@rdlabo/workers-hono-kit 0.9.4 → 0.9.6

package/dist/firebase/jose-firebase-verifier.d.ts

@@ -28,8 +28,9 @@ export declare const SECURETOKEN_JWK_URL = "https://www.googleapis.com/service_a
  *
  * This replaces the `firebase-admin` Auth surface (`verifyIdToken` / `getUser` /
  * `deleteUser`) in environments where the Node SDK cannot run, such as Cloudflare Workers.
- * Token verification mirrors the admin SDK's checks: issuer and audience equal to the
- * project id, an RS256 signature, a non-empty subject (the uid), and a valid `auth_time`.
+ * Token verification follows Firebase's documented third-party JWT validation requirements:
+ * issuer and audience equal to the project id, an RS256 signature, a non-empty subject (the
+ * uid), and valid `exp`, `iat`, and `auth_time` timestamps.
  *
  * @remarks
  * The verification key is supplied as `keyResolver`:
@@ -65,13 +66,15 @@ export declare class JoseFirebaseVerifier implements FirebaseVerifier {
      * Verify a Firebase ID token and return its decoded payload.
      *
      * Checks the RS256 signature against the configured key, enforces the expected issuer and
-     * audience (the project id), and applies the admin SDK's extra checks: a non-empty string
-     * subject of at most 128 characters and an `auth_time` that is a number not in the future.
+     * audience (the project id), and applies Firebase's documented ID-token checks: a required
+     * future `exp`, a non-empty string subject of at most 128 characters, plus finite `iat` and
+     * `auth_time` values that are not in the future. Timestamp comparisons use strict zero clock
+     * tolerance.
      *
      * @param idToken - The raw Firebase ID token (JWT) to verify.
      * @returns The decoded payload, with `uid` set from `sub` and `email` lifted to a top-level field.
      * @throws If the signature, issuer, audience, or expiry are invalid, if the subject is
-     *   missing/non-string/too long, or if `auth_time` is missing or in the future.
+     *   missing/non-string/too long, or if `iat`/`auth_time` is missing, non-finite, or in the future.
      */
     verifyIdToken(idToken: string): Promise<DecodedIdToken>;
     /**

package/dist/firebase/jose-firebase-verifier.js

@@ -14,8 +14,9 @@ export const SECURETOKEN_JWK_URL = 'https://www.googleapis.com/service_accounts/
  *
  * This replaces the `firebase-admin` Auth surface (`verifyIdToken` / `getUser` /
  * `deleteUser`) in environments where the Node SDK cannot run, such as Cloudflare Workers.
- * Token verification mirrors the admin SDK's checks: issuer and audience equal to the
- * project id, an RS256 signature, a non-empty subject (the uid), and a valid `auth_time`.
+ * Token verification follows Firebase's documented third-party JWT validation requirements:
+ * issuer and audience equal to the project id, an RS256 signature, a non-empty subject (the
+ * uid), and valid `exp`, `iat`, and `auth_time` timestamps.
  *
  * @remarks
  * The verification key is supplied as `keyResolver`:
@@ -48,29 +49,42 @@ export class JoseFirebaseVerifier {
      * Verify a Firebase ID token and return its decoded payload.
      *
      * Checks the RS256 signature against the configured key, enforces the expected issuer and
-     * audience (the project id), and applies the admin SDK's extra checks: a non-empty string
-     * subject of at most 128 characters and an `auth_time` that is a number not in the future.
+     * audience (the project id), and applies Firebase's documented ID-token checks: a required
+     * future `exp`, a non-empty string subject of at most 128 characters, plus finite `iat` and
+     * `auth_time` values that are not in the future. Timestamp comparisons use strict zero clock
+     * tolerance.
      *
      * @param idToken - The raw Firebase ID token (JWT) to verify.
      * @returns The decoded payload, with `uid` set from `sub` and `email` lifted to a top-level field.
      * @throws If the signature, issuer, audience, or expiry are invalid, if the subject is
-     *   missing/non-string/too long, or if `auth_time` is missing or in the future.
+     *   missing/non-string/too long, or if `iat`/`auth_time` is missing, non-finite, or in the future.
      */
     async verifyIdToken(idToken) {
+        const now = this.nowSeconds();
         const options = {
             issuer: `https://securetoken.google.com/${this.opts.projectId}`,
             audience: this.opts.projectId,
             algorithms: ['RS256'],
+            requiredClaims: ['exp'],
+            currentDate: new Date(now * 1000),
+            clockTolerance: 0,
         };
         // Branch so each call matches a single jwtVerify overload (static key vs getKey fn).
         const key = this.opts.keyResolver;
         const { payload } = typeof key === 'function' ? await jwtVerify(idToken, key, options) : await jwtVerify(idToken, key, options);
-        // Mirror firebase-admin's extra checks beyond signature/iss/aud/exp:
+        // Apply Firebase's documented checks beyond signature/iss/aud/exp.
         if (!payload.sub || typeof payload.sub !== 'string' || payload.sub.length > 128) {
             throw new Error('Firebase ID token has an invalid subject');
         }
+        if (!Number.isFinite(payload.exp)) {
+            throw new Error('Firebase ID token has an invalid exp');
+        }
+        const issuedAt = payload.iat;
+        if (typeof issuedAt !== 'number' || !Number.isFinite(issuedAt) || issuedAt > now) {
+            throw new Error('Firebase ID token has an invalid iat');
+        }
         const authTime = payload.auth_time;
-        if (typeof authTime !== 'number' || authTime > this.nowSeconds()) {
+        if (typeof authTime !== 'number' || !Number.isFinite(authTime) || authTime > now) {
             throw new Error('Firebase ID token has an invalid auth_time');
         }
         return { ...payload, uid: payload.sub, email: payload.email };
@@ -125,6 +139,10 @@ export class JoseFirebaseVerifier {
      * @internal
      */
     nowSeconds() {
-        return this.opts.now ? this.opts.now() : Math.floor(Date.now() / 1000);
+        const now = this.opts.now ? this.opts.now() : Math.floor(Date.now() / 1000);
+        if (!Number.isFinite(now)) {
+            throw new Error('Firebase verifier clock returned an invalid time');
+        }
+        return now;
     }
 }

package/dist/middleware/perf-log.d.ts

@@ -31,6 +31,8 @@ export interface PerfLogOptions {
      * When provided, write one data point per request to a **Workers Analytics Engine** dataset. Query
      * percentiles by route/colo with the SQL API (≈90-day retention). Non-blocking. Layout:
      * `doubles = [t_app_ms, cold(0|1), status]`, `blobs = [path, colo, method]`, `indexes = [path]`.
+     * Route patterns longer than Analytics Engine's 96-byte index limit use a stable hash as the index;
+     * the complete route remains available in `blob1`.
      */
     dataset?: AnalyticsEngineDatasetLike;
     /**

package/dist/middleware/perf-log.js

@@ -18,6 +18,20 @@
 // a cold start are labelled warm (only the very first flips the flag) even though they pay cold-init
 // waits — a minor warm-side contamination, negligible at the low request rates this targets.
 let isolateWarm = false;
+const ANALYTICS_INDEX_MAX_BYTES = 96;
+function analyticsIndex(path) {
+    const bytes = new TextEncoder().encode(path);
+    if (bytes.byteLength <= ANALYTICS_INDEX_MAX_BYTES) {
+        return path;
+    }
+    // FNV-1a 64-bit keeps sampling deterministic without adding async crypto work to every response.
+    let hash = 0xcbf29ce484222325n;
+    for (const byte of bytes) {
+        hash ^= BigInt(byte);
+        hash = BigInt.asUintN(64, hash * 0x100000001b3n);
+    }
+    return `route:${hash.toString(16).padStart(16, '0')}`;
+}
 /**
  * Create a Hono middleware that records a per-request latency data point and emits it to Workers
  * Logs (`console`) and/or Workers Analytics Engine (`dataset`).
@@ -84,11 +98,17 @@ export function perfLog(options = {}) {
         // In-code sampling thins Analytics Engine writes only; Workers Logs volume is controlled separately
         // by the observability `head_sampling_rate`. Low-traffic Workers should leave `sampleRate` at 1.
         if (sink && (rate >= 1 || Math.random() < rate)) {
-            sink.writeDataPoint({
-                doubles: [tApp, cold ? 1 : 0, status],
-                blobs: [path, colo, method],
-                indexes: [path],
-            });
+            try {
+                sink.writeDataPoint({
+                    doubles: [tApp, cold ? 1 : 0, status],
+                    blobs: [path, colo, method],
+                    indexes: [analyticsIndex(path)],
+                });
+            }
+            catch (error) {
+                // Telemetry must never replace an otherwise successful application response with a 500.
+                console.warn('[perfLog] Analytics Engine write failed', error);
+            }
         }
         if (emitConsole) {
             console.log(JSON.stringify({ perf: { cold, colo, method, path, status, t_app: tApp } }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rdlabo/workers-hono-kit",
-  "version": "0.9.4",
+  "version": "0.9.6",
   "private": false,
   "publishConfig": {
     "access": "public"