@inkeep/agents-api 0.0.0-dev-20260121145510

package/dist/middleware/ref.js

@@ -0,0 +1,239 @@
+import manageDbClient_default from "../data/db/manageDbClient.js";
+import "../data/db/index.js";
+import { createApiError, ensureBranchExists, getLogger, getProjectScopedRef, getTenantScopedRef, isRefWritable, resolveRef } from "@inkeep/agents-core";
+
+//#region src/middleware/ref.ts
+const logger = getLogger("ref-middleware");
+/**
+* Default tenant ID extractor - extracts from /tenants/{tenantId} path pattern
+*/
+const defaultExtractTenantId = (c) => {
+	return c.req.path.match(/^\/(?:manage|run)\/tenants\/([^/]+)/)?.[1];
+};
+/**
+* Default project ID extractor - extracts from /tenants/{tenantId}/projects/{projectId} or
+* /tenants/{tenantId}/project-full/{projectId} path patterns
+*/
+const defaultExtractProjectId = (c) => {
+	return c.req.path.match(/^\/(?:manage|run)\/tenants\/[^/]+\/(?:projects|project-full)(?:\/([^/]+))?/)?.[1];
+};
+/**
+* Extract tenantId from the executionContext set by apiKeyAuth middleware.
+*/
+const extractTenantIdFromExecutionContext = (c) => {
+	const executionContext = c.get("executionContext");
+	let tenantId;
+	if (executionContext) tenantId = executionContext.tenantId;
+	else tenantId = defaultExtractTenantId(c);
+	return tenantId;
+};
+/**
+* Extract projectId from the executionContext set by apiKeyAuth middleware.
+*/
+const extractProjectIdFromExecutionContext = (c) => {
+	const executionContext = c.get("executionContext");
+	let projectId;
+	if (executionContext) projectId = executionContext.projectId;
+	else projectId = defaultExtractProjectId(c);
+	return projectId;
+};
+/**
+* Creates a ref resolution middleware factory.
+*
+* This middleware:
+* 1. Extracts tenantId and projectId from the request
+* 2. Resolves the `ref` query parameter to a ResolvedRef
+* 3. Creates branches if needed (tenant_main, project_main)
+* 4. Sets `resolvedRef` in the Hono context for downstream handlers
+*
+* @param db - The Doltgres database client to use for ref resolution
+* @param options - Optional configuration for extraction and validation
+* @returns Hono middleware function
+*
+* @example
+* ```typescript
+* import { createRefMiddleware } from '@inkeep/agents-core';
+* import { manageDbClient } from './db';
+*
+* const refMiddleware = createRefMiddleware(manageDbClient);
+* app.use('/tenants/*', refMiddleware);
+* ```
+*/
+const createRefMiddleware = (db, options = {}) => {
+	const { extractTenantId = defaultExtractTenantId, extractProjectId = defaultExtractProjectId, allowProjectIdFromBody = true } = options;
+	return async (c, next) => {
+		const ref = c.req.query("ref");
+		const pathSplit = c.req.path.split("/");
+		const tenantId = extractTenantId(c);
+		let projectId = extractProjectId(c);
+		if (!projectId && allowProjectIdFromBody && [
+			"POST",
+			"PUT",
+			"PATCH"
+		].includes(c.req.method)) try {
+			const body = await c.req.json();
+			if (body && typeof body.projectId === "string") {
+				projectId = body.projectId;
+				logger.debug({ projectId }, "Extracted projectId from request body");
+			}
+		} catch {
+			logger.debug({}, "Could not extract projectId from body");
+		}
+		if (!tenantId) throw createApiError({
+			code: "bad_request",
+			message: "Missing tenantId"
+		});
+		if (process.env.ENVIRONMENT === "test") {
+			const defaultRef = {
+				type: "branch",
+				name: projectId ? getProjectScopedRef(tenantId, projectId, "main") : getTenantScopedRef(tenantId, "main"),
+				hash: "test-hash"
+			};
+			c.set("resolvedRef", defaultRef);
+			await next();
+			return;
+		}
+		if (pathSplit.length < 4 && ref !== "main" && ref !== void 0) throw createApiError({
+			code: "bad_request",
+			message: "Ref is not supported for this path"
+		});
+		let resolvedRef;
+		if (projectId) resolvedRef = await resolveProjectRef(db, c, tenantId, projectId, ref);
+		else resolvedRef = await resolveTenantRef(db, tenantId, ref);
+		if (c.req.path.includes("/signoz/")) logger.debug({
+			resolvedRef,
+			projectId,
+			tenantId
+		}, "Resolved ref");
+		else logger.info({
+			resolvedRef,
+			projectId,
+			tenantId
+		}, "Resolved ref");
+		c.set("resolvedRef", resolvedRef);
+		await next();
+	};
+};
+/**
+* Resolve ref for project-scoped requests
+*/
+async function resolveProjectRef(db, c, tenantId, projectId, ref) {
+	const projectMain = getProjectScopedRef(tenantId, projectId, "main");
+	const projectScopedRef = ref ? getProjectScopedRef(tenantId, projectId, ref) : projectMain;
+	if (ref && ref !== "main") {
+		let refResult$1 = await resolveRef(db)(projectScopedRef);
+		if (!refResult$1) refResult$1 = await resolveRef(db)(ref);
+		if (!refResult$1) throw createApiError({
+			code: "not_found",
+			message: `Unknown ref: ${ref}`
+		});
+		return refResult$1;
+	}
+	let refResult = null;
+	try {
+		refResult = await resolveRef(db)(projectMain);
+	} catch (error) {
+		logger.warn({
+			error,
+			projectMain
+		}, "Failed to resolve project main branch");
+		refResult = null;
+	}
+	if (!refResult) {
+		if (c.req.method === "PUT") {
+			const tenantMain = `${tenantId}_main`;
+			let tenantRefResult = await resolveRef(db)(tenantMain);
+			if (!tenantRefResult) {
+				await ensureBranchExists(db, tenantMain);
+				tenantRefResult = await resolveRef(db)(tenantMain);
+			}
+			if (tenantRefResult) return tenantRefResult;
+			throw createApiError({
+				code: "internal_server_error",
+				message: `Failed to create tenant main branch for upsert`
+			});
+		}
+		throw createApiError({
+			code: "not_found",
+			message: `Project not found: ${projectId}`
+		});
+	}
+	return refResult;
+}
+/**
+* Resolve ref for tenant-level requests
+*/
+async function resolveTenantRef(db, tenantId, ref) {
+	const tenantMain = `${tenantId}_main`;
+	if (ref && ref !== "main") {
+		const tenantScopedRef = `${tenantId}_${ref}`;
+		let refResult$1 = await resolveRef(db)(tenantScopedRef);
+		if (!refResult$1) refResult$1 = await resolveRef(db)(ref);
+		if (!refResult$1) throw createApiError({
+			code: "not_found",
+			message: `Unknown ref: ${ref}`
+		});
+		return refResult$1;
+	}
+	let refResult = await resolveRef(db)(tenantMain);
+	if (!refResult) {
+		await ensureBranchExists(db, tenantMain);
+		refResult = await resolveRef(db)(tenantMain);
+		if (!refResult) throw createApiError({
+			code: "internal_server_error",
+			message: `Failed to create tenant main branch: ${tenantMain}`
+		});
+	}
+	return refResult;
+}
+const writeProtectionMiddleware = async (c, next) => {
+	if (process.env.ENVIRONMENT === "test") {
+		await next();
+		return;
+	}
+	const resolvedRef = c.get("resolvedRef");
+	if (!resolvedRef) {
+		await next();
+		return;
+	}
+	const method = c.req.method;
+	if ([
+		"POST",
+		"PUT",
+		"PATCH",
+		"DELETE"
+	].includes(method) && !isRefWritable(resolvedRef)) throw createApiError({
+		code: "bad_request",
+		message: `Cannot perform write operation on ${resolvedRef.type}. Tags and commits are immutable. Write to a branch instead.`
+	});
+	await next();
+};
+const manageRefMiddleware = createRefMiddleware(manageDbClient_default);
+const runRefMiddleware = createRefMiddleware(manageDbClient_default, {
+	extractTenantId: extractTenantIdFromExecutionContext,
+	extractProjectId: extractProjectIdFromExecutionContext,
+	allowProjectIdFromBody: false
+});
+/**
+* Extract tenantId from query parameters (for OAuth routes)
+*/
+const extractTenantIdFromQuery = (c) => {
+	return c.req.query("tenantId");
+};
+/**
+* Extract projectId from query parameters (for OAuth routes)
+*/
+const extractProjectIdFromQuery = (c) => {
+	return c.req.query("projectId");
+};
+/**
+* Ref middleware for OAuth routes - extracts tenant/project from query params
+*/
+const oauthRefMiddleware = createRefMiddleware(manageDbClient_default, {
+	extractTenantId: extractTenantIdFromQuery,
+	extractProjectId: extractProjectIdFromQuery,
+	allowProjectIdFromBody: false
+});
+
+//#endregion
+export { createRefMiddleware, manageRefMiddleware, oauthRefMiddleware, runRefMiddleware, writeProtectionMiddleware };

package/dist/middleware/requirePermission.d.ts

@@ -0,0 +1,14 @@
+import { ManageAppVariables } from "../types/app.js";
+import * as hono5 from "hono";
+
+//#region src/middleware/requirePermission.d.ts
+type Permission = {
+  [resource: string]: string | string[];
+};
+declare const requirePermission: <Env$1 extends {
+  Variables: ManageAppVariables;
+} = {
+  Variables: ManageAppVariables;
+}>(permissions: Permission) => hono5.MiddlewareHandler<Env$1, string, {}, Response>;
+//#endregion
+export { requirePermission };

package/dist/middleware/requirePermission.js

@@ -0,0 +1,80 @@
+import { env } from "../env.js";
+import { createApiError } from "@inkeep/agents-core";
+import { createMiddleware } from "hono/factory";
+import { HTTPException } from "hono/http-exception";
+
+//#region src/middleware/requirePermission.ts
+function formatPermissionsForDisplay(permissions) {
+	const formatted = [];
+	for (const [resource, actions] of Object.entries(permissions)) {
+		const actionList = Array.isArray(actions) ? actions : [actions];
+		for (const action of actionList) formatted.push(`${resource}:${action}`);
+	}
+	return formatted;
+}
+const requirePermission = (permissions) => createMiddleware(async (c, next) => {
+	const isTestEnvironment = process.env.ENVIRONMENT === "test";
+	const auth = c.get("auth");
+	if (env.DISABLE_AUTH || isTestEnvironment || !auth) {
+		await next();
+		return;
+	}
+	const userId = c.get("userId");
+	const tenantId = c.get("tenantId");
+	const tenantRole = c.get("tenantRole");
+	const requiredPermissions = formatPermissionsForDisplay(permissions);
+	if (userId === "system" || userId?.startsWith("apikey:")) {
+		await next();
+		return;
+	}
+	if (!userId || !tenantId) throw createApiError({
+		code: "unauthorized",
+		message: "User or organization context not found. Ensure you are authenticated and belong to an organization.",
+		instance: c.req.path,
+		extensions: {
+			requiredPermissions,
+			context: {
+				hasUserId: !!userId,
+				hasTenantId: !!tenantId
+			}
+		}
+	});
+	try {
+		const result = await auth.api.hasPermission({
+			body: {
+				permissions,
+				organizationId: tenantId
+			},
+			headers: c.req.raw.headers
+		});
+		if (!result || !result.success) throw createApiError({
+			code: "forbidden",
+			message: `Permission denied. Required: ${requiredPermissions.join(", ")}`,
+			instance: c.req.path,
+			extensions: {
+				requiredPermissions,
+				context: {
+					userId,
+					organizationId: tenantId,
+					currentRole: tenantRole || "unknown"
+				}
+			}
+		});
+		await next();
+	} catch (error) {
+		if (error instanceof HTTPException) throw error;
+		const errorMessage = error instanceof Error ? error.message : "Unknown error";
+		throw createApiError({
+			code: "internal_server_error",
+			message: "Failed to verify permissions",
+			instance: c.req.path,
+			extensions: {
+				requiredPermissions,
+				internalError: errorMessage
+			}
+		});
+	}
+});
+
+//#endregion
+export { requirePermission };

package/dist/middleware/runAuth.d.ts

@@ -0,0 +1,29 @@
+import * as hono6 from "hono";
+import { BaseExecutionContext } from "@inkeep/agents-core";
+
+//#region src/middleware/runAuth.d.ts
+declare const runApiKeyAuth: () => hono6.MiddlewareHandler<{
+  Variables: {
+    executionContext: BaseExecutionContext;
+  };
+}, string, {}, Response>;
+/**
+ * Creates a middleware that applies API key authentication except for specified route patterns
+ * @param skipRouteCheck - Function that returns true if the route should skip authentication
+ */
+declare const runApiKeyAuthExcept: (skipRouteCheck: (path: string) => boolean) => hono6.MiddlewareHandler<{
+  Variables: {
+    executionContext: BaseExecutionContext;
+  };
+}, string, {}, Response>;
+/**
+ * Helper middleware for endpoints that optionally support API key authentication
+ * If no auth header is present, it continues without setting the executionContext
+ */
+declare const runOptionalAuth: () => hono6.MiddlewareHandler<{
+  Variables: {
+    executionContext?: BaseExecutionContext;
+  };
+}, string, {}, Response>;
+//#endregion
+export { runApiKeyAuth, runApiKeyAuthExcept, runOptionalAuth };

package/dist/middleware/runAuth.js

@@ -0,0 +1,253 @@
+import { getLogger as getLogger$1 } from "../logger.js";
+import { env } from "../env.js";
+import runDbClient_default from "../data/db/runDbClient.js";
+import { createBaseExecutionContext } from "../types/runExecutionContext.js";
+import { validateAndGetApiKey, validateTargetAgent, verifyServiceToken, verifyTempToken } from "@inkeep/agents-core";
+import { createMiddleware } from "hono/factory";
+import { HTTPException } from "hono/http-exception";
+
+//#region src/middleware/runAuth.ts
+const logger = getLogger$1("env-key-auth");
+/**
+* Extract common request data from the Hono context
+*/
+function extractRequestData(c) {
+	const authHeader = c.req.header("Authorization");
+	const tenantId = c.req.header("x-inkeep-tenant-id");
+	const projectId = c.req.header("x-inkeep-project-id");
+	const agentId = c.req.header("x-inkeep-agent-id");
+	const subAgentId = c.req.header("x-inkeep-sub-agent-id");
+	const proto = c.req.header("x-forwarded-proto")?.split(",")[0].trim();
+	const host = c.req.header("x-forwarded-host")?.split(",")[0].trim() ?? c.req.header("host");
+	const reqUrl = new URL(c.req.url);
+	const ref = c.req.query("ref");
+	const baseUrl = proto && host ? `${proto}://${host}` : host ? `${reqUrl.protocol}//${host}` : `${reqUrl.origin}`;
+	return {
+		authHeader,
+		apiKey: authHeader?.startsWith("Bearer ") ? authHeader.substring(7) : void 0,
+		tenantId,
+		projectId,
+		agentId,
+		subAgentId,
+		ref,
+		baseUrl
+	};
+}
+/**
+* Build the final execution context from auth result and request data
+*/
+function buildExecutionContext(authResult, reqData) {
+	return createBaseExecutionContext({
+		apiKey: authResult.apiKey,
+		tenantId: authResult.tenantId,
+		projectId: authResult.projectId,
+		agentId: authResult.agentId,
+		apiKeyId: authResult.apiKeyId,
+		baseUrl: reqData.baseUrl,
+		subAgentId: reqData.subAgentId,
+		ref: reqData.ref,
+		metadata: authResult.metadata
+	});
+}
+/**
+* Attempts to authenticate using a JWT temporary token
+*/
+async function tryTempJwtAuth(apiKey) {
+	if (!apiKey.startsWith("eyJ") || !env.INKEEP_AGENTS_TEMP_JWT_PUBLIC_KEY) return null;
+	try {
+		const payload = await verifyTempToken(Buffer.from(env.INKEEP_AGENTS_TEMP_JWT_PUBLIC_KEY, "base64").toString("utf-8"), apiKey);
+		logger.info({}, "JWT temp token authenticated successfully");
+		return {
+			apiKey,
+			tenantId: payload.tenantId,
+			projectId: payload.projectId,
+			agentId: payload.agentId,
+			apiKeyId: "temp-jwt",
+			metadata: { initiatedBy: payload.initiatedBy }
+		};
+	} catch (error) {
+		logger.debug({ error }, "JWT verification failed");
+		return null;
+	}
+}
+/**
+* Authenticate using a regular API key
+*/
+async function tryApiKeyAuth(apiKey) {
+	const apiKeyRecord = await validateAndGetApiKey(apiKey, runDbClient_default);
+	if (!apiKeyRecord) return null;
+	logger.debug({
+		tenantId: apiKeyRecord.tenantId,
+		projectId: apiKeyRecord.projectId,
+		agentId: apiKeyRecord.agentId
+	}, "API key authenticated successfully");
+	return {
+		apiKey,
+		tenantId: apiKeyRecord.tenantId,
+		projectId: apiKeyRecord.projectId,
+		agentId: apiKeyRecord.agentId,
+		apiKeyId: apiKeyRecord.id
+	};
+}
+/**
+* Authenticate using a team agent JWT token (for intra-tenant delegation)
+*/
+async function tryTeamAgentAuth(token, expectedSubAgentId) {
+	const result = await verifyServiceToken(token);
+	if (!result.valid || !result.payload) {
+		logger.warn({ error: result.error }, "Invalid team agent JWT token");
+		return {
+			authResult: null,
+			failureMessage: `Invalid team agent token: ${result.error || "Invalid token"}`
+		};
+	}
+	const payload = result.payload;
+	if (expectedSubAgentId && !validateTargetAgent(payload, expectedSubAgentId)) {
+		logger.error({
+			tokenTargetAgentId: payload.aud,
+			expectedSubAgentId,
+			originAgentId: payload.sub
+		}, "Team agent token target mismatch");
+		throw new HTTPException(403, { message: "Token not valid for the requested agent" });
+	}
+	logger.info({
+		originAgentId: payload.sub,
+		targetAgentId: payload.aud,
+		tenantId: payload.tenantId,
+		projectId: payload.projectId
+	}, "Team agent JWT token authenticated successfully");
+	return { authResult: {
+		apiKey: "team-agent-jwt",
+		tenantId: payload.tenantId,
+		projectId: payload.projectId,
+		agentId: payload.aud,
+		apiKeyId: "team-agent-token",
+		metadata: {
+			teamDelegation: true,
+			originAgentId: payload.sub
+		}
+	} };
+}
+/**
+* Authenticate using bypass secret (production mode bypass)
+*/
+function tryBypassAuth(apiKey, reqData) {
+	if (!env.INKEEP_AGENTS_RUN_API_BYPASS_SECRET) return null;
+	if (apiKey !== env.INKEEP_AGENTS_RUN_API_BYPASS_SECRET) return null;
+	if (!reqData.tenantId || !reqData.projectId || !reqData.agentId) throw new HTTPException(401, { message: "Missing or invalid tenant, project, or agent ID" });
+	logger.info({}, "Bypass secret authenticated successfully");
+	return {
+		apiKey,
+		tenantId: reqData.tenantId,
+		projectId: reqData.projectId,
+		agentId: reqData.agentId,
+		apiKeyId: "bypass"
+	};
+}
+/**
+* Create default development context
+*/
+function createDevContext(reqData) {
+	const result = {
+		apiKey: "development",
+		tenantId: reqData.tenantId || "test-tenant",
+		projectId: reqData.projectId || "test-project",
+		agentId: reqData.agentId || "test-agent",
+		apiKeyId: "test-key"
+	};
+	if (!reqData.tenantId || !reqData.projectId) logger.warn({
+		hasTenantId: !!reqData.tenantId,
+		hasProjectId: !!reqData.projectId,
+		hasApiKey: !!reqData.apiKey,
+		apiKeyPrefix: reqData.apiKey?.substring(0, 10),
+		resultTenantId: result.tenantId,
+		resultProjectId: result.projectId
+	}, "createDevContext: Using fallback test values due to missing tenant/project in request");
+	return result;
+}
+/**
+* Try all auth strategies in order, returning the first successful result
+*/
+async function authenticateRequest(reqData) {
+	const { apiKey, subAgentId } = reqData;
+	if (!apiKey) return { authResult: null };
+	const jwtResult = await tryTempJwtAuth(apiKey);
+	if (jwtResult) return { authResult: jwtResult };
+	const bypassResult = tryBypassAuth(apiKey, reqData);
+	if (bypassResult) return { authResult: bypassResult };
+	const apiKeyResult = await tryApiKeyAuth(apiKey);
+	if (apiKeyResult) return { authResult: apiKeyResult };
+	const teamAttempt = await tryTeamAgentAuth(apiKey, subAgentId);
+	if (teamAttempt.authResult) return { authResult: teamAttempt.authResult };
+	return {
+		authResult: null,
+		failureMessage: teamAttempt.failureMessage
+	};
+}
+/**
+* Core authentication handler that can be reused across middleware
+*/
+async function runApiKeyAuthHandler(c, next) {
+	if (c.req.method === "OPTIONS") {
+		await next();
+		return;
+	}
+	const reqData = extractRequestData(c);
+	if (process.env.ENVIRONMENT === "development" || process.env.ENVIRONMENT === "test") {
+		logger.info({}, "development environment");
+		const attempt$1 = await authenticateRequest(reqData);
+		if (attempt$1.authResult) c.set("executionContext", buildExecutionContext(attempt$1.authResult, reqData));
+		else {
+			logger.info({}, reqData.apiKey ? "Development/test environment - fallback to default context due to invalid API key" : "Development/test environment - no API key provided, using default context");
+			c.set("executionContext", buildExecutionContext(createDevContext(reqData), reqData));
+		}
+		await next();
+		return;
+	}
+	if (!reqData.authHeader || !reqData.authHeader.startsWith("Bearer ")) throw new HTTPException(401, { message: "Missing or invalid authorization header. Expected: Bearer <api_key>" });
+	if (!reqData.apiKey || reqData.apiKey.length < 16) throw new HTTPException(401, { message: "Invalid API key format" });
+	let attempt = { authResult: null };
+	try {
+		attempt = await authenticateRequest(reqData);
+	} catch (error) {
+		if (error instanceof HTTPException) throw error;
+		logger.error({ error }, "Authentication failed");
+		throw new HTTPException(500, { message: "Authentication failed" });
+	}
+	if (!attempt.authResult) {
+		logger.error({}, "API key authentication error - no valid auth method found");
+		throw new HTTPException(401, { message: attempt.failureMessage || "Invalid Token" });
+	}
+	logger.debug({
+		tenantId: attempt.authResult.tenantId,
+		projectId: attempt.authResult.projectId,
+		agentId: attempt.authResult.agentId,
+		subAgentId: reqData.subAgentId
+	}, "API key authenticated successfully");
+	c.set("executionContext", buildExecutionContext(attempt.authResult, reqData));
+	await next();
+}
+const runApiKeyAuth = () => createMiddleware(runApiKeyAuthHandler);
+/**
+* Creates a middleware that applies API key authentication except for specified route patterns
+* @param skipRouteCheck - Function that returns true if the route should skip authentication
+*/
+const runApiKeyAuthExcept = (skipRouteCheck) => createMiddleware(async (c, next) => {
+	if (skipRouteCheck(c.req.path)) return next();
+	return runApiKeyAuthHandler(c, next);
+});
+/**
+* Helper middleware for endpoints that optionally support API key authentication
+* If no auth header is present, it continues without setting the executionContext
+*/
+const runOptionalAuth = () => createMiddleware(async (c, next) => {
+	const authHeader = c.req.header("Authorization");
+	if (!authHeader || !authHeader.startsWith("Bearer ")) {
+		await next();
+		return;
+	}
+	return runApiKeyAuthHandler(c, next);
+});
+
+//#endregion
+export { runApiKeyAuth, runApiKeyAuthExcept, runOptionalAuth };

package/dist/middleware/sessionAuth.d.ts

@@ -0,0 +1,17 @@
+import * as hono9 from "hono";
+
+//#region src/middleware/sessionAuth.d.ts
+
+/**
+ * Middleware to enforce session-based authentication.
+ * Requires that a user has already been authenticated via Better Auth session.
+ * Used primarily for manage routes that require an active user session.
+ */
+declare const sessionAuth: () => hono9.MiddlewareHandler<any, string, {}, Response>;
+/**
+ * Global session middleware - sets user and session in context for all routes
+ * Used for all routes that require an active user session.
+ */
+declare const sessionContext: () => hono9.MiddlewareHandler<any, string, {}, Response>;
+//#endregion
+export { sessionAuth, sessionContext };

package/dist/middleware/sessionAuth.js

@@ -0,0 +1,58 @@
+import { env } from "../env.js";
+import { createApiError } from "@inkeep/agents-core";
+import { createMiddleware } from "hono/factory";
+import { HTTPException } from "hono/http-exception";
+
+//#region src/middleware/sessionAuth.ts
+/**
+* Middleware to enforce session-based authentication.
+* Requires that a user has already been authenticated via Better Auth session.
+* Used primarily for manage routes that require an active user session.
+*/
+const sessionAuth = () => createMiddleware(async (c, next) => {
+	try {
+		const user = c.get("user");
+		if (!user) throw createApiError({
+			code: "unauthorized",
+			message: "Please log in to access this resource"
+		});
+		c.set("userId", user.id);
+		c.set("userEmail", user.email);
+		await next();
+	} catch (error) {
+		if (error instanceof HTTPException) throw error;
+		throw createApiError({
+			code: "unauthorized",
+			message: "Authentication failed"
+		});
+	}
+});
+/**
+* Global session middleware - sets user and session in context for all routes
+* Used for all routes that require an active user session.
+*/
+const sessionContext = () => createMiddleware(async (c, next) => {
+	const auth = c.get("auth");
+	if (env.DISABLE_AUTH || !auth) {
+		c.set("user", null);
+		c.set("session", null);
+		await next();
+		return;
+	}
+	const headers$1 = new Headers(c.req.raw.headers);
+	const forwardedCookie = headers$1.get("x-forwarded-cookie");
+	if (forwardedCookie && !headers$1.get("cookie")) headers$1.set("cookie", forwardedCookie);
+	const session = await auth.api.getSession({ headers: headers$1 });
+	if (!session) {
+		c.set("user", null);
+		c.set("session", null);
+		await next();
+		return;
+	}
+	c.set("user", session.user);
+	c.set("session", session.session);
+	await next();
+});
+
+//#endregion
+export { sessionAuth, sessionContext };