@bajustone/fortress 1.0.0-rc.1

package/src/hono/hono.test.ts

@@ -0,0 +1,454 @@
+import type { Fortress } from '../core/fortress';
+import type { PluginRequestContext } from '../core/http/plugin-middleware';
+import type { FortressEnv } from './middleware/auth';
+import { Hono } from 'hono';
+import { beforeEach, describe, expect, it } from 'vitest';
+import { createFortress } from '../core/fortress';
+import { dataIsolation } from '../plugins/data-isolation';
+import { rateLimit } from '../plugins/rate-limit';
+import { createTestAdapter } from '../testing';
+import { getDb, getScopedDb, getUserId } from './helpers';
+import { createHonoMiddleware } from './index';
+
+const SECRET = 'hono-test-secret-at-least-32chars!!';
+
+let fortress: Fortress;
+let app: Hono<FortressEnv>;
+
+beforeEach(async () => {
+  fortress = createFortress({
+    jwt: { key: SECRET },
+    database: createTestAdapter(),
+  });
+
+  const { authMiddleware, rbacMiddleware, errorHandler } = createHonoMiddleware(fortress, {
+    routeMap: {
+      'GET /api/posts': { resource: 'post', action: 'list' },
+      'POST /api/posts': { resource: 'post', action: 'create' },
+      'GET /api/posts/:id': { resource: 'post', action: 'read' },
+    },
+    skipPaths: ['/health', '/auth/*'],
+  });
+
+  app = new Hono<FortressEnv>();
+  app.onError(errorHandler);
+
+  // Public routes
+  app.get('/health', c => c.json({ status: 'ok' }));
+  app.post('/auth/login', async (c) => {
+    const { identifier, password } = await c.req.json();
+    const result = await fortress.auth.login(identifier, password);
+    return c.json(result);
+  });
+
+  // Protected routes
+  app.use('/api/*', authMiddleware);
+  app.use('/api/*', rbacMiddleware);
+
+  app.get('/api/posts', (c) => {
+    const userId = getUserId(c);
+    return c.json({ userId, posts: [] });
+  });
+  app.post('/api/posts', c => c.json({ created: true }));
+  app.get('/api/posts/:id', c => c.json({ id: c.req.param('id') }));
+  app.get('/api/profile', (c) => {
+    const userId = getUserId(c);
+    return c.json({ userId });
+  });
+
+  // Seed a user
+  await fortress.auth.createUser({
+    email: 'test@example.com',
+    name: 'Test User',
+    password: 'password-123456',
+  });
+});
+
+async function loginAndGetToken(): Promise<string> {
+  const res = await app.request('/auth/login', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ identifier: 'test@example.com', password: 'password-123456' }),
+  });
+  const data = await res.json() as any;
+  return data.accessToken;
+}
+
+describe('hono errorHandler', () => {
+  it('returns 401 for missing auth header', async () => {
+    const res = await app.request('/api/posts');
+    expect(res.status).toBe(401);
+    const body = await res.json() as any;
+    expect(body.code).toBe('UNAUTHORIZED');
+  });
+
+  it('returns 401 for invalid token', async () => {
+    const res = await app.request('/api/posts', {
+      headers: { Authorization: 'Bearer invalid-token' },
+    });
+    expect(res.status).toBe(401);
+  });
+});
+
+describe('hono authMiddleware', () => {
+  it('allows requests with valid token', async () => {
+    const token = await loginAndGetToken();
+    const res = await app.request('/api/profile', {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    // No routeMap for /api/profile → RBAC skips, request goes through
+    expect(res.status).toBe(200);
+    const body = await res.json() as any;
+    expect(body.userId).toBeTruthy();
+  });
+
+  it('skips auth for skip paths', async () => {
+    const res = await app.request('/health');
+    expect(res.status).toBe(200);
+    const body = await res.json() as any;
+    expect(body.status).toBe('ok');
+  });
+
+  it('skips auth for wildcard skip paths', async () => {
+    const res = await app.request('/auth/login', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ identifier: 'test@example.com', password: 'password-123456' }),
+    });
+    expect(res.status).toBe(200);
+  });
+});
+
+describe('hono plugin middleware', () => {
+  it('passes resolved auth fields in PluginRequestContext after auth', async () => {
+    let captured: PluginRequestContext | undefined;
+    const local = createFortress({
+      jwt: { key: SECRET },
+      database: createTestAdapter(),
+      plugins: [{
+        name: 'context-spy',
+        middleware: [{
+          path: '/api/*',
+          position: 'after-auth',
+          handler: async (_ctx, request, next) => {
+            captured = request;
+            await next();
+          },
+        }],
+      }],
+    });
+    const user = await local.auth.createUser({
+      email: 'context@example.com',
+      name: 'Context',
+      password: 'password-123456',
+    });
+    const login = await local.auth.login('context@example.com', 'password-123456');
+    if (login.status !== 'success')
+      throw new Error('Expected successful login');
+    const { authMiddleware, pluginMiddleware, errorHandler } = createHonoMiddleware(local);
+    const localApp = new Hono<FortressEnv>();
+    localApp.onError(errorHandler);
+    localApp.use('/api/*', authMiddleware);
+    localApp.use('/api/*', pluginMiddleware.afterAuth);
+    localApp.get('/api/items', c => c.json({ ok: true }));
+
+    const response = await localApp.request('/api/items?include=all', {
+      headers: { authorization: `Bearer ${login.accessToken}` },
+    });
+    expect(response.status).toBe(200);
+    expect(captured?.request.url).toBe('http://localhost/api/items?include=all');
+    expect(captured?.fortressSubject).toEqual({ type: 'USER', id: user.id });
+    expect(captured?.fortressUserId).toBe(user.id);
+    expect(captured?.fortressClaims?.sub).toBe(user.id);
+  });
+
+  it('normalizes PluginRequestContext so path rate limits fire', async () => {
+    const limited = createFortress({
+      jwt: { key: SECRET },
+      database: createTestAdapter(),
+      plugins: [rateLimit({
+        login: { disabled: true },
+        register: { disabled: true },
+        paths: [{ match: '/api/*', rule: { maxPerIp: 1, windowSeconds: 60 } }],
+      })],
+    });
+    const { pluginMiddleware, errorHandler } = createHonoMiddleware(limited);
+    const limitedApp = new Hono<FortressEnv>();
+    limitedApp.onError(errorHandler);
+    limitedApp.use('/api/*', pluginMiddleware.beforeAuth);
+    limitedApp.get('/api/items', c => c.json({ ok: true }));
+
+    const headers = { 'x-forwarded-for': '192.0.2.1' };
+    expect((await limitedApp.request('/api/items', { headers })).status).toBe(200);
+    const rejected = await limitedApp.request('/api/items', { headers });
+    expect(rejected.status).toBe(429);
+    expect((await rejected.json() as any).code).toBe('RATE_LIMITED');
+  });
+});
+
+describe('hono rbacMiddleware', () => {
+  it('allows access when user has permission', async () => {
+    const token = await loginAndGetToken();
+
+    // Give the user permission to list posts
+    const user = await fortress.auth.me('1');
+    const role = await fortress.iam.createRole('viewer', [
+      { resource: 'post', action: 'list' },
+      { resource: 'post', action: 'read' },
+    ]);
+    await fortress.iam.bindRoleToUser(user.id, role.id);
+
+    const res = await app.request('/api/posts', {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    expect(res.status).toBe(200);
+  });
+
+  it('denies access when user lacks permission', async () => {
+    const token = await loginAndGetToken();
+
+    // User has no roles — should be denied for mapped routes
+    const res = await app.request('/api/posts', {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    expect(res.status).toBe(403);
+    const body = await res.json() as any;
+    expect(body.code).toBe('FORBIDDEN');
+  });
+
+  it('matches parameterized routes', async () => {
+    const token = await loginAndGetToken();
+
+    const role = await fortress.iam.createRole('reader', [
+      { resource: 'post', action: 'read' },
+    ]);
+    await fortress.iam.bindRoleToUser('1', role.id);
+
+    const res = await app.request('/api/posts/42', {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json() as any;
+    expect(body.id).toBe('42');
+  });
+
+  it('allows unmapped routes through (no routeMap entry)', async () => {
+    const token = await loginAndGetToken();
+
+    // /api/profile has no routeMap entry → RBAC skips
+    const res = await app.request('/api/profile', {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    expect(res.status).toBe(200);
+  });
+
+  it('denies unmapped routes when unmappedRoutes is deny, but honors skipPaths', async () => {
+    const token = await loginAndGetToken();
+
+    const { authMiddleware, rbacMiddleware, errorHandler } = createHonoMiddleware(fortress, {
+      routeMap: { 'GET /api/posts': { resource: 'post', action: 'list' } },
+      skipPaths: ['/api/public/*'],
+      unmappedRoutes: 'deny',
+    });
+    const denyApp = new Hono<FortressEnv>();
+    denyApp.onError(errorHandler);
+    denyApp.use('/api/*', authMiddleware);
+    denyApp.use('/api/*', rbacMiddleware);
+    denyApp.get('/api/unmapped', c => c.json({ ok: true }));
+    denyApp.get('/api/public/info', c => c.json({ ok: true }));
+
+    // Unmapped, non-skipped route → fail closed with 403.
+    const denied = await denyApp.request('/api/unmapped', {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    expect(denied.status).toBe(403);
+    expect((await denied.json() as any).code).toBe('FORBIDDEN');
+
+    // Skip-listed route is still allowed even under defaultDeny.
+    const allowed = await denyApp.request('/api/public/info', {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    expect(allowed.status).toBe(200);
+  });
+});
+
+describe('hono authMiddleware — fortressDb and getScopedDb', () => {
+  let dbApp: Hono<FortressEnv>;
+  let dbFortress: Fortress;
+
+  beforeEach(async () => {
+    dbFortress = createFortress({
+      jwt: { key: SECRET },
+      database: createTestAdapter(),
+    });
+
+    const { authMiddleware, errorHandler } = createHonoMiddleware(dbFortress);
+    dbApp = new Hono<FortressEnv>();
+    dbApp.onError(errorHandler);
+
+    dbApp.post('/auth/login', async (c) => {
+      const { identifier, password } = await c.req.json();
+      const result = await dbFortress.auth.login(identifier, password);
+      return c.json(result);
+    });
+
+    dbApp.use('/api/*', authMiddleware);
+
+    dbApp.get('/api/db-check', (c) => {
+      const db = getDb(c);
+      return c.json({
+        hasDb: !!db,
+        hasCreate: typeof db.create === 'function',
+      });
+    });
+
+    dbApp.get('/api/scoped-check', async (c) => {
+      const db = await getScopedDb(c, 'post');
+      return c.json({
+        hasDb: !!db,
+        hasCreate: typeof db.create === 'function',
+      });
+    });
+
+    await dbFortress.auth.createUser({
+      email: 'test@example.com',
+      name: 'Test User',
+      password: 'password-123456',
+    });
+  });
+
+  async function loginDb(): Promise<string> {
+    const res = await dbApp.request('/auth/login', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        identifier: 'test@example.com',
+        password: 'password-123456',
+      }),
+    });
+    const data = (await res.json()) as any;
+    return data.accessToken;
+  }
+
+  it('sets fortressDb on context after auth', async () => {
+    const token = await loginDb();
+    const res = await dbApp.request('/api/db-check', {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as any;
+    expect(body.hasDb).toBe(true);
+    expect(body.hasCreate).toBe(true);
+  });
+
+  it('getScopedDb returns adapter when no plugins define scopeRules', async () => {
+    const token = await loginDb();
+    const res = await dbApp.request('/api/scoped-check', {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as any;
+    expect(body.hasDb).toBe(true);
+    expect(body.hasCreate).toBe(true);
+  });
+});
+
+describe('hono authMiddleware — data-isolation scopeRules', () => {
+  let isolatedFortress: Fortress<any>;
+  let isolatedApp: Hono<FortressEnv>;
+
+  beforeEach(async () => {
+    const db = createTestAdapter();
+
+    isolatedFortress = createFortress({
+      jwt: { key: SECRET },
+      database: db,
+      plugins: [
+        dataIsolation({
+          scopes: [
+            {
+              name: 'org',
+              field: 'orgId',
+              models: ['post'],
+              resolveValue: async () => 42,
+            },
+          ],
+        }),
+      ],
+    });
+
+    const { authMiddleware, errorHandler } = createHonoMiddleware(
+      isolatedFortress,
+    );
+
+    isolatedApp = new Hono<FortressEnv>();
+    isolatedApp.onError(errorHandler);
+
+    isolatedApp.post('/auth/login', async (c) => {
+      const { identifier, password } = await c.req.json();
+      const result = await isolatedFortress.auth.login(identifier, password);
+      return c.json(result);
+    });
+
+    isolatedApp.use('/api/*', authMiddleware);
+
+    isolatedApp.get('/api/scoped-post', async (c) => {
+      const db = await getScopedDb(c, 'post');
+      // Verify the scoped adapter exists and has methods
+      return c.json({
+        hasDb: !!db,
+        hasFindMany: typeof db.findMany === 'function',
+        hasCreate: typeof db.create === 'function',
+      });
+    });
+
+    isolatedApp.get('/api/unscoped-user', async (c) => {
+      // "user" model is not in the scope config, so no filters applied
+      const db = await getScopedDb(c, 'user');
+      return c.json({ hasDb: !!db });
+    });
+
+    await isolatedFortress.auth.createUser({
+      email: 'test@example.com',
+      name: 'Test User',
+      password: 'password-123456',
+    });
+  });
+
+  async function loginIsolated(): Promise<string> {
+    const res = await isolatedApp.request('/auth/login', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        identifier: 'test@example.com',
+        password: 'password-123456',
+      }),
+    });
+    const data = (await res.json()) as any;
+    return data.accessToken;
+  }
+
+  it('getScopedDb applies scope rules for matching model', async () => {
+    const token = await loginIsolated();
+
+    const res = await isolatedApp.request('/api/scoped-post', {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as any;
+    expect(body.hasDb).toBe(true);
+    expect(body.hasFindMany).toBe(true);
+    expect(body.hasCreate).toBe(true);
+  });
+
+  it('getScopedDb returns base adapter for non-matching model', async () => {
+    const token = await loginIsolated();
+
+    const res = await isolatedApp.request('/api/unscoped-user', {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as any;
+    expect(body.hasDb).toBe(true);
+  });
+});

package/src/hono/index.ts

@@ -0,0 +1,101 @@
+/**
+ * Hono adapter for fortress.
+ *
+ * Provides {@link mountFortress}, the modern entry point that delegates to
+ * `fortress.handleRequest`, plus the lower-level middleware factories
+ * (`createHonoMiddleware`, `createAuthMiddleware`, `createRbacMiddleware`,
+ * `createCsrfMiddleware`, `createSecurityHeadersMiddleware`, etc.) for
+ * user-owned routes. Also exports `vBody` / `vParam` / `vQuery` typed
+ * extraction helpers for custom routes.
+ *
+ * @example
+ * ```ts
+ * import { Hono } from 'hono';
+ * import { mountFortress, createHonoMiddleware } from '@bajustone/fortress/hono';
+ *
+ * const app = new Hono();
+ *
+ * // One-line mount: handles all Fortress routes (auth, IAM, plugins, OAuth, OpenAPI).
+ * mountFortress(app, fortress);
+ *
+ * // Optional: protect your own routes with the IAM middleware.
+ * const { authMiddleware, rbacMiddleware, errorHandler } = createHonoMiddleware(fortress, {
+ *   routeMap: { 'GET /api/users': { resource: 'user', action: 'list' } },
+ * });
+ * app.use('/api/*', authMiddleware, rbacMiddleware);
+ * app.onError(errorHandler);
+ * ```
+ *
+ * @module
+ */
+
+import type { Fortress } from '../core/fortress';
+import type { RbacOptions } from './middleware/rbac';
+import { createAuthMiddleware } from './middleware/auth';
+import { createErrorHandler } from './middleware/error-handler';
+import { createPluginMiddleware } from './middleware/plugin-middleware';
+import { createRbacMiddleware } from './middleware/rbac';
+
+export { convertRoutes } from './convert-routes';
+export type { ConvertRoutesOptions, ExternalRoute, ToJSONSchemaConverter } from './convert-routes';
+export { fetcherSchemaConverter, identitySchemaConverter, toJSONSchemaConverter } from './converters';
+export { mountFortress } from './handle';
+export type { MountFortressOptions } from './handle';
+export { getClaims, getDb, getScopedDb, getSubject, getUserId } from './helpers';
+export type { FortressContext, FortressEnv, FortressVariables } from './middleware/auth';
+export { createCsrfMiddleware } from './middleware/csrf';
+export type { CsrfConfig } from './middleware/csrf';
+export { createPluginMiddleware } from './middleware/plugin-middleware';
+export type { RbacOptions, RouteMapping } from './middleware/rbac';
+export { createSecurityHeadersMiddleware } from './middleware/security-headers';
+export type { SecurityHeadersConfig } from './middleware/security-headers';
+export { buildRouteDefinition, getFortressRoutes, mountFortressOpenAPI } from './openapi';
+export type { SchemaConverter } from './openapi';
+export { protectedRoute } from './protect';
+export type { HonoProtectedRouteHandler, ProtectedRouteContext, ProtectedRouteHandler, ProtectedRouteTarget, ProtectOptions } from './protect';
+export { vBody, vParam, vQuery } from './validated';
+export type { InferOutput } from './validated';
+
+/**
+ * Options for {@link createHonoMiddleware}. Currently extends {@link RbacOptions}
+ * so callers can override which IAM resource/action a route maps to.
+ */
+export interface HonoAdapterOptions extends RbacOptions {}
+
+/**
+ * Create Hono middleware from a Fortress instance.
+ *
+ * Usage:
+ *   const { authMiddleware, pluginMiddleware, rbacMiddleware, errorHandler } = createHonoMiddleware(fortress, {
+ *     routeMap: { 'POST /api/users': { resource: 'user', action: 'create' } },
+ *     skipPaths: ['/health', '/auth/*'],
+ *   });
+ *
+ *   app.onError(errorHandler);
+ *   app.use('/api/*', pluginMiddleware.beforeAuth);
+ *   app.use('/api/*', authMiddleware);
+ *   app.use('/api/*', pluginMiddleware.afterAuth);
+ *   app.use('/api/*', rbacMiddleware);
+ *   app.use('/api/*', pluginMiddleware.afterRbac);
+ */
+export function createHonoMiddleware(fortress: Fortress, options?: HonoAdapterOptions): {
+  authMiddleware: ReturnType<typeof createAuthMiddleware>;
+  rbacMiddleware: ReturnType<typeof createRbacMiddleware>;
+  errorHandler: ReturnType<typeof createErrorHandler>;
+  pluginMiddleware: {
+    beforeAuth: ReturnType<typeof createPluginMiddleware>;
+    afterAuth: ReturnType<typeof createPluginMiddleware>;
+    afterRbac: ReturnType<typeof createPluginMiddleware>;
+  };
+} {
+  return {
+    authMiddleware: createAuthMiddleware(fortress),
+    rbacMiddleware: createRbacMiddleware(fortress, options),
+    errorHandler: createErrorHandler(),
+    pluginMiddleware: {
+      beforeAuth: createPluginMiddleware(fortress, 'before-auth'),
+      afterAuth: createPluginMiddleware(fortress, 'after-auth'),
+      afterRbac: createPluginMiddleware(fortress, 'after-rbac'),
+    },
+  };
+}