@voyant-travel/hono 0.126.3 → 0.127.1

package/dist/middleware/require-actor.d.ts

@@ -21,6 +21,7 @@ export interface RequireActorOptions {
     resources?: readonly {
         path: string;
         resource: string;
+        authorization?: "coarse" | "route";
     }[];
     accessCatalog?: AccessCatalog;
 }

package/dist/middleware/require-actor.js

@@ -79,11 +79,14 @@ export function isStaffRbacEnforced(env) {
 function isRequireActorOptions(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function apiKeyResourceForRequest(pathname, options) {
+function authorizationForRequest(pathname, options) {
     const override = [...(options.resources ?? [])]
         .sort((left, right) => right.path.length - left.path.length)
         .find(({ path }) => pathname === path || pathname.startsWith(`${path}/`));
-    return override?.resource ?? apiKeyResourceFromPath(pathname);
+    return {
+        resource: override?.resource ?? apiKeyResourceFromPath(pathname),
+        authorization: override?.authorization ?? "coarse",
+    };
 }
 export function requireActor(...args) {
     const options = isRequireActorOptions(args[0]) ? args[0] : {};
@@ -99,14 +102,14 @@ export function requireActor(...args) {
             const pathname = normalizePathname(new URL(c.req.url).pathname, {
                 basePath: options.basePath,
             });
-            const resource = apiKeyResourceForRequest(pathname, options);
+            const { resource, authorization } = authorizationForRequest(pathname, options);
             // Coarse-guard-exempt surfaces. `_meta` (capability discovery) and `mcp`
             // (the agent tool server) are dispatch surfaces where authorization is
             // enforced at a finer grain than method+path: the MCP server filters and
             // gates each tool by its own `requiredScopes` (voyant#2792, D2). So any
             // authenticated key reaches them; a key with no relevant scopes simply
             // sees an empty tool list. Neither is a real module name.
-            if (isCoarseGuardExempt(resource))
+            if (authorization === "route" || isCoarseGuardExempt(resource))
                 return next();
             const actions = apiKeyPermissionActionsForMethod(c.req.method, pathname);
             if (resource &&
@@ -137,8 +140,8 @@ export function requireActor(...args) {
             const pathname = normalizePathname(new URL(c.req.url).pathname, {
                 basePath: options.basePath,
             });
-            const resource = apiKeyResourceForRequest(pathname, options);
-            if (resource && !isCoarseGuardExempt(resource)) {
+            const { resource, authorization } = authorizationForRequest(pathname, options);
+            if (resource && authorization !== "route" && !isCoarseGuardExempt(resource)) {
                 const actions = apiKeyPermissionActionsForMethod(c.req.method, pathname);
                 if (!hasAnyApiKeyPermission(scopes, resource, actions, options.accessCatalog)) {
                     return c.json({ error: "Forbidden: missing required permission" }, 403);

package/dist/types.d.ts

@@ -218,6 +218,7 @@ export interface VoyantAppConfig<TBindings extends VoyantBindings = VoyantBindin
     accessResources?: readonly {
         path: string;
         resource: string;
+        authorization?: "coarse" | "route";
     }[];
     /** Effective selected-plus-legacy catalog used for wildcard policy. */
     accessCatalog?: AccessCatalog;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/hono",
-  "version": "0.126.3",
+  "version": "0.127.1",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -130,18 +130,18 @@
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.27",
     "zod": "^4.4.3",
-    "@voyant-travel/core": "^0.122.1",
-    "@voyant-travel/db": "^0.114.4",
-    "@voyant-travel/types": "^0.109.1",
+    "@voyant-travel/core": "^0.124.0",
+    "@voyant-travel/db": "^0.114.7",
+    "@voyant-travel/types": "^0.109.2",
     "@voyant-travel/utils": "^0.107.1",
-    "@voyant-travel/workflows": "^0.120.2"
+    "@voyant-travel/workflows": "^0.121.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20260702.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9",
     "@voyant-travel/voyant-typescript-config": "^0.1.0",
-    "@voyant-travel/workflows-orchestrator": "^0.120.2"
+    "@voyant-travel/workflows-orchestrator": "^0.121.0"
   },
   "files": [
     "dist"