patterns/macro

[giscus[bot]]

patterns/macro

Macro allows us to define a custom field to the hook.

https://elysiajs.com/patterns/macro

[Darren120]

bro wtf is this, how do i pass user from middleware to rest of my protected route?

[kurumeii]

Heya I'm no Elysia expert but my guess would be like this. First you define the macro plugin like the example above. After that, by using the use said plugin then call it in the third argument inside .get or whatever http method you want, you can access the user object in which the macro plugin you defined. Hope it makes sense

[arthur-eudeline]

There is actually a great example in the Better Auth docs that helped me integrate auth, I think it would fit your need : https://www.better-auth.com/docs/integrations/elysia#macro (Macro section)

[blackfyre]

There is actually a great example in the Better Auth docs that helped me integrate auth, I think it would fit your need : better-auth.com/docs/integrations/elysia#macro (Macro section)

Which kind of falls apart when dealing with Authorization as well...

[marcospgp]

"Macro allows us to define a custom field to the hook." is a very insufficient explanation

[PS193]

Just think about it like middleware. You'll define macro called "requireAuth:" then you'll make a resolve function inside, which check presence of Bearer, split it, verify it and return user object. If you put it before your routes, you routes can access the user object. But only if you pass "requireAuth: true" as their third agrument. If you write "requireAuth: false", the user object won't be here. You can decide which route will protected and which public. Make sense now ?

[Hiutaky]

An example with a betterauth and a role-based auth system:

export type AuthProps = {
  roles: UserRole[]
} | false;

export const authPlugin = new Elysia({ name: "better-auth" })
  .mount(auth.handler)
  .macro("auth", (props: AuthProps) =>  ({
      async resolve({ request, status }) {
        if( ! props ) return;

        const session = await auth.api.getSession({
          headers: request.headers,
        });
        const {roles} = props;

        if (!session) return status(401);

        const dbUser = await db.user.findUnique({
          where: { id: session.user.id },
          select: { role: true },
        });
        if( ! dbUser )
          return status(401);

        let driverAccount;

        if( ! roles.includes(dbUser.role) )
          return status(401)
        /**
         * Handle driver role
         */
        if( roles.includes("DRIVER") && roles.includes(dbUser?.role) )
          driverAccount = await db.driverAccount.findFirst({
            where: {
              driver: {
                userId: session.user.id,
              },
            },
            select: {
              id: true,
              isSetupComplete: true,
              mustChangePassword: true,
              tempPassword: true,
            },
          });


        return {
          auth,
          session: {
            ...session,
            driverAccount: roles.includes("DRIVER") ? driverAccount : null,
          },
          user: session.user
        };
      },

  }) );


  new Elysia()
    .use(authPlugin)
    .get("/test-restricted", ({ session }) => {
      return "I'm authed!"
    }, {
      auth: {
        roles: ["ADMIN", "CUSTOMER"]
      }
    })
    // no session available as param
    .get("/non-authed", ({ }) => {

    },{
      auth: false // or just omit the whole auth object
    })
    // no session available as param
    .get("non-authed-2", () => {

    })

[Hiutaky]

Another example using authentication and authorization flow:

export const authPlugin = new Elysia({ name: 'better-auth' })
  .use(createDbPlugin())
  .macro('auth', (props: AuthProps) => ({
    async resolve({ request, status, db }) {

      if( ! props ) return;

      /**
       * Starting authed context
       */
      
      const auth = await getAuth();
      const session = await auth.api.getSession({
        headers: request.headers
      });

      if( ! session )
        return status(401);

      /**
       * Handle authorize and delegate roles to the userRestaurant relation table
       */
      if( ! Array.isArray(props.roles) )
        return {
          ...session
        }

      if( Array.isArray( props.roles) && ! props.roles.includes(session.user.role as UserRestaurantRole) )
        return status(401);

      let restaurant : Restaurant | null = null;
      /**
       * Preload restaurant to be provided in the elysia context
       */
      if( session.user.selectedRestaurantId ) {
        const findings = await db
          .select()
          .from(restaurantTable)
          .where(
            eq(restaurantTable.id, session.user.selectedRestaurantId)
          ).limit(1)
          if( findings.length )
            restaurant = findings.at(0)!;
      }

      return {
        ...session,
        restaurant: restaurant
      }
    }
  }))
  .macro({
    authorize: ({ restaurantIdParam = 'restaurantId', roles }: AuthorizeProps) => {
      return {
        auth: {
          roles: true
        },
        resolve: async (ctx) => {
          const { status, params, db, session } = ctx as typeof ctx & {
            session?: Awaited<ReturnType<typeof getAuth>>['$Infer']['Session'];
            params: {
              restaurantId?: string
            }
          };
          if( ! session )
            return ctx.status(401);

          const rid = params.restaurantId
            ?? session.user.selectedRestaurantId

          if (!rid) {
            return { roleInRestaurant: session.user.role }
          }

          const membership = await db
            .select({ role: userRestaurant.role })
            .from(userRestaurant)
            .where(and(
              eq(userRestaurant.userId, session.user.id),
              eq(userRestaurant.restaurantId, rid),
            ))
            .limit(1)

          if (membership.length === 0)
            return status(403, 'Non sei membro di questo ristorante')

          const userRole = membership[0].role;

          const requiredMinLevel = Math.min(
            ...roles.map(r => roleHierarchy[r]),
          )

          if (roleHierarchy[userRole] < requiredMinLevel)
            return status(403, 'Ruolo insufficiente per questa risorsa')

          return {
            roleInRestaurant: userRole,
          }
        }
      }
    }
  }) 

Example usage:

export const healthRoute = new Elysia({ prefix: '/restaurant' })
  .use(authPlugin)
  .get('/', () => ({ status: 'ok' }), {
    detail: { summary: 'Health check endpoint' },
  })
  .get('/:restaurantId', ({session, user, roleInRestaurant}) => ({ status: 'ok' }), {
    //check auth to properly expose session and user in the ctx
    auth: {
      roles: true
    },
    //define granular role access depending on the :restaurantId param
    authorize: {
      roles: ["OWNER"]
    },
    detail: { summary: 'Health check endpoint' },
  })

That's the most Dev friendly solution I was able to use in my project.

Macro chaining is not propely able to infer the types, even if for example the auth macro is available in the authorize one. Type infer is not working, but if you console.log the ctx, session and user objects are available, so providing a proper typization into the "child" macro will solve the issue.

Also, even if both the route and the authorization macro are defining auth: true, the session is checked only once.