release: WRNexusJS 0.5.0

packages/auth/src/routes/api.ts

@@ -0,0 +1,125 @@
+import { verifyCsrf, type Context } from "@wrnexus/core";
+import { createAuthHttpHandlers } from "../http/index.ts";
+import {
+  getDefaultAuthEngine,
+  getDefaultAuthRouteOptions,
+  getDefaultAuthSchemas,
+  hasDefaultAuthEngine,
+} from "../runtime.ts";
+
+export type AuthHttpHandlers = ReturnType<typeof createAuthHttpHandlers>;
+import { AUTH_ROUTE_DEFINITIONS, type AuthHandlerName } from "./definitions.ts";
+
+const ROUTES = Object.fromEntries(
+  AUTH_ROUTE_DEFINITIONS.map((definition) => [definition.path, definition]),
+) as Readonly<Record<string, (typeof AUTH_ROUTE_DEFINITIONS)[number]>>;
+
+function unavailable(): Response {
+  return Response.json(
+    {
+      ok: false,
+      error: "WRN-AUTH-NOT-CONFIGURED",
+      message: "Configure auth.engine before serving package auth routes.",
+    },
+    { status: 503, headers: { "cache-control": "no-store" } },
+  );
+}
+
+function normalizeRoutePath(value: string): string {
+  try {
+    return (decodeURIComponent(value).replace(/\/+$/, "") || "/").toLowerCase();
+  } catch {
+    return (value.replace(/\/+$/, "") || "/").toLowerCase();
+  }
+}
+
+function requestRoutePath(ctx: Context): string {
+  const matchedRoute = ctx.locals.__wrnexusRoute;
+  if (typeof matchedRoute === "string" && matchedRoute.startsWith("/api/auth/")) {
+    return normalizeRoutePath(matchedRoute);
+  }
+  try {
+    return normalizeRoutePath(new URL(ctx.req.url).pathname);
+  } catch {
+    return normalizeRoutePath(ctx.url.pathname);
+  }
+}
+
+function methodNotAllowed(allowed: readonly string[]): Response {
+  return Response.json(
+    { ok: false, error: "Method Not Allowed" },
+    { status: 405, headers: { allow: allowed.join(", "), "cache-control": "no-store" } },
+  );
+}
+
+function handlersFor(ctx: Context): AuthHttpHandlers | undefined {
+  if (!hasDefaultAuthEngine()) return undefined;
+  const routeOptions = getDefaultAuthRouteOptions();
+  return createAuthHttpHandlers({
+    engine: getDefaultAuthEngine(),
+    schemas: getDefaultAuthSchemas(),
+    baseUrl: routeOptions.baseUrl ?? ctx.url.origin,
+    passkey: routeOptions.passkey,
+    onSignedIn: routeOptions.onSignedIn,
+    onSignedOut: routeOptions.onSignedOut,
+  });
+}
+
+/** Invoke one concrete handler. Route-specific entry modules use this path. */
+export async function invokeAuthHandler(name: AuthHandlerName, ctx: Context): Promise<Response> {
+  const handlers = handlersFor(ctx);
+  if (!handlers) return unavailable();
+
+  const method = ctx.req.method.toUpperCase();
+  const unsafeMethod = method !== "GET" && method !== "HEAD" && method !== "OPTIONS";
+  if (unsafeMethod && getDefaultAuthRouteOptions().csrf !== false && !verifyCsrf(ctx)) {
+    return Response.json(
+      { ok: false, error: "Invalid CSRF token" },
+      { status: 403, headers: { "cache-control": "no-store" } },
+    );
+  }
+
+  try {
+    return await handlers[name](ctx);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.startsWith("WRN-AUTH-PASSKEY-PROVIDER:")) {
+      return Response.json(
+        {
+          ok: false,
+          error: "Passkeys are unavailable",
+          code: "passkey-provider-not-configured",
+        },
+        { status: 503, headers: { "cache-control": "no-store" } },
+      );
+    }
+    console.error(`[wrnexus:auth] ${name} failed`, error);
+    return Response.json(
+      { ok: false, error: "Authentication request failed" },
+      { status: 500, headers: { "cache-control": "no-store" } },
+    );
+  }
+}
+
+/** Backward-compatible dispatcher for applications importing the shared route. */
+export async function dispatchAuthRoute(routePath: string, ctx: Context): Promise<Response> {
+  const definition = ROUTES[normalizeRoutePath(routePath)];
+  if (!definition) {
+    return Response.json(
+      { ok: false, error: "Not Found" },
+      { status: 404, headers: { "cache-control": "no-store" } },
+    );
+  }
+  const method = ctx.req.method.toUpperCase();
+  if (!definition.methods.some((allowed) => allowed === method)) {
+    return methodNotAllowed(definition.methods);
+  }
+  return invokeAuthHandler(definition.handler, ctx);
+}
+
+export default async function authApi(ctx: Context): Promise<Response> {
+  return dispatchAuthRoute(requestRoutePath(ctx), ctx);
+}
+
+export const GET = authApi;
+export const POST = authApi;