@tempoxyz/id 0.0.0-pr-232.sha-a0eb0e8 → 0.0.0-pr-232.sha-e4f25eb

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/app/server/assets/router--hr181W2.js.map +1 -1
  2. package/dist/app/server/index.js +1 -1
  3. package/dist/app/server/index.js.map +1 -1
  4. package/package.json +1 -1
  5. package/src/api/oauth.ts +7 -2
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@tempoxyz/id",
3
- "version": "0.0.0-pr-232.sha-a0eb0e8",
3
+ "version": "0.0.0-pr-232.sha-e4f25eb",
4
4
  "description": "Tempo ID: sign-in, tokens, and access keys for Tempo, on Better Auth and Void.",
5
5
  "type": "module",
6
6
  "exports": {
package/src/api/oauth.ts CHANGED
@@ -997,9 +997,14 @@ export const oauth = new Hono<Env>()
997
997
  }),
998
998
  async (c) => {
999
999
  const response = await Timing.measure(c, forward(c), 'oauth2.forward')
1000
+ if (!response.ok) return response
1000
1001
  // A verifier caches the key set a fifth of the publication delay, so it holds a rotation's new
1001
- // key well before the key signs.
1002
- if (response.ok)
1002
+ // key well before the key signs. An empty set, before the first token creates the first key,
1003
+ // stays uncached, so a verifier reads that key once it signs.
1004
+ const keys = schema.jwks.response.safeParse(
1005
+ await Timing.measure(c, response.clone().json(), 'response.json'),
1006
+ )
1007
+ if (keys.success && keys.data.keys.length > 0)
1003
1008
  response.headers.set(
1004
1009
  'cache-control',
1005
1010
  `public, max-age=${SigningKey.publication / 5}`,