@etus/bhono-app 0.1.1

package/templates/base/src/server/middleware/auth.ts

@@ -0,0 +1,146 @@
+// src/middleware/auth.ts
+import { createMiddleware } from 'hono/factory'
+import { verify } from 'hono/jwt'
+import { HTTPException } from 'hono/http-exception'
+import { users } from '../db/schema'
+import { eq, and, isNull } from 'drizzle-orm'
+import type { HonoEnv } from '../types'
+import { getSession } from '../lib/session'
+
+interface JWTPayload {
+  sub: string
+  email: string
+  iat: number
+  exp: number
+}
+
+/**
+ * Session-based authentication middleware
+ * Validates session from cookie and loads user from database
+ */
+export const sessionAuth = createMiddleware<HonoEnv>(async (c, next) => {
+  const session = getSession(c)
+
+  if (!session) {
+    throw new HTTPException(401, {
+      message: 'Not authenticated',
+    })
+  }
+
+  // Look up user in database to ensure they still exist and are active
+  const db = c.get('db')
+  if (!db) {
+    throw new HTTPException(500, { message: 'Database not initialized' })
+  }
+  const userResults = await db
+    .select()
+    .from(users)
+    .where(and(eq(users.id, session.userId), isNull(users.deletedAt)))
+    .limit(1)
+
+  const user = userResults.at(0)
+  if (!user) {
+    throw new HTTPException(401, {
+      message: 'User not found',
+    })
+  }
+
+  if (user.status !== 'active') {
+    throw new HTTPException(401, {
+      message: 'User account is not active',
+    })
+  }
+
+  // Set user in context
+  c.set('user', {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    status: user.status,
+    providerIds: user.providerIds ?? [],
+    isSuperAdmin: user.isSuperAdmin,
+    createdAt: user.createdAt,
+    updatedAt: user.updatedAt,
+    deletedAt: user.deletedAt,
+  })
+
+  await next()
+})
+
+/**
+ * JWT-based authentication middleware (legacy, kept for backward compatibility)
+ * Use sessionAuth for new code
+ */
+export const jwtAuth = createMiddleware<HonoEnv>(async (c, next) => {
+  // Extract Bearer token from Authorization header
+  const authHeader = c.req.header('Authorization')
+
+  if (!authHeader) {
+    throw new HTTPException(401, {
+      message: 'Missing authorization header',
+    })
+  }
+
+  const [scheme, token] = authHeader.split(' ')
+
+  if (scheme !== 'Bearer' || !token) {
+    throw new HTTPException(401, {
+      message: 'Invalid authorization header format. Expected: Bearer <token>',
+    })
+  }
+
+  // Verify JWT
+  let payload: JWTPayload
+  try {
+    payload = (await verify(token, c.env.JWT_SECRET)) as unknown as JWTPayload
+  } catch {
+    throw new HTTPException(401, {
+      message: 'Invalid or expired token',
+    })
+  }
+
+  if (!payload.sub) {
+    throw new HTTPException(401, {
+      message: 'Invalid token payload: missing sub',
+    })
+  }
+
+  // Look up user in database by ID (from sub claim)
+  const db = c.get('db')
+  if (!db) {
+    throw new HTTPException(500, { message: 'Database not initialized' })
+  }
+  const userResults = await db
+    .select()
+    .from(users)
+    .where(and(eq(users.id, payload.sub), isNull(users.deletedAt)))
+    .limit(1)
+
+  const user = userResults.at(0)
+  if (!user) {
+    throw new HTTPException(401, {
+      message: 'User not found',
+    })
+  }
+
+  if (user.status !== 'active') {
+    throw new HTTPException(401, {
+      message: 'User account is not active',
+    })
+  }
+
+  // Set user in context
+  c.set('user', {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    status: user.status,
+    providerIds: user.providerIds ?? [],
+    isSuperAdmin: user.isSuperAdmin,
+    createdAt: user.createdAt,
+    updatedAt: user.updatedAt,
+    deletedAt: user.deletedAt,
+  })
+
+  await next()
+})

package/templates/base/src/server/middleware/cors.test.ts

@@ -0,0 +1,88 @@
+import { describe, it, expect } from 'vitest'
+import { Hono } from 'hono'
+import { configurableCors } from './cors'
+
+describe('configurableCors', () => {
+  it('allows origin from CORS_ORIGINS list', async () => {
+    const app = new Hono()
+    app.use('*', configurableCors({
+      corsOrigins: ['https://app.example.com', 'https://admin.example.com'],
+      appUrl: 'https://default.example.com',
+    }))
+    app.get('/api/test', (c) => c.json({ ok: true }))
+
+    const res = await app.request('/api/test', {
+      headers: { Origin: 'https://app.example.com' },
+    })
+
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('https://app.example.com')
+  })
+
+  it('rejects origin not in CORS_ORIGINS list', async () => {
+    const app = new Hono()
+    app.use('*', configurableCors({
+      corsOrigins: ['https://app.example.com'],
+      appUrl: 'https://default.example.com',
+    }))
+    app.get('/api/test', (c) => c.json({ ok: true }))
+
+    const res = await app.request('/api/test', {
+      headers: { Origin: 'https://malicious.com' },
+    })
+
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBeNull()
+  })
+
+  it('uses APP_URL when CORS_ORIGINS is empty', async () => {
+    const app = new Hono()
+    app.use('*', configurableCors({
+      corsOrigins: [],
+      appUrl: 'https://default.example.com',
+    }))
+    app.get('/api/test', (c) => c.json({ ok: true }))
+
+    const res = await app.request('/api/test', {
+      headers: { Origin: 'https://default.example.com' },
+    })
+
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('https://default.example.com')
+  })
+
+  it('sets credentials to true', async () => {
+    const app = new Hono()
+    app.use('*', configurableCors({
+      corsOrigins: ['https://app.example.com'],
+      appUrl: 'https://default.example.com',
+    }))
+    app.get('/api/test', (c) => c.json({ ok: true }))
+
+    const res = await app.request('/api/test', {
+      headers: { Origin: 'https://app.example.com' },
+    })
+
+    expect(res.headers.get('Access-Control-Allow-Credentials')).toBe('true')
+  })
+
+  it('allows required headers', async () => {
+    const app = new Hono()
+    app.use('*', configurableCors({
+      corsOrigins: ['https://app.example.com'],
+      appUrl: 'https://default.example.com',
+    }))
+    app.options('/api/test', (c) => c.text(''))
+
+    const res = await app.request('/api/test', {
+      method: 'OPTIONS',
+      headers: {
+        Origin: 'https://app.example.com',
+        'Access-Control-Request-Method': 'POST',
+        'Access-Control-Request-Headers': 'Content-Type',
+      },
+    })
+
+    const allowedHeaders = res.headers.get('Access-Control-Allow-Headers')
+    expect(allowedHeaders).toContain('Content-Type')
+    expect(allowedHeaders).toContain('Authorization')
+    expect(allowedHeaders).toContain('Account-ID')
+  })
+})

package/templates/base/src/server/middleware/cors.ts

@@ -0,0 +1,26 @@
+import { cors } from 'hono/cors'
+
+interface CorsConfig {
+  corsOrigins: string[]
+  appUrl: string
+}
+
+/**
+ * Configurable CORS middleware.
+ * Uses CORS_ORIGINS list if provided, otherwise falls back to APP_URL.
+ */
+export const configurableCors = (config: CorsConfig) => {
+  const allowedOrigins = config.corsOrigins.length > 0
+    ? config.corsOrigins
+    : [config.appUrl]
+
+  return cors({
+    origin: (origin) => {
+      if (!origin) return null
+      return allowedOrigins.includes(origin) ? origin : null
+    },
+    credentials: true,
+    allowHeaders: ['Content-Type', 'Authorization', 'Account-ID'],
+    allowMethods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
+  })
+}

package/templates/base/src/server/middleware/error-handler.test.ts

@@ -0,0 +1,69 @@
+import { describe, it, expect } from 'vitest'
+import { Hono } from 'hono'
+import { errorHandler } from './error-handler'
+import { ValidationError, NotFoundError, InternalError } from '../lib/errors'
+
+describe('errorHandler', () => {
+  const createApp = () => {
+    const app = new Hono()
+    app.onError(errorHandler)
+    return app
+  }
+
+  it('handles ValidationError with correct format', async () => {
+    const app = createApp()
+    app.get('/test', () => {
+      throw new ValidationError('Invalid email', { field: 'email' })
+    })
+
+    const res = await app.request('/test')
+    const body = await res.json()
+
+    expect(res.status).toBe(400)
+    expect(body.error.code).toBe('VALIDATION_ERROR')
+    expect(body.error.message).toBe('Invalid email')
+    expect(body.error.status).toBe(400)
+    expect(body.error.timestamp).toBeDefined()
+    expect(body.error.details).toEqual({ field: 'email' })
+  })
+
+  it('handles NotFoundError', async () => {
+    const app = createApp()
+    app.get('/test', () => {
+      throw new NotFoundError('User')
+    })
+
+    const res = await app.request('/test')
+    const body = await res.json()
+
+    expect(res.status).toBe(404)
+    expect(body.error.code).toBe('NOT_FOUND')
+    expect(body.error.message).toBe('User not found')
+  })
+
+  it('handles unknown errors as INTERNAL_ERROR', async () => {
+    const app = createApp()
+    app.get('/test', () => {
+      throw new Error('Something went wrong')
+    })
+
+    const res = await app.request('/test')
+    const body = await res.json()
+
+    expect(res.status).toBe(500)
+    expect(body.error.code).toBe('INTERNAL_ERROR')
+    expect(body.error.message).toBe('Internal server error')
+  })
+
+  it('includes timestamp in ISO format', async () => {
+    const app = createApp()
+    app.get('/test', () => {
+      throw new NotFoundError('Resource')
+    })
+
+    const res = await app.request('/test')
+    const body = await res.json()
+
+    expect(() => new Date(body.error.timestamp)).not.toThrow()
+  })
+})

package/templates/base/src/server/middleware/error-handler.ts

@@ -0,0 +1,43 @@
+import type { ErrorHandler } from 'hono'
+import { HTTPException } from 'hono/http-exception'
+import { getErrorCode, type ErrorCode } from '../lib/errors'
+
+interface ErrorResponse {
+  error: {
+    code: ErrorCode
+    message: string
+    status: number
+    timestamp: string
+    details?: unknown
+  }
+}
+
+export const errorHandler: ErrorHandler = (err, c) => {
+  const status = err instanceof HTTPException ? err.status : 500
+  const message = err instanceof HTTPException ? err.message : 'Internal server error'
+  const code = getErrorCode(err)
+  const details = err instanceof HTTPException ? (err as HTTPException & { cause?: unknown }).cause : undefined
+
+  // Log the error for debugging (use console.log for Cloudflare Workers visibility)
+  console.log(JSON.stringify({
+    _tag: 'ERROR_HANDLER',
+    status,
+    code,
+    message,
+    name: err.name,
+    stack: err.stack?.substring(0, 500),
+    cause: String((err as Error & { cause?: unknown }).cause),
+  }))
+
+  const response: ErrorResponse = {
+    error: {
+      code,
+      message,
+      status,
+      timestamp: new Date().toISOString(),
+      ...(details !== undefined && { details }),
+    },
+  }
+
+  return c.json(response, status)
+}

package/templates/base/src/server/middleware/index.ts

@@ -0,0 +1,8 @@
+// src/middleware/index.ts
+export { requestContext } from './request-context'
+export { jwtAuth, sessionAuth } from './auth'
+export { accountMiddleware } from './account'
+export { errorHandler } from './error-handler'
+export { requestLogger } from './request-logger'
+export { configurableCors } from './cors'
+export { rateLimit, authRateLimit, rateLimitWithStore, RateLimitStore, globalStore } from './rate-limit'