@nwire/koa 0.12.0 → 0.12.1

package/dist/http-koa.js

@@ -35,6 +35,24 @@ import bodyParser from "koa-bodyparser";
 import cors from "@koa/cors";
 import helmet from "koa-helmet";
 import KoaRouter from "@koa/router";
+/** Zod throws a `ZodError` (name + `issues[]`) on a failed `.parse()`. */
+function isZodError(e) {
+    return (typeof e === "object" &&
+        e !== null &&
+        e.name === "ZodError" &&
+        Array.isArray(e.issues));
+}
+/**
+ * A human-readable summary of the first validation issue. Safe to expose:
+ * it describes the caller's own input, not internal state.
+ */
+function zodSummary(e) {
+    const first = e.issues[0];
+    if (!first)
+        return "validation failed";
+    const path = (first.path ?? []).join(".") || "(body)";
+    return `${path}: ${first.message}`;
+}
 function isHttpBinding(b) {
     return (typeof b === "object" &&
         b !== null &&
@@ -77,6 +95,15 @@ export function httpKoa(config = {}) {
                 catch (err) {
                     const e = err;
                     const isNwireError = e?.$kind === "error";
+                    if (isZodError(err)) {
+                        // A schema `.parse()` that escaped the per-route catch (e.g. an
+                        // action's own input schema). Validation failures are the
+                        // caller's fault → 400 with a readable summary, never an opaque
+                        // 500. The message is about their input, so it's safe to expose.
+                        kctx.status = 400;
+                        kctx.body = { error: { code: "validation_failed", summary: zodSummary(err) } };
+                        return;
+                    }
                     kctx.status = typeof e.status === "number" ? e.status : 500;
                     if (isNwireError) {
                         kctx.body = {
@@ -249,7 +276,7 @@ export function httpKoa(config = {}) {
                         kctx.body = {
                             error: {
                                 code: "validation_failed",
-                                summary: err.message,
+                                summary: isZodError(err) ? zodSummary(err) : err.message,
                             },
                         };
                         return;
@@ -274,7 +301,12 @@ export function httpKoa(config = {}) {
                             : (kc.request.headers["x-tenant"] ?? undefined));
                     const envelopePartial = {
                         tenant: resolveTenant(kctx),
-                        userId: kctx.state.userId ?? undefined,
+                        // Prefer an explicit `state.userId`, but fall back to the
+                        // user object's id so handlers reading `envelope.userId` work
+                        // whenever auth middleware populated `state.user`.
+                        userId: kctx.state.userId ??
+                            kctx.state.user?.id ??
+                            undefined,
                         // Pass the full user object through when adopter auth middleware
                         // populated it. Without this, transport-agnostic RBAC has to
                         // reach into `ctx.koa.state.user` and couples the handler to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nwire/koa",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Nwire — Koa-backed HTTP adopter. Consumes wires from @nwire/wires/http and serves them as Koa routes under endpoint lifecycle.",
   "keywords": [
     "adopter",
@@ -33,10 +33,10 @@
     "koa-bodyparser": "^4.4.1",
     "koa-helmet": "^8.0.1",
     "zod": "^4.0.0",
-    "@nwire/container": "0.12.0",
-    "@nwire/endpoint": "0.12.0",
-    "@nwire/logger": "0.12.0",
-    "@nwire/wires": "0.12.0"
+    "@nwire/endpoint": "0.12.1",
+    "@nwire/wires": "0.12.1",
+    "@nwire/logger": "0.12.1",
+    "@nwire/container": "0.12.1"
   },
   "devDependencies": {
     "@asteasolutions/zod-to-openapi": "^8.0.0",
@@ -47,8 +47,8 @@
     "@types/node": "^22.19.9",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18",
-    "@nwire/app": "0.12.0",
-    "@nwire/handler": "0.12.0"
+    "@nwire/app": "0.12.1",
+    "@nwire/handler": "0.12.1"
   },
   "peerDependencies": {
     "@asteasolutions/zod-to-openapi": "^8.0.0"