@bajustone/fortress 1.0.0-rc.1

package/dist/sveltekit.js

@@ -0,0 +1,1207 @@
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/core/http/cookie-serialize.ts
+function parseCookieHeader(header) {
+  if (!header)
+    return {};
+  const out = {};
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1)
+      continue;
+    const name = part.slice(0, eq).trim();
+    if (!name)
+      continue;
+    const raw = part.slice(eq + 1).trim();
+    try {
+      out[name] = decodeURIComponent(raw);
+    } catch {
+      out[name] = raw;
+    }
+  }
+  return out;
+}
+
+// src/sveltekit/cookies.ts
+function setAuthCookies(event, fortress, payload) {
+  const cookies = fortress.cookies;
+  const accessExpiry = fortress.config.jwt.accessTokenExpirySeconds ?? 900;
+  const refreshExpiry = fortress.config.jwt.refreshTokenExpirySeconds ?? 604800;
+  event.cookies.set(cookies.accessName, payload.accessToken, optsFor(cookies, accessExpiry));
+  if (payload.refreshToken) {
+    event.cookies.set(cookies.refreshName, payload.refreshToken, optsFor(cookies, refreshExpiry));
+  }
+}
+function clearAuthCookies(event, fortress) {
+  const cookies = fortress.cookies;
+  event.cookies.delete(cookies.accessName, optsFor(cookies));
+  event.cookies.delete(cookies.refreshName, optsFor(cookies));
+}
+function replayCookies(response, event) {
+  const setCookies = response.headers.getSetCookie();
+  for (const raw of setCookies) {
+    const parsed = parseSetCookie(raw);
+    if (!parsed)
+      continue;
+    event.cookies.set(parsed.name, parsed.value, parsed.opts);
+  }
+}
+function optsFor(cookies, maxAgeSeconds) {
+  const opts = {
+    path: cookies.path,
+    httpOnly: true,
+    secure: cookies.secure,
+    sameSite: cookies.sameSite
+  };
+  if (cookies.domain)
+    opts.domain = cookies.domain;
+  if (maxAgeSeconds !== void 0)
+    opts.maxAge = maxAgeSeconds;
+  return opts;
+}
+function parseSetCookie(raw) {
+  const parts = raw.split(";").map((p) => p.trim());
+  if (parts.length === 0)
+    return null;
+  const first = parts.shift();
+  if (!first)
+    return null;
+  const eq = first.indexOf("=");
+  if (eq === -1)
+    return null;
+  const name = first.slice(0, eq).trim();
+  const rawValue = first.slice(eq + 1).trim();
+  let value;
+  try {
+    value = decodeURIComponent(rawValue);
+  } catch {
+    value = rawValue;
+  }
+  const opts = { path: "/" };
+  for (const part of parts) {
+    const [k, v = ""] = part.split("=", 2);
+    const key = k.toLowerCase();
+    if (key === "path")
+      opts.path = v;
+    else if (key === "domain")
+      opts.domain = v;
+    else if (key === "httponly")
+      opts.httpOnly = true;
+    else if (key === "secure")
+      opts.secure = true;
+    else if (key === "samesite")
+      opts.sameSite = v.toLowerCase();
+    else if (key === "max-age")
+      opts.maxAge = Number(v);
+    else if (key === "expires")
+      opts.expires = new Date(v);
+  }
+  return { name, value, opts };
+}
+
+// src/sveltekit/actions.ts
+async function actionFailure(status, data) {
+  const { fail } = await import("@sveltejs/kit");
+  return fail(status, data);
+}
+async function actionRedirect(location) {
+  const { redirect } = await import("@sveltejs/kit");
+  return redirect(303, location);
+}
+function field(form, name) {
+  const v = form.get(name);
+  return typeof v === "string" ? v : "";
+}
+function buildMeta(event) {
+  return {
+    ipAddress: event.request.headers.get("x-forwarded-for") ?? event.request.headers.get("x-real-ip") ?? void 0,
+    userAgent: event.request.headers.get("user-agent") ?? void 0
+  };
+}
+var fortressActions = {
+  /**
+   * Sign in with `identifier` + `password` form fields. Sets the access +
+   * refresh cookies on success. Optionally redirects.
+   */
+  login(fortress, opts = {}) {
+    return async (event) => {
+      const form = await event.request.formData();
+      const identifier = field(form, "identifier");
+      const password = field(form, "password");
+      try {
+        const result = await fortress.auth.login(identifier, password, buildMeta(event));
+        if (result.status === "pending")
+          return { success: true, pending: true, challenge: result.pending };
+        if (result.status !== "success")
+          return { success: true, pending: false };
+        setAuthCookies(event, fortress, {
+          accessToken: result.accessToken,
+          refreshToken: result.refreshToken
+        });
+        if (opts.redirectTo)
+          await actionRedirect(opts.redirectTo);
+        return { success: true, pending: false };
+      } catch (err) {
+        if (err instanceof FortressError) {
+          return actionFailure(err.statusCode, { error: err.message, code: err.code });
+        }
+        throw err;
+      }
+    };
+  },
+  /**
+   * Register a new user from `email`, `name`, `password` form fields. On
+   * success, immediately logs them in (sets cookies) and optionally
+   * redirects. Mirrors the typical sign-up UX.
+   */
+  register(fortress, opts = {}) {
+    return async (event) => {
+      const form = await event.request.formData();
+      const data = {
+        email: field(form, "email"),
+        name: field(form, "name"),
+        password: field(form, "password")
+      };
+      try {
+        await fortress.auth.createUser(data);
+        const result = await fortress.auth.login(data.email, data.password ?? "", buildMeta(event));
+        if (result.status === "pending")
+          return { success: true, pending: true, challenge: result.pending };
+        if (result.status !== "success")
+          return { success: true, pending: false };
+        setAuthCookies(event, fortress, {
+          accessToken: result.accessToken,
+          refreshToken: result.refreshToken
+        });
+        if (opts.redirectTo)
+          await actionRedirect(opts.redirectTo);
+        return { success: true, pending: false };
+      } catch (err) {
+        if (err instanceof FortressError) {
+          return actionFailure(err.statusCode, { error: err.message, code: err.code });
+        }
+        throw err;
+      }
+    };
+  },
+  /**
+   * Revoke the current refresh token (if present) and clear both auth
+   * cookies. Optionally redirects.
+   */
+  logout(fortress, opts = {}) {
+    return async (event) => {
+      const refreshToken = event.cookies.get(fortress.cookies.refreshName);
+      if (refreshToken) {
+        try {
+          await fortress.auth.logout(refreshToken);
+        } catch {
+        }
+      }
+      clearAuthCookies(event, fortress);
+      if (opts.redirectTo)
+        await actionRedirect(opts.redirectTo);
+      return { success: true, pending: false };
+    };
+  },
+  /**
+   * Manually rotate the access + refresh tokens using the cookie. Useful
+   * if you want a `?/refresh` form action for SPAs that need to extend a
+   * session without a full reload.
+   */
+  refresh(fortress) {
+    return async (event) => {
+      const refreshToken = event.cookies.get(fortress.cookies.refreshName);
+      if (!refreshToken) {
+        return actionFailure(401, { error: "No refresh token", code: "UNAUTHORIZED" });
+      }
+      try {
+        const result = await fortress.auth.refresh(refreshToken, buildMeta(event));
+        setAuthCookies(event, fortress, result);
+        return { success: true, pending: false };
+      } catch (err) {
+        if (err instanceof FortressError) {
+          return actionFailure(err.statusCode, { error: err.message, code: err.code });
+        }
+        throw err;
+      }
+    };
+  }
+};
+
+// src/sveltekit/catch-all.ts
+function toSvelteKitHandler(fortress) {
+  const handler = (event) => fortress.handleRequest(event.request);
+  return {
+    GET: handler,
+    POST: handler,
+    PUT: handler,
+    DELETE: handler,
+    PATCH: handler
+  };
+}
+
+// src/core/http/error-response.ts
+function errorToResponse(err, logger) {
+  if (err instanceof FortressError) {
+    const headers = { "Content-Type": "application/json" };
+    if (err.code === "RATE_LIMITED" && err.retryAfter !== void 0) {
+      headers["Retry-After"] = String(err.retryAfter);
+    }
+    if (err.oauthError) {
+      const body2 = { error: err.oauthError };
+      if (err.oauthDescription)
+        body2.error_description = err.oauthDescription;
+      if (err.oauthErrorUri)
+        body2.error_uri = err.oauthErrorUri;
+      return new Response(JSON.stringify(body2), {
+        status: err.statusCode,
+        headers
+      });
+    }
+    return new Response(JSON.stringify(err.toJSON()), {
+      status: err.statusCode,
+      headers
+    });
+  }
+  logger?.error(
+    { err, message: err instanceof Error ? err.message : "Unknown error" },
+    "unhandled error in fortress.handleRequest"
+  );
+  const body = {
+    code: "INTERNAL_ERROR",
+    message: "Internal server error",
+    statusCode: 500
+  };
+  return new Response(JSON.stringify(body), {
+    status: 500,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function withCookies(response, setCookies) {
+  if (setCookies.length === 0)
+    return response;
+  const headers = new Headers(response.headers);
+  for (const cookie of setCookies) {
+    headers.append("set-cookie", cookie);
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+
+// src/core/http/match.ts
+function segmentSpecificity(segment) {
+  if (segment === "*")
+    return 0;
+  if (segment.startsWith(":"))
+    return 1;
+  return 2;
+}
+function canonicalizePath(pathname) {
+  const segments = pathname.split("/").filter(Boolean);
+  return segments.length === 0 ? "/" : `/${segments.join("/")}`;
+}
+function buildRouteTable(endpoints) {
+  const table = endpoints.map((ep) => {
+    const segments = canonicalizePath(ep.path).split("/").filter(Boolean);
+    const paramNames = [];
+    for (const seg of segments) {
+      if (seg.startsWith(":"))
+        paramNames.push(seg.slice(1));
+    }
+    return {
+      endpoint: ep,
+      method: ep.method.toUpperCase(),
+      segments,
+      paramNames
+    };
+  });
+  return table.map((route, index) => ({ route, index })).sort((a, b) => {
+    const length = Math.max(a.route.segments.length, b.route.segments.length);
+    for (let i = 0; i < length; i++) {
+      const difference = segmentSpecificity(b.route.segments[i] ?? "") - segmentSpecificity(a.route.segments[i] ?? "");
+      if (difference !== 0)
+        return difference;
+    }
+    return a.index - b.index;
+  }).map(({ route }) => route);
+}
+function matchRoute(table, method, pathname) {
+  const upperMethod = method.toUpperCase();
+  const pathSegments = canonicalizePath(pathname).split("/").filter(Boolean);
+  for (const route of table) {
+    if (route.method !== upperMethod)
+      continue;
+    if (route.segments.length !== pathSegments.length)
+      continue;
+    const params = {};
+    let matched = true;
+    for (let i = 0; i < route.segments.length; i++) {
+      const routeSeg = route.segments[i];
+      const pathSeg = pathSegments[i];
+      if (routeSeg.startsWith(":")) {
+        params[routeSeg.slice(1)] = decodeURIComponent(pathSeg);
+      } else if (routeSeg !== "*" && routeSeg !== pathSeg) {
+        matched = false;
+        break;
+      }
+    }
+    if (matched)
+      return { endpoint: route.endpoint, params };
+  }
+  return null;
+}
+
+// src/core/http/principal.ts
+async function tryPluginPrincipal(fortress, request) {
+  const plugins = fortress.config.plugins ?? [];
+  for (const plugin of plugins) {
+    if (!plugin.resolvePrincipal)
+      continue;
+    const resolved = await plugin.resolvePrincipal(request, {
+      db: fortress.config.database,
+      config: fortress.config,
+      auth: fortress.auth,
+      iam: fortress.iam
+    });
+    if (resolved)
+      return { subject: resolved.subject, claims: resolved.claims, scopes: resolved.scopes };
+  }
+  return null;
+}
+
+// src/core/plugin-runner.ts
+function chainAdapterWrappers(plugins, baseAdapter, requestContext) {
+  let adapter = baseAdapter;
+  for (const plugin of plugins) {
+    if (plugin.wrapAdapter) {
+      adapter = plugin.wrapAdapter(adapter, requestContext);
+    }
+  }
+  return adapter;
+}
+async function collectScopeRules(plugins, userId, model, ctx) {
+  const allFilters = [];
+  const allDefaults = {};
+  for (const plugin of plugins) {
+    if (!plugin.scopeRules) {
+      continue;
+    }
+    const rule = await plugin.scopeRules(userId, model, ctx);
+    if (!rule) {
+      continue;
+    }
+    allFilters.push(...rule.filters);
+    Object.assign(allDefaults, rule.defaults);
+  }
+  if (allFilters.length === 0 && Object.keys(allDefaults).length === 0) {
+    return null;
+  }
+  return { filters: allFilters, defaults: allDefaults };
+}
+function wrapAdapterWithScopeRules(adapter, scopeRule) {
+  const { filters, defaults } = scopeRule;
+  return {
+    ...adapter,
+    create: (params) => adapter.create({
+      ...params,
+      data: { ...params.data, ...defaults }
+    }),
+    findOne: (params) => adapter.findOne({
+      ...params,
+      where: [...params.where, ...filters]
+    }),
+    findMany: (params) => adapter.findMany({
+      ...params,
+      where: [...params.where ?? [], ...filters]
+    }),
+    update: (params) => Promise.resolve().then(() => {
+      for (const key of Object.keys(defaults)) {
+        if (Object.hasOwn(params.data, key))
+          throw Errors.forbidden(`Cannot update scoped field '${key}'`);
+      }
+      return adapter.update({
+        ...params,
+        where: [...params.where, ...filters]
+      });
+    }),
+    delete: (params) => adapter.delete({
+      ...params,
+      where: [...params.where, ...filters]
+    }),
+    count: (params) => adapter.count({
+      ...params,
+      where: [...params.where ?? [], ...filters]
+    }),
+    transaction: (fn) => adapter.transaction((tx) => fn(wrapAdapterWithScopeRules(tx, scopeRule)))
+  };
+}
+function middlewarePathToRegex(pattern) {
+  const regexStr = canonicalizePath(pattern).replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/:[^/]+/g, "[^/]+").replace(/\\\*/g, ".*").replace(/\//g, "\\/");
+  return new RegExp(`^${regexStr}$`);
+}
+function collectPluginMiddleware(plugins, position) {
+  const result = [];
+  for (const plugin of plugins) {
+    if (!plugin.middleware)
+      continue;
+    for (const mw of plugin.middleware) {
+      if (mw.position === position) {
+        result.push({ plugin, middleware: mw });
+      }
+    }
+  }
+  return result;
+}
+async function executePluginMiddleware(plugins, position, requestPath, ctx, request) {
+  const canonicalRequestPath = canonicalizePath(requestPath);
+  const matching = collectPluginMiddleware(plugins, position).filter(({ middleware: mw }) => middlewarePathToRegex(mw.path).test(canonicalRequestPath));
+  if (matching.length === 0)
+    return;
+  let index = 0;
+  async function runNext() {
+    if (index >= matching.length)
+      return;
+    const current = matching[index++];
+    await current.middleware.handler(ctx, request, runNext);
+  }
+  await runNext();
+}
+
+// src/sveltekit/handle.ts
+var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function createSvelteKitHandle(fortress, options = {}) {
+  const basePath = options.basePath ?? "";
+  const routeTable = buildRouteTable(fortress.manifest.filter((route) => route.mounted));
+  const skipPatterns = (options.skipPaths ?? []).map((p) => pathToRegex(p));
+  const routeMap = options.routeMap ?? {};
+  const unmappedRoutes = options.unmappedRoutes ?? "allow";
+  const refreshFlights = /* @__PURE__ */ new Map();
+  const refreshFlightKey = (refreshToken, meta) => `${refreshToken}\0${meta.userAgent ?? ""}`;
+  const acquireRefreshFlight = (refreshToken, meta) => {
+    const key = refreshFlightKey(refreshToken, meta);
+    const existing = refreshFlights.get(key);
+    if (existing) {
+      existing.consumers++;
+      return { key, promise: existing.promise };
+    }
+    const promise = fortress.auth.refresh(refreshToken, meta);
+    refreshFlights.set(key, { consumers: 1, promise });
+    return { key, promise };
+  };
+  const releaseRefreshFlight = (key) => {
+    const flight = refreshFlights.get(key);
+    if (!flight)
+      return;
+    flight.consumers--;
+    if (flight.consumers === 0)
+      refreshFlights.delete(key);
+  };
+  return async ({ event, resolve }) => {
+    let acquiredRefreshKey;
+    try {
+      const fullPath = event.url.pathname;
+      const innerPath = stripPrefix(fullPath, basePath);
+      if (innerPath !== null && matchRoute(routeTable, event.request.method, innerPath)) {
+        const rewritten = rewriteRequest(event.request, event.url, innerPath);
+        const response = await fortress.handleRequest(rewritten);
+        replayCookies(response, event);
+        return response;
+      }
+      await fortress.runPluginMiddleware("before-auth", { request: event.request });
+      let subject;
+      let userId;
+      let claims;
+      let scopes;
+      const pluginResolved = await tryPluginPrincipal(fortress, event.request);
+      if (pluginResolved) {
+        subject = pluginResolved.subject;
+        claims = pluginResolved.claims;
+        scopes = pluginResolved.scopes;
+      } else {
+        const token = fortress.extractAccessToken(event.request);
+        if (token) {
+          try {
+            claims = await fortress.auth.verifyToken(token);
+            subject = { type: claims.subjectType, id: claims.sub };
+          } catch {
+            const refreshToken = SAFE_METHODS.has(event.request.method.toUpperCase()) ? event.cookies.get(fortress.cookies.refreshName) : void 0;
+            if (refreshToken) {
+              try {
+                const flight = acquireRefreshFlight(refreshToken, requestMeta(event.request));
+                acquiredRefreshKey = flight.key;
+                const refreshed = await flight.promise;
+                setAuthCookies(event, fortress, refreshed);
+                claims = await fortress.auth.verifyToken(refreshed.accessToken);
+                subject = { type: claims.subjectType, id: claims.sub };
+              } catch {
+              }
+            }
+          }
+        }
+      }
+      if (subject?.type === "USER")
+        userId = subject.id;
+      if (subject) {
+        populateLocals(
+          event,
+          fortress,
+          subject,
+          claims,
+          scopes
+        );
+      } else {
+        const locals = event.locals;
+        locals.fortress ??= {};
+      }
+      await fortress.runPluginMiddleware("after-auth", {
+        request: event.request,
+        fortressSubject: subject,
+        fortressUserId: userId,
+        fortressClaims: claims,
+        fortressScopes: scopes
+      });
+      if (!skipPatterns.some((p) => p.test(fullPath))) {
+        const mapping = matchRouteMap(routeMap, event.request.method, fullPath);
+        if (!mapping && unmappedRoutes === "deny")
+          throw Errors.forbidden("No permission mapping for this route");
+        if (mapping) {
+          if (!subject)
+            throw Errors.unauthorized("Not authenticated");
+          const allowed = await fortress.iam.checkPermission(subject, mapping.resource, mapping.action, {
+            credentialScopes: scopes
+          });
+          if (!allowed)
+            throw Errors.forbidden("Insufficient permissions");
+        }
+      }
+      await fortress.runPluginMiddleware("after-rbac", {
+        request: event.request,
+        fortressSubject: subject,
+        fortressUserId: userId,
+        fortressClaims: claims,
+        fortressScopes: scopes
+      });
+      return await resolve(event);
+    } catch (err) {
+      return errorToResponse(err);
+    } finally {
+      if (acquiredRefreshKey)
+        releaseRefreshFlight(acquiredRefreshKey);
+    }
+  };
+}
+function requestMeta(request) {
+  return {
+    ipAddress: request.headers.get("x-forwarded-for") ?? request.headers.get("x-real-ip") ?? void 0,
+    userAgent: request.headers.get("user-agent") ?? void 0
+  };
+}
+function populateLocals(event, fortress, subject, claims, scopes) {
+  const plugins = fortress.config.plugins ?? [];
+  const requestContext = {
+    tenantId: claims?.customClaims?.tenantId,
+    ipAddress: event.request.headers.get("x-forwarded-for") ?? event.request.headers.get("x-real-ip") ?? void 0,
+    userAgent: event.request.headers.get("user-agent") ?? void 0
+  };
+  const wrapped = chainAdapterWrappers(plugins, fortress.config.database, requestContext);
+  const pluginCtx = { db: wrapped, config: fortress.config };
+  event.locals.fortress = {
+    subject,
+    userId: subject.type === "USER" ? subject.id : void 0,
+    claims,
+    scopes,
+    db: wrapped,
+    getScopedDb: async (model) => {
+      const rule = await collectScopeRules(plugins, subject.id, model, pluginCtx);
+      if (!rule)
+        return wrapped;
+      return wrapAdapterWithScopeRules(wrapped, rule);
+    }
+  };
+}
+function stripPrefix(pathname, prefix) {
+  if (!prefix)
+    return pathname;
+  if (!pathname.startsWith(prefix))
+    return null;
+  return pathname.slice(prefix.length) || "/";
+}
+function rewriteRequest(original, url, innerPath) {
+  const newUrl = `${url.origin}${innerPath}${url.search}`;
+  return new Request(newUrl, original);
+}
+function pathToRegex(pattern) {
+  const regexStr = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/:[^/]+/g, "[^/]+").replace(/\\\*/g, ".*").replace(/\//g, "\\/");
+  return new RegExp(`^${regexStr}$`);
+}
+function matchRouteMap(map, method, path) {
+  const exact = map[`${method} ${path}`];
+  if (exact)
+    return exact;
+  for (const [pattern, mapping] of Object.entries(map)) {
+    const [m, p] = pattern.split(" ", 2);
+    if (m !== method)
+      continue;
+    if (pathToRegex(p).test(path))
+      return mapping;
+  }
+  return null;
+}
+
+// src/sveltekit/helpers.ts
+function getSubject(event) {
+  const subject = event.locals.fortress?.subject;
+  if (!subject)
+    throw Errors.unauthorized("Not authenticated");
+  return subject;
+}
+function getUserId(event) {
+  const subject = event.locals.fortress?.subject;
+  if (!subject || subject.type !== "USER")
+    throw Errors.unauthorized("User not authenticated");
+  return subject.id;
+}
+function getClaims(event) {
+  const claims = event.locals.fortress?.claims;
+  if (!claims)
+    throw Errors.unauthorized("No JWT claims on this request");
+  return claims;
+}
+function getDb(event) {
+  const db = event.locals.fortress?.db;
+  if (!db)
+    throw Errors.unauthorized("Not authenticated");
+  return db;
+}
+function getScopedDb(event, model) {
+  const fn = event.locals.fortress?.getScopedDb;
+  if (!fn)
+    throw Errors.unauthorized("Not authenticated");
+  return fn(model);
+}
+
+// src/core/validation.ts
+import { fromJSONSchema } from "@bajustone/fetcher/openapi";
+var DECIMAL_INTEGER_RE = /^-?\d+$/;
+var DECIMAL_NUMBER_RE = /^-?\d+(?:\.\d+)?$/;
+var rawSchemaValidators = /* @__PURE__ */ new WeakMap();
+function standardSchemaFor(schema) {
+  if ("~standard" in schema)
+    return schema;
+  let compiled = rawSchemaValidators.get(schema);
+  if (!compiled) {
+    compiled = fromJSONSchema(schema);
+    rawSchemaValidators.set(schema, compiled);
+  }
+  return compiled;
+}
+function coerceBySchema(schema, data) {
+  if (!schema || !data || schema.type !== "object" || !schema.properties)
+    return data;
+  const out = { ...data };
+  for (const [key, propSchema] of Object.entries(schema.properties)) {
+    const value = out[key];
+    if (typeof value !== "string")
+      continue;
+    const coerced = coerceScalar(propSchema, value);
+    if (coerced !== void 0)
+      out[key] = coerced;
+  }
+  return out;
+}
+function coerceScalar(schema, value) {
+  const type = schema.type ?? numericConstraintType(schema);
+  switch (type) {
+    case "integer": {
+      if (!DECIMAL_INTEGER_RE.test(value))
+        return void 0;
+      const n = Number(value);
+      if (Number.isFinite(n) && Number.isSafeInteger(n) && String(n) === value)
+        return n;
+      return void 0;
+    }
+    case "number": {
+      if (!DECIMAL_NUMBER_RE.test(value))
+        return void 0;
+      const n = Number(value);
+      if (Number.isFinite(n) && (!Number.isInteger(n) || Number.isSafeInteger(n)) && String(n) === value)
+        return n;
+      return void 0;
+    }
+    case "boolean": {
+      if (value === "true")
+        return true;
+      if (value === "false")
+        return false;
+      return void 0;
+    }
+    default:
+      return void 0;
+  }
+}
+function numericConstraintType(schema) {
+  if (typeof schema.const === "number")
+    return Number.isInteger(schema.const) ? "integer" : "number";
+  if (schema.enum && schema.enum.length > 0 && schema.enum.every((value) => typeof value === "number"))
+    return schema.enum.every((value) => Number.isInteger(value)) ? "integer" : "number";
+  return void 0;
+}
+async function validateRequest(input, data) {
+  if (!input)
+    return;
+  const allIssues = [];
+  if (input.bodySchema || input.body) {
+    const issues = await validateSchema(input.bodySchema ?? input.body, data.body, "body");
+    allIssues.push(...issues);
+  }
+  if (input.querySchema || input.query) {
+    const issues = await validateSchema(input.querySchema ?? input.query, data.query, "query");
+    allIssues.push(...issues);
+  }
+  if (input.paramsSchema || input.params) {
+    const issues = await validateSchema(input.paramsSchema ?? input.params, data.params, "params");
+    allIssues.push(...issues);
+  }
+  if (allIssues.length > 0) {
+    throw Errors.validationError(allIssues);
+  }
+}
+async function validateSchema(schema, data, location) {
+  const result = await standardSchemaFor(schema)["~standard"].validate(data);
+  if (result.issues) {
+    return result.issues.map((issue) => ({
+      path: issue.path,
+      message: issue.message,
+      location
+    }));
+  }
+  return [];
+}
+async function validateValue(schema, data, location) {
+  const result = await schema["~standard"].validate(data);
+  if (result.issues) {
+    throw Errors.validationError(
+      result.issues.map((issue) => ({
+        path: issue.path,
+        message: issue.message,
+        location
+      }))
+    );
+  }
+  return result.value;
+}
+
+// src/core/http/csrf.ts
+function resolveCsrfConfig(config) {
+  return {
+    enabled: config?.enabled ?? true,
+    headerName: config?.headerName ?? "X-Fortress-CSRF",
+    skipPaths: config?.skipPaths ?? [],
+    rejectSameSite: config?.rejectSameSite ?? false
+  };
+}
+var SAFE_METHODS2 = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function matchesSkipPath(path, skipPaths) {
+  for (const skip of skipPaths) {
+    if (path === skip)
+      return true;
+    if (path.startsWith(`${skip}/`))
+      return true;
+  }
+  return false;
+}
+function isCookieAuthenticated(request, cookies) {
+  const jar = parseCookieHeader(request.headers.get("cookie"));
+  const hasCookie = (name) => typeof jar[name] === "string" && jar[name].length > 0;
+  return hasCookie(cookies.accessName) || hasCookie(cookies.refreshName);
+}
+function enforceCsrf(request, pathname, csrf, cookies) {
+  if (!csrf.enabled)
+    return;
+  if (SAFE_METHODS2.has(request.method.toUpperCase()))
+    return;
+  if (matchesSkipPath(pathname, csrf.skipPaths))
+    return;
+  const fetchSite = request.headers.get("sec-fetch-site");
+  const cookieAuthenticated = isCookieAuthenticated(request, cookies);
+  if (!cookieAuthenticated) {
+    if (request.headers.has("authorization") || request.headers.has("x-api-key"))
+      return;
+    if (fetchSite === "cross-site")
+      throw Errors.forbidden("CSRF: cross-site request rejected");
+    const origin = request.headers.get("origin");
+    if (origin) {
+      try {
+        if (new URL(origin).origin !== new URL(request.url).origin)
+          throw Errors.forbidden("CSRF: cross-origin request rejected");
+      } catch (error) {
+        if (error instanceof Error && "code" in error)
+          throw error;
+        throw Errors.forbidden("CSRF: invalid Origin header");
+      }
+    }
+    return;
+  }
+  if (fetchSite === "cross-site")
+    throw Errors.forbidden("CSRF: cross-site request rejected");
+  if (csrf.rejectSameSite && fetchSite === "same-site")
+    throw Errors.forbidden("CSRF: same-site request rejected");
+  const tokenHeader = request.headers.get(csrf.headerName);
+  if (!tokenHeader)
+    throw Errors.forbidden(`CSRF: missing ${csrf.headerName} header`);
+}
+
+// src/core/http/fortress-rbac.ts
+async function enforceFortressPermission(endpoint, subject, enforcement, scopes) {
+  const security = endpoint.meta?.security;
+  if (endpoint.meta?.permission) {
+    if (!subject)
+      throw Errors.unauthorized("Not authenticated");
+    const allowed = await enforcement.checkPermission(
+      subject,
+      endpoint.meta.permission.resource,
+      endpoint.meta.permission.action,
+      scopes
+    );
+    if (!allowed)
+      throw Errors.forbidden("Insufficient permissions");
+    return;
+  }
+  if (security?.includes("none") || security?.includes("basic"))
+    return;
+  if (security?.includes("bearer")) {
+    if (!subject)
+      throw Errors.unauthorized("Not authenticated");
+    return;
+  }
+  throw Errors.forbidden("No permission mapping for this route");
+}
+
+// src/core/http/plugin-middleware.ts
+async function runPluginMiddleware(plugins, config, phase, ctx) {
+  if (plugins.length === 0)
+    return;
+  const pluginCtx = { db: config.database, config };
+  const path = new URL(ctx.request.url).pathname;
+  await executePluginMiddleware(plugins, phase, path, pluginCtx, ctx);
+}
+
+// src/core/http/protect.ts
+function routeKey(route) {
+  return `${route.method.toUpperCase()} ${route.path}`;
+}
+function findEndpoint(fortress, target, method) {
+  if (typeof target !== "string") {
+    return target;
+  }
+  const matches = fortress.endpoints.filter((endpoint) => endpoint.handler === target);
+  if (matches.length === 0)
+    throw Errors.notFound(`No endpoint found for handler '${target}'`);
+  if (method) {
+    const byMethod = matches.find((endpoint) => endpoint.method.toUpperCase() === method.toUpperCase());
+    if (byMethod)
+      return byMethod;
+  }
+  if (matches.length > 1) {
+    throw Errors.badRequest(
+      `Handler '${target}' maps to multiple endpoints; pass the EndpointDefinition or ProtectOptions.method.`
+    );
+  }
+  return matches[0];
+}
+function findManifestEntry(fortress, endpoint) {
+  const key = routeKey(endpoint);
+  const entry = fortress.manifest.find((route) => `${route.method.toUpperCase()} ${route.path}` === key);
+  if (!entry)
+    throw Errors.notFound(`No route manifest entry found for ${key}`);
+  return entry;
+}
+function rewriteRequestPath(request, pathname) {
+  const current = new URL(request.url);
+  if (current.pathname === pathname)
+    return request;
+  const rewritten = new URL(request.url);
+  rewritten.pathname = pathname;
+  return new Request(rewritten, request);
+}
+async function parseJsonBody(request) {
+  if (request.method === "GET" || request.method === "HEAD")
+    return void 0;
+  if (!(request.headers.get("content-type") ?? "").includes("json"))
+    return void 0;
+  return request.clone().json().catch(() => void 0);
+}
+function objectOrEmpty(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
+}
+function successStatus(endpoint) {
+  const status = Object.keys(endpoint.responses ?? {}).map(Number).find((code) => code >= 200 && code < 300);
+  return status ?? 200;
+}
+function jsonResponse(body, status) {
+  return new Response(JSON.stringify(body ?? { ok: true }), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function maybeAttachAuthCookies(fortress, result, response) {
+  if (result instanceof Response)
+    return response;
+  const obj = result;
+  if (typeof obj?.accessToken !== "string")
+    return response;
+  return withCookies(response, fortress.serializeAuthCookies({
+    accessToken: obj.accessToken,
+    refreshToken: typeof obj.refreshToken === "string" ? obj.refreshToken : null
+  }));
+}
+function protect(fortress, target, handler, options = {}) {
+  const endpoint = findEndpoint(fortress, target, options.method);
+  const manifest = findManifestEntry(fortress, endpoint);
+  const endpointRouteTable = buildRouteTable([endpoint]);
+  const csrfConfig = resolveCsrfConfig(fortress.config.csrf);
+  const plugins = fortress.config.plugins ?? [];
+  return async function protectedRequestHandler(request) {
+    let response;
+    try {
+      const url = new URL(request.url);
+      const pipelinePath = options.path ?? url.pathname;
+      const pipelineRequest = rewriteRequestPath(request, pipelinePath);
+      await runPluginMiddleware(plugins, fortress.config, "before-auth", { request: pipelineRequest });
+      enforceCsrf(pipelineRequest, pipelinePath, csrfConfig, fortress.cookies);
+      let subject;
+      let userId;
+      let claims;
+      let scopes;
+      const selfManagedBearer = endpoint.meta?.bearerKind === "oauth";
+      if (!selfManagedBearer) {
+        const pluginResolved = await tryPluginPrincipal(fortress, pipelineRequest);
+        if (pluginResolved) {
+          subject = pluginResolved.subject;
+          claims = pluginResolved.claims;
+          scopes = pluginResolved.scopes;
+        }
+      }
+      const requiresBearer = !selfManagedBearer && ((endpoint.meta?.security?.includes("bearer") ?? false) || !!endpoint.meta?.permission);
+      if (!subject && requiresBearer) {
+        const token = fortress.extractAccessToken(pipelineRequest);
+        if (!token)
+          throw Errors.unauthorized("Missing access token");
+        try {
+          claims = await fortress.auth.verifyToken(token);
+          subject = { type: claims.subjectType, id: claims.sub };
+        } catch (err) {
+          if (err instanceof FortressError)
+            throw err;
+          throw Errors.unauthorized("Invalid access token");
+        }
+      }
+      if (subject?.type === "USER")
+        userId = subject.id;
+      await runPluginMiddleware(plugins, fortress.config, "after-auth", {
+        request: pipelineRequest,
+        fortressSubject: subject,
+        fortressUserId: userId,
+        fortressClaims: claims,
+        fortressScopes: scopes
+      });
+      if (!selfManagedBearer) {
+        await enforceFortressPermission(endpoint, subject, {
+          checkPermission: (subj, resource, action, credentialScopes) => fortress.iam.checkPermission(subj, resource, action, { credentialScopes })
+        }, scopes);
+      }
+      await runPluginMiddleware(plugins, fortress.config, "after-rbac", {
+        request: pipelineRequest,
+        fortressSubject: subject,
+        fortressUserId: userId,
+        fortressClaims: claims,
+        fortressScopes: scopes
+      });
+      const body = await parseJsonBody(request);
+      const rawQuery = Object.fromEntries(url.searchParams);
+      const match = matchRoute(endpointRouteTable, endpoint.method, options.path ?? url.pathname);
+      const rawParams = options.params ?? match?.params ?? {};
+      const query = coerceBySchema(endpoint.input?.query, rawQuery) ?? rawQuery;
+      const params = coerceBySchema(endpoint.input?.params, rawParams) ?? rawParams;
+      await validateRequest(endpoint.input, { body, query, params });
+      const input = { ...objectOrEmpty(body), ...query, ...params };
+      const result = await handler({
+        request,
+        endpoint,
+        manifest,
+        subject,
+        userId,
+        claims,
+        scopes,
+        params,
+        query,
+        body,
+        input,
+        respond: (status, responseBody) => jsonResponse(responseBody, status)
+        // Cast: the runtime values are untyped records; the generic context
+        // type narrows them for the caller, but the impl signature uses the
+        // loose `ProtectedRouteContext<EndpointDefinition>`.
+      });
+      response = result instanceof Response ? result : jsonResponse(result, successStatus(endpoint));
+      if (options.attachAuthCookies ?? true)
+        response = maybeAttachAuthCookies(fortress, result, response);
+      return response;
+    } catch (err) {
+      response = errorToResponse(err, fortress.logger);
+      return response;
+    }
+  };
+}
+
+// src/sveltekit/protect.ts
+function protectedRoute(fortress, target, handler, options = {}) {
+  return async (event) => {
+    const protectedHandler = protect(
+      fortress,
+      target,
+      (ctx) => handler(event, ctx),
+      { ...options, method: options.method ?? event.request.method }
+    );
+    const response = await protectedHandler(event.request);
+    replayCookies(response, event);
+    return response;
+  };
+}
+
+// src/sveltekit/validated.ts
+async function vBody(event, schema) {
+  const body = await event.request.json().catch(() => void 0);
+  return validateValue(schema, body, "body");
+}
+async function vParam(event, schema) {
+  return validateValue(schema, event.params, "params");
+}
+async function vQuery(event, schema) {
+  return validateValue(schema, Object.fromEntries(event.url.searchParams), "query");
+}
+export {
+  clearAuthCookies,
+  createSvelteKitHandle,
+  fortressActions,
+  getClaims,
+  getDb,
+  getScopedDb,
+  getSubject,
+  getUserId,
+  protectedRoute,
+  replayCookies,
+  setAuthCookies,
+  toSvelteKitHandler,
+  vBody,
+  vParam,
+  vQuery
+};