@bajustone/fortress 1.0.0-rc.1

package/src/sveltekit/actions.ts

@@ -0,0 +1,233 @@
+/**
+ * SvelteKit form-action helpers for the common auth flows.
+ *
+ * Use these in `+page.server.ts` to wire `<form method="POST">` to
+ * fortress's auth methods. They handle:
+ *
+ * - parsing form data
+ * - calling `fortress.auth.*`
+ * - setting cookies via `event.cookies.set` (so SvelteKit's `Set-Cookie`
+ *   handling sees them, not just the browser)
+ * - returning `fail(...)` on `FortressError`
+ * - throwing a `redirect(...)` on success when `redirectTo` is supplied
+ *
+ * Redirects and failures use SvelteKit's real `redirect()` / `fail()`
+ * primitives, so the action runtime recognizes them without casts or
+ * raw-Response 500s.
+ *
+ * @example
+ * ```ts
+ * // src/routes/login/+page.server.ts
+ * import { fortressActions } from '@bajustone/fortress/sveltekit';
+ * import { fortress } from '$lib/server/fortress';
+ *
+ * export const actions = {
+ *   default: fortressActions.login(fortress, { redirectTo: '/dashboard' }),
+ * };
+ * ```
+ */
+
+import type { ActionFailure } from '@sveltejs/kit';
+import type { Fortress } from '../core/fortress';
+import type { AuthChallenge, CreateUserInput, LoginIdentifierType } from '../core/types';
+import type { SvelteKitAction, SvelteKitRequestEvent } from './types';
+import { FortressError } from '../core/errors';
+import { clearAuthCookies, setAuthCookies } from './cookies';
+
+/** Shape returned by form-action helpers when something goes wrong. */
+export type FortressActionFailure = ActionFailure<{ error: string; code?: string }>;
+
+/** Discriminated result returned when no `redirectTo` is configured. */
+export type FortressActionSuccess
+  = | { success: true; pending: false }
+    | { success: true; pending: true; challenge: AuthChallenge };
+
+/** Common options for the auth-issuing helpers. */
+export interface FortressActionOptions {
+  /**
+   * On success, throw a redirect to this path. SvelteKit's action runtime
+   * picks up the thrown 3xx and emits a normal HTTP redirect.
+   */
+  redirectTo?: string;
+}
+
+async function actionFailure(
+  status: number,
+  data: { error: string; code?: string },
+): Promise<FortressActionFailure> {
+  const { fail } = await import('@sveltejs/kit');
+  return fail(status, data);
+}
+
+async function actionRedirect(location: string): Promise<never> {
+  const { redirect } = await import('@sveltejs/kit');
+  return redirect(303, location);
+}
+
+/** Read a single string field from a form, defaulting to '' if missing. */
+function field(form: FormData, name: string): string {
+  const v = form.get(name);
+  return typeof v === 'string' ? v : '';
+}
+
+function buildMeta(event: SvelteKitRequestEvent): { ipAddress?: string; userAgent?: string } {
+  return {
+    ipAddress:
+      event.request.headers.get('x-forwarded-for')
+      ?? event.request.headers.get('x-real-ip')
+      ?? undefined,
+    userAgent: event.request.headers.get('user-agent') ?? undefined,
+  };
+}
+
+/** Type of the {@link fortressActions} namespace — explicit so JSR's slow-type check is happy. */
+export interface FortressActions {
+  login: (
+    fortress: Fortress<any, any>,
+    opts?: FortressActionOptions,
+  ) => SvelteKitAction<FortressActionFailure | FortressActionSuccess>;
+  register: (
+    fortress: Fortress<any, any>,
+    opts?: FortressActionOptions,
+  ) => SvelteKitAction<FortressActionFailure | FortressActionSuccess>;
+  logout: (
+    fortress: Fortress<any, any>,
+    opts?: FortressActionOptions,
+  ) => SvelteKitAction<FortressActionSuccess>;
+  refresh: (
+    fortress: Fortress<any, any>,
+  ) => SvelteKitAction<FortressActionFailure | FortressActionSuccess>;
+}
+
+/** Form-action helpers exported as a single namespace. */
+export const fortressActions: FortressActions = {
+  /**
+   * Sign in with `identifier` + `password` form fields. Sets the access +
+   * refresh cookies on success. Optionally redirects.
+   */
+  login(
+    fortress: Fortress<any, any>,
+    opts: FortressActionOptions = {},
+  ): SvelteKitAction<FortressActionFailure | FortressActionSuccess> {
+    return async (event) => {
+      const form = await event.request.formData();
+      const identifier = field(form, 'identifier');
+      const password = field(form, 'password');
+      try {
+        const result = await fortress.auth.login(identifier, password, buildMeta(event));
+        if (result.status === 'pending')
+          return { success: true, pending: true, challenge: result.pending } as const;
+        if (result.status !== 'success')
+          return { success: true, pending: false } as const;
+        setAuthCookies(event, fortress, {
+          accessToken: result.accessToken,
+          refreshToken: result.refreshToken,
+        });
+        if (opts.redirectTo)
+          await actionRedirect(opts.redirectTo);
+        return { success: true, pending: false } as const;
+      }
+      catch (err) {
+        if (err instanceof FortressError) {
+          return actionFailure(err.statusCode, { error: err.message, code: err.code });
+        }
+        throw err;
+      }
+    };
+  },
+
+  /**
+   * Register a new user from `email`, `name`, `password` form fields. On
+   * success, immediately logs them in (sets cookies) and optionally
+   * redirects. Mirrors the typical sign-up UX.
+   */
+  register(
+    fortress: Fortress<any, any>,
+    opts: FortressActionOptions = {},
+  ): SvelteKitAction<FortressActionFailure | FortressActionSuccess> {
+    return async (event) => {
+      const form = await event.request.formData();
+      const data: CreateUserInput = {
+        email: field(form, 'email'),
+        name: field(form, 'name'),
+        password: field(form, 'password'),
+      };
+      try {
+        await fortress.auth.createUser(data);
+        const result = await fortress.auth.login(data.email, data.password ?? '', buildMeta(event));
+        if (result.status === 'pending')
+          return { success: true, pending: true, challenge: result.pending } as const;
+        if (result.status !== 'success')
+          return { success: true, pending: false } as const;
+        setAuthCookies(event, fortress, {
+          accessToken: result.accessToken,
+          refreshToken: result.refreshToken,
+        });
+        if (opts.redirectTo)
+          await actionRedirect(opts.redirectTo);
+        return { success: true, pending: false } as const;
+      }
+      catch (err) {
+        if (err instanceof FortressError) {
+          return actionFailure(err.statusCode, { error: err.message, code: err.code });
+        }
+        throw err;
+      }
+    };
+  },
+
+  /**
+   * Revoke the current refresh token (if present) and clear both auth
+   * cookies. Optionally redirects.
+   */
+  logout(
+    fortress: Fortress<any, any>,
+    opts: FortressActionOptions = {},
+  ): SvelteKitAction<FortressActionSuccess> {
+    return async (event) => {
+      const refreshToken = event.cookies.get(fortress.cookies.refreshName);
+      if (refreshToken) {
+        try {
+          await fortress.auth.logout(refreshToken);
+        }
+        catch {
+          // Ignore — clearing cookies is the important part.
+        }
+      }
+      clearAuthCookies(event, fortress);
+      if (opts.redirectTo)
+        await actionRedirect(opts.redirectTo);
+      return { success: true, pending: false } as const;
+    };
+  },
+
+  /**
+   * Manually rotate the access + refresh tokens using the cookie. Useful
+   * if you want a `?/refresh` form action for SPAs that need to extend a
+   * session without a full reload.
+   */
+  refresh(
+    fortress: Fortress<any, any>,
+  ): SvelteKitAction<FortressActionFailure | FortressActionSuccess> {
+    return async (event) => {
+      const refreshToken = event.cookies.get(fortress.cookies.refreshName);
+      if (!refreshToken) {
+        return actionFailure(401, { error: 'No refresh token', code: 'UNAUTHORIZED' });
+      }
+      try {
+        const result = await fortress.auth.refresh(refreshToken, buildMeta(event));
+        setAuthCookies(event, fortress, result);
+        return { success: true, pending: false } as const;
+      }
+      catch (err) {
+        if (err instanceof FortressError) {
+          return actionFailure(err.statusCode, { error: err.message, code: err.code });
+        }
+        throw err;
+      }
+    };
+  },
+} as const;
+
+// Re-export so consumers can pattern-match against the field type.
+export type { LoginIdentifierType };

package/src/sveltekit/catch-all.ts

@@ -0,0 +1,43 @@
+/**
+ * Optional catch-all `+server.ts` escape hatch.
+ *
+ * Lets users colocate Fortress routes inside their normal `src/routes/`
+ * tree instead of (or in addition to) the handle-hook approach.
+ *
+ * @example
+ * ```ts
+ * // src/routes/api/fortress/[...path]/+server.ts
+ * import { toSvelteKitHandler } from '@bajustone/fortress/sveltekit';
+ * import { fortress } from '$lib/server/fortress';
+ *
+ * export const { GET, POST, PUT, DELETE, PATCH } = toSvelteKitHandler(fortress);
+ * ```
+ */
+
+import type { Fortress } from '../core/fortress';
+import type { SvelteKitRequestEvent } from './types';
+
+/** Per-method handler signature compatible with SvelteKit `+server.ts` exports. */
+export type SvelteKitRouteHandler = (event: SvelteKitRequestEvent) => Promise<Response>;
+
+/**
+ * Build a `{ GET, POST, PUT, DELETE, PATCH }` set of handlers that all
+ * delegate to `fortress.handleRequest`. Suitable for `export const { ... } =
+ * toSvelteKitHandler(fortress)` in a catch-all `+server.ts`.
+ */
+export function toSvelteKitHandler(fortress: Fortress<any, any>): {
+  GET: SvelteKitRouteHandler;
+  POST: SvelteKitRouteHandler;
+  PUT: SvelteKitRouteHandler;
+  DELETE: SvelteKitRouteHandler;
+  PATCH: SvelteKitRouteHandler;
+} {
+  const handler: SvelteKitRouteHandler = event => fortress.handleRequest(event.request);
+  return {
+    GET: handler,
+    POST: handler,
+    PUT: handler,
+    DELETE: handler,
+    PATCH: handler,
+  };
+}

package/src/sveltekit/cookies.ts

@@ -0,0 +1,136 @@
+/**
+ * SvelteKit cookie bridging.
+ *
+ * Translates between fortress's auth result objects and SvelteKit's
+ * `event.cookies` API. Cookie attributes (name, secure, sameSite, path,
+ * domain) come from the resolved {@link ResolvedCookieConfig} on the
+ * Fortress instance, so SvelteKit, Hono, and Express all emit cookies with
+ * the same shape.
+ */
+
+import type { ResolvedCookieConfig } from '../core/config';
+import type { Fortress } from '../core/fortress';
+import type { AuthCookiePayload } from '../core/http/cookie-serialize';
+import type { SvelteKitCookieOptions, SvelteKitRequestEvent } from './types';
+import { parseCookieHeader } from '../core/http/cookie-serialize';
+
+/**
+ * Set the access + refresh cookies on a SvelteKit `RequestEvent` from a
+ * fortress auth result. Used by the form-action helpers and the auto-refresh
+ * path inside `createSvelteKitHandle`.
+ */
+export function setAuthCookies(
+  event: SvelteKitRequestEvent,
+  fortress: Fortress<any, any>,
+  payload: AuthCookiePayload,
+): void {
+  const cookies = fortress.cookies;
+  const accessExpiry = fortress.config.jwt.accessTokenExpirySeconds ?? 900;
+  const refreshExpiry = fortress.config.jwt.refreshTokenExpirySeconds ?? 604_800;
+
+  event.cookies.set(cookies.accessName, payload.accessToken, optsFor(cookies, accessExpiry));
+  if (payload.refreshToken) {
+    event.cookies.set(cookies.refreshName, payload.refreshToken, optsFor(cookies, refreshExpiry));
+  }
+}
+
+/** Clear both fortress auth cookies (logout). */
+export function clearAuthCookies(event: SvelteKitRequestEvent, fortress: Fortress<any, any>): void {
+  const cookies = fortress.cookies;
+  event.cookies.delete(cookies.accessName, optsFor(cookies));
+  event.cookies.delete(cookies.refreshName, optsFor(cookies));
+}
+
+/**
+ * Replay any `Set-Cookie` headers from a `Response` (typically returned by
+ * `fortress.handleRequest`) through `event.cookies.set` so they're visible
+ * to subsequent same-request reads. Returns the original response unchanged
+ * — the cookies are already on it; this just mirrors them into SvelteKit's
+ * cookie jar for in-request use.
+ */
+export function replayCookies(response: Response, event: SvelteKitRequestEvent): void {
+  const setCookies = response.headers.getSetCookie();
+  for (const raw of setCookies) {
+    const parsed = parseSetCookie(raw);
+    if (!parsed)
+      continue;
+    event.cookies.set(parsed.name, parsed.value, parsed.opts);
+  }
+}
+
+type RequiredPathCookieOptions = SvelteKitCookieOptions & { path: string };
+
+function optsFor(cookies: ResolvedCookieConfig, maxAgeSeconds?: number): RequiredPathCookieOptions {
+  const opts: RequiredPathCookieOptions = {
+    path: cookies.path,
+    httpOnly: true,
+    secure: cookies.secure,
+    sameSite: cookies.sameSite,
+  };
+  if (cookies.domain)
+    opts.domain = cookies.domain;
+  if (maxAgeSeconds !== undefined)
+    opts.maxAge = maxAgeSeconds;
+  return opts;
+}
+
+interface ParsedSetCookie {
+  name: string;
+  value: string;
+  opts: RequiredPathCookieOptions;
+}
+
+/**
+ * Parse a single `Set-Cookie` header string into name/value/options.
+ *
+ * Handles the attributes fortress emits (Path, Domain, HttpOnly, Secure,
+ * SameSite, Max-Age, Expires). Unknown attributes are ignored.
+ */
+function parseSetCookie(raw: string): ParsedSetCookie | null {
+  const parts = raw.split(';').map(p => p.trim());
+  if (parts.length === 0)
+    return null;
+  const first = parts.shift();
+  if (!first)
+    return null;
+  const eq = first.indexOf('=');
+  if (eq === -1)
+    return null;
+
+  const name = first.slice(0, eq).trim();
+  const rawValue = first.slice(eq + 1).trim();
+  let value: string;
+  try {
+    value = decodeURIComponent(rawValue);
+  }
+  catch {
+    value = rawValue;
+  }
+
+  // Reuse parseCookieHeader by formatting the attribute list as a single
+  // header string would not work — attributes have boolean variants like
+  // `Secure` and `HttpOnly`. Walk parts manually.
+  const opts: RequiredPathCookieOptions = { path: '/' };
+  for (const part of parts) {
+    const [k, v = ''] = part.split('=', 2);
+    const key = k.toLowerCase();
+    if (key === 'path')
+      opts.path = v;
+    else if (key === 'domain')
+      opts.domain = v;
+    else if (key === 'httponly')
+      opts.httpOnly = true;
+    else if (key === 'secure')
+      opts.secure = true;
+    else if (key === 'samesite')
+      opts.sameSite = v.toLowerCase() as 'lax' | 'strict' | 'none';
+    else if (key === 'max-age')
+      opts.maxAge = Number(v);
+    else if (key === 'expires')
+      opts.expires = new Date(v);
+  }
+  return { name, value, opts };
+}
+
+// Re-export so callers can use it from this module too
+export { parseCookieHeader };