@fougere/nuxt 0.1.0-alpha.0

package/src/runtime/form/fields.ts

@@ -0,0 +1,185 @@
+/**
+ * Form contract, pure part — derives what a create/edit form is made of
+ * from the entity's field axes. No Vue, no Nuxt: testable headless,
+ * usable by any renderer (the page owns the widgets).
+ */
+import { inputFields } from '@fougere/schema';
+import type { ValidationError } from '@fougere/schema';
+
+/** What an entity class exposes to a form — the schema statics it already has. */
+export interface FormEntity {
+  name: string;
+  getFields(): Record<string, FieldLike>;
+  validate(input: unknown): { success: true; data: unknown } | { success: false; errors: ValidationError[] };
+}
+
+interface FieldLike {
+  shape?: {
+    type?: unknown;
+    enum?: readonly unknown[];
+    format?: string;
+    properties?: unknown;
+    minLength?: number;
+    maxLength?: number;
+    minimum?: number;
+    maximum?: number;
+    pattern?: string;
+  };
+  lifecycle?: { create?: unknown };
+  role?: { primary?: boolean; relation?: { kind: string } };
+}
+
+/**
+ * The literal a field is born with, when it declares one.
+ *
+ * `text({ default: 'x' })` and `oneOf('a', 'b', { default: 'a' })` both compile to
+ * `lifecycle.create = { value }` — the create rule that answers the field's absence.
+ * The other create rules ('now', { generate }, 'optional') name no literal: their value
+ * is decided at write time, so a form has nothing to show for them.
+ */
+function defaultOf(field: FieldLike): unknown {
+  const create = field.lifecycle?.create;
+  return create !== null && typeof create === 'object' && 'value' in create
+    ? (create as { value: unknown }).value
+    : undefined;
+}
+
+export interface FormField {
+  name: string;
+  /** Rendering hint derived from the shape — the page maps it to widgets. */
+  control: 'text' | 'email' | 'url' | 'number' | 'boolean' | 'date' | 'select';
+  required: boolean;
+  /** i18n key by convention: `entity.field`. The schema never carries display text. */
+  labelKey: string;
+  /** Fallback label when no i18n message fills the key. */
+  label: string;
+  /** Enum values, when control is 'select'. */
+  options?: string[];
+  /**
+   * What the browser enforces, under the names it already knows — spread this on the
+   * input and the page states no rule of its own.
+   *
+   * The shape holds `minLength`/`maximum`/`pattern`; a browser holds `minlength`/
+   * `max`/`pattern` and enforces them with no JavaScript at all. Carrying them here
+   * is a projection, not a second rule: the judge reads the same shape, and a form
+   * that ignores these still gets the same verdict — it just gets it later, and a
+   * screen reader never gets it at all.
+   *
+   * `type` is part of the contract, not decoration: `email` and `url` are formats the
+   * shape states and the browser checks live, per field, as one types. A page writing
+   * `type="email"` by hand is spelling a second time what the card already said.
+   *
+   * Three deliberate absences, each one a place where the attribute would mean
+   * something the shape does not say:
+   * - a `date` field gets no `type` — neither `date` nor `datetime-local` produces the
+   *   RFC 3339 string a `date-time` shape judges, so the browser would accept what the
+   *   judge refuses;
+   * - `select` and `boolean` are not inputs — the page picks the widget, `control` says
+   *   which;
+   * - a required `boolean` gets no `required` — on a checkbox that attribute means
+   *   "must be CHECKED", where the shape only says the value must be supplied.
+   */
+  attrs?: {
+    type?: 'text' | 'email' | 'url' | 'number';
+    required?: boolean;
+    minlength?: number;
+    maxlength?: number;
+    min?: number;
+    max?: number;
+    pattern?: string;
+  };
+  /**
+   * The value the field is born with — the literal its `lifecycle.create` rule names.
+   * Present so the form can SHOW what is about to be written; the storage realizes it
+   * either way, so a form that ignores this still produces the same row.
+   */
+  default?: unknown;
+}
+
+/** The base JSON type of a shape — unwraps the `[T,'null']` union. */
+function baseType(type: unknown): string {
+  if (Array.isArray(type)) return (type.find((t) => t !== 'null') as string) ?? 'string';
+  return (type as string) ?? 'string';
+}
+
+/** The formats a browser has an input type for — the rest stay `text`, judged later. */
+const CONTROL_BY_FORMAT: Record<string, FormField['control']> = {
+  'date-time': 'date',
+  email: 'email',
+  uri: 'url',
+};
+
+function controlOf(field: FieldLike): FormField['control'] {
+  const shape = field.shape ?? {};
+  if (Array.isArray(shape.enum) && shape.enum.length) return 'select';
+  const base = baseType(shape.type);
+  if (base === 'number' || base === 'integer') return 'number';
+  if (base === 'boolean') return 'boolean';
+  if (base === 'string' && shape.format) return CONTROL_BY_FORMAT[shape.format] ?? 'text';
+  return 'text';
+}
+
+/** Controls that ARE an `<input type>` — see the two absences on {@link FormField.attrs}. */
+const INPUT_TYPES = new Set(['text', 'email', 'url', 'number']);
+
+/** The shape's bounds, under the names a browser already enforces. */
+function attrsOf(field: FieldLike, control: FormField['control'], required: boolean): NonNullable<FormField['attrs']> {
+  const s = field.shape ?? {};
+  const attrs = {
+    type: INPUT_TYPES.has(control) ? control : undefined,
+    required: (required && control !== 'boolean') || undefined,
+    minlength: s.minLength,
+    maxlength: s.maxLength,
+    min: s.minimum,
+    max: s.maximum,
+    pattern: s.pattern,
+  };
+  return Object.fromEntries(Object.entries(attrs).filter(([, v]) => v !== undefined));
+}
+
+/**
+ * The fields a create form is made of: membership from the io projection
+ * (`inputFields` — what a client may supply), requiredness from the
+ * lifecycle axis (any create rule makes absence legal).
+ */
+export function formFieldsOf(entity: FormEntity, entityKey: string): FormField[] {
+  return Object.entries(inputFields(entity.getFields() as never)).map(([name, field]) => {
+    const f = field as FieldLike;
+    const control = controlOf(f);
+    const required = f.lifecycle?.create === undefined;
+    const attrs = attrsOf(f, control, required);
+    return {
+      name,
+      control,
+      required,
+      labelKey: `${entityKey}.${name}`,
+      label: name.charAt(0).toUpperCase() + name.slice(1),
+      ...(Array.isArray(f.shape?.enum)
+        ? { options: f.shape.enum.filter((value): value is string => typeof value === 'string') }
+        : {}),
+      ...(Object.keys(attrs).length ? { attrs } : {}),
+      ...(defaultOf(f) !== undefined ? { default: defaultOf(f) } : {}),
+    };
+  });
+}
+
+/**
+ * The wire body of the form's values — an empty control is an absent value
+ * at the create boundary (absence is judged by the lifecycle axis, an empty
+ * string would be judged as a present bad value).
+ */
+export function payloadOf(values: Record<string, unknown>): Record<string, unknown> {
+  return Object.fromEntries(
+    Object.entries(values).filter(([, v]) => v !== undefined && v !== ''),
+  );
+}
+
+/** Index judge errors by field — local judge and remote judge share this shape. */
+export function errorsByField(errors: ValidationError[]): Record<string, string> {
+  const byField: Record<string, string> = {};
+  for (const err of errors) {
+    const field = err.path.split('.')[0] || err.path;
+    byField[field] ??= err.message;
+  }
+  return byField;
+}

package/src/runtime/plugins/session.server.ts

@@ -0,0 +1,15 @@
+/**
+ * Session hydration — server half of useCurrentUser. The auth middleware
+ * already resolved the user onto event.context; this plugin copies the
+ * session view into state so it rides the payload to the client. The
+ * page arrives already knowing its user — no round-trip.
+ */
+import { defineNuxtPlugin, useRequestEvent, useState } from '#imports';
+import { sessionViewOf, type SessionView } from '../session/view.js';
+
+export default defineNuxtPlugin(() => {
+  const event = useRequestEvent();
+  useState<SessionView>('fougere:session', () =>
+    sessionViewOf((event?.context ?? {}) as Record<string, unknown>),
+  );
+});

package/src/runtime/server/api/crud.ts

@@ -0,0 +1,86 @@
+/**
+ * REST catch-all — a thin bridge: parse the URL into a call value,
+ * invoke it, format the result for HTTP. Dispatch and errors belong to
+ * the runner; only static frond metadata is consulted here.
+ */
+import { defineEventHandler, readBody, getQuery, createError } from 'h3';
+import { toHttpError } from '@fougere/core';
+import { useFougereApp } from '../utils/fougereApp';
+import { invoke } from '../utils/invoke';
+
+function pluralize(name: string): string {
+  return name.endsWith('y') ? name.slice(0, -1) + 'ies' : name + 's';
+}
+
+export default defineEventHandler(async (event) => {
+  const app = await useFougereApp();
+
+  // ── parse: /api/{frondName}/{plural}[/{idOrOp}] → FrondCall + invocation
+  const path = event.path.replace(/^\/api\//, '').replace(/\?.*$/, '');
+  const segments = path.split('/').filter(Boolean);
+  if (segments.length < 2) return;
+
+  const frond = app.fronds.find((f) => f.name === segments[0]);
+  if (!frond) return;
+  const entity = frond.entities.find((e) => pluralize(e.name) === segments[1]);
+  if (!entity) return;
+
+  // The default handler, explicitly: this catch-all IS the default surface, and
+  // the call below lands on the default façade. Without `!h.surface` the op list
+  // that arbitrates "segment = op or id" could come from a surface handler while
+  // the call went somewhere else — two answers for one route.
+  const ops = [
+    ...(frond.handlers.find((h) => h.address === entity.name && !h.surface)?.operations.keys() ?? []),
+  ];
+
+  const method = event.method.toUpperCase();
+  const extra: string | undefined = segments[2];
+  const params: Record<string, string> = {};
+  let op: string;
+
+  if (!extra) {
+    op = method === 'GET' ? 'list' : 'create';
+  } else {
+    // /{idOrOp}: kebab-case → camelCase, known operation wins, else it's an id
+    const asOp = extra.replace(/-([a-z])/g, (_: string, c: string) => c.toUpperCase());
+    if (ops.includes(asOp)) {
+      op = asOp;
+    } else {
+      params.id = extra;
+      if (method === 'GET') op = 'findById';
+      else if (method === 'PUT' || method === 'PATCH') op = 'update';
+      else if (method === 'DELETE') op = 'delete';
+      else throw createError({ statusCode: 405, message: 'Method not allowed' });
+    }
+  }
+
+  const query = getQuery(event) as Record<string, string>;
+  const hasBody = method === 'POST' || method === 'PUT' || method === 'PATCH';
+  const body = hasBody ? await readBody(event) : undefined;
+
+  // ── invoke: the runner routes it — local façade or remote doublure
+  let result: unknown;
+  try {
+    result = await invoke({ entity: entity.name, op }, { params, query, body });
+  } catch (err) {
+    const { status, body: payload } = toHttpError(err);
+    throw createError({ statusCode: status, message: payload.message, data: payload });
+  }
+
+  // ── format
+  if (result === null) {
+    throw createError({ statusCode: 404, message: 'Not found' });
+  }
+
+  // ListResult → serialize as { items, total, hasMore, endCursor }
+  if (op === 'list' && Array.isArray(result)) {
+    return {
+      items: [...result],
+      total: (result as any).total,
+      hasMore: (result as any).hasMore,
+      endCursor: (result as any).endCursor,
+    };
+  }
+
+  return result;
+});

package/src/runtime/server/auth/middleware/auth.ts

@@ -0,0 +1,30 @@
+import { defineEventHandler, getRequestHeader } from 'h3';
+import { useFougereAuth } from '../../utils/fougereAuth';
+
+/**
+ * Resolves the current session/user from the request cookie and exposes them
+ * on event.context. Auth-related routes are skipped so the catch-all handles them.
+ */
+export default defineEventHandler(async (event) => {
+  if (event.path.startsWith('/auth/')) return;
+  const cookie = getRequestHeader(event, 'cookie');
+  if (!cookie) return;
+
+  let auth;
+  try {
+    auth = await useFougereAuth();
+  } catch {
+    return; // no auth configured
+  }
+
+  try {
+    // event.headers, not toWebRequest(event).headers — the web request wraps
+    // the body stream, and a later readBody would hang on the captured stream
+    const result = await (auth.api as { getSession: (opts: { headers: Headers }) => Promise<{ session: { userId: string }; user: Record<string, unknown> } | null> })
+      .getSession({ headers: event.headers });
+    if (result?.session && result?.user) {
+      event.context.user = result.user;
+      event.context.session = result.session;
+    }
+  } catch {}
+});

package/src/runtime/server/auth/routes/api/me.get.ts

@@ -0,0 +1,10 @@
+import { defineEventHandler, createError } from 'h3';
+
+export default defineEventHandler((event) => {
+  const user = event.context.user;
+  if (!user) {
+    throw createError({ statusCode: 401, message: 'Not logged in' });
+  }
+  const { passwordHash, ...safe } = user as Record<string, unknown>;
+  return safe;
+});

package/src/runtime/server/auth/routes/auth/[...].ts

@@ -0,0 +1,8 @@
+import { defineEventHandler } from 'h3';
+import { useFougereAuth } from '../../../utils/fougereAuth';
+
+export default defineEventHandler(async (event) => {
+  const auth = await useFougereAuth();
+  const webResponse = await auth.handler(toWebRequest(event));
+  return sendWebResponse(event, webResponse);
+});

package/src/runtime/server/routes/call.post.ts

@@ -0,0 +1,158 @@
+/**
+ * Receiving end for the browser — same wire as process-to-process
+ * (POST /_fougere/call, JSON-RPC), different trust boundary: the browser
+ * sits outside the topology, so `state` is stamped from the server-resolved
+ * session (event.context), never taken from the wire.
+ *
+ * The runner follows the app's topology: local façades and remote
+ * doublures alike — the browser never knows where a Frond lives.
+ */
+import { defineEventHandler } from 'h3';
+import { handleRpc, PARSE_ERROR } from '@fougere/transport-http';
+import { createAppRunner } from '@fougere/core';
+import type { Transport } from '@fougere/core';
+import { useFougereApp } from '../utils/fougereApp';
+
+type NodeReq = {
+  body?: unknown;
+  on?: (event: 'data' | 'end' | 'error', cb: (arg: never) => void) => void;
+};
+
+type WebReq = {
+  body?: { getReader?: () => { read: () => Promise<{ done: boolean; value?: Uint8Array }>; cancel?: () => Promise<void> } } | null;
+  headers?: { get?: (name: string) => string | null };
+  text?: () => Promise<string>;
+  json?: () => Promise<unknown>;
+};
+
+const MAX_BODY_BYTES = 1024 * 1024;
+
+function payloadTooLarge(): Error & { statusCode: number; statusMessage: string } {
+  return Object.assign(new Error('Payload too large'), { statusCode: 413, statusMessage: 'Payload too large' });
+}
+
+function parseRawJson(raw: string): unknown {
+  if (Buffer.byteLength(raw) > MAX_BODY_BYTES) throw payloadTooLarge();
+  return raw ? JSON.parse(raw) : {};
+}
+
+async function readWebBody(req: WebReq): Promise<unknown> {
+  const declaredLength = Number(req.headers?.get?.('content-length'));
+  if (Number.isFinite(declaredLength) && declaredLength > MAX_BODY_BYTES) throw payloadTooLarge();
+
+  const reader = req.body?.getReader?.();
+  if (reader) {
+    const chunks: Buffer[] = [];
+    let size = 0;
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      const chunk = Buffer.from(value ?? []);
+      size += chunk.length;
+      if (size > MAX_BODY_BYTES) {
+        await reader.cancel?.();
+        throw payloadTooLarge();
+      }
+      chunks.push(chunk);
+    }
+    return parseRawJson(Buffer.concat(chunks).toString('utf8'));
+  }
+
+  if (typeof req.text === 'function') return parseRawJson(await req.text());
+  // Legacy request-like implementations may expose only json(). The content-length
+  // check above still rejects declared oversized payloads; standard Request objects
+  // take the streamed branch and enforce the limit while reading.
+  if (typeof req.json === 'function') return req.json();
+  return {};
+}
+
+/**
+ * Read the JSON-RPC payload from the h3 event, agnostic to h3 version AND trust
+ * boundary. We read the event's shape directly instead of calling `readBody`,
+ * whose static `from 'h3'` import can bind to a different h3 major than the one
+ * that shaped the event (nitro's runtime is v1 here; devtools drag in v2) —
+ * `readBody` v2 on a v1 event throws `event.req.text is not a function`.
+ *
+ * Two shapes occur, both verified:
+ *  - SSR internal `$fetch`: a synthetic event whose `node.req.body` is already
+ *    the raw JSON string — the mock stream is not readable, never drain it.
+ *  - Browser POST: a real IncomingMessage, drained via stream events (`for
+ *    await` fails: the SSR mock has no async iterator).
+ * The `event.req.json()` branch is the future once nitro is fully on h3 v2.
+ */
+async function readJsonBody(event: { req?: unknown; node?: { req?: unknown } }): Promise<unknown> {
+  const rawNodeReq = event.node?.req;
+  const nodeReq = rawNodeReq && typeof rawNodeReq === 'object' ? rawNodeReq as NodeReq : undefined;
+  const preset = nodeReq?.body;
+  if (typeof preset === 'string') {
+    if (Buffer.byteLength(preset) > MAX_BODY_BYTES) throw payloadTooLarge();
+    return parseRawJson(preset);
+  }
+  if (preset instanceof Uint8Array) {
+    if (preset.byteLength > MAX_BODY_BYTES) throw payloadTooLarge();
+    const raw = Buffer.from(preset).toString('utf8');
+    return parseRawJson(raw);
+  }
+  const webReq = event.req && typeof event.req === 'object' ? event.req as WebReq : undefined;
+  if (
+    webReq
+    && (webReq.body?.getReader || typeof webReq.text === 'function' || typeof webReq.json === 'function')
+  ) return readWebBody(webReq);
+  if (nodeReq && typeof nodeReq.on === 'function') {
+    const raw = await new Promise<string>((resolve, reject) => {
+      const chunks: Buffer[] = [];
+      let size = 0;
+      let exceeded = false;
+      nodeReq.on!('data', (chunk) => {
+        if (exceeded) return;
+        const buffer = Buffer.from(chunk);
+        size += buffer.length;
+        if (size > MAX_BODY_BYTES) {
+          exceeded = true;
+          reject(payloadTooLarge());
+          return;
+        }
+        chunks.push(buffer);
+      });
+      nodeReq.on!('end', () => { if (!exceeded) resolve(Buffer.concat(chunks).toString('utf8')); });
+      nodeReq.on!('error', reject);
+    });
+    return parseRawJson(raw);
+  }
+  return {};
+}
+
+/**
+ * The audience this door serves — the path segment after `/_fougere/call`.
+ *
+ * The envelope is a surface like REST and GraphQL, so it selects its audience like they
+ * do; the difference is only that it takes it from the path instead of an option, because
+ * a door is mounted, not called. The same word names the directory
+ * (`handlers/public/`), the config key (`surfaces: { public: [...] }`) and this segment —
+ * derived, never configured.
+ *
+ * No escalation to guard: a named surface serves the entities it names and nothing else
+ * (closed by naming), so every one of them is a subset of what the bare path already
+ * serves.
+ */
+function surfaceOf(path: string): string | undefined {
+  const named = /^\/_fougere\/call\/([A-Za-z0-9_-]+)/.exec(path.replace(/\?.*$/, ''));
+  return named?.[1];
+}
+
+export default defineEventHandler(async (event) => {
+  const app = await useFougereApp();
+  const runner = createAppRunner(app, surfaceOf(event.path));
+  const stamped: Transport = (call, invocation) =>
+    runner(call, { ...invocation, state: (event.context ?? {}) as Record<string, unknown> });
+  try {
+    return handleRpc(stamped, await readJsonBody(event));
+  } catch (err) {
+    if ((err as { statusCode?: number })?.statusCode === 413) throw err;
+    return {
+      jsonrpc: '2.0' as const,
+      id: null,
+      error: { code: PARSE_ERROR, message: 'Parse error' },
+    };
+  }
+});

package/src/runtime/server/routes/session.get.ts

@@ -0,0 +1,11 @@
+/**
+ * The session view over the wire — same resolution the hydration reads,
+ * for a client refreshing after login/logout. Internal route, same
+ * family as /_fougere/call.
+ */
+import { defineEventHandler } from 'h3';
+import { sessionViewOf } from '../../session/view.js';
+
+export default defineEventHandler((event) =>
+  sessionViewOf((event.context ?? {}) as Record<string, unknown>),
+);