@forklaunch/core 1.3.4 → 1.3.6

package/lib/{apiDefinition.types-D3fcC39w.d.ts → apiDefinition.types-CAOGkjXe.d.ts}

@@ -179,9 +179,6 @@ type TokenOptions = {
     readonly headerName?: string;
 };
 type DecodeResource = (token: string) => JWTPayload | Promise<JWTPayload>;
-type AuthMethodsBase = TokenOptions & (HmacMethods | ({
-    readonly decodeResource?: DecodeResource;
-} & (PermissionSet | RoleSet) & (BasicAuthMethods | JwtAuthMethods)));
 type PermissionSet = {
     readonly allowedPermissions: Set<string>;
 } | {
@@ -192,11 +189,30 @@ type RoleSet = {
 } | {
     readonly forbiddenRoles: Set<string>;
 };
+/** Auth base for authenticated routes — JWT/Basic, no RBAC. */
+type AuthenticatedAuthBase = TokenOptions & {
+    readonly decodeResource?: DecodeResource;
+    readonly allowedPermissions?: never;
+    readonly forbiddenPermissions?: never;
+    readonly allowedRoles?: never;
+    readonly forbiddenRoles?: never;
+} & (BasicAuthMethods | JwtAuthMethods);
+/** Auth base for protected routes — JWT/Basic with required RBAC. */
+type ProtectedAuthBase = TokenOptions & {
+    readonly decodeResource?: DecodeResource;
+} & (PermissionSet | RoleSet) & (BasicAuthMethods | JwtAuthMethods);
+/**
+ * @deprecated Use AccessAuth discriminated union instead.
+ * Kept for backwards compatibility with AuthMethods.
+ */
+type AuthMethodsBase = TokenOptions & (HmacMethods | ({
+    readonly decodeResource?: DecodeResource;
+} & ((PermissionSet & (BasicAuthMethods | JwtAuthMethods)) | (RoleSet & (BasicAuthMethods | JwtAuthMethods)) | (BasicAuthMethods | JwtAuthMethods))));
 /**
  * Route access level — determines authentication and authorization requirements.
  *
  * - `'public'` — No authentication required. `auth` must not be provided.
- * - `'authenticated'` — JWT or Basic auth required, any valid user. RBAC optional.
+ * - `'authenticated'` — JWT or Basic auth required, any valid user. RBAC not allowed.
  * - `'protected'` — JWT or Basic auth required. Must declare roles, permissions, or scope.
  * - `'internal'` — HMAC auth required (inter-service communication).
  */
@@ -204,7 +220,7 @@ type AccessLevel = 'public' | 'authenticated' | 'protected' | 'internal';
 /**
  * Discriminated union that narrows the `auth` type based on the `access` level.
  * - `public`: auth not allowed
- * - `authenticated`: auth optional (JWT/Basic, RBAC not required)
+ * - `authenticated`: JWT/Basic auth required, RBAC fields disallowed
  * - `protected`: auth required, must include at least one RBAC declaration
  * - `internal`: auth required, must be HMAC
  */
@@ -213,10 +229,10 @@ type AccessAuth<Auth> = {
     readonly auth?: never;
 } | {
     readonly access: 'authenticated';
-    readonly auth?: Auth;
+    readonly auth?: Auth & AuthenticatedAuthBase;
 } | {
     readonly access: 'protected';
-    readonly auth: Auth & ({
+    readonly auth: Auth & ProtectedAuthBase & ({
         readonly allowedPermissions: Set<string>;
     } | {
         readonly forbiddenPermissions: Set<string>;

package/lib/{apiDefinition.types-pmtOHamW.d.mts → apiDefinition.types-CN-qa49j.d.mts}

@@ -179,9 +179,6 @@ type TokenOptions = {
     readonly headerName?: string;
 };
 type DecodeResource = (token: string) => JWTPayload | Promise<JWTPayload>;
-type AuthMethodsBase = TokenOptions & (HmacMethods | ({
-    readonly decodeResource?: DecodeResource;
-} & (PermissionSet | RoleSet) & (BasicAuthMethods | JwtAuthMethods)));
 type PermissionSet = {
     readonly allowedPermissions: Set<string>;
 } | {
@@ -192,11 +189,30 @@ type RoleSet = {
 } | {
     readonly forbiddenRoles: Set<string>;
 };
+/** Auth base for authenticated routes — JWT/Basic, no RBAC. */
+type AuthenticatedAuthBase = TokenOptions & {
+    readonly decodeResource?: DecodeResource;
+    readonly allowedPermissions?: never;
+    readonly forbiddenPermissions?: never;
+    readonly allowedRoles?: never;
+    readonly forbiddenRoles?: never;
+} & (BasicAuthMethods | JwtAuthMethods);
+/** Auth base for protected routes — JWT/Basic with required RBAC. */
+type ProtectedAuthBase = TokenOptions & {
+    readonly decodeResource?: DecodeResource;
+} & (PermissionSet | RoleSet) & (BasicAuthMethods | JwtAuthMethods);
+/**
+ * @deprecated Use AccessAuth discriminated union instead.
+ * Kept for backwards compatibility with AuthMethods.
+ */
+type AuthMethodsBase = TokenOptions & (HmacMethods | ({
+    readonly decodeResource?: DecodeResource;
+} & ((PermissionSet & (BasicAuthMethods | JwtAuthMethods)) | (RoleSet & (BasicAuthMethods | JwtAuthMethods)) | (BasicAuthMethods | JwtAuthMethods))));
 /**
  * Route access level — determines authentication and authorization requirements.
  *
  * - `'public'` — No authentication required. `auth` must not be provided.
- * - `'authenticated'` — JWT or Basic auth required, any valid user. RBAC optional.
+ * - `'authenticated'` — JWT or Basic auth required, any valid user. RBAC not allowed.
  * - `'protected'` — JWT or Basic auth required. Must declare roles, permissions, or scope.
  * - `'internal'` — HMAC auth required (inter-service communication).
  */
@@ -204,7 +220,7 @@ type AccessLevel = 'public' | 'authenticated' | 'protected' | 'internal';
 /**
  * Discriminated union that narrows the `auth` type based on the `access` level.
  * - `public`: auth not allowed
- * - `authenticated`: auth optional (JWT/Basic, RBAC not required)
+ * - `authenticated`: JWT/Basic auth required, RBAC fields disallowed
  * - `protected`: auth required, must include at least one RBAC declaration
  * - `internal`: auth required, must be HMAC
  */
@@ -213,10 +229,10 @@ type AccessAuth<Auth> = {
     readonly auth?: never;
 } | {
     readonly access: 'authenticated';
-    readonly auth?: Auth;
+    readonly auth?: Auth & AuthenticatedAuthBase;
 } | {
     readonly access: 'protected';
-    readonly auth: Auth & ({
+    readonly auth: Auth & ProtectedAuthBase & ({
         readonly allowedPermissions: Set<string>;
     } | {
         readonly forbiddenPermissions: Set<string>;

package/lib/http/index.d.mts

@@ -5,8 +5,8 @@ import { AnySchemaValidator } from '@forklaunch/validator';
 import { ServerOptions, IncomingMessage, ServerResponse } from 'node:http';
 import { O as OpenTelemetryCollector, M as MetricsDefinition, T as TelemetryOptions } from '../openTelemetryCollector-DorlR4pn.mjs';
 export { L as LogFn, a as LoggerMeta, b as MetricType, P as PinoLogger, h as httpRequestsTotalCounter, c as httpServerDurationHistogram, l as logger, m as meta } from '../openTelemetryCollector-DorlR4pn.mjs';
-import { M as Method, P as PathParamHttpContractDetails, H as HttpContractDetails, E as ExpressLikeRouterOptions, a as SessionObject, b as ParamsObject, R as ResponsesObject, B as Body, Q as QueryObject, c as HeadersObject, V as VersionSchema, d as SchemaAuthMethods, e as ExpressLikeSchemaHandler, f as ResolvedSessionObject, C as ContractDetails, g as PathMatch, L as LiveTypeFunction, h as LiveSdkFunction, A as AuthMethodsBase, i as ExpressLikeApplicationOptions, j as ParamsDictionary, k as VersionedRequests, l as AuthMethods, D as DecodeResource, m as BasicAuthMethods, F as ForklaunchRequest, n as MiddlewareContractDetails, o as ExpressLikeSchemaAuthMapper, p as ForklaunchNextFunction, q as ForklaunchResponse, r as ForklaunchResHeaders, s as ForklaunchStatusResponse, t as ForklaunchSendableData } from '../apiDefinition.types-pmtOHamW.mjs';
-export { u as AccessLevel, v as BodyObject, w as DefaultSubscriptionData, x as DocsConfiguration, y as ErrorContainer, z as ExpressLikeAuthMapper, G as ExpressLikeGlobalAuthOptions, I as ExpressLikeHandler, J as ExpressLikeSchemaGlobalAuthOptions, K as ExtractBody, N as ExtractContentType, O as ExtractResponseBody, T as ExtractedParamsObject, U as FileBody, W as ForklaunchBaseRequest, X as ForklaunchResErrors, Y as HmacMethods, Z as HttpMethod, _ as JsonBody, $ as JwtAuthMethods, a0 as LiveTypeFunctionRequestInit, a1 as MapParamsSchema, a2 as MapReqBodySchema, a3 as MapReqHeadersSchema, a4 as MapReqQuerySchema, a5 as MapResBodyMapSchema, a6 as MapResHeadersSchema, a7 as MapSchema, a8 as MapSessionSchema, a9 as MapVersionedReqsSchema, aa as MapVersionedRespsSchema, ab as MultipartForm, ac as NumberOnlyObject, ad as PathParamMethod, ae as PermissionSet, af as RawTypedResponseBody, ag as RequestContext, ah as ResolvedForklaunchAuthRequest, ai as ResolvedForklaunchRequest, aj as ResolvedForklaunchResponse, ak as ResponseBody, al as ResponseCompiledSchema, am as ResponseShape, an as RoleSet, ao as ServerSentEventBody, S as StringOnlyObject, ap as TextBody, aq as TypedBody, ar as TypedRequestBody, as as TypedResponseBody, at as UnknownBody, au as UnknownResponseBody, av as UrlEncodedForm, aw as VersionedResponses } from '../apiDefinition.types-pmtOHamW.mjs';
+import { M as Method, P as PathParamHttpContractDetails, H as HttpContractDetails, E as ExpressLikeRouterOptions, a as SessionObject, b as ParamsObject, R as ResponsesObject, B as Body, Q as QueryObject, c as HeadersObject, V as VersionSchema, d as SchemaAuthMethods, e as ExpressLikeSchemaHandler, f as ResolvedSessionObject, C as ContractDetails, g as PathMatch, L as LiveTypeFunction, h as LiveSdkFunction, A as AuthMethodsBase, i as ExpressLikeApplicationOptions, j as ParamsDictionary, k as VersionedRequests, l as AuthMethods, D as DecodeResource, m as BasicAuthMethods, F as ForklaunchRequest, n as MiddlewareContractDetails, o as ExpressLikeSchemaAuthMapper, p as ForklaunchNextFunction, q as ForklaunchResponse, r as ForklaunchResHeaders, s as ForklaunchStatusResponse, t as ForklaunchSendableData } from '../apiDefinition.types-CN-qa49j.mjs';
+export { u as AccessLevel, v as BodyObject, w as DefaultSubscriptionData, x as DocsConfiguration, y as ErrorContainer, z as ExpressLikeAuthMapper, G as ExpressLikeGlobalAuthOptions, I as ExpressLikeHandler, J as ExpressLikeSchemaGlobalAuthOptions, K as ExtractBody, N as ExtractContentType, O as ExtractResponseBody, T as ExtractedParamsObject, U as FileBody, W as ForklaunchBaseRequest, X as ForklaunchResErrors, Y as HmacMethods, Z as HttpMethod, _ as JsonBody, $ as JwtAuthMethods, a0 as LiveTypeFunctionRequestInit, a1 as MapParamsSchema, a2 as MapReqBodySchema, a3 as MapReqHeadersSchema, a4 as MapReqQuerySchema, a5 as MapResBodyMapSchema, a6 as MapResHeadersSchema, a7 as MapSchema, a8 as MapSessionSchema, a9 as MapVersionedReqsSchema, aa as MapVersionedRespsSchema, ab as MultipartForm, ac as NumberOnlyObject, ad as PathParamMethod, ae as PermissionSet, af as RawTypedResponseBody, ag as RequestContext, ah as ResolvedForklaunchAuthRequest, ai as ResolvedForklaunchRequest, aj as ResolvedForklaunchResponse, ak as ResponseBody, al as ResponseCompiledSchema, am as ResponseShape, an as RoleSet, ao as ServerSentEventBody, S as StringOnlyObject, ap as TextBody, aq as TypedBody, ar as TypedRequestBody, as as TypedResponseBody, at as UnknownBody, au as UnknownResponseBody, av as UrlEncodedForm, aw as VersionedResponses } from '../apiDefinition.types-CN-qa49j.mjs';
 import { JWTPayload, JWK } from 'jose';
 import { ZodSchemaValidator } from '@forklaunch/validator/zod';
 import { FastMCP } from 'fastmcp';

package/lib/http/index.d.ts

@@ -5,8 +5,8 @@ import { AnySchemaValidator } from '@forklaunch/validator';
 import { ServerOptions, IncomingMessage, ServerResponse } from 'node:http';
 import { O as OpenTelemetryCollector, M as MetricsDefinition, T as TelemetryOptions } from '../openTelemetryCollector-DorlR4pn.js';
 export { L as LogFn, a as LoggerMeta, b as MetricType, P as PinoLogger, h as httpRequestsTotalCounter, c as httpServerDurationHistogram, l as logger, m as meta } from '../openTelemetryCollector-DorlR4pn.js';
-import { M as Method, P as PathParamHttpContractDetails, H as HttpContractDetails, E as ExpressLikeRouterOptions, a as SessionObject, b as ParamsObject, R as ResponsesObject, B as Body, Q as QueryObject, c as HeadersObject, V as VersionSchema, d as SchemaAuthMethods, e as ExpressLikeSchemaHandler, f as ResolvedSessionObject, C as ContractDetails, g as PathMatch, L as LiveTypeFunction, h as LiveSdkFunction, A as AuthMethodsBase, i as ExpressLikeApplicationOptions, j as ParamsDictionary, k as VersionedRequests, l as AuthMethods, D as DecodeResource, m as BasicAuthMethods, F as ForklaunchRequest, n as MiddlewareContractDetails, o as ExpressLikeSchemaAuthMapper, p as ForklaunchNextFunction, q as ForklaunchResponse, r as ForklaunchResHeaders, s as ForklaunchStatusResponse, t as ForklaunchSendableData } from '../apiDefinition.types-D3fcC39w.js';
-export { u as AccessLevel, v as BodyObject, w as DefaultSubscriptionData, x as DocsConfiguration, y as ErrorContainer, z as ExpressLikeAuthMapper, G as ExpressLikeGlobalAuthOptions, I as ExpressLikeHandler, J as ExpressLikeSchemaGlobalAuthOptions, K as ExtractBody, N as ExtractContentType, O as ExtractResponseBody, T as ExtractedParamsObject, U as FileBody, W as ForklaunchBaseRequest, X as ForklaunchResErrors, Y as HmacMethods, Z as HttpMethod, _ as JsonBody, $ as JwtAuthMethods, a0 as LiveTypeFunctionRequestInit, a1 as MapParamsSchema, a2 as MapReqBodySchema, a3 as MapReqHeadersSchema, a4 as MapReqQuerySchema, a5 as MapResBodyMapSchema, a6 as MapResHeadersSchema, a7 as MapSchema, a8 as MapSessionSchema, a9 as MapVersionedReqsSchema, aa as MapVersionedRespsSchema, ab as MultipartForm, ac as NumberOnlyObject, ad as PathParamMethod, ae as PermissionSet, af as RawTypedResponseBody, ag as RequestContext, ah as ResolvedForklaunchAuthRequest, ai as ResolvedForklaunchRequest, aj as ResolvedForklaunchResponse, ak as ResponseBody, al as ResponseCompiledSchema, am as ResponseShape, an as RoleSet, ao as ServerSentEventBody, S as StringOnlyObject, ap as TextBody, aq as TypedBody, ar as TypedRequestBody, as as TypedResponseBody, at as UnknownBody, au as UnknownResponseBody, av as UrlEncodedForm, aw as VersionedResponses } from '../apiDefinition.types-D3fcC39w.js';
+import { M as Method, P as PathParamHttpContractDetails, H as HttpContractDetails, E as ExpressLikeRouterOptions, a as SessionObject, b as ParamsObject, R as ResponsesObject, B as Body, Q as QueryObject, c as HeadersObject, V as VersionSchema, d as SchemaAuthMethods, e as ExpressLikeSchemaHandler, f as ResolvedSessionObject, C as ContractDetails, g as PathMatch, L as LiveTypeFunction, h as LiveSdkFunction, A as AuthMethodsBase, i as ExpressLikeApplicationOptions, j as ParamsDictionary, k as VersionedRequests, l as AuthMethods, D as DecodeResource, m as BasicAuthMethods, F as ForklaunchRequest, n as MiddlewareContractDetails, o as ExpressLikeSchemaAuthMapper, p as ForklaunchNextFunction, q as ForklaunchResponse, r as ForklaunchResHeaders, s as ForklaunchStatusResponse, t as ForklaunchSendableData } from '../apiDefinition.types-CAOGkjXe.js';
+export { u as AccessLevel, v as BodyObject, w as DefaultSubscriptionData, x as DocsConfiguration, y as ErrorContainer, z as ExpressLikeAuthMapper, G as ExpressLikeGlobalAuthOptions, I as ExpressLikeHandler, J as ExpressLikeSchemaGlobalAuthOptions, K as ExtractBody, N as ExtractContentType, O as ExtractResponseBody, T as ExtractedParamsObject, U as FileBody, W as ForklaunchBaseRequest, X as ForklaunchResErrors, Y as HmacMethods, Z as HttpMethod, _ as JsonBody, $ as JwtAuthMethods, a0 as LiveTypeFunctionRequestInit, a1 as MapParamsSchema, a2 as MapReqBodySchema, a3 as MapReqHeadersSchema, a4 as MapReqQuerySchema, a5 as MapResBodyMapSchema, a6 as MapResHeadersSchema, a7 as MapSchema, a8 as MapSessionSchema, a9 as MapVersionedReqsSchema, aa as MapVersionedRespsSchema, ab as MultipartForm, ac as NumberOnlyObject, ad as PathParamMethod, ae as PermissionSet, af as RawTypedResponseBody, ag as RequestContext, ah as ResolvedForklaunchAuthRequest, ai as ResolvedForklaunchRequest, aj as ResolvedForklaunchResponse, ak as ResponseBody, al as ResponseCompiledSchema, am as ResponseShape, an as RoleSet, ao as ServerSentEventBody, S as StringOnlyObject, ap as TextBody, aq as TypedBody, ar as TypedRequestBody, as as TypedResponseBody, at as UnknownBody, au as UnknownResponseBody, av as UrlEncodedForm, aw as VersionedResponses } from '../apiDefinition.types-CAOGkjXe.js';
 import { JWTPayload, JWK } from 'jose';
 import { ZodSchemaValidator } from '@forklaunch/validator/zod';
 import { FastMCP } from 'fastmcp';

package/lib/http/index.js

@@ -756,7 +756,7 @@ function parseHmacTokenPart(part, expectedKey) {
   if (key !== expectedKey || rest.length === 0) return void 0;
   return rest.join("=");
 }
-async function checkAuthorizationToken(req, authorizationMethod, authorizationToken, globalOptions) {
+async function checkAuthorizationToken(req, authorizationMethod, authorizationToken, globalOptions, access) {
   if (authorizationMethod == null) {
     return void 0;
   }
@@ -893,7 +893,8 @@ async function checkAuthorizationToken(req, authorizationMethod, authorizationTo
       }
     }
   }
-  if (hasPermissionChecks(collapsedAuthorizationMethod)) {
+  if (access === "authenticated" || access === "internal") {
+  } else if (hasPermissionChecks(collapsedAuthorizationMethod)) {
     if (!collapsedAuthorizationMethod.surfacePermissions) {
       return [500, "No permission surfacing function provided."];
     }
@@ -933,7 +934,7 @@ async function checkAuthorizationToken(req, authorizationMethod, authorizationTo
         return invalidAuthorizationTokenRoles;
       }
     }
-  } else {
+  } else if (access === "protected") {
     return invalidAuthorizationMethod;
   }
   if (hasSubscriptionChecks(collapsedAuthorizationMethod)) {
@@ -966,9 +967,14 @@ async function checkAuthorizationToken(req, authorizationMethod, authorizationTo
   }
 }
 async function parseRequestAuth(req, res, next) {
+  const access = req.contractDetails.access;
+  if (access === "public") {
+    next?.();
+    return;
+  }
   const auth = req.contractDetails.auth;
   const token = req.headers[auth?.headerName ?? "Authorization"] || req.headers[auth?.headerName ?? "authorization"];
-  const [error, message] = await checkAuthorizationToken(req, auth, token, req._globalOptions?.()?.auth) ?? [];
+  const [error, message] = await checkAuthorizationToken(req, auth, token, req._globalOptions?.()?.auth, access) ?? [];
   if (error != null) {
     req.openTelemetryCollector?.error(
       message || "Authorization Failed",