@bajustone/fortress 1.0.0-rc.1

package/dist/express.js

@@ -0,0 +1,1314 @@
+// src/hono/convert-routes.ts
+var TRAILING_SLASH_REGEX = /\/$/;
+var RE_LEADING_SLASH = /^\//;
+var RE_PARAM_BRACE = /\{(\w+)\}/g;
+var RE_SLASH = /\//g;
+var RE_NON_WORD = /\W/g;
+function fromOpenAPIPath(path) {
+  return path.replace(RE_PARAM_BRACE, ":$1");
+}
+function toOperationId(method, path) {
+  const normalized = path.replace(RE_LEADING_SLASH, "").replace(RE_PARAM_BRACE, "$1").replace(RE_SLASH, "_").replace(RE_NON_WORD, "_");
+  return `${method.toLowerCase()}_${normalized}`;
+}
+var VALID_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "DELETE", "PATCH"]);
+var SECURITY_REVERSE = {
+  bearer: "bearer",
+  bearerauth: "bearer",
+  basic: "basic",
+  basicauth: "basic",
+  apikey: "apiKey",
+  apikeyauth: "apiKey"
+};
+function mapSecurity(security) {
+  const result = [];
+  for (const entry of security) {
+    const keys = Object.keys(entry);
+    if (keys.length === 0) {
+      result.push("none");
+      continue;
+    }
+    for (const key of keys) {
+      const mapped = SECURITY_REVERSE[key.toLowerCase()];
+      if (mapped && !result.includes(mapped)) {
+        result.push(mapped);
+      }
+    }
+  }
+  return result;
+}
+function convertRoutes(routes, options) {
+  const { schemaConverter, prefix } = options;
+  const result = [];
+  for (const route of routes) {
+    const method = route.method.toUpperCase();
+    if (!VALID_METHODS.has(method))
+      continue;
+    const rawPath = prefix ? `${prefix.replace(TRAILING_SLASH_REGEX, "")}${route.path}` : route.path;
+    const path = fromOpenAPIPath(rawPath);
+    const handler = toOperationId(method, rawPath);
+    const meta = {
+      summary: route.summary ?? ""
+    };
+    if (route.tags)
+      meta.tags = route.tags;
+    if (route.description)
+      meta.description = route.description;
+    if (route.deprecated)
+      meta.deprecated = true;
+    if (route.security) {
+      const mapped = mapSecurity(route.security);
+      if (mapped.length > 0)
+        meta.security = mapped;
+    }
+    const input = {};
+    let hasInput = false;
+    if (route.request?.body?.content?.["application/json"]?.schema) {
+      input.body = schemaConverter(route.request.body.content["application/json"].schema);
+      hasInput = true;
+    }
+    if (route.request?.params) {
+      input.params = schemaConverter(route.request.params);
+      hasInput = true;
+    }
+    if (route.request?.query) {
+      input.query = schemaConverter(route.request.query);
+      hasInput = true;
+    }
+    const responses = {};
+    let hasResponses = false;
+    for (const [status, resp] of Object.entries(route.responses)) {
+      const entry = { description: resp.description };
+      if (resp.content?.["application/json"]?.schema) {
+        entry.schema = schemaConverter(resp.content["application/json"].schema);
+      }
+      responses[Number(status)] = entry;
+      hasResponses = true;
+    }
+    const endpoint = {
+      method,
+      path,
+      handler,
+      meta
+    };
+    if (hasInput)
+      endpoint.input = input;
+    if (hasResponses)
+      endpoint.responses = responses;
+    result.push(endpoint);
+  }
+  return result;
+}
+
+// src/core/http/match.ts
+function segmentSpecificity(segment) {
+  if (segment === "*")
+    return 0;
+  if (segment.startsWith(":"))
+    return 1;
+  return 2;
+}
+function canonicalizePath(pathname) {
+  const segments = pathname.split("/").filter(Boolean);
+  return segments.length === 0 ? "/" : `/${segments.join("/")}`;
+}
+function buildRouteTable(endpoints) {
+  const table = endpoints.map((ep) => {
+    const segments = canonicalizePath(ep.path).split("/").filter(Boolean);
+    const paramNames = [];
+    for (const seg of segments) {
+      if (seg.startsWith(":"))
+        paramNames.push(seg.slice(1));
+    }
+    return {
+      endpoint: ep,
+      method: ep.method.toUpperCase(),
+      segments,
+      paramNames
+    };
+  });
+  return table.map((route, index) => ({ route, index })).sort((a, b) => {
+    const length = Math.max(a.route.segments.length, b.route.segments.length);
+    for (let i = 0; i < length; i++) {
+      const difference = segmentSpecificity(b.route.segments[i] ?? "") - segmentSpecificity(a.route.segments[i] ?? "");
+      if (difference !== 0)
+        return difference;
+    }
+    return a.index - b.index;
+  }).map(({ route }) => route);
+}
+function matchRoute(table, method, pathname) {
+  const upperMethod = method.toUpperCase();
+  const pathSegments = canonicalizePath(pathname).split("/").filter(Boolean);
+  for (const route of table) {
+    if (route.method !== upperMethod)
+      continue;
+    if (route.segments.length !== pathSegments.length)
+      continue;
+    const params = {};
+    let matched = true;
+    for (let i = 0; i < route.segments.length; i++) {
+      const routeSeg = route.segments[i];
+      const pathSeg = pathSegments[i];
+      if (routeSeg.startsWith(":")) {
+        params[routeSeg.slice(1)] = decodeURIComponent(pathSeg);
+      } else if (routeSeg !== "*" && routeSeg !== pathSeg) {
+        matched = false;
+        break;
+      }
+    }
+    if (matched)
+      return { endpoint: route.endpoint, params };
+  }
+  return null;
+}
+
+// src/express/handle.ts
+function mountFortress(app, fortress, options = {}) {
+  const prefix = options.prefix ?? "";
+  const routeTable = buildRouteTable(fortress.manifest.filter((route) => route.mounted));
+  const middleware = async (req, res, next) => {
+    let pathname = req.path;
+    if (prefix && pathname.startsWith(prefix)) {
+      pathname = pathname.slice(prefix.length) || "/";
+    } else if (prefix) {
+      next();
+      return;
+    }
+    if (!matchRoute(routeTable, req.method, pathname)) {
+      next();
+      return;
+    }
+    try {
+      const request = expressToWebRequest(req, pathname);
+      const response = await fortress.handleRequest(request);
+      await sendWebResponseToExpress(response, res);
+    } catch (err) {
+      next(err);
+    }
+  };
+  app.use(middleware);
+}
+function expressToWebRequest(req, pathname) {
+  const host = req.headers.host ?? "localhost";
+  const protocol = req.protocol ?? "http";
+  const search = (req.originalUrl ?? "").includes("?") ? `?${req.originalUrl.split("?")[1]}` : "";
+  const url = `${protocol}://${host}${pathname}${search}`;
+  const headers = new Headers();
+  for (const [k, v] of Object.entries(req.headers)) {
+    if (Array.isArray(v)) {
+      for (const item of v) headers.append(k, item);
+    } else if (typeof v === "string") {
+      headers.set(k, v);
+    }
+  }
+  const init = { method: req.method, headers };
+  if (req.method !== "GET" && req.method !== "HEAD") {
+    const body = req.body;
+    if (body !== void 0 && body !== null) {
+      if (typeof body === "string") {
+        init.body = body;
+      } else if (body instanceof Uint8Array) {
+        init.body = body;
+      } else if ((headers.get("content-type") ?? "").toLowerCase().includes("application/x-www-form-urlencoded")) {
+        const form = new URLSearchParams();
+        for (const [key, value] of Object.entries(body)) {
+          const values = Array.isArray(value) ? value : [value];
+          for (const item of values) {
+            if (item !== void 0 && item !== null)
+              form.append(key, String(item));
+          }
+        }
+        init.body = form.toString();
+      } else {
+        init.body = JSON.stringify(body);
+        if (!headers.has("content-type")) {
+          headers.set("content-type", "application/json");
+        }
+      }
+    }
+  }
+  return new Request(url, init);
+}
+async function sendWebResponseToExpress(response, res) {
+  res.status(response.status);
+  const setCookies = response.headers.getSetCookie();
+  for (const [k, v] of response.headers) {
+    if (k.toLowerCase() === "set-cookie")
+      continue;
+    res.setHeader(k, v);
+  }
+  if (setCookies.length > 0) {
+    res.setHeader("set-cookie", setCookies);
+  }
+  const text = await response.text();
+  const isJson = (response.headers.get("content-type") ?? "").includes("json");
+  if (isJson) {
+    try {
+      res.json(JSON.parse(text));
+    } catch {
+      res.json({ raw: text });
+    }
+  } else {
+    const resWithSend = res;
+    if (resWithSend.send) {
+      resWithSend.send(text);
+    } else {
+      res.json(text);
+    }
+  }
+}
+
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/core/plugin-runner.ts
+function chainAdapterWrappers(plugins, baseAdapter, requestContext) {
+  let adapter = baseAdapter;
+  for (const plugin of plugins) {
+    if (plugin.wrapAdapter) {
+      adapter = plugin.wrapAdapter(adapter, requestContext);
+    }
+  }
+  return adapter;
+}
+async function collectScopeRules(plugins, userId, model, ctx) {
+  const allFilters = [];
+  const allDefaults = {};
+  for (const plugin of plugins) {
+    if (!plugin.scopeRules) {
+      continue;
+    }
+    const rule = await plugin.scopeRules(userId, model, ctx);
+    if (!rule) {
+      continue;
+    }
+    allFilters.push(...rule.filters);
+    Object.assign(allDefaults, rule.defaults);
+  }
+  if (allFilters.length === 0 && Object.keys(allDefaults).length === 0) {
+    return null;
+  }
+  return { filters: allFilters, defaults: allDefaults };
+}
+function wrapAdapterWithScopeRules(adapter, scopeRule) {
+  const { filters, defaults } = scopeRule;
+  return {
+    ...adapter,
+    create: (params) => adapter.create({
+      ...params,
+      data: { ...params.data, ...defaults }
+    }),
+    findOne: (params) => adapter.findOne({
+      ...params,
+      where: [...params.where, ...filters]
+    }),
+    findMany: (params) => adapter.findMany({
+      ...params,
+      where: [...params.where ?? [], ...filters]
+    }),
+    update: (params) => Promise.resolve().then(() => {
+      for (const key of Object.keys(defaults)) {
+        if (Object.hasOwn(params.data, key))
+          throw Errors.forbidden(`Cannot update scoped field '${key}'`);
+      }
+      return adapter.update({
+        ...params,
+        where: [...params.where, ...filters]
+      });
+    }),
+    delete: (params) => adapter.delete({
+      ...params,
+      where: [...params.where, ...filters]
+    }),
+    count: (params) => adapter.count({
+      ...params,
+      where: [...params.where ?? [], ...filters]
+    }),
+    transaction: (fn) => adapter.transaction((tx) => fn(wrapAdapterWithScopeRules(tx, scopeRule)))
+  };
+}
+function middlewarePathToRegex(pattern) {
+  const regexStr = canonicalizePath(pattern).replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/:[^/]+/g, "[^/]+").replace(/\\\*/g, ".*").replace(/\//g, "\\/");
+  return new RegExp(`^${regexStr}$`);
+}
+function collectPluginMiddleware(plugins, position) {
+  const result = [];
+  for (const plugin of plugins) {
+    if (!plugin.middleware)
+      continue;
+    for (const mw of plugin.middleware) {
+      if (mw.position === position) {
+        result.push({ plugin, middleware: mw });
+      }
+    }
+  }
+  return result;
+}
+async function executePluginMiddleware(plugins, position, requestPath, ctx, request) {
+  const canonicalRequestPath = canonicalizePath(requestPath);
+  const matching = collectPluginMiddleware(plugins, position).filter(({ middleware: mw }) => middlewarePathToRegex(mw.path).test(canonicalRequestPath));
+  if (matching.length === 0)
+    return;
+  let index = 0;
+  async function runNext() {
+    if (index >= matching.length)
+      return;
+    const current = matching[index++];
+    await current.middleware.handler(ctx, request, runNext);
+  }
+  await runNext();
+}
+
+// src/express/middleware.ts
+function createAuthMiddleware(fortress) {
+  return async (req, _res, next) => {
+    try {
+      const headerJar = new Headers();
+      for (const [k, v] of Object.entries(req.headers)) {
+        if (Array.isArray(v)) {
+          for (const item of v) headerJar.append(k, item);
+        } else if (typeof v === "string") {
+          headerJar.set(k, v);
+        }
+      }
+      const requestPath = expressRequestPath(req);
+      const host = expressHeader(req, "host") ?? "localhost";
+      const protocol = req.protocol ?? expressHeader(req, "x-forwarded-proto") ?? "http";
+      const probe = new Request(`${protocol}://${host}${requestPath}`, {
+        method: req.method,
+        headers: headerJar
+      });
+      const resolved = await fortress.resolvePrincipal(probe);
+      if (!resolved) {
+        throw new FortressError("UNAUTHORIZED", "Missing or invalid credentials", 401);
+      }
+      const { subject, claims, scopes } = resolved;
+      req.fortressSubject = subject;
+      if (subject.type === "USER")
+        req.fortressUserId = subject.id;
+      if (claims)
+        req.fortressClaims = claims;
+      if (scopes !== void 0)
+        req.fortressScopes = scopes;
+      const plugins = fortress.config.plugins ?? [];
+      const requestContext = {
+        tenantId: claims?.customClaims?.tenantId,
+        ipAddress: req.headers["x-forwarded-for"] ?? req.headers["x-real-ip"],
+        userAgent: req.headers["user-agent"]
+      };
+      const wrappedAdapter = chainAdapterWrappers(plugins, fortress.config.database, requestContext);
+      req.fortressDb = wrappedAdapter;
+      const pluginCtx = { db: wrappedAdapter, config: fortress.config };
+      req.fortressGetScopedDb = async (model) => {
+        const scopeRule = await collectScopeRules(plugins, subject.id, model, pluginCtx);
+        if (!scopeRule)
+          return wrappedAdapter;
+        return wrapAdapterWithScopeRules(wrappedAdapter, scopeRule);
+      };
+      next();
+    } catch (err) {
+      next(err);
+    }
+  };
+}
+function createCsrfMiddleware(config) {
+  const headerName = (config?.headerName ?? "X-Fortress-CSRF").toLowerCase();
+  const skipPaths = config?.skipPaths ?? [];
+  const safeMethods = new Set((config?.safeMethods ?? ["GET", "HEAD", "OPTIONS"]).map((method) => method.toUpperCase()));
+  return (req, _res, next) => {
+    try {
+      if (safeMethods.has(req.method.toUpperCase()) || matchesCsrfSkipPath(req.path, skipPaths)) {
+        next();
+        return;
+      }
+      const fetchSite = expressHeader(req, "sec-fetch-site");
+      if (fetchSite === "cross-site")
+        throw new FortressError("FORBIDDEN", "CSRF: cross-site request rejected", 403);
+      if (!expressHeader(req, headerName))
+        throw new FortressError("FORBIDDEN", `CSRF: missing ${config?.headerName ?? "X-Fortress-CSRF"} header`, 403);
+      next();
+    } catch (error) {
+      next(error);
+    }
+  };
+}
+function createRbacMiddleware(fortress, options) {
+  const routeMap = normalizeRouteMap(options?.routeMap ?? {});
+  const skipPaths = options?.skipPaths ?? [];
+  const skipPatterns = skipPaths.map((p) => pathToRegex(p));
+  const unmappedRoutes = options?.unmappedRoutes ?? "allow";
+  return async (req, _res, next) => {
+    try {
+      const path = normalizeExpressPath(new URL(expressRequestPath(req), "http://localhost").pathname);
+      const method = req.method;
+      if (skipPatterns.some((pattern) => pattern.test(path))) {
+        next();
+        return;
+      }
+      const key = `${method} ${path}`;
+      let mapping = routeMap[key] ?? null;
+      if (!mapping) {
+        mapping = findRouteMapMatch(method, path, routeMap);
+      }
+      if (!mapping && options?.mapRequest) {
+        mapping = options.mapRequest(method, path);
+      }
+      if (!mapping) {
+        if (unmappedRoutes === "deny") {
+          throw new FortressError("FORBIDDEN", "No permission mapping for this route", 403);
+        }
+        next();
+        return;
+      }
+      if (!req.fortressSubject) {
+        throw new FortressError("UNAUTHORIZED", "Not authenticated", 401);
+      }
+      const allowed = await fortress.iam.checkPermission(req.fortressSubject, mapping.resource, mapping.action, {
+        credentialScopes: req.fortressScopes
+      });
+      if (!allowed) {
+        throw new FortressError("FORBIDDEN", "Insufficient permissions", 403);
+      }
+      next();
+    } catch (err) {
+      next(err);
+    }
+  };
+}
+function createErrorHandler(fortress) {
+  return (err, _req, res, _next) => {
+    if (err instanceof FortressError) {
+      if (err.code === "RATE_LIMITED" && err.retryAfter) {
+        res.setHeader("Retry-After", String(err.retryAfter));
+      }
+      res.status(err.statusCode).json(err.toJSON());
+      return;
+    }
+    fortress?.logger.error(
+      { err, message: err instanceof Error ? err.message : "Unknown error" },
+      "unhandled error in express middleware"
+    );
+    res.status(500).json({ code: "INTERNAL_ERROR", message: "Internal server error", statusCode: 500 });
+  };
+}
+function createExpressPluginMiddleware(fortress, position) {
+  const plugins = fortress.config.plugins ?? [];
+  return async (req, _res, next) => {
+    try {
+      const ctx = { db: fortress.config.database, config: fortress.config };
+      const headers = new Headers();
+      for (const [name, value] of Object.entries(req.headers)) {
+        if (Array.isArray(value)) {
+          for (const item of value) headers.append(name, item);
+        } else if (typeof value === "string") {
+          headers.set(name, value);
+        }
+      }
+      const requestPath = expressRequestPath(req);
+      const forwardedProtocol = req.headers["x-forwarded-proto"];
+      const protocol = req.protocol ?? (Array.isArray(forwardedProtocol) ? forwardedProtocol[0] : forwardedProtocol) ?? "http";
+      const hostHeader = req.headers.host;
+      const host = (Array.isArray(hostHeader) ? hostHeader[0] : hostHeader) ?? "localhost";
+      const method = req.method.toUpperCase();
+      let body;
+      if (method !== "GET" && method !== "HEAD" && req.body !== void 0) {
+        if (typeof req.body === "string" || req.body instanceof URLSearchParams)
+          body = req.body;
+        else if (req.body instanceof ArrayBuffer || ArrayBuffer.isView(req.body))
+          body = req.body;
+        else if (headers.get("content-type")?.toLowerCase().startsWith("application/x-www-form-urlencoded"))
+          body = new URLSearchParams(Object.entries(req.body).map(([key, value]) => [key, String(value)]));
+        else
+          body = JSON.stringify(req.body);
+      }
+      const requestContext = {
+        request: new Request(`${protocol}://${host}${requestPath}`, {
+          method,
+          headers,
+          body
+        }),
+        fortressSubject: req.fortressSubject,
+        fortressUserId: req.fortressUserId,
+        fortressClaims: req.fortressClaims,
+        fortressScopes: req.fortressScopes
+      };
+      await executePluginMiddleware(
+        plugins,
+        position,
+        new URL(requestPath, "http://localhost").pathname,
+        ctx,
+        requestContext
+      );
+      next();
+    } catch (err) {
+      next(err);
+    }
+  };
+}
+function createExpressMiddleware(fortress, options) {
+  return {
+    authMiddleware: createAuthMiddleware(fortress),
+    csrfMiddleware: createCsrfMiddleware(options?.csrf),
+    rbacMiddleware: createRbacMiddleware(fortress, options),
+    errorHandler: createErrorHandler(fortress),
+    pluginMiddleware: {
+      beforeAuth: createExpressPluginMiddleware(fortress, "before-auth"),
+      afterAuth: createExpressPluginMiddleware(fortress, "after-auth"),
+      afterRbac: createExpressPluginMiddleware(fortress, "after-rbac")
+    }
+  };
+}
+function getSubject(req) {
+  if (!req.fortressSubject) {
+    throw new FortressError("UNAUTHORIZED", "Not authenticated", 401);
+  }
+  return req.fortressSubject;
+}
+function getUserId(req) {
+  if (!req.fortressSubject || req.fortressSubject.type !== "USER") {
+    throw new FortressError("UNAUTHORIZED", "User not authenticated", 401);
+  }
+  return req.fortressSubject.id;
+}
+function getClaims(req) {
+  if (!req.fortressClaims) {
+    throw new FortressError("UNAUTHORIZED", "No JWT claims on this request", 401);
+  }
+  return req.fortressClaims;
+}
+function getDb(req) {
+  if (!req.fortressDb) {
+    throw new FortressError("UNAUTHORIZED", "User not authenticated", 401);
+  }
+  return req.fortressDb;
+}
+function getScopedDb(req, model) {
+  if (!req.fortressGetScopedDb) {
+    throw new FortressError("UNAUTHORIZED", "User not authenticated", 401);
+  }
+  return req.fortressGetScopedDb(model);
+}
+function findRouteMapMatch(method, path, routeMap) {
+  for (const [pattern, mapping] of Object.entries(routeMap)) {
+    const [patternMethod, patternPath] = pattern.split(" ", 2);
+    if (patternMethod !== method)
+      continue;
+    if (pathToRegex(patternPath).test(path))
+      return mapping;
+  }
+  return null;
+}
+function expressRequestPath(req) {
+  const path = req.originalUrl ?? req.url ?? req.path;
+  return path.startsWith("/") ? path : `/${path}`;
+}
+function expressHeader(req, name) {
+  const target = name.toLowerCase();
+  for (const [headerName, value] of Object.entries(req.headers)) {
+    if (headerName.toLowerCase() !== target)
+      continue;
+    return Array.isArray(value) ? value[0] : value;
+  }
+  return void 0;
+}
+function matchesCsrfSkipPath(path, skipPaths) {
+  return skipPaths.some((configured) => {
+    const withoutWildcard = configured.endsWith("/*") ? configured.slice(0, -2) : configured;
+    const base = withoutWildcard.length > 1 && withoutWildcard.endsWith("/") ? withoutWildcard.slice(0, -1) : withoutWildcard;
+    return path === base || path.startsWith(`${base}/`);
+  });
+}
+function normalizeRouteMap(routeMap) {
+  return Object.fromEntries(Object.entries(routeMap).map(([pattern, mapping]) => {
+    const separator = pattern.indexOf(" ");
+    if (separator < 0)
+      return [pattern, mapping];
+    const method = pattern.slice(0, separator);
+    const path = normalizeExpressPath(pattern.slice(separator + 1));
+    return [`${method} ${path}`, mapping];
+  }));
+}
+function normalizeExpressPath(path) {
+  const lowerCased = path.toLowerCase();
+  return lowerCased.length > 1 && lowerCased.endsWith("/") ? lowerCased.slice(0, -1) : lowerCased;
+}
+function pathToRegex(pattern) {
+  const regexStr = normalizeExpressPath(pattern).replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/:[^/]+/g, "[^/]+").replace(/\\\*/g, ".*").replace(/\//g, "\\/");
+  return new RegExp(`^${regexStr}$`, "i");
+}
+
+// src/core/validation.ts
+import { fromJSONSchema } from "@bajustone/fetcher/openapi";
+var DECIMAL_INTEGER_RE = /^-?\d+$/;
+var DECIMAL_NUMBER_RE = /^-?\d+(?:\.\d+)?$/;
+var rawSchemaValidators = /* @__PURE__ */ new WeakMap();
+function standardSchemaFor(schema) {
+  if ("~standard" in schema)
+    return schema;
+  let compiled = rawSchemaValidators.get(schema);
+  if (!compiled) {
+    compiled = fromJSONSchema(schema);
+    rawSchemaValidators.set(schema, compiled);
+  }
+  return compiled;
+}
+function coerceBySchema(schema, data) {
+  if (!schema || !data || schema.type !== "object" || !schema.properties)
+    return data;
+  const out = { ...data };
+  for (const [key, propSchema] of Object.entries(schema.properties)) {
+    const value = out[key];
+    if (typeof value !== "string")
+      continue;
+    const coerced = coerceScalar(propSchema, value);
+    if (coerced !== void 0)
+      out[key] = coerced;
+  }
+  return out;
+}
+function coerceScalar(schema, value) {
+  const type = schema.type ?? numericConstraintType(schema);
+  switch (type) {
+    case "integer": {
+      if (!DECIMAL_INTEGER_RE.test(value))
+        return void 0;
+      const n = Number(value);
+      if (Number.isFinite(n) && Number.isSafeInteger(n) && String(n) === value)
+        return n;
+      return void 0;
+    }
+    case "number": {
+      if (!DECIMAL_NUMBER_RE.test(value))
+        return void 0;
+      const n = Number(value);
+      if (Number.isFinite(n) && (!Number.isInteger(n) || Number.isSafeInteger(n)) && String(n) === value)
+        return n;
+      return void 0;
+    }
+    case "boolean": {
+      if (value === "true")
+        return true;
+      if (value === "false")
+        return false;
+      return void 0;
+    }
+    default:
+      return void 0;
+  }
+}
+function numericConstraintType(schema) {
+  if (typeof schema.const === "number")
+    return Number.isInteger(schema.const) ? "integer" : "number";
+  if (schema.enum && schema.enum.length > 0 && schema.enum.every((value) => typeof value === "number"))
+    return schema.enum.every((value) => Number.isInteger(value)) ? "integer" : "number";
+  return void 0;
+}
+async function validateRequest(input, data) {
+  if (!input)
+    return;
+  const allIssues = [];
+  if (input.bodySchema || input.body) {
+    const issues = await validateSchema(input.bodySchema ?? input.body, data.body, "body");
+    allIssues.push(...issues);
+  }
+  if (input.querySchema || input.query) {
+    const issues = await validateSchema(input.querySchema ?? input.query, data.query, "query");
+    allIssues.push(...issues);
+  }
+  if (input.paramsSchema || input.params) {
+    const issues = await validateSchema(input.paramsSchema ?? input.params, data.params, "params");
+    allIssues.push(...issues);
+  }
+  if (allIssues.length > 0) {
+    throw Errors.validationError(allIssues);
+  }
+}
+async function validateSchema(schema, data, location) {
+  const result = await standardSchemaFor(schema)["~standard"].validate(data);
+  if (result.issues) {
+    return result.issues.map((issue) => ({
+      path: issue.path,
+      message: issue.message,
+      location
+    }));
+  }
+  return [];
+}
+async function validateValue(schema, data, location) {
+  const result = await schema["~standard"].validate(data);
+  if (result.issues) {
+    throw Errors.validationError(
+      result.issues.map((issue) => ({
+        path: issue.path,
+        message: issue.message,
+        location
+      }))
+    );
+  }
+  return result.value;
+}
+
+// src/core/http/cookie-serialize.ts
+function parseCookieHeader(header) {
+  if (!header)
+    return {};
+  const out = {};
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1)
+      continue;
+    const name = part.slice(0, eq).trim();
+    if (!name)
+      continue;
+    const raw = part.slice(eq + 1).trim();
+    try {
+      out[name] = decodeURIComponent(raw);
+    } catch {
+      out[name] = raw;
+    }
+  }
+  return out;
+}
+
+// src/core/http/csrf.ts
+function resolveCsrfConfig(config) {
+  return {
+    enabled: config?.enabled ?? true,
+    headerName: config?.headerName ?? "X-Fortress-CSRF",
+    skipPaths: config?.skipPaths ?? [],
+    rejectSameSite: config?.rejectSameSite ?? false
+  };
+}
+var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function matchesSkipPath(path, skipPaths) {
+  for (const skip of skipPaths) {
+    if (path === skip)
+      return true;
+    if (path.startsWith(`${skip}/`))
+      return true;
+  }
+  return false;
+}
+function isCookieAuthenticated(request, cookies) {
+  const jar = parseCookieHeader(request.headers.get("cookie"));
+  const hasCookie = (name) => typeof jar[name] === "string" && jar[name].length > 0;
+  return hasCookie(cookies.accessName) || hasCookie(cookies.refreshName);
+}
+function enforceCsrf(request, pathname, csrf, cookies) {
+  if (!csrf.enabled)
+    return;
+  if (SAFE_METHODS.has(request.method.toUpperCase()))
+    return;
+  if (matchesSkipPath(pathname, csrf.skipPaths))
+    return;
+  const fetchSite = request.headers.get("sec-fetch-site");
+  const cookieAuthenticated = isCookieAuthenticated(request, cookies);
+  if (!cookieAuthenticated) {
+    if (request.headers.has("authorization") || request.headers.has("x-api-key"))
+      return;
+    if (fetchSite === "cross-site")
+      throw Errors.forbidden("CSRF: cross-site request rejected");
+    const origin = request.headers.get("origin");
+    if (origin) {
+      try {
+        if (new URL(origin).origin !== new URL(request.url).origin)
+          throw Errors.forbidden("CSRF: cross-origin request rejected");
+      } catch (error) {
+        if (error instanceof Error && "code" in error)
+          throw error;
+        throw Errors.forbidden("CSRF: invalid Origin header");
+      }
+    }
+    return;
+  }
+  if (fetchSite === "cross-site")
+    throw Errors.forbidden("CSRF: cross-site request rejected");
+  if (csrf.rejectSameSite && fetchSite === "same-site")
+    throw Errors.forbidden("CSRF: same-site request rejected");
+  const tokenHeader = request.headers.get(csrf.headerName);
+  if (!tokenHeader)
+    throw Errors.forbidden(`CSRF: missing ${csrf.headerName} header`);
+}
+
+// src/core/http/error-response.ts
+function errorToResponse(err, logger) {
+  if (err instanceof FortressError) {
+    const headers = { "Content-Type": "application/json" };
+    if (err.code === "RATE_LIMITED" && err.retryAfter !== void 0) {
+      headers["Retry-After"] = String(err.retryAfter);
+    }
+    if (err.oauthError) {
+      const body2 = { error: err.oauthError };
+      if (err.oauthDescription)
+        body2.error_description = err.oauthDescription;
+      if (err.oauthErrorUri)
+        body2.error_uri = err.oauthErrorUri;
+      return new Response(JSON.stringify(body2), {
+        status: err.statusCode,
+        headers
+      });
+    }
+    return new Response(JSON.stringify(err.toJSON()), {
+      status: err.statusCode,
+      headers
+    });
+  }
+  logger?.error(
+    { err, message: err instanceof Error ? err.message : "Unknown error" },
+    "unhandled error in fortress.handleRequest"
+  );
+  const body = {
+    code: "INTERNAL_ERROR",
+    message: "Internal server error",
+    statusCode: 500
+  };
+  return new Response(JSON.stringify(body), {
+    status: 500,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function withCookies(response, setCookies) {
+  if (setCookies.length === 0)
+    return response;
+  const headers = new Headers(response.headers);
+  for (const cookie of setCookies) {
+    headers.append("set-cookie", cookie);
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// src/core/http/fortress-rbac.ts
+async function enforceFortressPermission(endpoint, subject, enforcement, scopes) {
+  const security = endpoint.meta?.security;
+  if (endpoint.meta?.permission) {
+    if (!subject)
+      throw Errors.unauthorized("Not authenticated");
+    const allowed = await enforcement.checkPermission(
+      subject,
+      endpoint.meta.permission.resource,
+      endpoint.meta.permission.action,
+      scopes
+    );
+    if (!allowed)
+      throw Errors.forbidden("Insufficient permissions");
+    return;
+  }
+  if (security?.includes("none") || security?.includes("basic"))
+    return;
+  if (security?.includes("bearer")) {
+    if (!subject)
+      throw Errors.unauthorized("Not authenticated");
+    return;
+  }
+  throw Errors.forbidden("No permission mapping for this route");
+}
+
+// src/core/http/plugin-middleware.ts
+async function runPluginMiddleware(plugins, config, phase, ctx) {
+  if (plugins.length === 0)
+    return;
+  const pluginCtx = { db: config.database, config };
+  const path = new URL(ctx.request.url).pathname;
+  await executePluginMiddleware(plugins, phase, path, pluginCtx, ctx);
+}
+
+// src/core/http/principal.ts
+async function tryPluginPrincipal(fortress, request) {
+  const plugins = fortress.config.plugins ?? [];
+  for (const plugin of plugins) {
+    if (!plugin.resolvePrincipal)
+      continue;
+    const resolved = await plugin.resolvePrincipal(request, {
+      db: fortress.config.database,
+      config: fortress.config,
+      auth: fortress.auth,
+      iam: fortress.iam
+    });
+    if (resolved)
+      return { subject: resolved.subject, claims: resolved.claims, scopes: resolved.scopes };
+  }
+  return null;
+}
+
+// src/core/http/protect.ts
+function routeKey(route) {
+  return `${route.method.toUpperCase()} ${route.path}`;
+}
+function findEndpoint(fortress, target, method) {
+  if (typeof target !== "string") {
+    return target;
+  }
+  const matches = fortress.endpoints.filter((endpoint) => endpoint.handler === target);
+  if (matches.length === 0)
+    throw Errors.notFound(`No endpoint found for handler '${target}'`);
+  if (method) {
+    const byMethod = matches.find((endpoint) => endpoint.method.toUpperCase() === method.toUpperCase());
+    if (byMethod)
+      return byMethod;
+  }
+  if (matches.length > 1) {
+    throw Errors.badRequest(
+      `Handler '${target}' maps to multiple endpoints; pass the EndpointDefinition or ProtectOptions.method.`
+    );
+  }
+  return matches[0];
+}
+function findManifestEntry(fortress, endpoint) {
+  const key = routeKey(endpoint);
+  const entry = fortress.manifest.find((route) => `${route.method.toUpperCase()} ${route.path}` === key);
+  if (!entry)
+    throw Errors.notFound(`No route manifest entry found for ${key}`);
+  return entry;
+}
+function rewriteRequestPath(request, pathname) {
+  const current = new URL(request.url);
+  if (current.pathname === pathname)
+    return request;
+  const rewritten = new URL(request.url);
+  rewritten.pathname = pathname;
+  return new Request(rewritten, request);
+}
+async function parseJsonBody(request) {
+  if (request.method === "GET" || request.method === "HEAD")
+    return void 0;
+  if (!(request.headers.get("content-type") ?? "").includes("json"))
+    return void 0;
+  return request.clone().json().catch(() => void 0);
+}
+function objectOrEmpty(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
+}
+function successStatus(endpoint) {
+  const status = Object.keys(endpoint.responses ?? {}).map(Number).find((code) => code >= 200 && code < 300);
+  return status ?? 200;
+}
+function jsonResponse(body, status) {
+  return new Response(JSON.stringify(body ?? { ok: true }), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function maybeAttachAuthCookies(fortress, result, response) {
+  if (result instanceof Response)
+    return response;
+  const obj = result;
+  if (typeof obj?.accessToken !== "string")
+    return response;
+  return withCookies(response, fortress.serializeAuthCookies({
+    accessToken: obj.accessToken,
+    refreshToken: typeof obj.refreshToken === "string" ? obj.refreshToken : null
+  }));
+}
+function protect(fortress, target, handler, options = {}) {
+  const endpoint = findEndpoint(fortress, target, options.method);
+  const manifest = findManifestEntry(fortress, endpoint);
+  const endpointRouteTable = buildRouteTable([endpoint]);
+  const csrfConfig = resolveCsrfConfig(fortress.config.csrf);
+  const plugins = fortress.config.plugins ?? [];
+  return async function protectedRequestHandler(request) {
+    let response;
+    try {
+      const url = new URL(request.url);
+      const pipelinePath = options.path ?? url.pathname;
+      const pipelineRequest = rewriteRequestPath(request, pipelinePath);
+      await runPluginMiddleware(plugins, fortress.config, "before-auth", { request: pipelineRequest });
+      enforceCsrf(pipelineRequest, pipelinePath, csrfConfig, fortress.cookies);
+      let subject;
+      let userId;
+      let claims;
+      let scopes;
+      const selfManagedBearer = endpoint.meta?.bearerKind === "oauth";
+      if (!selfManagedBearer) {
+        const pluginResolved = await tryPluginPrincipal(fortress, pipelineRequest);
+        if (pluginResolved) {
+          subject = pluginResolved.subject;
+          claims = pluginResolved.claims;
+          scopes = pluginResolved.scopes;
+        }
+      }
+      const requiresBearer = !selfManagedBearer && ((endpoint.meta?.security?.includes("bearer") ?? false) || !!endpoint.meta?.permission);
+      if (!subject && requiresBearer) {
+        const token = fortress.extractAccessToken(pipelineRequest);
+        if (!token)
+          throw Errors.unauthorized("Missing access token");
+        try {
+          claims = await fortress.auth.verifyToken(token);
+          subject = { type: claims.subjectType, id: claims.sub };
+        } catch (err) {
+          if (err instanceof FortressError)
+            throw err;
+          throw Errors.unauthorized("Invalid access token");
+        }
+      }
+      if (subject?.type === "USER")
+        userId = subject.id;
+      await runPluginMiddleware(plugins, fortress.config, "after-auth", {
+        request: pipelineRequest,
+        fortressSubject: subject,
+        fortressUserId: userId,
+        fortressClaims: claims,
+        fortressScopes: scopes
+      });
+      if (!selfManagedBearer) {
+        await enforceFortressPermission(endpoint, subject, {
+          checkPermission: (subj, resource, action, credentialScopes) => fortress.iam.checkPermission(subj, resource, action, { credentialScopes })
+        }, scopes);
+      }
+      await runPluginMiddleware(plugins, fortress.config, "after-rbac", {
+        request: pipelineRequest,
+        fortressSubject: subject,
+        fortressUserId: userId,
+        fortressClaims: claims,
+        fortressScopes: scopes
+      });
+      const body = await parseJsonBody(request);
+      const rawQuery = Object.fromEntries(url.searchParams);
+      const match = matchRoute(endpointRouteTable, endpoint.method, options.path ?? url.pathname);
+      const rawParams = options.params ?? match?.params ?? {};
+      const query = coerceBySchema(endpoint.input?.query, rawQuery) ?? rawQuery;
+      const params = coerceBySchema(endpoint.input?.params, rawParams) ?? rawParams;
+      await validateRequest(endpoint.input, { body, query, params });
+      const input = { ...objectOrEmpty(body), ...query, ...params };
+      const result = await handler({
+        request,
+        endpoint,
+        manifest,
+        subject,
+        userId,
+        claims,
+        scopes,
+        params,
+        query,
+        body,
+        input,
+        respond: (status, responseBody) => jsonResponse(responseBody, status)
+        // Cast: the runtime values are untyped records; the generic context
+        // type narrows them for the caller, but the impl signature uses the
+        // loose `ProtectedRouteContext<EndpointDefinition>`.
+      });
+      response = result instanceof Response ? result : jsonResponse(result, successStatus(endpoint));
+      if (options.attachAuthCookies ?? true)
+        response = maybeAttachAuthCookies(fortress, result, response);
+      return response;
+    } catch (err) {
+      response = errorToResponse(err, fortress.logger);
+      return response;
+    }
+  };
+}
+
+// src/express/protect.ts
+function protectedRoute(fortress, target, handler, options = {}) {
+  return async (req, res, next) => {
+    try {
+      const request = expressToWebRequest2(req);
+      const protectedHandler = protect(
+        fortress,
+        target,
+        (ctx) => handler(req, res, ctx),
+        { ...options, method: options.method ?? req.method }
+      );
+      const response = await protectedHandler(request);
+      await sendWebResponseToExpress2(response, res);
+    } catch (err) {
+      next(err);
+    }
+  };
+}
+function expressToWebRequest2(req) {
+  const host = req.headers.host ?? "localhost";
+  const protocol = req.protocol ?? "http";
+  const originalUrl = req.originalUrl ?? req.path;
+  const search = originalUrl.includes("?") ? `?${originalUrl.split("?")[1]}` : "";
+  const url = `${protocol}://${host}${req.path}${search}`;
+  const headers = new Headers();
+  for (const [k, v] of Object.entries(req.headers)) {
+    if (Array.isArray(v)) {
+      for (const item of v) headers.append(k, item);
+    } else if (typeof v === "string") {
+      headers.set(k, v);
+    }
+  }
+  const init = { method: req.method, headers };
+  if (req.method !== "GET" && req.method !== "HEAD") {
+    const body = req.body;
+    if (body !== void 0 && body !== null) {
+      if (typeof body === "string") {
+        init.body = body;
+      } else if (body instanceof Uint8Array) {
+        init.body = body;
+      } else {
+        init.body = JSON.stringify(body);
+        if (!headers.has("content-type"))
+          headers.set("content-type", "application/json");
+      }
+    }
+  }
+  return new Request(url, init);
+}
+async function sendWebResponseToExpress2(response, res) {
+  res.status(response.status);
+  for (const [k, v] of response.headers) {
+    if (k.toLowerCase() !== "set-cookie")
+      res.setHeader(k, v);
+  }
+  const setCookies = response.headers.getSetCookie();
+  if (setCookies.length > 0) {
+    res.setHeader("set-cookie", setCookies);
+  }
+  const text = await response.text();
+  const isJson = (response.headers.get("content-type") ?? "").includes("json");
+  if (isJson) {
+    try {
+      res.json(JSON.parse(text));
+    } catch {
+      res.json({ raw: text });
+    }
+  } else {
+    const resWithSend = res;
+    if (resWithSend.send)
+      resWithSend.send(text);
+    else
+      res.json(text);
+  }
+}
+
+// src/express/validated.ts
+async function vBody(req, schema) {
+  return validateValue(schema, req.body, "body");
+}
+async function vParam(req, schema) {
+  return validateValue(schema, req.params, "params");
+}
+async function vQuery(req, schema) {
+  return validateValue(schema, req.query, "query");
+}
+export {
+  convertRoutes,
+  createAuthMiddleware,
+  createCsrfMiddleware,
+  createErrorHandler,
+  createExpressMiddleware,
+  createExpressPluginMiddleware,
+  createRbacMiddleware,
+  getClaims,
+  getDb,
+  getScopedDb,
+  getSubject,
+  getUserId,
+  mountFortress,
+  protectedRoute,
+  vBody,
+  vParam,
+  vQuery
+};