(`http://fortress.local${path}`);
+      for (const [k, v] of Object.entries(query)) {
+        if (v !== undefined && v !== null)
+          url.searchParams.set(k, String(v));
+      }
+
+      // Build request. GET/HEAD never carry a body; other methods get a
+      // JSON body when at least one body field was provided.
+      const headers: Record<string, string> = {
+        'content-type': 'application/json',
+        ...options.headers,
+      };
+      const init: RequestInit = {
+        method: ep.method,
+        headers,
+      };
+      const methodHasBody = ep.method !== 'GET';
+      if (methodHasBody && Object.keys(body).length > 0) {
+        init.body = JSON.stringify(body);
+      }
+
+      const res = await fortress.handleRequest(new Request(url, init));
+      const contentType = res.headers.get('content-type') ?? '';
+      const payload: unknown = contentType.includes('json')
+        ? await res.clone().json().catch(() => null)
+        : await res.clone().text().catch(() => null);
+
+      if (!res.ok) {
+        throw Errors.fromHttpResponse(res.status, payload);
+      }
+      return payload;
+    };
+  }
+
+  return out;
+}

package/src/core/http/cookie-serialize.test.ts

@@ -0,0 +1,198 @@
+import { describe, expect, it } from 'vitest';
+import { resolveCookieConfig } from '../config';
+import {
+  clearAuthCookies,
+  parseCookieHeader,
+  serializeAuthCookies,
+  serializeCookie,
+} from './cookie-serialize';
+
+describe('resolveCookieConfig', () => {
+  const originalNodeEnv = process.env.NODE_ENV;
+  const setEnv = (val: string | undefined): void => {
+    if (val === undefined)
+      delete process.env.NODE_ENV;
+    else process.env.NODE_ENV = val;
+  };
+
+  it('uses __Host- prefix and Secure when NODE_ENV=production', () => {
+    setEnv('production');
+    const c = resolveCookieConfig();
+    expect(c.accessName).toBe('__Host-fortress_access');
+    expect(c.refreshName).toBe('__Host-fortress_refresh');
+    expect(c.secure).toBe(true);
+    expect(c.sameSite).toBe('lax');
+    expect(c.path).toBe('/');
+    setEnv(originalNodeEnv);
+  });
+
+  it('defaults Secure on outside production too (P3.7 — NODE_ENV not relied on)', () => {
+    setEnv('development');
+    const c = resolveCookieConfig();
+    expect(c.accessName).toBe('__Host-fortress_access');
+    expect(c.refreshName).toBe('__Host-fortress_refresh');
+    expect(c.secure).toBe(true);
+    setEnv(originalNodeEnv);
+  });
+
+  it('opting out of Secure drops __Host- prefix (local HTTP dev escape hatch)', () => {
+    setEnv('development');
+    const c = resolveCookieConfig({ secure: false });
+    expect(c.accessName).toBe('fortress_access');
+    expect(c.refreshName).toBe('fortress_refresh');
+    expect(c.secure).toBe(false);
+    setEnv(originalNodeEnv);
+  });
+
+  it('drops __Host- prefix when a Domain is set even in production', () => {
+    setEnv('production');
+    const c = resolveCookieConfig({ domain: 'example.com' });
+    expect(c.accessName).toBe('fortress_access');
+    expect(c.refreshName).toBe('fortress_refresh');
+    expect(c.secure).toBe(true);
+    expect(c.domain).toBe('example.com');
+    setEnv(originalNodeEnv);
+  });
+
+  it('normalizes an empty domain to host-only cookies', () => {
+    const c = resolveCookieConfig({ domain: '' });
+    expect(c.domain).toBeUndefined();
+    expect(c.accessName).toBe('__Host-fortress_access');
+  });
+
+  it('drops __Host- prefix when path is not /', () => {
+    setEnv('production');
+    const c = resolveCookieConfig({ path: '/api' });
+    expect(c.accessName).toBe('fortress_access');
+    setEnv(originalNodeEnv);
+  });
+
+  it('honors caller-provided overrides', () => {
+    setEnv('production');
+    const c = resolveCookieConfig({
+      accessName: 'my_access',
+      refreshName: 'my_refresh',
+      sameSite: 'strict',
+      secure: false,
+    });
+    expect(c.accessName).toBe('my_access');
+    expect(c.refreshName).toBe('my_refresh');
+    expect(c.sameSite).toBe('strict');
+    expect(c.secure).toBe(false);
+    setEnv(originalNodeEnv);
+  });
+
+  it('rejects SameSite=None without Secure', () => {
+    expect(() => resolveCookieConfig({ sameSite: 'none', secure: false }))
+      .toThrow('SameSite=None requires Secure');
+  });
+
+  it('rejects invalid caller-supplied cookie prefixes', () => {
+    expect(() => resolveCookieConfig({ accessName: '__Secure-access', secure: false }))
+      .toThrow('__Secure- prefix');
+    expect(() => resolveCookieConfig({ refreshName: '__Host-refresh', domain: 'example.com' }))
+      .toThrow('__Host- prefix');
+    expect(() => resolveCookieConfig({ refreshName: '__Host-refresh', path: '/auth' }))
+      .toThrow('__Host- prefix');
+  });
+});
+
+describe('serializeCookie', () => {
+  it('produces a Set-Cookie value with all attributes', () => {
+    const cookies = resolveCookieConfig({ secure: true });
+    const out = serializeCookie('test', 'value', cookies, 60);
+    expect(out).toContain('test=value');
+    expect(out).toContain('Path=/');
+    expect(out).toContain('HttpOnly');
+    expect(out).toContain('Secure');
+    expect(out).toContain('SameSite=Lax');
+    expect(out).toContain('Max-Age=60');
+    expect(out).toContain('Expires=');
+  });
+
+  it('omits Secure when not set', () => {
+    const cookies = resolveCookieConfig({ secure: false });
+    const out = serializeCookie('test', 'value', cookies);
+    expect(out).not.toContain('Secure');
+  });
+
+  it('url-encodes the value', () => {
+    const cookies = resolveCookieConfig({ secure: false });
+    const out = serializeCookie('test', 'a b/c', cookies);
+    expect(out).toContain('test=a%20b%2Fc');
+  });
+
+  it('omits Max-Age/Expires when no expiry given', () => {
+    const cookies = resolveCookieConfig({ secure: false });
+    const out = serializeCookie('test', 'value', cookies);
+    expect(out).not.toContain('Max-Age');
+    expect(out).not.toContain('Expires');
+  });
+});
+
+describe('serializeAuthCookies', () => {
+  it('emits one Set-Cookie value when only accessToken is present', () => {
+    const cookies = resolveCookieConfig({ secure: false });
+    const out = serializeAuthCookies({ accessToken: 'a' }, cookies);
+    expect(out).toHaveLength(1);
+    expect(out[0]).toContain('fortress_access=a');
+  });
+
+  it('emits two values when refreshToken is also present', () => {
+    const cookies = resolveCookieConfig({ secure: false });
+    const out = serializeAuthCookies(
+      { accessToken: 'a', refreshToken: 'r' },
+      cookies,
+      { access: 60, refresh: 120 },
+    );
+    expect(out).toHaveLength(2);
+    expect(out[0]).toContain('fortress_access=a');
+    expect(out[0]).toContain('Max-Age=60');
+    expect(out[1]).toContain('fortress_refresh=r');
+    expect(out[1]).toContain('Max-Age=120');
+  });
+
+  it('omits the refresh cookie when refreshToken is null', () => {
+    const cookies = resolveCookieConfig({ secure: false });
+    const out = serializeAuthCookies(
+      { accessToken: 'a', refreshToken: null },
+      cookies,
+    );
+    expect(out).toHaveLength(1);
+  });
+});
+
+describe('clearAuthCookies', () => {
+  it('produces immediately-expiring Set-Cookie values for both names', () => {
+    const cookies = resolveCookieConfig({ secure: false });
+    const out = clearAuthCookies(cookies);
+    expect(out).toHaveLength(2);
+    expect(out[0]).toContain('fortress_access=');
+    expect(out[0]).toContain('Max-Age=0');
+    expect(out[1]).toContain('fortress_refresh=');
+    expect(out[1]).toContain('Max-Age=0');
+  });
+});
+
+describe('parseCookieHeader', () => {
+  it('returns {} for null/empty', () => {
+    expect(parseCookieHeader(null)).toEqual({});
+    expect(parseCookieHeader('')).toEqual({});
+  });
+
+  it('parses a single cookie', () => {
+    expect(parseCookieHeader('a=b')).toEqual({ a: 'b' });
+  });
+
+  it('parses multiple cookies', () => {
+    expect(parseCookieHeader('a=b; c=d')).toEqual({ a: 'b', c: 'd' });
+  });
+
+  it('decodes URL-encoded values', () => {
+    expect(parseCookieHeader('a=b%20c')).toEqual({ a: 'b c' });
+  });
+
+  it('skips malformed segments', () => {
+    expect(parseCookieHeader('a=b; nokey; c=d')).toEqual({ a: 'b', c: 'd' });
+  });
+});

package/src/core/http/cookie-serialize.ts

@@ -0,0 +1,107 @@
+/**
+ * Cookie serialization for fortress auth tokens.
+ *
+ * Produces and parses cookie strings for the access/refresh token pair using
+ * the resolved {@link ResolvedCookieConfig} (which already accounts for
+ * `__Host-` prefix rules and dev-vs-prod relaxation).
+ *
+ * Returns raw `Set-Cookie` header values so any framework adapter can append
+ * them to a `Response` directly without depending on a framework cookie API.
+ */
+
+import type { ResolvedCookieConfig } from '../config';
+
+/** Result of an auth flow that may set cookies on a Response. */
+export interface AuthCookiePayload {
+  accessToken: string;
+  refreshToken?: string | null;
+}
+
+/**
+ * Build the `Set-Cookie` header values for an access + refresh token pair.
+ * Returns one or two strings depending on whether `refreshToken` is present.
+ */
+export function serializeAuthCookies(
+  payload: AuthCookiePayload,
+  cookies: ResolvedCookieConfig,
+  expirySeconds: { access?: number; refresh?: number } = {},
+): string[] {
+  const out: string[] = [];
+  out.push(serializeCookie(cookies.accessName, payload.accessToken, cookies, expirySeconds.access));
+  if (payload.refreshToken) {
+    out.push(serializeCookie(cookies.refreshName, payload.refreshToken, cookies, expirySeconds.refresh));
+  }
+  return out;
+}
+
+/**
+ * Build expired `Set-Cookie` header values that clear both auth cookies.
+ * Used by logout flows.
+ */
+export function clearAuthCookies(cookies: ResolvedCookieConfig): string[] {
+  return [
+    serializeCookie(cookies.accessName, '', cookies, 0),
+    serializeCookie(cookies.refreshName, '', cookies, 0),
+  ];
+}
+
+/**
+ * Serialize a single cookie attribute set into a `Set-Cookie` header value.
+ *
+ * `maxAgeSeconds` of 0 produces an immediately-expiring cookie (used for
+ * `clearAuthCookies`). Omit it to set a session cookie. Otherwise the cookie
+ * gets both `Max-Age` and `Expires` for broad client compatibility.
+ */
+export function serializeCookie(
+  name: string,
+  value: string,
+  cookies: ResolvedCookieConfig,
+  maxAgeSeconds?: number,
+): string {
+  const parts: string[] = [`${name}=${encodeURIComponent(value)}`];
+  parts.push(`Path=${cookies.path}`);
+  if (cookies.domain) {
+    parts.push(`Domain=${cookies.domain}`);
+  }
+  parts.push('HttpOnly');
+  if (cookies.secure) {
+    parts.push('Secure');
+  }
+  parts.push(`SameSite=${capitalize(cookies.sameSite)}`);
+  if (maxAgeSeconds !== undefined) {
+    parts.push(`Max-Age=${maxAgeSeconds}`);
+    const expires = new Date(Date.now() + maxAgeSeconds * 1000);
+    parts.push(`Expires=${expires.toUTCString()}`);
+  }
+  return parts.join('; ');
+}
+
+/**
+ * Parse a `Cookie` request header into a name → value map. Returns an empty
+ * object if the header is missing or malformed. Values are URL-decoded.
+ */
+export function parseCookieHeader(header: string | null | undefined): Record<string, string> {
+  if (!header)
+    return {};
+  const out: Record<string, string> = {};
+  for (const part of header.split(';')) {
+    const eq = part.indexOf('=');
+    if (eq === -1)
+      continue;
+    const name = part.slice(0, eq).trim();
+    if (!name)
+      continue;
+    const raw = part.slice(eq + 1).trim();
+    try {
+      out[name] = decodeURIComponent(raw);
+    }
+    catch {
+      out[name] = raw;
+    }
+  }
+  return out;
+}
+
+function capitalize(s: string): string {
+  return s.charAt(0).toUpperCase() + s.slice(1);
+}