@objectstack/runtime 11.0.0 → 11.1.0

package/dist/index.d.cts

@@ -918,12 +918,16 @@ interface HttpDispatcherOptions {
     scopeManager?: EnvironmentScopeManager;
 }
 /**
- * @deprecated Use `createDispatcherPlugin()` from `@objectstack/runtime` instead.
- * This class will be removed in v2. Prefer the plugin-based approach:
- * ```ts
- * import { createDispatcherPlugin } from '@objectstack/runtime';
- * kernel.use(createDispatcherPlugin({ prefix: '/api/v1' }));
- * ```
+ * The HTTP dispatch engine — translates an inbound (method, path, body, ctx)
+ * request into a kernel response. Used directly by the framework's HTTP adapters
+ * (express / fastify / nextjs / nestjs / nuxt / sveltekit / hono) and plugin-msw,
+ * which need a *callable* dispatcher.
+ *
+ * NOTE: `createDispatcherPlugin()` is a different thing — a kernel plugin that
+ * registers routes on a kernel-hosted HTTP server. It is NOT a drop-in for
+ * adapters. Retiring this public class behind a `createHttpDispatcher()` factory
+ * is tracked in #2380 (a deliberate adapter-API change, not yet done) — so this
+ * is intentionally NOT marked `@deprecated` while no working replacement exists.
  */
 declare class HttpDispatcher {
     private kernel;
@@ -1120,6 +1124,13 @@ declare class HttpDispatcher {
      * response object that callers should surface directly — no further
      * dispatch happens.
      */
+    /**
+     * ADR-0069 — returns a 403 response when the resolved session is blocked by
+     * an auth-policy gate (expired password / required MFA) on a non-allow-listed
+     * path, else null. Mirrors the REST `enforceAuth` seam so REST + dispatcher
+     * (MCP, GraphQL) enforce consistently. Fails open on any lookup error.
+     */
+    private enforceAuthGate;
     private enforceProjectMembership;
     /**
      * Generates the discovery JSON response for the API root.

package/dist/index.d.ts

@@ -918,12 +918,16 @@ interface HttpDispatcherOptions {
     scopeManager?: EnvironmentScopeManager;
 }
 /**
- * @deprecated Use `createDispatcherPlugin()` from `@objectstack/runtime` instead.
- * This class will be removed in v2. Prefer the plugin-based approach:
- * ```ts
- * import { createDispatcherPlugin } from '@objectstack/runtime';
- * kernel.use(createDispatcherPlugin({ prefix: '/api/v1' }));
- * ```
+ * The HTTP dispatch engine — translates an inbound (method, path, body, ctx)
+ * request into a kernel response. Used directly by the framework's HTTP adapters
+ * (express / fastify / nextjs / nestjs / nuxt / sveltekit / hono) and plugin-msw,
+ * which need a *callable* dispatcher.
+ *
+ * NOTE: `createDispatcherPlugin()` is a different thing — a kernel plugin that
+ * registers routes on a kernel-hosted HTTP server. It is NOT a drop-in for
+ * adapters. Retiring this public class behind a `createHttpDispatcher()` factory
+ * is tracked in #2380 (a deliberate adapter-API change, not yet done) — so this
+ * is intentionally NOT marked `@deprecated` while no working replacement exists.
  */
 declare class HttpDispatcher {
     private kernel;
@@ -1120,6 +1124,13 @@ declare class HttpDispatcher {
      * response object that callers should surface directly — no further
      * dispatch happens.
      */
+    /**
+     * ADR-0069 — returns a 403 response when the resolved session is blocked by
+     * an auth-policy gate (expired password / required MFA) on a non-allow-listed
+     * path, else null. Mirrors the REST `enforceAuth` seam so REST + dispatcher
+     * (MCP, GraphQL) enforce consistently. Fails open on any lookup error.
+     */
+    private enforceAuthGate;
     private enforceProjectMembership;
     /**
      * Generates the discovery JSON response for the API root.

package/dist/index.js

@@ -1556,7 +1556,7 @@ async function createStandaloneStack(config) {
   const environmentId = cfg.environmentId ?? process.env.OS_ENVIRONMENT_ID ?? "proj_local";
   const artifactPathInput = cfg.artifactPath ?? process.env.OS_ARTIFACT_PATH ?? resolvePath2(cwd, "dist/objectstack.json");
   const artifactPath = isHttpUrl(artifactPathInput) ? artifactPathInput : artifactPathInput.startsWith("/") ? artifactPathInput : resolvePath2(cwd, artifactPathInput);
-  const dbUrl = cfg.databaseUrl ?? readEnvWithDeprecation("OS_DATABASE_URL", "DATABASE_URL")?.trim() ?? process.env.TURSO_DATABASE_URL?.trim() ?? (process.env.OS_HOME?.trim() ? `file:${resolvePath2(resolveObjectStackHome(), "data/standalone.db")}` : cfg.projectRoot ? `file:${resolvePath2(cfg.projectRoot, ".objectstack/data/standalone.db")}` : `file:${resolvePath2(resolveObjectStackHome(), "data/standalone.db")}`);
+  const dbUrl = cfg.databaseUrl ?? readEnvWithDeprecation("OS_DATABASE_URL", "DATABASE_URL", { silent: true })?.trim() ?? process.env.TURSO_DATABASE_URL?.trim() ?? (process.env.OS_HOME?.trim() ? `file:${resolvePath2(resolveObjectStackHome(), "data/standalone.db")}` : cfg.projectRoot ? `file:${resolvePath2(cfg.projectRoot, ".objectstack/data/standalone.db")}` : `file:${resolvePath2(resolveObjectStackHome(), "data/standalone.db")}`);
   const explicitDriver = cfg.databaseDriver ?? process.env.OS_DATABASE_DRIVER?.trim();
   const dbDriver = explicitDriver ?? detectDriverFromUrl(dbUrl);
   let driverPlugin;
@@ -1975,7 +1975,7 @@ function safeGet(ctx, name) {
 
 // src/http-dispatcher.ts
 init_package_state_store();
-import { getEnv, resolveLocale } from "@objectstack/core";
+import { getEnv, resolveLocale, evaluateAuthGate, isAuthGateAllowlisted } from "@objectstack/core";
 import { CoreServiceName } from "@objectstack/spec/system";
 import { pluralToSingular, PLURAL_TO_SINGULAR } from "@objectstack/spec/shared";
 
@@ -2844,6 +2844,43 @@ var _HttpDispatcher = class _HttpDispatcher {
    * response object that callers should surface directly — no further
    * dispatch happens.
    */
+  /**
+   * ADR-0069 — returns a 403 response when the resolved session is blocked by
+   * an auth-policy gate (expired password / required MFA) on a non-allow-listed
+   * path, else null. Mirrors the REST `enforceAuth` seam so REST + dispatcher
+   * (MCP, GraphQL) enforce consistently. Fails open on any lookup error.
+   */
+  async enforceAuthGate(context, cleanPath) {
+    try {
+      if (isAuthGateAllowlisted(cleanPath)) return null;
+      const authService = await this.resolveService("auth", context.environmentId);
+      if (!authService || typeof authService.isAuthGateActive !== "function" || !authService.isAuthGateActive()) {
+        return null;
+      }
+      let api = authService.api;
+      if (!api && typeof authService.getApi === "function") api = await authService.getApi();
+      if (!api?.getSession) return null;
+      const raw = context?.request?.headers;
+      let headers;
+      if (raw && typeof raw.get === "function") {
+        headers = raw;
+      } else if (raw && typeof raw === "object") {
+        headers = new globalThis.Headers();
+        for (const k of Object.keys(raw)) {
+          const v = raw[k];
+          if (v != null) headers.set(String(k), Array.isArray(v) ? v.join(",") : String(v));
+        }
+      } else {
+        return null;
+      }
+      const session = await api.getSession({ headers }).catch(() => void 0);
+      const gate = evaluateAuthGate(session?.user, cleanPath);
+      if (!gate) return null;
+      return this.error(gate.message, 403, { code: gate.code });
+    } catch {
+      return null;
+    }
+  }
   async enforceProjectMembership(context, path) {
     if (!this.enforceMembership) return null;
     const skipPaths = ["/auth", "/cloud", "/health", "/ready", "/discovery"];
@@ -4763,6 +4800,10 @@ var _HttpDispatcher = class _HttpDispatcher {
       });
     } catch {
     }
+    const authGated = await this.enforceAuthGate(context, cleanPath);
+    if (authGated) {
+      return { handled: true, response: authGated };
+    }
     const forbidden = await this.enforceProjectMembership(context, cleanPath);
     if (forbidden) {
       return { handled: true, response: forbidden };