@pikku/inspector 0.12.50 → 0.12.54

package/src/add/add-http-route.ts

@@ -272,18 +272,27 @@ export function registerHTTPRoute({
     }
   }
 
+  // The route's own `auth`, falling back to the group's. Recorded on the meta
+  // below so an audit can answer "is this route open?" without re-reading the
+  // source: the route can tighten a sessionless function, and until this was
+  // written down that tightening existed only in the wiring.
+  const routeAuthProp = getPropertyValue(obj, 'auth')
+  const resolvedAuth =
+    routeAuthProp === true || routeAuthProp === false
+      ? routeAuthProp
+      : inheritedAuth
+
   // For inline functions (e.g. oauth2 handlers), propagate sessionless: true
   // when auth is explicitly disabled at the route or group level — the
   // developer opted out of auth so no session is required.
   {
     const inlineMeta = state.functions.meta[funcName]
-    if (inlineMeta && inlineMeta.sessionless === undefined) {
-      const routeAuth = getPropertyValue(obj, 'auth')
-      const resolvedAuth =
-        routeAuth === true || routeAuth === false ? routeAuth : inheritedAuth
-      if (resolvedAuth === false) {
-        inlineMeta.sessionless = true
-      }
+    if (
+      inlineMeta &&
+      inlineMeta.sessionless === undefined &&
+      resolvedAuth === false
+    ) {
+      inlineMeta.sessionless = true
     }
   }
 
@@ -416,6 +425,7 @@ export function registerHTTPRoute({
     route: fullRoute,
     sourceFile: sourceFile.fileName,
     method: method as HTTPMethod,
+    ...(resolvedAuth !== undefined && { auth: resolvedAuth }),
     params: params.length > 0 ? params : undefined,
     query: query.length > 0 ? query : undefined,
     inputTypes: undefined,
@@ -484,6 +494,9 @@ export function registerHTTPRouteMeta({
     route: fullRoute,
     sourceFile: sourceFile.fileName,
     method: method as HTTPMethod,
+    ...((route.auth ?? inheritedAuth) !== undefined && {
+      auth: route.auth ?? inheritedAuth,
+    }),
     params: params.length > 0 ? params : undefined,
     inputTypes: undefined,
     tags: tags.length > 0 ? tags : undefined,

package/src/add/add-middleware.test.ts

@@ -0,0 +1,196 @@
+import { strict as assert } from 'assert'
+import { describe, test } from 'node:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { inspect } from '../inspector.js'
+import type { ErrorCode } from '../error-codes.js'
+import type { InspectorLogger, MiddlewareGroupMeta } from '../types.js'
+
+const makeLogger = (criticals: Array<{ code: ErrorCode; message: string }>) =>
+  ({
+    debug: () => {},
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    diagnostic: ({ code, message }) => {
+      criticals.push({ code, message })
+    },
+    critical: (code: ErrorCode, message: string) => {
+      criticals.push({ code, message })
+    },
+    hasCriticalErrors: () => criticals.length > 0,
+  }) satisfies InspectorLogger
+
+/** Every file that registered middleware for one pattern or tag. */
+const sourceFiles = (group: MiddlewareGroupMeta | undefined): string[] =>
+  group
+    ? [
+        group.sourceFile,
+        ...(group.additionalRegistrations ?? []).map((r) => r.sourceFile),
+      ]
+    : []
+
+/** Runs the inspector over files written into a throwaway directory. */
+const withProject = async (
+  prefix: string,
+  files: Record<string, string[]>,
+  assertions: (state: Awaited<ReturnType<typeof inspect>>) => void
+) => {
+  const rootDir = await mkdtemp(join(tmpdir(), prefix))
+  const paths: string[] = []
+  for (const [name, lines] of Object.entries(files)) {
+    const path = join(rootDir, name)
+    await writeFile(path, lines.join('\n'))
+    paths.push(path)
+  }
+  try {
+    assertions(await inspect(makeLogger([]), paths, { rootDir }))
+  } finally {
+    await rm(rootDir, { recursive: true, force: true })
+  }
+}
+
+describe('addMiddleware inspector', () => {
+  describe('two files registering the same HTTP pattern', () => {
+    // The group is keyed by pattern, so the second call used to overwrite the
+    // first. Codegen emits imports from what is stored, so the losing file was
+    // never imported and its middleware never registered — an app could lose
+    // its session bridge to an unrelated '*' group and see nothing go wrong
+    // until a request arrived without a session.
+    const project = {
+      'session.ts': [
+        "import { addHTTPMiddleware, pikkuMiddleware } from '#pikku'",
+        'export const sessionMiddleware = () =>',
+        "  addHTTPMiddleware('*', [",
+        '    pikkuMiddleware(async (_s, _w, next) => next()),',
+        '  ])',
+      ],
+      'logging.ts': [
+        "import { addHTTPMiddleware, pikkuMiddleware } from '#pikku'",
+        'export const loggingMiddleware = () =>',
+        "  addHTTPMiddleware('*', [",
+        '    pikkuMiddleware(async (_s, _w, next) => next()),',
+        '  ])',
+      ],
+    }
+
+    test('keeps both registrations', async () => {
+      await withProject('pikku-mw-http-collide-', project, (state) => {
+        const group = state.http.routeMiddleware.get('*')
+        assert.ok(group, "expected a group for '*'")
+        assert.equal(
+          sourceFiles(group).length,
+          2,
+          'both files must survive, or one middleware silently stops running'
+        )
+      })
+    })
+
+    test('keeps both export names, so both can be imported', async () => {
+      await withProject('pikku-mw-http-names-', project, (state) => {
+        const group = state.http.routeMiddleware.get('*')!
+        const names = [
+          group.exportName,
+          ...(group.additionalRegistrations ?? []).map((r) => r.exportName),
+        ]
+        assert.deepEqual(names.sort(), [
+          'loggingMiddleware',
+          'sessionMiddleware',
+        ])
+      })
+    })
+
+    test('unions the services both registrations need', async () => {
+      await withProject('pikku-mw-http-services-', project, (state) => {
+        const group = state.http.routeMiddleware.get('*')!
+        assert.equal(
+          new Set(group.services.services).size,
+          group.services.services.length,
+          'services must not repeat when two groups merge'
+        )
+      })
+    })
+  })
+
+  test('a single registration is unchanged', async () => {
+    await withProject(
+      'pikku-mw-http-single-',
+      {
+        'session.ts': [
+          "import { addHTTPMiddleware, pikkuMiddleware } from '#pikku'",
+          'export const sessionMiddleware = () =>',
+          "  addHTTPMiddleware('*', [",
+          '    pikkuMiddleware(async (_s, _w, next) => next()),',
+          '  ])',
+        ],
+      },
+      (state) => {
+        const group = state.http.routeMiddleware.get('*')!
+        assert.equal(group.exportName, 'sessionMiddleware')
+        assert.equal(
+          group.additionalRegistrations,
+          undefined,
+          'nothing to merge means nothing extra to serialize'
+        )
+      }
+    )
+  })
+
+  test('different patterns stay separate groups', async () => {
+    await withProject(
+      'pikku-mw-http-distinct-',
+      {
+        'session.ts': [
+          "import { addHTTPMiddleware, pikkuMiddleware } from '#pikku'",
+          'export const sessionMiddleware = () =>',
+          "  addHTTPMiddleware('*', [",
+          '    pikkuMiddleware(async (_s, _w, next) => next()),',
+          '  ])',
+        ],
+        'api.ts': [
+          "import { addHTTPMiddleware, pikkuMiddleware } from '#pikku'",
+          'export const apiMiddleware = () =>',
+          "  addHTTPMiddleware('/api/*', [",
+          '    pikkuMiddleware(async (_s, _w, next) => next()),',
+          '  ])',
+        ],
+      },
+      (state) => {
+        assert.equal(sourceFiles(state.http.routeMiddleware.get('*')).length, 1)
+        assert.equal(
+          sourceFiles(state.http.routeMiddleware.get('/api/*')).length,
+          1
+        )
+      }
+    )
+  })
+
+  test('two files registering the same tag keep both registrations', async () => {
+    await withProject(
+      'pikku-mw-tag-collide-',
+      {
+        'session.ts': [
+          "import { addTagMiddleware, pikkuMiddleware } from '#pikku'",
+          'export const sessionTag = () =>',
+          "  addTagMiddleware('api', [",
+          '    pikkuMiddleware(async (_s, _w, next) => next()),',
+          '  ])',
+        ],
+        'logging.ts': [
+          "import { addTagMiddleware, pikkuMiddleware } from '#pikku'",
+          'export const loggingTag = () =>',
+          "  addTagMiddleware('api', [",
+          '    pikkuMiddleware(async (_s, _w, next) => next()),',
+          '  ])',
+        ],
+      },
+      (state) => {
+        assert.equal(
+          sourceFiles(state.middleware.tagMiddleware.get('api')).length,
+          2
+        )
+      }
+    )
+  })
+})

package/src/add/add-middleware.ts

@@ -1,5 +1,9 @@
 import * as ts from 'typescript'
-import type { AddWiring, InspectorState } from '../types.js'
+import type {
+  AddWiring,
+  InspectorState,
+  MiddlewareGroupMeta,
+} from '../types.js'
 import {
   extractFunctionName,
   isNamedExport,
@@ -13,6 +17,62 @@ import { extractMiddlewareRefs } from '../utils/middleware.js'
 import { getPropertyValue } from '../utils/get-property-value.js'
 import { getPropertyAssignmentInitializer } from '../utils/type-utils.js'
 
+/**
+ * Record a middleware group, keeping any registration already stored under the
+ * same pattern or tag.
+ *
+ * Several files may add middleware for one pattern — an app's own `'*'` group
+ * alongside the generated better-auth session bridge, say — and the runtime
+ * composes them. A plain `set` kept only the last, and codegen emits imports
+ * from what is stored, so the other file was never imported and its middleware
+ * silently stopped running. Merging is the only shape that cannot lose a gate;
+ * the first registration stays primary so single-registration groups serialize
+ * exactly as before.
+ */
+function recordMiddlewareGroup(
+  groups: Map<string, MiddlewareGroupMeta>,
+  key: string,
+  group: MiddlewareGroupMeta
+): void {
+  const existing = groups.get(key)
+  if (!existing) {
+    groups.set(key, group)
+    return
+  }
+
+  // The same call seen twice — the inspector may revisit a file — is not a
+  // second registration, and appending it would emit a duplicate import.
+  const alreadyRecorded = [
+    existing,
+    ...(existing.additionalRegistrations ?? []),
+  ]
+  if (
+    alreadyRecorded.some(
+      (r) => r.sourceFile === group.sourceFile && r.position === group.position
+    )
+  ) {
+    return
+  }
+
+  existing.additionalRegistrations = [
+    ...(existing.additionalRegistrations ?? []),
+    {
+      exportName: group.exportName,
+      sourceFile: group.sourceFile,
+      position: group.position,
+      isFactory: group.isFactory,
+    },
+  ]
+  existing.count += group.count
+  existing.instanceIds = [...existing.instanceIds, ...group.instanceIds]
+  existing.services = {
+    optimized: false,
+    services: Array.from(
+      new Set([...existing.services.services, ...group.services.services])
+    ),
+  }
+}
+
 function renameTempDefinitions(
   state: InspectorState,
   definitionIds: string[],
@@ -333,7 +393,7 @@ export const addMiddleware: AddWiring = (logger, node, checker, state) => {
       )
     }
 
-    state.middleware.tagMiddleware.set(tag, {
+    recordMiddlewareGroup(state.middleware.tagMiddleware, tag, {
       exportName: exportedName,
       sourceFile,
       position: node.getStart(),
@@ -477,7 +537,7 @@ export const addMiddleware: AddWiring = (logger, node, checker, state) => {
       )
     }
 
-    state.http.routeMiddleware.set(pattern, {
+    recordMiddlewareGroup(state.http.routeMiddleware, pattern, {
       exportName: exportedName,
       sourceFile,
       position: node.getStart(),
@@ -796,7 +856,7 @@ export const addMiddleware: AddWiring = (logger, node, checker, state) => {
       )
     }
 
-    state.channelMiddleware.tagMiddleware.set(tag, {
+    recordMiddlewareGroup(state.channelMiddleware.tagMiddleware, tag, {
       exportName: exportedName,
       sourceFile,
       position: node.getStart(),