@voyant-travel/hono 0.128.1 → 0.128.2

package/dist/index.d.ts

@@ -20,5 +20,5 @@ export { stampOpenApiRegistryApiId } from "./openapi-ownership.js";
 export { openApiValidationHook } from "./openapi-validation.js";
 export type { CreatePublicCapabilityOptions, PublicCapabilityCookieOptions, PublicCapabilityPayload, VerifyPublicCapabilityOptions, } from "./public-capability.js";
 export { createPublicCapabilityToken, extractPublicCapabilityToken, serializePublicCapabilityCookie, verifyPublicCapabilityToken, } from "./public-capability.js";
-export type { DbFactory, DbFactorySelector, DbSource, DbSurfaceSelection, LogEntry, LoggerProvider, VoyantAppConfig, VoyantAuthIntegration, VoyantAuthPermissionArgs, VoyantAuthResolveArgs, VoyantBindings, VoyantDb, VoyantExecutionContext, VoyantQueryRuntime, VoyantRequestAuthContext, VoyantRouteHandler, VoyantVariables, } from "./types.js";
+export type { DbFactory, DbFactorySelector, DbSource, DbSurfaceSelection, LogEntry, LoggerProvider, VoyantAppConfig, VoyantAuthAppTokenResolveArgs, VoyantAuthIntegration, VoyantAuthPermissionArgs, VoyantAuthResolveArgs, VoyantBindings, VoyantDb, VoyantExecutionContext, VoyantQueryRuntime, VoyantRequestAuthContext, VoyantRouteHandler, VoyantVariables, } from "./types.js";
 export { ApiHttpError, ForbiddenApiError, normalizeValidationError, parseJsonBody, parseOptionalJsonBody, parseQuery, RequestValidationError, UnauthorizedApiError, } from "./validation.js";

package/dist/middleware/auth.js

@@ -139,6 +139,19 @@ function applyAuthContext(c, auth) {
         c.set("apiTokenId", auth.apiTokenId);
     if (auth.apiKeyId)
         c.set("apiKeyId", auth.apiKeyId);
+    if (auth.appId)
+        c.set("appId", auth.appId);
+    if (auth.appInstallationId)
+        c.set("appInstallationId", auth.appInstallationId);
+    if (auth.appReleaseId)
+        c.set("appReleaseId", auth.appReleaseId);
+    if (auth.appCredentialGeneration !== undefined) {
+        c.set("appCredentialGeneration", auth.appCredentialGeneration);
+    }
+    if (auth.appTokenMode)
+        c.set("appTokenMode", auth.appTokenMode);
+    if (auth.appViewerId)
+        c.set("appViewerId", auth.appViewerId);
 }
 export function requireAuth(dbSource, opts) {
     const publicPaths = opts?.publicPaths ?? [];
@@ -270,7 +283,29 @@ export function requireAuth(dbSource, opts) {
                 await lease.release();
             }
         }
-        // Strategy 3: App-provided auth resolution (cookies, provider tokens, etc.)
+        // Strategy 3: Remote app access token support
+        if (token && opts?.auth?.resolveAppToken) {
+            const lease = acquireRequestDb(c, dbFactory);
+            try {
+                const resolved = await opts.auth.resolveAppToken({
+                    request: c.req.raw,
+                    env: c.env,
+                    db: lease.db,
+                    // Guarded: Hono throws on `executionCtx` access outside Workers.
+                    ctx: tryGetExecutionCtx(c),
+                    token,
+                });
+                if (resolved?.callerType === "app" && resolved.appInstallationId) {
+                    applyAuthContext(c, resolved);
+                    // `await` is load-bearing — see strategy 2.
+                    return await next();
+                }
+            }
+            finally {
+                await lease.release();
+            }
+        }
+        // Strategy 4: App-provided auth resolution (cookies, provider tokens, etc.)
         if (opts?.auth?.resolve) {
             const lease = acquireRequestDb(c, dbFactory);
             try {
@@ -293,7 +328,7 @@ export function requireAuth(dbSource, opts) {
                 await lease.release();
             }
         }
-        // Strategy 4: Generic session-claims bearer token support
+        // Strategy 5: Generic session-claims bearer token support
         const sessionSecret = c.env.SESSION_CLAIMS_SECRET;
         if (token && sessionSecret && token.includes(".")) {
             try {

package/dist/middleware/require-actor.js

@@ -98,7 +98,9 @@ export function requireActor(...args) {
     return async (c, next) => {
         if (c.req.method === "OPTIONS")
             return next();
-        if (c.get("callerType") === "api_key" || c.get("callerType") === "internal") {
+        if (c.get("callerType") === "api_key" ||
+            c.get("callerType") === "app" ||
+            c.get("callerType") === "internal") {
             const pathname = normalizePathname(new URL(c.req.url).pathname, {
                 basePath: options.basePath,
             });
@@ -116,7 +118,7 @@ export function requireActor(...args) {
                 hasAnyApiKeyPermission(c.get("scopes"), resource, actions, options.accessCatalog)) {
                 return next();
             }
-            return c.json({ error: "Forbidden: API key missing required permission" }, 403);
+            return c.json({ error: "Forbidden: token missing required permission" }, 403);
         }
         const actor = c.get("actor");
         if (!actor) {

package/dist/types.d.ts

@@ -134,6 +134,9 @@ export interface VoyantAuthResolveArgs<TBindings extends VoyantBindings = Voyant
     db: VoyantDb;
     ctx?: VoyantExecutionContext;
 }
+export interface VoyantAuthAppTokenResolveArgs<TBindings extends VoyantBindings = VoyantBindings> extends VoyantAuthResolveArgs<TBindings> {
+    token: string;
+}
 export interface VoyantAuthPermissionArgs<TBindings extends VoyantBindings = VoyantBindings> extends VoyantAuthResolveArgs<TBindings> {
     permission: VoyantPermission;
     auth: VoyantRequestAuthContext;
@@ -160,6 +163,7 @@ export interface VoyantAuthIntegration<TBindings extends VoyantBindings = Voyant
      * so `/v1/public/*` route guards work.
      */
     resolve?: (args: VoyantAuthResolveArgs<TBindings>) => Promise<VoyantRequestAuthContext | null> | VoyantRequestAuthContext | null;
+    resolveAppToken?: (args: VoyantAuthAppTokenResolveArgs<TBindings>) => Promise<VoyantAuthContext | null> | VoyantAuthContext | null;
     hasPermission?: (args: VoyantAuthPermissionArgs<TBindings>) => Promise<boolean> | boolean;
     validateApiKey?: (args: VoyantAuthApiKeyValidationArgs<TBindings>) => Promise<boolean> | boolean;
     onUnauthorized?: (args: VoyantAuthUnauthorizedArgs<TBindings>) => Promise<Response | null> | Response | null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/hono",
-  "version": "0.128.1",
+  "version": "0.128.2",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -130,17 +130,17 @@
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.27",
     "zod": "^4.4.3",
-    "@voyant-travel/core": "^0.125.0",
-    "@voyant-travel/db": "^0.114.9",
-    "@voyant-travel/types": "^0.109.2",
+    "@voyant-travel/core": "^0.125.1",
+    "@voyant-travel/db": "^0.114.10",
+    "@voyant-travel/types": "^0.109.3",
     "@voyant-travel/utils": "^0.107.1",
-    "@voyant-travel/workflows": "^0.122.2"
+    "@voyant-travel/workflows": "^0.122.3"
   },
   "devDependencies": {
     "typescript": "^6.0.3",
     "vitest": "^4.1.9",
     "@voyant-travel/voyant-typescript-config": "^0.1.0",
-    "@voyant-travel/workflows-orchestrator": "^0.122.2"
+    "@voyant-travel/workflows-orchestrator": "^0.122.3"
   },
   "files": [
     "dist"