@contractkit/plugin-typescript 0.24.0 → 0.25.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contractkit/plugin-typescript",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "ContractKit built-in plugin: TypeScript codegen (SDK clients, Koa routers, Zod schemas, plain types)",
   "author": {
     "name": "Marooned Software",
@@ -26,7 +26,7 @@
     ".": "./dist/index.js"
   },
   "dependencies": {
-    "@contractkit/core": "0.17.0"
+    "@contractkit/core": "0.18.0"
   },
   "devDependencies": {
     "@repo/config-eslint": "0.3.1",

package/src/codegen-operation.ts

@@ -137,9 +137,9 @@ export function generateOp(root: OpRootNode, options: OpCodegenOptions = {}): st
     // before deciding whether to emit the zod import.
     const body: string[] = [];
     const needsSignature = fileNeedsSignature(root);
-    const needsSecurity = fileNeedsSecurity(root);
+    const needsPolicy = fileNeedsPolicy(root);
     const koaImports = ['ServerKitRouter', 'bodyParserMiddleware'];
-    if (needsSecurity) koaImports.push('requireSecurity');
+    if (needsPolicy) koaImports.push('requirePolicy');
     if (needsSignature) koaImports.push('requireSignature');
     body.push(`import { ${koaImports.join(', ')} } from '@maroonedsoftware/koa';`);
 
@@ -241,8 +241,14 @@ function generateHandler(route: OpRouteNode, op: OpOperationNode, root: OpRootNo
     // Middleware list
     const middlewares: string[] = [];
     if (effectiveSecurity !== SECURITY_NONE) {
-        const args = effectiveSecurity && effectiveSecurity.requireMfa !== undefined ? `{ requireMfa: ${effectiveSecurity.requireMfa} }` : '';
-        middlewares.push(`requireSecurity(${args})`);
+        const policy = effectiveSecurity?.policy;
+        const args =
+            policy === undefined
+                ? ''
+                : policy === false
+                  ? '{ policy: false }'
+                  : `{ policy: '${policy}' }`;
+        middlewares.push(`requirePolicy(${args})`);
     }
     if (hasBody) {
         const parserTokens = Array.from(new Set(bodies.map(b => bodyParserToken(b.contentType))));
@@ -761,7 +767,7 @@ function routeNeedsValidation(root: OpRootNode): boolean {
     );
 }
 
-function fileNeedsSecurity(root: OpRootNode): boolean {
+function fileNeedsPolicy(root: OpRootNode): boolean {
     return root.routes.some(route => route.operations.some(op => resolveSecurity(route, op, root) !== SECURITY_NONE));
 }
 

package/tests/codegen-operation.test.ts

@@ -807,9 +807,9 @@ describe('generateOp — route modifiers JSDoc', () => {
             expect(out).toContain('anonymous access, no security required');
         });
 
-        it('emits no annotation for security with requireMfa', () => {
+        it('emits no annotation for security with policy', () => {
             const op = opOperation('get', {
-                security: { requireMfa: true, loc: { file: 'test.op', line: 1 } },
+                security: { policy: 'paymentsWrite', loc: { file: 'test.op', line: 1 } },
             });
             const root = opRoot([opRoute('/users', [op])]);
             const out = generateOp(root);
@@ -845,7 +845,7 @@ describe('generateOp — route modifiers JSDoc', () => {
             });
             const root = opRoot([opRoute('/webhooks', [op])]);
             const out = generateOp(root);
-            expect(out).toContain(`import { ServerKitRouter, bodyParserMiddleware, requireSecurity, requireSignature }`);
+            expect(out).toContain(`import { ServerKitRouter, bodyParserMiddleware, requirePolicy, requireSignature }`);
             expect(out).toContain(`requireSignature('MODERN_TREASURY_WEBHOOK')`);
         });
 
@@ -867,63 +867,63 @@ describe('generateOp — route modifiers JSDoc', () => {
 
         it('does not import requireSignature when no signature is set', () => {
             const op = opOperation('get', {
-                security: { requireMfa: true, loc: { file: 'test.op', line: 1 } },
+                security: { policy: 'paymentsWrite', loc: { file: 'test.op', line: 1 } },
             });
             const root = opRoot([opRoute('/users', [op])]);
             const out = generateOp(root);
             expect(out).not.toContain('requireSignature');
-            expect(out).toContain(`import { ServerKitRouter, bodyParserMiddleware, requireSecurity }`);
+            expect(out).toContain(`import { ServerKitRouter, bodyParserMiddleware, requirePolicy }`);
         });
     });
 
-    // ─── Security (requireMfa) middleware ───────────────────────────
+    // ─── Policy middleware ──────────────────────────────────────────
 
-    describe('security middleware', () => {
-        it('injects requireSecurity() with no args for unannotated routes', () => {
+    describe('policy middleware', () => {
+        it('injects requirePolicy() with no args for unannotated routes', () => {
             const op = opOperation('get');
             const root = opRoot([opRoute('/users', [op])]);
             const out = generateOp(root);
-            expect(out).toContain(`import { ServerKitRouter, bodyParserMiddleware, requireSecurity }`);
-            expect(out).toContain(`requireSecurity()`);
+            expect(out).toContain(`import { ServerKitRouter, bodyParserMiddleware, requirePolicy }`);
+            expect(out).toContain(`requirePolicy()`);
         });
 
-        it('injects requireSecurity with requireMfa: true when set', () => {
+        it('injects requirePolicy with a named policy when set', () => {
             const op = opOperation('get', {
-                security: { requireMfa: true, loc: { file: 'test.op', line: 1 } },
+                security: { policy: 'paymentsWrite', loc: { file: 'test.op', line: 1 } },
             });
             const root = opRoot([opRoute('/users', [op])]);
             const out = generateOp(root);
-            expect(out).toContain(`requireSecurity({ requireMfa: true })`);
+            expect(out).toContain(`requirePolicy({ policy: 'paymentsWrite' })`);
         });
 
-        it('injects requireSecurity with requireMfa: false when set', () => {
+        it('injects requirePolicy with policy: false when explicitly bypassed', () => {
             const op = opOperation('get', {
-                security: { requireMfa: false, loc: { file: 'test.op', line: 1 } },
+                security: { policy: false, loc: { file: 'test.op', line: 1 } },
             });
             const routeLine = generateOp(opRoot([opRoute('/users', [op])]))
                 .split('\n')
                 .find(l => l.includes('.get('));
-            expect(routeLine).toContain(`requireSecurity({ requireMfa: false })`);
+            expect(routeLine).toContain(`requirePolicy({ policy: false })`);
         });
 
-        it('does not inject requireSecurity for public (security: none) routes', () => {
+        it('does not inject requirePolicy for public (security: none) routes', () => {
             const op = opOperation('get', { security: SECURITY_NONE });
             const root = opRoot([opRoute('/health', [op])]);
             const out = generateOp(root);
-            expect(out).not.toContain('requireSecurity');
+            expect(out).not.toContain('requirePolicy');
         });
 
-        it('does not import requireSecurity when all routes are public', () => {
+        it('does not import requirePolicy when all routes are public', () => {
             const op = opOperation('get', { security: SECURITY_NONE });
             const root = opRoot([opRoute('/health', [op])]);
             const out = generateOp(root);
             expect(out).toContain(`import { ServerKitRouter, bodyParserMiddleware }`);
-            expect(out).not.toContain('requireSecurity');
+            expect(out).not.toContain('requirePolicy');
         });
 
-        it('places requireSecurity before bodyParserMiddleware in the route line', () => {
+        it('places requirePolicy before bodyParserMiddleware in the route line', () => {
             const op = opOperation('post', {
-                security: { requireMfa: true, loc: { file: 'test.op', line: 1 } },
+                security: { policy: 'paymentsWrite', loc: { file: 'test.op', line: 1 } },
                 request: opRequest('Payload'),
             });
             const root = opRoot([opRoute('/users', [op])]);
@@ -931,16 +931,16 @@ describe('generateOp — route modifiers JSDoc', () => {
                 .split('\n')
                 .find(l => l.includes('.post('));
             expect(routeLine).toBeDefined();
-            const secIdx = routeLine!.indexOf(`requireSecurity`);
+            const polIdx = routeLine!.indexOf(`requirePolicy`);
             const bodyIdx = routeLine!.indexOf(`bodyParserMiddleware`);
-            expect(secIdx).toBeGreaterThan(-1);
-            expect(bodyIdx).toBeGreaterThan(secIdx);
+            expect(polIdx).toBeGreaterThan(-1);
+            expect(bodyIdx).toBeGreaterThan(polIdx);
         });
 
-        it('places requireSecurity before requireSignature when both are set', () => {
+        it('places requirePolicy before requireSignature when both are set', () => {
             const op = opOperation('post', {
                 signature: 'MY_KEY',
-                security: { requireMfa: true, loc: { file: 'test.op', line: 1 } },
+                security: { policy: 'paymentsWrite', loc: { file: 'test.op', line: 1 } },
                 request: opRequest('Payload'),
             });
             const root = opRoot([opRoute('/webhooks', [op])]);
@@ -948,30 +948,30 @@ describe('generateOp — route modifiers JSDoc', () => {
                 .split('\n')
                 .find(l => l.includes('.post('));
             expect(routeLine).toBeDefined();
-            const secIdx = routeLine!.indexOf(`requireSecurity`);
+            const polIdx = routeLine!.indexOf(`requirePolicy`);
             const sigIdx = routeLine!.indexOf(`requireSignature`);
-            expect(secIdx).toBeGreaterThan(-1);
-            expect(sigIdx).toBeGreaterThan(secIdx);
+            expect(polIdx).toBeGreaterThan(-1);
+            expect(sigIdx).toBeGreaterThan(polIdx);
         });
 
-        it('imports both requireSecurity and requireSignature when both are set', () => {
+        it('imports both requirePolicy and requireSignature when both are set', () => {
             const op = opOperation('post', {
                 signature: 'MY_KEY',
-                security: { requireMfa: true, loc: { file: 'test.op', line: 1 } },
+                security: { policy: 'paymentsWrite', loc: { file: 'test.op', line: 1 } },
                 request: opRequest('Payload'),
             });
             const root = opRoot([opRoute('/webhooks', [op])]);
             const out = generateOp(root);
-            expect(out).toContain(`import { ServerKitRouter, bodyParserMiddleware, requireSecurity, requireSignature }`);
+            expect(out).toContain(`import { ServerKitRouter, bodyParserMiddleware, requirePolicy, requireSignature }`);
         });
 
-        it('works with route-level requireMfa security', () => {
+        it('works with route-level policy security', () => {
             const op = opOperation('get');
             const route = opRoute('/users', [op]);
-            route.security = { requireMfa: true, loc: { file: 'test.op', line: 1 } };
+            route.security = { policy: 'paymentsWrite', loc: { file: 'test.op', line: 1 } };
             const root = opRoot([route]);
             const out = generateOp(root);
-            expect(out).toContain(`requireSecurity({ requireMfa: true })`);
+            expect(out).toContain(`requirePolicy({ policy: 'paymentsWrite' })`);
         });
     });
 });