A zero-trust plugin for Fastify that enforces explicit access control for all routes.
- Default deny: all routes are blocked by default
- Route-level access control
- Async validation support
- TypeScript support
npm install fastify-zero-trust
import Fastify from 'fastify' import zeroTrust from 'fastify-zero-trust' const fastify = Fastify() // Register the plugin await fastify.register(zeroTrust) // Public route fastify.get('/hello', { allowIf: async (request) => true }, async (request, reply) => { return { hello: 'world' } }) // Protected route fastify.get('/protected', { allowIf: async (request) => { return request.headers['x-access-token'] === 'secret-token' } }, async (request, reply) => { return { message: 'secret data' } }) await fastify.listen({ port: 3000 })
You can customize error handling and exclude routes by providing options:
await fastify.register(zeroTrust, { // Routes to exclude from validation (format: "METHOD:/path") excludedRoutes: ['GET:/health', 'GET:/metrics'], // Called when no validator is found for a route onMissingValidator: async (request, reply) => { reply.code(403).send({ error: 'Custom default deny message' }) }, // Called when a validator returns false onValidatorDenied: async (request, reply) => { reply.code(403).send({ error: 'Custom validation denied message' }) }, // Called when a validator throws an error onValidatorError: async (request, reply, error) => { reply.code(403).send({ error: `Validation error: ${error.message}` }) } })
The plugin adds an allowIf option to route definitions. This function should return a Promise:
- Return
trueto allow access - Return
falseto deny access - If no
allowIffunction is provided, access is denied by default
The plugin includes TypeScript type definitions and extends Fastify's RouteOptions interface.
MIT