@bajustone/fortress 1.0.0-rc.1

package/src/hono/converters.test.ts

@@ -0,0 +1,50 @@
+import type { EndpointDefinition } from '../core/endpoint';
+import { describe, expect, it } from 'vitest';
+import { obj, str } from '../core/schema-builder';
+import { convertRoutes } from './convert-routes';
+import { fetcherSchemaConverter, identitySchemaConverter, toJSONSchemaConverter } from './converters';
+import { buildRouteDefinition } from './openapi';
+
+describe('hono OpenAPI converters (Zod-free defaults)', () => {
+  it('identitySchemaConverter passes JSON Schema through unchanged', () => {
+    const js = { type: 'object' as const, properties: { a: { type: 'string' as const } } };
+    expect(identitySchemaConverter(js)).toBe(js);
+  });
+
+  it('fetcherSchemaConverter compiles JSON Schema into a validating Standard Schema', () => {
+    const schema = fetcherSchemaConverter({ type: 'object', properties: { a: { type: 'string' } }, required: ['a'] });
+    expect(typeof schema['~standard'].validate).toBe('function');
+    expect(schema['~standard'].validate({ a: 'x' })).toEqual({ value: { a: 'x' } });
+    const bad = schema['~standard'].validate({}) as { issues?: unknown };
+    expect(bad.issues).toBeTruthy(); // missing required `a`
+  });
+
+  it('toJSONSchemaConverter extracts JSON Schema from a fortress/fetcher builder schema', () => {
+    const js = toJSONSchemaConverter(obj({ a: str() }, 'a'));
+    expect(js.type).toBe('object');
+    expect(js.properties?.a?.type).toBe('string');
+  });
+
+  it('mounting works with identitySchemaConverter (no Zod)', () => {
+    const ep: EndpointDefinition = {
+      method: 'POST',
+      path: '/x',
+      handler: 'x',
+      input: { body: { type: 'object', properties: { a: { type: 'string' } }, required: ['a'] } },
+    };
+    const def = buildRouteDefinition(ep, identitySchemaConverter);
+    expect((def.request as any).body.content['application/json'].schema).toEqual(ep.input!.body);
+  });
+
+  it('convertRoutes imports a fetcher/fortress-authored route via toJSONSchemaConverter', () => {
+    const route = {
+      method: 'POST',
+      path: '/users',
+      responses: { 200: { description: 'ok' } },
+      request: { body: { content: { 'application/json': { schema: obj({ name: str() }, 'name') } } } },
+    };
+    const [ep] = convertRoutes([route as any], { schemaConverter: toJSONSchemaConverter });
+    expect(ep.input?.body?.type).toBe('object');
+    expect(ep.input?.body?.properties?.name?.type).toBe('string');
+  });
+});

package/src/hono/converters.ts

@@ -0,0 +1,43 @@
+/**
+ * Default schema converters for the Hono OpenAPI integration — so you can mount
+ * fortress endpoints (or import external routes) **without pulling in Zod**.
+ *
+ * fortress's builder schemas (and `@bajustone/fetcher`'s builder schemas) ARE
+ * JSON Schema, so the converters are trivial: identity for the JSON-Schema
+ * direction, and `fromJSONSchema` when the target wants a validating Standard
+ * Schema V1. Existing Zod callers are unaffected — these are opt-in defaults.
+ *
+ * @module
+ */
+
+import type { JSONSchema } from '../core/json-schema';
+import type { StandardSchemaV1 } from '../core/standard-schema';
+import type { ToJSONSchemaConverter } from './convert-routes';
+import type { SchemaConverter } from './openapi';
+import { fromJSONSchema } from '@bajustone/fetcher/openapi';
+import { extractJsonSchema } from '../core/schema-builder';
+
+/**
+ * A {@link SchemaConverter} that passes JSON Schema through unchanged. Use with
+ * OpenAPI tooling that consumes JSON Schema directly, or for raw spec
+ * generation. Requires no schema library.
+ */
+export const identitySchemaConverter: SchemaConverter<JSONSchema> = jsonSchema => jsonSchema;
+
+/**
+ * A {@link SchemaConverter} that compiles JSON Schema into a validating
+ * `@bajustone/fetcher` Standard Schema V1. Use with Hono OpenAPI tooling that
+ * accepts Standard Schema (e.g. `hono-openapi` / `@hono/standard-validator`) —
+ * no Zod required.
+ */
+export const fetcherSchemaConverter: SchemaConverter<StandardSchemaV1> = jsonSchema =>
+  fromJSONSchema(jsonSchema) as unknown as StandardSchemaV1;
+
+/**
+ * A {@link ToJSONSchemaConverter} for importing external routes authored with
+ * fortress's or fetcher's builder (both ARE JSON Schema). Extracts clean JSON
+ * Schema (runtime-only `~`-prefixed props are dropped at OpenAPI emission).
+ * Pass to {@link convertRoutes} so such routes import without Zod.
+ */
+export const toJSONSchemaConverter: ToJSONSchemaConverter = schema =>
+  extractJsonSchema(schema as Parameters<typeof extractJsonSchema>[0]);

package/src/hono/handle.ts

@@ -0,0 +1,79 @@
+/**
+ * Primary entry point for the Hono adapter: register a single fortress
+ * middleware that detects Fortress-managed paths and delegates to
+ * `fortress.handleRequest`. Custom user routes registered *before*
+ * `mountFortress` keep working — Hono's first-match routing means user
+ * handlers win over the catch-all.
+ *
+ * @example
+ * ```ts
+ * import { Hono } from 'hono';
+ * import { mountFortress } from '@bajustone/fortress/hono';
+ *
+ * const app = new Hono();
+ * mountFortress(app, fortress);
+ * // POST /auth/login, POST /auth/refresh, GET /auth/me, /iam/*, /oauth/* …
+ * // are all handled automatically. Cookies for login/refresh are set on
+ * // the response without any extra wiring.
+ * ```
+ */
+
+import type { Env, Hono } from 'hono';
+import type { Fortress } from '../core/fortress';
+import { buildRouteTable, matchRoute } from '../core/http/match';
+
+/** Options for {@link mountFortress}. */
+export interface MountFortressOptions {
+  /**
+   * Optional path prefix to mount Fortress under (e.g. `/api`). When set,
+   * a request to `/api/auth/login` is internally rewritten to `/auth/login`
+   * before being passed to `fortress.handleRequest`.
+   */
+  prefix?: string;
+}
+
+/**
+ * Mount a single Hono middleware that delegates Fortress-managed paths to
+ * `fortress.handleRequest` and otherwise calls `next()` so user-route
+ * handlers run normally.
+ *
+ * Cookies emitted by login/refresh/impersonate are honored automatically:
+ * the `Response` returned by `fortress.handleRequest` already carries the
+ * `Set-Cookie` headers built by core, and Hono returns it verbatim.
+ */
+export function mountFortress<E extends Env = Env>(
+  app: Hono<E>,
+  fortress: Fortress,
+  options: MountFortressOptions = {},
+): void {
+  const prefix = options.prefix ?? '';
+  // Pre-build the route table once at startup. The middleware uses this to
+  // detect whether a request belongs to Fortress before delegating to core.
+  // Matching against the table catches every endpoint (auth, iam, plugin
+  // routes including OpenAPI's flat `/openapi.json` and `/openapi`) without
+  // needing per-prefix heuristics.
+  const routeTable = buildRouteTable(fortress.manifest.filter(route => route.mounted));
+
+  app.use('*', async (c, next) => {
+    const url = new URL(c.req.url);
+    let pathname = url.pathname;
+    if (prefix && pathname.startsWith(prefix)) {
+      pathname = pathname.slice(prefix.length) || '/';
+    }
+    else if (prefix) {
+      // Path doesn't live under our prefix — leave it for user routes.
+      await next();
+      return;
+    }
+
+    if (!matchRoute(routeTable, c.req.method, pathname)) {
+      await next();
+      return;
+    }
+
+    // Build a fresh Request with the (possibly rewritten) path so core
+    // matches the canonical /auth/* / /iam/* paths regardless of mount prefix.
+    const rewritten = new Request(`${url.origin}${pathname}${url.search}`, c.req.raw);
+    return fortress.handleRequest(rewritten);
+  });
+}

package/src/hono/helpers.ts

@@ -0,0 +1,2 @@
+export { getClaims, getDb, getScopedDb, getSubject, getUserId } from './middleware/auth';
+export type { FortressContext, FortressEnv, FortressVariables } from './middleware/auth';

package/src/hono/hono-api-key-user-routes.test.ts

@@ -0,0 +1,225 @@
+/**
+ * Integration tests proving that api-key credentials authenticate user-owned
+ * Hono routes — the gap this branch closed. The auth middleware must delegate
+ * to `fortress.resolvePrincipal`, populate `fortressSubject` for every
+ * principal kind, and the RBAC middleware must check permissions by subject
+ * (not by hardcoded USER subject).
+ */
+
+import type { Fortress } from '../core/fortress';
+import type { Subject } from '../core/types';
+import type { FortressEnv } from './middleware/auth';
+import { Hono } from 'hono';
+import { beforeEach, describe, expect, it } from 'vitest';
+import { createFortress } from '../core/fortress';
+import { apiKey } from '../plugins/api-key';
+import { createTestAdapter } from '../testing';
+import { getSubject, getUserId } from './helpers';
+import { createHonoMiddleware } from './index';
+
+const SECRET = 'hono-api-key-user-routes-secret-32char!';
+
+interface Ctx {
+  fortress: Fortress<any>;
+  app: Hono<FortressEnv>;
+  userId: string;
+  userKey: string;
+  saId: string;
+  saKey: string;
+  saKeyNoPerm: string;
+  saNoPermId: string;
+  userAccessToken: string;
+}
+
+async function setup(): Promise<Ctx> {
+  const fortress: Fortress<any> = createFortress({
+    jwt: { key: SECRET },
+    database: createTestAdapter(),
+    plugins: [apiKey({ prefix: 'test' })],
+  });
+
+  // Seed: a user, a service account with 'deploy:run' permission, and a
+  // second service account with *no* permissions (for the deny case).
+  const user = await fortress.auth.createUser({
+    email: 'human@example.com',
+    name: 'Human',
+    password: 'password-123456',
+  });
+  const userLogin = await fortress.auth.login('human@example.com', 'password-123456');
+  if (userLogin.status !== 'success')
+    throw new Error('login should succeed');
+
+  // Give the user the same 'deploy:run' permission so shared user routes work.
+  const deployRole = await fortress.iam.createRole('deployer', [
+    { resource: 'deploy', action: 'run' },
+  ]);
+  await fortress.iam.bindRoleToUser(user.id, deployRole.id);
+
+  const sa = await fortress.iam.createServiceAccount({ name: 'ci-deploy-bot' });
+  await fortress.iam.bindRoleToServiceAccount(sa.id, deployRole.id);
+
+  const saNoPerm = await fortress.iam.createServiceAccount({ name: 'observer-bot' });
+
+  const { key: userKey } = await fortress.plugins['api-key'].createKey({
+    subject: { type: 'USER', id: user.id },
+    name: 'user-key',
+  });
+  const { key: saKey } = await fortress.plugins['api-key'].createKey({
+    subject: { type: 'SERVICE_ACCOUNT', id: sa.id },
+    name: 'sa-key',
+  });
+  const { key: saKeyNoPerm } = await fortress.plugins['api-key'].createKey({
+    subject: { type: 'SERVICE_ACCOUNT', id: saNoPerm.id },
+    name: 'observer-key',
+  });
+
+  const { authMiddleware, rbacMiddleware, errorHandler } = createHonoMiddleware(fortress, {
+    routeMap: {
+      'POST /deploy/run': { resource: 'deploy', action: 'run' },
+    },
+  });
+
+  const app = new Hono<FortressEnv>();
+  app.onError(errorHandler);
+  app.use('/deploy/*', authMiddleware, rbacMiddleware);
+  app.use('/me/*', authMiddleware); // no rbac
+
+  app.post('/deploy/run', (c) => {
+    const subject = getSubject(c);
+    return c.json({ startedBy: subject });
+  });
+
+  // Endpoint that only USER subjects can reach (tests that getUserId throws
+  // for non-USER principals).
+  app.get('/me/profile', (c) => {
+    const uid = getUserId(c);
+    return c.json({ userId: uid });
+  });
+
+  // Endpoint that echoes the full subject so we can assert fortressSubject
+  // is populated and fortressUserId is USER-only.
+  app.get('/me/whoami', (c) => {
+    const subject = c.get('fortressSubject') as Subject;
+    const userId = c.get('fortressUserId');
+    return c.json({ subject, userId });
+  });
+
+  return {
+    fortress,
+    app,
+    userId: user.id,
+    userKey,
+    saId: sa.id,
+    saKey,
+    saKeyNoPerm,
+    saNoPermId: saNoPerm.id,
+    userAccessToken: userLogin.accessToken,
+  };
+}
+
+describe('hono user routes: api-key authentication', () => {
+  let ctx: Ctx;
+  beforeEach(async () => {
+    ctx = await setup();
+  });
+
+  it('authorization: ApiKey <key> authenticates a USER on a custom user route', async () => {
+    const res = await ctx.app.request('/me/whoami', {
+      headers: { Authorization: `ApiKey ${ctx.userKey}` },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json() as { subject: Subject; userId: string };
+    expect(body.subject).toEqual({ type: 'USER', id: ctx.userId });
+    expect(body.userId).toBe(ctx.userId);
+  });
+
+  it('x-API-Key authenticates a SERVICE_ACCOUNT on a custom user route', async () => {
+    const res = await ctx.app.request('/me/whoami', {
+      headers: { 'X-API-Key': ctx.saKey },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json() as { subject: Subject; userId: string | null };
+    expect(body.subject).toEqual({ type: 'SERVICE_ACCOUNT', id: ctx.saId });
+    // fortressUserId is a USER-only alias — undefined for service accounts
+    expect(body.userId).toBeFalsy();
+  });
+
+  it('falls back to JWT bearer when no api-key header is present', async () => {
+    const res = await ctx.app.request('/me/whoami', {
+      headers: { Authorization: `Bearer ${ctx.userAccessToken}` },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json() as { subject: Subject; userId: string };
+    expect(body.subject).toEqual({ type: 'USER', id: ctx.userId });
+    expect(body.userId).toBe(ctx.userId);
+  });
+
+  it('returns 401 when no credential is present', async () => {
+    const res = await ctx.app.request('/me/whoami');
+    expect(res.status).toBe(401);
+  });
+
+  it('returns 401 for an unknown api-key', async () => {
+    const res = await ctx.app.request('/me/whoami', {
+      headers: { 'X-API-Key': 'test_sk_not-real' },
+    });
+    expect(res.status).toBe(401);
+  });
+
+  it('getUserId throws 401 for a SERVICE_ACCOUNT principal (USER-only helper)', async () => {
+    const res = await ctx.app.request('/me/profile', {
+      headers: { 'X-API-Key': ctx.saKey },
+    });
+    expect(res.status).toBe(401);
+  });
+
+  it('getUserId returns the id for a USER principal', async () => {
+    const res = await ctx.app.request('/me/profile', {
+      headers: { Authorization: `ApiKey ${ctx.userKey}` },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json() as { userId: string };
+    expect(body.userId).toBe(ctx.userId);
+  });
+});
+
+describe('hono user routes: api-key + RBAC middleware', () => {
+  let ctx: Ctx;
+  beforeEach(async () => {
+    ctx = await setup();
+  });
+
+  it('allows a SERVICE_ACCOUNT api-key when the bound role grants the permission', async () => {
+    const res = await ctx.app.request('/deploy/run', {
+      method: 'POST',
+      headers: { Authorization: `ApiKey ${ctx.saKey}` },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json() as { startedBy: Subject };
+    expect(body.startedBy).toEqual({ type: 'SERVICE_ACCOUNT', id: ctx.saId });
+  });
+
+  it('denies a SERVICE_ACCOUNT api-key that lacks the permission', async () => {
+    const res = await ctx.app.request('/deploy/run', {
+      method: 'POST',
+      headers: { 'X-API-Key': ctx.saKeyNoPerm },
+    });
+    expect(res.status).toBe(403);
+  });
+
+  it('allows a USER api-key when the user has the permission', async () => {
+    const res = await ctx.app.request('/deploy/run', {
+      method: 'POST',
+      headers: { Authorization: `ApiKey ${ctx.userKey}` },
+    });
+    expect(res.status).toBe(200);
+  });
+
+  it('allows the same USER over JWT bearer (control: JWT still works)', async () => {
+    const res = await ctx.app.request('/deploy/run', {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${ctx.userAccessToken}` },
+    });
+    expect(res.status).toBe(200);
+  });
+});