@voyant-travel/hono 0.129.1 → 0.130.0

package/README.md

@@ -41,6 +41,11 @@ const app = createApp({
 })
 ```
 
+Custom `resolve` adapters must return an explicit realm alongside the actor:
+admin sessions return `{ actor: "staff", realm: "admin" }`, while storefront
+sessions return a non-staff actor with `realm: "customer"`. Realm/actor
+mismatches are rejected before protected routes run.
+
 Use `modules`, `extensions`, and provider-backed route helpers as the default
 composition surface. Use `plugins` when you want to register a reusable
 distribution bundle that packages those pieces together.

package/dist/index.d.ts

@@ -20,5 +20,5 @@ export { stampOpenApiRegistryApiId } from "./openapi-ownership.js";
 export { openApiValidationHook } from "./openapi-validation.js";
 export type { CreatePublicCapabilityOptions, PublicCapabilityCookieOptions, PublicCapabilityPayload, VerifyPublicCapabilityOptions, } from "./public-capability.js";
 export { createPublicCapabilityToken, extractPublicCapabilityToken, serializePublicCapabilityCookie, verifyPublicCapabilityToken, } from "./public-capability.js";
-export type { DbFactory, DbFactorySelector, DbSource, DbSurfaceSelection, LogEntry, LoggerProvider, VoyantAppConfig, VoyantAuthAppTokenResolveArgs, VoyantAuthIntegration, VoyantAuthPermissionArgs, VoyantAuthResolveArgs, VoyantBindings, VoyantDb, VoyantExecutionContext, VoyantQueryRuntime, VoyantRequestAuthContext, VoyantRouteHandler, VoyantVariables, } from "./types.js";
+export type { DbFactory, DbFactorySelector, DbSource, DbSurfaceSelection, LogEntry, LoggerProvider, VoyantAppConfig, VoyantAuthAppTokenResolveArgs, VoyantAuthIntegration, VoyantAuthPermissionArgs, VoyantAuthResolveArgs, VoyantBindings, VoyantDb, VoyantExecutionContext, VoyantQueryRuntime, VoyantRequestAuthContext, VoyantResolvedSessionAuthContext, VoyantRouteHandler, VoyantVariables, } from "./types.js";
 export { ApiHttpError, ForbiddenApiError, normalizeValidationError, parseJsonBody, parseOptionalJsonBody, parseQuery, RequestValidationError, UnauthorizedApiError, } from "./validation.js";

package/dist/middleware/auth.js

@@ -149,6 +149,12 @@ function applyAuthContext(c, auth) {
     if (auth.appCredentialGeneration !== undefined) {
         c.set("appCredentialGeneration", auth.appCredentialGeneration);
     }
+    if (auth.appWorkloadEnvironmentId) {
+        c.set("appWorkloadEnvironmentId", auth.appWorkloadEnvironmentId);
+    }
+    if (auth.appContractGeneration !== undefined) {
+        c.set("appContractGeneration", auth.appContractGeneration);
+    }
     if (auth.appTokenMode)
         c.set("appTokenMode", auth.appTokenMode);
     if (auth.appViewerId)
@@ -156,6 +162,15 @@ function applyAuthContext(c, auth) {
     if (auth.appContextConstraint)
         c.set("appContextConstraint", auth.appContextConstraint);
 }
+function matchesRequestRealm(path, auth) {
+    if (path === "/v1/admin" || path.startsWith("/v1/admin/")) {
+        return auth.actor === "staff" && auth.realm === "admin";
+    }
+    if (path === "/v1/public" || path.startsWith("/v1/public/")) {
+        return auth.actor !== "staff" && auth.realm === "customer";
+    }
+    return false;
+}
 export function requireAuth(dbSource, opts) {
     const publicPaths = opts?.publicPaths ?? [];
     return async (c, next) => {
@@ -325,7 +340,7 @@ export function requireAuth(dbSource, opts) {
                     // Guarded: Hono throws on `executionCtx` access outside Workers.
                     ctx: tryGetExecutionCtx(c),
                 });
-                if (resolved?.userId) {
+                if (resolved?.userId && matchesRequestRealm(p, resolved)) {
                     applyAuthContext(c, resolved);
                     // `await` is load-bearing — see strategy 2: a bare
                     // `return next()` would let the `finally` release the shared
@@ -337,14 +352,31 @@ export function requireAuth(dbSource, opts) {
                 await lease.release();
             }
         }
-        // Strategy 5: Generic session-claims bearer token support
-        const sessionSecret = c.env.SESSION_CLAIMS_SECRET;
-        if (token && sessionSecret && token.includes(".")) {
+        // Strategy 5: Realm-bound session-claims bearer token support. Ambiguous
+        // surfaces intentionally skip this strategy instead of trying both keys.
+        const sessionRealm = p === "/v1/admin" || p.startsWith("/v1/admin/")
+            ? "admin"
+            : p === "/v1/public" || p.startsWith("/v1/public/")
+                ? "customer"
+                : null;
+        const adminSessionSecret = c.env.SESSION_CLAIMS_ADMIN_SECRET?.trim();
+        const customerSessionSecret = c.env.SESSION_CLAIMS_CUSTOMER_SECRET?.trim();
+        const sessionRootsAreDistinct = !adminSessionSecret || !customerSessionSecret || adminSessionSecret !== customerSessionSecret;
+        const sessionSecret = !sessionRootsAreDistinct
+            ? undefined
+            : sessionRealm === "admin"
+                ? adminSessionSecret
+                : sessionRealm === "customer"
+                    ? customerSessionSecret
+                    : undefined;
+        if (token && sessionSecret && sessionSecret.length >= 32 && token.includes(".")) {
             try {
                 const sessionAuth = await verifySession(token, sessionSecret);
                 applyAuthContext(c, {
                     ...sessionAuth,
                     callerType: "session",
+                    actor: sessionRealm === "admin" ? "staff" : "customer",
+                    audience: sessionRealm === "admin" ? "staff" : "customer",
                 });
                 return next();
             }

package/dist/types.d.ts

@@ -17,7 +17,8 @@ export interface VoyantExecutionContext {
 export interface VoyantBindings {
     INTERNAL_API_KEY?: string;
     INTERNAL_API_KEY_SCOPES?: string;
-    SESSION_CLAIMS_SECRET?: string;
+    SESSION_CLAIMS_ADMIN_SECRET?: string;
+    SESSION_CLAIMS_CUSTOMER_SECRET?: string;
     BETTER_AUTH_ADMIN_SECRET?: string;
     BETTER_AUTH_CUSTOMER_SECRET?: string;
     DATABASE_URL: string;
@@ -117,9 +118,13 @@ export declare function resolveDbFactoryResult(value: VoyantDb | DisposableDb):
 export type VoyantRequestAuthContext = Omit<VoyantAuthContext, "actor"> & {
     userId: string;
     actor: Actor;
-    /** Explicit security realm for session identities. */
+    /** Explicit security realm when the context represents a user session. */
     realm?: "admin" | "customer";
 };
+/** User-session identity returned by a custom `auth.resolve` adapter. */
+export type VoyantResolvedSessionAuthContext = VoyantRequestAuthContext & {
+    realm: "admin" | "customer";
+};
 export interface LogEntry {
     method: string;
     path: string;
@@ -159,13 +164,13 @@ export interface VoyantAuthIntegration<TBindings extends VoyantBindings = Voyant
     /**
      * Resolve the request to an auth context, or return `null` for anonymous.
      *
-     * The returned object MUST include `actor` — `requireActor` is fail-closed,
-     * so omitting it 401s every protected route. For single-tenant admin apps
-     * where every authenticated session is staff, return `actor: "staff"`.
-     * Customer/partner/supplier sessions should return the corresponding actor
-     * so `/v1/public/*` route guards work.
+     * The returned object MUST include both `actor` and `realm`. Admin sessions
+     * use `realm: "admin"` with `actor: "staff"`; customer, partner, or supplier
+     * sessions use `realm: "customer"` with the corresponding non-staff actor.
+     * Realm/actor mismatches fail closed so credentials cannot cross between
+     * `/v1/admin/*` and `/v1/public/*`.
      */
-    resolve?: (args: VoyantAuthResolveArgs<TBindings>) => Promise<VoyantRequestAuthContext | null> | VoyantRequestAuthContext | null;
+    resolve?: (args: VoyantAuthResolveArgs<TBindings>) => Promise<VoyantResolvedSessionAuthContext | null> | VoyantResolvedSessionAuthContext | null;
     resolveAppToken?: (args: VoyantAuthAppTokenResolveArgs<TBindings>) => Promise<VoyantAuthContext | null> | VoyantAuthContext | null;
     hasPermission?: (args: VoyantAuthPermissionArgs<TBindings>) => Promise<boolean> | boolean;
     validateApiKey?: (args: VoyantAuthApiKeyValidationArgs<TBindings>) => Promise<boolean> | boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/hono",
-  "version": "0.129.1",
+  "version": "0.130.0",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -130,17 +130,17 @@
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.27",
     "zod": "^4.4.3",
-    "@voyant-travel/core": "^0.127.0",
-    "@voyant-travel/db": "^0.114.13",
+    "@voyant-travel/core": "^0.128.0",
+    "@voyant-travel/db": "^0.114.14",
     "@voyant-travel/types": "^0.109.4",
-    "@voyant-travel/utils": "^0.107.1",
-    "@voyant-travel/workflows": "^0.122.6"
+    "@voyant-travel/utils": "^0.108.0",
+    "@voyant-travel/workflows": "^0.122.7"
   },
   "devDependencies": {
     "typescript": "^6.0.3",
     "vitest": "^4.1.9",
     "@voyant-travel/voyant-typescript-config": "^0.1.0",
-    "@voyant-travel/workflows-orchestrator": "^0.122.6"
+    "@voyant-travel/workflows-orchestrator": "^0.122.7"
   },
   "files": [
     "dist"