@wrelik/auth 0.2.1 → 0.2.2

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @wrelik/auth@0.2.1 build /home/runner/work/wrelik-kit/wrelik-kit/packages/auth
+> @wrelik/auth@0.2.2 build /home/runner/work/wrelik-kit/wrelik-kit/packages/auth
 > tsup src/index.ts src/next.ts src/react-native.ts --format cjs,esm --dts --clean
 
 CLI Building entry: src/index.ts, src/next.ts, src/react-native.ts
@@ -9,18 +9,18 @@
 CLI Cleaning output folder
 CJS Build start
 ESM Build start
-CJS dist/index.js        2.23 KB
-CJS dist/react-native.js 2.31 KB
+CJS dist/index.js        2.28 KB
 CJS dist/next.js         1.61 KB
-CJS ⚡️ Build success in 54ms
+CJS dist/react-native.js 2.36 KB
+CJS ⚡️ Build success in 60ms
 ESM dist/index.mjs          239.00 B
 ESM dist/next.mjs           255.00 B
 ESM dist/chunk-HWIZ2Q5U.mjs 391.00 B
 ESM dist/react-native.mjs   593.00 B
-ESM dist/chunk-5WLTDLEP.mjs 748.00 B
-ESM ⚡️ Build success in 55ms
+ESM dist/chunk-TF32HGN2.mjs 799.00 B
+ESM ⚡️ Build success in 60ms
 DTS Build start
-DTS ⚡️ Build success in 4418ms
+DTS ⚡️ Build success in 4598ms
 DTS dist/index.d.ts            393.00 B
 DTS dist/next.d.ts             134.00 B
 DTS dist/react-native.d.ts     430.00 B

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @wrelik/auth
 
+## 0.2.2
+
+### Patch Changes
+
+- 2b9cbf7: Fix auth role checks to reject malformed runtime role payloads and remove a duplicate TypeScript compiler option in errors to eliminate build warnings.
+- Updated dependencies [2b9cbf7]
+  - @wrelik/errors@0.2.1
+
+## Unreleased
+
+### Patch Changes
+
+- Fix role authorization checks to deny malformed runtime `roles` payloads.
+- Add regression coverage to ensure malformed `roles` values cannot grant access.
+
 ## 0.2.1
 
 ### Patch Changes

package/dist/{chunk-5WLTDLEP.mjs → chunk-TF32HGN2.mjs}

@@ -15,6 +15,7 @@ function requireTenant(session) {
 }
 function hasRole(session, role) {
   if (!session || !session.userId) return false;
+  if (!Array.isArray(session.roles)) return false;
   return session.roles.includes(role);
 }
 function requireRole(session, role) {

package/dist/index.js

@@ -45,6 +45,7 @@ function requireTenant(session) {
 }
 function hasRole(session, role) {
   if (!session || !session.userId) return false;
+  if (!Array.isArray(session.roles)) return false;
   return session.roles.includes(role);
 }
 function requireRole(session, role) {

package/dist/index.mjs

@@ -6,7 +6,7 @@ import {
   requireRole,
   requireTenant,
   requireUser
-} from "./chunk-5WLTDLEP.mjs";
+} from "./chunk-TF32HGN2.mjs";
 export {
   fromClerkAuth,
   hasRole,

package/dist/next.mjs

@@ -1,7 +1,7 @@
 import {
   fromClerkAuth
 } from "./chunk-HWIZ2Q5U.mjs";
-import "./chunk-5WLTDLEP.mjs";
+import "./chunk-TF32HGN2.mjs";
 
 // src/next.ts
 import { auth } from "@clerk/nextjs";

package/dist/react-native.js

@@ -45,6 +45,7 @@ function requireTenant(session) {
 }
 function hasRole(session, role) {
   if (!session || !session.userId) return false;
+  if (!Array.isArray(session.roles)) return false;
   return session.roles.includes(role);
 }
 function requireRole(session, role) {

package/dist/react-native.mjs

@@ -3,7 +3,7 @@ import {
   requireRole,
   requireTenant,
   requireUser
-} from "./chunk-5WLTDLEP.mjs";
+} from "./chunk-TF32HGN2.mjs";
 
 // src/react-native.ts
 function mapClerkToSession(auth) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrelik/auth",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "publishConfig": {
     "access": "public"
   },
@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@clerk/backend": "^0.38.0",
-    "@wrelik/errors": "0.2.0"
+    "@wrelik/errors": "0.2.1"
   },
   "peerDependencies": {
     "@clerk/nextjs": "^4.29.0"

package/src/shared.test.ts

@@ -24,4 +24,17 @@ describe('Auth Shared', () => {
     expect(hasRole(session, 'admin')).toBe(true);
     expect(hasRole(session, 'user')).toBe(false);
   });
+
+  it('does not grant role access when roles has invalid runtime shape', () => {
+    const malformedSession = {
+      userId: 'u1',
+      tenantId: 't1',
+      // Simulates untrusted runtime payload, despite the TypeScript type.
+      roles: 'admin',
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any;
+
+    expect(hasRole(malformedSession, 'admin')).toBe(false);
+    expect(hasRole(malformedSession, 'min')).toBe(false);
+  });
 });

package/src/shared.ts

@@ -23,6 +23,7 @@ export function requireTenant(session: WorkflowSession | null): string {
 
 export function hasRole(session: WorkflowSession | null, role: string): boolean {
   if (!session || !session.userId) return false;
+  if (!Array.isArray(session.roles)) return false;
   return session.roles.includes(role);
 }