@morojs/moro 1.5.17 → 1.6.1

package/src/core/logger/outputs.ts

@@ -29,6 +29,7 @@ export class FileOutput implements LogOutput {
 
       // TODO: Implement log rotation if needed
     } catch (error) {
+      // Use console.error as fallback since this is the logger itself
       console.error('File logger error:', error);
     }
   }
@@ -76,6 +77,7 @@ export class WebhookOutput implements LogOutput {
         throw new Error(`Webhook failed: ${response.status}`);
       }
     } catch (error) {
+      // Use console.error as fallback since this is the logger itself
       console.error('Webhook logger error:', error);
     }
   }

package/src/core/middleware/built-in/auth.ts

@@ -12,7 +12,6 @@ import {
   CredentialsProvider,
   EmailProvider,
 } from '../../../types/auth';
-import { safeVerifyJWT, createAuthErrorResponse } from './jwt-helpers';
 
 const logger = createFrameworkLogger('AuthMiddleware');
 
@@ -152,15 +151,7 @@ export const auth = (options: AuthOptions): MiddlewareInterface => ({
           return authInstance.getSession({ req });
         },
         getToken: async () => {
-          try {
-            return authInstance.verifyJWT(authRequest.token || '');
-          } catch (error: any) {
-            // Handle JWT errors gracefully in getToken method
-            logger.debug('Failed to verify token in getToken', 'TokenValidation', {
-              error: error.message,
-            });
-            return null;
-          }
+          return authInstance.verifyJWT(authRequest.token || '');
         },
         getCsrfToken: async () => {
           return authInstance.getCsrfToken();
@@ -186,60 +177,8 @@ export const auth = (options: AuthOptions): MiddlewareInterface => ({
           if (decoded) {
             session = await authInstance.getSession({ req: { ...req, token } });
           }
-        } catch (error: any) {
-          // Handle specific JWT errors gracefully and return proper HTTP responses
-          if (error.name === 'TokenExpiredError') {
-            logger.debug('JWT token expired', 'TokenValidation', {
-              message: error.message,
-              expiredAt: error.expiredAt,
-            });
-
-            // If this is a protected route request, return a proper 401 response
-            if (req.headers.accept?.includes('application/json')) {
-              return res.status(401).json(
-                createAuthErrorResponse({
-                  type: 'expired',
-                  message: error.message,
-                  expiredAt: error.expiredAt,
-                })
-              );
-            }
-          } else if (error.name === 'JsonWebTokenError') {
-            logger.debug('Invalid JWT token format', 'TokenValidation', {
-              message: error.message,
-            });
-
-            // If this is a protected route request, return a proper 401 response
-            if (req.headers.accept?.includes('application/json')) {
-              return res.status(401).json(
-                createAuthErrorResponse({
-                  type: 'invalid',
-                  message: error.message,
-                })
-              );
-            }
-          } else if (error.name === 'NotBeforeError') {
-            logger.debug('JWT token not active yet', 'TokenValidation', {
-              message: error.message,
-              date: error.date,
-            });
-
-            // If this is a protected route request, return a proper 401 response
-            if (req.headers.accept?.includes('application/json')) {
-              return res.status(401).json(
-                createAuthErrorResponse({
-                  type: 'malformed',
-                  message: error.message,
-                  date: error.date,
-                })
-              );
-            }
-          } else {
-            logger.debug('JWT token validation failed', 'TokenValidation', {
-              error: error.message || error,
-            });
-          }
-          // Continue with unauthenticated state for non-API requests
+        } catch (error) {
+          logger.debug('Invalid JWT token', 'TokenValidation', { error });
         }
       }
 
@@ -290,11 +229,11 @@ export const auth = (options: AuthOptions): MiddlewareInterface => ({
   },
 });
 
-// Auth.js implementation with proper JWT handling
+// Mock Auth.js implementation (would be replaced with actual Auth.js)
 async function initializeAuthJS(config: AuthOptions): Promise<any> {
   return {
     handler: async (req: any, res: any) => {
-      // Basic Auth.js request handler
+      // Mock Auth.js request handler
       const path = req.url.replace(config.basePath!, '');
 
       if (path.startsWith('/signin')) {
@@ -315,7 +254,7 @@ async function initializeAuthJS(config: AuthOptions): Promise<any> {
     },
 
     getSession: async ({ req }: { req: any }) => {
-      // Basic session retrieval
+      // Mock session retrieval
       const sessionId =
         req.cookies?.['next-auth.session-token'] ||
         req.cookies?.['__Secure-next-auth.session-token'];
@@ -331,53 +270,33 @@ async function initializeAuthJS(config: AuthOptions): Promise<any> {
     },
 
     verifyJWT: async (token: string) => {
-      const secret = process.env.JWT_SECRET || config.jwt?.secret || config.secret || '';
-
-      // Use the safe JWT verification function
-      const result = safeVerifyJWT(token, secret);
-
-      if (!result.success) {
-        // Create a custom error that includes the structured error information
-        const customError = new Error(result.error?.message || 'JWT verification failed');
-
-        // Add the error type information for upstream handling
-        (customError as any).jwtErrorType = result.error?.type;
-        (customError as any).jwtErrorDetails = result.error;
-
-        // Map the safe error types back to standard JWT error names for compatibility
-        if (result.error?.type === 'expired') {
-          customError.name = 'TokenExpiredError';
-          (customError as any).expiredAt = result.error.expiredAt;
-        } else if (result.error?.type === 'invalid') {
-          customError.name = 'JsonWebTokenError';
-        } else if (result.error?.type === 'malformed') {
-          customError.name = 'NotBeforeError';
-          (customError as any).date = result.error.date;
-        }
-
-        throw customError;
+      // Mock JWT verification
+      try {
+        // In real implementation, use jose or jsonwebtoken
+        const payload = JSON.parse(Buffer.from(token.split('.')[1], 'base64').toString());
+        return payload;
+      } catch {
+        return null;
       }
-
-      return result.payload;
     },
 
     signIn: async (provider?: string, options?: any) => {
-      // Basic sign in redirect
+      // Mock sign in
       return { url: `${config.basePath}/signin${provider ? `/${provider}` : ''}` };
     },
 
     signOut: async (options?: any) => {
-      // Basic sign out redirect
+      // Mock sign out
       return { url: `${config.basePath}/signout` };
     },
 
     updateSession: async (session: any) => {
-      // Basic session update
+      // Mock session update
       return session;
     },
 
     getCsrfToken: async () => {
-      // Basic CSRF token generation
+      // Mock CSRF token generation
       const crypto = require('crypto');
       return crypto.randomBytes(32).toString('hex');
     },

package/src/core/middleware/built-in/cache.ts

@@ -188,9 +188,7 @@ export const cache = (options: CacheOptions = {}): MiddlewareInterface => ({
           parts.push(`stale-while-revalidate=${directives.staleWhileRevalidate}`);
         }
 
-        if (!res.headersSent) {
-          res.setHeader('Cache-Control', parts.join(', '));
-        }
+        res.setHeader('Cache-Control', parts.join(', '));
         return res;
       };
 

package/src/core/middleware/built-in/index.ts

@@ -33,14 +33,6 @@ export {
   sessionHelpers,
 } from './auth-helpers';
 
-// JWT Utilities for Custom Middleware
-export {
-  safeVerifyJWT,
-  extractJWTFromHeader,
-  createAuthErrorResponse,
-  type JWTVerificationResult,
-} from './jwt-helpers';
-
 export {
   extendedProviders,
   enterpriseProviders,

package/src/core/middleware/built-in/request-logger.ts

@@ -1,7 +1,5 @@
 // Simple request logging middleware
-import { createFrameworkLogger } from '../../logger';
-
-const logger = createFrameworkLogger('RequestLogger');
+import { logger } from '../../logger';
 
 export const requestLogger = async (context: any): Promise<void> => {
   const startTime = Date.now();

package/src/core/middleware/built-in/sse.ts

@@ -35,15 +35,13 @@ export const sse = (
       logger.debug('Setting up SSE connection', 'SSESetup');
 
       // Set SSE headers
-      if (!res.headersSent) {
-        res.writeHead(200, {
-          'Content-Type': 'text/event-stream',
-          'Cache-Control': 'no-cache',
-          Connection: 'keep-alive',
-          'Access-Control-Allow-Origin': options.cors ? '*' : undefined,
-          'Access-Control-Allow-Headers': options.cors ? 'Cache-Control' : undefined,
-        });
-      }
+      res.writeHead(200, {
+        'Content-Type': 'text/event-stream',
+        'Cache-Control': 'no-cache',
+        Connection: 'keep-alive',
+        'Access-Control-Allow-Origin': options.cors ? '*' : undefined,
+        'Access-Control-Allow-Headers': options.cors ? 'Cache-Control' : undefined,
+      });
 
       // Add SSE methods to response
       res.sendEvent = (data: any, event?: string, id?: string) => {