@pikku/core 0.11.2 → 0.12.0

package/src/middleware/auth-apikey.test.ts

@@ -3,7 +3,10 @@ import assert from 'node:assert/strict'
 import { authAPIKey } from './auth-apikey.js'
 import { resetPikkuState } from '../pikku-state.js'
 import { CoreUserSession } from '../types/core.types.js'
-import { PikkuSessionService } from '../services/user-session-service.js'
+import {
+  PikkuSessionService,
+  createMiddlewareSessionWireProps,
+} from '../services/user-session-service.js'
 
 beforeEach(() => {
   resetPikkuState()
@@ -43,7 +46,7 @@ describe('authAPIKey middleware', () => {
           request: createMockHTTPRequest({ 'x-api-key': 'my-api-key' }),
           response: createMockHTTPResponse(),
         },
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
       } as any,
       async () => {
         nextCalled = true
@@ -75,7 +78,7 @@ describe('authAPIKey middleware', () => {
           request: createMockHTTPRequest({}, { apiKey: 'query-api-key' }),
           response: createMockHTTPResponse(),
         },
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
       } as any,
       async () => {
         nextCalled = true
@@ -111,7 +114,7 @@ describe('authAPIKey middleware', () => {
           ),
           response: createMockHTTPResponse(),
         },
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
       } as any,
       async () => {
         nextCalled = true
@@ -143,7 +146,7 @@ describe('authAPIKey middleware', () => {
           request: createMockHTTPRequest({}, { apiKey: 'query-fallback' }),
           response: createMockHTTPResponse(),
         },
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
       } as any,
       async () => {
         nextCalled = true
@@ -171,7 +174,7 @@ describe('authAPIKey middleware', () => {
           request: createMockHTTPRequest({}),
           response: createMockHTTPResponse(),
         },
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
       } as any,
       async () => {
         nextCalled = true
@@ -199,7 +202,7 @@ describe('authAPIKey middleware', () => {
           request: createMockHTTPRequest({ 'x-api-key': 'invalid-key' }),
           response: createMockHTTPResponse(),
         },
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
       } as any,
       async () => {
         nextCalled = true
@@ -234,7 +237,7 @@ describe('authAPIKey middleware', () => {
           request: createMockHTTPRequest({ 'x-api-key': 'some-key' }),
           response: createMockHTTPResponse(),
         },
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
       } as any,
       async () => {
         nextCalled = true
@@ -258,7 +261,7 @@ describe('authAPIKey middleware', () => {
 
     await middleware(
       { jwt: jwtService } as any,
-      { session: SessionService } as any,
+      { ...createMiddlewareSessionWireProps(SessionService) } as any,
       async () => {
         nextCalled = true
       }
@@ -281,7 +284,7 @@ describe('authAPIKey middleware', () => {
           request: createMockHTTPRequest({ 'x-api-key': 'some-key' }),
           response: createMockHTTPResponse(),
         },
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
       } as any,
       async () => {
         nextCalled = true
@@ -313,7 +316,7 @@ describe('authAPIKey middleware', () => {
           request: createMockHTTPRequest({}, { apiKey: 'query-key' }),
           response: createMockHTTPResponse(),
         },
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
       } as any,
       async () => {
         nextCalled = true
@@ -346,7 +349,7 @@ describe('authAPIKey middleware', () => {
           request: createMockHTTPRequest({ 'x-api-key': 'header-key' }),
           response: createMockHTTPResponse(),
         },
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
       } as any,
       async () => {
         nextCalled = true

package/src/middleware/auth-apikey.ts

@@ -21,8 +21,8 @@ export const authAPIKey = pikkuMiddlewareFactory<{
   source: 'header' | 'query' | 'all'
 }>(({ source }) =>
   pikkuMiddleware(
-    async ({ jwt: jwtService }, { http, session: SessionService }, next) => {
-      if (!http?.request || !SessionService || SessionService.get()) {
+    async ({ jwt: jwtService }, { http, setSession, session }, next) => {
+      if (!http?.request || !setSession || session) {
         return next()
       }
 
@@ -37,7 +37,7 @@ export const authAPIKey = pikkuMiddlewareFactory<{
       if (apiKey && jwtService) {
         const userSession = await jwtService.decode(apiKey)
         if (userSession) {
-          SessionService.setInitial(userSession)
+          setSession?.(userSession)
         }
       }
 

package/src/middleware/auth-bearer.test.ts

@@ -3,7 +3,10 @@ import assert from 'node:assert/strict'
 import { authBearer } from './auth-bearer.js'
 import { resetPikkuState } from '../pikku-state.js'
 import { CoreUserSession } from '../types/core.types.js'
-import { PikkuSessionService } from '../services/user-session-service.js'
+import {
+  PikkuSessionService,
+  createMiddlewareSessionWireProps,
+} from '../services/user-session-service.js'
 import { InvalidSessionError } from '../errors/errors.js'
 
 beforeEach(() => {
@@ -39,7 +42,7 @@ describe('authBearer middleware', () => {
     await middleware(
       { jwt: jwtService } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({
             authorization: 'Bearer jwt-token',
@@ -73,7 +76,7 @@ describe('authBearer middleware', () => {
     await middleware(
       { jwt: jwtService } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({
             Authorization: 'Bearer jwt-token-2',
@@ -116,7 +119,7 @@ describe('authBearer middleware', () => {
     await middleware(
       { jwt: jwtService } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({
             authorization: 'Bearer my-static-token',
@@ -147,7 +150,7 @@ describe('authBearer middleware', () => {
         await middleware(
           { jwt: jwtService } as any,
           {
-            session: SessionService,
+            ...createMiddlewareSessionWireProps(SessionService),
             http: {
               request: createMockHTTPRequest({
                 authorization: 'Basic some-token',
@@ -179,7 +182,7 @@ describe('authBearer middleware', () => {
         await middleware(
           { jwt: jwtService } as any,
           {
-            session: SessionService,
+            ...createMiddlewareSessionWireProps(SessionService),
             http: {
               request: createMockHTTPRequest({
                 authorization: 'Bearer',
@@ -211,7 +214,7 @@ describe('authBearer middleware', () => {
         await middleware(
           { jwt: jwtService } as any,
           {
-            session: SessionService,
+            ...createMiddlewareSessionWireProps(SessionService),
             http: {
               request: createMockHTTPRequest({
                 authorization: 'BearerToken',
@@ -242,7 +245,7 @@ describe('authBearer middleware', () => {
     await middleware(
       { jwt: jwtService } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({
             authorization: 'Bearer invalid-token',
@@ -282,7 +285,7 @@ describe('authBearer middleware', () => {
     await middleware(
       { jwt: jwtService } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({
             authorization: 'Bearer wrong-token',
@@ -319,7 +322,7 @@ describe('authBearer middleware', () => {
     await middleware(
       { jwt: jwtService } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({
             authorization: 'Bearer some-token',
@@ -349,7 +352,7 @@ describe('authBearer middleware', () => {
 
     await middleware(
       { jwt: jwtService } as any,
-      { session: SessionService } as any,
+      { ...createMiddlewareSessionWireProps(SessionService) } as any,
       async () => {
         nextCalled = true
       }
@@ -372,7 +375,7 @@ describe('authBearer middleware', () => {
     await middleware(
       { jwt: jwtService } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({}),
           response: createMockHTTPResponse(),
@@ -396,7 +399,7 @@ describe('authBearer middleware', () => {
     await middleware(
       { jwt: undefined } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({
             authorization: 'Bearer some-token',
@@ -428,7 +431,7 @@ describe('authBearer middleware', () => {
     await middleware(
       { jwt: undefined } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({
             authorization: 'Bearer static-token',

package/src/middleware/auth-bearer.ts

@@ -40,38 +40,36 @@ export const authBearer = pikkuMiddlewareFactory<{
     userSession: CoreUserSession
   }
 }>(({ token } = {}) =>
-  pikkuMiddleware(async ({ jwt: jwtService }, { http, session }, next) => {
-    // Skip if session already exists.
-    if (!http?.request || !session || session.get()) {
-      return next()
-    }
+  pikkuMiddleware(
+    async ({ jwt: jwtService }, { http, setSession, session }, next) => {
+      if (!http?.request || !setSession || session) {
+        return next()
+      }
 
-    const authHeader =
-      http.request.header('authorization') ||
-      http.request.header('Authorization')
+      const authHeader =
+        http.request.header('authorization') ||
+        http.request.header('Authorization')
 
-    if (authHeader) {
-      const [scheme, bearerToken] = authHeader.split(' ')
-      if (scheme !== 'Bearer' || !bearerToken) {
-        throw new InvalidSessionError()
-      }
+      if (authHeader) {
+        const [scheme, bearerToken] = authHeader.split(' ')
+        if (scheme !== 'Bearer' || !bearerToken) {
+          throw new InvalidSessionError()
+        }
 
-      let userSession: CoreUserSession | null = null
+        let userSession: CoreUserSession | null = null
 
-      // If static token provided, validate against it
-      if (token && bearerToken === token.value) {
-        userSession = token.userSession
-      }
-      // Otherwise, default to JWT decoding
-      else if (jwtService && !token) {
-        userSession = await jwtService.decode(bearerToken)
-      }
+        if (token && bearerToken === token.value) {
+          userSession = token.userSession
+        } else if (jwtService && !token) {
+          userSession = await jwtService.decode(bearerToken)
+        }
 
-      if (userSession) {
-        session.setInitial(userSession)
+        if (userSession) {
+          setSession?.(userSession)
+        }
       }
-    }
 
-    return next()
-  })
+      return next()
+    }
+  )
 )

package/src/middleware/auth-cookie.test.ts

@@ -3,7 +3,10 @@ import assert from 'node:assert/strict'
 import { authCookie } from './auth-cookie.js'
 import { resetPikkuState } from '../pikku-state.js'
 import { CoreUserSession } from '../types/core.types.js'
-import { PikkuSessionService } from '../services/user-session-service.js'
+import {
+  PikkuSessionService,
+  createMiddlewareSessionWireProps,
+} from '../services/user-session-service.js'
 
 beforeEach(() => {
   resetPikkuState()
@@ -66,7 +69,7 @@ describe('authCookie middleware', () => {
         logger: createMockLogger(),
       } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({ session: 'cookie-jwt-value' }),
           response: mockResponse,
@@ -107,7 +110,7 @@ describe('authCookie middleware', () => {
         logger: createMockLogger(),
       } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({}),
           response: mockResponse,
@@ -151,7 +154,7 @@ describe('authCookie middleware', () => {
         logger: createMockLogger(),
       } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({ session: 'existing-jwt' }),
           response: mockResponse,
@@ -192,7 +195,7 @@ describe('authCookie middleware', () => {
         logger: createMockLogger(),
       } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({}),
           response: mockResponse,
@@ -230,7 +233,7 @@ describe('authCookie middleware', () => {
         logger: createMockLogger(),
       } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({ session: 'invalid-jwt' }),
           response: mockResponse,
@@ -274,7 +277,7 @@ describe('authCookie middleware', () => {
         logger: createMockLogger(),
       } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({ session: 'some-jwt' }),
           response: mockResponse,
@@ -309,7 +312,7 @@ describe('authCookie middleware', () => {
         jwt: jwtService,
         logger: createMockLogger(),
       } as any,
-      { session: SessionService } as any,
+      { ...createMiddlewareSessionWireProps(SessionService) } as any,
       async () => {
         nextCalled = true
       }
@@ -337,7 +340,7 @@ describe('authCookie middleware', () => {
         logger: createMockLogger(),
       } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({ session: 'some-jwt' }),
           response: mockResponse,
@@ -371,7 +374,7 @@ describe('authCookie middleware', () => {
         logger: mockLogger,
       } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({}),
           response: mockResponse,
@@ -415,7 +418,7 @@ describe('authCookie middleware', () => {
         logger: createMockLogger(),
       } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({}),
           response: undefined,
@@ -456,7 +459,7 @@ describe('authCookie middleware', () => {
         logger: createMockLogger(),
       } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({
             my_custom_cookie: 'custom-cookie-value',
@@ -498,7 +501,7 @@ describe('authCookie middleware', () => {
         logger: createMockLogger(),
       } as any,
       {
-        session: SessionService,
+        ...createMiddlewareSessionWireProps(SessionService),
         http: {
           request: createMockHTTPRequest({}),
           response: mockResponse,

package/src/middleware/auth-cookie.ts

@@ -41,35 +41,33 @@ export const authCookie = pikkuMiddlewareFactory<{
   pikkuMiddleware(
     async (
       { jwt: jwtService, logger },
-      { http, session: SessionService },
+      { http, setSession, getSession, session, hasSessionChanged },
       next
     ) => {
-      if (!http?.request || !SessionService || SessionService.get()) {
+      if (!http?.request || !setSession || session) {
         return next()
       }
 
-      // Try to decode session from cookie
       const cookieValue = http.request.cookie(name)
       if (cookieValue && jwtService) {
         const userSession = await jwtService.decode(cookieValue)
         if (userSession) {
-          SessionService.setInitial(userSession)
+          setSession?.(userSession)
         }
       }
 
       await next()
 
-      // Set the cookie in the response if the session has changed
       if (!http?.response) {
         return
       }
 
-      if (SessionService.sessionChanged) {
-        const session = SessionService.get()
+      if (hasSessionChanged?.()) {
+        const currentSession = await getSession?.()
         if (jwtService) {
           http.response.cookie(
             name,
-            await jwtService.encode(expiresIn, session),
+            await jwtService.encode(expiresIn, currentSession),
             {
               ...options,
               expires: getRelativeTimeOffsetFromNow(expiresIn),

package/src/middleware/cors.ts

@@ -0,0 +1,96 @@
+import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js'
+
+/**
+ * CORS middleware that handles cross-origin requests including OPTIONS preflight.
+ *
+ * Sets appropriate CORS headers on all responses and short-circuits OPTIONS
+ * preflight requests with a 204 No Content response.
+ *
+ * @param options.origin - Allowed origin(s). Use `'*'` for any origin, a string for a single origin, or an array for multiple origins. Defaults to `'*'`.
+ * @param options.methods - Allowed HTTP methods. Defaults to common methods.
+ * @param options.headers - Allowed request headers. Defaults to common headers.
+ * @param options.credentials - Whether to allow credentials. Defaults to `false`.
+ * @param options.maxAge - Preflight cache duration in seconds. Defaults to `86400` (24 hours).
+ *
+ * @example
+ * ```typescript
+ * import { cors } from '@pikku/core/middleware'
+ *
+ * // Allow all origins
+ * addHTTPMiddleware('*', [cors()])
+ *
+ * // Specific origin with credentials
+ * addHTTPMiddleware('*', [
+ *   cors({
+ *     origin: 'https://app.example.com',
+ *     credentials: true,
+ *   })
+ * ])
+ *
+ * // Multiple origins
+ * addHTTPMiddleware('*', [
+ *   cors({
+ *     origin: ['https://app.example.com', 'https://admin.example.com'],
+ *   })
+ * ])
+ * ```
+ */
+export const cors = pikkuMiddlewareFactory<{
+  origin?: string | string[]
+  methods?: string[]
+  headers?: string[]
+  credentials?: boolean
+  maxAge?: number
+}>(
+  ({
+    origin = '*',
+    methods = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
+    headers = ['Content-Type', 'Authorization', 'x-api-key'],
+    credentials = false,
+    maxAge = 86400,
+  } = {}) =>
+    pikkuMiddleware({
+      name: 'CORS',
+      description: 'Handles cross-origin requests including OPTIONS preflight',
+      func: async (_services, wires, next) => {
+        const request = wires.http?.request
+        const response = wires.http?.response
+
+        if (!request || !response) {
+          return next()
+        }
+
+        const requestOrigin = request.header('origin')
+
+        let allowedOrigin: string
+        if (Array.isArray(origin)) {
+          allowedOrigin =
+            requestOrigin && origin.includes(requestOrigin)
+              ? requestOrigin
+              : origin[0]
+        } else {
+          allowedOrigin = origin
+        }
+
+        response.header('Access-Control-Allow-Origin', allowedOrigin)
+        response.header('Access-Control-Allow-Methods', methods.join(', '))
+        response.header('Access-Control-Allow-Headers', headers.join(', '))
+
+        if (credentials) {
+          response.header('Access-Control-Allow-Credentials', 'true')
+        }
+
+        if (Array.isArray(origin)) {
+          response.header('Vary', 'Origin')
+        }
+
+        if (request.method() === 'options') {
+          response.header('Access-Control-Max-Age', String(maxAge))
+          response.status(204).json(undefined as any)
+          return
+        }
+
+        return next()
+      },
+    })
+)

package/src/middleware/index.ts

@@ -1,3 +1,5 @@
-export * from './auth-apikey.js'
-export * from './auth-cookie.js'
-export * from './auth-bearer.js'
+export { authAPIKey } from './auth-apikey.js'
+export { authCookie } from './auth-cookie.js'
+export { authBearer } from './auth-bearer.js'
+export { pikkuRemoteAuthMiddleware } from './remote-auth.js'
+export { cors } from './cors.js'

package/src/middleware/remote-auth.ts

@@ -0,0 +1,68 @@
+import { UnauthorizedError } from '../errors/errors.js'
+import { pikkuMiddleware } from '../types/core.types.js'
+import { decryptJSON } from '../crypto-utils.js'
+
+export const pikkuRemoteAuthMiddleware = pikkuMiddleware(
+  async ({ secrets, jwt }, { http, setSession }, next) => {
+    if (!http?.request || !secrets) {
+      return next()
+    }
+
+    let secret: string
+    try {
+      secret = await secrets.getSecret('PIKKU_REMOTE_SECRET')
+    } catch {
+      return next()
+    }
+    if (!jwt) {
+      throw new Error('PIKKU_REMOTE_SECRET set but JWT service missing')
+    }
+
+    const authHeader =
+      http.request.header('authorization') ||
+      http.request.header('Authorization')
+
+    if (!authHeader) {
+      throw new UnauthorizedError()
+    }
+
+    const [scheme, token] = authHeader.split(' ')
+    if (scheme !== 'Bearer' || !token) {
+      throw new UnauthorizedError()
+    }
+
+    let payload: any
+    try {
+      payload = await jwt.decode(token)
+    } catch {
+      throw new UnauthorizedError()
+    }
+
+    if (payload?.aud !== 'pikku-remote') {
+      throw new UnauthorizedError()
+    }
+
+    if (payload?.fn && http.request.path().startsWith('/rpc/')) {
+      const fn = decodeURIComponent(http.request.path().slice('/rpc/'.length))
+      if (fn && payload.fn !== fn) {
+        throw new UnauthorizedError()
+      }
+    }
+
+    if (payload?.session) {
+      try {
+        const decrypted = await decryptJSON<{ session?: unknown }>(
+          secret,
+          payload.session
+        )
+        if (decrypted?.session && setSession) {
+          await setSession(decrypted.session)
+        }
+      } catch {
+        throw new UnauthorizedError()
+      }
+    }
+
+    return next()
+  }
+)