@karmaniverous/smoz 0.2.15 → 0.2.16

package/dist/cjs/index.js

@@ -997,6 +997,12 @@ const serverlessConfigSchema = zod.z.object({
     defaultHandlerFileExport: zod.z.string().min(1),
 });
 
+/** Security context classification used throughout the handlers. */
+/**
+ * HTTP security context tokens.
+ */
+const httpContexts = ['my', 'private', 'public'];
+
 const splitPath = (basePath) => basePath.split('/').filter(Boolean);
 /** Prefix non-public contexts and return path elements. */
 /**
@@ -1011,6 +1017,19 @@ const buildPathElements = (basePath, context) => {
     return context === 'public' ? parts : [context, ...parts];
 };
 const sanitizeBasePath = (p) => p.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '');
+/**
+ * Infer the security context from a path that was built by
+ * `buildPathElements`. Non-public contexts appear as the first
+ * path segment; public paths have no context prefix.
+ */
+const inferContextFromPath = (path) => {
+    const firstSeg = splitPath(sanitizeBasePath(path))[0];
+    return firstSeg !== undefined &&
+        httpContexts.includes(firstSeg) &&
+        firstSeg !== 'public'
+        ? firstSeg
+        : 'public';
+};
 
 const HTTP_METHODS = new Set([
     'get',
@@ -1129,11 +1148,15 @@ const buildAllServerlessFunctions = (registry, serverless, buildFnEnv) => {
                 ...(r.basePath ? { basePath: r.basePath } : {}),
                 ...(r.httpContexts ? { httpContexts: r.httpContexts } : {}),
             }, r.callerModuleUrl, r.endpointsRootAbs);
-            const path = `/${basePath.replace(/^\/+/, '')}`;
             const ctxs = contexts.length > 0 ? contexts : ['public'];
-            events = ctxs.map(() => ({
-                http: { method, path },
-            }));
+            events = ctxs.map((ctx) => {
+                const elems = buildPathElements(basePath, ctx);
+                const ctxPath = `/${elems.join('/')}`;
+                const ctxEventProps = serverless.httpContextEventMap[ctx];
+                return {
+                    http: { method, path: ctxPath, ...ctxEventProps },
+                };
+            });
         }
         catch {
             events = r.serverlessExtras ?? [];
@@ -1480,12 +1503,15 @@ const dirFromHere = (metaUrl, levelsUp = 1) => {
 
 exports.App = App;
 exports.baseEventTypeMapSchema = baseEventTypeMapSchema;
+exports.buildPathElements = buildPathElements;
 exports.buildSafeDefaults = buildSafeDefaults;
 exports.defineAppConfig = defineAppConfig;
 exports.detectSecurityContext = detectSecurityContext;
 exports.dirFromHere = dirFromHere;
 exports.findIndex = findIndex;
 exports.getId = getId;
+exports.httpContexts = httpContexts;
+exports.inferContextFromPath = inferContextFromPath;
 exports.insertAfter = insertAfter;
 exports.insertBefore = insertBefore;
 exports.removeStep = removeStep;

package/dist/index.d.ts

@@ -122,7 +122,8 @@ declare function buildStageArtifacts<GlobalParamsSchema extends ZodObject<ZodRaw
 /**
  * HTTP security context tokens.
  */
-type HttpContext = 'my' | 'private' | 'public';
+declare const httpContexts: readonly ["my", "private", "public"];
+type HttpContext = (typeof httpContexts)[number];
 
 /**
  * Extract the property type `K` from a union of object types `U`.
@@ -625,6 +626,22 @@ declare function wrapHandler<GlobalParamsSchema extends ZodObject<ZodRawShape>,
  */
 type LambdaEvent = Record<string, unknown>;
 
+/** Prefix non-public contexts and return path elements. */
+/**
+ * Build OpenAPI/serverless path elements from a base path and context.
+ *
+ * @param basePath - base path (e.g., 'users/:id')
+ * @param context  - 'my' | 'private' | 'public' (public is unprefixed)
+ * @returns array of path segments without leading/trailing slashes
+ */
+declare const buildPathElements: (basePath: string, context: HttpContext) => string[];
+/**
+ * Infer the security context from a path that was built by
+ * `buildPathElements`. Non-public contexts appear as the first
+ * path segment; public paths have no context prefix.
+ */
+declare const inferContextFromPath: (path: string) => HttpContext;
+
 /** Normalize a path to POSIX separators. */
 declare const toPosixPath: (p: string) => string;
 /**
@@ -636,5 +653,5 @@ declare const toPosixPath: (p: string) => string;
  */
 declare const dirFromHere: (metaUrl: string, levelsUp?: number) => string;
 
-export { App, baseEventTypeMapSchema, buildSafeDefaults, defineAppConfig, detectSecurityContext, dirFromHere, findIndex, getId, insertAfter, insertBefore, removeStep, replaceStep, tagStep, toPosixPath, wrapHandler };
+export { App, baseEventTypeMapSchema, buildPathElements, buildSafeDefaults, defineAppConfig, detectSecurityContext, dirFromHere, findIndex, getId, httpContexts, inferContextFromPath, insertAfter, insertBefore, removeStep, replaceStep, tagStep, toPosixPath, wrapHandler };
 export type { AppHttpConfig, AppInit, ConsoleLogger, DefineAppConfigInput, DefineAppConfigOutput, EnvKeysNode, EnvSchemaNode, FunctionHttpConfig, GlobalEnvConfig, GlobalParamsNode, Handler, HandlerOptions, HttpContext, HttpProfile, HttpStackOptions, LambdaEvent, MethodKey, SecurityContextHttpEventMap, ShapedEvent, StageParamsNode };

package/dist/mjs/cli/inline-server.js

@@ -48,6 +48,46 @@ const match = (segs, pathName) => {
     }
     return { ok: true, params };
 };
+/**
+ * Decode JWT payload without signature validation (local dev only).
+ * Returns the parsed claims object, or an empty object on failure.
+ */
+const decodeJwtClaims = (token) => {
+    try {
+        const parts = token.replace(/^Bearer\s+/i, '').split('.');
+        if (parts.length < 2)
+            return {};
+        const payload = Buffer.from(parts[1], 'base64url').toString('utf8');
+        const parsed = JSON.parse(payload);
+        return typeof parsed === 'object' && parsed !== null
+            ? parsed
+            : {};
+    }
+    catch {
+        return {};
+    }
+};
+/**
+ * Build a local-dev authorizer that makes `detectSecurityContext`
+ * return the correct context for the route.
+ *
+ * Only populates the authorizer when the client actually sends
+ * credentials, so `detectSecurityContext` reflects reality:
+ * - `my` route + JWT in Authorization header → decoded claims.
+ * - `private` route → no authorizer; the forwarded `x-api-key`
+ *   header is enough for `detectSecurityContext`.
+ * - No credentials → empty authorizer → `public`.
+ */
+const buildLocalAuthorizer = (context, authHeader) => {
+    if (context === 'my' && authHeader) {
+        const claims = decodeJwtClaims(authHeader);
+        if (Object.keys(claims).length > 0)
+            return { claims };
+    }
+    // Return undefined so detectSecurityContext sees no authorizer,
+    // rather than {} which it treats as truthy.
+    return undefined;
+};
 const toEvent = async (req, route, params) => {
     const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
     const { single, multi } = toHeaders(req.headers);
@@ -90,7 +130,7 @@ const toEvent = async (req, route, params) => {
             requestTimeEpoch: Date.now(),
             resourceId: 'res',
             resourcePath: route.pattern,
-            authorizer: {},
+            authorizer: buildLocalAuthorizer(route.context, single['authorization']),
             protocol: 'HTTP/1.1',
         },
     };
@@ -149,6 +189,28 @@ const loadApp = async (root) => {
     return app;
 };
 
+/** Security context classification used throughout the handlers. */
+/**
+ * HTTP security context tokens.
+ */
+const httpContexts = ['my', 'private', 'public'];
+
+const splitPath = (basePath) => basePath.split('/').filter(Boolean);
+const sanitizeBasePath = (p) => p.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '');
+/**
+ * Infer the security context from a path that was built by
+ * `buildPathElements`. Non-public contexts appear as the first
+ * path segment; public paths have no context prefix.
+ */
+const inferContextFromPath = (path) => {
+    const firstSeg = splitPath(sanitizeBasePath(path))[0];
+    return firstSeg !== undefined &&
+        httpContexts.includes(firstSeg) &&
+        firstSeg !== 'public'
+        ? firstSeg
+        : 'public';
+};
+
 const splitPattern = (p) => p
     .replace(/\\/g, '/')
     .replace(/^\/+|\/+$/g, '')
@@ -195,11 +257,13 @@ const loadHandlers = async (root, app) => {
             const pattern = '/' + (httpEvt?.path ?? '').replace(/^\/+/, '');
             if (!method || !pattern)
                 continue;
+            const context = inferContextFromPath(pattern);
             routes.push({
                 method,
                 pattern,
                 segs: splitPattern(pattern),
                 handlerRef: `${moduleRel}.${exportName}`,
+                context,
                 handler: handler,
             });
         }

package/dist/mjs/index.js

@@ -995,6 +995,12 @@ const serverlessConfigSchema = z.object({
     defaultHandlerFileExport: z.string().min(1),
 });
 
+/** Security context classification used throughout the handlers. */
+/**
+ * HTTP security context tokens.
+ */
+const httpContexts = ['my', 'private', 'public'];
+
 const splitPath = (basePath) => basePath.split('/').filter(Boolean);
 /** Prefix non-public contexts and return path elements. */
 /**
@@ -1009,6 +1015,19 @@ const buildPathElements = (basePath, context) => {
     return context === 'public' ? parts : [context, ...parts];
 };
 const sanitizeBasePath = (p) => p.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '');
+/**
+ * Infer the security context from a path that was built by
+ * `buildPathElements`. Non-public contexts appear as the first
+ * path segment; public paths have no context prefix.
+ */
+const inferContextFromPath = (path) => {
+    const firstSeg = splitPath(sanitizeBasePath(path))[0];
+    return firstSeg !== undefined &&
+        httpContexts.includes(firstSeg) &&
+        firstSeg !== 'public'
+        ? firstSeg
+        : 'public';
+};
 
 const HTTP_METHODS = new Set([
     'get',
@@ -1127,11 +1146,15 @@ const buildAllServerlessFunctions = (registry, serverless, buildFnEnv) => {
                 ...(r.basePath ? { basePath: r.basePath } : {}),
                 ...(r.httpContexts ? { httpContexts: r.httpContexts } : {}),
             }, r.callerModuleUrl, r.endpointsRootAbs);
-            const path = `/${basePath.replace(/^\/+/, '')}`;
             const ctxs = contexts.length > 0 ? contexts : ['public'];
-            events = ctxs.map(() => ({
-                http: { method, path },
-            }));
+            events = ctxs.map((ctx) => {
+                const elems = buildPathElements(basePath, ctx);
+                const ctxPath = `/${elems.join('/')}`;
+                const ctxEventProps = serverless.httpContextEventMap[ctx];
+                return {
+                    http: { method, path: ctxPath, ...ctxEventProps },
+                };
+            });
         }
         catch {
             events = r.serverlessExtras ?? [];
@@ -1476,4 +1499,4 @@ const dirFromHere = (metaUrl, levelsUp = 1) => {
     return toPosixPath(abs);
 };
 
-export { App, baseEventTypeMapSchema, buildSafeDefaults, defineAppConfig, detectSecurityContext, dirFromHere, findIndex, getId, insertAfter, insertBefore, removeStep, replaceStep, tagStep, toPosixPath, wrapHandler };
+export { App, baseEventTypeMapSchema, buildPathElements, buildSafeDefaults, defineAppConfig, detectSecurityContext, dirFromHere, findIndex, getId, httpContexts, inferContextFromPath, insertAfter, insertBefore, removeStep, replaceStep, tagStep, toPosixPath, wrapHandler };

package/package.json

@@ -183,7 +183,7 @@
     "templates:lint": "eslint --fix -c templates/default/eslint.config.ts \"templates/default/**/*.{ts,tsx,js,jsx}\" \"templates/default/eslint.config.ts\""
   },
   "type": "module",
-  "version": "0.2.15",
+  "version": "0.2.16",
   "volta": {
     "node": "22.19.0"
   }