@forklaunch/core 1.3.6 → 1.3.8

package/lib/http/index.mjs

@@ -28,6 +28,31 @@ import {
   toRecord
 } from "@forklaunch/common";
 
+// src/http/guards/hasPermissionChecks.ts
+function hasPermissionChecks(maybePermissionedAuth) {
+  if (typeof maybePermissionedAuth !== "object" || maybePermissionedAuth === null) {
+    return false;
+  }
+  const hasAllowedPermissions = "allowedPermissions" in maybePermissionedAuth && maybePermissionedAuth.allowedPermissions instanceof Set && maybePermissionedAuth.allowedPermissions.size > 0;
+  const hasForbiddenPermissions = "forbiddenPermissions" in maybePermissionedAuth && maybePermissionedAuth.forbiddenPermissions instanceof Set && maybePermissionedAuth.forbiddenPermissions.size > 0;
+  return hasAllowedPermissions || hasForbiddenPermissions;
+}
+
+// src/http/guards/hasRoleChecks.ts
+function hasRoleChecks(maybeRoledAuth) {
+  if (typeof maybeRoledAuth !== "object" || maybeRoledAuth === null) {
+    return false;
+  }
+  const hasAllowedRoles = "allowedRoles" in maybeRoledAuth && maybeRoledAuth.allowedRoles instanceof Set && maybeRoledAuth.allowedRoles.size > 0;
+  const hasForbiddenRoles = "forbiddenRoles" in maybeRoledAuth && maybeRoledAuth.forbiddenRoles instanceof Set && maybeRoledAuth.forbiddenRoles.size > 0;
+  return hasAllowedRoles || hasForbiddenRoles;
+}
+
+// src/http/guards/hasScopeChecks.ts
+function hasScopeChecks(maybePermissionedAuth) {
+  return typeof maybePermissionedAuth === "object" && maybePermissionedAuth !== null && "requiredScope" in maybePermissionedAuth && maybePermissionedAuth.requiredScope != null;
+}
+
 // src/http/guards/isForklaunchRouter.ts
 function isForklaunchRouter(maybeForklaunchRouter) {
   return maybeForklaunchRouter != null && typeof maybeForklaunchRouter === "object" && "basePath" in maybeForklaunchRouter && "routes" in maybeForklaunchRouter && Array.isArray(maybeForklaunchRouter.routes);
@@ -242,31 +267,6 @@ function discriminateResponseBodies(schemaValidator, responses) {
 // src/http/router/routerSharedLogic.ts
 import { isRecord as isRecord2 } from "@forklaunch/common";
 
-// src/http/guards/hasPermissionChecks.ts
-function hasPermissionChecks(maybePermissionedAuth) {
-  if (typeof maybePermissionedAuth !== "object" || maybePermissionedAuth === null) {
-    return false;
-  }
-  const hasAllowedPermissions = "allowedPermissions" in maybePermissionedAuth && maybePermissionedAuth.allowedPermissions instanceof Set && maybePermissionedAuth.allowedPermissions.size > 0;
-  const hasForbiddenPermissions = "forbiddenPermissions" in maybePermissionedAuth && maybePermissionedAuth.forbiddenPermissions instanceof Set && maybePermissionedAuth.forbiddenPermissions.size > 0;
-  return hasAllowedPermissions || hasForbiddenPermissions;
-}
-
-// src/http/guards/hasRoleChecks.ts
-function hasRoleChecks(maybeRoledAuth) {
-  if (typeof maybeRoledAuth !== "object" || maybeRoledAuth === null) {
-    return false;
-  }
-  const hasAllowedRoles = "allowedRoles" in maybeRoledAuth && maybeRoledAuth.allowedRoles instanceof Set && maybeRoledAuth.allowedRoles.size > 0;
-  const hasForbiddenRoles = "forbiddenRoles" in maybeRoledAuth && maybeRoledAuth.forbiddenRoles instanceof Set && maybeRoledAuth.forbiddenRoles.size > 0;
-  return hasAllowedRoles || hasForbiddenRoles;
-}
-
-// src/http/guards/hasScopeChecks.ts
-function hasScopeChecks(maybePermissionedAuth) {
-  return typeof maybePermissionedAuth === "object" && maybePermissionedAuth !== null && "requiredScope" in maybePermissionedAuth && maybePermissionedAuth.requiredScope != null;
-}
-
 // src/http/guards/hasVersionedSchema.ts
 function hasVersionedSchema(contractDetails) {
   return typeof contractDetails === "object" && contractDetails !== null && "versions" in contractDetails && contractDetails.versions !== null;
@@ -1890,6 +1890,46 @@ var ForklaunchExpressLikeRouter = class _ForklaunchExpressLikeRouter {
       );
     });
   }
+  /**
+   * Validates that all protected routes have the required surfacing functions
+   * available (from the route, router, or application level).
+   * Call this at listen() time when the full option chain is assembled.
+   */
+  validateSurfacingFunctions(router = this, parentAuth) {
+    const routerAuth = router.routerOptions?.auth && typeof router.routerOptions.auth === "object" ? router.routerOptions.auth : void 0;
+    const globalAuth = routerAuth ?? parentAuth;
+    for (const route of router.routes) {
+      const auth = route.contractDetails.auth;
+      const access = route.contractDetails.access;
+      if (!auth || access !== "protected") continue;
+      const routeAuth = auth;
+      const routeName = route.contractDetails.name;
+      if (hasPermissionChecks(auth)) {
+        if (!routeAuth["surfacePermissions"] && !globalAuth?.surfacePermissions) {
+          throw new Error(
+            `Route '${routeName}': declares allowedPermissions or forbiddenPermissions but no surfacePermissions function was provided on the route, router, or application`
+          );
+        }
+      }
+      if (hasRoleChecks(auth)) {
+        if (!routeAuth["surfaceRoles"] && !globalAuth?.surfaceRoles) {
+          throw new Error(
+            `Route '${routeName}': declares allowedRoles or forbiddenRoles but no surfaceRoles function was provided on the route, router, or application`
+          );
+        }
+      }
+      if (hasScopeChecks(auth)) {
+        if (!routeAuth["surfaceScopes"] && !globalAuth?.surfaceScopes) {
+          throw new Error(
+            `Route '${routeName}': declares requiredScope but no surfaceScopes function was provided on the route, router, or application`
+          );
+        }
+      }
+    }
+    for (const subRouter of router.routers) {
+      this.validateSurfacingFunctions(subRouter, globalAuth);
+    }
+  }
   use = (pathOrContractDetailsOrMiddlewareOrTypedHandler, contractDetailsOrMiddlewareOrTypedHandler, ...middlewareOrMiddlewareWithTypedHandler) => {
     [
       pathOrContractDetailsOrMiddlewareOrTypedHandler,
@@ -2197,6 +2237,13 @@ var ForklaunchExpressLikeApplication = class extends ForklaunchExpressLikeRouter
     this.appOptions = appOptions;
     this.internal.use(cors(this.appOptions?.cors ?? {}));
   }
+  /**
+   * Validates all registered routes across the app and all mounted routers.
+   * Call this at the start of listen() to fail fast at startup.
+   */
+  validateAllRoutes() {
+    this.validateSurfacingFunctions();
+  }
 };
 
 // src/http/cluster/isPortBound.ts
@@ -4055,7 +4102,7 @@ function generateOperationObject(schemaValidator, path, method, controllerName,
       operationObject.security = [
         {
           basic: Array.from(
-            "allowedPermissions" in auth ? auth.allowedPermissions?.values() || [] : []
+            "allowedPermissions" in auth && auth.allowedPermissions instanceof Set ? auth.allowedPermissions.values() : []
           )
         }
       ];
@@ -4067,7 +4114,7 @@ function generateOperationObject(schemaValidator, path, method, controllerName,
       operationObject.security = [
         {
           [auth.headerName !== "Authorization" ? "bearer" : "apiKey"]: Array.from(
-            "allowedPermissions" in auth ? auth.allowedPermissions?.values() || [] : []
+            "allowedPermissions" in auth && auth.allowedPermissions instanceof Set ? auth.allowedPermissions.values() : []
           )
         }
       ];