@nodefony/framework 10.0.0-beta.3 → 10.0.0-beta.4

package/README.md

@@ -18,6 +18,10 @@ sert **HTTP et WebSocket dans le même contexte**, nativement.
   instance par requête (par connexion en WebSocket). `RealtimeController` est par connexion.
 - **Décorateurs** : `@controller`, `@route`, `@Get/@Post/...`, `@Param/@Body/@Query/@Headers`,
   `@Domain`, etc.
+- **Routes à schéma** : `@Post("/posts", { schema: { body } })` — l'entrée est validée avant
+  l'action (422 qui nomme chaque champ, sur HTTP comme par la socket) et reçue typée en un seul
+  argument, `input: RouteInput<S>`. Zod, Valibot, ArkType : tout Standard Schema. Détail :
+  [`docs/decorateurs.md`](docs/decorateurs.md).
 - **Data plane admin** : `AdminApiController` + `IAdminBroker` (surface `/nodefony/<module>/api/*`).
 
 ## Exemple

package/dist/_virtual/{_@oxc-project_runtime@0.153.0 → _@oxc-project_runtime@0.155.0}/helpers/esm/decorate.js

@@ -1,9 +1,8 @@
-//#region \0@oxc-project+runtime@0.153.0/helpers/esm/decorate.js
+// \0@oxc-project+runtime@0.155.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
 	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
 	return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-//#endregion
 export { __decorate as default };

package/dist/index.js

@@ -4,12 +4,12 @@ import { getIdempotencyStoreFactory, listIdempotencyBackends, listIdempotencySto
 import { RedisIdempotencyStore } from "./nodefony/src/RedisIdempotencyStore.js";
 import { scheduleIdempotencyGc } from "./nodefony/src/idempotencyGc.js";
 import Route from "./nodefony/src/Route.js";
+import { validateRouteInput } from "./nodefony/src/routeSchema.js";
 import Controller from "./nodefony/src/Controller.js";
 import { All, Anonymous, Body, BypassFirewall, Cookie, Csp, CsrfExempt, CsrfProtect, CurrentUser, Delete, Domain, Get, Head, Header, Headers, HttpCode, Idempotent, IsGranted, Options, Param, Patch, Post, Put, Query, Redirect, Req, RequireAuthentication, RequireScope, Res, Scope, Session, UploadedFile, UploadedFiles, UseSession, buildContextParamArgs, controller, controllers, getParamArgsMeta, route, routeExpectsBodyStream } from "./nodefony/decorators/routerDecorators.js";
 import Resolver from "./nodefony/src/Resolver.js";
-import __decorateMetadata from "./_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorateMetadata.js";
-import __decorate from "./_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorate.js";
-import router_default from "./nodefony/service/router.js";
+import __decorate from "./_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
+import router_default, { FRAMEWORK_ROUTER, isFrameworkRouter } from "./nodefony/service/router.js";
 import ResourceController from "./nodefony/src/ResourceController.js";
 import AdminApiController from "./nodefony/controller/AdminApiController.js";
 import AdminBroker_default from "./nodefony/service/AdminBroker.js";
@@ -30,10 +30,8 @@ import { createFrameworkAdminApi } from "./nodefony/src/FrameworkAdminApi.js";
 import { createSyslogAdminApi } from "./nodefony/src/SyslogAdminApi.js";
 import Eta from "./nodefony/service/Eta.js";
 import path from "node:path";
-import { AUTO_STORE, EMPTY_INFRA, Kernel, Module, durableStoreRemedy, readStoreConnector, readStoreLocation, resolveAutoStore, runNeedsExternalServices, services } from "nodefony";
-import { mergeResolvers, mergeTypeDefs } from "@graphql-tools/merge";
-import { makeExecutableSchema, mergeSchemas } from "@graphql-tools/schema";
-//#region index.ts
+import { AUTO_STORE, EMPTY_INFRA, Module, durableStoreRemedy, readStoreConnector, readStoreLocation, resolveAutoStore, services, storeConnectivity } from "nodefony";
+// index.ts
 registerIdempotencyStore("redis", (ctx) => {
 	const redis = ctx.module.kernel?.container?.get("redis");
 	if (!redis) throw new Error("the @nodefony/redis module is not loaded (add use(\"@nodefony/redis\") in nodefony.config.ts)");
@@ -92,13 +90,13 @@ let Framework = class Framework extends Module {
 		let name = configured;
 		let reason = `store explicitement configuré ("${configured}")`;
 		if (name === AUTO_STORE) {
-			const auto = resolveAutoStore("ephemeral", this.kernel?.infra ?? EMPTY_INFRA, listIdempotencyBackends(), "memory", runNeedsExternalServices(this.kernel));
+			const auto = resolveAutoStore("ephemeral", this.kernel?.infra ?? EMPTY_INFRA, listIdempotencyBackends(), "memory", storeConnectivity(this.kernel));
 			name = auto.store;
 			reason = auto.reason;
 			this.log(`idempotency.store "auto" → "${name}" (${auto.reason})`, "INFO");
 		}
 		if (name === "memory") {
-			if (this.kernel?.environment === "production") this.log("idempotency.store \"memory\" en PRODUCTION — déduplication per-pod uniquement : un rejeu routé vers un autre pod n'est pas dédupliqué (double-effet possible). " + durableStoreRemedy(runNeedsExternalServices(this.kernel)), "WARNING");
+			if (this.kernel?.environment === "production") this.log("idempotency.store \"memory\" en PRODUCTION — déduplication per-pod uniquement : un rejeu routé vers un autre pod n'est pas dédupliqué (double-effet possible). " + durableStoreRemedy(storeConnectivity(this.kernel)), "WARNING");
 			this.kernel?.registerStoreResolution({
 				brick: "idempotency",
 				nature: "ephemeral",
@@ -204,13 +202,6 @@ Framework = __decorate([services([
 	Eta,
 	AdminBroker_default,
 	IdempotencyStore_default
-]), __decorateMetadata("design:paramtypes", [typeof Kernel === "undefined" ? Object : Kernel])], Framework);
-const graphql = {
-	mergeSchemas,
-	makeExecutableSchema,
-	mergeResolvers,
-	mergeTypeDefs
-};
+])], Framework);
 var framework_default = Framework;
-//#endregion
-export { AdminApiController, AdminBroker_default as AdminBroker, All, Anonymous, ApiKeyController, BenchController, Body, BypassFirewall, Controller, Cookie, Csp, CsrfExempt, CsrfProtect, CurrentUser, Delete, Domain, Eta, Get, Head, Header, Headers, HttpCode, Idempotent, IsGranted, IssuerMetadataController, LoginPageController, IdempotencyStore_default as MemoryIdempotencyStore, OAuth2Controller, Options, Param, Patch, Post, ProtectedResourceMetadataController, Put, Query, Redirect, Req, RequireAuthentication, RequireScope, Res, Resolver, ResourceController, Route, router_default as Router, Scope, Session, SessionAuthController, TokenAuthController, TotpController, UploadedFile, UploadedFiles, UseSession, WebAuthnController, buildContextParamArgs, buildPlaygroundSnapshot, collectProtectedResources, controller, controllers, createFrameworkAdminApi, createKernelAdminApi, createSyslogAdminApi, framework_default as default, defineFrameworkConfig, frameworkConfigJsonSchema, frameworkConfigSchema, getIdempotencyStoreFactory, getParamArgsMeta, graphql, listIdempotencyStores, mountApiKeyRoutes, mountBenchRoutes, mountIssuerMetadataRoutes, mountLoginPage, mountOAuth2Routes, mountProtectedResourceRoutes, mountSessionAuthRoutes, mountTokenAuthRoutes, mountTotpRoutes, mountWebAuthnRoutes, protectedResourceRoutePaths, registerIdempotencyStore, route, routeExpectsBodyStream };
+export { AdminApiController, AdminBroker_default as AdminBroker, All, Anonymous, ApiKeyController, BenchController, Body, BypassFirewall, Controller, Cookie, Csp, CsrfExempt, CsrfProtect, CurrentUser, Delete, Domain, Eta, FRAMEWORK_ROUTER, Get, Head, Header, Headers, HttpCode, Idempotent, IsGranted, IssuerMetadataController, LoginPageController, IdempotencyStore_default as MemoryIdempotencyStore, OAuth2Controller, Options, Param, Patch, Post, ProtectedResourceMetadataController, Put, Query, Redirect, Req, RequireAuthentication, RequireScope, Res, Resolver, ResourceController, Route, router_default as Router, Scope, Session, SessionAuthController, TokenAuthController, TotpController, UploadedFile, UploadedFiles, UseSession, WebAuthnController, buildContextParamArgs, buildPlaygroundSnapshot, collectProtectedResources, controller, controllers, createFrameworkAdminApi, createKernelAdminApi, createSyslogAdminApi, framework_default as default, defineFrameworkConfig, frameworkConfigJsonSchema, frameworkConfigSchema, getIdempotencyStoreFactory, getParamArgsMeta, isFrameworkRouter, listIdempotencyStores, mountApiKeyRoutes, mountBenchRoutes, mountIssuerMetadataRoutes, mountLoginPage, mountOAuth2Routes, mountProtectedResourceRoutes, mountSessionAuthRoutes, mountTokenAuthRoutes, mountTotpRoutes, mountWebAuthnRoutes, protectedResourceRoutePaths, registerIdempotencyStore, route, routeExpectsBodyStream, validateRouteInput };

package/dist/nodefony/config/config.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-//#region nodefony/config/config.ts
+// nodefony/config/config.ts
 /**
 * @nodefony/framework — CONFIGURATION DU MODULE (schéma Zod = source unique).
 *
@@ -58,5 +58,4 @@ var config_default = {
 		}
 	} }
 };
-//#endregion
 export { config_default as default, frameworkConfigSchema };

package/dist/nodefony/config/defineModuleConfig.js

@@ -1,7 +1,7 @@
 import { frameworkConfigSchema } from "./config.js";
 import { parseModuleConfig } from "nodefony";
 import { z } from "zod";
-//#region nodefony/config/defineModuleConfig.ts
+// nodefony/config/defineModuleConfig.ts
 /**
 * Builder type-safe de la configuration de `@nodefony/framework` (PUR — ne
 * retape JAMAIS un défaut : source unique = `./config.ts`).
@@ -32,5 +32,4 @@ function defineFrameworkConfig(config = {}) {
 function frameworkConfigJsonSchema() {
 	return z.toJSONSchema(frameworkConfigSchema);
 }
-//#endregion
 export { defineFrameworkConfig, frameworkConfigJsonSchema };

package/dist/nodefony/controller/AdminApiController.js

@@ -1,7 +1,39 @@
 import Controller from "../src/Controller.js";
 import { computeFingerprint, evaluateIdempotency, resolveIdempotencyKey, resolveIdentity } from "../src/idempotency.js";
 import { JsonRpcServerError, RequestContext, RpcError, executeAdminEndpoint } from "nodefony";
-//#region nodefony/controller/AdminApiController.ts
+// nodefony/controller/AdminApiController.ts
+/** Vrai pour une chaîne ou un tableau de chaînes — ce que porte {@link IAdminRequest.query}. */
+function isAdminQueryValue(value) {
+	if (typeof value === "string") return true;
+	if (!Array.isArray(value)) return false;
+	for (const item of value) if (typeof item !== "string") return false;
+	return true;
+}
+/**
+* Ramène les paramètres d'URL au contrat {@link IAdminRequest.query} : seules
+* les chaînes et les tableaux de chaînes passent. `qs` produit des objets pour
+* `a[b]=1` ; les laisser passer sous un type qui les nie tromperait chaque
+* producteur du plan d'administration.
+*
+* @param source - paramètres d'URL de la requête (`Controller.query`)
+* @returns `source` lui-même quand il respecte déjà le contrat (aucune
+*   allocation), sinon une copie sans les valeurs imbriquées
+*/
+function toAdminQuery(source) {
+	if (source === void 0) return {};
+	let conforms = true;
+	for (const key of Object.keys(source)) if (!isAdminQueryValue(source[key])) {
+		conforms = false;
+		break;
+	}
+	if (conforms) return source;
+	const kept = [];
+	for (const key of Object.keys(source)) {
+		const value = source[key];
+		if (isAdminQueryValue(value)) kept.push([key, value]);
+	}
+	return Object.fromEntries(kept);
+}
 /**
 * Controller pont unique du data plane admin (Studio).
 *
@@ -43,7 +75,7 @@ var AdminApiController = class AdminApiController extends Controller {
 	*/
 	async dispatch(...args) {
 		const { status, headers, body } = await this.runAdmin(args);
-		if (this.context?.type.startsWith("websocket")) {
+		if (this.context?.type === "websocket") {
 			if (status >= 400) {
 				const message = body?.error ?? "admin error";
 				throw new RpcError(message, JsonRpcServerError.DEFAULT, {
@@ -114,7 +146,7 @@ var AdminApiController = class AdminApiController extends Controller {
 				request.params,
 				request.body ?? null
 			]),
-			isWs: Boolean((this.context?.type)?.startsWith("websocket")),
+			isWs: this.context?.type === "websocket",
 			required: false
 		});
 		switch (verdict.kind) {
@@ -143,10 +175,10 @@ var AdminApiController = class AdminApiController extends Controller {
 		}
 		const als = RequestContext.get();
 		const user = als?.user ?? null;
-		const post = this.queryPost;
+		const post = this.body;
 		return {
 			params,
-			query: this.query ?? {},
+			query: toAdminQuery(this.query),
 			body: als?.body !== void 0 ? als.body : post ?? null,
 			user,
 			roles: this.extractRoles(user),
@@ -183,5 +215,4 @@ var AdminApiController = class AdminApiController extends Controller {
 		return [...walker.reachableRoles(roles)];
 	}
 };
-//#endregion
-export { AdminApiController as default };
+export { AdminApiController as default, toAdminQuery };

package/dist/nodefony/controller/ApiKeyController.js

@@ -1,7 +1,7 @@
 import router_default from "../service/router.js";
 import SecurityApiController from "../src/SecurityApiController.js";
 import { collectDeclaredApiScopes } from "../src/scopeCatalog.js";
-//#region nodefony/controller/ApiKeyController.ts
+// nodefony/controller/ApiKeyController.ts
 let mounted = false;
 /**
 * Endpoints HTTP de **gestion des clés API personnelles (PAT, P6.12)** — console
@@ -32,15 +32,15 @@ var ApiKeyController = class extends SecurityApiController {
 	async create() {
 		const svc = this.#manager();
 		if (!svc || !svc.isEnabled()) return this.renderJson({ error: "API keys unavailable" }, 503);
-		const subject = await this.#currentSubject();
-		if (subject === null) return this.renderJson({ error: "Unauthorized" }, 401);
-		const body = this.queryPost ?? {};
+		const holder = await this.#currentHolder();
+		if (holder === null) return this.renderJson({ error: "Unauthorized" }, 401);
+		const body = this.body ?? {};
 		try {
-			const created = await svc.createForSubject(subject, "user", {
+			const created = await svc.createForSubject(holder.identifier, "user", {
 				name: body.name,
 				scopes: body.scopes,
 				expiresInDays: body.expiresInDays
-			});
+			}, holder.roles);
 			return await this.renderJson(created, 201);
 		} catch (e) {
 			return this.#renderApiKeyError(e);
@@ -86,10 +86,18 @@ var ApiKeyController = class extends SecurityApiController {
 	}
 	/** Identifiant du porteur courant (session BFF revalidée), ou `null` si non authentifié. */
 	async #currentSubject() {
+		return (await this.#currentHolder())?.identifier ?? null;
+	}
+	async #currentHolder() {
 		const flow = this.#flow();
 		if (!flow) return null;
 		const me = await flow.me(this.context);
-		return me && typeof me.identifier === "string" ? me.identifier : null;
+		if (!me || typeof me.identifier !== "string") return null;
+		const roles = Array.isArray(me.roles) ? me.roles.filter((r) => typeof r === "string") : [];
+		return {
+			identifier: me.identifier,
+			roles
+		};
 	}
 	#renderApiKeyError(e) {
 		const code = e.code;
@@ -97,6 +105,7 @@ var ApiKeyController = class extends SecurityApiController {
 			const message = e.message;
 			return this.renderJson({ error: typeof message === "string" ? message : "Bad request" }, 400);
 		}
+		if (code === 403) return this.renderJson({ error: e instanceof Error ? e.message : "Forbidden" }, 403);
 		if (code === 409) return this.renderJson({ error: "API key limit reached" }, 409);
 		if (code === 503) return this.renderJson({ error: "API keys unavailable" }, 503);
 		throw e;
@@ -149,5 +158,4 @@ function mountApiKeyRoutes(frameworkModule) {
 	if (!Object.prototype.hasOwnProperty.call(ApiKeyController.prototype, "module")) router_default.setController(ApiKeyController, frameworkModule);
 	mounted = true;
 }
-//#endregion
 export { ApiKeyController as default, mountApiKeyRoutes };

package/dist/nodefony/controller/BenchController.js

@@ -1,6 +1,6 @@
 import Controller from "../src/Controller.js";
 import router_default from "../service/router.js";
-//#region nodefony/controller/BenchController.ts
+// nodefony/controller/BenchController.ts
 /**
 * Corps servi par la cible de banc — **gelé et partagé** : ce qu'on chronomètre
 * est le pipeline, pas la construction d'un objet. Le figer évite qu'une
@@ -128,5 +128,4 @@ function mountBenchRoutes(frameworkModule) {
 	if (!Object.prototype.hasOwnProperty.call(BenchController.prototype, "module")) router_default.setController(BenchController, frameworkModule);
 	mounted = true;
 }
-//#endregion
 export { BenchController as default, mountBenchRoutes };

package/dist/nodefony/controller/IssuerMetadataController.js

@@ -2,7 +2,7 @@ import Controller from "../src/Controller.js";
 import router_default from "../service/router.js";
 import { askedAuthority, onDeclaredAuthority } from "./oauthAuthority.js";
 import { JWKS_PATH, authorizationServerMetadataPath, buildAuthorizationServerMetadata } from "nodefony";
-//#region nodefony/controller/IssuerMetadataController.ts
+// nodefony/controller/IssuerMetadataController.ts
 let mounted = false;
 /**
 * Les deux documents qui rendent une application Nodefony **découvrable** comme
@@ -144,5 +144,4 @@ function mountIssuerMetadataRoutes(frameworkModule, issuer) {
 	if (!Object.prototype.hasOwnProperty.call(IssuerMetadataController.prototype, "module")) router_default.setController(IssuerMetadataController, frameworkModule);
 	mounted = true;
 }
-//#endregion
 export { IssuerMetadataController as default, mountIssuerMetadataRoutes };

package/dist/nodefony/controller/LoginPageController.js

@@ -1,8 +1,7 @@
 import { isDevelopment } from "../src/singletonGuard.js";
 import Controller from "../src/Controller.js";
 import { Csp } from "../decorators/routerDecorators.js";
-import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorateMetadata.js";
-import __decorate from "../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorate.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
 import router_default from "../service/router.js";
 import { LOGIN_PAGE_ASSET_FILES, LOGIN_PAGE_TEMPLATE, buildLoginPageView, keepSuccess } from "../src/loginPage.js";
 import path from "node:path";
@@ -11,7 +10,7 @@ import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { Eta } from "eta";
-//#region nodefony/controller/LoginPageController.ts
+// nodefony/controller/LoginPageController.ts
 const NO_STORE = { "cache-control": "no-store" };
 let mounted = false;
 let engine = null;
@@ -69,7 +68,7 @@ var LoginPageController = class extends Controller {
 	async page() {
 		const page = this.get("authFlow")?.describeLoginPage?.() ?? null;
 		if (page === null) return this.renderJson({ error: "Not Found" }, 404, NO_STORE);
-		const query = this.queryGet;
+		const query = this.query;
 		const view = buildLoginPageView(page, {
 			from: query?.from,
 			reason: query?.reason,
@@ -88,12 +87,7 @@ var LoginPageController = class extends Controller {
 		});
 	}
 };
-__decorate([
-	Csp({ "frame-ancestors": ["'none'"] }),
-	__decorateMetadata("design:type", Function),
-	__decorateMetadata("design:paramtypes", []),
-	__decorateMetadata("design:returntype", Promise)
-], LoginPageController.prototype, "page", null);
+__decorate([Csp({ "frame-ancestors": ["'none'"] })], LoginPageController.prototype, "page", null);
 /**
 * Monte la page de connexion par défaut quand security la décrit : la route
 * sur `loginPage.path`, et ses fichiers sous `LOGIN_PAGE_ASSETS_BASE`.
@@ -120,5 +114,4 @@ function mountLoginPage(frameworkModule) {
 	if (!Object.prototype.hasOwnProperty.call(LoginPageController.prototype, "module")) router_default.setController(LoginPageController, frameworkModule);
 	mounted = true;
 }
-//#endregion
 export { LoginPageController as default, mountLoginPage };

package/dist/nodefony/controller/OAuth2Controller.js

@@ -1,7 +1,7 @@
 import router_default from "../service/router.js";
 import SecurityApiController from "../src/SecurityApiController.js";
 import { OAUTH2_API_BASE, OAUTH2_FAILED_REASON, safeRedirectPath } from "nodefony";
-//#region nodefony/controller/OAuth2Controller.ts
+// nodefony/controller/OAuth2Controller.ts
 const STATE_KEY = "oauth2:state";
 const VERIFIER_KEY = "oauth2:verifier";
 const PROVIDER_KEY = "oauth2:provider";
@@ -191,7 +191,7 @@ var OAuth2Controller = class extends SecurityApiController {
 		const svc = this.#service();
 		if (!svc || !svc.listProviders().includes(provider)) return this.renderJson({ error: "Unknown provider" }, 404, noStore);
 		if (!svc.backchannelLogout) return this.renderJson({ error: "Not implemented" }, 501, noStore);
-		const token = this.queryPost?.logout_token;
+		const token = this.body?.logout_token;
 		if (typeof token !== "string" || token.length === 0) return this.renderJson({ error: "invalid_request" }, 400, noStore);
 		let outcome;
 		try {
@@ -220,7 +220,7 @@ var OAuth2Controller = class extends SecurityApiController {
 	}
 	/** Lit un paramètre de query string (GET), ou `null`. */
 	#queryString(key) {
-		const v = this.queryGet?.[key];
+		const v = this.query?.[key];
 		return typeof v === "string" && v.length > 0 ? v : null;
 	}
 };
@@ -267,5 +267,4 @@ function mountOAuth2Routes(frameworkModule) {
 	if (!Object.prototype.hasOwnProperty.call(OAuth2Controller.prototype, "module")) router_default.setController(OAuth2Controller, frameworkModule);
 	mounted = true;
 }
-//#endregion
 export { OAuth2Controller as default, mountOAuth2Routes, oauth2FailureTarget, providerThemeOption };

package/dist/nodefony/controller/ProtectedResourceMetadataController.js

@@ -2,7 +2,7 @@ import Controller from "../src/Controller.js";
 import router_default from "../service/router.js";
 import { askedAuthority, onDeclaredAuthority } from "./oauthAuthority.js";
 import { buildProtectedResourceMetadata, canonicalResourceUri, protectedResourceMetadataPath } from "nodefony";
-//#region nodefony/controller/ProtectedResourceMetadataController.ts
+// nodefony/controller/ProtectedResourceMetadataController.ts
 let mounted = false;
 /**
 * Ce qui a été PUBLIÉ au montage — la même liste qui a décidé des chemins.
@@ -217,5 +217,4 @@ function mountProtectedResourceRoutes(frameworkModule, resources) {
 	mounted = true;
 	return paths.length;
 }
-//#endregion
 export { collectProtectedResources, ProtectedResourceMetadataController as default, mountProtectedResourceRoutes, protectedResourceRoutePaths };

package/dist/nodefony/controller/SessionAuthController.js

@@ -1,7 +1,9 @@
+import { CsrfProtect } from "../decorators/routerDecorators.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.155.0/helpers/esm/decorate.js";
 import router_default from "../service/router.js";
 import SecurityApiController from "../src/SecurityApiController.js";
 import { AUTH_API_BASE } from "nodefony";
-//#region nodefony/controller/SessionAuthController.ts
+// nodefony/controller/SessionAuthController.ts
 let mounted = false;
 /**
 * Endpoints HTTP du flux de session BFF — adaptateurs MINCES au-dessus du
@@ -42,7 +44,7 @@ var SessionAuthController = class extends SecurityApiController {
 	async login() {
 		const flow = this.#flow();
 		if (!flow) return this.renderJson({ error: "Authentication unavailable" }, 503);
-		const body = this.queryPost ?? {};
+		const body = this.body ?? {};
 		try {
 			const outcome = await flow.login(this.context, body.username, body.password);
 			if (outcome.status === "mfa_required") return await this.renderJson({
@@ -62,7 +64,7 @@ var SessionAuthController = class extends SecurityApiController {
 	async loginTotp() {
 		const flow = this.#flow();
 		if (!flow) return this.renderJson({ error: "Authentication unavailable" }, 503);
-		const body = this.queryPost ?? {};
+		const body = this.body ?? {};
 		try {
 			const user = await flow.completeMfaLogin(this.context, body.code);
 			return await this.renderJson({ user });
@@ -94,6 +96,13 @@ var SessionAuthController = class extends SecurityApiController {
 	* Identité de la session courante, re-résolue (rôles frais). Toujours `200` :
 	* `{ user: null }` quand il n'y a pas de session (ou qu'elle ne mène plus à
 	* un compte actif) — l'absence de session est un état, pas une erreur.
+	*
+	* **Sème aussi le jeton anti-CSRF** (cookie lisible `csrf-token`) : c'est la
+	* seule requête sûre que TOUT client connaît d'avance. Sans elle, une mutation
+	* `@CsrfProtect` n'a de jeton à rejouer que si son auteur a AUSSI décoré une
+	* lecture — protéger les seules écritures, le geste naturel, rendait alors 403
+	* sans issue, au navigateur comme aux tests générés. Le jeton est sans état
+	* (HMAC) : celui-ci vaut pour toute route protégée.
 	*/
 	async me() {
 		const flow = this.#flow();
@@ -118,6 +127,7 @@ var SessionAuthController = class extends SecurityApiController {
 		throw e;
 	}
 };
+__decorate([CsrfProtect()], SessionAuthController.prototype, "me", null);
 /**
 * Monte les routes du flux de session BFF — appelé par le module framework à
 * `onKernelReady`, seulement si le service `authFlow` est présent.
@@ -165,5 +175,4 @@ function mountSessionAuthRoutes(frameworkModule) {
 	if (!Object.prototype.hasOwnProperty.call(SessionAuthController.prototype, "module")) router_default.setController(SessionAuthController, frameworkModule);
 	mounted = true;
 }
-//#endregion
 export { SessionAuthController as default, mountSessionAuthRoutes };

package/dist/nodefony/controller/TokenAuthController.js

@@ -1,6 +1,6 @@
 import router_default from "../service/router.js";
 import SecurityApiController from "../src/SecurityApiController.js";
-//#region nodefony/controller/TokenAuthController.ts
+// nodefony/controller/TokenAuthController.ts
 let mounted = false;
 /** Normalise le paramètre `scope` (string OAuth « a b c » ou tableau) → string[]. */
 function parseScope(scope) {
@@ -36,7 +36,7 @@ var TokenAuthController = class extends SecurityApiController {
 	async token() {
 		const svc = this.#issuer();
 		if (!svc || !svc.isEnabled()) return this.renderJson({ error: "Token issuance unavailable" }, 503);
-		const body = this.queryPost ?? {};
+		const body = this.body ?? {};
 		try {
 			const tokens = await svc.issueForCredentials(body.username, body.password, parseScope(body.scope), body.resource, this.context);
 			return await this.renderJson(tokens);
@@ -48,7 +48,7 @@ var TokenAuthController = class extends SecurityApiController {
 	async refresh() {
 		const svc = this.#issuer();
 		if (!svc || !svc.isEnabled()) return this.renderJson({ error: "Token issuance unavailable" }, 503);
-		const body = this.queryPost ?? {};
+		const body = this.body ?? {};
 		try {
 			const tokens = await svc.refresh(body.refresh_token, body.resource);
 			return await this.renderJson(tokens);
@@ -116,5 +116,4 @@ function mountTokenAuthRoutes(frameworkModule) {
 	if (!Object.prototype.hasOwnProperty.call(TokenAuthController.prototype, "module")) router_default.setController(TokenAuthController, frameworkModule);
 	mounted = true;
 }
-//#endregion
 export { TokenAuthController as default, mountTokenAuthRoutes };

package/dist/nodefony/controller/TotpController.js

@@ -1,6 +1,6 @@
 import router_default from "../service/router.js";
 import SecurityApiController from "../src/SecurityApiController.js";
-//#region nodefony/controller/TotpController.ts
+// nodefony/controller/TotpController.ts
 let mounted = false;
 /**
 * Endpoints HTTP **self-service 2FA TOTP (P6.17)** — console « ma sécurité »,
@@ -39,7 +39,7 @@ var TotpController = class extends SecurityApiController {
 		if (!svc) return this.renderJson({ error: "2FA unavailable" }, 503);
 		const subject = await this.#currentSubject();
 		if (subject === null) return this.renderJson({ error: "Unauthorized" }, 401);
-		const code = this.queryPost?.code;
+		const code = this.body?.code;
 		if (typeof code !== "string" || code.length === 0) return this.renderJson({ error: "Invalid code" }, 400);
 		let activation;
 		try {
@@ -128,5 +128,4 @@ function mountTotpRoutes(frameworkModule) {
 	if (!Object.prototype.hasOwnProperty.call(TotpController.prototype, "module")) router_default.setController(TotpController, frameworkModule);
 	mounted = true;
 }
-//#endregion
 export { TotpController as default, mountTotpRoutes };

package/dist/nodefony/controller/WebAuthnController.js

@@ -1,7 +1,7 @@
 import router_default from "../service/router.js";
 import SecurityApiController from "../src/SecurityApiController.js";
 import { WEBAUTHN_API_BASE, WEBAUTHN_STATUS_PATH } from "nodefony";
-//#region nodefony/controller/WebAuthnController.ts
+// nodefony/controller/WebAuthnController.ts
 const REG_CHALLENGE = "webauthn:reg:challenge";
 const AUTH_CHALLENGE = "webauthn:auth:challenge";
 let mounted = false;
@@ -164,7 +164,7 @@ var WebAuthnController = class extends SecurityApiController {
 	* cérémonie est découvrable (cf {@link WebAuthnController.loginOptions}).
 	*/
 	#body() {
-		return this.queryPost ?? {};
+		return this.body ?? {};
 	}
 	/** Origine HTTP de la requête (validée par le service contre le rpID). */
 	#origin() {
@@ -255,5 +255,4 @@ function mountWebAuthnRoutes(frameworkModule) {
 	if (!Object.prototype.hasOwnProperty.call(WebAuthnController.prototype, "module")) router_default.setController(WebAuthnController, frameworkModule);
 	mounted = true;
 }
-//#endregion
 export { WebAuthnController as default, mountWebAuthnRoutes };

package/dist/nodefony/controller/oauthAuthority.js

@@ -1,4 +1,4 @@
-//#region nodefony/controller/oauthAuthority.ts
+// nodefony/controller/oauthAuthority.ts
 /**
 * Une seule règle : un document bien connu ne se sert QUE sur l'autorité dont
 * il se réclame.
@@ -70,5 +70,4 @@ function askedAuthority(headers) {
 	const asked = Array.isArray(raw) ? raw[0] : raw;
 	return typeof asked === "string" && asked.length > 0 ? asked : void 0;
 }
-//#endregion
 export { askedAuthority, onDeclaredAuthority };