@forgezero/access 0.1.0 → 0.1.1

package/README.md

@@ -67,9 +67,9 @@ integration suite.
 | `/testing` | decide without a server |
 | `/pipeline` · `/authenticator` | the resolver, and WebAuthn |
 
-Full documentation: **https://forgezero.net/docs/access**
+Full documentation: **https://www.forgezero.net/docs/access**
 
 ## Licence
 
-MIT. Part of [ForgeZero](https://forgezero.net) — secrets, attested compute and
+MIT. Part of [ForgeZero](https://www.forgezero.net) — secrets, attested compute and
 deploys — and usable entirely on its own, with no ForgeZero account.

package/dist/conditions.js

@@ -288,7 +288,10 @@ function required(state, name, condition) {
 function loadTarget(options) {
   const as = options.as ?? "target";
   const code = options.code ?? "NOT_FOUND";
-  const readId = options.id ?? ((context) => context.params.id);
+  const readId = options.id ?? ((context) => {
+    const id = context.params.id;
+    return typeof id === "string" ? id : undefined;
+  });
   return define("loadTarget", options.routes, [{ status: 404, code, when: "no record matches the identifier" }], async (context) => {
     const id = readId(context);
     if (!id)

package/dist/elysia.js

@@ -286,6 +286,46 @@ function defineHandlers(routes, handlers) {
   }
   return handlers;
 }
+function recordFromValidator(value, part) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+    return value;
+  }
+  throw new AccessError("VALIDATOR_RESULT_INVALID", `The validator returned an unusable ${part} value.`);
+}
+function headersFromValidator(value) {
+  try {
+    return new Headers(value);
+  } catch {
+    throw new AccessError("VALIDATOR_RESULT_INVALID", "The validator returned an unusable headers value.");
+  }
+}
+function urlWithQuery(url, query) {
+  const validated = new URL(url);
+  validated.search = "";
+  for (const [name, value] of Object.entries(query)) {
+    const values = Array.isArray(value) ? value : [value];
+    for (const item of values) {
+      if (item !== undefined && item !== null)
+        validated.searchParams.append(name, String(item));
+    }
+  }
+  return validated;
+}
+async function responsePayload(response, routeKey) {
+  let text;
+  try {
+    text = await response.clone().text();
+  } catch {
+    throw new AccessError("RESPONSE_UNREADABLE", `"${routeKey}" returned a response that could not be inspected.`);
+  }
+  if (text.length === 0)
+    return;
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new AccessError("RESPONSE_NOT_JSON", `"${routeKey}" returned a non-JSON body for a declared response.`);
+  }
+}
 var WINDOWS = { s: 1, m: 60, h: 3600, d: 86400 };
 function windowSeconds(window) {
   const match = /^(\d+)([smhd])$/.exec(window);
@@ -370,13 +410,15 @@ function createPipeline(options) {
       }
     }
     let body;
-    const query = Object.fromEntries(url.searchParams);
+    let validatedParams = params;
+    let validatedQuery = Object.fromEntries(url.searchParams);
+    let validatedHeaders = new Headers(request.headers);
     if (validator) {
       const checks = [];
       if (route.params)
         checks.push(["params", route.params, params]);
       if (route.query)
-        checks.push(["query", route.query, query]);
+        checks.push(["query", route.query, validatedQuery]);
       if (route.headers)
         checks.push(["headers", route.headers, Object.fromEntries(request.headers)]);
       if (route.body) {
@@ -393,8 +435,20 @@ function createPipeline(options) {
             errors: result2.errors
           });
         }
-        if (where === "body")
-          body = result2.value;
+        switch (where) {
+          case "params":
+            validatedParams = recordFromValidator(result2.value, "params");
+            break;
+          case "query":
+            validatedQuery = recordFromValidator(result2.value, "query");
+            break;
+          case "headers":
+            validatedHeaders = headersFromValidator(result2.value);
+            break;
+          case "body":
+            body = result2.value;
+            break;
+        }
       }
     } else if (route.body) {
       body = await request.json().catch(() => {
@@ -404,11 +458,11 @@ function createPipeline(options) {
     const context = {
       route: routeKey,
       method: route.method,
-      url,
-      params,
-      query,
+      url: route.query && validator ? urlWithQuery(url, validatedQuery) : url,
+      params: validatedParams,
+      query: validatedQuery,
       body,
-      headers: request.headers,
+      headers: validatedHeaders,
       session,
       realm,
       stage,
@@ -508,16 +562,19 @@ function createPipeline(options) {
     }
     const result = await (telemetry ? telemetry.span("handler", { "access.route": routeKey }, async () => handler(context, state)) : handler(context, state));
     if (validateResponses && validator && route.response) {
-      const schema = route.response[200];
-      if (schema && !(result instanceof Response)) {
-        const check = validator.validate(schema, result);
-        if (!check.ok) {
-          throw new AccessError("RESPONSE_MISMATCH", `"${routeKey}" returned a shape it does not declare: ${check.errors[0]?.message}`);
-        }
+      const status = result instanceof Response ? result.status : 200;
+      const schema = route.response[status];
+      if (!schema) {
+        throw new AccessError("RESPONSE_STATUS_UNDECLARED", `"${routeKey}" returned undeclared status ${status}.`);
+      }
+      const payload = result instanceof Response ? await responsePayload(result, routeKey) : result;
+      const check = validator.validate(schema, payload);
+      if (!check.ok) {
+        throw new AccessError("RESPONSE_MISMATCH", `"${routeKey}" returned status ${status} with a body that does not match its declaration.`);
       }
     }
     runAfter(result);
-    record({ "access.outcome": "allowed", "access.status": 200 });
+    record({ "access.outcome": "allowed", "access.status": result instanceof Response ? result.status : 200 });
     return result instanceof Response ? result : new Response(JSON.stringify(result), { headers: { "content-type": "application/json" } });
   };
 }

package/dist/fetch.js

@@ -286,6 +286,46 @@ function defineHandlers(routes, handlers) {
   }
   return handlers;
 }
+function recordFromValidator(value, part) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+    return value;
+  }
+  throw new AccessError("VALIDATOR_RESULT_INVALID", `The validator returned an unusable ${part} value.`);
+}
+function headersFromValidator(value) {
+  try {
+    return new Headers(value);
+  } catch {
+    throw new AccessError("VALIDATOR_RESULT_INVALID", "The validator returned an unusable headers value.");
+  }
+}
+function urlWithQuery(url, query) {
+  const validated = new URL(url);
+  validated.search = "";
+  for (const [name, value] of Object.entries(query)) {
+    const values = Array.isArray(value) ? value : [value];
+    for (const item of values) {
+      if (item !== undefined && item !== null)
+        validated.searchParams.append(name, String(item));
+    }
+  }
+  return validated;
+}
+async function responsePayload(response, routeKey) {
+  let text;
+  try {
+    text = await response.clone().text();
+  } catch {
+    throw new AccessError("RESPONSE_UNREADABLE", `"${routeKey}" returned a response that could not be inspected.`);
+  }
+  if (text.length === 0)
+    return;
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new AccessError("RESPONSE_NOT_JSON", `"${routeKey}" returned a non-JSON body for a declared response.`);
+  }
+}
 var WINDOWS = { s: 1, m: 60, h: 3600, d: 86400 };
 function windowSeconds(window) {
   const match = /^(\d+)([smhd])$/.exec(window);
@@ -370,13 +410,15 @@ function createPipeline(options) {
       }
     }
     let body;
-    const query = Object.fromEntries(url.searchParams);
+    let validatedParams = params;
+    let validatedQuery = Object.fromEntries(url.searchParams);
+    let validatedHeaders = new Headers(request.headers);
     if (validator) {
       const checks = [];
       if (route.params)
         checks.push(["params", route.params, params]);
       if (route.query)
-        checks.push(["query", route.query, query]);
+        checks.push(["query", route.query, validatedQuery]);
       if (route.headers)
         checks.push(["headers", route.headers, Object.fromEntries(request.headers)]);
       if (route.body) {
@@ -393,8 +435,20 @@ function createPipeline(options) {
             errors: result2.errors
           });
         }
-        if (where === "body")
-          body = result2.value;
+        switch (where) {
+          case "params":
+            validatedParams = recordFromValidator(result2.value, "params");
+            break;
+          case "query":
+            validatedQuery = recordFromValidator(result2.value, "query");
+            break;
+          case "headers":
+            validatedHeaders = headersFromValidator(result2.value);
+            break;
+          case "body":
+            body = result2.value;
+            break;
+        }
       }
     } else if (route.body) {
       body = await request.json().catch(() => {
@@ -404,11 +458,11 @@ function createPipeline(options) {
     const context = {
       route: routeKey,
       method: route.method,
-      url,
-      params,
-      query,
+      url: route.query && validator ? urlWithQuery(url, validatedQuery) : url,
+      params: validatedParams,
+      query: validatedQuery,
       body,
-      headers: request.headers,
+      headers: validatedHeaders,
       session,
       realm,
       stage,
@@ -508,16 +562,19 @@ function createPipeline(options) {
     }
     const result = await (telemetry ? telemetry.span("handler", { "access.route": routeKey }, async () => handler(context, state)) : handler(context, state));
     if (validateResponses && validator && route.response) {
-      const schema = route.response[200];
-      if (schema && !(result instanceof Response)) {
-        const check = validator.validate(schema, result);
-        if (!check.ok) {
-          throw new AccessError("RESPONSE_MISMATCH", `"${routeKey}" returned a shape it does not declare: ${check.errors[0]?.message}`);
-        }
+      const status = result instanceof Response ? result.status : 200;
+      const schema = route.response[status];
+      if (!schema) {
+        throw new AccessError("RESPONSE_STATUS_UNDECLARED", `"${routeKey}" returned undeclared status ${status}.`);
+      }
+      const payload = result instanceof Response ? await responsePayload(result, routeKey) : result;
+      const check = validator.validate(schema, payload);
+      if (!check.ok) {
+        throw new AccessError("RESPONSE_MISMATCH", `"${routeKey}" returned status ${status} with a body that does not match its declaration.`);
       }
     }
     runAfter(result);
-    record({ "access.outcome": "allowed", "access.status": 200 });
+    record({ "access.outcome": "allowed", "access.status": result instanceof Response ? result.status : 200 });
     return result instanceof Response ? result : new Response(JSON.stringify(result), { headers: { "content-type": "application/json" } });
   };
 }

package/dist/index.d.ts

@@ -221,7 +221,8 @@ export interface RequestContext {
     route: string;
     method: Method;
     url: URL;
-    params: Record<string, string>;
+    /** Validated route parameters. A schema may convert path text to numbers or booleans. */
+    params: Record<string, unknown>;
     query: Record<string, unknown>;
     body: unknown;
     headers: Headers;

package/dist/pipeline.js

@@ -286,6 +286,46 @@ function defineHandlers(routes, handlers) {
   }
   return handlers;
 }
+function recordFromValidator(value, part) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+    return value;
+  }
+  throw new AccessError("VALIDATOR_RESULT_INVALID", `The validator returned an unusable ${part} value.`);
+}
+function headersFromValidator(value) {
+  try {
+    return new Headers(value);
+  } catch {
+    throw new AccessError("VALIDATOR_RESULT_INVALID", "The validator returned an unusable headers value.");
+  }
+}
+function urlWithQuery(url, query) {
+  const validated = new URL(url);
+  validated.search = "";
+  for (const [name, value] of Object.entries(query)) {
+    const values = Array.isArray(value) ? value : [value];
+    for (const item of values) {
+      if (item !== undefined && item !== null)
+        validated.searchParams.append(name, String(item));
+    }
+  }
+  return validated;
+}
+async function responsePayload(response, routeKey) {
+  let text;
+  try {
+    text = await response.clone().text();
+  } catch {
+    throw new AccessError("RESPONSE_UNREADABLE", `"${routeKey}" returned a response that could not be inspected.`);
+  }
+  if (text.length === 0)
+    return;
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new AccessError("RESPONSE_NOT_JSON", `"${routeKey}" returned a non-JSON body for a declared response.`);
+  }
+}
 var WINDOWS = { s: 1, m: 60, h: 3600, d: 86400 };
 function windowSeconds(window) {
   const match = /^(\d+)([smhd])$/.exec(window);
@@ -370,13 +410,15 @@ function createPipeline(options) {
       }
     }
     let body;
-    const query = Object.fromEntries(url.searchParams);
+    let validatedParams = params;
+    let validatedQuery = Object.fromEntries(url.searchParams);
+    let validatedHeaders = new Headers(request.headers);
     if (validator) {
       const checks = [];
       if (route.params)
         checks.push(["params", route.params, params]);
       if (route.query)
-        checks.push(["query", route.query, query]);
+        checks.push(["query", route.query, validatedQuery]);
       if (route.headers)
         checks.push(["headers", route.headers, Object.fromEntries(request.headers)]);
       if (route.body) {
@@ -393,8 +435,20 @@ function createPipeline(options) {
             errors: result2.errors
           });
         }
-        if (where === "body")
-          body = result2.value;
+        switch (where) {
+          case "params":
+            validatedParams = recordFromValidator(result2.value, "params");
+            break;
+          case "query":
+            validatedQuery = recordFromValidator(result2.value, "query");
+            break;
+          case "headers":
+            validatedHeaders = headersFromValidator(result2.value);
+            break;
+          case "body":
+            body = result2.value;
+            break;
+        }
       }
     } else if (route.body) {
       body = await request.json().catch(() => {
@@ -404,11 +458,11 @@ function createPipeline(options) {
     const context = {
       route: routeKey,
       method: route.method,
-      url,
-      params,
-      query,
+      url: route.query && validator ? urlWithQuery(url, validatedQuery) : url,
+      params: validatedParams,
+      query: validatedQuery,
       body,
-      headers: request.headers,
+      headers: validatedHeaders,
       session,
       realm,
       stage,
@@ -508,16 +562,19 @@ function createPipeline(options) {
     }
     const result = await (telemetry ? telemetry.span("handler", { "access.route": routeKey }, async () => handler(context, state)) : handler(context, state));
     if (validateResponses && validator && route.response) {
-      const schema = route.response[200];
-      if (schema && !(result instanceof Response)) {
-        const check = validator.validate(schema, result);
-        if (!check.ok) {
-          throw new AccessError("RESPONSE_MISMATCH", `"${routeKey}" returned a shape it does not declare: ${check.errors[0]?.message}`);
-        }
+      const status = result instanceof Response ? result.status : 200;
+      const schema = route.response[status];
+      if (!schema) {
+        throw new AccessError("RESPONSE_STATUS_UNDECLARED", `"${routeKey}" returned undeclared status ${status}.`);
+      }
+      const payload = result instanceof Response ? await responsePayload(result, routeKey) : result;
+      const check = validator.validate(schema, payload);
+      if (!check.ok) {
+        throw new AccessError("RESPONSE_MISMATCH", `"${routeKey}" returned status ${status} with a body that does not match its declaration.`);
       }
     }
     runAfter(result);
-    record({ "access.outcome": "allowed", "access.status": 200 });
+    record({ "access.outcome": "allowed", "access.status": result instanceof Response ? result.status : 200 });
     return result instanceof Response ? result : new Response(JSON.stringify(result), { headers: { "content-type": "application/json" } });
   };
 }

package/package.json

@@ -1,10 +1,10 @@
 {
-  "//": "Publishing happens from an operator's machine, not CI \u2014 CLAUDE.md records that the absence of CI is deliberate. npm's `provenance` attests a tarball was built by a recognised CI provider from a named commit, so it cannot be produced here: it was set, and the first publish failed with `Automatic provenance generation not supported for provider: null`. A setting that can never be satisfied is worse than none, because it reads as a guarantee nobody is getting. Restore it the day this publishes from CI, and not before.",
   "name": "@forgezero/access",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "exports": {
     ".": {
@@ -56,8 +56,9 @@
       "default": "./dist/ceremony-modes.js"
     }
   },
-  "scripts": {
-    "check": "tsc --noEmit",
+	"scripts": {
+		"check": "tsc --noEmit",
+		"prebuild": "rm -rf dist",
     "build": "bun build src/index.ts src/fetch.ts src/pipeline.ts src/elysia.ts src/client.ts src/testing.ts src/rate-limit.ts src/security.ts src/conditions.ts src/effects.ts src/authenticator.ts src/ceremony-modes.ts --root src --outdir dist --target browser --format esm --packages external && tsc --emitDeclarationOnly --declaration --noEmit false --outDir dist",
     "prepublishOnly": "bun run check && bun run build"
   },
@@ -76,13 +77,13 @@
     "mfa"
   ],
   "license": "MIT",
-  "homepage": "https://forgezero.net/docs/access",
+  "homepage": "https://www.forgezero.net/docs/access",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/axxra/forgezero.git",
-    "directory": "packages/access"
+    "url": "git+https://github.com/forgezero-net/packages.git",
+    "directory": "access"
   },
-  "bugs": "https://github.com/axxra/forgezero/issues",
+  "bugs": "https://github.com/forgezero-net/packages/issues",
   "sideEffects": false,
   "types": "./dist/index.d.ts",
   "files": [