Melindungi endpoint API
Route publik, sesi opsional, requireAuth, requireAdmin, dan rate limit.
TurboJet tidak memakai gaya oRPC publicProcedure / protectedProcedure. Proteksi adalah middleware Hono biasa yang di-compose per route.
Pola
| Pola | Cara |
|---|---|
| Publik | Tanpa middleware auth (mis. feedback POST /) |
| Sesi opsional | Panggil getSessionFromHeaders di dalam handler |
| Terautentikasi | requireAuth → c.get("session") |
| Admin | requireAuth lalu requireAdmin (role ADMIN) |
Publik + sesi opsional
Feedback bersifat publik tetapi bisa menempelkan pengguna yang sudah login jika cookie ada:
export const feedbackRouter = new Hono().post(
"/",
rateLimit("WRITE"),
zValidator("json", createFeedbackSchema),
async (c) => {
const session = await getSessionFromHeaders(c.req.raw.headers);
const result = await createFeedback({
data: c.req.valid("json"),
session,
ipAddress: c.req.header("x-forwarded-for") ?? null,
});
return c.json(result);
},
);getSessionFromHeaders mengembalikan null untuk tamu — tidak menolak request.
Terautentikasi (requireAuth)
Pakai requireAuth agar pemanggil tanpa auth mendapat 401. Router bertipe memakai Hono<AuthEnv> agar c.get("session") tersedia:
import { requireAuth, type AuthEnv } from "../../middleware/auth";
export const meRouter = new Hono<AuthEnv>().patch(
"/name",
rateLimit("WRITE"),
requireAuth,
zValidator("json", changeNameSchema),
async (c) => {
const session = c.get("session");
const result = await changeName(session.user.id, c.req.valid("json"));
return c.json(result);
},
);Admin (requireAuth + requireAdmin)
Route admin merangkai kedua middleware. Menyebar guard bersama menjaga urutan konsisten:
import { requireAuth, type AuthEnv } from "../../middleware/auth";
import { requireAdmin } from "../../middleware/admin";
const adminGuard = [rateLimit("READ"), requireAuth, requireAdmin] as const;
const adminWriteGuard = [rateLimit("WRITE"), requireAuth, requireAdmin] as const;
const usersRouter = new Hono<AuthEnv>().get(
"/",
...adminGuard,
zValidator("query", usersListInputSchema),
async (c) => {
const result = await getUsersList(c.req.valid("query"));
return c.json(result);
},
);requireAdmin memeriksa bahwa pengguna sesi memiliki role ADMIN.
Middleware kustom
Compose middleware Hono tambahan dengan cara yang sama — sebelum atau sesudah auth sesuai kebutuhan. Tidak ada lapisan Permix / prosedur org di kit ini.
Rate limiting
Hampir setiap route sebaiknya memakai rateLimit("READ" | "WRITE" | …) di awal rantai. Bucket dan limit ada di packages/api/src/middleware/rate-limit.ts dan packages/api/src/lib/ratelimit.ts.