@voyant-travel/hono 0.130.1 → 0.131.0

package/dist/anonymous-paths.d.ts

@@ -9,6 +9,11 @@ import type { ApiExtension, ApiModule } from "./module.js";
  * `publicPath`/name under `/v1/public`. `anonymous: true` opens the whole mount;
  * a string array opens specific sub-paths relative to it. Pure and sorted for a
  * deterministic, snapshot-auditable result; the global list is what `requireAuth`
- * matches to skip auth (and stamp `actor: "customer"`).
+ * matches to skip auth and mark the request as explicitly anonymous.
  */
 export declare function assembleAnonymousPaths(modules: readonly ApiModule[], extensions: readonly ApiExtension[], explicit?: readonly string[]): string[];
+/**
+ * Assemble anonymous paths that use mixed auth: valid customer sessions are
+ * resolved, while requests without a valid session continue as explicit guests.
+ */
+export declare function assembleOptionalCustomerAuthPaths(modules: readonly ApiModule[], extensions: readonly ApiExtension[]): string[];

package/dist/anonymous-paths.js

@@ -9,7 +9,7 @@ import { resolveSurfaceMountPath } from "./mount-paths.js";
  * `publicPath`/name under `/v1/public`. `anonymous: true` opens the whole mount;
  * a string array opens specific sub-paths relative to it. Pure and sorted for a
  * deterministic, snapshot-auditable result; the global list is what `requireAuth`
- * matches to skip auth (and stamp `actor: "customer"`).
+ * matches to skip auth and mark the request as explicitly anonymous.
  */
 export function assembleAnonymousPaths(modules, extensions, explicit = []) {
     const paths = new Set(explicit);
@@ -53,3 +53,29 @@ export function assembleAnonymousPaths(modules, extensions, explicit = []) {
     }
     return [...paths].sort();
 }
+/**
+ * Assemble anonymous paths that use mixed auth: valid customer sessions are
+ * resolved, while requests without a valid session continue as explicit guests.
+ */
+export function assembleOptionalCustomerAuthPaths(modules, extensions) {
+    const paths = new Set();
+    const add = (mount, declaration) => {
+        if (!declaration)
+            return;
+        if (declaration === true) {
+            paths.add(mount);
+            return;
+        }
+        for (const sub of declaration) {
+            const trimmed = sub.trim().replace(/^\/+|\/+$/g, "");
+            paths.add(trimmed ? `${mount}/${trimmed}` : mount);
+        }
+    };
+    for (const module of modules) {
+        add(resolveSurfaceMountPath("/v1/public", module.publicPath, module.module.name), module.optionalCustomerAuth);
+    }
+    for (const extension of extensions) {
+        add(resolveSurfaceMountPath("/v1/public", extension.publicPath, extension.extension.module), extension.optionalCustomerAuth);
+    }
+    return [...paths].sort();
+}

package/dist/app.js

@@ -3,7 +3,7 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { createContainer, createEventBus, createQueryRunner, } from "@voyant-travel/core";
 import { createLinkServiceFactory } from "@voyant-travel/db/links";
-import { assembleAnonymousPaths } from "./anonymous-paths.js";
+import { assembleAnonymousPaths, assembleOptionalCustomerAuthPaths } from "./anonymous-paths.js";
 import { containerToServiceResolver, makeFrameworkLogger, wireWorkflowRuntime, } from "./app-workflows.js";
 import { composeAuthAugmentations } from "./auth-augmentation.js";
 import { expandApiBundles, isLazyApiBundle, } from "./bundle.js";
@@ -99,13 +99,14 @@ export function mountApp(config) {
     // Anonymous-access allow-list (ADR-0008): assembled from module/extension
     // `anonymous` declarations + bundle-declared absolute anonymous paths (e.g. a
     // payment-processor webhook) + any explicit `publicPaths` escape-hatch entries.
-    // Used by both the auth middleware (skip auth / stamp customer actor) and the
+    // Used by both the auth middleware (skip auth / mark an explicit guest) and the
     // public-write rate-limit matcher below, so the two never diverge.
     const anonymousPaths = assembleAnonymousPaths(allModules, allExtensions, [
         ...(config.publicPaths ?? []),
         ...(expanded?.anonymousPaths ?? []),
         ...lazyPlugins.flatMap((plugin) => plugin.anonymous ?? []),
     ]);
+    const optionalCustomerAuthPaths = assembleOptionalCustomerAuthPaths(allModules, allExtensions);
     const clientAuthenticatedRoutes = assembleClientAuthenticatedRoutes(allModules);
     const composedAuth = composeAuthAugmentations(config.auth, allModules);
     // When the framework owns the bus, route subscriber-dispatch failures
@@ -263,6 +264,7 @@ export function mountApp(config) {
         anonymousPaths.push(...assembleAnonymousPaths(lazyExpanded.modules, lazyExpanded.extensions, [
             ...lazyExpanded.anonymousPaths,
         ]));
+        optionalCustomerAuthPaths.push(...assembleOptionalCustomerAuthPaths(lazyExpanded.modules, lazyExpanded.extensions));
         for (const mod of lazyExpanded.modules) {
             if (mod.module.service !== undefined) {
                 container.register(mod.module.name, mod.module.service);
@@ -483,6 +485,7 @@ export function mountApp(config) {
         : config.db;
     const authOptions = {
         publicPaths: anonymousPaths,
+        optionalCustomerAuthPaths,
         clientAuthenticatedRoutes,
         basePath: config.basePath,
         auth: composedAuth,

package/dist/auth/index.d.ts

@@ -1,4 +1,6 @@
 export { constantTimeEqual, generateNumericCode, randomBytesHex, sha256Base64Url, sha256Hex, unsignCookie, } from "./crypto.js";
+export { type BusinessCustomerBuyerContext, type CustomerBuyerContext, type PersonalCustomerBuyerContext, requireBusinessCustomerBuyerContext, requireCustomerBuyerContext, requirePersonalCustomerBuyerContext, } from "./require-customer-buyer.js";
+export { type CustomerIdentityContext, requireCustomerIdentityContext, } from "./require-customer-identity.js";
 export { requireUserId } from "./require-user.js";
 export type { SessionAuthContext } from "./session-jwt.js";
 export { extractBearerToken, verifySession } from "./session-jwt.js";

package/dist/auth/index.js

@@ -1,3 +1,5 @@
 export { constantTimeEqual, generateNumericCode, randomBytesHex, sha256Base64Url, sha256Hex, unsignCookie, } from "./crypto.js";
+export { requireBusinessCustomerBuyerContext, requireCustomerBuyerContext, requirePersonalCustomerBuyerContext, } from "./require-customer-buyer.js";
+export { requireCustomerIdentityContext, } from "./require-customer-identity.js";
 export { requireUserId } from "./require-user.js";
 export { extractBearerToken, verifySession } from "./session-jwt.js";

package/dist/auth/require-customer-buyer.d.ts

@@ -0,0 +1,27 @@
+import type { Context } from "hono";
+interface CustomerBuyerContextBase {
+    userId: string;
+    buyerAccountId: string;
+}
+export interface PersonalCustomerBuyerContext extends CustomerBuyerContextBase {
+    kind: "personal";
+    authOrganizationId: null;
+    relationshipOrganizationId: null;
+    relationshipPersonId: string | null;
+    membershipId: null;
+    membershipRole: null;
+}
+export interface BusinessCustomerBuyerContext extends CustomerBuyerContextBase {
+    kind: "business";
+    authOrganizationId: string;
+    relationshipOrganizationId: string;
+    relationshipPersonId: null;
+    membershipId: string;
+    membershipRole: string;
+}
+export type CustomerBuyerContext = PersonalCustomerBuyerContext | BusinessCustomerBuyerContext;
+/** Requires the provider-neutral, request-revalidated storefront buyer context. */
+export declare function requireCustomerBuyerContext(c: Context): CustomerBuyerContext;
+export declare function requirePersonalCustomerBuyerContext(c: Context): PersonalCustomerBuyerContext;
+export declare function requireBusinessCustomerBuyerContext(c: Context): BusinessCustomerBuyerContext;
+export {};

package/dist/auth/require-customer-buyer.js

@@ -0,0 +1,55 @@
+import { ForbiddenApiError } from "../validation.js";
+import { requireCustomerIdentityContext } from "./require-customer-identity.js";
+/** Requires the provider-neutral, request-revalidated storefront buyer context. */
+export function requireCustomerBuyerContext(c) {
+    const identity = requireCustomerIdentityContext(c);
+    const userId = identity.userId;
+    const buyerAccountId = c.get("buyerAccountId");
+    const kind = c.get("buyerAccountKind");
+    if (!buyerAccountId || (kind !== "personal" && kind !== "business")) {
+        throw new ForbiddenApiError("A customer buyer account must be selected");
+    }
+    if (kind === "personal") {
+        return {
+            userId,
+            buyerAccountId,
+            kind,
+            authOrganizationId: null,
+            relationshipOrganizationId: null,
+            relationshipPersonId: identity.relationshipPersonId,
+            membershipId: null,
+            membershipRole: null,
+        };
+    }
+    const authOrganizationId = c.get("authOrganizationId");
+    const relationshipOrganizationId = c.get("relationshipOrganizationId");
+    const membershipId = c.get("buyerMembershipId");
+    const membershipRole = c.get("buyerMembershipRole");
+    if (!authOrganizationId || !relationshipOrganizationId || !membershipId || !membershipRole) {
+        throw new ForbiddenApiError("The business buyer membership is no longer available");
+    }
+    return {
+        userId,
+        buyerAccountId,
+        kind,
+        authOrganizationId,
+        relationshipOrganizationId,
+        relationshipPersonId: null,
+        membershipId,
+        membershipRole,
+    };
+}
+export function requirePersonalCustomerBuyerContext(c) {
+    const buyer = requireCustomerBuyerContext(c);
+    if (buyer.kind !== "personal") {
+        throw new ForbiddenApiError("A personal buyer account is required");
+    }
+    return buyer;
+}
+export function requireBusinessCustomerBuyerContext(c) {
+    const buyer = requireCustomerBuyerContext(c);
+    if (buyer.kind !== "business") {
+        throw new ForbiddenApiError("A business buyer account is required");
+    }
+    return buyer;
+}

package/dist/auth/require-customer-identity.d.ts

@@ -0,0 +1,9 @@
+import type { Context } from "hono";
+export interface CustomerIdentityContext {
+    userId: string;
+    sessionId: string | null;
+    email: string | null;
+    relationshipPersonId: string | null;
+}
+/** Requires customer-realm identity without requiring a selected buyer account. */
+export declare function requireCustomerIdentityContext(c: Context): CustomerIdentityContext;

package/dist/auth/require-customer-identity.js

@@ -0,0 +1,16 @@
+import { UnauthorizedApiError } from "../validation.js";
+/** Requires customer-realm identity without requiring a selected buyer account. */
+export function requireCustomerIdentityContext(c) {
+    if (c.get("realm") !== "customer" || c.get("actor") !== "customer") {
+        throw new UnauthorizedApiError();
+    }
+    const userId = c.get("userId");
+    if (!userId)
+        throw new UnauthorizedApiError();
+    return {
+        userId,
+        sessionId: c.get("sessionId") ?? null,
+        email: c.get("email") ?? null,
+        relationshipPersonId: c.get("relationshipPersonId") ?? null,
+    };
+}

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 export type { VoyantPermission } from "@voyant-travel/core";
-export { assembleAnonymousPaths } from "./anonymous-paths.js";
+export { assembleAnonymousPaths, assembleOptionalCustomerAuthPaths } from "./anonymous-paths.js";
 export { mountApp } from "./app.js";
-export type { SessionAuthContext } from "./auth/index.js";
-export { constantTimeEqual, extractBearerToken, generateNumericCode, randomBytesHex, requireUserId, sha256Base64Url, sha256Hex, unsignCookie, verifySession, } from "./auth/index.js";
+export type { BusinessCustomerBuyerContext, CustomerBuyerContext, CustomerIdentityContext, PersonalCustomerBuyerContext, SessionAuthContext, } from "./auth/index.js";
+export { constantTimeEqual, extractBearerToken, generateNumericCode, randomBytesHex, requireBusinessCustomerBuyerContext, requireCustomerBuyerContext, requireCustomerIdentityContext, requirePersonalCustomerBuyerContext, requireUserId, sha256Base64Url, sha256Hex, unsignCookie, verifySession, } from "./auth/index.js";
 export type { ApiBundle, ApiBundleInput, ExpandedApiBundles, LazyApiBundle, } from "./bundle.js";
 export { defineApiBundle, defineLazyApiBundle, expandApiBundles, isLazyApiBundle, } from "./bundle.js";
 export { type CreateAppConfig, createApp } from "./create-app.js";

package/dist/index.js

@@ -1,6 +1,6 @@
-export { assembleAnonymousPaths } from "./anonymous-paths.js";
+export { assembleAnonymousPaths, assembleOptionalCustomerAuthPaths } from "./anonymous-paths.js";
 export { mountApp } from "./app.js";
-export { constantTimeEqual, extractBearerToken, generateNumericCode, randomBytesHex, requireUserId, sha256Base64Url, sha256Hex, unsignCookie, verifySession, } from "./auth/index.js";
+export { constantTimeEqual, extractBearerToken, generateNumericCode, randomBytesHex, requireBusinessCustomerBuyerContext, requireCustomerBuyerContext, requireCustomerIdentityContext, requirePersonalCustomerBuyerContext, requireUserId, sha256Base64Url, sha256Hex, unsignCookie, verifySession, } from "./auth/index.js";
 export { defineApiBundle, defineLazyApiBundle, expandApiBundles, isLazyApiBundle, } from "./bundle.js";
 export { createApp } from "./create-app.js";
 export { createAuthenticatedDocumentDownloadResolver, encodeStorageKeyPath, resolveStoredDocumentDownload, } from "./document-download.js";

package/dist/middleware/auth.d.ts

@@ -3,6 +3,7 @@ import type { AbsoluteClientAuthenticatedRoute } from "../client-authenticated-r
 import { type DbSource, type VoyantAuthIntegration, type VoyantBindings, type VoyantVariables } from "../types.js";
 export declare function requireAuth<TBindings extends VoyantBindings>(dbSource: DbSource<TBindings>, opts?: {
     publicPaths?: string[];
+    optionalCustomerAuthPaths?: string[];
     clientAuthenticatedRoutes?: readonly AbsoluteClientAuthenticatedRoute[];
     basePath?: string;
     auth?: VoyantAuthIntegration<TBindings>;

package/dist/middleware/auth.js

@@ -117,8 +117,32 @@ function applyAuthContext(c, auth) {
         c.set("userId", auth.userId);
     if (auth.sessionId)
         c.set("sessionId", auth.sessionId);
+    if (auth.realm)
+        c.set("realm", auth.realm);
+    if (auth.isAnonymousRequest !== undefined) {
+        c.set("isAnonymousRequest", auth.isAnonymousRequest);
+    }
     if (auth.organizationId !== undefined)
         c.set("organizationId", auth.organizationId ?? undefined);
+    if (auth.buyerAccountId !== undefined)
+        c.set("buyerAccountId", auth.buyerAccountId ?? undefined);
+    if (auth.buyerAccountKind !== undefined)
+        c.set("buyerAccountKind", auth.buyerAccountKind);
+    if (auth.authOrganizationId !== undefined) {
+        c.set("authOrganizationId", auth.authOrganizationId ?? undefined);
+    }
+    if (auth.relationshipOrganizationId !== undefined) {
+        c.set("relationshipOrganizationId", auth.relationshipOrganizationId ?? undefined);
+    }
+    if (auth.relationshipPersonId !== undefined) {
+        c.set("relationshipPersonId", auth.relationshipPersonId ?? undefined);
+    }
+    if (auth.buyerMembershipId !== undefined) {
+        c.set("buyerMembershipId", auth.buyerMembershipId ?? undefined);
+    }
+    if (auth.buyerMembershipRole !== undefined) {
+        c.set("buyerMembershipRole", auth.buyerMembershipRole ?? undefined);
+    }
     if (auth.callerType)
         c.set("callerType", auth.callerType);
     if (auth.actor)
@@ -173,6 +197,7 @@ function matchesRequestRealm(path, auth) {
 }
 export function requireAuth(dbSource, opts) {
     const publicPaths = opts?.publicPaths ?? [];
+    const optionalCustomerAuthPaths = opts?.optionalCustomerAuthPaths ?? [];
     return async (c, next) => {
         if (c.req.method === "OPTIONS")
             return next();
@@ -188,10 +213,10 @@ export function requireAuth(dbSource, opts) {
         if (matchesClientAuthenticatedRoute(c.req.method, p, opts?.clientAuthenticatedRoutes ?? [])) {
             return next();
         }
-        if (matchesPublicPath(p, publicPaths)) {
-            if (p.startsWith("/v1/public/")) {
-                c.set("actor", "customer");
-            }
+        const isAnonymousPath = matchesPublicPath(p, publicPaths);
+        const isOptionalCustomerAuthPath = matchesPublicPath(p, optionalCustomerAuthPaths);
+        if (isAnonymousPath && !isOptionalCustomerAuthPath) {
+            c.set("isAnonymousRequest", true);
             return next();
         }
         const authHeader = c.req.header("authorization") || c.req.header("Authorization");
@@ -369,11 +394,16 @@ export function requireAuth(dbSource, opts) {
                 : sessionRealm === "customer"
                     ? customerSessionSecret
                     : undefined;
-        if (token && sessionSecret && sessionSecret.length >= 32 && token.includes(".")) {
+        if (token &&
+            sessionRealm &&
+            sessionSecret &&
+            sessionSecret.length >= 32 &&
+            token.includes(".")) {
             try {
                 const sessionAuth = await verifySession(token, sessionSecret);
                 applyAuthContext(c, {
                     ...sessionAuth,
+                    realm: sessionRealm,
                     callerType: "session",
                     actor: sessionRealm === "admin" ? "staff" : "customer",
                     audience: sessionRealm === "admin" ? "staff" : "customer",
@@ -384,6 +414,10 @@ export function requireAuth(dbSource, opts) {
                 // fall through
             }
         }
+        if (isAnonymousPath && isOptionalCustomerAuthPath) {
+            c.set("isAnonymousRequest", true);
+            return next();
+        }
         if (opts?.auth?.onUnauthorized) {
             const response = await opts.auth.onUnauthorized({
                 request: c.req.raw,

package/dist/middleware/require-actor.js

@@ -99,6 +99,9 @@ export function requireActor(...args) {
     return async (c, next) => {
         if (c.req.method === "OPTIONS")
             return next();
+        if (c.get("isAnonymousRequest") && allowSet.has("customer") && !allowSet.has("staff")) {
+            return next();
+        }
         const pathname = normalizePathname(new URL(c.req.url).pathname, {
             basePath: options.basePath,
         });

package/dist/module.d.ts

@@ -52,11 +52,13 @@ export interface ApiModule {
      * opens `/v1/public/customer-portal/contact-exists`). The framework assembles
      * the global anonymous allow-list from these declarations, so the
      * "reachable-without-auth" decision lives next to the route rather than in a
-     * hand-maintained `publicPaths` list. Anonymous public requests are stamped
-     * `actor: "customer"`. Only affects the public surface — admin routes always
-     * require a `staff` actor.
+     * hand-maintained `publicPaths` list. Anonymous public requests are marked as
+     * guests and do not receive a synthetic actor. Only affects the public
+     * surface — admin routes always require a `staff` actor.
      */
     anonymous?: boolean | readonly string[];
+    /** Anonymous paths that also attempt live customer-session resolution. */
+    optionalCustomerAuth?: boolean | readonly string[];
     /**
      * Concrete admin endpoints whose credential is validated by the route itself
      * instead of by the staff-session middleware. Each declaration is matched by
@@ -125,6 +127,8 @@ export interface ApiExtension {
      * to the extension's public mount.
      */
     anonymous?: boolean | readonly string[];
+    /** Anonymous paths that also attempt live customer-session resolution. */
+    optionalCustomerAuth?: boolean | readonly string[];
     /**
      * Absolute transactional path prefixes — same semantics as
      * {@link ApiModule.transactionalPaths}.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/hono",
-  "version": "0.130.1",
+  "version": "0.131.0",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -130,17 +130,17 @@
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.27",
     "zod": "^4.4.3",
-    "@voyant-travel/core": "^0.129.0",
-    "@voyant-travel/db": "^0.114.15",
-    "@voyant-travel/types": "^0.109.5",
+    "@voyant-travel/db": "^0.115.0",
+    "@voyant-travel/core": "^0.130.0",
+    "@voyant-travel/types": "^0.109.6",
     "@voyant-travel/utils": "^0.108.0",
-    "@voyant-travel/workflows": "^0.122.8"
+    "@voyant-travel/workflows": "^0.122.9"
   },
   "devDependencies": {
     "typescript": "^6.0.3",
     "vitest": "^4.1.9",
     "@voyant-travel/voyant-typescript-config": "^0.1.0",
-    "@voyant-travel/workflows-orchestrator": "^0.122.8"
+    "@voyant-travel/workflows-orchestrator": "^0.122.9"
   },
   "files": [
     "dist"