feat(hono): add hono integration package (@aura-stack/hono)#139
Merged
halvaradop merged 2 commits intomasterfrom Apr 10, 2026
Merged
feat(hono): add hono integration package (@aura-stack/hono)#139halvaradop merged 2 commits intomasterfrom
halvaradop merged 2 commits intomasterfrom
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughThis PR extracts Hono-specific authentication logic into a new package Changes
Sequence DiagramsequenceDiagram
participant Client
participant HonoApp as Hono App
participant withAuth as withAuth Middleware
participant toHandler as toHandler
participant AuthPkg as `@aura-stack/hono` (Auth API)
participant SessionStore as Session Store
Client->>HonoApp: GET /api/protected
HonoApp->>withAuth: run middleware
withAuth->>AuthPkg: api.getSession(headers)
AuthPkg->>SessionStore: lookup session
SessionStore-->>AuthPkg: session or null
AuthPkg-->>withAuth: session object
withAuth->>HonoApp: ctx.set("session", session)\nnext()
HonoApp-->>Client: 200 OK (with session) or 401
Client->>HonoApp: GET /api/auth/signIn/github
HonoApp->>toHandler: proxy request
toHandler->>AuthPkg: handlers.ALL(request)
AuthPkg-->>toHandler: Response (302 redirect / set-cookie)
toHandler-->>Client: 302 Redirect + set-cookie
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🧹 Nitpick comments (2)
packages/hono/README.md (1)
41-82: Usetsfences for non-JSX examples.These snippets are TypeScript server code and don’t use JSX;
tsimproves editor highlighting consistency.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/hono/README.md` around lines 41 - 82, Update the README code fences from JSX/TSX to TypeScript-only to improve editor highlighting: change the opening fence markers used around the server examples (the blocks showing createAuth, export of toHandler/withAuth, the Hono.all mount, and the withAuth-protected route) from ```tsx to ```ts so examples referencing createAuth, toHandler, withAuth, and Hono.all are correctly highlighted as TypeScript.packages/hono/test/index.test.ts (1)
23-33: Consider extracting session-cookie creation to a small helper.The JWT + cookie construction is duplicated in two tests; a helper would reduce repetition and keep fixtures aligned.
♻️ Refactor sketch
+const createSessionCookie = async () => { + const sessionToken = await auth.jose.encodeJWT({ + sub: "johndoe", + name: "John Doe", + email: "johndoe@example.com", + }) + return `aura-auth.session_token=${sessionToken}` +} - const sessionToken = await auth.jose.encodeJWT({ - sub: "johndoe", - name: "John Doe", - email: "johndoe@example.com", - }) const res = await app.request("/api/auth/session", { headers: { - Cookie: `aura-auth.session_token=${sessionToken}`, + Cookie: await createSessionCookie(), }, })Also applies to: 69-79
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/hono/test/index.test.ts` around lines 23 - 33, Extract repeated JWT+cookie construction into a small helper (e.g., makeSessionCookie or createSessionCookie) inside the test file so both tests reuse it: move the call to auth.jose.encodeJWT and the Cookie string assembly into that helper (it should accept an optional payload or use the same fixture), return the full Cookie header value like "aura-auth.session_token=..."; then replace the inline sessionToken + Cookie header in the tests (the block creating sessionToken and setting headers.Cookie) with a call to the helper to reduce duplication and keep fixtures aligned.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@apps/hono/README.md`:
- Line 17: Update the overview sentence that incorrectly states the package
provides TypeScript support for "Express" applications: in the README line
referencing the '@aura-stack/hono' package, replace "Express applications" with
"Hono applications" (or "Hono-based applications") so the sentence correctly
reads that '@aura-stack/hono' provides standard middlewares and first-class
TypeScript support for Hono applications.
In `@apps/hono/src/lib/auth.ts`:
- Around line 3-6: The createAuth call that defines the exported auth constant
(auth) is missing the trustedOrigins option; update the createAuth({ ... })
invocation to include a trustedOrigins array (e.g., ["http://localhost:3000",
"https://*.vercel.app"]) to match other app examples and enable origin
validation—add the property inside the existing createAuth config and adjust the
origin entries to match your development/production environments.
In `@packages/hono/deno.json`:
- Around line 14-15: Replace the invalid Deno npm specifier
"npm:`@aura-stack/auth`@workspace:*" with a valid import-map entry: use a concrete
npm version specifier (e.g., change the "@aura-stack/auth" mapping to
"npm:`@aura-stack/auth`@^1.0.0" or another appropriate semver), or remove the
"npm:" specifier and switch to a bare import that the workspace tooling
resolves; update the "@aura-stack/auth" entry in the import map accordingly so
Deno can resolve it.
In `@packages/hono/package.json`:
- Around line 19-20: The "clean:cts" npm script currently runs unguarded and
fails if the dist directory is missing; update the "clean:cts" script entry so
it first checks that the dist directory exists before running the delete command
(i.e., guard the find invocation with a directory-existence test), and keep
"prepublish" invoking "clean:cts" as-is; edit the package.json scripts section
to replace the current "clean:cts" value with a guarded version that only runs
the find delete when dist exists.
In `@packages/hono/src/lib/with-auth.ts`:
- Around line 16-18: The catch block in with-auth.ts currently returns await
next() without setting the session, leaving downstream handlers with an
undefined session; update the catch block in the withAuth middleware to
explicitly set the session to null (e.g., assign ctx.req.ctx.session = null or
the same session key used elsewhere in this file) before calling return await
next() so the middleware contract always provides a session key.
In `@packages/hono/test/index.test.ts`:
- Around line 52-55: The tests call await res.json() which is inferred as
unknown under strict TS and later access properties (e.g., csrfToken), causing
TS18046; update each test to assert a safe type for body before property access
(for example cast the result of res.json() to a specific shape or to
Record<string, any>), and apply this change to every occurrence listed (the body
variables around the csrfToken checks and the other instances at the ranges
noted: lines ~16–20, 35–44, 52–55, 63–65, 81–83, 105–107, 121–123) so subsequent
property reads (e.g., body.csrfToken) are type-safe; locate the body
declarations in the test file (index.test.ts) and replace their type with an
appropriate assertion or interface.
---
Nitpick comments:
In `@packages/hono/README.md`:
- Around line 41-82: Update the README code fences from JSX/TSX to
TypeScript-only to improve editor highlighting: change the opening fence markers
used around the server examples (the blocks showing createAuth, export of
toHandler/withAuth, the Hono.all mount, and the withAuth-protected route) from
```tsx to ```ts so examples referencing createAuth, toHandler, withAuth, and
Hono.all are correctly highlighted as TypeScript.
In `@packages/hono/test/index.test.ts`:
- Around line 23-33: Extract repeated JWT+cookie construction into a small
helper (e.g., makeSessionCookie or createSessionCookie) inside the test file so
both tests reuse it: move the call to auth.jose.encodeJWT and the Cookie string
assembly into that helper (it should accept an optional payload or use the same
fixture), return the full Cookie header value like
"aura-auth.session_token=..."; then replace the inline sessionToken + Cookie
header in the tests (the block creating sessionToken and setting headers.Cookie)
with a call to the helper to reduce duplication and keep fixtures aligned.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: c15b70ea-b070-451f-b650-6263c265ba8d
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (22)
apps/hono/README.mdapps/hono/package.jsonapps/hono/src/auth.tsapps/hono/src/index.tsapps/hono/src/lib/auth.tsapps/hono/src/lib/handler.tsapps/hono/src/middleware/with-auth.tsapps/hono/tsconfig.jsonpackages/hono/CHANGELOG.mdpackages/hono/README.mdpackages/hono/deno.jsonpackages/hono/package.jsonpackages/hono/src/createAuth.tspackages/hono/src/index.tspackages/hono/src/lib/handler.tspackages/hono/src/lib/with-auth.tspackages/hono/src/oauth/index.tspackages/hono/test/index.test.tspackages/hono/test/presets.tspackages/hono/tsconfig.jsonpackages/hono/tsup.config.tspackages/hono/vitest.config.ts
💤 Files with no reviewable changes (3)
- apps/hono/src/auth.ts
- apps/hono/src/middleware/with-auth.ts
- apps/hono/src/lib/handler.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This pull request introduces the
@aura-stack/honopackage, providing a dedicated integration for authentication within Hono applications. The package includes built-in middleware and handlers to simplify session management and authentication flows.The provided utilities, such as the
withAuthmiddleware, validate the user session and infer its type based on the configuredidentity.schema. This enables strong type inference when accessing session data viactx.get.Additionally, the package includes an adapter to bridge Hono (Bun runtime) request/response objects with Web Standard APIs, ensuring compatibility with Aura Auth’s internal architecture.
Key Changes
@aura-stack/honopackagewithAuthmiddleware for session validation with type inferencetoHandleradapter to convert Bun/Hono request handling to Web Standard APIsapps/honointegration exampleUsage