@c9up/ream 0.1.25 → 0.1.27

package/src/middleware/Pipeline.ts

@@ -20,13 +20,84 @@ export type MiddlewareFunction = (
   next: () => Promise<void>,
 ) => Promise<void> | void
 
+/** What a route validator must hand back, whichever method it exposes. */
+export interface RuntimeValidationResult {
+  valid: boolean
+  errors: unknown[]
+  data?: unknown
+}
+
 /**
- * Structural contract for a route validator. A `@c9up/rune` schema matches this
- * shape, so ream stays decoupled from the validation engine — any object with a
- * `validate(data)` returning `{ valid, errors, data? }` works.
+ * Structural contract for a route validator. ream stays decoupled from the
+ * validation engine — any object exposing a result-returning check works.
+ *
+ * Three spellings are accepted because `@c9up/rune` follows VineJS: `validate()`
+ * is async and throws, `validateResult()` is synchronous and never throws, and
+ * `validateResultAsync()` is the async result-based form.
+ *
+ * `validateResultAsync` is preferred. The synchronous `validateResult()` cannot
+ * run async rules — with `unique`, `exists` or `useAsync` in the schema it
+ * throws a plain Error, which would surface as a 500 instead of a 422.
  */
 export interface RuntimeValidator {
-  validate(data: unknown): { valid: boolean; errors: unknown[]; data?: unknown }
+  validate?(data: unknown): RuntimeValidationResult | Promise<unknown>
+  validateResult?(data: unknown): RuntimeValidationResult
+  validateResultAsync?(data: unknown): Promise<RuntimeValidationResult>
+}
+
+/** A thrown validation failure, as raised by rune/VineJS `validate()`. */
+interface ThrownValidationFailure {
+  messages: unknown[]
+}
+
+function isThrownValidationFailure(value: unknown): value is ThrownValidationFailure {
+  return (
+    value instanceof Error && 'messages' in value && Array.isArray(Reflect.get(value, 'messages'))
+  )
+}
+
+function isValidationResult(value: unknown): value is RuntimeValidationResult {
+  return typeof value === 'object' && value !== null && 'valid' in value
+}
+
+/**
+ * Run a validator whatever contract it exposes, and always come back with a
+ * result object.
+ *
+ * Order matters: the async result form first (it is the only one that can run
+ * `unique` / `exists`), then the synchronous one, then VineJS's throwing
+ * `validate()` — awaited, and with its `E_VALIDATION_ERROR` translated back
+ * into a result so callers keep a single shape to handle.
+ */
+export async function runValidator(
+  validator: RuntimeValidator,
+  data: unknown,
+): Promise<RuntimeValidationResult> {
+  if (typeof validator.validateResultAsync === 'function') {
+    return validator.validateResultAsync(data)
+  }
+
+  if (typeof validator.validateResult === 'function') {
+    return validator.validateResult(data)
+  }
+
+  if (typeof validator.validate === 'function') {
+    try {
+      const outcome = await validator.validate(data)
+      // A result-returning `validate()` (not the VineJS contract) is honoured
+      // as-is; the throwing contract resolves to the validated payload.
+      return isValidationResult(outcome) ? outcome : { valid: true, errors: [], data: outcome }
+    } catch (err) {
+      if (isThrownValidationFailure(err)) {
+        return { valid: false, errors: err.messages }
+      }
+      throw err
+    }
+  }
+
+  throw new TypeError(
+    'Route validator exposes none of validateResultAsync(), validateResult() or validate().',
+  )
 }
 
 /** Named middleware registry. */
@@ -138,7 +209,7 @@ function createGuardMiddleware(
   return async (ctx, next) => {
     const needsAuth =
       guards.length > 0 || (roles && roles.length > 0) || (permissions && permissions.length > 0)
-    if (needsAuth && !ctx.auth.authenticated) {
+    if (needsAuth && !ctx.auth.isAuthenticated) {
       throw new E_UNAUTHORIZED()
     }
 
@@ -174,7 +245,7 @@ function createGuardMiddleware(
 function createValidationMiddleware(validators: RuntimeValidator[]): MiddlewareFunction {
   return async (ctx, next) => {
     for (const validator of validators) {
-      const result = validator.validate(ctx.request.body())
+      const result = await runValidator(validator, ctx.request.body())
       if (!result.valid) {
         throw new E_VALIDATION_ERROR(result.errors)
       }

package/src/openapi/OpenApiProvider.ts

@@ -47,8 +47,8 @@ export class OpenApiProvider extends Provider {
     const config = this.app.config.get<OpenApiDocsConfig>('openapi') ?? {}
     if (config.enabled === false) return
 
-    const generator = this.#override ?? this.#buildGenerator(config)
-    const server = this.app.container.make<Server>('server')
+    const generator = this.#override ?? (await this.#buildGenerator(config))
+    const server = await this.app.container.make<Server>('server')
     const middleware = new OpenApiMiddleware({
       specPath: config.specPath,
       docsPath: config.docsPath,
@@ -57,8 +57,8 @@ export class OpenApiProvider extends Provider {
     server.use([(ctx, next) => middleware.handle(ctx, next)])
   }
 
-  #buildGenerator(config: OpenApiDocsConfig): OpenApiGenerator {
-    const router = this.app.container.make<Router>('router')
+  async #buildGenerator(config: OpenApiDocsConfig): Promise<OpenApiGenerator> {
+    const router = await this.app.container.make<Router>('router')
     return new OpenApiGenerator(router, {
       title: config.title ?? 'API',
       version: config.version ?? '1.0.0',