@edge-base/server 0.2.9 → 0.3.2

package/src/routes/admin.ts

@@ -1539,7 +1539,14 @@ api.openapi(adminCreateSignedUrl, async (c) => {
 
   const expiresInMs = parseDuration(body.expiresIn || '1h');
   const expiresAt = Date.now() + expiresInMs;
-  const token = await createSignedToken(body.key, bucketName, expiresAt, secret);
+  const token = await createSignedToken(body.key, bucketName, expiresAt, secret, {
+    file: {
+      size: obj.size,
+      contentType: obj.httpMetadata?.contentType || 'application/octet-stream',
+      etag: obj.etag,
+      uploadedAt: obj.uploaded?.toISOString(),
+    },
+  });
 
   // Build signed URL using the public storage endpoint
   const url = new URL(c.req.url);

package/src/routes/auth.ts

@@ -27,6 +27,7 @@ import {
   buildEmailActionUrl,
   parseClientRedirectInput,
 } from '../lib/auth-redirect.js';
+import { hashOtpSecret, verifyOtpSecret } from '../lib/auth-token.js';
 import {
   signAccessToken, signRefreshToken, verifyRefreshTokenWithFallback,
   parseDuration, TokenExpiredError,
@@ -176,7 +177,7 @@ function getMaxActiveSessions(env: Env): number {
 }
 
 function isEmailProviderName(value: unknown): value is EmailConfig['provider'] {
-  return value === 'resend' || value === 'sendgrid' || value === 'mailgun' || value === 'ses';
+  return value === 'resend' || value === 'sendgrid' || value === 'mailgun' || value === 'ses' || value === 'cloudflare';
 }
 
 function getEmailConfig(env: Env): EmailConfig | undefined {
@@ -187,22 +188,29 @@ function getEmailConfig(env: Env): EmailConfig | undefined {
   const provider = configured?.provider
     ?? (isEmailProviderName(runtimeEnv.EDGEBASE_EMAIL_PROVIDER) ? runtimeEnv.EDGEBASE_EMAIL_PROVIDER : undefined);
   const apiKey = configured?.apiKey
-    ?? (typeof runtimeEnv.EDGEBASE_EMAIL_API_KEY === 'string' ? runtimeEnv.EDGEBASE_EMAIL_API_KEY : undefined);
+    ?? (typeof runtimeEnv.EDGEBASE_EMAIL_API_KEY === 'string' ? runtimeEnv.EDGEBASE_EMAIL_API_KEY : undefined)
+    ?? (typeof runtimeEnv.EDGEBASE_EMAIL_CLOUDFLARE_API_TOKEN === 'string' ? runtimeEnv.EDGEBASE_EMAIL_CLOUDFLARE_API_TOKEN : undefined);
   const from = configured?.from
     ?? (typeof runtimeEnv.EDGEBASE_EMAIL_FROM === 'string' ? runtimeEnv.EDGEBASE_EMAIL_FROM : undefined);
+  const cloudflareAccountId = configured?.accountId
+    ?? (typeof runtimeEnv.EDGEBASE_EMAIL_CLOUDFLARE_ACCOUNT_ID === 'string' ? runtimeEnv.EDGEBASE_EMAIL_CLOUDFLARE_ACCOUNT_ID : undefined);
+  const cloudflareBinding = configured?.binding
+    ?? (typeof runtimeEnv.EDGEBASE_EMAIL_CLOUDFLARE_BINDING === 'string' ? runtimeEnv.EDGEBASE_EMAIL_CLOUDFLARE_BINDING : undefined);
 
-  if (!provider || !apiKey || !from) {
+  if (!provider || !from || (provider !== 'cloudflare' && !apiKey)) {
     return configured;
   }
 
   return {
     provider,
-    apiKey,
     from,
+    ...(apiKey ? { apiKey } : {}),
     domain: configured?.domain
       ?? (typeof runtimeEnv.EDGEBASE_EMAIL_MAILGUN_DOMAIN === 'string' ? runtimeEnv.EDGEBASE_EMAIL_MAILGUN_DOMAIN : undefined),
     region: configured?.region
       ?? (typeof runtimeEnv.EDGEBASE_EMAIL_SES_REGION === 'string' ? runtimeEnv.EDGEBASE_EMAIL_SES_REGION : undefined),
+    accountId: cloudflareAccountId,
+    binding: cloudflareBinding,
     appName: configured?.appName ?? 'EdgeBase Local Auth Harness',
     defaultLocale: configured?.defaultLocale,
     verifyUrl: configured?.verifyUrl
@@ -539,7 +547,7 @@ async function rotateRefreshTokenFlow(
   }
 
   const newRefreshToken = await signRefreshToken(
-    { sub: userId, type: 'refresh', jti: generateId() },
+    { sub: userId, type: 'refresh', jti: session.id as string },
     getUserSecret(env),
     getRefreshTokenTTL(env),
   );
@@ -781,7 +789,11 @@ async function sendMailWithHook(
     }
   }
 
-  return provider.send({ to, subject: finalSubject, html: finalHtml });
+  const result = await provider.send({ to, subject: finalSubject, html: finalHtml });
+  if (!result.success) {
+    throw new EdgeBaseError(502, 'Email delivery failed.', undefined, 'email-delivery-failed');
+  }
+  return result;
 }
 
 async function sendSmsWithHook(
@@ -987,15 +999,8 @@ authRoute.openapi(signup, async (c) => {
 
   const userId = generateId();
   const db = getAuthDb(c);
-
-  // Register pending in D1 email index
-  try {
-    await registerEmailPending(db, body.email, userId);
-  } catch (err) {
-    if ((err as Error).message === 'EMAIL_ALREADY_REGISTERED') {
-      throw new EdgeBaseError(409, 'Email already registered.', undefined, 'email-already-exists');
-    }
-    throw new EdgeBaseError(500, 'Signup failed. Please try again.', undefined, 'internal-error');
+  if (await lookupEmail(db, body.email)) {
+    throw new EdgeBaseError(409, 'Email already registered.', undefined, 'email-already-exists');
   }
 
   // Create user directly in D1
@@ -1003,10 +1008,27 @@ authRoute.openapi(signup, async (c) => {
     // Password policy validation
     const policyResult = await validatePassword(body.password, getPasswordPolicyConfig(c.env));
     if (!policyResult.valid) {
-      await deleteEmailPending(db, body.email).catch(() => {});
       throw new EdgeBaseError(400, policyResult.errors[0], { password: { code: 'password_policy', message: policyResult.errors.join('; ') } }, 'password-policy');
     }
 
+    // beforeSignUp hook — blocking, can cancel signup
+    await executeAuthHook(c.env, c.executionCtx, 'beforeSignUp', {
+      id: userId,
+      email: body.email,
+      displayName,
+      avatarUrl,
+    }, { blocking: true, workerUrl: getWorkerUrl(c.req.url, c.env) });
+
+    // Register pending in D1 email index
+    try {
+      await registerEmailPending(db, body.email, userId);
+    } catch (err) {
+      if ((err as Error).message === 'EMAIL_ALREADY_REGISTERED') {
+        throw new EdgeBaseError(409, 'Email already registered.', undefined, 'email-already-exists');
+      }
+      throw new EdgeBaseError(500, 'Signup failed. Please try again.', undefined, 'internal-error');
+    }
+
     const passwordHash = await hashPassword(body.password);
 
     await authService.createUser(db, {
@@ -1021,14 +1043,6 @@ authRoute.openapi(signup, async (c) => {
       locale,
     });
 
-    // beforeSignUp hook — blocking, can cancel signup
-    await executeAuthHook(c.env, c.executionCtx, 'beforeSignUp', {
-      id: userId,
-      email: body.email,
-      displayName,
-      avatarUrl,
-    }, { blocking: true, workerUrl: getWorkerUrl(c.req.url, c.env) });
-
     // Create session + tokens
     const session = await createSessionAndTokens(c.env, userId, ip, c.req.header('user-agent') || '');
 
@@ -1370,19 +1384,24 @@ authRoute.openapi(signinMagicLink, async (c) => {
   } else if (autoCreate) {
     // Auto-create user + send magic link
     const userId = generateId();
+    const reqLocale = parseAcceptLanguage(c.req.header('accept-language'));
 
     try {
-      await registerEmailPending(db, body.email, userId);
-    } catch (err) {
-      if ((err as Error).message === 'EMAIL_ALREADY_REGISTERED') {
-        return c.json({ ok: true });
+      // beforeSignUp hook
+      await executeAuthHook(c.env, c.executionCtx, 'beforeSignUp', {
+        id: userId, email: body.email, displayName: null, avatarUrl: null,
+      }, { blocking: true, workerUrl: getWorkerUrl(c.req.url, c.env) });
+
+      try {
+        await registerEmailPending(db, body.email, userId);
+      } catch (err) {
+        if ((err as Error).message === 'EMAIL_ALREADY_REGISTERED') {
+          return c.json({ ok: true });
+        }
+        throw new EdgeBaseError(500, 'Magic link request failed.', undefined, 'internal-error');
       }
-      throw new EdgeBaseError(500, 'Magic link request failed.', undefined, 'internal-error');
-    }
 
-    try {
       // Create user with no password, verified = 1
-      const reqLocale = parseAcceptLanguage(c.req.header('accept-language'));
       await authService.createUser(db, {
         userId,
         email: body.email,
@@ -1393,11 +1412,6 @@ authRoute.openapi(signinMagicLink, async (c) => {
         locale: reqLocale ?? 'en',
       });
 
-      // beforeSignUp hook
-      await executeAuthHook(c.env, c.executionCtx, 'beforeSignUp', {
-        id: userId, email: body.email, displayName: null, avatarUrl: null,
-      }, { blocking: true, workerUrl: getWorkerUrl(c.req.url, c.env) });
-
       // Sync to _users_public
       const user = await authService.getUserById(db, userId);
       if (user) {
@@ -1452,7 +1466,7 @@ authRoute.openapi(signinMagicLink, async (c) => {
         await sendMailWithHook(
           c.env, c.executionCtx, provider, 'magicLink', body.email,
           resolveSubject(c.env, 'magicLink', defaultSubject, locale), html, locale,
-        ).catch(() => {});
+        );
       } else {
         if (!isReleaseMode(c.env)) {
           debugToken = token;
@@ -1627,10 +1641,12 @@ authRoute.openapi(signinPhone, async (c) => {
     const code = generateOTP();
     if (exposeTestSecrets) devCode = code;
 
+    const codeHash = await hashOtpSecret(code, getUserSecret(c.env));
+
     // Store OTP in KV with 5 min TTL
     await c.env.KV.put(
       `phone-otp:${phone}`,
-      JSON.stringify({ code, userId, attempts: 0 }),
+      JSON.stringify({ codeHash, userId, attempts: 0 }),
       { expirationTtl: 300 },
     );
 
@@ -1657,15 +1673,20 @@ authRoute.openapi(signinPhone, async (c) => {
     const userId = generateId();
 
     try {
-      await registerPhonePending(db, phone, userId);
-    } catch (err) {
-      if ((err as Error).message === 'PHONE_ALREADY_REGISTERED') {
-        return c.json({ ok: true });
+      // beforeSignUp hook
+      await executeAuthHook(c.env, c.executionCtx, 'beforeSignUp', {
+        id: userId, email: null, phone, displayName: null, avatarUrl: null,
+      }, { blocking: true, workerUrl: getWorkerUrl(c.req.url, c.env) });
+
+      try {
+        await registerPhonePending(db, phone, userId);
+      } catch (err) {
+        if ((err as Error).message === 'PHONE_ALREADY_REGISTERED') {
+          return c.json({ ok: true });
+        }
+        throw new EdgeBaseError(500, 'Phone OTP request failed.', undefined, 'internal-error');
       }
-      throw new EdgeBaseError(500, 'Phone OTP request failed.', undefined, 'internal-error');
-    }
 
-    try {
       // Create user with phone in D1
       await authService.createUser(db, {
         userId,
@@ -1679,10 +1700,12 @@ authRoute.openapi(signinPhone, async (c) => {
       const code = generateOTP();
       if (exposeTestSecrets) devCode = code;
 
+      const codeHash = await hashOtpSecret(code, getUserSecret(c.env));
+
       // Store OTP in KV
       await c.env.KV.put(
         `phone-otp:${phone}`,
-        JSON.stringify({ code, userId, attempts: 0 }),
+        JSON.stringify({ codeHash, userId, attempts: 0 }),
         { expirationTtl: 300 },
       );
 
@@ -1756,7 +1779,7 @@ authRoute.openapi(verifyPhone, async (c) => {
 
   // Look up phone → userId via KV OTP data
   const otpData = await c.env.KV.get(`phone-otp:${phone}`, 'json') as {
-    code: string; userId: string; attempts: number;
+    codeHash?: string; code?: string; userId: string; attempts: number;
   } | null;
 
   if (!otpData) {
@@ -1769,8 +1792,11 @@ authRoute.openapi(verifyPhone, async (c) => {
     throw new EdgeBaseError(429, 'Too many failed OTP attempts. Please request a new code.', undefined, 'rate-limited');
   }
 
-  // Verify code (timing-safe comparison)
-  if (!timingSafeEqual(otpData.code, body.code)) {
+  const submittedCode = body.code.trim();
+  const otpMatches = otpData.codeHash
+    ? await verifyOtpSecret(submittedCode, otpData.codeHash, getUserSecret(c.env))
+    : timingSafeEqual(otpData.code ?? '', submittedCode);
+  if (!otpMatches) {
     await c.env.KV.put(
       `phone-otp:${phone}`,
       JSON.stringify({ ...otpData, attempts: otpData.attempts + 1 }),
@@ -1895,10 +1921,12 @@ authRoute.openapi(linkPhone, async (c) => {
   const code = generateOTP();
   const exposeTestSecrets = shouldExposeAuthTestSecrets(c.env);
 
+  const codeHash = await hashOtpSecret(code, getUserSecret(c.env));
+
   // Store link OTP in KV (separate key pattern)
   await c.env.KV.put(
     `phone-link-otp:${phone}`,
-    JSON.stringify({ code, userId, attempts: 0 }),
+    JSON.stringify({ codeHash, userId, attempts: 0 }),
     { expirationTtl: 300 },
   );
 
@@ -1964,7 +1992,7 @@ authRoute.openapi(verifyLinkPhone, async (c) => {
 
   // Verify OTP from KV
   const otpData = await c.env.KV.get(`phone-link-otp:${phone}`, 'json') as {
-    code: string; userId: string; attempts: number;
+    codeHash?: string; code?: string; userId: string; attempts: number;
   } | null;
 
   if (!otpData) {
@@ -1980,7 +2008,11 @@ authRoute.openapi(verifyLinkPhone, async (c) => {
     throw new EdgeBaseError(429, 'Too many failed OTP attempts. Please request a new code.', undefined, 'rate-limited');
   }
 
-  if (!timingSafeEqual(otpData.code, body.code)) {
+  const submittedCode = body.code.trim();
+  const otpMatches = otpData.codeHash
+    ? await verifyOtpSecret(submittedCode, otpData.codeHash, getUserSecret(c.env))
+    : timingSafeEqual(otpData.code ?? '', submittedCode);
+  if (!otpMatches) {
     await c.env.KV.put(
       `phone-link-otp:${phone}`,
       JSON.stringify({ ...otpData, attempts: otpData.attempts + 1 }),
@@ -2083,11 +2115,12 @@ authRoute.openapi(signinEmailOtp, async (c) => {
 
     const code = generateOTP();
     if (exposeTestSecrets) devCode = code;
+    const codeHash = await hashOtpSecret(code, getUserSecret(c.env));
 
     // Store OTP in KV with 5 min TTL
     await c.env.KV.put(
       `email-otp:${email}`,
-      JSON.stringify({ code, userId, attempts: 0 }),
+      JSON.stringify({ codeHash, userId, attempts: 0 }),
       { expirationTtl: 300 },
     );
 
@@ -2117,19 +2150,24 @@ authRoute.openapi(signinEmailOtp, async (c) => {
     }
 
     const userId = generateId();
+    const otpReqLocale = parseAcceptLanguage(c.req.header('accept-language'));
 
     try {
-      await registerEmailPending(db, email, userId);
-    } catch (err) {
-      if ((err as Error).message === 'EMAIL_ALREADY_REGISTERED') {
-        return c.json({ ok: true });
+      // beforeSignUp hook
+      await executeAuthHook(c.env, c.executionCtx, 'beforeSignUp', {
+        id: userId, email, displayName: null, avatarUrl: null,
+      }, { blocking: true, workerUrl: getWorkerUrl(c.req.url, c.env) });
+
+      try {
+        await registerEmailPending(db, email, userId);
+      } catch (err) {
+        if ((err as Error).message === 'EMAIL_ALREADY_REGISTERED') {
+          return c.json({ ok: true });
+        }
+        throw new EdgeBaseError(500, 'Email OTP request failed.', undefined, 'internal-error');
       }
-      throw new EdgeBaseError(500, 'Email OTP request failed.', undefined, 'internal-error');
-    }
 
-    try {
       // Create user with email, verified = 1
-      const otpReqLocale = parseAcceptLanguage(c.req.header('accept-language'));
       await authService.createUser(db, {
         userId,
         email,
@@ -2141,11 +2179,12 @@ authRoute.openapi(signinEmailOtp, async (c) => {
 
       const code = generateOTP();
       if (exposeTestSecrets) devCode = code;
+      const codeHash = await hashOtpSecret(code, getUserSecret(c.env));
 
       // Store OTP in KV
       await c.env.KV.put(
         `email-otp:${email}`,
-        JSON.stringify({ code, userId, attempts: 0 }),
+        JSON.stringify({ codeHash, userId, attempts: 0 }),
         { expirationTtl: 300 },
       );
 
@@ -2218,7 +2257,7 @@ authRoute.openapi(verifyEmailOtp, async (c) => {
 
   // Look up OTP data from KV
   const otpData = await c.env.KV.get(`email-otp:${email}`, 'json') as {
-    code: string; userId: string; attempts: number;
+    codeHash?: string; code?: string; userId: string; attempts: number;
   } | null;
 
   if (!otpData) {
@@ -2230,7 +2269,11 @@ authRoute.openapi(verifyEmailOtp, async (c) => {
     throw new EdgeBaseError(429, 'Too many failed OTP attempts. Please request a new code.', undefined, 'rate-limited');
   }
 
-  if (!timingSafeEqual(otpData.code, body.code)) {
+  const submittedCode = body.code.trim();
+  const otpMatches = otpData.codeHash
+    ? await verifyOtpSecret(submittedCode, otpData.codeHash, getUserSecret(c.env))
+    : timingSafeEqual(otpData.code ?? '', submittedCode);
+  if (!otpMatches) {
     await c.env.KV.put(
       `email-otp:${email}`,
       JSON.stringify({ ...otpData, attempts: otpData.attempts + 1 }),
@@ -2577,6 +2620,67 @@ authRoute.openapi(mfaRecovery, async (c) => {
   });
 });
 
+// POST /mfa/recovery-codes — regenerate recovery codes (authenticated)
+const mfaRecoveryCodesRegenerate = createRoute({
+  operationId: 'authMfaRecoveryCodesRegenerate',
+  method: 'post',
+  path: '/mfa/recovery-codes',
+  tags: ['client'],
+  summary: 'Regenerate MFA recovery codes',
+  request: {
+    body: { content: { 'application/json': { schema: z.object({
+      password: z.string().optional(),
+      code: z.string().optional(),
+    }).passthrough() } }, required: false },
+  },
+  responses: {
+    200: { description: 'Success', content: { 'application/json': { schema: jsonResponseSchema } } },
+    400: { description: 'Bad request', content: { 'application/json': { schema: errorResponseSchema } } },
+    401: { description: 'Authentication required or verification failed', content: { 'application/json': { schema: errorResponseSchema } } },
+  },
+});
+
+authRoute.openapi(mfaRecoveryCodesRegenerate, async (c) => {
+  const userId = requireAuth(c.get('auth'));
+  const bodyText = await c.req.text();
+  let body: { password?: string; code?: string } = {};
+  try { body = bodyText ? JSON.parse(bodyText) : {}; } catch { throw new EdgeBaseError(400, 'Invalid JSON.', undefined, 'invalid-json'); }
+  await ensureAuthActionAllowed(c, 'mfaRecoveryCodesRegenerate', {
+    userId,
+    passwordProvided: !!body.password,
+    codeProvided: !!body.code,
+  });
+  const db = getAuthDb(c);
+
+  const user = await authService.getUserById(db, userId);
+  if (!user) throw new EdgeBaseError(404, 'User not found.', undefined, 'user-not-found');
+  const factor = await authService.getMfaFactorByUser(db, userId, 'totp');
+  if (!factor || !factor.verified) {
+    throw new EdgeBaseError(400, 'No verified TOTP factor found.', undefined, 'invalid-input');
+  }
+
+  if (body.password) {
+    if (!user.passwordHash) throw new EdgeBaseError(400, 'This account has no password set.', undefined, 'invalid-input');
+    const valid = await verifyPassword(body.password, user.passwordHash as string);
+    if (!valid) throw new EdgeBaseError(401, 'Invalid password.', undefined, 'invalid-password');
+  } else if (body.code) {
+    const secret = await decryptSecret(factor.secret as string, getUserSecret(c.env));
+    const valid = await verifyTOTP(secret, body.code);
+    if (!valid) throw new EdgeBaseError(401, 'Invalid TOTP code.', undefined, 'invalid-totp');
+  } else {
+    throw new EdgeBaseError(400, 'Either password or TOTP code is required to regenerate recovery codes.', undefined, 'invalid-input');
+  }
+
+  const recoveryCodes = generateRecoveryCodes(8);
+  const hashedCodes: { id: string; codeHash: string }[] = [];
+  for (const code of recoveryCodes) {
+    hashedCodes.push({ id: generateId(), codeHash: await hashRecoveryCode(code) });
+  }
+  await authService.replaceRecoveryCodes(db, userId, hashedCodes);
+
+  return c.json({ recoveryCodes });
+});
+
 // DELETE /mfa/totp — disable TOTP (authenticated)
 const mfaTotpDelete = createRoute({
   operationId: 'authMfaTotpDelete',

package/src/routes/room.ts

@@ -12,11 +12,13 @@
  *   - KV counter with expirationTtl: 60s
  */
 import { OpenAPIHono, createRoute, z, type HonoEnv } from '../lib/hono.js';
-import type { RoomNamespaceConfig } from '@edge-base/shared';
+import type { EdgeBaseConfig, RoomHandlerContext, RoomNamespaceConfig } from '@edge-base/shared';
 import type { Context } from 'hono';
 import { parseConfig } from '../lib/do-router.js';
+import { buildFunctionContext } from '../lib/functions.js';
 import { resolveRoomRuntime } from '../lib/room-runtime.js';
 import { zodDefaultHook, jsonResponseSchema, errorResponseSchema } from '../lib/schemas.js';
+import { resolveRootServiceKey } from '../lib/service-key.js';
 import {
   acquirePendingWebSocketSlot,
   getPendingWebSocketCount,
@@ -111,6 +113,33 @@ function getRoomAuthContext(
   };
 }
 
+function buildRoomRouteAccessContext(
+  c: Context<HonoEnv>,
+  config: EdgeBaseConfig,
+): RoomHandlerContext {
+  let executionCtx: ExecutionContext | undefined;
+  try {
+    executionCtx = c.executionCtx;
+  } catch {
+    executionCtx = undefined;
+  }
+  const ctx = buildFunctionContext({
+    request: c.req.raw,
+    auth: getRoomAuthContext(c.get('auth') as never),
+    databaseNamespace: c.env.DATABASE,
+    authNamespace: c.env.AUTH,
+    d1Database: c.env.AUTH_DB,
+    kvNamespace: c.env.KV,
+    config,
+    env: c.env,
+    executionCtx,
+    serviceKey: resolveRootServiceKey(config, c.env),
+  });
+  return {
+    admin: ctx.admin as never,
+  };
+}
+
 export async function proxyRoomDoRequest(
   c: Context<HonoEnv>,
   path: string,
@@ -433,9 +462,11 @@ roomRoute.openapi(getRoomMetadata, async (c) => {
   }
   if (metadataAccess) {
     const auth = (c.get('auth') as { id?: string; role?: string; email?: string | null; custom?: Record<string, unknown> | null; isAnonymous?: boolean; meta?: Record<string, unknown> } | null | undefined) ?? null;
+    const accessCtx = buildRoomRouteAccessContext(c, config);
     const allowed = await Promise.resolve(metadataAccess(
       getRoomAuthContext(auth),
       roomId,
+      accessCtx,
     )).catch(() => false);
     if (!allowed) {
       return c.json({ code: 403, message: 'Denied by room metadata access rule' }, 403);
@@ -493,9 +524,11 @@ roomRoute.openapi(getRoomSummary, async (c) => {
   }
   if (metadataAccess) {
     const auth = (c.get('auth') as { id?: string; role?: string; email?: string | null; custom?: Record<string, unknown> | null; isAnonymous?: boolean; meta?: Record<string, unknown> } | null | undefined) ?? null;
+    const accessCtx = buildRoomRouteAccessContext(c, config);
     const allowed = await Promise.resolve(metadataAccess(
       getRoomAuthContext(auth),
       roomId,
+      accessCtx,
     )).catch(() => false);
     if (!allowed) {
       return c.json({ code: 403, message: 'Denied by room metadata access rule' }, 403);
@@ -557,8 +590,9 @@ roomRoute.openapi(getRoomSummaries, async (c) => {
   const deniedIds: string[] = [];
 
   if (metadataAccess) {
+    const accessCtx = buildRoomRouteAccessContext(c, config);
     for (const roomId of roomIds) {
-      const allowed = await Promise.resolve(metadataAccess(authContext, roomId)).catch(() => false);
+      const allowed = await Promise.resolve(metadataAccess(authContext, roomId, accessCtx)).catch(() => false);
       if (allowed) {
         allowedRoomIds.push(roomId);
       } else {