@crowi/api 2.0.0-alpha.0

package/dist/hono/index.js

@@ -0,0 +1,240 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildHonoApp = exports.honoOnError = exports.defaultHook = exports.createJwtAuth = exports.createJwtAdminRequired = exports.createHonoApp = void 0;
+const app_1 = require("./app");
+const attach_1 = require("../mcp/attach");
+const cors_1 = require("./middleware/cors");
+const adminCrypto_1 = require("./handlers/adminCrypto");
+const app_2 = require("./handlers/admin/app");
+const auth_1 = require("./handlers/admin/auth");
+const mail_1 = require("./handlers/admin/mail");
+const plugins_1 = require("./handlers/admin/plugins");
+const search_1 = require("./handlers/admin/search");
+const security_1 = require("./handlers/admin/security");
+const storage_1 = require("./handlers/admin/storage");
+const users_1 = require("./handlers/admin/users");
+const access_token_1 = require("./handlers/access-token");
+const app_3 = require("./handlers/app");
+const attachment_1 = require("./handlers/attachment");
+const attachment_stream_1 = require("./handlers/attachment-stream");
+const autocomplete_1 = require("./handlers/autocomplete");
+const backlink_1 = require("./handlers/backlink");
+const bookmark_1 = require("./handlers/bookmark");
+const comment_1 = require("./handlers/comment");
+const draft_1 = require("./handlers/draft");
+const installer_1 = require("./handlers/installer");
+const me_1 = require("./handlers/me");
+const notification_1 = require("./handlers/notification");
+const oauth_1 = require("./handlers/oauth");
+const page_1 = require("./handlers/page");
+const page_collab_1 = require("./handlers/page-collab");
+const page_preview_1 = require("./handlers/page-preview");
+const presence_1 = require("./handlers/presence");
+const revision_1 = require("./handlers/revision");
+const search_2 = require("./handlers/search");
+const tokenAuth_1 = require("./handlers/tokenAuth");
+const inviteAccept_1 = require("./handlers/inviteAccept");
+const passwordReset_1 = require("./handlers/passwordReset");
+const activation_1 = require("./handlers/activation");
+const emailChange_1 = require("./handlers/emailChange");
+const user_1 = require("./handlers/user");
+var app_4 = require("./app");
+Object.defineProperty(exports, "createHonoApp", { enumerable: true, get: function () { return app_4.createHonoApp; } });
+Object.defineProperty(exports, "createJwtAdminRequired", { enumerable: true, get: function () { return app_4.createJwtAdminRequired; } });
+Object.defineProperty(exports, "createJwtAuth", { enumerable: true, get: function () { return app_4.createJwtAuth; } });
+Object.defineProperty(exports, "defaultHook", { enumerable: true, get: function () { return app_4.defaultHook; } });
+Object.defineProperty(exports, "honoOnError", { enumerable: true, get: function () { return app_4.honoOnError; } });
+/**
+ * Build the Hono application chain.
+ *
+ * Phase 4 commits extend this chain by wrapping the previous return
+ * value with the next `registerXRoutes(...)`. Keeping the entire chain
+ * inside a single expression preserves OpenAPIHono's per-route type
+ * accumulation, which keeps the contract `AppType` and the runtime
+ * chain in lock-step.
+ *
+ * Order doesn't affect routing (Hono dispatches by `method + path`) but
+ * we keep it aligned with the contract stub chain in
+ * `packages/api-contract/src/client.ts` so the two are easy to eyeball
+ * for drift.
+ */
+const buildHonoApp = (crowi) => {
+    const base = (0, app_1.createHonoApp)();
+    // RFC-0006 Phase 6 Sub-batch D — Hono is the sole HTTP host, so
+    // this CORS apply is the only CORS layer in the process. The Express
+    // bridge that previously also ran `cors()` is gone.
+    //
+    // `app.use('*', ...)` mutates the underlying Hono instance — it
+    // doesn't extend the typed openapi chain — so we install before
+    // any `register*Routes(...)` calls.
+    base.use('*', (0, cors_1.createCors)(crowi));
+    const withApp = (0, app_3.registerAppRoutes)(base, crowi);
+    const withInstaller = (0, installer_1.registerInstallerRoutes)(withApp, crowi);
+    const withTokenAuth = (0, tokenAuth_1.registerTokenAuthRoutes)(withInstaller, crowi);
+    // Public invite-acceptance (token is the credential) — register before
+    // the auth-gated me/user routes.
+    const withInviteAccept = (0, inviteAccept_1.registerInviteAcceptRoutes)(withTokenAuth, crowi);
+    // Public self-service password reset (token is the credential).
+    const withPasswordReset = (0, passwordReset_1.registerPasswordResetRoutes)(withInviteAccept, crowi);
+    // Public account activation (email confirmation; token is the credential).
+    const withActivation = (0, activation_1.registerActivationRoutes)(withPasswordReset, crowi);
+    // Public email-change confirmation (token is the credential).
+    const withEmailChange = (0, emailChange_1.registerEmailChangeRoutes)(withActivation, crowi);
+    const withMe = (0, me_1.registerMeRoutes)(withEmailChange, crowi);
+    // RFC-0010 Phase 2 — PAT management (`/me/access-tokens`). MUST follow
+    // `registerMeRoutes`: it rides that handler's broad `/me/*` jwtAuth
+    // apply rather than installing its own (avoids a second User.findById).
+    const withAccessToken = (0, access_token_1.registerAccessTokenRoutes)(withMe, crowi);
+    // RFC-0010 Phase 3/4 — OAuth authorization-server endpoints. `/oauth/token`,
+    // `/oauth/revoke`, `/.well-known/oauth-authorization-server`,
+    // `/oauth/device/authorize` and `GET /oauth/device` are public;
+    // `/oauth/authorize` and `/oauth/device/verify` install their own per-path
+    // `createJwtAuth` (no prefix overlap with any other handler's broad apply,
+    // so they are self-contained).
+    const withOAuth = (0, oauth_1.registerOAuthRoutes)(withAccessToken, crowi);
+    const withUser = (0, user_1.registerUserRoutes)(withOAuth, crowi);
+    const withBookmark = (0, bookmark_1.registerBookmarkRoutes)(withUser, crowi);
+    const withBacklink = (0, backlink_1.registerBacklinkRoutes)(withBookmark, crowi);
+    const withComment = (0, comment_1.registerCommentRoutes)(withBacklink, crowi);
+    // Revision MUST register before page / page-preview / pageCollab /
+    // presence: it owns the `app.use('/pages/*', createJwtAuth(crowi))`
+    // broad apply, and the downstream `/pages/*` handlers rely on that
+    // already-installed middleware (Hono does not dedupe middleware by
+    // reference — re-installing would cost a second JWT verify +
+    // User.findById per request).
+    const withRevision = (0, revision_1.registerRevisionRoutes)(withComment, crowi);
+    const withPage = (0, page_1.registerPageRoutes)(withRevision, crowi);
+    const withPagePreview = (0, page_preview_1.registerPagePreviewRoutes)(withPage, crowi);
+    // pageCollab (RFC-0003 wsToken) + presence (RFC-0005 token + likers)
+    // both attach `/pages/{id}/<suffix>` endpoints under the shared
+    // jwtAuth apply. presence depends on the same prefix as pageCollab
+    // so we keep them grouped; their relative order is irrelevant to
+    // routing (Hono dispatches by method+path) but mirrors the spec
+    // chain in `packages/api-contract/src/client.ts`.
+    const withPageCollab = (0, page_collab_1.registerPageCollabRoutes)(withPagePreview, crowi);
+    const withPresence = (0, presence_1.registerPresenceRoutes)(withPageCollab, crowi);
+    // Batch 6 — draft / autocomplete / attachment (RFC-0004). draft +
+    // `/pages/autocomplete` ride on the revision-owned `/pages/*` jwtAuth
+    // apply (same dedupe-avoidance rationale as page / page-preview /
+    // pageCollab / presence). autocomplete installs jwtAuth on the
+    // singleton `/users/autocomplete` literal itself; attachment installs
+    // jwtAuth + rate-limit on `/attachments/*`. Rate limiting wraps the
+    // two autocomplete endpoints (60/min) and `uploadAttachment` (20/min).
+    const withDraft = (0, draft_1.registerDraftRoutes)(withPresence, crowi);
+    const withAutocomplete = (0, autocomplete_1.registerAutocompleteRoutes)(withDraft, crowi);
+    const withAttachment = (0, attachment_1.registerAttachmentRoutes)(withAutocomplete, crowi);
+    // RFC-0006 Phase 6 Sub-batch D — raw streaming attachment routes
+    // (`GET /attachments/by-key/:key`, `GET /attachments/:id`). Hono
+    // native via `Readable.toWeb`, no Express bridge. Registers
+    // alongside the JSON attachment routes; the literal `:id{24-hex}`
+    // pattern keeps them disjoint from `/attachments/upload` /
+    // `/attachments/:id/meta`. Mutates the underlying instance
+    // (returns `app` unchanged-as-type), so registering after
+    // `registerAttachmentRoutes` is fine — both share the same
+    // jwt-auth broad apply.
+    (0, attachment_stream_1.registerAttachmentStreamRoutes)(withAttachment, crowi);
+    // Batch 7 — search. Singleton literal path `/search` (OUTSIDE the
+    // revision-owned `/pages/*` apply). The handler installs jwtAuth on
+    // the literal path itself, same single-route install pattern as
+    // `/users/autocomplete`. No rate limit.
+    const withSearch = (0, search_2.registerSearchRoutes)(withAttachment, crowi);
+    // Batch 8 — adminCrypto. Two literal paths under `/admin/crypto/*`,
+    // admin-only (first time `createJwtAdminRequired` lands on Hono).
+    const withAdminCrypto = (0, adminCrypto_1.registerAdminCryptoRoutes)(withSearch, crowi);
+    // Batch 9 — the 8 admin sub-contracts (app / auth / security / mail /
+    // storage / search / users / plugins). Each handler installs
+    // `createJwtAdminRequired(crowi)` broadly on its `/admin/<sub>/*`
+    // prefix + the bare `/admin/<sub>` path. No prefix overlap between
+    // sub-contracts (every one owns a distinct second-segment literal),
+    // so the broad apply pattern is safe.
+    const withAdminApp = (0, app_2.registerAdminAppRoutes)(withAdminCrypto, crowi);
+    const withAdminAuth = (0, auth_1.registerAdminAuthRoutes)(withAdminApp, crowi);
+    const withAdminSecurity = (0, security_1.registerAdminSecurityRoutes)(withAdminAuth, crowi);
+    const withAdminMail = (0, mail_1.registerAdminMailRoutes)(withAdminSecurity, crowi);
+    const withAdminStorage = (0, storage_1.registerAdminStorageRoutes)(withAdminMail, crowi);
+    const withAdminSearch = (0, search_1.registerAdminSearchRoutes)(withAdminStorage, crowi);
+    const withAdminUsers = (0, users_1.registerAdminUsersRoutes)(withAdminSearch, crowi);
+    const withAdminPlugins = (0, plugins_1.registerAdminPluginsRoutes)(withAdminUsers, crowi);
+    const withNotification = (0, notification_1.registerNotificationRoutes)(withAdminPlugins, crowi);
+    // RFC-0011 — built-in MCP server. `/mcp` is a normal Hono route (not a
+    // WS upgrade), so it is attached here alongside the other handler
+    // registration rather than in the post-`buildServer` WS-attach phase.
+    // It mounts `app.all('/mcp', …)` under `createJwtAuth(crowi)` + a
+    // per-user rate limit; each tool dispatches in-process to the existing
+    // scoped routes (`honoApp.request`). `/mcp` is JSON-RPC, not a REST
+    // contract, so it is intentionally NOT added to the OpenAPI document.
+    // `attachMcp` mutates the underlying Hono instance (it does not extend
+    // the typed openapi chain), so it is called for its side-effect.
+    (0, attach_1.attachMcp)(withNotification, crowi);
+    // RFC-0006 Phase 6 — expose the runtime OpenAPI 3.1 document at
+    // `/api/v2/openapi.json` and the Scalar API Reference UI at
+    // `/api/v2/docs`. The doc is built from the handlers actually
+    // registered above (vs. the bare scaffold in
+    // `packages/api-contract/scripts/generate-openapi.ts` which emits the
+    // commit-tracked artefact), so admins always see the live shape.
+    //
+    // We intentionally call `.doc31` / `.get` on the chained app for
+    // their side-effect only — capturing the return type would extend
+    // an already-TS2589-deep chain. The mutation registers the routes
+    // on the same underlying Hono instance, which is what consumers
+    // observe at runtime.
+    //
+    // Scalar (`@scalar/hono-api-reference`) is ESM-only with a `.js`
+    // extension, which Jest's CJS runtime cannot statically parse. We
+    // dynamic-import it from a lazy wrapper middleware so test files
+    // that boot the api process don't trip a transform error. The
+    // handler is registered eagerly; the import only runs on the first
+    // `GET /api/v2/docs` request.
+    withNotification.doc31('/openapi.json', {
+        openapi: '3.1.0',
+        info: {
+            title: 'Crowi API',
+            description: 'API for Crowi - Markdown-based Wiki Application',
+            version: '2.0.0',
+        },
+    });
+    let scalarHandler = null;
+    withNotification.get('/docs', async (c, next) => {
+        if (scalarHandler == null) {
+            const { Scalar } = await Promise.resolve().then(() => __importStar(require('@scalar/hono-api-reference')));
+            scalarHandler = Scalar({ url: '/api/v2/openapi.json' });
+        }
+        return scalarHandler(c, next);
+    });
+    return withNotification;
+};
+exports.buildHonoApp = buildHonoApp;
+//# sourceMappingURL=index.js.map

package/dist/hono/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/hono/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,+BAAsC;AACtC,0CAA0C;AAC1C,4CAA+C;AAC/C,wDAAmE;AACnE,8CAA8D;AAC9D,gDAAgE;AAChE,gDAAgE;AAChE,sDAAsE;AACtE,oDAAoE;AACpE,wDAAwE;AACxE,sDAAsE;AACtE,kDAAkE;AAClE,0DAAoE;AACpE,wCAAmD;AACnD,sDAAiE;AACjE,oEAA8E;AAC9E,0DAAqE;AACrE,kDAA6D;AAC7D,kDAA6D;AAC7D,gDAA2D;AAC3D,4CAAuD;AACvD,oDAA+D;AAC/D,sCAAiD;AACjD,0DAAqE;AACrE,4CAAuD;AACvD,0CAAqD;AACrD,wDAAkE;AAClE,0DAAoE;AACpE,kDAA6D;AAC7D,kDAA6D;AAC7D,8CAAyD;AACzD,oDAA+D;AAC/D,0DAAqE;AACrE,4DAAuE;AACvE,sDAAiE;AACjE,wDAAmE;AACnE,0CAAqD;AAErD,6BAAuG;AAA9F,oGAAA,aAAa,OAAA;AAAE,6GAAA,sBAAsB,OAAA;AAAE,oGAAA,aAAa,OAAA;AAAE,kGAAA,WAAW,OAAA;AAAE,kGAAA,WAAW,OAAA;AAGvF;;;;;;;;;;;;;GAaG;AACI,MAAM,YAAY,GAAG,CAAC,KAAY,EAAE,EAAE;IAC3C,MAAM,IAAI,GAAG,IAAA,mBAAa,GAAE,CAAC;IAC7B,gEAAgE;IAChE,qEAAqE;IACrE,oDAAoD;IACpD,EAAE;IACF,gEAAgE;IAChE,gEAAgE;IAChE,oCAAoC;IACpC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAA,iBAAU,EAAC,KAAK,CAAC,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAA,uBAAiB,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,IAAA,mCAAuB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,IAAA,mCAAuB,EAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACpE,uEAAuE;IACvE,iCAAiC;IACjC,MAAM,gBAAgB,GAAG,IAAA,yCAA0B,EAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC1E,gEAAgE;IAChE,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC/E,2EAA2E;IAC3E,MAAM,cAAc,GAAG,IAAA,qCAAwB,EAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC1E,8DAA8D;IAC9D,MAAM,eAAe,GAAG,IAAA,uCAAyB,EAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,IAAA,qBAAgB,EAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACxD,uEAAuE;IACvE,oEAAoE;IACpE,wEAAwE;IACxE,MAAM,eAAe,GAAG,IAAA,wCAAyB,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjE,6EAA6E;IAC7E,8DAA8D;IAC9D,gEAAgE;IAChE,2EAA2E;IAC3E,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,SAAS,GAAG,IAAA,2BAAmB,EAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAA,yBAAkB,EAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,IAAA,iCAAsB,EAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,IAAA,iCAAsB,EAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,IAAA,+BAAqB,EAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC/D,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,mEAAmE;IACnE,6DAA6D;IAC7D,8BAA8B;IAC9B,MAAM,YAAY,GAAG,IAAA,iCAAsB,EAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAA,yBAAkB,EAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,IAAA,wCAAyB,EAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnE,qEAAqE;IACrE,gEAAgE;IAChE,mEAAmE;IACnE,iEAAiE;IACjE,gEAAgE;IAChE,kDAAkD;IAClD,MAAM,cAAc,GAAG,IAAA,sCAAwB,EAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,IAAA,iCAAsB,EAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACnE,kEAAkE;IAClE,sEAAsE;IACtE,kEAAkE;IAClE,+DAA+D;IAC/D,sEAAsE;IACtE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,SAAS,GAAG,IAAA,2BAAmB,EAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,IAAA,yCAA0B,EAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACtE,MAAM,cAAc,GAAG,IAAA,qCAAwB,EAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACzE,iEAAiE;IACjE,iEAAiE;IACjE,4DAA4D;IAC5D,kEAAkE;IAClE,2DAA2D;IAC3D,2DAA2D;IAC3D,0DAA0D;IAC1D,2DAA2D;IAC3D,wBAAwB;IACxB,IAAA,kDAA8B,EAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACtD,kEAAkE;IAClE,oEAAoE;IACpE,gEAAgE;IAChE,wCAAwC;IACxC,MAAM,UAAU,GAAG,IAAA,6BAAoB,EAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC/D,oEAAoE;IACpE,kEAAkE;IAClE,MAAM,eAAe,GAAG,IAAA,uCAAyB,EAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrE,sEAAsE;IACtE,6DAA6D;IAC7D,kEAAkE;IAClE,mEAAmE;IACnE,oEAAoE;IACpE,sCAAsC;IACtC,MAAM,YAAY,GAAG,IAAA,4BAAsB,EAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,IAAA,8BAAuB,EAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACnE,MAAM,iBAAiB,GAAG,IAAA,sCAA2B,EAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC5E,MAAM,aAAa,GAAG,IAAA,8BAAuB,EAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,gBAAgB,GAAG,IAAA,oCAA0B,EAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC1E,MAAM,eAAe,GAAG,IAAA,kCAAyB,EAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC3E,MAAM,cAAc,GAAG,IAAA,gCAAwB,EAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,gBAAgB,GAAG,IAAA,oCAA0B,EAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC3E,MAAM,gBAAgB,GAAG,IAAA,yCAA0B,EAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAE7E,uEAAuE;IACvE,kEAAkE;IAClE,sEAAsE;IACtE,kEAAkE;IAClE,uEAAuE;IACvE,oEAAoE;IACpE,sEAAsE;IACtE,uEAAuE;IACvE,iEAAiE;IACjE,IAAA,kBAAS,EAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAEnC,gEAAgE;IAChE,4DAA4D;IAC5D,8DAA8D;IAC9D,6CAA6C;IAC7C,sEAAsE;IACtE,iEAAiE;IACjE,EAAE;IACF,iEAAiE;IACjE,kEAAkE;IAClE,kEAAkE;IAClE,gEAAgE;IAChE,sBAAsB;IACtB,EAAE;IACF,iEAAiE;IACjE,kEAAkE;IAClE,iEAAiE;IACjE,8DAA8D;IAC9D,mEAAmE;IACnE,8BAA8B;IAC9B,gBAAgB,CAAC,KAAK,CAAC,eAAe,EAAE;QACtC,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,iDAAiD;YAC9D,OAAO,EAAE,OAAO;SACjB;KACF,CAAC,CAAC;IAOH,IAAI,aAAa,GAA2B,IAAI,CAAC;IACjD,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC9C,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,wDAAa,4BAA4B,GAAC,CAAC;YAC9D,aAAa,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,CAA+B,CAAC;QACxF,CAAC;QACD,OAAO,aAAa,CAAC,CAAY,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,OAAO,gBAAgB,CAAC;AAC1B,CAAC,CAAC;AAzJW,QAAA,YAAY,gBAyJvB"}

package/dist/hono/middleware/admin.d.ts

@@ -0,0 +1,5 @@
+import type Crowi from '../../crowi';
+import { type HonoAuthVariables } from './auth';
+export declare const createJwtAdminRequired: (crowi: Crowi) => import("../../hono").MiddlewareHandler<{
+    Variables: HonoAuthVariables;
+}, string, {}, Response>;

package/dist/hono/middleware/admin.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createJwtAdminRequired = void 0;
+const factory_1 = require("hono/factory");
+const auth_1 = require("./auth");
+const ADMIN_REQUIRED_BODY = {
+    error: {
+        code: 'ADMIN_REQUIRED',
+        message: 'Admin permission required',
+    },
+};
+const createJwtAdminRequired = (crowi) => {
+    const jwtAuth = (0, auth_1.createJwtAuth)(crowi);
+    return (0, factory_1.createMiddleware)(async (c, next) => {
+        let shortCircuit;
+        const jwtResult = await jwtAuth(c, async () => {
+            const user = c.get('user');
+            if (!user?.admin) {
+                shortCircuit = c.json(ADMIN_REQUIRED_BODY, 403);
+                return;
+            }
+            await next();
+        });
+        // jwtAuth returned a Response (= it short-circuited with 401/403)
+        // and never invoked our inner callback. Forward that response.
+        if (shortCircuit)
+            return shortCircuit;
+        if (jwtResult instanceof Response)
+            return jwtResult;
+        return;
+    });
+};
+exports.createJwtAdminRequired = createJwtAdminRequired;
+//# sourceMappingURL=admin.js.map

package/dist/hono/middleware/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../../src/hono/middleware/admin.ts"],"names":[],"mappings":";;;AAcA,0CAAgD;AAKhD,iCAA+D;AAI/D,MAAM,mBAAmB,GAAuB;IAC9C,KAAK,EAAE;QACL,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,2BAA2B;KACrC;CACF,CAAC;AAEK,MAAM,sBAAsB,GAAG,CAAC,KAAY,EAAE,EAAE;IACrD,MAAM,OAAO,GAAG,IAAA,oBAAa,EAAC,KAAK,CAAC,CAAC;IAErC,OAAO,IAAA,0BAAgB,EAAmC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC1E,IAAI,YAAkC,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;gBACjB,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;QACH,kEAAkE;QAClE,+DAA+D;QAC/D,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QACtC,IAAI,SAAS,YAAY,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpD,OAAO;IACT,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAnBW,QAAA,sBAAsB,0BAmBjC"}

package/dist/hono/middleware/auth.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Hono port of the Express `jwtAuth` middleware. Wire-format identical to
+ * `packages/api/src/middlewares/jwtAuth.ts`:
+ *
+ *   - Bearer token first, `crowi.accessToken` cookie fallback (for
+ *     `<img src="/api/v2/...">`-style requests that cannot carry an
+ *     Authorization header).
+ *   - 401 `AUTHENTICATION_REQUIRED` on missing / invalid / expired token
+ *     or unknown user. Body shape matches `AuthenticationRequiredErrorSchema`.
+ *   - 403 `USER_REGISTERED` / `USER_SUSPENDED` / `USER_INVITED` for
+ *     non-active accounts. Body shape matches `UserStatusErrorSchema`.
+ *   - On success, the resolved `UserDocument` is exposed via `c.get('user')`.
+ */
+import type { AuthenticationRequiredErrorSchema, Scope } from '@crowi/api-contract';
+import type { z } from 'zod';
+import type Crowi from '../../crowi';
+import type { UserDocument } from '../../models/user';
+type AuthenticationRequiredError = z.infer<typeof AuthenticationRequiredErrorSchema>;
+export declare const AUTH_REQUIRED_BODY: AuthenticationRequiredError;
+/**
+ * RFC-0010 — context describing how the request authenticated.
+ *
+ *  - `web`: a browser session JWT (`type: 'access'`) or its cookie
+ *    fallback. Carries no scope claim and is granted **all** scopes, so
+ *    `requireScope` always passes and the existing UI behaviour is
+ *    unchanged.
+ *  - `oauth`: an OAuth access token (`type: 'oauth_access'`). Scopes are
+ *    limited to the token's `scope` claim and `clientId` identifies the
+ *    issuing client.
+ *  - `pat`: a Personal Access Token (`crowi_pat_…` opaque Bearer,
+ *    RFC-0010 Phase 2). Scopes are the stored token's `scopes`; `tokenId`
+ *    is the PAT document id. Handlers that must stay web-session-only
+ *    (e.g. PAT management) branch on `kind !== 'web'`.
+ */
+export type AuthContext = {
+    kind: 'web';
+} | {
+    kind: 'oauth';
+    clientId: string;
+} | {
+    kind: 'pat';
+    tokenId: string;
+};
+export interface HonoAuthVariables {
+    user: UserDocument;
+    /** Scopes the authenticated principal holds (web sessions = all). */
+    authScopes: ReadonlySet<Scope>;
+    /** How the request authenticated; lets handlers branch web vs. OAuth. */
+    authContext: AuthContext;
+}
+export declare const createJwtAuth: (crowi: Crowi) => import("../../hono").MiddlewareHandler<{
+    Variables: HonoAuthVariables;
+}, string, {}, Response>;
+export {};

package/dist/hono/middleware/auth.js

@@ -0,0 +1,142 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createJwtAuth = exports.AUTH_REQUIRED_BODY = void 0;
+const api_contract_1 = require("@crowi/api-contract");
+const debug_1 = __importDefault(require("debug"));
+const cookie_1 = require("hono/cookie");
+const factory_1 = require("hono/factory");
+const jwt_1 = require("../../util/jwt");
+const ACCESS_TOKEN_COOKIE_NAME = 'crowi.accessToken';
+exports.AUTH_REQUIRED_BODY = {
+    error: {
+        code: 'AUTHENTICATION_REQUIRED',
+        message: 'Authentication is required',
+    },
+};
+const createJwtAuth = (crowi) => {
+    const debug = (0, debug_1.default)('crowi:hono:middleware:auth');
+    const User = crowi.model('User');
+    const PersonalAccessToken = crowi.model('PersonalAccessToken');
+    const jwtUtil = (0, jwt_1.createJwtUtil)(crowi);
+    return (0, factory_1.createMiddleware)(async (c, next) => {
+        const authHeader = c.req.header('authorization');
+        let token = jwtUtil.extractTokenFromHeader(authHeader);
+        // The cookie fallback (for `<img src>`-style requests that cannot
+        // carry an Authorization header) only ever holds a web-session
+        // access token, so it is never treated as OAuth — fromCookie flips
+        // the accepted token types below to `access`-only.
+        let fromCookie = false;
+        if (!token) {
+            const cookieToken = (0, cookie_1.getCookie)(c, ACCESS_TOKEN_COOKIE_NAME);
+            if (cookieToken) {
+                token = cookieToken.trim() || null;
+                fromCookie = !!token;
+            }
+        }
+        if (!token) {
+            return c.json(exports.AUTH_REQUIRED_BODY, 401);
+        }
+        // Resolve the request's principal up front. Three credential shapes:
+        //   - `crowi_pat_…` opaque Bearer → Personal Access Token (RFC-0010
+        //     Phase 2): looked up by SHA-256 hash, scopes from the stored row.
+        //   - JWT `access` (Bearer or cookie) → web session, all scopes.
+        //   - JWT `oauth_access` (Bearer only) → OAuth token, claim scopes.
+        // `resolved` carries the user plus a deferred scope/context applier so
+        // the shared status check below runs once for every credential shape.
+        let resolved = null;
+        const isPat = !fromCookie && token.startsWith(PersonalAccessToken.TOKEN_PREFIX);
+        if (isPat) {
+            const record = await PersonalAccessToken.findActiveByHash(PersonalAccessToken.hashToken(token));
+            // A missing / revoked / expired PAT is filtered out by
+            // `findActiveByHash`'s query, so a null result is an ordinary 401.
+            if (!record) {
+                return c.json(exports.AUTH_REQUIRED_BODY, 401);
+            }
+            const tokenId = record._id.toString();
+            resolved = {
+                userId: record.userId.toString(),
+                apply: async () => {
+                    const scopes = new Set();
+                    for (const s of record.scopes) {
+                        if ((0, api_contract_1.isScope)(s))
+                            scopes.add(s);
+                    }
+                    c.set('authScopes', scopes);
+                    c.set('authContext', { kind: 'pat', tokenId });
+                    // Best-effort last-used bump; never blocks the request.
+                    await record.touchLastUsed();
+                },
+            };
+        }
+        else {
+            // Bearer: accept both web-session (`access`) and OAuth
+            // (`oauth_access`) tokens. Cookie: web-session only.
+            const payload = fromCookie ? jwtUtil.verifyToken(token, 'access') : jwtUtil.verifyToken(token, ['access', 'oauth_access']);
+            if (!payload) {
+                return c.json(exports.AUTH_REQUIRED_BODY, 401);
+            }
+            resolved = {
+                userId: payload.userId,
+                apply: async () => {
+                    // Web sessions (`access`, or the cookie fallback) get every scope
+                    // so `requireScope` always passes and UI behaviour is unchanged.
+                    // OAuth tokens are limited to their parsed `scope` claim.
+                    if (payload.type === 'oauth_access') {
+                        c.set('authScopes', (0, api_contract_1.parseScopeClaim)(payload.scope));
+                        c.set('authContext', { kind: 'oauth', clientId: payload.client_id });
+                    }
+                    else {
+                        c.set('authScopes', api_contract_1.ALL_SCOPES);
+                        c.set('authContext', { kind: 'web' });
+                    }
+                },
+            };
+        }
+        try {
+            const user = await User.findById(resolved.userId);
+            if (!user) {
+                return c.json(exports.AUTH_REQUIRED_BODY, 401);
+            }
+            if (user.status !== User.STATUS_ACTIVE) {
+                let code = 'USER_SUSPENDED';
+                let message = 'User account is not active';
+                let redirectTo = '/login/error/suspended';
+                if (user.status === User.STATUS_REGISTERED) {
+                    code = 'USER_REGISTERED';
+                    message = 'User registration is not complete';
+                    redirectTo = '/login/error/registered';
+                }
+                else if (user.status === User.STATUS_SUSPENDED) {
+                    code = 'USER_SUSPENDED';
+                    message = 'User account is suspended';
+                    redirectTo = '/login/error/suspended';
+                }
+                else if (user.status === User.STATUS_INVITED) {
+                    code = 'USER_INVITED';
+                    message = 'User invitation is pending';
+                    redirectTo = '/login/invited';
+                }
+                const body = {
+                    error: { code, message, redirectTo },
+                };
+                return c.json(body, 403);
+            }
+            c.set('user', user);
+            // RFC-0010 scope resolution — deferred to the credential-specific
+            // applier so this status-check path is shared across web / OAuth /
+            // PAT. Sets `authScopes` + `authContext` (and, for PATs, bumps
+            // `lastUsedAt`).
+            await resolved.apply();
+            await next();
+        }
+        catch (error) {
+            debug('JWT authentication error:', error);
+            return c.json(exports.AUTH_REQUIRED_BODY, 401);
+        }
+    });
+};
+exports.createJwtAuth = createJwtAuth;
+//# sourceMappingURL=auth.js.map

package/dist/hono/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/hono/middleware/auth.ts"],"names":[],"mappings":";;;;;;AAcA,sDAA2E;AAC3E,kDAA0B;AAC1B,wCAAwC;AACxC,0CAAgD;AAKhD,sCAA6C;AAK7C,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AAExC,QAAA,kBAAkB,GAAgC;IAC7D,KAAK,EAAE;QACL,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,4BAA4B;KACtC;CACF,CAAC;AA2BK,MAAM,aAAa,GAAG,CAAC,KAAY,EAAE,EAAE;IAC5C,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,4BAA4B,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,mBAAmB,GAAG,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAA,mBAAa,EAAC,KAAK,CAAC,CAAC;IAErC,OAAO,IAAA,0BAAgB,EAAmC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC1E,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,KAAK,GAAG,OAAO,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEvD,kEAAkE;QAClE,+DAA+D;QAC/D,mEAAmE;QACnE,mDAAmD;QACnD,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,WAAW,GAAG,IAAA,kBAAS,EAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;YAC3D,IAAI,WAAW,EAAE,CAAC;gBAChB,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;gBACnC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CAAC,0BAAkB,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;QAED,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,iEAAiE;QACjE,oEAAoE;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,IAAI,QAAQ,GAA0D,IAAI,CAAC;QAE3E,MAAM,KAAK,GAAG,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;QAEhF,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAChG,uDAAuD;YACvD,mEAAmE;YACnE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,0BAAkB,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACtC,QAAQ,GAAG;gBACT,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAChC,KAAK,EAAE,KAAK,IAAI,EAAE;oBAChB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAS,CAAC;oBAChC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;wBAC9B,IAAI,IAAA,sBAAO,EAAC,CAAC,CAAC;4BAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAChC,CAAC;oBACD,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;oBAC5B,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC/C,wDAAwD;oBACxD,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC/B,CAAC;aACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,qDAAqD;YACrD,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAU,CAAC,CAAC;YACpI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,0BAAkB,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;YACD,QAAQ,GAAG;gBACT,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,KAAK,EAAE,KAAK,IAAI,EAAE;oBAChB,kEAAkE;oBAClE,iEAAiE;oBACjE,0DAA0D;oBAC1D,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;wBACpC,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,IAAA,8BAAe,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;wBACpD,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;oBACvE,CAAC;yBAAM,CAAC;wBACN,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,yBAAU,CAAC,CAAC;wBAChC,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBACxC,CAAC;gBACH,CAAC;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,CAAC,IAAI,CAAC,0BAAkB,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvC,IAAI,IAAI,GAA0D,gBAAgB,CAAC;gBACnF,IAAI,OAAO,GAAG,4BAA4B,CAAC;gBAC3C,IAAI,UAAU,GAAG,wBAAwB,CAAC;gBAE1C,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBAC3C,IAAI,GAAG,iBAAiB,CAAC;oBACzB,OAAO,GAAG,mCAAmC,CAAC;oBAC9C,UAAU,GAAG,yBAAyB,CAAC;gBACzC,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACjD,IAAI,GAAG,gBAAgB,CAAC;oBACxB,OAAO,GAAG,2BAA2B,CAAC;oBACtC,UAAU,GAAG,wBAAwB,CAAC;gBACxC,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;oBAC/C,IAAI,GAAG,cAAc,CAAC;oBACtB,OAAO,GAAG,4BAA4B,CAAC;oBACvC,UAAU,GAAG,gBAAgB,CAAC;gBAChC,CAAC;gBAED,MAAM,IAAI,GAAoB;oBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE;iBACrC,CAAC;gBACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3B,CAAC;YAED,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAoB,CAAC,CAAC;YAEpC,kEAAkE;YAClE,mEAAmE;YACnE,+DAA+D;YAC/D,iBAAiB;YACjB,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;YAEvB,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,0BAAkB,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAhIW,QAAA,aAAa,iBAgIxB"}

package/dist/hono/middleware/cors.d.ts

@@ -0,0 +1,3 @@
+import type { MiddlewareHandler } from '../../hono';
+import type Crowi from '../../crowi';
+export declare const createCors: (crowi: Crowi) => MiddlewareHandler;

package/dist/hono/middleware/cors.js

@@ -0,0 +1,86 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCors = void 0;
+/**
+ * RFC-0006 Phase 6 Sub-batch C — Hono port of the Express `cors`
+ * middleware. The Express bridge will be retired in Sub-batch D, after
+ * which this is the only CORS layer on `/api/v2/*` (and on every other
+ * Hono-owned path, since Hono will then be the sole HTTP host).
+ *
+ * Allow-origin policy (mirrors `packages/api/src/crowi/express-init.ts`
+ * byte-for-byte, with the same precedence order):
+ *
+ *   1. Requests with no `Origin` header are allowed (mobile clients,
+ *      curl, server-to-server, supertest).
+ *   2. `process.env.CLIENT_URL` exact match (production allow-list).
+ *   3. In `NODE_ENV === 'development'`, any `localhost` / `127.0.0.1`
+ *      origin (port-agnostic) is allowed — this is what lets the
+ *      Next.js dev server on `:4302` talk to the api on `:4301`.
+ *   4. `crowi.getBaseUrl()` exact match (covers deployments that
+ *      reverse-proxy the api on its own hostname without setting
+ *      `CLIENT_URL`).
+ *   5. Anything else is rejected (returns `undefined` from the
+ *      callback → Hono omits `Access-Control-Allow-Origin`, which
+ *      makes the browser fail the CORS check).
+ *
+ * `credentials: true` is required for the JWT refresh-token cookie
+ * (`crowi.accessToken`) used by `<img src=...>` style requests. The
+ * `allowMethods` / `allowHeaders` lists match the Express config so
+ * the wire-format diff is zero.
+ */
+const debug_1 = __importDefault(require("debug"));
+const cors_1 = require("hono/cors");
+const debug = (0, debug_1.default)('crowi:hono:middleware:cors');
+/**
+ * Return value matches the Hono `cors` `origin` callback contract:
+ * `string` — echo this exact origin back as
+ * `Access-Control-Allow-Origin`; `undefined` / `null` — reject (no
+ * header emitted).
+ */
+const buildOriginResolver = (crowi) => {
+    const env = crowi.node_env;
+    const clientUrl = process.env.CLIENT_URL;
+    return (origin) => {
+        // No `Origin` header (or empty string from the helper) — non-browser
+        // clients. The Express cors package would call `callback(null,
+        // true)`; the Hono equivalent is to echo back whatever the helper
+        // produced (treat as same-origin). Hono normalises an absent
+        // header to `''` here, so we cannot distinguish "no Origin" from
+        // "empty Origin" — both fall through this branch, which matches
+        // the legacy behaviour.
+        if (!origin)
+            return origin;
+        if (clientUrl && origin === clientUrl) {
+            return origin;
+        }
+        if (env === 'development' && (origin.includes('localhost') || origin.includes('127.0.0.1'))) {
+            return origin;
+        }
+        const baseUrl = crowi.getBaseUrl();
+        if (baseUrl && origin === baseUrl) {
+            return origin;
+        }
+        if (env !== 'development') {
+            debug('CORS rejected origin:', origin);
+            return undefined;
+        }
+        // Dev fallback: allow anything in development so local plugin /
+        // smoke-test traffic isn't blocked. Production rejected above.
+        return origin;
+    };
+};
+const createCors = (crowi) => {
+    const resolveOrigin = buildOriginResolver(crowi);
+    debug('CORS enabled, CLIENT_URL:', process.env.CLIENT_URL || '(not set)');
+    return (0, cors_1.cors)({
+        origin: (origin) => resolveOrigin(origin),
+        credentials: true,
+        allowMethods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+        allowHeaders: ['Content-Type', 'Authorization', 'X-Requested-With'],
+    });
+};
+exports.createCors = createCors;
+//# sourceMappingURL=cors.js.map

package/dist/hono/middleware/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../../src/hono/middleware/cors.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,kDAA0B;AAC1B,oCAAiC;AAKjC,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,4BAA4B,CAAC,CAAC;AAElD;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAAC,KAAY,EAAE,EAAE;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAEzC,OAAO,CAAC,MAAc,EAAsB,EAAE;QAC5C,qEAAqE;QACrE,+DAA+D;QAC/D,kEAAkE;QAClE,6DAA6D;QAC7D,iEAAiE;QACjE,gEAAgE;QAChE,wBAAwB;QACxB,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC;QAE3B,IAAI,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,GAAG,KAAK,aAAa,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAC5F,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;QACnC,IAAI,OAAO,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YAC1B,KAAK,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,gEAAgE;QAChE,+DAA+D;QAC/D,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,UAAU,GAAG,CAAC,KAAY,EAAqB,EAAE;IAC5D,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACjD,KAAK,CAAC,2BAA2B,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC;IAE1E,OAAO,IAAA,WAAI,EAAC;QACV,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;QACzC,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC;QACzD,YAAY,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,kBAAkB,CAAC;KACpE,CAAC,CAAC;AACL,CAAC,CAAC;AAVW,QAAA,UAAU,cAUrB"}

package/dist/hono/middleware/default-hook.d.ts

@@ -0,0 +1,8 @@
+import type { Context } from '../../hono';
+import type { ZodError } from 'zod';
+interface ValidationHookResult {
+    success: boolean;
+    error?: ZodError;
+}
+export declare const defaultHook: (result: ValidationHookResult, c: Context) => Response | undefined;
+export {};

package/dist/hono/middleware/default-hook.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultHook = void 0;
+const defaultHook = (result, c) => {
+    if (result.success)
+        return;
+    const body = {
+        error: {
+            code: 'VALIDATION_ERROR',
+            message: 'Request validation failed',
+            details: result.error?.flatten(),
+        },
+    };
+    return c.json(body, 400);
+};
+exports.defaultHook = defaultHook;
+//# sourceMappingURL=default-hook.js.map

package/dist/hono/middleware/default-hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-hook.js","sourceRoot":"","sources":["../../../src/hono/middleware/default-hook.ts"],"names":[],"mappings":";;;AAyBO,MAAM,WAAW,GAAG,CAAC,MAA4B,EAAE,CAAU,EAAwB,EAAE;IAC5F,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO;IAC3B,MAAM,IAAI,GAAoB;QAC5B,KAAK,EAAE;YACL,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,2BAA2B;YACpC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE;SACjC;KACF,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC,CAAC;AAVW,QAAA,WAAW,eAUtB"}

package/dist/hono/middleware/error-handler.d.ts

@@ -0,0 +1,2 @@
+import type { Context } from '../../hono';
+export declare const honoOnError: (err: Error, c: Context) => Response;