adonis-ensure-checks

AdonisJS v7 middleware that enforces validation and authorization are called during development. Catches missing request.validateUsing() or bouncer.authorize() at dev/test time rather than in production.

Installation

npm install adonis-ensure-checks
node ace configure adonis-ensure-checks

How it works

The middleware shadows request.validateUsing() / request.tryValidateUsing() and bouncer methods (authorize, allows, denies, execute, with) to track whether they were called. If a request reaches the response without the required checks, it throws:

EnsureValidationError: POST /api/posts handler did not call request.validateUsing().
All mutating requests must be validated. To fix, add a validation to your handler, or add the route pattern to validation.skip in your ensure_checks config.

EnsureAuthorizationError: GET /api/posts handler did not call bouncer.authorize() or equivalent.
All requests must be authorized. To fix, add authorization to your handler, or add the route pattern to authorization.skip in your ensure_checks config.

Configuration

After running node ace configure, edit config/ensure_checks.ts:

import { defineConfig } from 'adonis-ensure-checks'

export default defineConfig({
  validation: {
    enabled: true,
    methods: ['POST', 'PUT', 'PATCH', 'DELETE'],
    environments: ['development', 'test'],
    skip: [],
  },
  authorization: {
    enabled: true,
    methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
    environments: ['development', 'test'],
    skip: [],
  },
})

Each check has its own independent enabled, methods, environments, and skip list.

Opting out

Skip checks for specific routes by adding patterns to the skip list for each check:

import { defineConfig } from 'adonis-ensure-checks'

export default defineConfig({
  validation: {
    skip: [
      '/webhooks/stripe',       // exact match
      '/webhooks/*',            // prefix wildcard (trailing /* only)
      /^\/internal\//,          // RegExp
    ],
  },
  authorization: {
    skip: [
      '/public/*',
      '/health',
    ],
  },
})

If @adonisjs/bouncer is not installed, the authorization check is gracefully skipped even when enabled.

License

MIT