@chidchanun/bcp 0.1.16 → 0.1.17

package/docs/auth-route-guards.md

@@ -0,0 +1,216 @@
+# Auth Route Guards
+
+BCP Framework `0.1.17` integrates the Authentication Core with route guards through the server-only `bcp/auth` entrypoint.
+
+## Protect a route tree
+
+Create `guard.ts` in the route directory you want to protect:
+
+```ts
+import {
+    createAuthGuard,
+} from "bcp/auth";
+
+export const guard =
+    createAuthGuard({
+        redirectTo:
+            "/login",
+    });
+```
+
+The guard redirects unauthenticated requests to `/login` with status `303` by default. A `303` is suitable for guards that may run before form actions because it converts a redirected mutation request into a normal GET request to the login page.
+
+To return `401 Unauthorized` instead of redirecting:
+
+```ts
+import {
+    createAuthGuard,
+} from "bcp/auth";
+
+export const guard =
+    createAuthGuard({
+        redirectTo:
+            null,
+    });
+```
+
+## Require a role
+
+```ts
+import {
+    createRoleGuard,
+} from "bcp/auth";
+
+interface User {
+    id: number;
+    email: string;
+    role: string;
+}
+
+export const guard =
+    createRoleGuard<User>(
+        "admin",
+        {
+            redirectTo:
+                "/login",
+        }
+    );
+```
+
+An authenticated user without the required role receives `403 Forbidden` by default.
+
+You can redirect forbidden users instead:
+
+```ts
+export const guard =
+    createRoleGuard<User>(
+        "admin",
+        {
+            forbiddenRedirectTo:
+                "/forbidden",
+        }
+    );
+```
+
+## Require one of several roles
+
+The default role matching mode is `any`:
+
+```ts
+export const guard =
+    createRoleGuard<User>([
+        "admin",
+        "manager",
+    ]);
+```
+
+A user with either role is allowed.
+
+## Require all permissions
+
+`requireRole()` and `createRoleGuard()` can read another user field and require every value:
+
+```ts
+interface User {
+    id: number;
+    permissions: string[];
+}
+
+export const guard =
+    createRoleGuard<User>(
+        [
+            "users.read",
+            "users.write",
+        ],
+        {
+            roleField:
+                "permissions",
+            match:
+                "all",
+        }
+    );
+```
+
+## Inline guard logic
+
+Use `requireAuth()` when a guard needs additional application-specific checks:
+
+```ts
+import {
+    requireAuth,
+} from "bcp/auth";
+
+export async function guard() {
+    const result =
+        await requireAuth<AppUser>();
+
+    if (
+        result instanceof
+        Response
+    ) {
+        return result;
+    }
+
+    if (
+        !result.auth.user.active
+    ) {
+        return new Response(
+            "Forbidden",
+            {
+                status:
+                    403,
+            }
+        );
+    }
+
+    return result;
+}
+```
+
+## Auth data in child guards and loaders
+
+Successful auth helpers return guard data in this shape:
+
+```ts
+{
+    auth: {
+        sid,
+        user,
+        data,
+        iat,
+        exp,
+        iss,
+        aud,
+    },
+}
+```
+
+Because BCP merges parent guard data into child guards and page loaders, descendants can read the authenticated session without verifying the cookie again.
+
+Use `getGuardAuth()` for typed access:
+
+```ts
+import {
+    getGuardAuth,
+} from "bcp/auth";
+
+export async function loader({
+    guardData,
+}) {
+    const session =
+        getGuardAuth<AppUser>(
+            guardData
+        );
+
+    if (!session) {
+        throw new Error(
+            "Protected loader did not receive auth guard data."
+        );
+    }
+
+    return {
+        userId:
+            session.user.id,
+    };
+}
+```
+
+## Low-level role checks
+
+`requireRole()` is also available directly:
+
+```ts
+import {
+    requireRole,
+} from "bcp/auth";
+
+export function guard() {
+    return requireRole<AppUser>(
+        "admin"
+    );
+}
+```
+
+## Security boundary
+
+`bcp/auth` is server-only. BCP blocks it from page/client graphs and maps its browser export to the server-only runtime guard. Authentication and authorization checks should stay in guards, loaders, actions, API routes, or other server modules.

package/docs/releases/0.1.17.md

@@ -0,0 +1,36 @@
+# BCP Framework 0.1.17
+
+## Auth + Route Guard Integration
+
+BCP Framework 0.1.17 connects the Authentication Core introduced in 0.1.16 with the existing scoped route guard system.
+
+### New `bcp/auth` guard helpers
+
+- `requireAuth()` verifies the active BCP auth session and returns it as guard data.
+- `requireRole()` verifies authentication plus one or more roles/permissions.
+- `createAuthGuard()` creates a guard function that can be exported directly from `guard.ts`.
+- `createRoleGuard()` creates a role-protected guard function.
+- `getGuardAuth()` safely reads typed auth data from merged `guardData`.
+
+Successful auth helpers return the session under `guardData.auth`, so child guards and page loaders can reuse the authenticated user without verifying the cookie again.
+
+### Unauthorized and forbidden behavior
+
+- Unauthenticated requests redirect to `/login` with HTTP `303` by default.
+- `redirectTo: null` returns `401 Unauthorized` instead.
+- Authenticated users that fail a role requirement receive `403 Forbidden` by default.
+- `forbiddenRedirectTo` can redirect insufficient-role users to a custom page.
+
+### Role matching
+
+- A single role can be required with `requireRole("admin")`.
+- Multiple roles default to `match: "any"`.
+- `match: "all"` requires every requested value.
+- `roleField` allows permission arrays or custom role fields such as `permissions` instead of the default `role` field.
+
+### Reliability
+
+- Added unit coverage for authentication redirects, 401 mode, role allow/deny behavior, custom role fields and guard factories.
+- Added page-guard pipeline integration coverage proving auth data flows from a parent auth guard into child guards.
+- Added publish-surface regression coverage for the route guard helpers exposed through `bcp/auth`.
+- Added dedicated Auth Route Guards documentation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chidchanun/bcp",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "BCP Framework - a React full-stack framework with file-based routing, SSR, APIs, middleware, islands, caching and standalone production builds.",
   "type": "module",
   "license": "MIT",

package/packages/client/src/auth.ts

@@ -12,3 +12,18 @@ export {
     type AuthSession,
     type AuthUser,
 } from "../../server/src/auth.js";
+
+export {
+    createAuthGuard,
+    createRoleGuard,
+    getGuardAuth,
+    requireAuth,
+    requireRole,
+
+    type AuthGuardData,
+    type AuthGuardFunction,
+    type AuthGuardResult,
+    type RequireAuthOptions,
+    type RequireRoleOptions,
+    type RequiredRole,
+} from "../../server/src/auth-guard.js";

package/packages/server/src/auth-guard.ts

@@ -0,0 +1,403 @@
+import {
+    auth,
+    type AuthOptions,
+    type AuthSession,
+    type AuthUser,
+} from "./auth.js";
+import {
+    redirect,
+    type RedirectStatus,
+} from "./server-response.js";
+
+export interface AuthGuardData<
+    TUser extends AuthUser = AuthUser,
+    TData extends object = Record<string, never>
+> extends Record<string, unknown> {
+    auth: AuthSession<TUser, TData>;
+}
+
+export interface RequireAuthOptions
+extends AuthOptions {
+    redirectTo?:
+        string |
+        URL |
+        null;
+    redirectStatus?: RedirectStatus;
+}
+
+export interface RequireRoleOptions
+extends RequireAuthOptions {
+    roleField?: string;
+    match?: "any" | "all";
+    forbiddenRedirectTo?:
+        string |
+        URL |
+        null;
+    forbiddenRedirectStatus?: RedirectStatus;
+}
+
+export type RequiredRole =
+    string |
+    readonly string[];
+
+export type AuthGuardResult<
+    TUser extends AuthUser = AuthUser,
+    TData extends object = Record<string, never>
+> =
+    | AuthGuardData<TUser, TData>
+    | Response;
+
+export type AuthGuardFunction<
+    TUser extends AuthUser = AuthUser,
+    TData extends object = Record<string, never>
+> = () => Promise<
+    AuthGuardResult<
+        TUser,
+        TData
+    >
+>;
+
+export async function requireAuth<
+    TUser extends AuthUser = AuthUser,
+    TData extends object = Record<string, never>
+>(
+    options: RequireAuthOptions = {}
+): Promise<AuthGuardResult<TUser, TData>> {
+    const {
+        redirectTo = "/login",
+        redirectStatus = 303,
+        ...authOptions
+    } = options;
+    const session =
+        await auth<
+            TUser,
+            TData
+        >(
+            authOptions
+        );
+
+    if (!session) {
+        if (
+            redirectTo ===
+            null
+        ) {
+            return new Response(
+                "Unauthorized",
+                {
+                    status:
+                        401,
+                }
+            );
+        }
+
+        return redirect(
+            redirectTo,
+            redirectStatus
+        );
+    }
+
+    return {
+        auth:
+            session,
+    };
+}
+
+export async function requireRole<
+    TUser extends AuthUser = AuthUser,
+    TData extends object = Record<string, never>
+>(
+    requiredRole: RequiredRole,
+    options: RequireRoleOptions = {}
+): Promise<AuthGuardResult<TUser, TData>> {
+    const roles =
+        normalizeRequiredRoles(
+            requiredRole
+        );
+    const {
+        roleField = "role",
+        match = "any",
+        forbiddenRedirectTo = null,
+        forbiddenRedirectStatus = 303,
+        ...authOptions
+    } = options;
+    const authenticated =
+        await requireAuth<
+            TUser,
+            TData
+        >(
+            authOptions
+        );
+
+    if (
+        authenticated instanceof
+        Response
+    ) {
+        return authenticated;
+    }
+
+    const assignedRoles =
+        readAssignedRoles(
+            authenticated.auth.user,
+            roleField
+        );
+    const allowed =
+        match === "all"
+            ? roles.every(
+                (role) =>
+                    assignedRoles.includes(
+                        role
+                    )
+            )
+            : roles.some(
+                (role) =>
+                    assignedRoles.includes(
+                        role
+                    )
+            );
+
+    if (!allowed) {
+        if (
+            forbiddenRedirectTo !==
+            null
+        ) {
+            return redirect(
+                forbiddenRedirectTo,
+                forbiddenRedirectStatus
+            );
+        }
+
+        return new Response(
+            "Forbidden",
+            {
+                status:
+                    403,
+            }
+        );
+    }
+
+    return authenticated;
+}
+
+export function createAuthGuard<
+    TUser extends AuthUser = AuthUser,
+    TData extends object = Record<string, never>
+>(
+    options: RequireAuthOptions = {}
+): AuthGuardFunction<TUser, TData> {
+    return () =>
+        requireAuth<
+            TUser,
+            TData
+        >(
+            options
+        );
+}
+
+export function createRoleGuard<
+    TUser extends AuthUser = AuthUser,
+    TData extends object = Record<string, never>
+>(
+    requiredRole: RequiredRole,
+    options: RequireRoleOptions = {}
+): AuthGuardFunction<TUser, TData> {
+    return () =>
+        requireRole<
+            TUser,
+            TData
+        >(
+            requiredRole,
+            options
+        );
+}
+
+export function getGuardAuth<
+    TUser extends AuthUser = AuthUser,
+    TData extends object = Record<string, never>
+>(
+    guardData:
+        Readonly<{
+            auth?: unknown;
+        }>
+): AuthSession<TUser, TData> | null {
+    const value =
+        guardData.auth;
+
+    if (
+        !value ||
+        typeof value !==
+            "object" ||
+        Array.isArray(
+            value
+        )
+    ) {
+        return null;
+    }
+
+    const session =
+        value as Partial<
+            AuthSession<
+                TUser,
+                TData
+            >
+        >;
+
+    if (
+        typeof session.sid !==
+            "string" ||
+        session.sid.trim().length ===
+            0 ||
+        typeof session.iat !==
+            "number" ||
+        !Number.isFinite(
+            session.iat
+        ) ||
+        typeof session.exp !==
+            "number" ||
+        !Number.isFinite(
+            session.exp
+        ) ||
+        !isGuardAuthUser(
+            session.user
+        )
+    ) {
+        return null;
+    }
+
+    return value as
+        AuthSession<
+            TUser,
+            TData
+        >;
+}
+
+function normalizeRequiredRoles(
+    value: RequiredRole
+): string[] {
+    const roles =
+        typeof value ===
+            "string"
+            ? [
+                value,
+            ]
+            : [
+                ...value,
+            ];
+    const normalized =
+        roles.map(
+            (role) =>
+                role.trim()
+        );
+
+    if (
+        normalized.length ===
+            0 ||
+        normalized.some(
+            (role) =>
+                role.length ===
+                0
+        )
+    ) {
+        throw new TypeError(
+            "BCP Auth Guard: required roles must contain non-empty strings."
+        );
+    }
+
+    return Array.from(
+        new Set(
+            normalized
+        )
+    );
+}
+
+function readAssignedRoles(
+    user: AuthUser,
+    roleField: string
+): string[] {
+    const field =
+        roleField.trim();
+
+    if (!field) {
+        throw new TypeError(
+            "BCP Auth Guard: roleField must be a non-empty string."
+        );
+    }
+
+    const value =
+        (
+            user as
+            unknown as
+            Record<string, unknown>
+        )[field];
+
+    if (
+        typeof value ===
+        "string"
+    ) {
+        const role =
+            value.trim();
+
+        return role
+            ? [
+                role,
+            ]
+            : [];
+    }
+
+    if (
+        Array.isArray(
+            value
+        )
+    ) {
+        return value
+            .filter(
+                (
+                    role
+                ): role is string =>
+                    typeof role ===
+                    "string"
+            )
+            .map(
+                (role) =>
+                    role.trim()
+            )
+            .filter(
+                Boolean
+            );
+    }
+
+    return [];
+}
+
+function isGuardAuthUser(
+    value: unknown
+): value is AuthUser {
+    if (
+        !value ||
+        typeof value !==
+            "object" ||
+        Array.isArray(
+            value
+        )
+    ) {
+        return false;
+    }
+
+    const id =
+        (
+            value as
+            Record<string, unknown>
+        ).id;
+
+    return (
+        typeof id ===
+            "string" &&
+        id.trim().length >
+            0
+    ) || (
+        typeof id ===
+            "number" &&
+        Number.isFinite(
+            id
+        )
+    );
+}