quidproquo-webserver 0.1.19 → 0.1.21

package/lib/esm/types/OpenApiDocument.d.ts

@@ -0,0 +1,60 @@
+import { JsonSchema } from '../config/types/JsonSchema';
+export type OpenApiParameter = {
+    name: string;
+    in: 'path' | 'query';
+    required: boolean;
+    schema: JsonSchema;
+    description?: string;
+};
+export type OpenApiMediaType = {
+    schema: JsonSchema;
+};
+export type OpenApiRequestBody = {
+    required: boolean;
+    content: {
+        'application/json': OpenApiMediaType;
+    };
+};
+export type OpenApiResponse = {
+    description: string;
+    content?: {
+        'application/json': OpenApiMediaType;
+    };
+};
+export type OpenApiSecurityRequirement = Record<string, string[]>;
+export type OpenApiOperation = {
+    operationId: string;
+    summary?: string;
+    description?: string;
+    tags?: string[];
+    parameters?: OpenApiParameter[];
+    requestBody?: OpenApiRequestBody;
+    responses: Record<string, OpenApiResponse>;
+    security?: OpenApiSecurityRequirement[];
+};
+export type OpenApiPathItem = Partial<Record<'get' | 'post' | 'put' | 'patch' | 'delete' | 'options' | 'head', OpenApiOperation>>;
+export type OpenApiSecurityScheme = {
+    type: 'http';
+    scheme: 'bearer';
+    bearerFormat: 'JWT';
+} | {
+    type: 'apiKey';
+    in: 'header';
+    name: string;
+};
+export type OpenApiInfo = {
+    title: string;
+    version: string;
+    description?: string;
+};
+export type OpenApiDocument = {
+    openapi: '3.1.0';
+    info: OpenApiInfo;
+    servers: {
+        url: string;
+    }[];
+    paths: Record<string, OpenApiPathItem>;
+    components: {
+        securitySchemes: Record<string, OpenApiSecurityScheme>;
+    };
+};

package/lib/esm/types/OpenApiDocument.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=OpenApiDocument.js.map

package/lib/esm/types/OpenApiDocument.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenApiDocument.js","sourceRoot":"","sources":["../../../src/types/OpenApiDocument.ts"],"names":[],"mappings":"","sourcesContent":["import { JsonSchema } from '../config/types/JsonSchema';\n\n// The slice of OpenAPI 3.1 this framework emits. Anything the generator does not\n// produce (callbacks, links, examples) is deliberately absent rather than typed loosely.\nexport type OpenApiParameter = {\n  name: string;\n  in: 'path' | 'query';\n  required: boolean;\n  schema: JsonSchema;\n  description?: string;\n};\n\nexport type OpenApiMediaType = { schema: JsonSchema };\n\nexport type OpenApiRequestBody = {\n  required: boolean;\n  content: { 'application/json': OpenApiMediaType };\n};\n\nexport type OpenApiResponse = {\n  description: string;\n  content?: { 'application/json': OpenApiMediaType };\n};\n\nexport type OpenApiSecurityRequirement = Record<string, string[]>;\n\nexport type OpenApiOperation = {\n  operationId: string;\n  summary?: string;\n  description?: string;\n  tags?: string[];\n  parameters?: OpenApiParameter[];\n  requestBody?: OpenApiRequestBody;\n  responses: Record<string, OpenApiResponse>;\n  security?: OpenApiSecurityRequirement[];\n};\n\nexport type OpenApiPathItem = Partial<Record<'get' | 'post' | 'put' | 'patch' | 'delete' | 'options' | 'head', OpenApiOperation>>;\n\nexport type OpenApiSecurityScheme = { type: 'http'; scheme: 'bearer'; bearerFormat: 'JWT' } | { type: 'apiKey'; in: 'header'; name: string };\n\nexport type OpenApiInfo = {\n  title: string;\n  version: string;\n  description?: string;\n};\n\nexport type OpenApiDocument = {\n  openapi: '3.1.0';\n  info: OpenApiInfo;\n  servers: { url: string }[];\n  paths: Record<string, OpenApiPathItem>;\n  components: {\n    securitySchemes: Record<string, OpenApiSecurityScheme>;\n  };\n};\n"]}

package/lib/esm/types/index.d.ts

@@ -3,6 +3,7 @@ export * from './constants';
 export * from './EmailSendEvent';
 export * from './ExecuteServiceFunctionEvent';
 export * from './HTTPEvent';
+export * from './OpenApiDocument';
 export * from './SEOEvent';
 export * from './StorageDriveEvent';
 export * from './WebsocketEvent';

package/lib/esm/types/index.js

@@ -3,6 +3,7 @@ export * from './constants';
 export * from './EmailSendEvent';
 export * from './ExecuteServiceFunctionEvent';
 export * from './HTTPEvent';
+export * from './OpenApiDocument';
 export * from './SEOEvent';
 export * from './StorageDriveEvent';
 export * from './WebsocketEvent';

package/lib/esm/types/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC","sourcesContent":["export * from './CloudflareDnsDeployEvent';\nexport * from './constants';\nexport * from './EmailSendEvent';\nexport * from './ExecuteServiceFunctionEvent';\nexport * from './HTTPEvent';\nexport * from './SEOEvent';\nexport * from './StorageDriveEvent';\nexport * from './WebsocketEvent';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,aAAa,CAAC;AAC5B,cAAc,kBAAkB,CAAC;AACjC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC","sourcesContent":["export * from './CloudflareDnsDeployEvent';\nexport * from './constants';\nexport * from './EmailSendEvent';\nexport * from './ExecuteServiceFunctionEvent';\nexport * from './HTTPEvent';\nexport * from './OpenApiDocument';\nexport * from './SEOEvent';\nexport * from './StorageDriveEvent';\nexport * from './WebsocketEvent';\n"]}

package/lib/esm/utils/headerUtils.d.ts

@@ -1,12 +1,13 @@
 import { AskResponse, QPQConfig } from 'quidproquo-core';
-import { RouteOptions, ServiceAllowedOrigin } from '../config/settings/route';
+import { RouteOptions } from '../config/settings/route';
+import { DomainResolver } from '../domain/types/DomainResolver';
 import { SeoEvent } from '../types';
 import { HTTPEvent, HttpEventHeaders } from '../types/HTTPEvent';
 export declare const getHeaderValue: (header: string, headers: HttpEventHeaders) => string | null;
 export declare function askReadRequiredHeader(event: HTTPEvent, requiredHeader: string): AskResponse<string>;
 export declare function askReadRequiredHeaders(event: HTTPEvent, requiredHeaders: string[]): AskResponse<string[]>;
 export declare const getAccessTokenFromHeaders: (headers: HttpEventHeaders) => string | undefined;
-export declare const convertContentSecurityPolicyEntryToString: (baseDomain: string, allowedOrigin: ServiceAllowedOrigin | string) => string;
-export declare const getAllowedOrigins: (qpqConfig: QPQConfig, route: RouteOptions) => string[];
-export declare const getCorsHeaders: (qpqConfig: QPQConfig, route: RouteOptions, reqHeaders: HttpEventHeaders) => HttpEventHeaders;
+/** Site roots first (primary leads, so it is the fallback origin), then default and route entries, all lowercased. */
+export declare const getAllowedOrigins: (qpqConfig: QPQConfig, route: RouteOptions, resolver?: DomainResolver) => string[];
+export declare const getCorsHeaders: (qpqConfig: QPQConfig, route: RouteOptions, reqHeaders: HttpEventHeaders, resolver?: DomainResolver) => HttpEventHeaders;
 export declare const isBot: (event: HTTPEvent | SeoEvent<any>) => boolean;

package/lib/esm/utils/headerUtils.js

@@ -1,6 +1,8 @@
 import { askMap, askThrowError, ErrorTypeEnum } from 'quidproquo-core';
+import { resolveHosts } from '../domain/logic/host/resolveHosts';
+import { resolveOrigins } from '../domain/logic/origin/resolveOrigins';
 import { qpqHeaderIsBot } from '../types';
-import { getBaseDomainName, getDefaultRouteSettings } from './qpqConfigAccessorsUtils';
+import { getDefaultRouteSettings } from './qpqConfigAccessorsUtils';
 export const getHeaderValue = (header, headers) => {
     const headerAsLower = header.toLowerCase();
     const realHeaderKey = Object.keys(headers).find((k) => k.toLowerCase() === headerAsLower);
@@ -26,37 +28,23 @@ export const getAccessTokenFromHeaders = (headers) => {
     const [authType, authToken] = authorizationHeader.split(' ');
     return authToken;
 };
-export const convertContentSecurityPolicyEntryToString = (baseDomain, allowedOrigin) => {
-    if (typeof allowedOrigin === 'string') {
-        return allowedOrigin;
-    }
-    // Otherwise its a QpqServiceContentSecurityPolicy
-    const domain = allowedOrigin.domain || baseDomain;
-    const protocol = allowedOrigin.protocol || 'https';
-    if (allowedOrigin.service) {
-        return `${protocol}://${allowedOrigin.api}.${allowedOrigin.service}.${domain}`;
-    }
-    return `${protocol}://${allowedOrigin.api}.${domain}`;
-};
-export const getAllowedOrigins = (qpqConfig, route) => {
-    const baseDomain = getBaseDomainName(qpqConfig);
-    // Root domain
-    const rootDomain = `https://${baseDomain}`;
-    // generic settings
-    const defaultRouteSettings = getDefaultRouteSettings(qpqConfig);
-    const defaultAllowedOrigins = defaultRouteSettings.reduce((acc, cur) => [...acc, ...(cur.routeOptions.allowedOrigins || []).map((ao) => convertContentSecurityPolicyEntryToString(baseDomain, ao))], []);
-    // Route specific
-    const routeAllowedOrigins = (route.allowedOrigins || []).map((ao) => convertContentSecurityPolicyEntryToString(baseDomain, ao));
-    // Return the allowed origins
-    const allAllowedOrigins = [rootDomain, ...defaultAllowedOrigins, ...routeAllowedOrigins].map((o) => o.toLowerCase());
-    return allAllowedOrigins;
+/** Site roots first (primary leads, so it is the fallback origin), then default and route entries, all lowercased. */
+export const getAllowedOrigins = (qpqConfig, route, resolver) => {
+    const rootOrigins = resolveHosts(qpqConfig, {}, resolver).map((host) => `https://${host}`);
+    const defaultAllowedOrigins = getDefaultRouteSettings(qpqConfig).flatMap((setting) => (setting.routeOptions.allowedOrigins || []).flatMap((entry) => resolveOrigins(qpqConfig, entry, resolver)));
+    const routeAllowedOrigins = (route.allowedOrigins || []).flatMap((entry) => resolveOrigins(qpqConfig, entry, resolver));
+    return [...rootOrigins, ...defaultAllowedOrigins, ...routeAllowedOrigins].map((origin) => origin.toLowerCase());
 };
-export const getCorsHeaders = (qpqConfig, route, reqHeaders) => {
+export const getCorsHeaders = (qpqConfig, route, reqHeaders, resolver) => {
     const origin = getHeaderValue('origin', reqHeaders) || '';
-    const allowedOrigins = getAllowedOrigins(qpqConfig, route);
+    const allowedOrigins = getAllowedOrigins(qpqConfig, route, resolver);
     const allowCredentials = !!route.routeAuthSettings?.userDirectoryName;
     // If we have an auth endpoint, then we don't let wildcard origins access the API for security reasons
-    const allowOrigin = (!allowCredentials ? allowedOrigins.find((ao) => origin === ao || ao === '*') : allowedOrigins.find((ao) => origin === ao)) || allowedOrigins[0];
+    // A service with no domain declares nothing browser-facing, so an open origin is the
+    // only sensible fallback (the storage-drive cors default makes the same call).
+    const allowOrigin = (!allowCredentials ? allowedOrigins.find((ao) => origin === ao || ao === '*') : allowedOrigins.find((ao) => origin === ao)) ||
+        allowedOrigins[0] ||
+        '*';
     // Reflect exactly what the preflight asks for instead of a blanket '*'. A
     // literal '*' is invalid once credentials are allowed (browsers reject it),
     // so echoing the requested headers/method keeps authenticated routes working

package/lib/esm/utils/headerUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"headerUtils.js","sourceRoot":"","sources":["../../../src/utils/headerUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAe,aAAa,EAAE,aAAa,EAAa,MAAM,iBAAiB,CAAC;AAG/F,OAAO,EAAE,cAAc,EAAY,MAAM,UAAU,CAAC;AAEpD,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEvF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,OAAyB,EAAiB,EAAE;IACzF,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,CAAC;IAE1F,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;AACxC,CAAC,CAAC;AAEF,MAAM,SAAS,CAAC,CAAC,qBAAqB,CAAC,KAAgB,EAAE,cAAsB;IAC7E,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,cAAc,YAAY,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,sBAAsB,CAAC,KAAgB,EAAE,eAAyB;IACjF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAc;QAC7D,OAAO,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,OAAyB,EAAsB,EAAE;IACzF,MAAM,mBAAmB,GAAG,cAAc,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3E,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE7D,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,UAAkB,EAAE,aAA4C,EAAU,EAAE;IACpI,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,kDAAkD;IAClD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,UAAU,CAAC;IAElD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,IAAI,OAAO,CAAC;IAEnD,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,GAAG,QAAQ,MAAM,aAAa,CAAC,GAAG,IAAI,aAAa,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC;IACjF,CAAC;IAED,OAAO,GAAG,QAAQ,MAAM,aAAa,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC;AACxD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAoB,EAAE,KAAmB,EAAY,EAAE;IACvF,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAChD,cAAc;IACd,MAAM,UAAU,GAAG,WAAW,UAAU,EAAE,CAAC;IAE3C,mBAAmB;IACnB,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAEhE,MAAM,qBAAqB,GAAG,oBAAoB,CAAC,MAAM,CACvD,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,yCAAyC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,EACzI,EAAc,CACf,CAAC;IAEF,iBAAiB;IACjB,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,yCAAyC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;IAEhI,6BAA6B;IAC7B,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,GAAG,qBAAqB,EAAE,GAAG,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAErH,OAAO,iBAAiB,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAoB,EAAE,KAAmB,EAAE,UAA4B,EAAoB,EAAE;IAC1H,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IAE1D,MAAM,cAAc,GAAG,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE3D,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAEtE,sGAAsG;IACtG,MAAM,WAAW,GACf,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC;IAEnJ,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,iFAAiF;IACjF,MAAM,gBAAgB,GAAG,cAAc,CAAC,gCAAgC,EAAE,UAAU,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG,cAAc,CAAC,+BAA+B,EAAE,UAAU,CAAC,CAAC;IAEpF,OAAO;QACL,8BAA8B,EAAE,gBAAgB,IAAI,6BAA6B;QACjF,8BAA8B,EAAE,eAAe,IAAI,wCAAwC;QAC3F,6BAA6B,EAAE,WAAW;QAC1C,kCAAkC,EAAE,GAAG,gBAAgB,EAAE;QACzD,IAAI,EAAE,uEAAuE;KAC9E,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,KAAgC,EAAW,EAAE;IACjE,OAAO,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,MAAM,CAAC;AAClD,CAAC,CAAC","sourcesContent":["import { askMap, AskResponse, askThrowError, ErrorTypeEnum, QPQConfig } from 'quidproquo-core';\n\nimport { RouteOptions, ServiceAllowedOrigin } from '../config/settings/route';\nimport { qpqHeaderIsBot, SeoEvent } from '../types';\nimport { HTTPEvent, HttpEventHeaders } from '../types/HTTPEvent';\nimport { getBaseDomainName, getDefaultRouteSettings } from './qpqConfigAccessorsUtils';\n\nexport const getHeaderValue = (header: string, headers: HttpEventHeaders): string | null => {\n  const headerAsLower = header.toLowerCase();\n  const realHeaderKey = Object.keys(headers).find((k) => k.toLowerCase() === headerAsLower);\n\n  if (!realHeaderKey) {\n    return null;\n  }\n\n  return headers[realHeaderKey] || null;\n};\n\nexport function* askReadRequiredHeader(event: HTTPEvent, requiredHeader: string): AskResponse<string> {\n  const header = getHeaderValue(requiredHeader, event.headers);\n  if (!header) {\n    return yield* askThrowError(ErrorTypeEnum.NotFound, `Header ${requiredHeader} not found`);\n  }\n\n  return header;\n}\n\nexport function* askReadRequiredHeaders(event: HTTPEvent, requiredHeaders: string[]): AskResponse<string[]> {\n  return yield* askMap(requiredHeaders, function* (header: string) {\n    return yield* askReadRequiredHeader(event, header);\n  });\n}\n\nexport const getAccessTokenFromHeaders = (headers: HttpEventHeaders): string | undefined => {\n  const authorizationHeader = getHeaderValue('authorization', headers) || '';\n  const [authType, authToken] = authorizationHeader.split(' ');\n\n  return authToken;\n};\n\nexport const convertContentSecurityPolicyEntryToString = (baseDomain: string, allowedOrigin: ServiceAllowedOrigin | string): string => {\n  if (typeof allowedOrigin === 'string') {\n    return allowedOrigin;\n  }\n\n  // Otherwise its a QpqServiceContentSecurityPolicy\n  const domain = allowedOrigin.domain || baseDomain;\n\n  const protocol = allowedOrigin.protocol || 'https';\n\n  if (allowedOrigin.service) {\n    return `${protocol}://${allowedOrigin.api}.${allowedOrigin.service}.${domain}`;\n  }\n\n  return `${protocol}://${allowedOrigin.api}.${domain}`;\n};\n\nexport const getAllowedOrigins = (qpqConfig: QPQConfig, route: RouteOptions): string[] => {\n  const baseDomain = getBaseDomainName(qpqConfig);\n  // Root domain\n  const rootDomain = `https://${baseDomain}`;\n\n  // generic settings\n  const defaultRouteSettings = getDefaultRouteSettings(qpqConfig);\n\n  const defaultAllowedOrigins = defaultRouteSettings.reduce(\n    (acc, cur) => [...acc, ...(cur.routeOptions.allowedOrigins || []).map((ao) => convertContentSecurityPolicyEntryToString(baseDomain, ao))],\n    [] as string[],\n  );\n\n  // Route specific\n  const routeAllowedOrigins = (route.allowedOrigins || []).map((ao) => convertContentSecurityPolicyEntryToString(baseDomain, ao));\n\n  // Return the allowed origins\n  const allAllowedOrigins = [rootDomain, ...defaultAllowedOrigins, ...routeAllowedOrigins].map((o) => o.toLowerCase());\n\n  return allAllowedOrigins;\n};\n\nexport const getCorsHeaders = (qpqConfig: QPQConfig, route: RouteOptions, reqHeaders: HttpEventHeaders): HttpEventHeaders => {\n  const origin = getHeaderValue('origin', reqHeaders) || '';\n\n  const allowedOrigins = getAllowedOrigins(qpqConfig, route);\n\n  const allowCredentials = !!route.routeAuthSettings?.userDirectoryName;\n\n  // If we have an auth endpoint, then we don't let wildcard origins access the API for security reasons\n  const allowOrigin =\n    (!allowCredentials ? allowedOrigins.find((ao) => origin === ao || ao === '*') : allowedOrigins.find((ao) => origin === ao)) || allowedOrigins[0];\n\n  // Reflect exactly what the preflight asks for instead of a blanket '*'. A\n  // literal '*' is invalid once credentials are allowed (browsers reject it),\n  // so echoing the requested headers/method keeps authenticated routes working\n  // while staying scoped to the real request. The security boundary is the\n  // origin check above; these two just describe what that trusted origin may send.\n  const requestedHeaders = getHeaderValue('access-control-request-headers', reqHeaders);\n  const requestedMethod = getHeaderValue('access-control-request-method', reqHeaders);\n\n  return {\n    'Access-Control-Allow-Headers': requestedHeaders || 'Authorization, Content-Type',\n    'Access-Control-Allow-Methods': requestedMethod || 'GET, POST, PUT, PATCH, DELETE, OPTIONS',\n    'Access-Control-Allow-Origin': allowOrigin,\n    'Access-Control-Allow-Credentials': `${allowCredentials}`,\n    Vary: 'Origin, Access-Control-Request-Headers, Access-Control-Request-Method',\n  };\n};\n\nexport const isBot = (event: HTTPEvent | SeoEvent<any>): boolean => {\n  return event.headers[qpqHeaderIsBot] === 'true';\n};\n"]}
+{"version":3,"file":"headerUtils.js","sourceRoot":"","sources":["../../../src/utils/headerUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAe,aAAa,EAAE,aAAa,EAAa,MAAM,iBAAiB,CAAC;AAG/F,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAY,MAAM,UAAU,CAAC;AAEpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,OAAyB,EAAiB,EAAE;IACzF,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,CAAC;IAE1F,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;AACxC,CAAC,CAAC;AAEF,MAAM,SAAS,CAAC,CAAC,qBAAqB,CAAC,KAAgB,EAAE,cAAsB;IAC7E,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,cAAc,YAAY,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,SAAS,CAAC,CAAC,sBAAsB,CAAC,KAAgB,EAAE,eAAyB;IACjF,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAc;QAC7D,OAAO,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,OAAyB,EAAsB,EAAE;IACzF,MAAM,mBAAmB,GAAG,cAAc,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3E,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE7D,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,sHAAsH;AACtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAoB,EAAE,KAAmB,EAAE,QAAyB,EAAY,EAAE;IAClH,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAE3F,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACnF,CAAC,OAAO,CAAC,YAAY,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAC3G,CAAC;IAEF,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAExH,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,qBAAqB,EAAE,GAAG,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AAClH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,SAAoB,EACpB,KAAmB,EACnB,UAA4B,EAC5B,QAAyB,EACP,EAAE;IACpB,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IAE1D,MAAM,cAAc,GAAG,iBAAiB,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAErE,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAEtE,sGAAsG;IACtG,qFAAqF;IACrF,+EAA+E;IAC/E,MAAM,WAAW,GACf,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;QAC3H,cAAc,CAAC,CAAC,CAAC;QACjB,GAAG,CAAC;IAEN,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,iFAAiF;IACjF,MAAM,gBAAgB,GAAG,cAAc,CAAC,gCAAgC,EAAE,UAAU,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG,cAAc,CAAC,+BAA+B,EAAE,UAAU,CAAC,CAAC;IAEpF,OAAO;QACL,8BAA8B,EAAE,gBAAgB,IAAI,6BAA6B;QACjF,8BAA8B,EAAE,eAAe,IAAI,wCAAwC;QAC3F,6BAA6B,EAAE,WAAW;QAC1C,kCAAkC,EAAE,GAAG,gBAAgB,EAAE;QACzD,IAAI,EAAE,uEAAuE;KAC9E,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,KAAgC,EAAW,EAAE;IACjE,OAAO,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,MAAM,CAAC;AAClD,CAAC,CAAC","sourcesContent":["import { askMap, AskResponse, askThrowError, ErrorTypeEnum, QPQConfig } from 'quidproquo-core';\n\nimport { RouteOptions } from '../config/settings/route';\nimport { resolveHosts } from '../domain/logic/host/resolveHosts';\nimport { resolveOrigins } from '../domain/logic/origin/resolveOrigins';\nimport { DomainResolver } from '../domain/types/DomainResolver';\nimport { qpqHeaderIsBot, SeoEvent } from '../types';\nimport { HTTPEvent, HttpEventHeaders } from '../types/HTTPEvent';\nimport { getDefaultRouteSettings } from './qpqConfigAccessorsUtils';\n\nexport const getHeaderValue = (header: string, headers: HttpEventHeaders): string | null => {\n  const headerAsLower = header.toLowerCase();\n  const realHeaderKey = Object.keys(headers).find((k) => k.toLowerCase() === headerAsLower);\n\n  if (!realHeaderKey) {\n    return null;\n  }\n\n  return headers[realHeaderKey] || null;\n};\n\nexport function* askReadRequiredHeader(event: HTTPEvent, requiredHeader: string): AskResponse<string> {\n  const header = getHeaderValue(requiredHeader, event.headers);\n  if (!header) {\n    return yield* askThrowError(ErrorTypeEnum.NotFound, `Header ${requiredHeader} not found`);\n  }\n\n  return header;\n}\n\nexport function* askReadRequiredHeaders(event: HTTPEvent, requiredHeaders: string[]): AskResponse<string[]> {\n  return yield* askMap(requiredHeaders, function* (header: string) {\n    return yield* askReadRequiredHeader(event, header);\n  });\n}\n\nexport const getAccessTokenFromHeaders = (headers: HttpEventHeaders): string | undefined => {\n  const authorizationHeader = getHeaderValue('authorization', headers) || '';\n  const [authType, authToken] = authorizationHeader.split(' ');\n\n  return authToken;\n};\n\n/** Site roots first (primary leads, so it is the fallback origin), then default and route entries, all lowercased. */\nexport const getAllowedOrigins = (qpqConfig: QPQConfig, route: RouteOptions, resolver?: DomainResolver): string[] => {\n  const rootOrigins = resolveHosts(qpqConfig, {}, resolver).map((host) => `https://${host}`);\n\n  const defaultAllowedOrigins = getDefaultRouteSettings(qpqConfig).flatMap((setting) =>\n    (setting.routeOptions.allowedOrigins || []).flatMap((entry) => resolveOrigins(qpqConfig, entry, resolver)),\n  );\n\n  const routeAllowedOrigins = (route.allowedOrigins || []).flatMap((entry) => resolveOrigins(qpqConfig, entry, resolver));\n\n  return [...rootOrigins, ...defaultAllowedOrigins, ...routeAllowedOrigins].map((origin) => origin.toLowerCase());\n};\n\nexport const getCorsHeaders = (\n  qpqConfig: QPQConfig,\n  route: RouteOptions,\n  reqHeaders: HttpEventHeaders,\n  resolver?: DomainResolver,\n): HttpEventHeaders => {\n  const origin = getHeaderValue('origin', reqHeaders) || '';\n\n  const allowedOrigins = getAllowedOrigins(qpqConfig, route, resolver);\n\n  const allowCredentials = !!route.routeAuthSettings?.userDirectoryName;\n\n  // If we have an auth endpoint, then we don't let wildcard origins access the API for security reasons\n  // A service with no domain declares nothing browser-facing, so an open origin is the\n  // only sensible fallback (the storage-drive cors default makes the same call).\n  const allowOrigin =\n    (!allowCredentials ? allowedOrigins.find((ao) => origin === ao || ao === '*') : allowedOrigins.find((ao) => origin === ao)) ||\n    allowedOrigins[0] ||\n    '*';\n\n  // Reflect exactly what the preflight asks for instead of a blanket '*'. A\n  // literal '*' is invalid once credentials are allowed (browsers reject it),\n  // so echoing the requested headers/method keeps authenticated routes working\n  // while staying scoped to the real request. The security boundary is the\n  // origin check above; these two just describe what that trusted origin may send.\n  const requestedHeaders = getHeaderValue('access-control-request-headers', reqHeaders);\n  const requestedMethod = getHeaderValue('access-control-request-method', reqHeaders);\n\n  return {\n    'Access-Control-Allow-Headers': requestedHeaders || 'Authorization, Content-Type',\n    'Access-Control-Allow-Methods': requestedMethod || 'GET, POST, PUT, PATCH, DELETE, OPTIONS',\n    'Access-Control-Allow-Origin': allowOrigin,\n    'Access-Control-Allow-Credentials': `${allowCredentials}`,\n    Vary: 'Origin, Access-Control-Request-Headers, Access-Control-Request-Method',\n  };\n};\n\nexport const isBot = (event: HTTPEvent | SeoEvent<any>): boolean => {\n  return event.headers[qpqHeaderIsBot] === 'true';\n};\n"]}

package/lib/esm/utils/index.d.ts

@@ -1,8 +1,11 @@
+export * from '../configUtils';
+export * from '../domain/logic';
 export * from './headerUtils';
 export * from './httpEventUtils';
 export * from './jwtUtils';
 export * from './mergeRouteUtils';
 export * from './networkRequestUtils';
+export * from './openApi';
 export * from './pathUtils';
 export * from './preformNetworkRequest';
 export * from './qpqConfigAccessorsUtils';

package/lib/esm/utils/index.js

@@ -1,8 +1,11 @@
+export * from '../configUtils';
+export * from '../domain/logic';
 export * from './headerUtils';
 export * from './httpEventUtils';
 export * from './jwtUtils';
 export * from './mergeRouteUtils';
 export * from './networkRequestUtils';
+export * from './openApi';
 export * from './pathUtils';
 export * from './preformNetworkRequest';
 export * from './qpqConfigAccessorsUtils';

package/lib/esm/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,uBAAuB,CAAC","sourcesContent":["export * from './headerUtils';\nexport * from './httpEventUtils';\nexport * from './jwtUtils';\nexport * from './mergeRouteUtils';\nexport * from './networkRequestUtils';\nexport * from './pathUtils';\nexport * from './preformNetworkRequest';\nexport * from './qpqConfigAccessorsUtils';\nexport * from './urlUtils';\nexport * from './websocketEventUtils';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC;AAC3B,cAAc,uBAAuB,CAAC","sourcesContent":["export * from '../configUtils';\nexport * from '../domain/logic';\nexport * from './headerUtils';\nexport * from './httpEventUtils';\nexport * from './jwtUtils';\nexport * from './mergeRouteUtils';\nexport * from './networkRequestUtils';\nexport * from './openApi';\nexport * from './pathUtils';\nexport * from './preformNetworkRequest';\nexport * from './qpqConfigAccessorsUtils';\nexport * from './urlUtils';\nexport * from './websocketEventUtils';\n"]}

package/lib/esm/utils/mergeRouteUtils.js

@@ -10,6 +10,8 @@ export const mergeRouteOptions = (routeOptionsA, routeOptionsB) => {
     return {
         allowedOrigins: [...new Set([...(routeOptionsB.allowedOrigins || []), ...(routeOptionsA.allowedOrigins || [])])],
         routeAuthSettings: mergeRouteAuthSettings(routeOptionsA.routeAuthSettings, routeOptionsB.routeAuthSettings),
+        // Schemas describe one route, they are never shared defaults, so the more specific side wins outright
+        schema: routeOptionsB.schema ?? routeOptionsA.schema,
     };
 };
 export const mergeAllRouteOptions = (activeApi, routeConfig, qpqConfig) => {

package/lib/esm/utils/mergeRouteUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"mergeRouteUtils.js","sourceRoot":"","sources":["../../../src/utils/mergeRouteUtils.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,kBAAsC,EAAE,kBAAsC,EAAqB,EAAE;IAC1I,OAAO;QACL,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,IAAI,kBAAkB,EAAE,iBAAiB;QACjG,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,kBAAkB,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAEpG,OAAO,EAAE,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,kBAAkB,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAC9F,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACxB,GAAG,CAAC,SAAS,CACX,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,eAAe,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,CAC3I,KAAK,KAAK,CACd;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,aAA2B,EAAE,aAA2B,EAAgB,EAAE;IAC1G,OAAO;QACL,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChH,iBAAiB,EAAE,sBAAsB,CAAC,aAAa,CAAC,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,CAAC;KAC5G,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,SAAiB,EAAE,WAA2C,EAAE,SAAoB,EAAgB,EAAE;IACzI,sEAAsE;IACtE,YAAY;IACZ,MAAM,cAAc,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACrF,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC;IAEzC,OAAO,CAAC,GAAG,cAAc,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAkB,CAAC,CAAC;AACjH,CAAC,CAAC","sourcesContent":["import { QPQConfig } from 'quidproquo-core';\n\nimport { RouteAuthSettings, RouteQPQWebServerConfigSetting } from '../config/settings/route';\nimport { RouteOptions } from '../config/settings/route';\nimport { getDefaultRouteSettings } from './qpqConfigAccessorsUtils';\n\nexport const mergeRouteAuthSettings = (routeAuthSettingsA?: RouteAuthSettings, routeAuthSettingsB?: RouteAuthSettings): RouteAuthSettings => {\n  return {\n    userDirectoryName: routeAuthSettingsB?.userDirectoryName || routeAuthSettingsA?.userDirectoryName,\n    scopes: [...new Set([...(routeAuthSettingsB?.scopes || []), ...(routeAuthSettingsA?.scopes || [])])],\n\n    apiKeys: [...(routeAuthSettingsB?.apiKeys || []), ...(routeAuthSettingsA?.apiKeys || [])].filter(\n      (apiKeyRef, index, arr) =>\n        arr.findIndex(\n          (item) => item.name === apiKeyRef.name && item.applicationName === apiKeyRef.applicationName && item.serviceName === apiKeyRef.serviceName,\n        ) === index,\n    ),\n  };\n};\n\nexport const mergeRouteOptions = (routeOptionsA: RouteOptions, routeOptionsB: RouteOptions): RouteOptions => {\n  return {\n    allowedOrigins: [...new Set([...(routeOptionsB.allowedOrigins || []), ...(routeOptionsA.allowedOrigins || [])])],\n    routeAuthSettings: mergeRouteAuthSettings(routeOptionsA.routeAuthSettings, routeOptionsB.routeAuthSettings),\n  };\n};\n\nexport const mergeAllRouteOptions = (activeApi: string, routeConfig: RouteQPQWebServerConfigSetting, qpqConfig: QPQConfig): RouteOptions => {\n  // TODO: This needs to filter active route on the current route Config\n  // activeApi\n  const defaultOptions = getDefaultRouteSettings(qpqConfig).map((o) => o.routeOptions);\n  const routeOptions = routeConfig.options;\n\n  return [...defaultOptions, routeOptions].reduce((acc, opt) => mergeRouteOptions(acc, opt), {} as RouteOptions);\n};\n"]}
+{"version":3,"file":"mergeRouteUtils.js","sourceRoot":"","sources":["../../../src/utils/mergeRouteUtils.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,kBAAsC,EAAE,kBAAsC,EAAqB,EAAE;IAC1I,OAAO;QACL,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,IAAI,kBAAkB,EAAE,iBAAiB;QACjG,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,kBAAkB,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAEpG,OAAO,EAAE,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,kBAAkB,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAC9F,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACxB,GAAG,CAAC,SAAS,CACX,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,eAAe,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,CAC3I,KAAK,KAAK,CACd;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,aAA2B,EAAE,aAA2B,EAAgB,EAAE;IAC1G,OAAO;QACL,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChH,iBAAiB,EAAE,sBAAsB,CAAC,aAAa,CAAC,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,CAAC;QAE3G,sGAAsG;QACtG,MAAM,EAAE,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM;KACrD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,SAAiB,EAAE,WAA2C,EAAE,SAAoB,EAAgB,EAAE;IACzI,sEAAsE;IACtE,YAAY;IACZ,MAAM,cAAc,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACrF,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC;IAEzC,OAAO,CAAC,GAAG,cAAc,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAkB,CAAC,CAAC;AACjH,CAAC,CAAC","sourcesContent":["import { QPQConfig } from 'quidproquo-core';\n\nimport { RouteAuthSettings, RouteQPQWebServerConfigSetting } from '../config/settings/route';\nimport { RouteOptions } from '../config/settings/route';\nimport { getDefaultRouteSettings } from './qpqConfigAccessorsUtils';\n\nexport const mergeRouteAuthSettings = (routeAuthSettingsA?: RouteAuthSettings, routeAuthSettingsB?: RouteAuthSettings): RouteAuthSettings => {\n  return {\n    userDirectoryName: routeAuthSettingsB?.userDirectoryName || routeAuthSettingsA?.userDirectoryName,\n    scopes: [...new Set([...(routeAuthSettingsB?.scopes || []), ...(routeAuthSettingsA?.scopes || [])])],\n\n    apiKeys: [...(routeAuthSettingsB?.apiKeys || []), ...(routeAuthSettingsA?.apiKeys || [])].filter(\n      (apiKeyRef, index, arr) =>\n        arr.findIndex(\n          (item) => item.name === apiKeyRef.name && item.applicationName === apiKeyRef.applicationName && item.serviceName === apiKeyRef.serviceName,\n        ) === index,\n    ),\n  };\n};\n\nexport const mergeRouteOptions = (routeOptionsA: RouteOptions, routeOptionsB: RouteOptions): RouteOptions => {\n  return {\n    allowedOrigins: [...new Set([...(routeOptionsB.allowedOrigins || []), ...(routeOptionsA.allowedOrigins || [])])],\n    routeAuthSettings: mergeRouteAuthSettings(routeOptionsA.routeAuthSettings, routeOptionsB.routeAuthSettings),\n\n    // Schemas describe one route, they are never shared defaults, so the more specific side wins outright\n    schema: routeOptionsB.schema ?? routeOptionsA.schema,\n  };\n};\n\nexport const mergeAllRouteOptions = (activeApi: string, routeConfig: RouteQPQWebServerConfigSetting, qpqConfig: QPQConfig): RouteOptions => {\n  // TODO: This needs to filter active route on the current route Config\n  // activeApi\n  const defaultOptions = getDefaultRouteSettings(qpqConfig).map((o) => o.routeOptions);\n  const routeOptions = routeConfig.options;\n\n  return [...defaultOptions, routeOptions].reduce((acc, opt) => mergeRouteOptions(acc, opt), {} as RouteOptions);\n};\n"]}

package/lib/esm/utils/openApi/OpenApiDocumentOptions.d.ts

@@ -0,0 +1,2 @@
+import { OpenApiInfo } from '../../types/OpenApiDocument';
+export type OpenApiDocumentOptions = Partial<OpenApiInfo>;

package/lib/esm/utils/openApi/OpenApiDocumentOptions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=OpenApiDocumentOptions.js.map

package/lib/esm/utils/openApi/OpenApiDocumentOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenApiDocumentOptions.js","sourceRoot":"","sources":["../../../../src/utils/openApi/OpenApiDocumentOptions.ts"],"names":[],"mappings":"","sourcesContent":["import { OpenApiInfo } from '../../types/OpenApiDocument';\n\n// The parts of the document that are prose rather than derived from the routes.\n// Every field falls back to something sensible taken from the service config.\nexport type OpenApiDocumentOptions = Partial<OpenApiInfo>;\n"]}

package/lib/esm/utils/openApi/buildOpenApiDocument.d.ts

@@ -0,0 +1,5 @@
+import { QPQConfig } from 'quidproquo-core';
+import { DomainResolver } from '../../domain/types/DomainResolver';
+import { OpenApiDocument } from '../../types/OpenApiDocument';
+import { OpenApiDocumentOptions } from './OpenApiDocumentOptions';
+export declare const buildOpenApiDocument: (qpqConfig: QPQConfig, options?: OpenApiDocumentOptions, resolver?: DomainResolver) => OpenApiDocument;

package/lib/esm/utils/openApi/buildOpenApiDocument.js

@@ -0,0 +1,50 @@
+import { qpqCoreUtils } from 'quidproquo-core';
+import { resolveHosts } from '../../domain/logic/host/resolveHosts';
+import { mergeAllRouteOptions } from '../mergeRouteUtils';
+import { getAllRoutes, getApiConfigs } from '../qpqConfigAccessorsUtils';
+import { buildOpenApiOperation } from './buildOpenApiOperation';
+import { openApiSecuritySchemes } from './buildOpenApiSecurity';
+// Every live api on every root is a server the operations can be called on. Deployed, an
+// api domain is shared by every service in the application and each service is mounted
+// under its module name (the api gateway base path mapping), so the url carries that path.
+// A service with no domain (nothing browser-facing, local only) lists none.
+const buildServers = (qpqConfig, resolver) => {
+    const serviceName = qpqCoreUtils.getApplicationModuleName(qpqConfig);
+    return getApiConfigs(qpqConfig)
+        .filter((api) => !api.deprecated)
+        .flatMap((api) => resolveHosts(qpqConfig, { subdomain: api.apiSubdomain }, resolver).map((host) => ({ url: `https://${host}/${serviceName}` })));
+};
+// Only schemes some operation actually references make it into components, so a
+// service with no auth publishes no dangling security definitions.
+const buildSecuritySchemes = (paths) => {
+    const used = new Set(Object.values(paths)
+        .flatMap((pathItem) => Object.values(pathItem))
+        .flatMap((operation) => operation.security ?? [])
+        .flatMap((requirement) => Object.keys(requirement)));
+    return Object.fromEntries(Object.entries(openApiSecuritySchemes).filter(([name]) => used.has(name)));
+};
+// Walk every route in the config and describe it. Routes are plain data, so this
+// runs anywhere the config does: at deploy time, in a processor, or in a test.
+export const buildOpenApiDocument = (qpqConfig, options = {}, resolver) => {
+    const paths = {};
+    for (const route of getAllRoutes(qpqConfig)) {
+        const routeOptions = mergeAllRouteOptions('', route, qpqConfig);
+        if (routeOptions.schema?.hidden) {
+            continue;
+        }
+        const verb = route.method.toLowerCase();
+        paths[route.path] = { ...paths[route.path], [verb]: buildOpenApiOperation(route, routeOptions) };
+    }
+    return {
+        openapi: '3.1.0',
+        info: {
+            title: options.title ?? `${qpqCoreUtils.getApplicationName(qpqConfig)} ${qpqCoreUtils.getApplicationModuleName(qpqConfig)}`,
+            version: options.version ?? '1.0.0',
+            description: options.description,
+        },
+        servers: buildServers(qpqConfig, resolver),
+        paths,
+        components: { securitySchemes: buildSecuritySchemes(paths) },
+    };
+};
+//# sourceMappingURL=buildOpenApiDocument.js.map

package/lib/esm/utils/openApi/buildOpenApiDocument.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildOpenApiDocument.js","sourceRoot":"","sources":["../../../../src/utils/openApi/buildOpenApiDocument.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAGpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAKhE,yFAAyF;AACzF,uFAAuF;AACvF,2FAA2F;AAC3F,4EAA4E;AAC5E,MAAM,YAAY,GAAG,CAAC,SAAoB,EAAE,QAAyB,EAAqB,EAAE;IAC1F,MAAM,WAAW,GAAG,YAAY,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAErE,OAAO,aAAa,CAAC,SAAS,CAAC;SAC5B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;SAChC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,IAAI,IAAI,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACrJ,CAAC,CAAC;AAEF,gFAAgF;AAChF,mEAAmE;AACnE,MAAM,oBAAoB,GAAG,CAAC,KAAsC,EAAyC,EAAE;IAC7G,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;SACjB,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;SAC9C,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC;SAChD,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CACtD,CAAC;IAEF,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvG,CAAC,CAAC;AAEF,iFAAiF;AACjF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,SAAoB,EAAE,UAAkC,EAAE,EAAE,QAAyB,EAAmB,EAAE;IAC7I,MAAM,KAAK,GAAoC,EAAE,CAAC;IAElD,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAc,CAAC;QACpD,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;IACnG,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,YAAY,CAAC,kBAAkB,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE;YAC3H,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO;YACnC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC;QACD,OAAO,EAAE,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC;QAC1C,KAAK;QACL,UAAU,EAAE,EAAE,eAAe,EAAE,oBAAoB,CAAC,KAAK,CAAC,EAAE;KAC7D,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { QPQConfig, qpqCoreUtils } from 'quidproquo-core';\n\nimport { resolveHosts } from '../../domain/logic/host/resolveHosts';\nimport { DomainResolver } from '../../domain/types/DomainResolver';\nimport { OpenApiDocument, OpenApiPathItem, OpenApiSecurityScheme } from '../../types/OpenApiDocument';\nimport { mergeAllRouteOptions } from '../mergeRouteUtils';\nimport { getAllRoutes, getApiConfigs } from '../qpqConfigAccessorsUtils';\nimport { buildOpenApiOperation } from './buildOpenApiOperation';\nimport { openApiSecuritySchemes } from './buildOpenApiSecurity';\nimport { OpenApiDocumentOptions } from './OpenApiDocumentOptions';\n\ntype HttpVerb = keyof OpenApiPathItem;\n\n// Every live api on every root is a server the operations can be called on. Deployed, an\n// api domain is shared by every service in the application and each service is mounted\n// under its module name (the api gateway base path mapping), so the url carries that path.\n// A service with no domain (nothing browser-facing, local only) lists none.\nconst buildServers = (qpqConfig: QPQConfig, resolver?: DomainResolver): { url: string }[] => {\n  const serviceName = qpqCoreUtils.getApplicationModuleName(qpqConfig);\n\n  return getApiConfigs(qpqConfig)\n    .filter((api) => !api.deprecated)\n    .flatMap((api) => resolveHosts(qpqConfig, { subdomain: api.apiSubdomain }, resolver).map((host) => ({ url: `https://${host}/${serviceName}` })));\n};\n\n// Only schemes some operation actually references make it into components, so a\n// service with no auth publishes no dangling security definitions.\nconst buildSecuritySchemes = (paths: Record<string, OpenApiPathItem>): Record<string, OpenApiSecurityScheme> => {\n  const used = new Set(\n    Object.values(paths)\n      .flatMap((pathItem) => Object.values(pathItem))\n      .flatMap((operation) => operation.security ?? [])\n      .flatMap((requirement) => Object.keys(requirement)),\n  );\n\n  return Object.fromEntries(Object.entries(openApiSecuritySchemes).filter(([name]) => used.has(name)));\n};\n\n// Walk every route in the config and describe it. Routes are plain data, so this\n// runs anywhere the config does: at deploy time, in a processor, or in a test.\nexport const buildOpenApiDocument = (qpqConfig: QPQConfig, options: OpenApiDocumentOptions = {}, resolver?: DomainResolver): OpenApiDocument => {\n  const paths: Record<string, OpenApiPathItem> = {};\n\n  for (const route of getAllRoutes(qpqConfig)) {\n    const routeOptions = mergeAllRouteOptions('', route, qpqConfig);\n    if (routeOptions.schema?.hidden) {\n      continue;\n    }\n\n    const verb = route.method.toLowerCase() as HttpVerb;\n    paths[route.path] = { ...paths[route.path], [verb]: buildOpenApiOperation(route, routeOptions) };\n  }\n\n  return {\n    openapi: '3.1.0',\n    info: {\n      title: options.title ?? `${qpqCoreUtils.getApplicationName(qpqConfig)} ${qpqCoreUtils.getApplicationModuleName(qpqConfig)}`,\n      version: options.version ?? '1.0.0',\n      description: options.description,\n    },\n    servers: buildServers(qpqConfig, resolver),\n    paths,\n    components: { securitySchemes: buildSecuritySchemes(paths) },\n  };\n};\n"]}

package/lib/esm/utils/openApi/buildOpenApiOperation.d.ts

@@ -0,0 +1,4 @@
+import { RouteOptions } from '../../config/settings/route';
+import { RouteQPQWebServerConfigSetting } from '../../config/settings/route';
+import { OpenApiOperation } from '../../types/OpenApiDocument';
+export declare const buildOpenApiOperation: (route: RouteQPQWebServerConfigSetting, options: RouteOptions) => OpenApiOperation;

package/lib/esm/utils/openApi/buildOpenApiOperation.js

@@ -0,0 +1,40 @@
+import { buildOpenApiPathParameters } from './buildOpenApiPathParameters';
+import { buildOpenApiQueryParameters } from './buildOpenApiQueryParameters';
+import { buildOpenApiSecurity } from './buildOpenApiSecurity';
+// `get_v1_widgets_id` style: stable across deploys and unique per method+path,
+// which is all client generators need from it.
+const toOperationId = (method, path) => [method.toLowerCase(), ...path.replace(/[{}]/g, '').split('/').filter(Boolean)].join('_');
+const buildResponses = (options) => {
+    const { schema, routeAuthSettings } = options;
+    const responses = {
+        '200': schema?.responseJsonSchema
+            ? { description: 'Success', content: { 'application/json': { schema: schema.responseJsonSchema } } }
+            : { description: 'Success' },
+    };
+    if (routeAuthSettings?.userDirectoryName || routeAuthSettings?.apiKeys?.length) {
+        responses['401'] = { description: 'Missing or invalid credentials' };
+    }
+    // Only routes that validate input can reject it; a plain route has no 422 path
+    if (schema?.bodyJsonSchema || schema?.queryJsonSchema) {
+        responses['422'] = { description: 'Request failed validation' };
+    }
+    return responses;
+};
+// One route becomes one operation. `options` is the route's options after the
+// service defaults have been merged in, so auth requirements are the real ones.
+export const buildOpenApiOperation = (route, options) => {
+    const { schema } = options;
+    const parameters = [...buildOpenApiPathParameters(route.path), ...buildOpenApiQueryParameters(schema?.queryJsonSchema)];
+    const security = buildOpenApiSecurity(options.routeAuthSettings);
+    return {
+        operationId: toOperationId(route.method, route.path),
+        summary: schema?.summary,
+        description: schema?.description,
+        tags: schema?.tags,
+        parameters: parameters.length ? parameters : undefined,
+        requestBody: schema?.bodyJsonSchema ? { required: true, content: { 'application/json': { schema: schema.bodyJsonSchema } } } : undefined,
+        responses: buildResponses(options),
+        security: security.length ? security : undefined,
+    };
+};
+//# sourceMappingURL=buildOpenApiOperation.js.map

package/lib/esm/utils/openApi/buildOpenApiOperation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildOpenApiOperation.js","sourceRoot":"","sources":["../../../../src/utils/openApi/buildOpenApiOperation.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,+EAA+E;AAC/E,+CAA+C;AAC/C,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE,CAC7D,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE5F,MAAM,cAAc,GAAG,CAAC,OAAqB,EAAmC,EAAE;IAChF,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC;IAE9C,MAAM,SAAS,GAAoC;QACjD,KAAK,EAAE,MAAM,EAAE,kBAAkB;YAC/B,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,kBAAkB,EAAE,EAAE,EAAE;YACpG,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE;KAC/B,CAAC;IAEF,IAAI,iBAAiB,EAAE,iBAAiB,IAAI,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC/E,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IACvE,CAAC;IAED,+EAA+E;IAC/E,IAAI,MAAM,EAAE,cAAc,IAAI,MAAM,EAAE,eAAe,EAAE,CAAC;QACtD,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;IAClE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAqC,EAAE,OAAqB,EAAoB,EAAE;IACtH,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,UAAU,GAAG,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,2BAA2B,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACxH,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAEjE,OAAO;QACL,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;QACpD,OAAO,EAAE,MAAM,EAAE,OAAO;QACxB,WAAW,EAAE,MAAM,EAAE,WAAW;QAChC,IAAI,EAAE,MAAM,EAAE,IAAI;QAClB,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QACtD,WAAW,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;QACxI,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC;QAClC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACjD,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { RouteOptions } from '../../config/settings/route';\nimport { RouteQPQWebServerConfigSetting } from '../../config/settings/route';\nimport { OpenApiOperation, OpenApiResponse } from '../../types/OpenApiDocument';\nimport { buildOpenApiPathParameters } from './buildOpenApiPathParameters';\nimport { buildOpenApiQueryParameters } from './buildOpenApiQueryParameters';\nimport { buildOpenApiSecurity } from './buildOpenApiSecurity';\n\n// `get_v1_widgets_id` style: stable across deploys and unique per method+path,\n// which is all client generators need from it.\nconst toOperationId = (method: string, path: string): string =>\n  [method.toLowerCase(), ...path.replace(/[{}]/g, '').split('/').filter(Boolean)].join('_');\n\nconst buildResponses = (options: RouteOptions): Record<string, OpenApiResponse> => {\n  const { schema, routeAuthSettings } = options;\n\n  const responses: Record<string, OpenApiResponse> = {\n    '200': schema?.responseJsonSchema\n      ? { description: 'Success', content: { 'application/json': { schema: schema.responseJsonSchema } } }\n      : { description: 'Success' },\n  };\n\n  if (routeAuthSettings?.userDirectoryName || routeAuthSettings?.apiKeys?.length) {\n    responses['401'] = { description: 'Missing or invalid credentials' };\n  }\n\n  // Only routes that validate input can reject it; a plain route has no 422 path\n  if (schema?.bodyJsonSchema || schema?.queryJsonSchema) {\n    responses['422'] = { description: 'Request failed validation' };\n  }\n\n  return responses;\n};\n\n// One route becomes one operation. `options` is the route's options after the\n// service defaults have been merged in, so auth requirements are the real ones.\nexport const buildOpenApiOperation = (route: RouteQPQWebServerConfigSetting, options: RouteOptions): OpenApiOperation => {\n  const { schema } = options;\n  const parameters = [...buildOpenApiPathParameters(route.path), ...buildOpenApiQueryParameters(schema?.queryJsonSchema)];\n  const security = buildOpenApiSecurity(options.routeAuthSettings);\n\n  return {\n    operationId: toOperationId(route.method, route.path),\n    summary: schema?.summary,\n    description: schema?.description,\n    tags: schema?.tags,\n    parameters: parameters.length ? parameters : undefined,\n    requestBody: schema?.bodyJsonSchema ? { required: true, content: { 'application/json': { schema: schema.bodyJsonSchema } } } : undefined,\n    responses: buildResponses(options),\n    security: security.length ? security : undefined,\n  };\n};\n"]}

package/lib/esm/utils/openApi/buildOpenApiPathParameters.d.ts

@@ -0,0 +1,2 @@
+import { OpenApiParameter } from '../../types/OpenApiDocument';
+export declare const buildOpenApiPathParameters: (path: string) => OpenApiParameter[];

package/lib/esm/utils/openApi/buildOpenApiPathParameters.js

@@ -0,0 +1,9 @@
+// Route paths already use OpenAPI's `{param}` template syntax, so the path itself
+// is the source of truth for path parameters. They are always strings on the wire.
+export const buildOpenApiPathParameters = (path) => [...path.matchAll(/\{([^}]+)\}/g)].map(([, name]) => ({
+    name,
+    in: 'path',
+    required: true,
+    schema: { type: 'string' },
+}));
+//# sourceMappingURL=buildOpenApiPathParameters.js.map

package/lib/esm/utils/openApi/buildOpenApiPathParameters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildOpenApiPathParameters.js","sourceRoot":"","sources":["../../../../src/utils/openApi/buildOpenApiPathParameters.ts"],"names":[],"mappings":"AAEA,kFAAkF;AAClF,mFAAmF;AACnF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAY,EAAsB,EAAE,CAC7E,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI;IACJ,EAAE,EAAE,MAAM;IACV,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;CAC3B,CAAC,CAAC,CAAC","sourcesContent":["import { OpenApiParameter } from '../../types/OpenApiDocument';\n\n// Route paths already use OpenAPI's `{param}` template syntax, so the path itself\n// is the source of truth for path parameters. They are always strings on the wire.\nexport const buildOpenApiPathParameters = (path: string): OpenApiParameter[] =>\n  [...path.matchAll(/\\{([^}]+)\\}/g)].map(([, name]) => ({\n    name,\n    in: 'path',\n    required: true,\n    schema: { type: 'string' },\n  }));\n"]}

package/lib/esm/utils/openApi/buildOpenApiQueryParameters.d.ts

@@ -0,0 +1,3 @@
+import { JsonSchema } from '../../config/types/JsonSchema';
+import { OpenApiParameter } from '../../types/OpenApiDocument';
+export declare const buildOpenApiQueryParameters: (querySchema?: JsonSchema) => OpenApiParameter[];

package/lib/esm/utils/openApi/buildOpenApiQueryParameters.js

@@ -0,0 +1,21 @@
+const isJsonSchema = (value) => typeof value === 'object' && value !== null;
+// A query schema is declared as one object schema, but OpenAPI wants one parameter
+// per key. Only the top-level properties can be unpacked; a query schema that is
+// not an object (or has none) contributes nothing rather than something wrong.
+export const buildOpenApiQueryParameters = (querySchema) => {
+    const properties = querySchema?.properties;
+    if (!isJsonSchema(properties)) {
+        return [];
+    }
+    const required = Array.isArray(querySchema?.required) ? querySchema.required : [];
+    return Object.entries(properties)
+        .filter((entry) => isJsonSchema(entry[1]))
+        .map(([name, schema]) => ({
+        name,
+        in: 'query',
+        required: required.includes(name),
+        schema,
+        description: typeof schema.description === 'string' ? schema.description : undefined,
+    }));
+};
+//# sourceMappingURL=buildOpenApiQueryParameters.js.map

package/lib/esm/utils/openApi/buildOpenApiQueryParameters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildOpenApiQueryParameters.js","sourceRoot":"","sources":["../../../../src/utils/openApi/buildOpenApiQueryParameters.ts"],"names":[],"mappings":"AAGA,MAAM,YAAY,GAAG,CAAC,KAAc,EAAuB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AAE1G,mFAAmF;AACnF,iFAAiF;AACjF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,WAAwB,EAAsB,EAAE;IAC1F,MAAM,UAAU,GAAG,WAAW,EAAE,UAAU,CAAC;IAC3C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAE,WAAW,CAAC,QAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhG,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;SAC9B,MAAM,CAAC,CAAC,KAAK,EAAiC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;SACxE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,IAAI;QACJ,EAAE,EAAE,OAAO;QACX,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QACjC,MAAM;QACN,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC,CAAC,CAAC;AACR,CAAC,CAAC","sourcesContent":["import { JsonSchema } from '../../config/types/JsonSchema';\nimport { OpenApiParameter } from '../../types/OpenApiDocument';\n\nconst isJsonSchema = (value: unknown): value is JsonSchema => typeof value === 'object' && value !== null;\n\n// A query schema is declared as one object schema, but OpenAPI wants one parameter\n// per key. Only the top-level properties can be unpacked; a query schema that is\n// not an object (or has none) contributes nothing rather than something wrong.\nexport const buildOpenApiQueryParameters = (querySchema?: JsonSchema): OpenApiParameter[] => {\n  const properties = querySchema?.properties;\n  if (!isJsonSchema(properties)) {\n    return [];\n  }\n\n  const required = Array.isArray(querySchema?.required) ? (querySchema.required as string[]) : [];\n\n  return Object.entries(properties)\n    .filter((entry): entry is [string, JsonSchema] => isJsonSchema(entry[1]))\n    .map(([name, schema]) => ({\n      name,\n      in: 'query',\n      required: required.includes(name),\n      schema,\n      description: typeof schema.description === 'string' ? schema.description : undefined,\n    }));\n};\n"]}

package/lib/esm/utils/openApi/buildOpenApiSecurity.d.ts

@@ -0,0 +1,4 @@
+import { RouteAuthSettings } from '../../config/settings/route';
+import { OpenApiSecurityRequirement, OpenApiSecurityScheme } from '../../types/OpenApiDocument';
+export declare const buildOpenApiSecurity: (routeAuthSettings?: RouteAuthSettings) => OpenApiSecurityRequirement[];
+export declare const openApiSecuritySchemes: Record<string, OpenApiSecurityScheme>;

package/lib/esm/utils/openApi/buildOpenApiSecurity.js

@@ -0,0 +1,19 @@
+import { OPEN_API_API_KEY_AUTH, OPEN_API_BEARER_AUTH } from './openApiSecuritySchemeNames';
+// Mirrors what askValidateRouteAuth actually checks: a user directory means a JWT in
+// the Authorization header, api keys mean the x-api-key header. Either satisfies the
+// route, so they are listed as alternatives rather than both required.
+export const buildOpenApiSecurity = (routeAuthSettings) => {
+    const requirements = [];
+    if (routeAuthSettings?.userDirectoryName) {
+        requirements.push({ [OPEN_API_BEARER_AUTH]: routeAuthSettings.scopes ?? [] });
+    }
+    if (routeAuthSettings?.apiKeys?.length) {
+        requirements.push({ [OPEN_API_API_KEY_AUTH]: [] });
+    }
+    return requirements;
+};
+export const openApiSecuritySchemes = {
+    [OPEN_API_BEARER_AUTH]: { type: 'http', scheme: 'bearer', bearerFormat: 'JWT' },
+    [OPEN_API_API_KEY_AUTH]: { type: 'apiKey', in: 'header', name: 'x-api-key' },
+};
+//# sourceMappingURL=buildOpenApiSecurity.js.map

package/lib/esm/utils/openApi/buildOpenApiSecurity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildOpenApiSecurity.js","sourceRoot":"","sources":["../../../../src/utils/openApi/buildOpenApiSecurity.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAE3F,qFAAqF;AACrF,qFAAqF;AACrF,uEAAuE;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,iBAAqC,EAAgC,EAAE;IAC1G,MAAM,YAAY,GAAiC,EAAE,CAAC;IAEtD,IAAI,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;QACzC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,iBAAiB,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACvC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAA0C;IAC3E,CAAC,oBAAoB,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE;IAC/E,CAAC,qBAAqB,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE;CAC7E,CAAC","sourcesContent":["import { RouteAuthSettings } from '../../config/settings/route';\nimport { OpenApiSecurityRequirement, OpenApiSecurityScheme } from '../../types/OpenApiDocument';\nimport { OPEN_API_API_KEY_AUTH, OPEN_API_BEARER_AUTH } from './openApiSecuritySchemeNames';\n\n// Mirrors what askValidateRouteAuth actually checks: a user directory means a JWT in\n// the Authorization header, api keys mean the x-api-key header. Either satisfies the\n// route, so they are listed as alternatives rather than both required.\nexport const buildOpenApiSecurity = (routeAuthSettings?: RouteAuthSettings): OpenApiSecurityRequirement[] => {\n  const requirements: OpenApiSecurityRequirement[] = [];\n\n  if (routeAuthSettings?.userDirectoryName) {\n    requirements.push({ [OPEN_API_BEARER_AUTH]: routeAuthSettings.scopes ?? [] });\n  }\n\n  if (routeAuthSettings?.apiKeys?.length) {\n    requirements.push({ [OPEN_API_API_KEY_AUTH]: [] });\n  }\n\n  return requirements;\n};\n\nexport const openApiSecuritySchemes: Record<string, OpenApiSecurityScheme> = {\n  [OPEN_API_BEARER_AUTH]: { type: 'http', scheme: 'bearer', bearerFormat: 'JWT' },\n  [OPEN_API_API_KEY_AUTH]: { type: 'apiKey', in: 'header', name: 'x-api-key' },\n};\n"]}

package/lib/esm/utils/openApi/index.d.ts

@@ -0,0 +1,7 @@
+export * from './buildOpenApiDocument';
+export * from './buildOpenApiOperation';
+export * from './buildOpenApiPathParameters';
+export * from './buildOpenApiQueryParameters';
+export * from './buildOpenApiSecurity';
+export * from './OpenApiDocumentOptions';
+export * from './openApiSecuritySchemeNames';

package/lib/esm/utils/openApi/index.js

@@ -0,0 +1,8 @@
+export * from './buildOpenApiDocument';
+export * from './buildOpenApiOperation';
+export * from './buildOpenApiPathParameters';
+export * from './buildOpenApiQueryParameters';
+export * from './buildOpenApiSecurity';
+export * from './OpenApiDocumentOptions';
+export * from './openApiSecuritySchemeNames';
+//# sourceMappingURL=index.js.map

package/lib/esm/utils/openApi/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/utils/openApi/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC","sourcesContent":["export * from './buildOpenApiDocument';\nexport * from './buildOpenApiOperation';\nexport * from './buildOpenApiPathParameters';\nexport * from './buildOpenApiQueryParameters';\nexport * from './buildOpenApiSecurity';\nexport * from './OpenApiDocumentOptions';\nexport * from './openApiSecuritySchemeNames';\n"]}

package/lib/esm/utils/openApi/openApiSecuritySchemeNames.d.ts

@@ -0,0 +1,2 @@
+export declare const OPEN_API_BEARER_AUTH = "bearerAuth";
+export declare const OPEN_API_API_KEY_AUTH = "apiKeyAuth";

package/lib/esm/utils/openApi/openApiSecuritySchemeNames.js

@@ -0,0 +1,4 @@
+// Keys under components.securitySchemes; operations reference them by name.
+export const OPEN_API_BEARER_AUTH = 'bearerAuth';
+export const OPEN_API_API_KEY_AUTH = 'apiKeyAuth';
+//# sourceMappingURL=openApiSecuritySchemeNames.js.map

package/lib/esm/utils/openApi/openApiSecuritySchemeNames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openApiSecuritySchemeNames.js","sourceRoot":"","sources":["../../../../src/utils/openApi/openApiSecuritySchemeNames.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AACjD,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC","sourcesContent":["// Keys under components.securitySchemes; operations reference them by name.\nexport const OPEN_API_BEARER_AUTH = 'bearerAuth';\nexport const OPEN_API_API_KEY_AUTH = 'apiKeyAuth';\n"]}