@lucaapp/service-utils 5.27.0 → 5.29.1

package/dist/lib/api/openapi.js

@@ -225,6 +225,27 @@ const hoistCombinatorRequiredFields = (spec) => {
     visit(schemas);
 };
 exports.hoistCombinatorRequiredFields = hoistCombinatorRequiredFields;
+/**
+ * Turn each middleware's declared schemes into OpenAPI security requirements.
+ *
+ * OpenAPI expresses the two relations differently: separate objects in the
+ * `security` array are alternatives (OR), while several schemes inside one
+ * object are all required (AND). A middleware's own `security: [a, b]` means
+ * "a or b" -- it accepts either credential -- but two middlewares on the same
+ * route both run, so their requirements are combined with AND.
+ *
+ * That makes the result the cartesian product across middlewares:
+ *
+ *   [[a, b], [c]]  ->  [{a, c}, {b, c}]
+ *
+ * A single middleware therefore still renders as plain alternatives, which is
+ * what it did before, and stacked middlewares no longer render as if presenting
+ * any one of their credentials were enough.
+ */
+const buildSecurityRequirements = (securityByMiddleware) => securityByMiddleware.reduce((requirements, alternatives) => requirements.flatMap(requirement => 
+// Duplicates collapse on their own: the same scheme required twice is
+// still one entry in the object.
+alternatives.map(scheme => ({ ...requirement, [scheme]: [] }))), [{}]);
 const registerEndpoint = (registry, method, prefixPath, rootPrefixPath, path, summary, 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 options, tags, debug) => {
@@ -233,7 +254,11 @@ options, tags, debug) => {
     let querySchema = options.schemas?.query || undefined;
     let headersSchema = options.schemas?.headers || undefined;
     let responseSchemas = options.responses;
-    const securitySchemes = new Set();
+    // One entry per security-declaring middleware, each holding that middleware's
+    // alternatives. Kept separate because the two levels mean different things:
+    // within a middleware the schemes are alternatives, across middlewares they
+    // are all enforced. See buildSecurityRequirements.
+    const securityByMiddleware = [];
     if (options.errors) {
         for (const errorType of Object.keys(options.errors)) {
             const statusCode = options.errors[errorType];
@@ -294,8 +319,9 @@ options, tags, debug) => {
                 });
             }
         }
-        for (const scheme of middleware.options.security || []) {
-            securitySchemes.add(scheme);
+        const middlewareSecurity = middleware.options.security || [];
+        if (middlewareSecurity.length > 0) {
+            securityByMiddleware.push([...middlewareSecurity]);
         }
     }
     // Add ZodError response
@@ -355,8 +381,8 @@ options, tags, debug) => {
         responses: responseMap,
         operationId: options.operationId ||
             deriveOperationId(registry, method, prefixPath.slice(rootPrefixPath.length) + path),
-        ...(securitySchemes.size > 0 && {
-            security: [...securitySchemes].map(scheme => ({ [scheme]: [] })),
+        ...(securityByMiddleware.length > 0 && {
+            security: buildSecurityRequirements(securityByMiddleware),
         }),
     });
 };

package/dist/lib/api/security.d.ts

@@ -1,3 +1,3 @@
 import type { SecuritySchemeObject } from 'openapi3-ts/oas30';
-export type SecurityScheme = 'jwt_operator' | 'jwt_support' | 'jwt_operator_device' | 'jwt_consumer' | 'api_key';
+export type SecurityScheme = 'jwt_operator' | 'jwt_support' | 'jwt_operator_device' | 'jwt_consumer' | 'api_key_operator_device' | 'api_key_atworld' | 'api_key_at_support' | 'basic_adyen_webhook' | 'hmac_adyen_webhook';
 export declare const SECURITY_SCHEMES: Record<SecurityScheme, SecuritySchemeObject>;

package/dist/lib/api/security.js

@@ -1,15 +1,37 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SECURITY_SCHEMES = void 0;
-const X_AUTH_HEADER = {
+const xAuth = (description) => ({
     type: 'apiKey',
     in: 'header',
     name: 'X-Auth',
-};
+    description,
+});
+const xApiKey = (description) => ({
+    type: 'apiKey',
+    in: 'header',
+    name: 'X-Api-Key',
+    description,
+});
+const basicAuth = (description) => ({
+    type: 'http',
+    scheme: 'basic',
+    description,
+});
+const hmacHeader = (description) => ({
+    type: 'apiKey',
+    in: 'header',
+    name: 'hmacsignature',
+    description,
+});
 exports.SECURITY_SCHEMES = {
-    jwt_operator: X_AUTH_HEADER,
-    jwt_support: X_AUTH_HEADER,
-    jwt_operator_device: X_AUTH_HEADER,
-    jwt_consumer: X_AUTH_HEADER,
-    api_key: { type: 'apiKey', in: 'header', name: 'X-Api-Key' },
+    jwt_operator: xAuth('Operator session JWT issued by the luca backend'),
+    jwt_support: xAuth('Support session JWT issued by the luca backend'),
+    jwt_operator_device: xAuth('Operator device JWT issued by the luca backend (kiosk, terminal, link)'),
+    jwt_consumer: xAuth('Consumer JWT'),
+    api_key_operator_device: xApiKey('Operator device API key (sk_...) created by the operator for an external device'),
+    api_key_atworld: xApiKey('ATworld partner API key'),
+    api_key_at_support: xApiKey('AT support API key (partner or luca)'),
+    basic_adyen_webhook: basicAuth('Basic auth credential luca configures on the Adyen webhook endpoint'),
+    hmac_adyen_webhook: hmacHeader('Adyen HMAC-SHA256 signature over the raw request body, verified against the configured balance platform HMAC keys'),
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lucaapp/service-utils",
-  "version": "5.27.0",
+  "version": "5.29.1",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
@@ -11,7 +11,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "ts:check": "tsc -p . --noEmit",
-    "lint": "eslint .",
+    "lint": "eslint --quiet .",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
     "test:ci": "VITEST_JUNIT_SUITE_NAME=service-utils CI=true vitest run --coverage",