@porulle/core 0.58.0 → 0.59.0

package/dist/auth/auth-failure.d.ts

@@ -11,5 +11,10 @@
  * better-call's `APIError` carries `name === "APIError"` and a numeric
  * `statusCode`; its `status` is a string such as `"UNAUTHORIZED"`.
  */
-export declare function isCredentialRejection(err: unknown): boolean;
+export declare function isCredentialRejection(err: unknown): err is {
+    name: "APIError";
+    statusCode: number;
+};
+/** The HTTP status better-auth attached to a credential rejection, or null for anything else. */
+export declare function credentialRejectionStatus(err: unknown): number | null;
 //# sourceMappingURL=auth-failure.d.ts.map

package/dist/auth/auth-failure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-failure.d.ts","sourceRoot":"","sources":["../../src/auth/auth-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAI3D"}
+{"version":3,"file":"auth-failure.d.ts","sourceRoot":"","sources":["../../src/auth/auth-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAInG;AAED,iGAAiG;AACjG,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAErE"}

package/dist/auth/auth-failure.js

@@ -17,3 +17,7 @@ export function isCredentialRejection(err) {
     const { name, statusCode } = err;
     return name === "APIError" && typeof statusCode === "number";
 }
+/** The HTTP status better-auth attached to a credential rejection, or null for anything else. */
+export function credentialRejectionStatus(err) {
+    return isCredentialRejection(err) ? err.statusCode : null;
+}

package/dist/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAc/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,yBAAuB,CAAC;AAE3D;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAInE;AAKD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,cAAc,GACrB,iBAAiB,CAuPnB"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAc/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,yBAAuB,CAAC;AAE3D;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAInE;AAKD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,cAAc,GACrB,iBAAiB,CAsQnB"}

package/dist/auth/middleware.js

@@ -1,6 +1,6 @@
 import { getCustomerPermissions, resolveActor } from "./actor.js";
 import { DEFAULT_ORG_ID } from "./org.js";
-import { isCredentialRejection } from "./auth-failure.js";
+import { credentialRejectionStatus, isCredentialRejection } from "./auth-failure.js";
 import { isStrictOrgResolution } from "./strict-org-resolution.js";
 import { isIdentityFreeRoute } from "./identity-free-routes.js";
 function emptyToNull(value) {
@@ -182,14 +182,28 @@ export function authMiddleware(auth, config) {
                 }
             }
             catch (err) {
-                // An invalid, expired, or rate-limited key is a rejection: fall through
-                // to anonymous. Anything else means the key was never checked.
+                // A rejection better-auth raised was an evaluated credential; anything else means the key
+                // was never checked, and is a fault. A rate-limited key is not a bad one: say so.
                 if (!isCredentialRejection(err)) {
                     reportAuthCheckFault(err, "api_key");
                     throw err;
                 }
+                if (credentialRejectionStatus(err) === 429) {
+                    return c.json({ error: { code: "RATE_LIMITED", message: "Too many requests for this credential." } }, 429);
+                }
             }
         }
+        // A credential the caller PRESENTED and that did not verify is refused, not served as a guest.
+        // Falling through to anonymous gave a shopper whose token had expired a fresh guest cart in
+        // place of theirs, and told a broken client nothing. Absent credentials stay anonymous (guest
+        // checkout depends on it), and a stale session COOKIE is not "presented": browsers carry one on
+        // every public page, and refusing it would 401 logged-out browsing.
+        const presented = (c.req.header("x-api-key") ?? "").trim() !== "" || (c.req.header("authorization") ?? "").trim() !== "";
+        if (presented) {
+            const refused = c.json({ error: { code: "UNAUTHORIZED", message: "The presented credential could not be verified." } }, 401);
+            applyAuthenticateChallenge(refused);
+            return refused;
+        }
         if (!c.get("actor")) {
             // For anonymous requests in multi-store deployments, resolve the
             // store so catalog/search queries return the right store's data.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/core",
-  "version": "0.58.0",
+  "version": "0.59.0",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/auth/auth-failure.ts

@@ -11,8 +11,13 @@
  * better-call's `APIError` carries `name === "APIError"` and a numeric
  * `statusCode`; its `status` is a string such as `"UNAUTHORIZED"`.
  */
-export function isCredentialRejection(err: unknown): boolean {
+export function isCredentialRejection(err: unknown): err is { name: "APIError"; statusCode: number } {
   if (typeof err !== "object" || err === null) return false;
   const { name, statusCode } = err as { name?: unknown; statusCode?: unknown };
   return name === "APIError" && typeof statusCode === "number";
 }
+
+/** The HTTP status better-auth attached to a credential rejection, or null for anything else. */
+export function credentialRejectionStatus(err: unknown): number | null {
+  return isCredentialRejection(err) ? err.statusCode : null;
+}

package/src/auth/middleware.ts

@@ -4,7 +4,7 @@ import type { Actor } from "./types.js";
 import type { AuthInstance } from "./setup.js";
 import { getCustomerPermissions, resolveActor } from "./actor.js";
 import { DEFAULT_ORG_ID } from "./org.js";
-import { isCredentialRejection } from "./auth-failure.js";
+import { credentialRejectionStatus, isCredentialRejection } from "./auth-failure.js";
 import { isStrictOrgResolution } from "./strict-org-resolution.js";
 import { isIdentityFreeRoute } from "./identity-free-routes.js";
 
@@ -208,15 +208,30 @@ export function authMiddleware(
           return;
         }
       } catch (err) {
-        // An invalid, expired, or rate-limited key is a rejection: fall through
-        // to anonymous. Anything else means the key was never checked.
+        // A rejection better-auth raised was an evaluated credential; anything else means the key
+        // was never checked, and is a fault. A rate-limited key is not a bad one: say so.
         if (!isCredentialRejection(err)) {
           reportAuthCheckFault(err, "api_key");
           throw err;
         }
+        if (credentialRejectionStatus(err) === 429) {
+          return c.json({ error: { code: "RATE_LIMITED", message: "Too many requests for this credential." } }, 429);
+        }
       }
     }
 
+    // A credential the caller PRESENTED and that did not verify is refused, not served as a guest.
+    // Falling through to anonymous gave a shopper whose token had expired a fresh guest cart in
+    // place of theirs, and told a broken client nothing. Absent credentials stay anonymous (guest
+    // checkout depends on it), and a stale session COOKIE is not "presented": browsers carry one on
+    // every public page, and refusing it would 401 logged-out browsing.
+    const presented = (c.req.header("x-api-key") ?? "").trim() !== "" || (c.req.header("authorization") ?? "").trim() !== "";
+    if (presented) {
+      const refused = c.json({ error: { code: "UNAUTHORIZED", message: "The presented credential could not be verified." } }, 401);
+      applyAuthenticateChallenge(refused);
+      return refused;
+    }
+
     if (!c.get("actor")) {
       // For anonymous requests in multi-store deployments, resolve the
       // store so catalog/search queries return the right store's data.