@drawnagency/primitives 0.1.54 → 0.1.55

package/dist/auth/index.js

@@ -9,7 +9,7 @@ import {
   signSessionToken,
   verifyAudienceToken,
   verifySessionToken
-} from "../chunk-PIKI3HUP.js";
+} from "../chunk-B5VYSTPB.js";
 import {
   isSameOriginRequest,
   requireSessionSecret,

package/dist/{chunk-PIKI3HUP.js → chunk-B5VYSTPB.js}

@@ -19,7 +19,7 @@ async function signSessionToken(session) {
 async function verifySessionToken(token) {
   const secret = requireSessionSecret();
   try {
-    const { payload } = await jose.jwtVerify(token, secret);
+    const { payload } = await jose.jwtVerify(token, secret, { algorithms: ["HS256"] });
     const role = payload.role;
     if (role !== "owner" && role !== "editor") return null;
     return {
@@ -38,7 +38,7 @@ async function signAudienceToken(audience) {
 async function verifyAudienceToken(token) {
   const secret = requireSessionSecret();
   try {
-    const { payload } = await jose.jwtVerify(token, secret);
+    const { payload } = await jose.jwtVerify(token, secret, { algorithms: ["HS256"] });
     const audience = payload.audience;
     return typeof audience === "string" && audience !== "" ? audience : null;
   } catch {

package/dist/index.js

@@ -70,7 +70,7 @@ import {
   signSessionToken,
   verifyAudienceToken,
   verifySessionToken
-} from "./chunk-PIKI3HUP.js";
+} from "./chunk-B5VYSTPB.js";
 import {
   isSameOriginRequest,
   requireSessionSecret,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drawnagency/primitives",
-  "version": "0.1.54",
+  "version": "0.1.55",
   "type": "module",
   "exports": {
     "./package.json": "./package.json",

package/src/auth/cookies.ts

@@ -23,7 +23,7 @@ export async function signSessionToken(session: Session): Promise<string> {
 export async function verifySessionToken(token: string): Promise<Session | null> {
   const secret = requireSessionSecret();  // throws on misconfiguration, before try
   try {
-    const { payload } = await jose.jwtVerify(token, secret);
+    const { payload } = await jose.jwtVerify(token, secret, { algorithms: ["HS256"] });
     const role = payload.role;
     if (role !== "owner" && role !== "editor") return null;
     return {
@@ -52,7 +52,7 @@ export async function signAudienceToken(audience: string): Promise<string> {
 export async function verifyAudienceToken(token: string): Promise<string | null> {
   const secret = requireSessionSecret(); // throws on misconfiguration, before try
   try {
-    const { payload } = await jose.jwtVerify(token, secret);
+    const { payload } = await jose.jwtVerify(token, secret, { algorithms: ["HS256"] });
     const audience = payload.audience;
     return typeof audience === "string" && audience !== "" ? audience : null;
   } catch {

package/src/components/shell/EditorShell.tsx

@@ -444,7 +444,7 @@ export default function EditorShell({
           if (restoredContent) {
             return {
               section: { id, ...restoredContent },
-              meta: restoredIndex.sections[id] ?? existing?.meta ?? { type: restoredContent.type, status: "draft", access: ["internal"] },
+              meta: restoredIndex.sections[id] ?? existing?.meta ?? { type: restoredContent.type, status: "draft", access: [] },
             };
           }
           if (existing) {