@objectstack/runtime 11.0.0 → 11.1.0

package/README.md

@@ -134,7 +134,7 @@ new AppPlugin(appConfig)
 
 #### IHttpServer
 
-Abstract interface for HTTP server capabilities. Allows plugins to work with any HTTP framework (Express, Fastify, Hono, etc.) without tight coupling.
+Abstract interface for HTTP server capabilities. Allows plugins to work with any HTTP framework (e.g. Hono) without tight coupling.
 
 ```typescript
 import { IHttpServer, IHttpRequest, IHttpResponse } from '@objectstack/runtime';
@@ -144,7 +144,7 @@ class MyHttpServerPlugin implements Plugin {
   name = 'http-server';
   
   async init(ctx: PluginContext) {
-    const server: IHttpServer = createMyServer(); // Express, Hono, etc.
+    const server: IHttpServer = createMyServer(); // Hono, or any framework via IHttpServer
     ctx.registerService('http-server', server);
   }
 }
@@ -599,7 +599,7 @@ createDispatcherPlugin({
 
 Token-bucket `RateLimiter` with pluggable `RateLimitStore` (in-memory default,
 Redis-friendly contract). Curated `DEFAULT_RATE_LIMITS` for auth / write / read
-buckets. Fastify / Hono / Express recipes in
+buckets. A Hono recipe in
 [`docs/HARDENING.md`](../../docs/HARDENING.md#rate-limiting).
 
 ```ts

package/dist/index.cjs

@@ -1575,7 +1575,7 @@ async function createStandaloneStack(config) {
   const environmentId = cfg.environmentId ?? process.env.OS_ENVIRONMENT_ID ?? "proj_local";
   const artifactPathInput = cfg.artifactPath ?? process.env.OS_ARTIFACT_PATH ?? (0, import_node_path3.resolve)(cwd, "dist/objectstack.json");
   const artifactPath = isHttpUrl(artifactPathInput) ? artifactPathInput : artifactPathInput.startsWith("/") ? artifactPathInput : (0, import_node_path3.resolve)(cwd, artifactPathInput);
-  const dbUrl = cfg.databaseUrl ?? (0, import_types2.readEnvWithDeprecation)("OS_DATABASE_URL", "DATABASE_URL")?.trim() ?? process.env.TURSO_DATABASE_URL?.trim() ?? (process.env.OS_HOME?.trim() ? `file:${(0, import_node_path3.resolve)(resolveObjectStackHome(), "data/standalone.db")}` : cfg.projectRoot ? `file:${(0, import_node_path3.resolve)(cfg.projectRoot, ".objectstack/data/standalone.db")}` : `file:${(0, import_node_path3.resolve)(resolveObjectStackHome(), "data/standalone.db")}`);
+  const dbUrl = cfg.databaseUrl ?? (0, import_types2.readEnvWithDeprecation)("OS_DATABASE_URL", "DATABASE_URL", { silent: true })?.trim() ?? process.env.TURSO_DATABASE_URL?.trim() ?? (process.env.OS_HOME?.trim() ? `file:${(0, import_node_path3.resolve)(resolveObjectStackHome(), "data/standalone.db")}` : cfg.projectRoot ? `file:${(0, import_node_path3.resolve)(cfg.projectRoot, ".objectstack/data/standalone.db")}` : `file:${(0, import_node_path3.resolve)(resolveObjectStackHome(), "data/standalone.db")}`);
   const explicitDriver = cfg.databaseDriver ?? process.env.OS_DATABASE_DRIVER?.trim();
   const dbDriver = explicitDriver ?? detectDriverFromUrl(dbUrl);
   let driverPlugin;
@@ -2909,6 +2909,43 @@ var _HttpDispatcher = class _HttpDispatcher {
    * response object that callers should surface directly — no further
    * dispatch happens.
    */
+  /**
+   * ADR-0069 — returns a 403 response when the resolved session is blocked by
+   * an auth-policy gate (expired password / required MFA) on a non-allow-listed
+   * path, else null. Mirrors the REST `enforceAuth` seam so REST + dispatcher
+   * (MCP, GraphQL) enforce consistently. Fails open on any lookup error.
+   */
+  async enforceAuthGate(context, cleanPath) {
+    try {
+      if ((0, import_core4.isAuthGateAllowlisted)(cleanPath)) return null;
+      const authService = await this.resolveService("auth", context.environmentId);
+      if (!authService || typeof authService.isAuthGateActive !== "function" || !authService.isAuthGateActive()) {
+        return null;
+      }
+      let api = authService.api;
+      if (!api && typeof authService.getApi === "function") api = await authService.getApi();
+      if (!api?.getSession) return null;
+      const raw = context?.request?.headers;
+      let headers;
+      if (raw && typeof raw.get === "function") {
+        headers = raw;
+      } else if (raw && typeof raw === "object") {
+        headers = new globalThis.Headers();
+        for (const k of Object.keys(raw)) {
+          const v = raw[k];
+          if (v != null) headers.set(String(k), Array.isArray(v) ? v.join(",") : String(v));
+        }
+      } else {
+        return null;
+      }
+      const session = await api.getSession({ headers }).catch(() => void 0);
+      const gate = (0, import_core4.evaluateAuthGate)(session?.user, cleanPath);
+      if (!gate) return null;
+      return this.error(gate.message, 403, { code: gate.code });
+    } catch {
+      return null;
+    }
+  }
   async enforceProjectMembership(context, path) {
     if (!this.enforceMembership) return null;
     const skipPaths = ["/auth", "/cloud", "/health", "/ready", "/discovery"];
@@ -4828,6 +4865,10 @@ var _HttpDispatcher = class _HttpDispatcher {
       });
     } catch {
     }
+    const authGated = await this.enforceAuthGate(context, cleanPath);
+    if (authGated) {
+      return { handled: true, response: authGated };
+    }
     const forbidden = await this.enforceProjectMembership(context, cleanPath);
     if (forbidden) {
       return { handled: true, response: forbidden };