@anteros/core 0.0.1-alpha.5 → 0.0.1-alpha.8

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@anteros/core",
   "module": "index.ts",
-  "version": "0.0.1-alpha.5",
+  "version": "0.0.1-alpha.8",
   "type": "module",
   "description": "Anteros Core",
   "private": false,

package/server/api.ts

@@ -69,6 +69,15 @@ async function checkFileAccess(
         throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
     }
 
+    // Boolean `true` → allow without requiring a token
+    if (typeof rule === 'boolean') {
+        if (!rule) {
+            throw new AppError(`${operation} not allowed`, { status: 401, code: 'ACCESS_DENIED' });
+        }
+        return;
+    }
+
+    // Function → requires a valid token
     const t = c.get('token');
     const accessToken = { value: t?.value ?? null, decoded: t?.decoded ?? null, provided: t?.provided ?? false, expired: t?.expired ?? false };
 
@@ -79,13 +88,8 @@ async function checkFileAccess(
         throw new AppError('Authentication required', { status: 401, code: 'AUTH_REQUIRED' });
     }
 
-    let allowed: boolean;
-    if (typeof rule === 'function') {
-        const rest = new useRest({ internal: false, tenant_id });
-        allowed = await rule({ rest, error: fn.error, jwt: func.jwt, token: accessToken });
-    } else {
-        allowed = rule;
-    }
+    const rest = new useRest({ internal: false, tenant_id });
+    const allowed = await (rule as Function)({ rest, error: fn.error, jwt: func.jwt, token: accessToken });
     if (!allowed) {
         throw new AppError(`${operation} not allowed`, { status: 401, code: 'ACCESS_DENIED' });
     }

package/server/hono.ts

@@ -129,22 +129,16 @@ function createApp(): Hono<{ Variables: HonoVariables }> {
             })
             const bearer = c.req.header('Authorization')?.replace('Bearer ', '');
             if (bearer) {
-                let tokenData: { value: string | null; decoded: Record<string, unknown> | null; provided: boolean; expired: boolean };
-                try {
-                    const { value, error } = await jwt.verify(bearer);
-                    const isValid = !error && value != null;
-                    const isExpired = !!error && error.toLowerCase().includes('exp');
-
-                    tokenData = {
-                        value: bearer,
-                        decoded: isValid ? (value as Record<string, unknown>) : null,
-                        provided: true,
-                        expired: isExpired || (value != null && typeof (value as any)?.exp === 'number' && (value as any).exp * 1000 < Date.now()),
-                    };
-                } catch {
-                    // Malformed token — treat as invalid, don't crash
-                    tokenData = { value: null, decoded: null, provided: true, expired: true };
-                }
+                const { value, error } = await jwt.verify(bearer);
+                const isValid = !error && value != null;
+                const isExpired = !!error && error.toLowerCase().includes('exp');
+
+                const tokenData = {
+                    value: bearer,
+                    decoded: isValid ? (value as Record<string, unknown>) : null,
+                    provided: true,
+                    expired: isExpired || (value != null && typeof (value as any)?.exp === 'number' && (value as any).exp * 1000 < Date.now()),
+                };
 
                 requestCtxStorage.set('token', tokenData);
                 c.set('token', tokenData);

package/utils/func.ts

@@ -19,29 +19,22 @@ const jwt = {
         audience?: string | string[];
         subject?: string;
     }) => {
-        try {
-            let SECRET_ = cfg.server.jwt?.secret || Bun.env.JWT_SECRET
-            if (!SECRET_) throw new Error('JWT_SECRET is not set');
-            let EXPIRES_IN = cfg.server.jwt?.expiresIn || '1h'
-
-            const secret = new TextEncoder().encode(SECRET_);
-            const signer = new Jose.SignJWT(payload)
-                .setProtectedHeader({ alg: 'HS256' })
-                .setIssuedAt()
-                .setExpirationTime(EXPIRES_IN || '1h')
-
-            if (options?.issuer) signer.setIssuer(options.issuer)
-            if (options?.audience) signer.setAudience(options.audience)
-            if (options?.subject) signer.setSubject(options.subject)
-
-            const token = await signer.sign(secret);
-            return token;
-        } catch (err: any) {
-            throw new AppError(err?.message || 'Failed to sign token', {
-                code: 'JWT_SIGN_ERROR',
-                status: 500,
-            });
-        }
+        let SECRET_ = cfg.server.jwt?.secret || Bun.env.JWT_SECRET
+        if (!SECRET_) throw new Error('JWT_SECRET is not set');
+        let EXPIRES_IN = cfg.server.jwt?.expiresIn || '1h'
+
+        const secret = new TextEncoder().encode(SECRET_);
+        const signer = new Jose.SignJWT(payload)
+            .setProtectedHeader({ alg: 'HS256' })
+            .setIssuedAt()
+            .setExpirationTime(EXPIRES_IN || '1h')
+
+        if (options?.issuer) signer.setIssuer(options.issuer)
+        if (options?.audience) signer.setAudience(options.audience)
+        if (options?.subject) signer.setSubject(options.subject)
+
+        const token = await signer.sign(secret);
+        return token;
     },
     verify: async (token: string): Promise<{ value: Record<string, unknown> | null, error: string | null }> => {
         try {
@@ -54,10 +47,10 @@ const jwt = {
                 value: payload,
                 error: null
             }
-        } catch (err: any) {
+        } catch (error) {
             return {
                 value: null,
-                error: err instanceof Error ? err.message : String(err)
+                error: error instanceof Error ? error.message : 'Invalid token'
             }
         }
     }