@feasibleone/blong-gogo 1.25.1 → 1.27.0

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## [1.27.0](https://github.com/feasibleone/blong/compare/blong-gogo-v1.26.0...blong-gogo-v1.27.0) (2026-07-23)
+
+
+### Features
+
+* compress static assets ([a0a376d](https://github.com/feasibleone/blong/commit/a0a376dc141a8b3041ad0c83895bd3de5675c2e2))
+* static routes ([b544ca3](https://github.com/feasibleone/blong/commit/b544ca3b4c3ed858457c93f21b8523147c30bf59))
+
+## [1.26.0](https://github.com/feasibleone/blong/compare/blong-gogo-v1.25.1...blong-gogo-v1.26.0) (2026-07-14)
+
+
+### Features
+
+* authorization ([cf1a7ff](https://github.com/feasibleone/blong/commit/cf1a7ff605de0a6078fc859a31532443386808b2))
+* blong-mock, blong-server ([756caca](https://github.com/feasibleone/blong/commit/756cacab712db6792bf1b93830fc1d833b396f8d))
+* blong-party ([602a3b4](https://github.com/feasibleone/blong/commit/602a3b422e1f76c27a96b1cd5d5a8cf0edbc268f))
+* check access credentials ([e6af405](https://github.com/feasibleone/blong/commit/e6af405c43921cb9c553db9c4986b7fe56154724))
+* core.resource merging ([371d3e2](https://github.com/feasibleone/blong/commit/371d3e2b3f519dfd59ca4fd480bc33317992afcd))
+* implement subjectObjectSchema ([8ca3282](https://github.com/feasibleone/blong/commit/8ca32829277b9816eb5e43ce708d2f1d0cc3ef28))
+* improve playwright ([c88dca8](https://github.com/feasibleone/blong/commit/c88dca832548a878ce81aab7320395c3c6a81551))
+* manifest concept ([ed3c038](https://github.com/feasibleone/blong/commit/ed3c038352644d2d8f828b3cb69cbea718e7084b))
+* object schema ([688d5d2](https://github.com/feasibleone/blong/commit/688d5d2a4a895c8feba7b898da03c46b3a3f3292))
+* playwright coverage ([616cf61](https://github.com/feasibleone/blong/commit/616cf61f8616dc7fa6fac8f75fcd5a8577e70448))
+* schema helpers and constraints ([8409257](https://github.com/feasibleone/blong/commit/84092571f6b327c1166ef142f70cb7d91b013eaf))
+* schema sync ([ae63684](https://github.com/feasibleone/blong/commit/ae63684ea85d2b0f7adc8e8a380e51e0564d54c4))
+* seed ([5c76603](https://github.com/feasibleone/blong/commit/5c7660392bc1197638810e864bfd47ce1218b2e5))
+* support expressions in the configuration ([843bb58](https://github.com/feasibleone/blong/commit/843bb58c97456d85eac573874c90755bdb68bc95))
+* vitest coverage ([4c6d9cb](https://github.com/feasibleone/blong/commit/4c6d9cb941957b0291cbe091e06884589b1e8f06))
+
+
+### Bug Fixes
+
+* authorization flow test ([f816dc2](https://github.com/feasibleone/blong/commit/f816dc2fb0d1556dff04d42901cfe5c36cca0717))
+* build ([de22713](https://github.com/feasibleone/blong/commit/de2271393350945b8d793ca0ec89670465bba085))
+* core.resource merging ([f191055](https://github.com/feasibleone/blong/commit/f1910558ce0f369f556911c4c0f6397b8003fd33))
+* full stack alignment for CRUD ([8795e08](https://github.com/feasibleone/blong/commit/8795e087182402ac28c3ea03c6bee27319069625))
+* handle existing PK ([fb0041b](https://github.com/feasibleone/blong/commit/fb0041b8f6ac7ba2f0dc0a752ab19dd49c09d79f))
+* hanging playwright install ([13bf7a4](https://github.com/feasibleone/blong/commit/13bf7a4031f1f94160e0cb9d8b4f83a1732e70af))
+* keep running the server in CI for the playwright intent ([5d01f3b](https://github.com/feasibleone/blong/commit/5d01f3b044f4506c2f6fab3c2c048b116b59accb))
+* login ([4def73d](https://github.com/feasibleone/blong/commit/4def73d33473d2b9183e91fa1ab030b2ccb85ad5))
+* Playwright, Storybook and realm DRY ([4302512](https://github.com/feasibleone/blong/commit/43025123e613ef43e0ac5b83ab00fbc0cabfccf2))
+* Playwright, Storybook and realm DRY ([7bbfad8](https://github.com/feasibleone/blong/commit/7bbfad8160da0ead5600ad56b543e935bfd01954))
+* portal loading in the browser ([5c2bc76](https://github.com/feasibleone/blong/commit/5c2bc762dea53d7d2caa0022ea3d7e3f106fdddb))
+
 ## [1.25.1](https://github.com/feasibleone/blong/compare/blong-gogo-v1.25.0...blong-gogo-v1.25.1) (2026-05-25)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feasibleone/blong-gogo",
-  "version": "1.25.1",
+  "version": "1.27.0",
   "repository": {
     "url": "git+https://github.com/feasibleone/blong.git"
   },
@@ -24,12 +24,18 @@
     "@fastify/bearer-auth": "^10.1.2",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",
+    "@fastify/deepmerge": "^3.2.1",
+    "@fastify/helmet": "^13.1.0",
+    "@fastify/static": "^10.1.0",
     "@fastify/swagger": "^9.7.0",
     "@fastify/swagger-ui": "^5.2.5",
+    "@fastify/type-provider-typebox": "^6.1.0",
     "@feasibleone/blong": "^1.0.0",
     "@feasibleone/blong-chain": "^1.0.0",
     "@feasibleone/blong-config": "^1.0.0",
     "@feasibleone/blong-kopi": "^1.0.0",
+    "@feasibleone/blong-lib": "^1.0.0",
+    "@feasibleone/blong-mock": "^1.0.0",
     "@keycloak/keycloak-admin-client": "^26.6.2",
     "@kubernetes/client-node": "^1.4.0",
     "@octokit/rest": "^22.0.1",
@@ -43,7 +49,7 @@
     "fastify-plugin": "^5.1.0",
     "got": "^14.6.6",
     "jose": "^6.2.1",
-    "knex": "^3.1.0",
+    "knex": "^3.2.10",
     "ky": "^1.14.2",
     "lru-cache": "^11.2.4",
     "minimist": "^1.2.8",
@@ -64,10 +70,12 @@
     "undici": "^8.0.1",
     "ut-bitsyntax": "^6.2.7",
     "ut-dns-discovery": "^6.2.3",
+    "ut-function.cbc": "^1.1.6",
     "ut-function.interpolate": "1.1.3",
     "ut-function.merge": "^1.5.6",
     "uuid": "^13.0.0",
-    "yaml": "^2.8.3"
+    "yaml": "^2.8.3",
+    "@feasibleone/blong-template": "1.0.0"
   },
   "devDependencies": {
     "@rushstack/heft": "^1.2.6",
@@ -75,10 +83,10 @@
     "@rushstack/heft-typescript-plugin": "^1.3.1",
     "@types/cacache": "^20.0.1",
     "@types/node": "^24",
-    "playwright": "^1.58.2",
+    "playwright": "^1.60.0",
     "tap": "^21.6.3",
     "typescript": "^6.0.3",
-    "@feasibleone/blong-dev": "1.0.2"
+    "@feasibleone/blong-dev": "1.1.1"
   },
   "scripts": {
     "browser-check": "node scripts/browser-compat-check.mjs",

package/src/AdapterBase.ts

@@ -11,7 +11,6 @@ import type {
 } from '@feasibleone/blong/types';
 import type net from 'node:net';
 import PQueue from 'p-queue';
-import merge from 'ut-function.merge';
 
 import ConfigRuntime from './ConfigRuntime.ts';
 import {isExpectedError} from './lib.ts';
@@ -87,6 +86,7 @@ export class AdapterBase<T, C extends IContext> implements AdapterHandlerContext
     configBase: string;
     log: unknown = null;
     importedMap?: Map<string, Record<string, (...args: unknown[]) => unknown>>;
+    platform: IApi['platform'];
 
     // These are prefixed with _ rather than using # private class fields.
     // The adapter uses Object.setPrototypeOf(current, base) to set the base as
@@ -103,7 +103,7 @@ export class AdapterBase<T, C extends IContext> implements AdapterHandlerContext
     // api.attachHandlers = ... only *after* the port factory returns.  Storing
     // the api object and reading api.attachHandlers lazily (at call time)
     // ensures we always see the real function rather than the initial undefined.
-    _api: Pick<IApi, 'attachHandlers'>;
+    _api: Pick<IApi, 'attachHandlers' | 'render' | 'attach'>;
     _createLog: IApi['createLog'];
     _attachCheckpoint: IApi['attachCheckpoint'];
     _activationNames: string[];
@@ -123,6 +123,9 @@ export class AdapterBase<T, C extends IContext> implements AdapterHandlerContext
             | 'attachHandlers'
             | 'createLog'
             | 'attachCheckpoint'
+            | 'render'
+            | 'platform'
+            | 'attach'
         >,
         configBase: string,
         activationNames: string[] = [],
@@ -133,6 +136,7 @@ export class AdapterBase<T, C extends IContext> implements AdapterHandlerContext
         this._dispatch = api.dispatch;
         this._methodId = api.methodId;
         this._getPath = api.getPath;
+        this.platform = api.platform;
         this._api = api;
         this._createLog = api.createLog;
         this._attachCheckpoint = api.attachCheckpoint;
@@ -150,7 +154,7 @@ export class AdapterBase<T, C extends IContext> implements AdapterHandlerContext
     }
 
     async init(...configs: object[]): Promise<void> {
-        this.config = merge(this.activeConfig(), ...configs) as Config<T, C>;
+        this.config = this._api.render([this.activeConfig(), ...configs]) as Config<T, C>;
         this.log = this._createLog?.(this.config.logLevel || 'info', {
             ...this.config.log,
             name: this.config.id,
@@ -275,7 +279,7 @@ export class AdapterBase<T, C extends IContext> implements AdapterHandlerContext
     async drain(): Promise<void> {}
 
     findHandler(methodName: string): unknown {
-        methodName = this._methodId(methodName);
+        methodName = this.methodPath(this._methodId(methodName));
         return this.imported[methodName];
     }
 
@@ -323,12 +327,12 @@ export class AdapterBase<T, C extends IContext> implements AdapterHandlerContext
         return this.event('start', {configBase: this.configBase, config});
     }
 
-    async link(
+    async attach(
         patterns: (string | RegExp)[] | string | RegExp,
-        target: AdapterHandlerContext = {} as unknown as AdapterHandlerContext,
+        target: object = {},
     ): Promise<object> {
-        await this._api.attachHandlers(target, patterns);
-        return target.imported;
+        await this._api.attach(target, patterns);
+        return target;
     }
 
     async handle(...params: unknown[]): Promise<unknown> {
@@ -371,17 +375,27 @@ export default async function adapter<T, C extends IContext>(
     configBase: string,
     activationNames: string[] = [],
 ): Promise<Adapter<T, C>> {
-    const {adapter: adapterFactory, utError, handlers, remote, rpc, local, registry, type} = api;
+    const {
+        adapter: adapterFactory,
+        utError,
+        handlers,
+        remote,
+        rpc,
+        local,
+        registry,
+        type,
+        schema,
+    } = api;
     _errors ||= utError.register(errorMap);
 
     const base = new AdapterBase<T, C>(api, configBase, activationNames);
 
-    const result = handlers!({utError, remote, type});
+    const result = handlers!({utError, remote, type, schema: registry.objectSchema, manifest: api.manifest});
     let current = result;
     while (current.extends) {
         const parent = await (typeof current.extends === 'string'
-            ? adapterFactory(current.extends)!({utError, remote, rpc, local, registry})
-            : current.extends({utError, remote, rpc, local, registry}));
+            ? adapterFactory(current.extends)!({utError, remote, rpc, local, registry, schema, manifest: api.manifest})
+            : current.extends({utError, remote, rpc, local, registry, schema, manifest: api.manifest}));
         Object.setPrototypeOf(current, parent);
         current = parent;
     }

package/src/ConfigRuntime.ts

@@ -133,7 +133,12 @@ export function createConfigProxy<T extends object>(
             get(_target, prop) {
                 const container = getNode(path);
                 const val = container == null ? undefined : Reflect.get(container as object, prop);
-                if (val === undefined || val === null || typeof val !== 'object') {
+                if (
+                    val === undefined ||
+                    val === null ||
+                    typeof val !== 'object' ||
+                    val.constructor !== Object
+                ) {
                     if (
                         _factoryPhase.active &&
                         val !== undefined &&
@@ -252,7 +257,9 @@ export function deepDiff(prev: unknown, next: unknown, path = ''): ConfigDiff {
 // ---------------------------------------------------------------------------
 
 export default class ConfigRuntime implements IConfigRuntime {
-    readonly #loadParams: object;
+    readonly #baseConfig: object;
+    readonly #configs: object[];
+    readonly #suite: string;
     readonly #subscribers: Set<ConfigSubscriber> = new Set();
 
     #rawSnapshot: object = {};
@@ -262,8 +269,10 @@ export default class ConfigRuntime implements IConfigRuntime {
     readonly enterConfig: (mode?: FactoryPhaseMode) => void;
     readonly exitConfig: () => Error[];
 
-    public constructor(loadParams: object = {}) {
-        this.#loadParams = loadParams;
+    public constructor(baseConfig: object, configs: (object | boolean)[], suite: string) {
+        this.#baseConfig = baseConfig;
+        this.#configs = configs.filter(Boolean) as object[];
+        this.#suite = suite;
         const {proxy, update, enterConfig, exitConfig} = createConfigProxy(this.#rawSnapshot);
         this.#proxy = proxy;
         this.#updateProxy = update;
@@ -283,13 +292,18 @@ export default class ConfigRuntime implements IConfigRuntime {
         return this.#rawSnapshot;
     }
 
+    private mergeConfigs(blongConfig: object): object {
+        const loaded = loadBlong(blongConfig);
+        return merge({}, this.#baseConfig, ...this.#configs, loaded);
+    }
+
     /**
      * Load configuration from all sources using blong-config.
      * Merges the result into the proxy backing store so existing references
      * automatically reflect the new values.
      */
     public async load(params: object = {}): Promise<object> {
-        const loaded = loadBlong({...this.#loadParams, ...params});
+        const loaded = this.mergeConfigs({config: {suite: this.#suite}, ...params});
         this.#rawSnapshot = loaded;
         this.#updateProxy(loaded);
         return this.#proxy;
@@ -304,7 +318,7 @@ export default class ConfigRuntime implements IConfigRuntime {
      */
     public async reload(): Promise<ConfigDiff> {
         const prev = this.#rawSnapshot;
-        const next = loadBlong(this.#loadParams);
+        const next = this.mergeConfigs({config: {suite: this.#suite}});
         const diff = this.diff(prev, next);
 
         // Only do work when something actually changed
@@ -390,17 +404,4 @@ export default class ConfigRuntime implements IConfigRuntime {
                 .flat(),
         ]);
     }
-
-    /**
-     * Merge module configs from multiple sources in the standard order.
-     *
-     * Previously done in `loadRealm()`:
-     *   `merge(mergedConfig, ...loadedConfigs.filter(Boolean))`
-     *
-     * @param base - the base config object (mutated in place)
-     * @param sources - config objects to merge, in priority order
-     */
-    static mergeModuleConfig(base: object, ...sources: unknown[]): object {
-        return merge(base, ...sources.filter(Boolean));
-    }
 }

package/src/Gateway.ts

@@ -7,6 +7,7 @@ import type {
     IGateway,
     ILocal,
     ILog,
+    IManifest,
     IMeta,
     IPlatformApi,
 } from '@feasibleone/blong/types';
@@ -15,12 +16,14 @@ import fastify, {type FastifyReply, type FastifyRequest, type RouteOptions} from
 import os from 'os';
 import type {LevelWithSilent} from 'pino';
 import {Type, type TSchema} from 'typebox';
+import Value from 'typebox/value';
 import {v4} from 'uuid';
 
+import {type TypeBoxTypeProvider} from '@fastify/type-provider-typebox';
 import type {IResolution} from './Resolution.ts';
 import type {IRpcClient} from './RpcClient.ts';
 import jwt from './jwt.ts';
-import {isExpectedError, methodParts, snakeToCamel} from './lib.ts';
+import {isExpectedError, methodId, methodParts, snakeToCamel} from './lib.ts';
 import type {IConfig as IConfigMLE} from './mle.ts';
 import swagger from './swagger.ts';
 
@@ -68,11 +71,21 @@ interface IConfig extends IConfigMLE {
      * production to prevent callers from suppressing audit-level error logs.
      */
     expectedErrors?: boolean;
+    /**
+     * Optional handler name (semantic triple) that returns the list of allowed
+     * actions for the authenticated user.  When set, the gateway calls this
+     * handler during authentication and stores the result in credentials,
+     * then enforces that every request's methodId is in the allowed list.
+     */
+    authorize?: string;
     errorFields: unknown[];
     jwt: {
         cache: object;
         audience: string;
     };
+    static?: {
+        root: string;
+    };
 }
 
 function operationParams(
@@ -146,7 +159,7 @@ export default class Gateway extends Internal implements IGateway {
     #config: IConfig = {
         host: '0.0.0.0',
         port: 8080,
-        logLevel: 'trace',
+        logLevel: 'warn',
         cors: undefined,
         sign: undefined as IConfig['sign'] | undefined,
         encrypt: undefined as IConfig['encrypt'] | undefined,
@@ -156,6 +169,7 @@ export default class Gateway extends Internal implements IGateway {
         },
         debug: false,
         expectedErrors: false,
+        authorize: undefined,
         errorFields: [],
         jwt: {
             cache: {},
@@ -170,6 +184,7 @@ export default class Gateway extends Internal implements IGateway {
     #errorFields: [string, unknown][] = [];
     #plugins: {plugin: unknown; options: unknown}[] = [];
     #platform: IPlatformApi;
+    #manifest: IManifest | undefined;
 
     public constructor(
         config: IConfig,
@@ -180,6 +195,7 @@ export default class Gateway extends Internal implements IGateway {
             resolution,
             local,
             platform,
+            manifest,
         }: {
             log?: ILog;
             error?: IErrorFactory;
@@ -187,6 +203,7 @@ export default class Gateway extends Internal implements IGateway {
             local?: ILocal;
             resolution?: IResolution;
             platform?: IPlatformApi;
+            manifest?: IManifest;
         },
     ) {
         super({log});
@@ -194,6 +211,16 @@ export default class Gateway extends Internal implements IGateway {
         this.#platform = platform!;
 
         this.merge(this.#config, config);
+        this.#config.sign ||= (
+            process.env.GATEWAY_SIGN_KEY
+                ? {env: 'GATEWAY_SIGN_KEY'}
+                : {generate: {alg: 'ES384', crv: 'P-384', use: 'sig'}}
+        ) as IConfig['sign'];
+        this.#config.encrypt ||= (
+            process.env.GATEWAY_ENCRYPT_KEY
+                ? {env: 'GATEWAY_ENCRYPT_KEY'}
+                : {generate: {alg: 'ECDH-ES+A256KW', crv: 'P-384', use: 'enc'}}
+        ) as IConfig['encrypt'];
         this.#errorFields = Object.entries({
             type: true,
             message: true,
@@ -210,6 +237,7 @@ export default class Gateway extends Internal implements IGateway {
         this.#resolution = resolution!;
         this.#rpcClient = remote!;
         this.#local = local!;
+        this.#manifest = manifest;
     }
 
     protected config(): object {
@@ -336,6 +364,7 @@ export default class Gateway extends Internal implements IGateway {
                         : `/${value.basePath ?? 'rpc'}/${method.split('.').join('/')}`,
                 config: {
                     auth: value.auth ?? 'jwt',
+                    methodName: method,
                 },
                 schema: Type && {
                     ...('body' in value
@@ -539,11 +568,34 @@ export default class Gateway extends Internal implements IGateway {
                         strict: false,
                     },
                 },
+            }).withTypeProvider<TypeBoxTypeProvider>();
+
+            this.#server.setValidatorCompiler(({schema}: {schema: TSchema}) => {
+                return (data: unknown) => {
+                    // 1. Runtime validation check
+                    if (!Value.Check(schema, data)) {
+                        const errors = [...Value.Errors(schema, data)];
+                        return {
+                            error: new Error(
+                                `Validation failed: ${errors.map(e => e.message).join(', ')}`,
+                            ),
+                        };
+                    }
+
+                    // 2. Transform/Decode the validated string into a Date object
+                    try {
+                        const decoded = Value.Decode(schema, data);
+                        return {value: decoded};
+                    } catch (error) {
+                        return {error};
+                    }
+                };
             });
+
             this.#server.setErrorHandler(
                 (error: Record<string, unknown>, request: FastifyRequest, reply: FastifyReply) => {
                     request.log.error({err: error}, 'gateway unhandled error');
-                    return reply.status(500).send({
+                    return reply.status((error as {statusCode?: number}).statusCode || 500).send({
                         jsonrpc: '2.0',
                         id: (request.body as {id?: unknown})?.id,
                         error: this._formatError(error),
@@ -556,7 +608,16 @@ export default class Gateway extends Internal implements IGateway {
                     this.#rpcClient.verify(token, options),
                 errors: this.#errors,
                 audience: this.#config.jwt.audience,
+                authorize: this.#config.authorize,
+                local: this.#local,
+                methodId: methodId,
+                methodParts: methodParts,
             });
+            if (this.#config.static)
+                await this.#server.register(
+                    (await import('./static.ts')).default,
+                    this.#config.static,
+                );
             if (this.#config.cors)
                 await this.#server.register((await import('./cors.ts')).default, this.#config.cors);
             if (this.#config.sign || this.#config.encrypt) {
@@ -584,6 +645,13 @@ export default class Gateway extends Internal implements IGateway {
             port: this.#config.port,
             host: this.#config.host,
         });
+        // Publish the effective port to the manifest so other platforms
+        // (e.g. browser backend adapter) can discover it.
+        // The manifest proxy automatically resolves any pending deferred.
+        const address = this.#server.server.address();
+        if (this.#manifest && address && typeof address === 'object') {
+            this.#manifest.gatewayPort = address.port;
+        }
         return this;
     }