@xdelivered/emberflow 0.2.0

package/dist/server/httpOperations.js

@@ -0,0 +1,62 @@
+import { enforceAuth, isHttpError, validateAgainstSchema } from '../src/engine/index.js';
+import { extractResponse } from './operationResult.js';
+export function makeOperationHandler(deps) {
+    const { runs, op, policy, verifiers } = deps;
+    const env = deps.env ?? { secrets: {}, vars: {}, environment: 'default', safeMode: false };
+    return async (req, res) => {
+        const request = {
+            params: req.params,
+            query: req.query,
+            body: req.body,
+            headers: req.headers,
+        };
+        try {
+            // Auth precedes validation: an unauthenticated/misconfigured request
+            // never reaches schema validation or the run, and 401/500 from the
+            // verifier is mapped by the HttpError branch below — never a generic
+            // 500 that could imply the request otherwise would have run.
+            let user;
+            if (policy) {
+                if (!verifiers)
+                    throw new Error('makeOperationHandler: policy set but no verifiers registry provided');
+                ({ user } = enforceAuth({ policy, request, secrets: env.secrets, verifiers }));
+            }
+            const schema = op.http?.inputSchema;
+            if (schema) {
+                const error = validateAgainstSchema(schema, request.body);
+                if (error !== null) {
+                    res.status(400).json({ error });
+                    return;
+                }
+            }
+            // Promote the request body's fields to the top of the run input so
+            // flows that read domain fields directly (`from('input', 'ppv')`)
+            // resolve them, while keeping `body` (and params/query/headers/user)
+            // available for ops that read `input.body.x`. Spread the body FIRST
+            // so params/query/body/headers/user always win over a colliding key.
+            const bodyFields = request.body && typeof request.body === 'object' && !Array.isArray(request.body)
+                ? request.body
+                : {};
+            const { handle } = runs.create(op, {
+                ...env,
+                input: { ...bodyFields, ...request, user },
+            });
+            const run = await handle.runToEnd();
+            const { status, body } = extractResponse(run, op);
+            res.status(status).json(body ?? null);
+        }
+        catch (err) {
+            if (isHttpError(err)) {
+                res.status(err.status).json(err.body ?? null);
+                return;
+            }
+            // A node's thrown Error can carry secrets in its message (e.g. a DB
+            // connection string or a URL with an API key) — never echo it to the
+            // (currently unauthenticated) client. Log the real error server-side
+            // and return a generic body instead. HttpError above stays the
+            // sanctioned way for a node to control the client-visible status+body.
+            console.error('[operation] run failed:', err);
+            res.status(500).json({ error: 'internal error' });
+        }
+    };
+}

package/dist/server/index.d.ts

@@ -0,0 +1 @@
+export {};