bazis 0.107.0 → 0.108.0

package/core/app/messages.ts

@@ -1,10 +1,19 @@
-import { EN_HTTP_MESSAGES, RU_HTTP_MESSAGES, formatMessage, type HttpMessageKey, type Localize } from "../http/Errors/messages";
+import { EN_HTTP_MESSAGES, RU_HTTP_MESSAGES, formatMessage, type HttpMessageKey, type LanguageSelection, type Localize, type SelectedLanguage } from "../http/Errors/messages";
 import { KernelError } from "../kernel";
 import { EN_VALIDATION_MESSAGES, MessageRegistry, RU_VALIDATION_MESSAGES, type ValidationCode } from "../../library/validation";
 
 /** Language of the texts the framework writes into responses. */
 export type AppLanguage = "en" | "ru";
 
+/**
+ * Several response languages: each request gets the best match of its
+ * `Accept-Language` among `supported`, or `default`.
+ */
+export interface AppLanguageOptions {
+  readonly default: AppLanguage;
+  readonly supported: readonly AppLanguage[];
+}
+
 /**
  * Own texts for framework messages, by key: HTTP texts (`notFound`,
  * `malformedJson`, …), validation codes (`required`, `minLength`, …),
@@ -42,3 +51,49 @@ export function createLocalize(language: AppLanguage = "en", messages: AppMessag
     return text === undefined ? undefined : formatMessage(text, params, template);
   };
 }
+
+/**
+ * The response language of every request: one language, or the best match of
+ * `Accept-Language` (`ru-RU,ru;q=0.9,en;q=0.8`) among `supported`.
+ */
+export function createLanguages(option: AppLanguage | AppLanguageOptions = "en", messages: AppMessages = {}): LanguageSelection {
+  if (typeof option === "string") {
+    const single: SelectedLanguage = { language: option, localize: createLocalize(option, messages) };
+    return { negotiated: false, select: () => single };
+  }
+  const supported = [...new Set(option.supported)];
+  if (supported.length === 0) throw new KernelError("runApp: language.supported needs at least one language.");
+  if (!supported.includes(option.default)) {
+    throw new KernelError(`runApp: language.default "${String(option.default)}" must be one of language.supported (${supported.join(", ")}).`);
+  }
+  const selected = new Map<string, SelectedLanguage>(supported.map((language) => [language, { language, localize: createLocalize(language, messages) }]));
+  const fallback = selected.get(option.default)!;
+  return {
+    negotiated: supported.length > 1,
+    select(acceptLanguage) {
+      const language = negotiateLanguage(acceptLanguage, supported);
+      return language === undefined ? fallback : selected.get(language)!;
+    },
+  };
+}
+
+/** The supported language with the highest `q` in `Accept-Language`; ties keep the header order. */
+export function negotiateLanguage(header: string | null | undefined, supported: readonly string[]): string | undefined {
+  if (header === null || header === undefined || header.length > 1024) return undefined;
+  let best: { language: string; q: number } | undefined;
+  for (const part of header.split(",").slice(0, 32)) {
+    const [range = "", ...parameters] = part.trim().split(";");
+    const tag = range.trim().toLowerCase();
+    if (tag.length === 0) continue;
+    let q = 1;
+    for (const parameter of parameters) {
+      const [name, value] = parameter.trim().split("=");
+      if (name?.trim() === "q") q = Number(value);
+    }
+    if (!Number.isFinite(q) || q <= 0 || q > 1) continue;
+    const primary = tag === "*" ? undefined : tag.split("-")[0];
+    const language = primary === undefined ? undefined : supported.find((candidate) => candidate === primary);
+    if (language !== undefined && (best === undefined || q > best.q)) best = { language, q };
+  }
+  return best?.language;
+}

package/core/app/runApp.ts

@@ -13,6 +13,7 @@ import { missingCacheModuleCheck } from "../cache/http/missingCacheModuleCheck";
 import { httpModule, useModelValidator, type HttpModuleOptions, type ModelValidator } from "../http";
 import { grpcModule, type GrpcModuleOptions } from "../grpc";
 import { buildHttpOpenApiDocument } from "../http/OpenApi/openApiDocument";
+import { defaultAuthorizeChecks } from "../http/Authorization/metadata";
 import { KernelBuilder, Bazis, KernelError, type KernelOptions, type ValidatableConfig } from "../kernel";
 import { websocketModule, type WebSocketOptions } from "../websocket";
 import {
@@ -20,7 +21,7 @@ import {
   type UiProfileV1,
 } from "../../library/ui";
 import { modelValidatorAdapter } from "../../library/validation";
-import { createLocalize, type AppLanguage, type AppMessages } from "./messages";
+import { createLanguages, type AppLanguage, type AppLanguageOptions, type AppMessages } from "./messages";
 import { useCodexLanguage } from "../infra/connectors/codex/contracts";
 import {
   type RunAppUiOptions,
@@ -65,8 +66,16 @@ export interface RunAppOptions {
    * ```ts
    * await runApp(AppModule, { language: "ru", http: { port: 3000 } });
    * ```
+   *
+   * Several languages — each request gets the best match of its
+   * `Accept-Language`, or `default`; such responses carry `Content-Language`
+   * and `Vary: Accept-Language`, and `ctx.language` names the choice:
+   *
+   * ```ts
+   * await runApp(AppModule, { language: { default: "ru", supported: ["ru", "en"] } });
+   * ```
    */
-  readonly language?: AppLanguage;
+  readonly language?: AppLanguage | AppLanguageOptions;
   /**
    * Own texts for single framework messages, on top of `language`:
    * `{ notFound: "Нет такой страницы", required: "Заполните {property}" }`.
@@ -204,6 +213,7 @@ function buildUiOpenApiDocument(
     controllers: collectModuleControllers([root]),
     globalPrefix: http.prefix,
     versioning: http.versioning,
+    authorize: defaultAuthorizeChecks(http.authorize),
     title: docs?.title ?? "Bazis UI profiles",
     version: docs?.version ?? "1.0.0",
   });
@@ -290,8 +300,8 @@ export async function runApp(root: BazisModuleRef, options: RunAppOptions = {}):
  */
 export function composeApp(root: BazisModuleRef, options: RunAppOptions = {}): BazisModuleRef {
   // Checked even without HTTP: an unknown language is a startup error.
-  const localize = createLocalize(options.language, options.messages);
-  useCodexLanguage(options.language ?? "en");
+  const languages = createLanguages(options.language, options.messages);
+  useCodexLanguage(typeof options.language === "object" ? options.language.default : options.language ?? "en");
   // Infrastructure and cache are global modules; add them to the graph next to the feature root.
   const globals: BazisModuleRef[] = [];
   if (options.infra !== undefined) {
@@ -329,7 +339,7 @@ export function composeApp(root: BazisModuleRef, options: RunAppOptions = {}): B
       options.http,
     );
     const httpRoot = httpModule({
-      localize,
+      languages,
       ...options.http,
       validator,
       imports: [httpAppRoot],

package/core/http/Authorization/authorizeComposer.ts

@@ -2,7 +2,7 @@ import { JwtError } from "../../../library/jwt/errors";
 import { ForbiddenError, UnauthorizedError } from "../Errors/HttpError";
 import type { HttpMiddleware } from "../Middleware/types";
 import type { RouteMiddlewareComposer } from "../options";
-import { resolveAuthorizeMeta } from "./metadata";
+import { routeAuthorizeChecks, type AuthorizeCheck } from "./metadata";
 
 /**
  * Built-in composer for `@Authorize`. The HTTP server puts it first among
@@ -12,14 +12,13 @@ import { resolveAuthorizeMeta } from "./metadata";
  * `UnauthorizedError` → `401`). A `JwtError` (missing, malformed, expired or
  * forged token) escaping a check is a 401 as well, not a server error.
  */
-export function createAuthorizeComposer(): RouteMiddlewareComposer {
+export function createAuthorizeComposer(defaults: readonly AuthorizeCheck[] = []): RouteMiddlewareComposer {
   return (controllerClass, methodName) => {
-    const meta = resolveAuthorizeMeta(controllerClass, methodName);
-    if (meta.allowAnonymous || meta.authorize === undefined) {
+    const checks = routeAuthorizeChecks(controllerClass, methodName, defaults);
+    if (checks === undefined) {
       return [];
     }
 
-    const { checks } = meta.authorize;
     const middleware: HttpMiddleware = async (ctx, next) => {
       for (const check of checks) {
         let allowed: boolean;

package/core/http/Authorization/metadata.ts

@@ -177,3 +177,20 @@ export function resolveAuthorizeMeta(ctor: object, methodName: string | symbol):
     ? { allowAnonymous: false }
     : { allowAnonymous: false, authorize: { checks } };
 }
+
+/**
+ * The checks a route runs: the server's default checks (`runApp({ http:
+ * { authorize } })`) first, then the route's own `@Authorize`; each function
+ * once. `undefined` — the route is open: `@AllowAnonymous`, or no checks at all.
+ */
+export function routeAuthorizeChecks(ctor: object, methodName: string | symbol, defaults: readonly AuthorizeCheck[] = []): readonly AuthorizeCheck[] | undefined {
+  const meta = resolveAuthorizeMeta(ctor, methodName);
+  if (meta.allowAnonymous) return undefined;
+  const checks = [...new Set([...defaults, ...(meta.authorize?.checks ?? [])])];
+  return checks.length === 0 ? undefined : checks;
+}
+
+/** `authorize` of the HTTP options as a list. */
+export function defaultAuthorizeChecks(option: AuthorizeCheck | readonly AuthorizeCheck[] | undefined): readonly AuthorizeCheck[] {
+  return option === undefined ? [] : typeof option === "function" ? [option] : option;
+}

package/core/http/Errors/messages.ts

@@ -8,6 +8,27 @@ export type MessageParams = Readonly<Record<string, unknown>>;
  */
 export type Localize = (key: string, params: MessageParams) => string | undefined;
 
+/** The response language of one request and its texts. */
+export interface SelectedLanguage {
+  readonly language: string;
+  readonly localize: Localize;
+}
+
+/**
+ * Picks the response language of a request. `negotiated`: several languages,
+ * chosen by `Accept-Language`; responses whose text the framework wrote then
+ * carry `Content-Language` and `Vary: Accept-Language`.
+ */
+export interface LanguageSelection {
+  readonly negotiated: boolean;
+  select(acceptLanguage: string | null | undefined): SelectedLanguage;
+}
+
+/** Headers of a framework-written response in a negotiated language. */
+export function languageHeaders(selection: LanguageSelection | undefined, selected: SelectedLanguage | undefined): [string, string][] {
+  return selection?.negotiated === true && selected !== undefined ? [["content-language", selected.language], ["vary", "Accept-Language"]] : [];
+}
+
 /** A message key and parameters carried by an error, rendered at the response. */
 export interface LocalizedMessage {
   readonly key: string;

package/core/http/HttpContext/HttpContext.ts

@@ -46,6 +46,12 @@ export class HttpContext {
     readonly clientIp?: string,
     /** Validator captured by the owning HTTP server. */
     readonly modelValidator?: ModelValidator,
+    /**
+     * Response language of this request: `runApp({ language })`, or the best
+     * match of `Accept-Language` when several languages are supported.
+     * `undefined` without `language`.
+     */
+    readonly language?: string,
   ) {}
 
   get method(): string {

package/core/http/HttpServer.ts

@@ -15,6 +15,7 @@ import type { HttpMiddleware } from "./Middleware/types";
 import { prepareOpenApiDocs, serveOpenApiDocs } from "./OpenApi/openApiDocs";
 import type { PreparedOpenApiDocs } from "../../library/openapi";
 import { RouterBuilder } from "./Routing/RouterBuilder";
+import { defaultAuthorizeChecks } from "./Authorization/metadata";
 import type { Router } from "./Routing/Router";
 import { parseRequestPath } from "./Routing/template";
 import { assertVersioningOptions, createVersionReader, type VersionReader } from "./Versioning/VersionReader";
@@ -22,7 +23,7 @@ import { HTTP_ERROR_HOOK, ROUTE_MIDDLEWARE_COMPOSER, SERVER_MIDDLEWARE, sortByOr
 import type { HealthEndpointOptions, RouteMiddlewareComposer, HttpModuleOptions, HttpServerOptions } from "./options";
 import { WEBSOCKET_UPGRADE, type WebSocketUpgrade } from "./WebSocketUpgrade";
 import { HttpSetupError } from "./Errors/HttpError";
-import { EN_HTTP_MESSAGES, formatMessage, type HttpMessageKey, type MessageParams } from "./Errors/messages";
+import { EN_HTTP_MESSAGES, formatMessage, languageHeaders, type HttpMessageKey, type MessageParams, type SelectedLanguage } from "./Errors/messages";
 import { getModelValidator, type ModelValidator } from "./Binding/modelValidator";
 
 const DEFAULT_MAX_BODY_BYTES = 1024 * 1024;
@@ -167,7 +168,7 @@ export class HttpServer implements HostedService {
       errorHandler({
         exposeDetails,
         ...(errorLogger ? { logger: errorLogger } : {}),
-        ...(this.options.localize ? { localize: this.options.localize } : {}),
+        ...(this.options.languages ? { languages: this.options.languages } : {}),
         ...this.options.errorHandler,
         onUnexpectedError: this.collectErrorHook(),
       }),
@@ -177,11 +178,13 @@ export class HttpServer implements HostedService {
     this.globalCors = this.options.cors || serverMiddleware.map(corsOptionsOf).find((options) => options !== undefined);
     serverChain.push(...serverMiddleware.filter((middleware) => !isCorrelationIdMiddleware(middleware)));
 
+    const defaultChecks = defaultAuthorizeChecks(this.options.authorize);
     const builder = new RouterBuilder(
       serverChain,
       this.options.prefix,
       this.options.versioning,
       this.collectRouteComposer(),
+      defaultChecks,
     );
     this.router = builder.build(this.options.controllers);
     const routes = builder.routes;
@@ -192,6 +195,7 @@ export class HttpServer implements HostedService {
       globalPrefix: this.options.prefix,
       versioning: this.options.versioning,
       environment: this.resolver.tryResolve(Environment),
+      authorize: defaultChecks,
     });
 
     this.webSocket = this.resolver.tryResolve(WEBSOCKET_UPGRADE);
@@ -204,7 +208,7 @@ export class HttpServer implements HostedService {
         await ws.initialize();
         this.server = await this.startBunServer((listen) => Bun.serve({
           ...listen,
-          error: (error) => this.transportError(error),
+          error: (error) => this.transportError(error, undefined),
           websocket: ws.createBunHandler(),
           fetch: async (request, server) => {
             // null -> not for the WS runtime, fall through to HTTP.
@@ -230,7 +234,7 @@ export class HttpServer implements HostedService {
         Bun.serve({
           ...listen,
           fetch: (request, server) => this.dispatch(request, server.requestIP(request)?.address),
-          error: (error) => this.transportError(error),
+          error: (error) => this.transportError(error, undefined),
         }),
       );
     }
@@ -380,29 +384,44 @@ export class HttpServer implements HostedService {
     } catch (error) {
       // Covers failures before a request context can be created. Normal route
       // and short-circuit failures are handled by the configured error boundary.
-      response = this.prepareClientResponse(this.transportError(error), request);
+      response = this.prepareClientResponse(this.transportError(error, request), request);
     }
     // HEAD must echo the GET response's status/headers without a body.
     return request.method === "HEAD" ? stripBody(response) : response;
   }
 
-  /** A response text the server writes itself, in the application language. */
-  private text(key: HttpMessageKey, params: MessageParams = {}): string {
+  /** The response language of a request; `undefined` without `runApp({ language })`. */
+  private selected(request: Request | undefined): SelectedLanguage | undefined {
+    try {
+      return this.options.languages?.select(request?.headers.get("accept-language"));
+    } catch {
+      return undefined;
+    }
+  }
+
+  /** A response text the server writes itself, in the language of the request. */
+  private text(key: HttpMessageKey, request: Request | undefined, params: MessageParams = {}): string {
     const english = formatMessage(EN_HTTP_MESSAGES[key], params);
     try {
-      return this.options.localize?.(key, params) ?? english;
+      return this.selected(request)?.localize(key, params) ?? english;
     } catch {
       return english;
     }
   }
 
-  private transportError(error: unknown): Response {
+  /** `{ error, …extra }` the server writes itself, with the language headers when negotiated. */
+  private errorJson(request: Request | undefined, status: number, key: HttpMessageKey, extra: Record<string, unknown> = {}, headers: Record<string, string> = {}): Response {
+    const language = Object.fromEntries(languageHeaders(this.options.languages, this.selected(request)));
+    return json(status, { error: this.text(key, request), ...extra }, { ...headers, ...language });
+  }
+
+  private transportError(error: unknown, request: Request | undefined): Response {
     try {
       console.error("[http] transport failed:", redactSensitive(error));
     } catch {
       // Best-effort diagnostics only.
     }
-    const response = json(500, { error: this.text("internalServerError") });
+    const response = this.errorJson(request, 500, "internalServerError");
     if (this.options.securityHeaders !== false) {
       applySecurityHeaders(response, this.options.securityHeaders ?? {});
     }
@@ -446,9 +465,9 @@ export class HttpServer implements HostedService {
     if (!segments) {
       if (this.maxBodyBytes !== undefined && exceedsBodyLimit(request, this.maxBodyBytes)) {
         return this.runShortCircuit(request, url, clientIp, () =>
-          json(413, { error: this.text("payloadTooLarge"), details: { maxBytes: this.maxBodyBytes } }));
+          this.errorJson(request, 413, "payloadTooLarge", { details: { maxBytes: this.maxBodyBytes } }));
       }
-      return this.runShortCircuit(request, url, clientIp, () => json(400, { error: this.text("malformedPath") }));
+      return this.runShortCircuit(request, url, clientIp, () => this.errorJson(request, 400, "malformedPath"));
     }
 
     const match = this.router!.match(request.method, segments, this.readVersion(request, url));
@@ -457,18 +476,18 @@ export class HttpServer implements HostedService {
       : this.maxBodyBytes;
     if (effectiveMaxBodyBytes !== undefined && exceedsBodyLimit(request, effectiveMaxBodyBytes)) {
       return this.runShortCircuit(request, url, clientIp, () =>
-        json(413, { error: this.text("payloadTooLarge"), details: { maxBytes: effectiveMaxBodyBytes } }));
+        this.errorJson(request, 413, "payloadTooLarge", { details: { maxBytes: effectiveMaxBodyBytes } }));
     }
     if (match.kind === "not-found") {
-      return this.runShortCircuit(request, url, clientIp, () => json(404, { error: this.text("notFound") }));
+      return this.runShortCircuit(request, url, clientIp, () => this.errorJson(request, 404, "notFound"));
     }
     if (match.kind === "method-not-allowed") {
       return this.runShortCircuit(request, url, clientIp, () =>
-        json(405, { error: this.text("methodNotAllowed") }, { allow: match.allow.join(", ") }));
+        this.errorJson(request, 405, "methodNotAllowed", {}, { allow: match.allow.join(", ") }));
     }
     if (match.kind === "unsupported-version") {
       return this.runShortCircuit(request, url, clientIp, () =>
-        json(400, { error: this.text("unsupportedApiVersion"), details: { supported: match.supported } }));
+        this.errorJson(request, 400, "unsupportedApiVersion", { details: { supported: match.supported } }));
     }
 
     const scope = this.provider.createScope();
@@ -481,13 +500,14 @@ export class HttpServer implements HostedService {
       effectiveMaxBodyBytes,
       clientIp,
       this.modelValidator,
+      this.selected(request)?.language,
     );
     let scopeTransferred = false;
     try {
       await runPipeline(match.action.chain, ctx);
       // The error boundary always sets a response on failure; an empty
       // response here means no middleware produced one.
-      const response = this.prepareClientResponse(ctx.response ?? json(404, { error: this.text("notFound") }), request);
+      const response = this.prepareClientResponse(ctx.response ?? this.errorJson(request, 404, "notFound"), request);
       if (request.method === "HEAD") return stripBody(response);
       if (!response.body) return response;
       this.trackResponse(holdResponseScope(response, request.signal, () =>
@@ -525,6 +545,7 @@ export class HttpServer implements HostedService {
       this.maxBodyBytes,
       clientIp,
       this.modelValidator,
+      this.selected(request)?.language,
     );
     const terminal: HttpMiddleware = async (context) => {
       context.response = await produce();
@@ -532,7 +553,7 @@ export class HttpServer implements HostedService {
     let scopeTransferred = false;
     try {
       await runPipeline([...this.shortCircuitChain, terminal], ctx);
-      const response = this.prepareClientResponse(ctx.response ?? json(500, { error: this.text("internalServerError") }), request);
+      const response = this.prepareClientResponse(ctx.response ?? this.errorJson(request, 500, "internalServerError"), request);
       if (request.method === "HEAD") return stripBody(response);
       if (!response.body) return response;
       this.trackResponse(holdResponseScope(response, request.signal, () =>

package/core/http/Middleware/errorHandler.ts

@@ -3,7 +3,7 @@ import { redactSensitive, redactSensitiveText } from "../../../library/redaction
 import { HttpClientError, HttpErrorCode } from "../../../library/http-client/errors";
 import type { HttpContext } from "../HttpContext/HttpContext";
 import { HttpError, ModelValidationError } from "../Errors/HttpError";
-import { EN_HTTP_MESSAGES, STATUS_MESSAGE_KEYS, type HttpMessageKey, type Localize } from "../Errors/messages";
+import { EN_HTTP_MESSAGES, STATUS_MESSAGE_KEYS, type HttpMessageKey, languageHeaders, type LanguageSelection, type Localize } from "../Errors/messages";
 import { upstreamFailure } from "../Errors/upstreamFailure";
 import type { HttpMiddleware } from "./types";
 
@@ -36,11 +36,11 @@ export interface ErrorHandlerOptions {
   logger?: Logger;
   /**
    * Renders framework texts (`Not Found`, validation messages, …) in the
-   * application language; `runApp` builds it from `language` and `messages`.
-   * Without it the texts stay English. Messages an application passes to an
-   * error itself are never changed.
+   * response language of each request; `runApp` builds it from `language` and
+   * `messages`. Without it the texts stay English. Messages an application
+   * passes to an error itself are never changed.
    */
-  localize?: Localize;
+  languages?: LanguageSelection;
 }
 
 function jsonResponse(status: number, body: unknown, extraHeaders?: readonly [string, string][]): Response {
@@ -111,13 +111,15 @@ function safelyReportUnexpected(
  */
 export function errorHandler(options: ErrorHandlerOptions = {}): HttpMiddleware {
   const log = resolveErrorLog(options);
-  const text = textRenderer(options.localize);
   return async (ctx, next) => {
     try {
       await next();
     } catch (error) {
+      const selected = options.languages?.select(ctx.header("accept-language"));
+      const text = textRenderer(selected?.localize);
+      const language = languageHeaders(options.languages, selected);
       if (error instanceof HttpError) {
-        const extra: [string, string][] = [];
+        const extra: [string, string][] = [...language];
         const allow = (error as { allow?: readonly string[] }).allow;
         if (allow) {
           extra.push(["allow", allow.join(", ")]);
@@ -159,8 +161,8 @@ export function errorHandler(options: ErrorHandlerOptions = {}): HttpMiddleware
             // message must not reach a browser or a shared screenshot.
             message: redactSensitiveText(error instanceof Error ? error.message : String(error)),
             stack: error instanceof Error && error.stack !== undefined ? redactSensitiveText(error.stack) : undefined,
-          })
-        : safeJsonResponse(status, { error: title });
+          }, language)
+        : safeJsonResponse(status, { error: title }, language);
     }
   };
 }

package/core/http/OpenApi/openApiDocs.ts

@@ -1,3 +1,4 @@
+import type { AuthorizeCheck } from "../Authorization/metadata";
 import type { Class } from "../../di";
 import { Environment } from "../../kernel";
 import {
@@ -15,6 +16,7 @@ interface PrepareOpenApiDocsInput {
   readonly globalPrefix?: string;
   readonly versioning?: ApiVersioningOptions;
   readonly environment?: Environment;
+  readonly authorize?: readonly AuthorizeCheck[];
 }
 
 const DEFAULT_UI_PATH = "/docs";
@@ -38,6 +40,7 @@ export function prepareOpenApiDocs(input: PrepareOpenApiDocsInput): PreparedOpen
     versioning: input.versioning,
     title,
     version,
+    ...(input.authorize === undefined ? {} : { authorize: input.authorize }),
   });
   const json = JSON.stringify(document, null, 2);
   return {

package/core/http/OpenApi/openApiDocument.ts

@@ -8,7 +8,7 @@ import {
   type OpenApiSchema,
 } from "../../../library/openapi";
 import { optionsFromSchema } from "../../../library/jsonapi";
-import { resolveAuthorizeMeta } from "../Authorization/metadata";
+import { resolveAuthorizeMeta, routeAuthorizeChecks, type AuthorizeCheck } from "../Authorization/metadata";
 import type { ParameterBinding } from "../Binding/bindings";
 import { resolveGeneratedBindings } from "../Binding/autoBindings";
 import { controllerMetaOf, type ActionMeta, type ControllerMeta } from "../Decorators/metadata";
@@ -23,6 +23,8 @@ export interface HttpOpenApiDocumentBuildInput {
   readonly versioning?: ApiVersioningOptions;
   readonly title: string;
   readonly version: string;
+  /** Default checks of `runApp({ http: { authorize } })`: such routes are secured too. */
+  readonly authorize?: readonly AuthorizeCheck[];
 }
 
 /** Body of every error response: `{ "error": "...", "details": ... }` (see Middleware/errorHandler). */
@@ -80,6 +82,7 @@ function collectOpenApiOperations(
           routeTemplate: joinPaths(meta.prefix, route.template),
           versioning: input.versioning,
           generated,
+          defaultChecks: input.authorize ?? [],
         }));
       }
     }
@@ -98,6 +101,7 @@ interface CreateOperationInput {
   readonly routeTemplate: string;
   readonly versioning?: ApiVersioningOptions;
   readonly generated: GeneratedOpenApiMetadata;
+  readonly defaultChecks: readonly AuthorizeCheck[];
 }
 
 function createOperation(input: CreateOperationInput): OpenApiCatalogOperation {
@@ -108,7 +112,7 @@ function createOperation(input: CreateOperationInput): OpenApiCatalogOperation {
   const status = String(successStatus(input.httpMethod, input.action, generatedOperation?.status));
   const responseSchema = generatedOperation?.response;
   const contentType = input.action.produces ?? "application/json";
-  const authorized = !auth.allowAnonymous && auth.authorize !== undefined;
+  const authorized = routeAuthorizeChecks(input.controllerClass, input.methodName, input.defaultChecks) !== undefined;
 
   return {
     path: input.path,

package/core/http/Routing/RouterBuilder.ts

@@ -10,7 +10,7 @@ import { corsOptionsOf } from "../Middleware/cors";
 import { normalizeResult } from "../Results/normalize";
 import type { ApiVersioningOptions, RouteMiddlewareComposer } from "../options";
 import { createAuthorizeComposer } from "../Authorization/authorizeComposer";
-import { resolveAuthorizeMeta } from "../Authorization/metadata";
+import { resolveAuthorizeMeta, routeAuthorizeChecks, type AuthorizeCheck } from "../Authorization/metadata";
 
 /** A registered route as the startup screen lists it. */
 export interface RegisteredRoute {
@@ -39,7 +39,7 @@ interface ActionPipeline {
  * precompiled per route — request dispatch performs no metadata work at all.
  */
 export class RouterBuilder {
-  private readonly authorizeComposer = createAuthorizeComposer();
+  private readonly authorizeComposer: RouteMiddlewareComposer;
   /** Every route of the last {@link build}, in registration order. */
   readonly routes: RegisteredRoute[] = [];
 
@@ -49,7 +49,11 @@ export class RouterBuilder {
     private readonly globalPrefix: string | undefined,
     private readonly versioning: ApiVersioningOptions | undefined,
     private readonly routeMiddlewareComposer?: RouteMiddlewareComposer,
-  ) {}
+    /** Checks for every route that is not `@AllowAnonymous`. */
+    private readonly defaultChecks: readonly AuthorizeCheck[] = [],
+  ) {
+    this.authorizeComposer = createAuthorizeComposer(defaultChecks);
+  }
 
   build(controllers: readonly Class<object>[]): Router {
     const router = new Router();
@@ -110,7 +114,7 @@ export class RouterBuilder {
           method: declaration.httpMethod,
           path: fullPath,
           handler: routeAction.name,
-          open: access.allowAnonymous === true || access.authorize === undefined,
+          open: routeAuthorizeChecks(controllerClass, methodName, this.defaultChecks) === undefined,
           anonymous: access.allowAnonymous === true,
         }));
       }

package/core/http/options.ts

@@ -2,12 +2,13 @@ import type { Class } from "../di";
 import type { AccessLogOptions } from "./Middleware/accessLog";
 import type { CorsOptions } from "./Middleware/cors";
 import type { ErrorHandlerOptions } from "./Middleware/errorHandler";
-import type { Localize } from "./Errors/messages";
+import type { LanguageSelection } from "./Errors/messages";
 import type { SecurityHeadersOptions } from "./Middleware/securityHeaders";
 import type { HttpMiddleware } from "./Middleware/types";
 import type { ActionMeta, ControllerMeta } from "./Decorators/metadata";
 import type { OpenApiDocsOptions } from "../../library/openapi";
 import type { ModelValidator } from "./Binding/modelValidator";
+import type { AuthorizeCheck } from "./Authorization/metadata";
 
 /** Built-in health endpoint (liveness/readiness probe). */
 export interface HealthEndpointOptions {
@@ -60,11 +61,11 @@ export interface HttpModuleOptions {
   /** Request-model validator captured by this HTTP server instance. */
   readonly validator?: ModelValidator;
   /**
-   * Renders framework response texts in the application language. `runApp`
+   * Response language of each request and its framework texts. `runApp`
    * sets it from its `language` and `messages` options; without it the
    * texts are English.
    */
-  readonly localize?: Localize;
+  readonly languages?: LanguageSelection;
   /**
    * Modules providing the controllers' dependencies. Controllers live inside
    * the returned HttpModule, so their dependencies must be visible to it:
@@ -129,6 +130,16 @@ export interface HttpModuleOptions {
    * title/version.
    */
   readonly docs?: OpenApiDocsOptions | boolean;
+  /**
+   * Closed by default: these checks run on every route that is not
+   * `@AllowAnonymous`, before the route's own `@Authorize` checks
+   * (like ASP.NET Core's fallback policy). `/health` and the docs stay open.
+   *
+   * ```ts
+   * runApp(AppModule, { http: { authorize: signedIn } });
+   * ```
+   */
+  readonly authorize?: AuthorizeCheck | readonly AuthorizeCheck[];
   /**
    * Access log for every request (method, path, status, duration, correlation
    * id). `true` enables the default single-line sink; pass an object to plug a

package/core/infra/connectors/codex/CodexAppServerClient.ts

@@ -232,7 +232,7 @@ export class CodexAppServerClient implements CodexClient {
         if (method === "account/updated") this.modelCache = undefined;
       }, () => { this.clearLogin(); this.modelCache = undefined; });
       const initialized = await client.request("initialize", {
-        clientInfo: { name: "bazis", title: "Bazis", version: "0.107.0" }, capabilities: { experimentalApi: true },
+        clientInfo: { name: "bazis", title: "Bazis", version: "0.108.0" }, capabilities: { experimentalApi: true },
       }, 15_000, signal);
       if (resolve(text(initialized.codexHome, 4096)) !== this.paths.home) throw new CodexError("PROTOCOL_ERROR");
       client.notify("initialized");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.107.0",
+  "version": "0.108.0",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",