@juspay/neurolink 13.8.17 → 13.8.19

package/dist/server/adapters/honoAdapter.js

@@ -7,6 +7,9 @@ import { logger } from "../../utils/logger.js";
 import { AlreadyRunningError, ServerAdapterError, ServerStopError, wrapError, } from "../errors.js";
 import { BaseServerAdapter } from "../abstract/baseServerAdapter.js";
 import { markContextCarried } from "../utils/carriedContextMark.js";
+import { resolveClientAddress } from "../utils/clientAddress.js";
+import { shapeRouteError } from "../utils/clientError.js";
+import { pathMatchesAny } from "../utils/pathMatch.js";
 import { isErrorResponse } from "../utils/validation.js";
 import { isRawBodyContentType, isWebResponse, parseByteLimit, RawBodyTooLargeError, readBoundedRequestBody, } from "../utils/rawBody.js";
 /**
@@ -32,9 +35,13 @@ export class HonoServerAdapter extends BaseServerAdapter {
     // Populated by initializeFramework's dynamic imports; used by methods that
     // run after initialization (route registration, streaming) and so cannot
     // rely on initializeFramework's own local closure variables.
-    HTTPExceptionCtor;
     streamSSEFn;
     parseFormBody;
+    // The runtime's view of the TCP peer (Node, Bun or Deno); undefined where the
+    // runtime offers none, and then requests carry no address.
+    getConnInfoFn;
+    // The rate limiter counts nothing it cannot attribute, and says so once.
+    warnedNoClientAddress = false;
     constructor(neurolink, config = {}) {
         super(neurolink, config);
     }
@@ -44,12 +51,8 @@ export class HonoServerAdapter extends BaseServerAdapter {
     createRateLimiter() {
         return async (c, next) => {
             // Skip rate limiting for excluded paths
-            if (this.config.rateLimit.skipPaths) {
-                for (const skipPath of this.config.rateLimit.skipPaths) {
-                    if (c.req.path.startsWith(skipPath)) {
-                        return next();
-                    }
-                }
+            if (pathMatchesAny(c.req.path, this.config.rateLimit.skipPaths)) {
+                return next();
             }
             // Use custom keyGenerator if provided, otherwise default to IP-based key
             let key;
@@ -71,14 +74,29 @@ export class HonoServerAdapter extends BaseServerAdapter {
                     externalServerManager: this.externalServerManager,
                     timestamp: Date.now(),
                     metadata: {},
+                    remoteAddress: this.remoteAddressFor(c),
                 };
                 key = this.config.rateLimit.keyGenerator(minCtx);
             }
             else {
-                key =
-                    c.req.header("x-forwarded-for") ||
-                        c.req.header("x-real-ip") ||
-                        "unknown";
+                // The TCP peer, or behind a declared proxy the client it reports. A
+                // header alone used to be the key, so one shared "unknown" bucket
+                // served every direct client and a rotating X-Forwarded-For escaped
+                // the limit; a request with no attributable address is now let
+                // through rather than pooled with every other such request.
+                key = resolveClientAddress({
+                    remoteAddress: this.remoteAddressFor(c),
+                    forwardedFor: c.req.header("x-forwarded-for"),
+                    trustProxy: this.config.rateLimit.trustProxy,
+                    trustedProxies: this.config.rateLimit.trustedProxies,
+                });
+                if (key === undefined) {
+                    if (!this.warnedNoClientAddress) {
+                        this.warnedNoClientAddress = true;
+                        logger.alwaysStderr("[HonoAdapter] The runtime reports no peer address for requests, so the rate limiter cannot count them; configure rateLimit.keyGenerator to limit by another key.");
+                    }
+                    return next();
+                }
             }
             const now = Date.now();
             const windowMs = this.config.rateLimit.windowMs;
@@ -137,9 +155,9 @@ export class HonoServerAdapter extends BaseServerAdapter {
             this.importFrameworkDependency("hono/timeout", "hono"),
             this.importFrameworkDependency("hono/utils/body", "hono"),
         ]);
-        this.HTTPExceptionCtor = HTTPException;
         this.streamSSEFn = streamSSE;
         this.parseFormBody = parseBody;
+        this.getConnInfoFn = await this.loadConnInfo();
         this.app = new Hono();
         // Add secure headers
         this.app.use("*", secureHeaders());
@@ -235,6 +253,7 @@ export class HonoServerAdapter extends BaseServerAdapter {
             const startTime = Date.now();
             // Track connection for graceful shutdown
             this.trackConnection(connectionId, undefined, requestId);
+            let abort;
             try {
                 // Extract path parameters
                 const params = c.req.param();
@@ -263,6 +282,15 @@ export class HonoServerAdapter extends BaseServerAdapter {
                     }
                     ctx = created;
                 }
+                // The handler learns of a client that went away through the request's
+                // own signal, and of the request timeout through the same controller
+                // (Hono's timeout middleware answers 504; this stops the work).
+                abort = this.attachRequestAbort(ctx, {
+                    onClientClose: (listener) => c.req.raw.signal.addEventListener("abort", listener, {
+                        once: true,
+                    }),
+                    applyTimeout: !route.streaming?.enabled,
+                });
                 // Emit request event
                 this.emit("request", {
                     requestId,
@@ -344,15 +372,23 @@ export class HonoServerAdapter extends BaseServerAdapter {
                 });
             }
             catch (error) {
-                const errorMessage = error instanceof Error ? error.message : String(error);
-                logger.error("[HonoAdapter] Handler error", {
+                // The exception's text stays in the log under this request id; the
+                // client gets a fixed message for its category. It used to get the
+                // text itself, environment variable names and upstream bodies included.
+                const shaped = shapeRouteError("HonoAdapter", requestId, error);
+                this.emit("response", {
                     requestId,
-                    route: route.path,
-                    error: errorMessage,
+                    statusCode: shaped.status,
+                    duration: Date.now() - startTime,
+                    timestamp: new Date(),
                 });
-                throw new this.HTTPExceptionCtor(500, { message: errorMessage });
+                return c.json({
+                    error: { code: shaped.code, message: shaped.message },
+                    metadata: { requestId, timestamp: new Date().toISOString() },
+                }, shaped.status);
             }
             finally {
+                abort?.release();
                 // Untrack connection when request completes
                 this.untrackConnection(connectionId);
                 // Clean up context store to prevent memory leaks
@@ -417,13 +453,14 @@ export class HonoServerAdapter extends BaseServerAdapter {
                 });
             }
             catch (error) {
+                const shaped = shapeRouteError("HonoAdapter", ctx.requestId, error);
                 await stream.writeSSE({
                     data: JSON.stringify({
                         type: "error",
                         error: {
-                            code: "STREAM_ERROR",
-                            message: error instanceof Error ? error.message : "Stream error",
-                            status: 500,
+                            code: shaped.code,
+                            message: shaped.message,
+                            status: shaped.status,
                         },
                         timestamp: Date.now(),
                     }),
@@ -482,7 +519,7 @@ export class HonoServerAdapter extends BaseServerAdapter {
         for (const path of paths) {
             this.app.use(path, async (c, next) => {
                 // Skip excluded paths
-                if (middleware.excludePaths?.some((p) => c.req.path.startsWith(p))) {
+                if (pathMatchesAny(c.req.path, middleware.excludePaths)) {
                     return next();
                 }
                 // Extract path parameters
@@ -566,6 +603,7 @@ export class HonoServerAdapter extends BaseServerAdapter {
             this.startTime = new Date();
             this.lifecycleState = "running";
             logger.info(`[HonoAdapter] Server started on ${host}:${port}`);
+            this.warnIfSensitiveRoutesUnauthenticated();
             this.emit("started", {
                 port,
                 host,
@@ -684,6 +722,45 @@ export class HonoServerAdapter extends BaseServerAdapter {
         });
         return headers;
     }
+    /**
+     * The runtime's connection-info helper: `@hono/node-server`'s on Node, the
+     * Bun or Deno adapter's there. Absent on a runtime that offers none.
+     */
+    async loadConnInfo() {
+        try {
+            if (typeof Bun !== "undefined") {
+                const bun = await import("hono/bun");
+                return bun.getConnInfo;
+            }
+            if (typeof Deno !== "undefined") {
+                const deno = await import("hono/deno");
+                return deno.getConnInfo;
+            }
+            const node = await import("@hono/node-server/conninfo");
+            return node.getConnInfo;
+        }
+        catch (error) {
+            logger.debug("[HonoAdapter] No connection-info helper for this runtime", {
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return undefined;
+        }
+    }
+    /** The TCP peer of this request, when the runtime reports one. */
+    remoteAddressFor(c) {
+        if (!this.getConnInfoFn) {
+            return undefined;
+        }
+        try {
+            const address = this.getConnInfoFn(c).remote.address;
+            return typeof address === "string" && address.length > 0
+                ? address
+                : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
     extractQuery(c) {
         const query = {};
         const url = new URL(c.req.url);
@@ -726,6 +803,7 @@ export class HonoServerAdapter extends BaseServerAdapter {
             query: this.extractQuery(c),
             params,
             body,
+            remoteAddress: this.remoteAddressFor(c),
         });
     }
     async extractBody(c) {

package/dist/server/adapters/koaAdapter.d.ts

@@ -18,6 +18,7 @@ export declare class KoaServerAdapter extends BaseServerAdapter {
     private rateLimitStore;
     private rateLimitCleanupInterval?;
     private sockets;
+    private warnedNoClientAddress;
     private registeredMiddleware;
     constructor(neurolink: NeuroLink, config?: ServerAdapterConfig);
     /**

package/dist/server/adapters/koaAdapter.js

@@ -6,6 +6,9 @@
 import { logger } from "../../utils/logger.js";
 import { AlreadyRunningError, ServerAdapterError, ServerStopError, wrapError, } from "../errors.js";
 import { BaseServerAdapter } from "../abstract/baseServerAdapter.js";
+import { resolveClientAddress } from "../utils/clientAddress.js";
+import { shapeRouteError } from "../utils/clientError.js";
+import { pathMatchesAny } from "../utils/pathMatch.js";
 import { isErrorResponse } from "../utils/validation.js";
 import { isRawBodyContentType, isWebResponse, parseByteLimit, RawBodyTooLargeError, readRawBody, readWebResponse, } from "../utils/rawBody.js";
 /**
@@ -20,6 +23,8 @@ export class KoaServerAdapter extends BaseServerAdapter {
     rateLimitStore = new Map();
     rateLimitCleanupInterval;
     sockets = new Set();
+    // The rate limiter counts nothing it cannot attribute, and says so once.
+    warnedNoClientAddress = false;
     // Middleware from registerMiddleware(). It runs through one dispatcher that
     // is mounted ahead of the router: app.use() after the router is mounted
     // would only ever see requests no route matched.
@@ -72,12 +77,15 @@ export class KoaServerAdapter extends BaseServerAdapter {
                 });
                 const adapterError = error instanceof ServerAdapterError ? error : undefined;
                 const statusCode = adapterError?.getHttpStatus() || err.status || err.statusCode || 500;
+                // A 4xx carries a message this server or Koa composed; any 5xx's
+                // text stays in the log.
+                const serverSide = statusCode >= 500;
                 ctx.status = statusCode;
                 ctx.body = {
                     error: {
                         code: adapterError?.code ??
-                            (statusCode === 500 ? "INTERNAL_ERROR" : `HTTP_${statusCode}`),
-                        message: statusCode === 500 ? "An internal error occurred" : err.message,
+                            (serverSide ? "INTERNAL_ERROR" : `HTTP_${statusCode}`),
+                        message: serverSide ? "An internal error occurred" : err.message,
                     },
                     metadata: {
                         requestId,
@@ -92,10 +100,13 @@ export class KoaServerAdapter extends BaseServerAdapter {
             const cors = corsModule.default;
             this.app.use(cors({
                 origin: (ctx) => {
-                    const origin = ctx.request.headers.origin || "*";
+                    // The wildcard is sent as the literal "*": reflecting the
+                    // request's Origin instead would grant any page a credentialed
+                    // allowance the wildcard itself cannot carry.
                     if (this.config.cors.origins.includes("*")) {
-                        return origin;
+                        return "*";
                     }
+                    const origin = ctx.request.headers.origin ?? "";
                     return this.config.cors.origins.includes(origin) ? origin : "";
                 },
                 allowMethods: this.config.cors.methods?.join(","),
@@ -165,18 +176,38 @@ export class KoaServerAdapter extends BaseServerAdapter {
     createRateLimiter() {
         return async (ctx, next) => {
             // Skip rate limiting for excluded paths
-            if (this.config.rateLimit.skipPaths) {
-                for (const skipPath of this.config.rateLimit.skipPaths) {
-                    if (ctx.path.startsWith(skipPath)) {
-                        await next();
-                        return;
-                    }
+            if (pathMatchesAny(ctx.path, this.config.rateLimit.skipPaths)) {
+                await next();
+                return;
+            }
+            // The TCP peer, or behind a declared proxy the client it reports. A
+            // header alone used to be the key, so a rotating X-Forwarded-For escaped
+            // the limit; a request with no attributable address is let through
+            // rather than pooled with every other such request.
+            const key = this.config.rateLimit.keyGenerator
+                ? this.config.rateLimit.keyGenerator(this.createContext({
+                    requestId: ctx.state.requestId,
+                    method: ctx.method,
+                    path: ctx.path,
+                    headers: ctx.headers,
+                    query: ctx.query,
+                    params: {},
+                    remoteAddress: ctx.req.socket?.remoteAddress,
+                }))
+                : resolveClientAddress({
+                    remoteAddress: ctx.req.socket?.remoteAddress,
+                    forwardedFor: ctx.get("x-forwarded-for") || undefined,
+                    trustProxy: this.config.rateLimit.trustProxy,
+                    trustedProxies: this.config.rateLimit.trustedProxies,
+                });
+            if (key === undefined) {
+                if (!this.warnedNoClientAddress) {
+                    this.warnedNoClientAddress = true;
+                    logger.alwaysStderr("[KoaAdapter] A request arrived with no peer address, so the rate limiter cannot count it; configure rateLimit.keyGenerator to limit by another key.");
                 }
+                await next();
+                return;
             }
-            const key = ctx.get("x-forwarded-for") ||
-                ctx.get("x-real-ip") ||
-                ctx.ip ||
-                "unknown";
             const now = Date.now();
             const windowMs = this.config.rateLimit.windowMs;
             const maxRequests = this.config.rateLimit.maxRequests;
@@ -256,12 +287,24 @@ export class KoaServerAdapter extends BaseServerAdapter {
                 query: ctx.query,
                 params: ctx.params,
                 body: ctx.request.body,
+                remoteAddress: ctx.req.socket?.remoteAddress,
             });
             // Copy response headers from middleware (stored in ctx.state by middleware)
             if (ctx.state.responseHeaders) {
                 serverCtx.responseHeaders = { ...ctx.state.responseHeaders };
             }
             this.restoreCarriedContext(serverCtx, ctx.state.carriedContext);
+            // The handler learns of a client that went away, and a request over
+            // `config.timeout` is answered 504 and its work aborted. Koa applied no
+            // request timeout at all.
+            const abort = this.attachRequestAbort(serverCtx, {
+                onClientClose: (listener) => ctx.req.on("close", () => {
+                    if (!ctx.res.writableFinished) {
+                        listener();
+                    }
+                }),
+                applyTimeout: !route.streaming?.enabled,
+            });
             // Emit request event
             this.emit("request", {
                 requestId,
@@ -269,39 +312,68 @@ export class KoaServerAdapter extends BaseServerAdapter {
                 path: serverCtx.path,
                 timestamp: new Date(),
             });
-            // Handle streaming if configured
-            if (route.streaming?.enabled) {
-                return this.handleStreamingResponse(ctx, serverCtx, route);
-            }
-            // Execute handler
-            const result = await route.handler(serverCtx);
-            const duration = Date.now() - startTime;
-            // A route that answers in its own wire format returns a web Response.
-            if (isWebResponse(result)) {
-                const raw = await readWebResponse(result);
-                this.emit("response", {
-                    requestId,
-                    statusCode: raw.status,
-                    duration,
-                    timestamp: new Date(),
-                });
-                for (const [key, value] of Object.entries({
-                    ...serverCtx.responseHeaders,
-                    ...raw.headers,
-                })) {
-                    ctx.set(key, value);
+            try {
+                // Handle streaming if configured
+                if (route.streaming?.enabled) {
+                    return await this.handleStreamingResponse(ctx, serverCtx, route);
                 }
-                ctx.status = raw.status;
-                ctx.body = raw.body;
-                return;
-            }
-            // Check if result is an error response
-            if (isErrorResponse(result)) {
-                const statusCode = result.httpStatus ?? 500;
-                // Emit response event with error status
+                // Execute handler
+                const result = abort.deadline
+                    ? await Promise.race([route.handler(serverCtx), abort.deadline])
+                    : await route.handler(serverCtx);
+                const duration = Date.now() - startTime;
+                // A route that answers in its own wire format returns a web Response.
+                if (isWebResponse(result)) {
+                    const raw = await readWebResponse(result);
+                    this.emit("response", {
+                        requestId,
+                        statusCode: raw.status,
+                        duration,
+                        timestamp: new Date(),
+                    });
+                    for (const [key, value] of Object.entries({
+                        ...serverCtx.responseHeaders,
+                        ...raw.headers,
+                    })) {
+                        ctx.set(key, value);
+                    }
+                    ctx.status = raw.status;
+                    ctx.body = raw.body;
+                    return;
+                }
+                // Check if result is an error response
+                if (isErrorResponse(result)) {
+                    const statusCode = result.httpStatus ?? 500;
+                    // Emit response event with error status
+                    this.emit("response", {
+                        requestId,
+                        statusCode,
+                        duration,
+                        timestamp: new Date(),
+                    });
+                    // Apply response headers from middleware and handler
+                    if (serverCtx.responseHeaders) {
+                        for (const [key, value] of Object.entries(serverCtx.responseHeaders)) {
+                            ctx.set(key, value);
+                        }
+                    }
+                    // Return error response with proper status code
+                    ctx.status = statusCode;
+                    ctx.body = {
+                        error: result.error,
+                        metadata: {
+                            ...result.metadata,
+                            requestId,
+                            timestamp: new Date().toISOString(),
+                            duration,
+                        },
+                    };
+                    return;
+                }
+                // Emit response event
                 this.emit("response", {
                     requestId,
-                    statusCode,
+                    statusCode: 200,
                     duration,
                     timestamp: new Date(),
                 });
@@ -311,41 +383,44 @@ export class KoaServerAdapter extends BaseServerAdapter {
                         ctx.set(key, value);
                     }
                 }
-                // Return error response with proper status code
-                ctx.status = statusCode;
+                // Return formatted response
                 ctx.body = {
-                    error: result.error,
+                    data: result,
                     metadata: {
-                        ...result.metadata,
                         requestId,
                         timestamp: new Date().toISOString(),
                         duration,
                     },
                 };
-                return;
             }
-            // Emit response event
-            this.emit("response", {
-                requestId,
-                statusCode: 200,
-                duration,
-                timestamp: new Date(),
-            });
-            // Apply response headers from middleware and handler
-            if (serverCtx.responseHeaders) {
-                for (const [key, value] of Object.entries(serverCtx.responseHeaders)) {
-                    ctx.set(key, value);
+            catch (error) {
+                // The exception's text stays in the log under this request id; the
+                // client gets a fixed message for its category.
+                const shaped = shapeRouteError("KoaAdapter", requestId, error);
+                this.emitRequestError({
+                    requestId,
+                    error: error instanceof Error ? error : new Error(String(error)),
+                    timestamp: new Date(),
+                });
+                this.emit("response", {
+                    requestId,
+                    statusCode: shaped.status,
+                    duration: Date.now() - startTime,
+                    timestamp: new Date(),
+                });
+                if (ctx.res.headersSent) {
+                    ctx.res.end();
+                    return;
                 }
+                ctx.status = shaped.status;
+                ctx.body = {
+                    error: { code: shaped.code, message: shaped.message },
+                    metadata: { requestId, timestamp: new Date().toISOString() },
+                };
+            }
+            finally {
+                abort.release();
             }
-            // Return formatted response
-            ctx.body = {
-                data: result,
-                metadata: {
-                    requestId,
-                    timestamp: new Date().toISOString(),
-                    duration,
-                },
-            };
         });
     }
     /**
@@ -382,9 +457,13 @@ export class KoaServerAdapter extends BaseServerAdapter {
             stream.end();
         }
         catch (error) {
+            const shaped = shapeRouteError("KoaAdapter", serverCtx.requestId, error);
             stream.write(`event: error\n`);
             stream.write(`data: ${JSON.stringify({
-                error: error instanceof Error ? error.message : "Stream error",
+                error: shaped.message,
+                code: shaped.code,
+                status: shaped.status,
+                requestId: serverCtx.requestId,
             })}\n\n`);
             stream.end();
         }
@@ -395,13 +474,11 @@ export class KoaServerAdapter extends BaseServerAdapter {
     registerFrameworkMiddleware(middleware) {
         this.registeredMiddleware.push(async (ctx, next) => {
             // Skip excluded paths
-            if (middleware.excludePaths?.some((p) => ctx.path.startsWith(p))) {
+            if (pathMatchesAny(ctx.path, middleware.excludePaths)) {
                 return next();
             }
             // Check if path matches
-            const paths = middleware.paths || ["/"];
-            const matches = paths.some((p) => ctx.path.startsWith(p) || p === "*");
-            if (!matches) {
+            if (!pathMatchesAny(ctx.path, middleware.paths || ["/"])) {
                 return next();
             }
             // Initialize response headers storage in ctx.state if not present
@@ -417,6 +494,7 @@ export class KoaServerAdapter extends BaseServerAdapter {
                 query: ctx.query,
                 params: ctx.params,
                 body: ctx.request.body,
+                remoteAddress: ctx.req.socket?.remoteAddress,
             });
             // Copy existing response headers to context
             serverCtx.responseHeaders = { ...ctx.state.responseHeaders };
@@ -470,6 +548,7 @@ export class KoaServerAdapter extends BaseServerAdapter {
                     this.isRunning = true;
                     this.startTime = new Date();
                     this.lifecycleState = "running";
+                    this.warnIfSensitiveRoutesUnauthenticated();
                     // Track connections for graceful shutdown
                     this.server?.on("connection", (socket) => {
                         const connectionId = `conn-${Date.now()}-${Math.random().toString(36).substring(2, 9)}`;

package/dist/server/index.d.ts

@@ -42,6 +42,8 @@ export { createAgentRoutes, createAllRoutes, createHealthRoutes, createMCPRoutes
 export { BaseDataStreamWriter, createDataStreamResponse, createDataStreamWriter, createNDJSONHeaders, createSSEHeaders, DataStreamResponse, formatSSEEvent, pipeAsyncIterableToDataStream, WebStreamWriter, } from "./streaming/index.js";
 export { ErrorCategory, ErrorSeverity, ServerAdapterErrorCode, } from "../types/index.js";
 export { createStreamRedactor, redactStreamChunk } from "./utils/redaction.js";
+export { isLoopbackAddress, resolveClientAddress, } from "./utils/clientAddress.js";
+export { clientFacingError } from "./utils/clientError.js";
 export { AgentExecuteRequestSchema, createErrorResponse, ServerNameParamSchema, SessionIdParamSchema, ToolArgumentsSchema, ToolExecuteRequestSchema, ToolNameParamSchema, ToolSearchQuerySchema, TranscribeConfigSchema, TranscribeRequestSchema, TranscribeStreamConfigSchema, validateParams, validateQuery, validateRequest, } from "./utils/validation.js";
 export { createAgentWebSocketHandler, WebSocketConnectionManager, WebSocketMessageRouter, } from "./websocket/index.js";
 export { attachTranscribeWebSocket } from "./websocket/transcribeWebSocket.js";

package/dist/server/index.js

@@ -117,6 +117,10 @@ pipeAsyncIterableToDataStream, WebStreamWriter, } from "./streaming/index.js";
 // Export error constants
 export { ErrorCategory, ErrorSeverity, ServerAdapterErrorCode, } from "../types/index.js";
 export { createStreamRedactor, redactStreamChunk } from "./utils/redaction.js";
+// The address a request is counted against (for a custom rate-limit
+// keyGenerator behind a reverse proxy) and the loopback test the adapters use.
+export { isLoopbackAddress, resolveClientAddress, } from "./utils/clientAddress.js";
+export { clientFacingError } from "./utils/clientError.js";
 // ============================================
 // Validation Utilities
 // ============================================

package/dist/server/middleware/auth.js

@@ -65,6 +65,7 @@ export function createAuthMiddleware(config) {
         name: "authentication",
         order: 10, // Run early but after request ID
         excludePaths: skipPaths,
+        authenticates: true,
         handler: async (ctx, next) => {
             // The playground header is a development convenience, so it is honoured
             // only when NODE_ENV is exactly "development". An unset NODE_ENV (the
@@ -286,12 +287,15 @@ export function createBearerAuthMiddleware(validate, options = {}) {
         name: "bearer-auth",
         order: 10,
         excludePaths: skipPaths,
+        authenticates: true,
         handler: async (ctx, next) => {
             const authHeader = ctx.headers[headerName.toLowerCase()];
-            // Extract bearer token
+            // Extract bearer token. The token must open with a non-whitespace
+            // character, as in extractToken(): with `\s+(.+)` a header that failed
+            // to match was retried at every split, quadratic in its length.
             let token = null;
             if (authHeader) {
-                const match = authHeader.match(/^Bearer\s+(.+)$/i);
+                const match = authHeader.match(/^Bearer\s+(\S.*)$/i);
                 token = match ? match[1] : null;
             }
             // Handle missing token

package/dist/server/middleware/cache.js

@@ -136,10 +136,15 @@ export function createCacheMiddleware(config) {
     };
 }
 /**
- * Default cache key generator
+ * Default cache key generator. An authenticated user's id is part of the key,
+ * so one caller's cached response is never served to another; without a user
+ * the key is the request alone, as before.
  */
 function defaultKeyGenerator(ctx) {
     const parts = [ctx.method, ctx.path];
+    if (ctx.user?.id) {
+        parts.push(`user=${ctx.user.id}`);
+    }
     // Include sorted query params
     const queryKeys = Object.keys(ctx.query).sort();
     if (queryKeys.length > 0) {