bazis 0.109.1 → 0.110.1

package/core/app/runApp.ts

@@ -15,6 +15,7 @@ import { grpcModule, type GrpcModuleOptions } from "../grpc";
 import { buildHttpOpenApiDocument } from "../http/OpenApi/openApiDocument";
 import { defaultAuthorizeChecks } from "../http/Authorization/metadata";
 import { KernelBuilder, Bazis, KernelError, type KernelOptions, type ValidatableConfig } from "../kernel";
+import { reportBuildFailure } from "../kernel/Bazis";
 import { websocketModule, type WebSocketOptions } from "../websocket";
 import {
   isUiProfileAuthoringClass,
@@ -287,7 +288,14 @@ function normalizeAbsolutePath(path: string): string {
  */
 export async function runApp(root: BazisModuleRef, options: RunAppOptions = {}): Promise<number> {
   await loadBazisGeneratedRuntime();
-  return Bazis.run(composeApp(root, options), options.kernel, (builder) => {
+  let app: BazisModuleRef;
+  try {
+    app = composeApp(root, options);
+  } catch (error) {
+    // Composing already reads routes and options: report its errors like the kernel build does.
+    return reportBuildFailure(error);
+  }
+  return Bazis.run(app, options.kernel, (builder) => {
     builder.useApplicationRoot(root);
     options.configure?.(builder);
   });

package/core/http/Authorization/metadata.ts

@@ -1,4 +1,5 @@
 import type { ServiceScope } from "../../di";
+import { HttpSetupError } from "../Errors/HttpError";
 
 // Same one-line polyfill as the rest of the HTTP module: Bun executes TC39
 // decorators natively, but Symbol.metadata may be missing in the runtime.
@@ -46,6 +47,8 @@ interface AuthActionMeta {
   allowAnonymous?: boolean;
   /** Declaration made on this exact class/method metadata object. */
   declaration?: "authorize" | "anonymous";
+  /** Both `@Authorize` and `@AllowAnonymous` were declared here. */
+  conflict?: true;
 }
 
 interface AuthControllerMeta {
@@ -53,6 +56,8 @@ interface AuthControllerMeta {
   allowAnonymous?: boolean;
   /** Declaration made on this exact class metadata object. */
   declaration?: "authorize" | "anonymous";
+  /** Both `@Authorize` and `@AllowAnonymous` were declared on the class. */
+  conflict?: true;
   actions: Map<string | symbol, AuthActionMeta>;
 }
 
@@ -105,8 +110,15 @@ function ownActionMeta(metadata: object, methodName: string | symbol): AuthActio
   return action;
 }
 
+// The other declaration on the same class or method: each would silently undo
+// the other and the decorator order would decide. Reported when routes are built.
+function markConflict(target: { declaration?: "authorize" | "anonymous"; conflict?: true }, declaration: "authorize" | "anonymous"): void {
+  if (target.declaration !== undefined && target.declaration !== declaration) target.conflict = true;
+}
+
 export function setControllerAuthorize(metadata: object, options: AuthorizeOptions): void {
   const meta = ownMeta(metadata);
+  markConflict(meta, "authorize");
   meta.authorize = meta.declaration === "authorize" && meta.authorize
     ? { checks: [...options.checks, ...meta.authorize.checks] }
     : options;
@@ -116,6 +128,7 @@ export function setControllerAuthorize(metadata: object, options: AuthorizeOptio
 
 export function setControllerAllowAnonymous(metadata: object): void {
   const meta = ownMeta(metadata);
+  markConflict(meta, "anonymous");
   meta.allowAnonymous = true;
   meta.declaration = "anonymous";
   delete meta.authorize;
@@ -123,6 +136,7 @@ export function setControllerAllowAnonymous(metadata: object): void {
 
 export function setActionAuthorize(metadata: object, methodName: string | symbol, options: AuthorizeOptions): void {
   const action = ownActionMeta(metadata, methodName);
+  markConflict(action, "authorize");
   action.authorize = action.declaration === "authorize" && action.authorize
     ? { checks: [...options.checks, ...action.authorize.checks] }
     : options;
@@ -132,6 +146,7 @@ export function setActionAuthorize(metadata: object, methodName: string | symbol
 
 export function setActionAllowAnonymous(metadata: object, methodName: string | symbol): void {
   const action = ownActionMeta(metadata, methodName);
+  markConflict(action, "anonymous");
   action.allowAnonymous = true;
   action.declaration = "anonymous";
   delete action.authorize;
@@ -153,6 +168,7 @@ export interface ResolvedAuthorizeMeta {
  *
  * Inheritance is different: a subclass's own class-level declaration replaces
  * the base class's, and an overriding method's declaration replaces the base method's.
+ * Both decorators on the same class or method throw `HttpSetupError`.
  */
 export function resolveAuthorizeMeta(ctor: object, methodName: string | symbol): ResolvedAuthorizeMeta {
   const metadata = (ctor as { [key: symbol]: unknown })[Symbol.metadata as unknown as symbol] as
@@ -163,7 +179,20 @@ export function resolveAuthorizeMeta(ctor: object, methodName: string | symbol):
     return { allowAnonymous: false };
   }
 
+  const owner = (ctor as { readonly name?: string }).name || "Controller";
+  if (meta.conflict) {
+    throw new HttpSetupError(
+      `${owner} has both @AllowAnonymous() and @Authorize(...) on the class: the result would depend on the decorator order. `
+        + "Keep one; to open single methods of a protected class, put @AllowAnonymous() on them.",
+    );
+  }
   const action = meta.actions.get(methodName);
+  if (action?.conflict) {
+    throw new HttpSetupError(
+      `${owner}.${String(methodName)} has both @AllowAnonymous() and @Authorize(...): the result would depend on the decorator order. `
+        + "Keep @Authorize(...) to protect the route, or @AllowAnonymous() to open it.",
+    );
+  }
   if (action?.allowAnonymous) {
     return { allowAnonymous: true };
   }

package/core/infra/connectors/codex/CodexAppServerClient.ts

@@ -232,7 +232,7 @@ export class CodexAppServerClient implements CodexClient {
         if (method === "account/updated") this.modelCache = undefined;
       }, () => { this.clearLogin(); this.modelCache = undefined; });
       const initialized = await client.request("initialize", {
-        clientInfo: { name: "bazis", title: "Bazis", version: "0.109.1" }, capabilities: { experimentalApi: true },
+        clientInfo: { name: "bazis", title: "Bazis", version: "0.110.1" }, capabilities: { experimentalApi: true },
       }, 15_000, signal);
       if (resolve(text(initialized.codexHome, 4096)) !== this.paths.home) throw new CodexError("PROTOCOL_ERROR");
       client.notify("initialized");

package/core/kernel/Bazis.ts

@@ -47,17 +47,7 @@ export class Bazis {
     try {
       kernel = await builder.build();
     } catch (error) {
-      if (screen !== undefined && !(error instanceof ShutdownTimeoutError)) {
-        screen.failed(error, undefined, builder.report);
-        process.exitCode = 1;
-        return 1;
-      }
-      if (error instanceof DiError || error instanceof KernelError) {
-        console.error(`[bazis] configuration error: ${redactSensitiveText(error.message)}`);
-        process.exitCode = 1;
-        return 1;
-      }
-      throw error;
+      return reportBuildFailure(error, screen, builder.report);
     }
 
     try {
@@ -96,3 +86,27 @@ export class Bazis {
     }
   }
 }
+
+/**
+ * @internal How a start that failed before the kernel was built is reported:
+ * the startup screen on a terminal, otherwise one `[bazis] configuration error`
+ * line for DI and kernel errors. Returns exit code 1; anything else is rethrown.
+ * `runApp` uses it for errors found while it composes the application.
+ */
+export function reportBuildFailure(
+  error: unknown,
+  screen: StartupScreen | undefined = startupScreenEnabled() ? new StartupScreen() : undefined,
+  report?: KernelBuilder["report"],
+): number {
+  if (screen !== undefined && !(error instanceof ShutdownTimeoutError)) {
+    screen.failed(error, undefined, report);
+    process.exitCode = 1;
+    return 1;
+  }
+  if (error instanceof DiError || error instanceof KernelError) {
+    console.error(`[bazis] configuration error: ${redactSensitiveText(error.message)}`);
+    process.exitCode = 1;
+    return 1;
+  }
+  throw error;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.109.1",
+  "version": "0.110.1",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",