@porulle/core 0.15.0 → 0.16.0

package/dist/auth/actor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actor.d.ts","sourceRoot":"","sources":["../../src/auth/actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG/C,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC,eAAO,MAAM,mBAAmB,qBAAwC,CAAC;AAEzE,eAAO,MAAM,4BAA4B,0JAS/B,CAAC;AAEX,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,EAAE,CAEvE;AAYD,8EAA8E;AAC9E,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,OAAsD,GAC9D,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAsEvB"}
+{"version":3,"file":"actor.d.ts","sourceRoot":"","sources":["../../src/auth/actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC,eAAO,MAAM,mBAAmB,qBAAwC,CAAC;AAEzE,eAAO,MAAM,4BAA4B,0JAS/B,CAAC;AAEX,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,EAAE,CAEvE;AAYD,8EAA8E;AAC9E,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,OAAsD,GAC9D,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CA0EvB"}

package/dist/auth/actor.js

@@ -1,4 +1,5 @@
 import { DEFAULT_ORG_ID } from "./org.js";
+import { isCredentialRejection } from "./auth-failure.js";
 export const AUTH_COOKIE_PREFIX = "uc";
 export const SESSION_COOKIE_NAME = `${AUTH_COOKIE_PREFIX}.session_token`;
 export const DEFAULT_CUSTOMER_PERMISSIONS = [
@@ -29,8 +30,13 @@ export async function resolveActor(headers, auth, config, request = new Request(
             headers,
         }));
     }
-    catch {
-        return null;
+    catch (err) {
+        // A rejected session is anonymous. A session store that could not answer is
+        // a fault: reporting it as "no session" downgrades a signed-in caller
+        // silently and leaves nothing to debug.
+        if (isCredentialRejection(err))
+            return null;
+        throw err;
     }
     if (!session)
         return null;

package/dist/auth/auth-failure.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Separates a credential better-auth evaluated and rejected from an auth check
+ * that failed to run. Only the first justifies telling a caller their
+ * credential is bad; the second is a fault and must surface as one.
+ *
+ * Matched structurally rather than with `instanceof APIError`. A cross-copy
+ * `instanceof` is false whenever two better-auth copies are resolved into one
+ * tree — which is precisely the fault this predicate has to stay honest about.
+ * `kernel/error-mapper.ts` reads `constructor?.name` for the same reason.
+ *
+ * better-call's `APIError` carries `name === "APIError"` and a numeric
+ * `statusCode`; its `status` is a string such as `"UNAUTHORIZED"`.
+ */
+export declare function isCredentialRejection(err: unknown): boolean;
+//# sourceMappingURL=auth-failure.d.ts.map

package/dist/auth/auth-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-failure.d.ts","sourceRoot":"","sources":["../../src/auth/auth-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAI3D"}

package/dist/auth/auth-failure.js

@@ -0,0 +1,19 @@
+/**
+ * Separates a credential better-auth evaluated and rejected from an auth check
+ * that failed to run. Only the first justifies telling a caller their
+ * credential is bad; the second is a fault and must surface as one.
+ *
+ * Matched structurally rather than with `instanceof APIError`. A cross-copy
+ * `instanceof` is false whenever two better-auth copies are resolved into one
+ * tree — which is precisely the fault this predicate has to stay honest about.
+ * `kernel/error-mapper.ts` reads `constructor?.name` for the same reason.
+ *
+ * better-call's `APIError` carries `name === "APIError"` and a numeric
+ * `statusCode`; its `status` is a string such as `"UNAUTHORIZED"`.
+ */
+export function isCredentialRejection(err) {
+    if (typeof err !== "object" || err === null)
+        return false;
+    const { name, statusCode } = err;
+    return name === "APIError" && typeof statusCode === "number";
+}

package/dist/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAY/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAK1D,wBAAgB,cAAc,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,cAAc,GACrB,iBAAiB,CAiMnB"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAa/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAK1D,wBAAgB,cAAc,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,cAAc,GACrB,iBAAiB,CAiNnB"}

package/dist/auth/middleware.js

@@ -1,5 +1,6 @@
 import { getCustomerPermissions, resolveActor } from "./actor.js";
 import { DEFAULT_ORG_ID } from "./org.js";
+import { isCredentialRejection } from "./auth-failure.js";
 import { isStrictOrgResolution } from "./strict-org-resolution.js";
 function emptyToNull(value) {
     return value == null || value === "" ? null : value;
@@ -31,7 +32,20 @@ export function authMiddleware(auth, config) {
                 }
             }
         }
-        const actor = await resolveActor(c.req.raw.headers, auth, config, c.req.raw);
+        // A caller told "Authentication required." goes and checks their
+        // credential. When the check never ran, that answer is a lie and there is
+        // nothing in the log to correct it. Report a fault as a fault.
+        const reportAuthCheckFault = (err, stage) => {
+            c.get("logger")?.error({ err, stage, path: c.req.path, method: c.req.method }, "auth check failed — the credential was never evaluated, so this is not an authentication failure");
+        };
+        let actor;
+        try {
+            actor = await resolveActor(c.req.raw.headers, auth, config, c.req.raw);
+        }
+        catch (err) {
+            reportAuthCheckFault(err, "session");
+            throw err;
+        }
         if (actor) {
             c.set("actor", actor);
             await next();
@@ -126,8 +140,13 @@ export function authMiddleware(auth, config) {
                     return;
                 }
             }
-            catch {
-                // invalid, expired, or rate-limited key — fall through
+            catch (err) {
+                // An invalid, expired, or rate-limited key is a rejection: fall through
+                // to anonymous. Anything else means the key was never checked.
+                if (!isCredentialRejection(err)) {
+                    reportAuthCheckFault(err, "api_key");
+                    throw err;
+                }
             }
         }
         if (!c.get("actor")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/core",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/auth/actor.ts

@@ -2,6 +2,7 @@ import type { AuthSessionLike, CommerceConfig } from "../config/types.js";
 import type { Actor } from "./types.js";
 import type { AuthInstance } from "./setup.js";
 import { DEFAULT_ORG_ID } from "./org.js";
+import { isCredentialRejection } from "./auth-failure.js";
 
 export const AUTH_COOKIE_PREFIX = "uc";
 export const SESSION_COOKIE_NAME = `${AUTH_COOKIE_PREFIX}.session_token`;
@@ -43,8 +44,12 @@ export async function resolveActor(
     session = (await auth.api.getSession({
       headers,
     })) as AuthSessionLike | null;
-  } catch {
-    return null;
+  } catch (err) {
+    // A rejected session is anonymous. A session store that could not answer is
+    // a fault: reporting it as "no session" downgrades a signed-in caller
+    // silently and leaves nothing to debug.
+    if (isCredentialRejection(err)) return null;
+    throw err;
   }
 
   if (!session) return null;

package/src/auth/auth-failure.ts

@@ -0,0 +1,18 @@
+/**
+ * Separates a credential better-auth evaluated and rejected from an auth check
+ * that failed to run. Only the first justifies telling a caller their
+ * credential is bad; the second is a fault and must surface as one.
+ *
+ * Matched structurally rather than with `instanceof APIError`. A cross-copy
+ * `instanceof` is false whenever two better-auth copies are resolved into one
+ * tree — which is precisely the fault this predicate has to stay honest about.
+ * `kernel/error-mapper.ts` reads `constructor?.name` for the same reason.
+ *
+ * better-call's `APIError` carries `name === "APIError"` and a numeric
+ * `statusCode`; its `status` is a string such as `"UNAUTHORIZED"`.
+ */
+export function isCredentialRejection(err: unknown): boolean {
+  if (typeof err !== "object" || err === null) return false;
+  const { name, statusCode } = err as { name?: unknown; statusCode?: unknown };
+  return name === "APIError" && typeof statusCode === "number";
+}

package/src/auth/middleware.ts

@@ -4,6 +4,7 @@ import type { Actor } from "./types.js";
 import type { AuthInstance } from "./setup.js";
 import { getCustomerPermissions, resolveActor } from "./actor.js";
 import { DEFAULT_ORG_ID } from "./org.js";
+import { isCredentialRejection } from "./auth-failure.js";
 import { isStrictOrgResolution } from "./strict-org-resolution.js";
 
 function emptyToNull(value: string | null | undefined): string | null {
@@ -43,12 +44,23 @@ export function authMiddleware(
       }
     }
 
-    const actor = await resolveActor(
-      c.req.raw.headers,
-      auth,
-      config,
-      c.req.raw,
-    );
+    // A caller told "Authentication required." goes and checks their
+    // credential. When the check never ran, that answer is a lie and there is
+    // nothing in the log to correct it. Report a fault as a fault.
+    const reportAuthCheckFault = (err: unknown, stage: string): void => {
+      c.get("logger")?.error(
+        { err, stage, path: c.req.path, method: c.req.method },
+        "auth check failed — the credential was never evaluated, so this is not an authentication failure",
+      );
+    };
+
+    let actor: Actor | null;
+    try {
+      actor = await resolveActor(c.req.raw.headers, auth, config, c.req.raw);
+    } catch (err) {
+      reportAuthCheckFault(err, "session");
+      throw err;
+    }
     if (actor) {
       c.set("actor", actor);
       await next();
@@ -153,8 +165,13 @@ export function authMiddleware(
           await next();
           return;
         }
-      } catch {
-        // invalid, expired, or rate-limited key — fall through
+      } catch (err) {
+        // An invalid, expired, or rate-limited key is a rejection: fall through
+        // to anonymous. Anything else means the key was never checked.
+        if (!isCredentialRejection(err)) {
+          reportAuthCheckFault(err, "api_key");
+          throw err;
+        }
       }
     }