@bajustone/fortress 1.0.0-rc.1

package/src/sveltekit/types.ts

@@ -0,0 +1,134 @@
+/**
+ * SvelteKit adapter types. Public handle/action signatures are anchored to
+ * the real optional `@sveltejs/kit` peer so strict-mode consumers can assign
+ * them without casts. Small request/cookie subsets remain for framework-free
+ * helpers and tests; every real RequestEvent structurally satisfies them.
+ */
+
+import type { Handle, RequestEvent } from '@sveltejs/kit';
+import type { DatabaseAdapter } from '../adapters/database';
+import type { Subject, TokenClaims } from '../core/types';
+
+// ── Minimal SvelteKit type subset ───────────────────────────────────
+
+/** Cookie options accepted by SvelteKit's `event.cookies.set` / `delete`. */
+export interface SvelteKitCookieOptions {
+  path?: string;
+  domain?: string;
+  httpOnly?: boolean;
+  secure?: boolean;
+  sameSite?: 'lax' | 'strict' | 'none' | boolean;
+  maxAge?: number;
+  expires?: Date;
+}
+
+/** SvelteKit `Cookies` API surface used by the fortress adapter. */
+export interface SvelteKitCookies {
+  get: (name: string) => string | undefined;
+  set: (name: string, value: string, opts: SvelteKitCookieOptions & { path: string }) => void;
+  delete: (name: string, opts: SvelteKitCookieOptions & { path: string }) => void;
+  getAll?: () => { name: string; value: string }[];
+}
+
+/**
+ * Minimal `RequestEvent` shape consumed by the adapter. Compatible by
+ * structural typing with `@sveltejs/kit`'s real `RequestEvent`. The
+ * `locals.fortress` field comes from the consumer augmenting `App.Locals`
+ * with {@link FortressLocals}.
+ *
+ * `TLocals` is constrained to `object` (not `Record<string, unknown>`) so
+ * the {@link FortressLocals} interface — which only declares the
+ * `fortress` key without an index signature — satisfies it.
+ */
+export interface SvelteKitRequestEvent<TLocals extends object = object> {
+  request: Request;
+  url: URL;
+  cookies: SvelteKitCookies;
+  locals: TLocals;
+  params: Record<string, string>;
+  setHeaders?: (headers: Record<string, string>) => void;
+}
+
+/** Exact SvelteKit `Handle` hook signature, including the resolve options overload. */
+export type SvelteKitHandle = Handle;
+
+/** SvelteKit-compatible form action signature with a narrowed result type. */
+export type SvelteKitAction<TResult = unknown> = (
+  event: RequestEvent,
+) => Promise<TResult> | TResult;
+
+// ── Fortress-specific types ─────────────────────────────────────────
+
+/**
+ * Shape of `event.locals.fortress` after the fortress handle hook runs.
+ *
+ * Consumers augment SvelteKit's `App.Locals` with this interface so server
+ * load functions and `+server.ts` handlers can read the auth context with
+ * full type safety.
+ *
+ * @example
+ * ```ts
+ * // src/app.d.ts
+ * import type { FortressLocals } from '@bajustone/fortress/sveltekit';
+ *
+ * declare global {
+ *   namespace App {
+ *     interface Locals extends FortressLocals {}
+ *   }
+ * }
+ * ```
+ */
+export interface FortressLocals {
+  fortress: {
+    /**
+     * Resolved principal for the current request. Set for every
+     * authenticated request regardless of credential type (JWT, api-key,
+     * future OAuth client_credentials, mTLS). Check `subject.type` to
+     * distinguish `USER` / `SERVICE_ACCOUNT` / `GROUP`.
+     */
+    subject?: Subject;
+    /**
+     * Convenience alias for `subject.id` — set **only** when
+     * `subject.type === 'USER'`. Non-USER principals (e.g. a service
+     * account via api-key) leave this undefined; fall back to `subject`.
+     */
+    userId?: string;
+    /**
+     * Verified JWT claims, if the request was authenticated via a JWT.
+     * Plugin-resolved principals (api-key, etc.) do not populate this.
+     */
+    claims?: TokenClaims;
+    /** Credential-level narrowing scopes (for example API-key scopes). */
+    scopes?: string[] | null;
+    /** Per-request DB adapter with plugin `wrapAdapter` chain applied. */
+    db?: DatabaseAdapter;
+    /** Lazily compute a model-scoped DB adapter (data-isolation aware). */
+    getScopedDb?: (model: string) => Promise<DatabaseAdapter>;
+  };
+}
+
+/** Options accepted by {@link createSvelteKitHandle}. */
+export interface SvelteKitAdapterOptions {
+  /**
+   * Path prefix the fortress routes live under (defaults to `/api`).
+   *
+   * Example: with `basePath: '/api'`, the request `/api/auth/login` is
+   * internally rewritten to `/auth/login` before being passed to
+   * `fortress.handleRequest`. Plugin and IAM routes follow the same prefix.
+   */
+  basePath?: string;
+  /**
+   * Optional declarative route → `(resource, action)` map for user-owned
+   * routes. Used by the user-route RBAC pass to call
+   * `fortress.iam.checkPermission` for non-fortress paths. Format:
+   * `'GET /api/users': { resource: 'user', action: 'list' }`.
+   */
+  routeMap?: Record<string, { resource: string; action: string }>;
+  /** Behavior for user-owned routes absent from routeMap (default: allow). */
+  unmappedRoutes?: 'allow' | 'deny';
+  /**
+   * Paths the user-route RBAC pass should skip entirely (supports `*`).
+   * Example: `['/api/health', '/api/public/*']`.
+   */
+  skipPaths?: string[];
+}

package/src/sveltekit/validated.test.ts

@@ -0,0 +1,117 @@
+import type { SvelteKitRequestEvent } from './types';
+import type { InferOutput } from './validated';
+import { describe, expect, expectTypeOf, it } from 'vitest';
+import { FortressError } from '../core/errors';
+import { obj, str } from '../core/schema-builder';
+import { vBody, vParam, vQuery } from './validated';
+
+const CreateUserBody = obj({ name: str(), email: str() }, 'name', 'email');
+const IdParam = obj({ id: str('User ID') }, 'id');
+const SearchQuery = obj({ q: str('Search query'), page: str() }, 'q');
+
+function fakeEvent(opts: {
+  body?: unknown;
+  params?: Record<string, string>;
+  url?: string;
+}): SvelteKitRequestEvent {
+  const url = new URL(opts.url ?? 'http://localhost/');
+  const request = new Request(url, {
+    method: opts.body !== undefined ? 'POST' : 'GET',
+    headers: opts.body !== undefined ? { 'Content-Type': 'application/json' } : {},
+    body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
+  });
+  return {
+    request,
+    url,
+    cookies: { get: () => undefined, set: () => {}, delete: () => {} },
+    locals: {} as any,
+    params: opts.params ?? {},
+  };
+}
+
+describe('vBody', () => {
+  it('returns parsed JSON body when valid', async () => {
+    const event = fakeEvent({ body: { name: 'Alice', email: 'alice@test.com' } });
+    const data = await vBody(event, CreateUserBody);
+    expect(data).toEqual({ name: 'Alice', email: 'alice@test.com' });
+  });
+
+  it('throws VALIDATION_ERROR when body is missing required fields', async () => {
+    const event = fakeEvent({ body: { name: 'Alice' } });
+    await expect(vBody(event, CreateUserBody)).rejects.toMatchObject({
+      code: 'VALIDATION_ERROR',
+      statusCode: 422,
+    });
+  });
+
+  it('throws VALIDATION_ERROR when body is unparseable', async () => {
+    const url = new URL('http://localhost/');
+    const request = new Request(url, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: 'not json',
+    });
+    const event: SvelteKitRequestEvent = {
+      request,
+      url,
+      cookies: { get: () => undefined, set: () => {}, delete: () => {} },
+      locals: {} as any,
+      params: {},
+    };
+    await expect(vBody(event, CreateUserBody)).rejects.toBeInstanceOf(FortressError);
+  });
+});
+
+describe('vParam', () => {
+  it('returns route params when valid', async () => {
+    const event = fakeEvent({ params: { id: '42' } });
+    const data = await vParam(event, IdParam);
+    expect(data.id).toBe('42');
+  });
+
+  it('throws VALIDATION_ERROR when required param missing', async () => {
+    const event = fakeEvent({ params: {} });
+    await expect(vParam(event, IdParam)).rejects.toMatchObject({
+      code: 'VALIDATION_ERROR',
+      statusCode: 422,
+    });
+  });
+});
+
+describe('vQuery', () => {
+  it('returns query parameters when valid', async () => {
+    const event = fakeEvent({ url: 'http://localhost/?q=hello' });
+    const data = await vQuery(event, SearchQuery);
+    expect(data.q).toBe('hello');
+  });
+
+  it('throws VALIDATION_ERROR when required query field missing', async () => {
+    const event = fakeEvent({ url: 'http://localhost/' });
+    await expect(vQuery(event, SearchQuery)).rejects.toMatchObject({
+      code: 'VALIDATION_ERROR',
+      statusCode: 422,
+    });
+  });
+});
+
+describe('type inference', () => {
+  it('infers vBody return type from schema', () => {
+    const fn = (e: SvelteKitRequestEvent) => vBody(e, CreateUserBody);
+    expectTypeOf(fn).returns.resolves.toEqualTypeOf<{ name: string; email: string }>();
+  });
+
+  it('infers vParam return type from schema', () => {
+    const fn = (e: SvelteKitRequestEvent) => vParam(e, IdParam);
+    expectTypeOf(fn).returns.resolves.toEqualTypeOf<{ id: string }>();
+  });
+
+  it('infers vQuery return type from schema', () => {
+    const fn = (e: SvelteKitRequestEvent) => vQuery(e, SearchQuery);
+    expectTypeOf(fn).returns.resolves.toEqualTypeOf<{ q: string; page?: string }>();
+  });
+
+  it('exports InferOutput utility type', () => {
+    type Expected = InferOutput<typeof CreateUserBody>;
+    expectTypeOf<Expected>().toEqualTypeOf<{ name: string; email: string }>();
+  });
+});

package/src/sveltekit/validated.ts

@@ -0,0 +1,78 @@
+/**
+ * Typed extraction-and-validation helpers for SvelteKit `+server.ts` handlers
+ * and form actions.
+ *
+ * These helpers extract request data (body, params, query) **and validate
+ * it at runtime** against the supplied Standard Schema. On success they
+ * return the parsed value with full TypeScript inference; on failure they
+ * throw `FortressError('VALIDATION_ERROR', 422)` — the same shape every
+ * fortress-managed endpoint produces — so the existing SvelteKit error
+ * mapping (via `errorToResponse`) formats it identically.
+ *
+ * Works with any Standard Schema V1 library: Zod, Valibot, ArkType, or
+ * fortress's built-in schema builders.
+ *
+ * @example
+ * ```ts
+ * // src/routes/api/users/[id]/+server.ts
+ * import { vBody, vParam } from '@bajustone/fortress/sveltekit';
+ * import { obj, str } from '@bajustone/fortress';
+ *
+ * const UpdateBody = obj({ name: str() }, 'name');
+ * const Params = obj({ id: str() }, 'id');
+ *
+ * export async function PATCH(event) {
+ *   const { id }   = await vParam(event, Params);
+ *   const { name } = await vBody(event, UpdateBody);
+ *   // ...
+ * }
+ * ```
+ *
+ * Validation runs per call, so the first failing helper throws and any
+ * downstream helpers in the same handler do not run. If you need to
+ * aggregate body+query+params issues into a single response, use the
+ * framework-agnostic `validateRequest` from `@bajustone/fortress` instead.
+ */
+
+import type { StandardSchemaV1 } from '../core/standard-schema';
+import type { SvelteKitRequestEvent } from './types';
+import { validateValue } from '../core/validation';
+
+/** Infer the output type of a Standard Schema V1 schema. */
+export type InferOutput<T extends StandardSchemaV1> = StandardSchemaV1.InferOutput<T>;
+
+/**
+ * Extract and validate the JSON request body. Returns the parsed value typed
+ * as `InferOutput<T>`, or throws `FortressError('VALIDATION_ERROR', 422)`.
+ */
+export async function vBody<T extends StandardSchemaV1>(
+  event: SvelteKitRequestEvent,
+  schema: T,
+): Promise<InferOutput<T>> {
+  const body = await event.request.json().catch(() => undefined);
+  return validateValue(schema, body, 'body');
+}
+
+/**
+ * Extract and validate route parameters from a `[param]`-style file. Returns
+ * the parsed value typed as `InferOutput<T>`, or throws
+ * `FortressError('VALIDATION_ERROR', 422)`.
+ */
+export async function vParam<T extends StandardSchemaV1>(
+  event: SvelteKitRequestEvent,
+  schema: T,
+): Promise<InferOutput<T>> {
+  return validateValue(schema, event.params, 'params');
+}
+
+/**
+ * Extract and validate query parameters from `event.url.searchParams`.
+ * Returns the parsed value typed as `InferOutput<T>`, or throws
+ * `FortressError('VALIDATION_ERROR', 422)`.
+ */
+export async function vQuery<T extends StandardSchemaV1>(
+  event: SvelteKitRequestEvent,
+  schema: T,
+): Promise<InferOutput<T>> {
+  return validateValue(schema, Object.fromEntries(event.url.searchParams), 'query');
+}