@anteros/core 0.0.1-alpha.3 → 0.0.1-alpha.5

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@anteros/core",
   "module": "index.ts",
-  "version": "0.0.1-alpha.3",
+  "version": "0.0.1-alpha.5",
   "type": "module",
   "description": "Anteros Core",
   "private": false,

package/server/hono.ts

@@ -129,16 +129,22 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
             })
             const bearer = c.req.header('Authorization')?.replace('Bearer ', '');
             if (bearer) {
-                const { value, error } = await jwt.verify(bearer);
-                const isValid = !error && value != null;
-                const isExpired = !!error && error.toLowerCase().includes('exp');
-
-                const tokenData = {
-                    value: bearer,
-                    decoded: isValid ? (value as Record<string, unknown>) : null,
-                    provided: true,
-                    expired: isExpired || (value != null && typeof (value as any)?.exp === 'number' && (value as any).exp * 1000 < Date.now()),
-                };
+                let tokenData: { value: string | null; decoded: Record<string, unknown> | null; provided: boolean; expired: boolean };
+                try {
+                    const { value, error } = await jwt.verify(bearer);
+                    const isValid = !error && value != null;
+                    const isExpired = !!error && error.toLowerCase().includes('exp');
+
+                    tokenData = {
+                        value: bearer,
+                        decoded: isValid ? (value as Record<string, unknown>) : null,
+                        provided: true,
+                        expired: isExpired || (value != null && typeof (value as any)?.exp === 'number' && (value as any).exp * 1000 < Date.now()),
+                    };
+                } catch {
+                    // Malformed token — treat as invalid, don't crash
+                    tokenData = { value: null, decoded: null, provided: true, expired: true };
+                }
 
                 requestCtxStorage.set('token', tokenData);
                 c.set('token', tokenData);

package/utils/func.ts

@@ -19,22 +19,29 @@ const jwt = {
         audience?: string | string[];
         subject?: string;
     }) => {
-        let SECRET_ = cfg.server.jwt?.secret || Bun.env.JWT_SECRET
-        if (!SECRET_) throw new Error('JWT_SECRET is not set');
-        let EXPIRES_IN = cfg.server.jwt?.expiresIn || '1h'
-
-        const secret = new TextEncoder().encode(SECRET_);
-        const signer = new Jose.SignJWT(payload)
-            .setProtectedHeader({ alg: 'HS256' })
-            .setIssuedAt()
-            .setExpirationTime(EXPIRES_IN || '1h')
-
-        if (options?.issuer) signer.setIssuer(options.issuer)
-        if (options?.audience) signer.setAudience(options.audience)
-        if (options?.subject) signer.setSubject(options.subject)
-
-        const token = await signer.sign(secret);
-        return token;
+        try {
+            let SECRET_ = cfg.server.jwt?.secret || Bun.env.JWT_SECRET
+            if (!SECRET_) throw new Error('JWT_SECRET is not set');
+            let EXPIRES_IN = cfg.server.jwt?.expiresIn || '1h'
+
+            const secret = new TextEncoder().encode(SECRET_);
+            const signer = new Jose.SignJWT(payload)
+                .setProtectedHeader({ alg: 'HS256' })
+                .setIssuedAt()
+                .setExpirationTime(EXPIRES_IN || '1h')
+
+            if (options?.issuer) signer.setIssuer(options.issuer)
+            if (options?.audience) signer.setAudience(options.audience)
+            if (options?.subject) signer.setSubject(options.subject)
+
+            const token = await signer.sign(secret);
+            return token;
+        } catch (err: any) {
+            throw new AppError(err?.message || 'Failed to sign token', {
+                code: 'JWT_SIGN_ERROR',
+                status: 500,
+            });
+        }
     },
     verify: async (token: string): Promise<{ value: Record<string, unknown> | null, error: string | null }> => {
         try {
@@ -47,10 +54,10 @@ const jwt = {
                 value: payload,
                 error: null
             }
-        } catch (error) {
+        } catch (err: any) {
             return {
                 value: null,
-                error: error instanceof Error ? error.message : 'Invalid token'
+                error: err instanceof Error ? err.message : String(err)
             }
         }
     }