@korajs/auth 1.0.0-beta.0 → 1.0.0-beta.1

package/dist/server.cjs

@@ -405,7 +405,7 @@ var MAX_PASSWORD_LENGTH = 128;
 var MAX_NAME_LENGTH = 200;
 var CHALLENGE_TTL_MS = 6e4;
 function isValidEmail(email) {
-  if (email.length === 0 || email.length > 254) {
+  if (typeof email !== "string" || email.length === 0 || email.length > 254) {
     return false;
   }
   const atIndex = email.indexOf("@");
@@ -425,6 +425,9 @@ function isValidEmail(email) {
   return true;
 }
 function sanitizeName(name) {
+  if (typeof name !== "string") {
+    return "";
+  }
   const cleaned = name.replace(/[\x00-\x1f\x7f]/g, "");
   const trimmed = cleaned.trim();
   if (trimmed.length > MAX_NAME_LENGTH) {
@@ -475,7 +478,7 @@ var BuiltInAuthRoutes = class {
         }
       };
     }
-    if (body.password.length < MIN_PASSWORD_LENGTH) {
+    if (typeof body.password !== "string" || body.password.length < MIN_PASSWORD_LENGTH) {
       return {
         status: 400,
         body: {
@@ -539,6 +542,12 @@ var BuiltInAuthRoutes = class {
    * @returns Auth response with the user and tokens, or an error
    */
   async handleSignIn(body, clientIp) {
+    if (typeof body.email !== "string" || typeof body.password !== "string") {
+      return {
+        status: 400,
+        body: { error: "Email and password are required." }
+      };
+    }
     const rateLimitKey = clientIp ? `signin:${body.email.toLowerCase()}:${clientIp}` : `signin:${body.email.toLowerCase()}`;
     if (!await this.rateLimiter.isAllowed(rateLimitKey)) {
       return {
@@ -1046,6 +1055,9 @@ function decodeJwt(token) {
   }
 }
 function verifyJwt(token, secret) {
+  if (typeof token !== "string") {
+    return null;
+  }
   const parts = token.split(".");
   if (parts.length !== 3) {
     return null;
@@ -2057,6 +2069,11 @@ function createDefaultTokenManager(options) {
       "createKoraAuthServer requires jwtSecret in production. Set KORA_AUTH_SECRET or pass jwtSecret."
     );
   }
+  if (!secret) {
+    console.warn(
+      "[kora] No JWT secret configured; using an ephemeral random secret. Every token is invalidated when the process restarts. Set KORA_AUTH_SECRET or pass jwtSecret to createKoraAuthServer for stable sessions."
+    );
+  }
   return new TokenManager({
     secret: secret ?? TokenManager.generateSecret(),
     revocationStore: new InMemoryTokenRevocationStore(),
@@ -2359,7 +2376,11 @@ function notFound() {
   return { status: 404, body: { error: "Not found" } };
 }
 function readEnvSecret() {
-  return typeof process !== "undefined" ? process.env.KORA_AUTH_SECRET : void 0;
+  if (typeof process === "undefined") {
+    return void 0;
+  }
+  const value = process.env.KORA_AUTH_SECRET;
+  return value && value.trim().length > 0 ? value : void 0;
 }
 function isProduction() {
   return typeof process !== "undefined" && process.env.NODE_ENV === "production";
@@ -4222,7 +4243,7 @@ var MAX_ORG_NAME_LENGTH = 200;
 var MAX_SLUG_LENGTH = 100;
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,98}[a-z0-9]$/;
 function isValidEmail2(email) {
-  if (email.length === 0 || email.length > 254) return false;
+  if (typeof email !== "string" || email.length === 0 || email.length > 254) return false;
   const atIndex = email.indexOf("@");
   if (atIndex < 1) return false;
   const domain = email.slice(atIndex + 1);