@rabstack/rab-api 1.7.0 → 1.8.0

package/index.cjs.js

@@ -581,15 +581,13 @@ const authHandler = (isProtected, config)=>(req, res, next)=>{
             console.log('authHandler:UnauthorizedException:Token Not Found');
             throw new UnauthorizedException('Unauthorized', config.errorCode);
         }
-        // Token exists - verify it
+        // Token exists - verify it (must be valid regardless of protection)
         try {
             const payload = jwt.verify(token, config.jwt.secret_key);
             req['auth'] = payload;
             return next();
         } catch (err) {
             console.error('authHandler:JWT Error:', err.message);
-            // If not protected, continue without auth even if token is invalid
-            if (!isProtected) return next();
             throw new UnauthorizedException('Unauthorized', config.errorCode);
         }
     };

package/index.esm.js

@@ -579,15 +579,13 @@ const authHandler = (isProtected, config)=>(req, res, next)=>{
             console.log('authHandler:UnauthorizedException:Token Not Found');
             throw new UnauthorizedException('Unauthorized', config.errorCode);
         }
-        // Token exists - verify it
+        // Token exists - verify it (must be valid regardless of protection)
         try {
             const payload = jwt.verify(token, config.jwt.secret_key);
             req['auth'] = payload;
             return next();
         } catch (err) {
             console.error('authHandler:JWT Error:', err.message);
-            // If not protected, continue without auth even if token is invalid
-            if (!isProtected) return next();
             throw new UnauthorizedException('Unauthorized', config.errorCode);
         }
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rabstack/rab-api",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "A TypeScript REST API framework built on Express.js with decorator-based routing, dependency injection, and built-in validation",
   "author": "Softin",
   "license": "MIT",