@voltagent/server-core 1.0.28 → 1.0.30

package/dist/index.d.mts

@@ -1900,6 +1900,11 @@ interface JWTAuthOptions {
         audience?: string;
         issuer?: string;
     };
+    /**
+     * When true, all routes require authentication by default (opt-out model)
+     * @default false
+     */
+    defaultPrivate?: boolean;
 }
 /**
  * Create a JWT authentication provider

package/dist/index.d.ts

@@ -1900,6 +1900,11 @@ interface JWTAuthOptions {
         audience?: string;
         issuer?: string;
     };
+    /**
+     * When true, all routes require authentication by default (opt-out model)
+     * @default false
+     */
+    defaultPrivate?: boolean;
 }
 /**
  * Create a JWT authentication provider

package/dist/index.js

@@ -3963,7 +3963,8 @@ function jwtAuth(options) {
       }
       return void 0;
     },
-    publicRoutes
+    publicRoutes,
+    defaultPrivate: options.defaultPrivate
   };
 }
 __name(jwtAuth, "jwtAuth");
@@ -4884,21 +4885,37 @@ function setupWebSocketUpgrade(server, wss, pathPrefix = "/ws", auth, logger) {
             }
             user = { id: "console", type: "console-access" };
           } else {
-            const token = url.searchParams.get("token");
-            if (token) {
-              try {
-                user = await auth.verifyToken(token);
-              } catch (error) {
-                logger?.debug("[WebSocket] Token verification failed:", { error });
-                socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
-                socket.destroy();
-                return;
+            const hasConsoleAccess2 = hasWebSocketConsoleAccess(req);
+            if (hasConsoleAccess2) {
+              user = { id: "console", type: "console-access" };
+            } else {
+              const needsAuth = requiresAuth("WS", path2, auth.publicRoutes, auth.defaultPrivate);
+              if (needsAuth) {
+                const token = url.searchParams.get("token");
+                if (token) {
+                  try {
+                    user = await auth.verifyToken(token);
+                  } catch (error) {
+                    logger?.debug("[WebSocket] Token verification failed:", { error });
+                    socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
+                    socket.destroy();
+                    return;
+                  }
+                } else {
+                  logger?.debug("[WebSocket] No token provided for protected WebSocket");
+                  socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
+                  socket.destroy();
+                  return;
+                }
+              } else {
+                const token = url.searchParams.get("token");
+                if (token) {
+                  try {
+                    user = await auth.verifyToken(token);
+                  } catch {
+                  }
+                }
               }
-            } else if (auth.defaultPrivate) {
-              logger?.debug("[WebSocket] No token provided for protected WebSocket");
-              socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
-              socket.destroy();
-              return;
             }
           }
         } catch (error) {