@critical-path/server 0.15.0 → 0.17.0

package/src/router.ts

@@ -1,4 +1,9 @@
 import { CriticalPathEngine, type AuthorType, type CriticalPathConfig } from '@critical-path/core';
+import * as schemas from '@critical-path/core/schemas';
+import { buildOpenApiDocument } from './openapi.js';
+
+/** Actor for requests when no `getContext` is configured or it resolves no user. */
+export const ANONYMOUS_ACTOR = Object.freeze({ userId: 'anonymous', username: 'Anonymous', actorType: 'user' as const });
 
 const CORS_ALLOW_METHODS = 'GET, POST, PUT, PATCH, DELETE, OPTIONS';
 const DEFAULT_CORS_ALLOW_HEADERS = ['Content-Type', 'Authorization'];
@@ -51,8 +56,8 @@ export interface CriticalPathRouterOptions {
   exposeErrors?: boolean;
   /**
    * Resolves the caller's identity from the request (session cookie, bearer token, etc.).
-   * When it returns a `userId`, all mutations in the request are attributed to that user and
-   * identity fields in request bodies (`actorId`, `authorId`, `userId`, ...) are ignored.
+   * When it returns a `userId`, all mutations in the request are attributed to that user;
+   * otherwise they are attributed to `ANONYMOUS_ACTOR`. Request bodies never carry identity.
    */
   getContext?: (request: Request) => RequestContext | null | undefined | Promise<RequestContext | null | undefined>;
   /** Reject requests with `401` unless `getContext` returns a `userId`. Defaults to `false`. */
@@ -62,7 +67,10 @@ export interface CriticalPathRouterOptions {
    * When omitted, everything up to the first `/critical-path` segment is stripped.
    */
   basePath?: string;
-  /** CORS policy. Defaults to `{ origins: '*' }`; pass `false` to send no CORS headers. */
+  /**
+   * CORS policy. Defaults to `false` (no CORS headers, so only same-origin browsers can call the
+   * API). Set `{ origins: [...] }` to allow specific sites, or `{ origins: '*' }` for any site.
+   */
   cors?: CorsOptions | false;
 }
 
@@ -90,7 +98,7 @@ export class CriticalPathRouter {
     this.getContext = options.getContext;
     this.requireAuth = options.requireAuth ?? false;
     this.basePath = options.basePath ? '/' + options.basePath.replace(/^\/+|\/+$/g, '') : undefined;
-    this.cors = options.cors === undefined ? { origins: '*' } : options.cors;
+    this.cors = options.cors ?? false;
     if (this.cors && this.cors.origins === '*' && this.cors.credentials) {
       throw new Error('CORS credentials cannot be combined with origins "*"; list the allowed origins instead.');
     }
@@ -168,11 +176,19 @@ export class CriticalPathRouter {
     if (this.requireAuth && !context?.userId) {
       return this.jsonResponse({ error: 'Authentication required' }, 401);
     }
-    const engine = context?.userId
-      ? this.engine.withActor({ userId: context.userId, username: context.userName, actorType: context.actorType })
-      : this.engine;
+    // Every request runs as an actor, so authorship never comes from request bodies.
+    const engine = this.engine.withActor(
+      context?.userId
+        ? { userId: context.userId, username: context.userName, actorType: context.actorType }
+        : ANONYMOUS_ACTOR
+    );
 
     try {
+      // OpenAPI contract (behind the same auth as every other route)
+      if (segments[0] === 'openapi.json' && segments.length === 1 && method === 'GET') {
+        return this.jsonResponse(buildOpenApiDocument({ serverUrl: this.openApiServerUrl(url, subpath) }));
+      }
+
       // Workflows API
       if (segments[0] === 'workflows') {
         const workflowId = segments[1];
@@ -182,7 +198,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ workflows });
           }
           if (method === 'POST') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.CreateWorkflowSchema);
             const workflow = await engine.createWorkflow(body);
             return this.jsonResponse({ workflow }, 201);
           }
@@ -193,7 +209,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ workflow });
           }
           if (method === 'PATCH' || method === 'PUT') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.UpdateWorkflowSchema);
             const updated = await engine.updateWorkflow(workflowId, body);
             if (!updated) return this.jsonResponse({ error: 'Workflow not found' }, 404);
             return this.jsonResponse({ workflow: updated });
@@ -216,7 +232,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ projects });
           }
           if (method === 'POST') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.CreateProjectSchema);
             const project = await engine.createProject(body);
             return this.jsonResponse({ project }, 201);
           }
@@ -261,7 +277,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ project });
           }
           if (method === 'PATCH' || method === 'PUT') {
-            const { id: _id, createdAt: _createdAt, updatedAt: _updatedAt, ...updates } = await this.readJson(request);
+            const updates = await this.readBody(request, schemas.UpdateProjectSchema);
             const project = await engine.updateProject(projectId, updates);
             if (!project) return this.jsonResponse({ error: 'Project not found' }, 404);
             return this.jsonResponse({ project });
@@ -286,7 +302,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ tasks });
           }
           if (method === 'POST') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.CreateTaskSchema);
             const task = await engine.createTask(body);
             return this.jsonResponse({ task }, 201);
           }
@@ -296,8 +312,8 @@ export class CriticalPathRouter {
             return this.jsonResponse({ comments });
           }
           if (method === 'POST') {
-            const body = await this.readJson(request);
-            const comment = await engine.addComment({ ...body, taskId });
+            const body = await this.readBody(request, schemas.CreateCommentSchema, { taskId });
+            const comment = await engine.addComment(body);
             return this.jsonResponse({ comment }, 201);
           }
         } else if (subResource === 'attachments') {
@@ -306,8 +322,8 @@ export class CriticalPathRouter {
             return this.jsonResponse({ attachments });
           }
           if (method === 'POST') {
-            const body = await this.readJson(request);
-            const attachment = await engine.createAttachment({ ...body, taskId });
+            const body = await this.readBody(request, schemas.CreateAttachmentSchema, { taskId });
+            const attachment = await engine.createAttachment(body);
             return this.jsonResponse({ attachment }, 201);
           }
         } else if (subResource === 'dependencies') {
@@ -316,10 +332,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ graph });
           }
           if (method === 'POST') {
-            const body = await this.readJson(request);
-            if (typeof body.dependsOnTaskId !== 'string' || !body.dependsOnTaskId) {
-              return this.jsonResponse({ error: 'dependsOnTaskId is required' }, 400);
-            }
+            const body = await this.readBody(request, schemas.CreateDependencySchema);
             const dep = await engine.addDependency({
               taskId,
               dependsOnTaskId: body.dependsOnTaskId,
@@ -364,7 +377,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ task });
           }
           if (method === 'PATCH' || method === 'PUT') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.UpdateTaskSchema);
             const updated = await engine.updateTask(taskId, body);
             if (!updated) return this.jsonResponse({ error: 'Task not found' }, 404);
             return this.jsonResponse({ task: updated });
@@ -386,7 +399,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ teams });
           }
           if (method === 'POST') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.CreateTeamSchema);
             const team = await engine.createTeam(body);
             return this.jsonResponse({ team }, 201);
           }
@@ -397,7 +410,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ team });
           }
           if (method === 'PATCH' || method === 'PUT') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.UpdateTeamSchema);
             const updated = await engine.updateTeam(teamId, body);
             if (!updated) return this.jsonResponse({ error: 'Team not found' }, 404);
             return this.jsonResponse({ team: updated });
@@ -421,7 +434,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ containers });
           }
           if (method === 'POST') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.CreateContainerSchema);
             const container = await engine.createContainer(body);
             return this.jsonResponse({ container }, 201);
           }
@@ -432,7 +445,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ container });
           }
           if (method === 'PATCH' || method === 'PUT') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.UpdateContainerSchema);
             const updated = await engine.updateContainer(containerId, body);
             if (!updated) return this.jsonResponse({ error: 'Container not found' }, 404);
             return this.jsonResponse({ container: updated });
@@ -456,7 +469,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ deliverables });
           }
           if (method === 'POST') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.CreateDeliverableSchema);
             const deliverable = await engine.createDeliverable(body);
             return this.jsonResponse({ deliverable }, 201);
           }
@@ -473,7 +486,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ deliverable });
           }
           if (method === 'PATCH' || method === 'PUT') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.UpdateDeliverableSchema);
             const updated = await engine.updateDeliverable(deliverableId, body);
             if (!updated) return this.jsonResponse({ error: 'Deliverable not found' }, 404);
             return this.jsonResponse({ deliverable: updated });
@@ -497,7 +510,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ iterations });
           }
           if (method === 'POST') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.CreateIterationSchema);
             const iteration = await engine.createIteration(body);
             return this.jsonResponse({ iteration }, 201);
           }
@@ -508,7 +521,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ iteration });
           }
           if (method === 'PATCH' || method === 'PUT') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.UpdateIterationSchema);
             const updated = await engine.updateIteration(iterationId, body);
             if (!updated) return this.jsonResponse({ error: 'Iteration not found' }, 404);
             return this.jsonResponse({ iteration: updated });
@@ -537,28 +550,17 @@ export class CriticalPathRouter {
         const subResource = segments[2];
         if (commentId && subResource === 'reactions') {
           if (method === 'POST') {
-            const body = await this.readJson(request);
-            const userId = context?.userId ?? body.userId;
-            if (!body.emoji || !userId) {
-              return this.jsonResponse({ error: 'emoji and userId are required' }, 400);
-            }
-            const comment = await engine.addCommentReaction(commentId, { emoji: body.emoji, userId });
+            const body = await this.readBody(request, schemas.CommentReactionSchema);
+            const comment = await engine.addCommentReaction(commentId, body);
             if (!comment) return this.jsonResponse({ error: 'Comment not found' }, 404);
             return this.jsonResponse({ comment }, 200);
           }
           if (method === 'DELETE') {
-            let body: any = {};
-            try {
-              body = await this.readJson(request);
-            } catch {
-              // Body may be empty on DELETE, fallback to searchParams
-            }
-            const emoji = body.emoji || url.searchParams.get('emoji');
-            const userId = context?.userId ?? (body.userId || url.searchParams.get('userId'));
-            if (!emoji || !userId) {
-              return this.jsonResponse({ error: 'emoji and userId are required' }, 400);
+            const emoji = url.searchParams.get('emoji');
+            if (!emoji) {
+              return this.jsonResponse({ error: 'emoji query parameter is required' }, 400);
             }
-            const comment = await engine.removeCommentReaction(commentId, { emoji, userId });
+            const comment = await engine.removeCommentReaction(commentId, { emoji });
             if (!comment) return this.jsonResponse({ error: 'Comment not found' }, 404);
             return this.jsonResponse({ comment }, 200);
           }
@@ -570,7 +572,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ comments });
           }
           if (method === 'POST') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.CreateCommentSchema);
             const comment = await engine.addComment(body);
             return this.jsonResponse({ comment }, 201);
           }
@@ -581,7 +583,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ comment });
           }
           if (method === 'PATCH' || method === 'PUT') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.UpdateCommentSchema);
             const updated = await engine.updateComment(commentId, body);
             if (!updated) return this.jsonResponse({ error: 'Comment not found' }, 404);
             return this.jsonResponse({ comment: updated });
@@ -599,13 +601,13 @@ export class CriticalPathRouter {
         const attachmentId = segments[1];
         if (attachmentId === 'presign') {
           if (method === 'POST') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.PresignAttachmentSchema);
             const presigned = await engine.getPresignedAttachmentUploadUrl(body);
             return this.jsonResponse({ presigned });
           }
         } else if (attachmentId === 'upload') {
           if (method === 'POST') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.UploadAttachmentSchema);
             const attachment = await engine.uploadAttachmentFile(body);
             return this.jsonResponse({ attachment }, 201);
           }
@@ -618,7 +620,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ attachments });
           }
           if (method === 'POST') {
-            const body = await this.readJson(request);
+            const body = await this.readBody(request, schemas.CreateAttachmentSchema);
             const attachment = await engine.createAttachment(body);
             return this.jsonResponse({ attachment }, 201);
           }
@@ -645,7 +647,7 @@ export class CriticalPathRouter {
           return this.jsonResponse({ timeEntries: entries });
         }
         if (method === 'POST') {
-          const body = await this.readJson(request);
+          const body = await this.readBody(request, schemas.LogTimeSchema);
           const entry = await engine.logTime(body);
           return this.jsonResponse({ timeEntry: entry }, 201);
         }
@@ -709,6 +711,26 @@ export class CriticalPathRouter {
     }
   }
 
+  /**
+   * Reads and validates a JSON body. `overrides` (e.g. a `taskId` from the URL) are applied before
+   * validation so path parameters always win over body fields.
+   */
+  private async readBody<S extends { safeParse(data: unknown): unknown }>(
+    request: Request,
+    schema: S,
+    overrides: Record<string, unknown> = {}
+  ): Promise<S extends { _output: infer O } ? O : never> {
+    const raw = await this.readJson(request);
+    const body = raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {};
+    return schemas.parsePayload(schema as any, { ...body, ...overrides });
+  }
+
+  /** The API root as seen by this request, e.g. `https://host/api/critical-path`. */
+  private openApiServerUrl(url: URL, subpath: string): string {
+    const root = url.pathname.slice(0, url.pathname.length - subpath.length).replace(/\/+$/, '');
+    return `${url.origin}${root}`;
+  }
+
   private async readJson(request: Request): Promise<any> {
     try {
       return await request.json();
@@ -723,9 +745,10 @@ export class CriticalPathRouter {
 
     switch (name) {
       case 'BadRequestError':
-      case 'ValidationError':
       case 'AttachmentValidationError':
         return this.jsonResponse({ error: e.message }, 400);
+      case 'ValidationError':
+        return this.jsonResponse(e.issues ? { error: e.message, issues: e.issues } : { error: e.message }, 400);
       case 'WorkflowValidationError':
         return this.jsonResponse({ error: e.message, fromStatus: e.fromStatus, toStatus: e.toStatus }, 400);
       case 'CustomFieldValidationError':

package/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["./src/index.test.ts","./src/index.ts","./src/router.ts","./src/adapters/next.ts","./src/adapters/sveltekit.ts","./src/adapters/universal.ts"],"version":"5.9.3"}
+{"root":["./src/index.test.ts","./src/index.ts","./src/openapi.test.ts","./src/openapi.ts","./src/router.ts","./src/adapters/next.ts","./src/adapters/sveltekit.ts","./src/adapters/universal.ts"],"version":"5.9.3"}