bazis 0.98.25 → 0.98.26

package/core/http/Authorization/authorizeComposer.ts

@@ -1,4 +1,5 @@
-import { ForbiddenError } from "../Errors/HttpError";
+import { JwtError } from "../../../library/jwt/errors";
+import { ForbiddenError, UnauthorizedError } from "../Errors/HttpError";
 import type { HttpMiddleware } from "../Middleware/types";
 import type { RouteMiddlewareComposer } from "../options";
 import { resolveAuthorizeMeta } from "./metadata";
@@ -8,7 +9,8 @@ import { resolveAuthorizeMeta } from "./metadata";
  * the per-route composers. For routes that require authorization it returns
  * middleware that runs all checks in order: any that returns `false` → `403`;
  * a check may throw an `HttpError` itself (for example
- * `UnauthorizedError` → `401`).
+ * `UnauthorizedError` → `401`). A `JwtError` (missing, malformed, expired or
+ * forged token) escaping a check is a 401 as well, not a server error.
  */
 export function createAuthorizeComposer(): RouteMiddlewareComposer {
   return (controllerClass, methodName) => {
@@ -20,7 +22,18 @@ export function createAuthorizeComposer(): RouteMiddlewareComposer {
     const { checks } = meta.authorize;
     const middleware: HttpMiddleware = async (ctx, next) => {
       for (const check of checks) {
-        if (!(await check(ctx))) {
+        let allowed: boolean;
+        try {
+          allowed = await check(ctx);
+        } catch (error) {
+          if (error instanceof JwtError) {
+            const unauthorized = new UnauthorizedError();
+            Object.defineProperty(unauthorized, "cause", { value: error, configurable: true, writable: true });
+            throw unauthorized;
+          }
+          throw error;
+        }
+        if (!allowed) {
           throw new ForbiddenError();
         }
       }

package/core/http/Authorization/bearerToken.ts

@@ -0,0 +1,11 @@
+import type { HttpContext } from "../HttpContext/HttpContext";
+
+/**
+ * The token of an `Authorization: Bearer <token>` header, or `undefined`
+ * without the header, with another scheme or with an empty token. The scheme
+ * is case-insensitive (RFC 7235); surrounding spaces are trimmed.
+ */
+export function bearerToken(ctx: Pick<HttpContext, "header">): string | undefined {
+  const match = /^\s*bearer\s+(\S+)\s*$/i.exec(ctx.header("authorization") ?? "");
+  return match?.[1];
+}

package/core/http/index.ts

@@ -34,6 +34,7 @@ export { PRINCIPAL_STATE_KEY, type RequestPrincipal } from "./HttpContext/princi
 // Authorization
 export { Authorize, AllowAnonymous } from "./Authorization/Authorize";
 export { createAuthorizeComposer } from "./Authorization/authorizeComposer";
+export { bearerToken } from "./Authorization/bearerToken";
 export {
   resolveAuthorizeMeta,
   type AuthorizeCheck,

package/core/infra/connectors/codex/CodexAppServerClient.ts

@@ -232,7 +232,7 @@ export class CodexAppServerClient implements CodexClient {
         if (method === "account/updated") this.modelCache = undefined;
       }, () => { this.clearLogin(); this.modelCache = undefined; });
       const initialized = await client.request("initialize", {
-        clientInfo: { name: "bazis", title: "Bazis", version: "0.98.25" }, capabilities: { experimentalApi: true },
+        clientInfo: { name: "bazis", title: "Bazis", version: "0.98.26" }, capabilities: { experimentalApi: true },
       }, 15_000, signal);
       if (resolve(text(initialized.codexHome, 4096)) !== this.paths.home) throw new CodexError("PROTOCOL_ERROR");
       client.notify("initialized");

package/library/jwt/signing/Rs256Algorithm.ts

@@ -34,14 +34,19 @@ export class Rs256Algorithm implements SigningAlgorithm {
     if (keys === null || typeof keys !== "object" || Array.isArray(keys)) {
       throw new TypeError("RS256 key material must be an object");
     }
-    this.keys = Object.freeze({ ...keys });
     for (const field of ["publicKeyPem", "privateKeyPem", "keyId"] as const) {
-      const value = this.keys[field];
+      const value = keys[field];
       if (value === undefined && field !== "publicKeyPem") continue;
       if (typeof value !== "string" || value.length === 0) {
         throw new TypeError(`RS256 ${field} must be a non-empty string`);
       }
     }
+    // A wrong key format must fail here, at startup, not on the first sign-in.
+    this.keys = Object.freeze({
+      ...keys,
+      publicKeyPem: checkedPem("publicKeyPem", keys.publicKeyPem),
+      ...(keys.privateKeyPem === undefined ? {} : { privateKeyPem: checkedPem("privateKeyPem", keys.privateKeyPem) }),
+    });
     this.canSign = this.keys.privateKeyPem !== undefined;
     this.keyId = this.keys.keyId;
   }
@@ -78,13 +83,13 @@ export class Rs256Algorithm implements SigningAlgorithm {
     if (this.keys.privateKeyPem === undefined) {
       throw new Error("RS256 private key PEM is required for signing");
     }
-    const key = await crypto.subtle.importKey(
+    const key = await importKey("private", () => crypto.subtle.importKey(
       "pkcs8",
-      decodePemToBuffer(this.keys.privateKeyPem),
+      decodePemToBuffer(this.keys.privateKeyPem!),
       RSA_PARAMS,
       false,
       ["sign"],
-    );
+    ));
     return this.cachedPrivate = this.requireStrongKey(key);
   }
 
@@ -92,13 +97,13 @@ export class Rs256Algorithm implements SigningAlgorithm {
     if (this.cachedPublic !== undefined) {
       return this.cachedPublic;
     }
-    const key = await crypto.subtle.importKey(
+    const key = await importKey("public", () => crypto.subtle.importKey(
       "spki",
       decodePemToBuffer(this.keys.publicKeyPem),
       RSA_PARAMS,
       true,
       ["verify"],
-    );
+    ));
     return this.cachedPublic = this.requireStrongKey(key);
   }
 
@@ -112,6 +117,39 @@ export class Rs256Algorithm implements SigningAlgorithm {
   }
 }
 
+const PEM = /^-----BEGIN ([A-Z0-9 ]+)-----\n([\s\S]*?)\n?-----END \1-----$/;
+
+/**
+ * Normalizes and checks one PEM string: literal `\n` (a key stored on one line
+ * in .env or a CI secret) and CRLF become line breaks; the label must be the
+ * one Web Crypto imports (PKCS#8 private, SPKI public), with a fix otherwise.
+ */
+function checkedPem(field: "publicKeyPem" | "privateKeyPem", value: string): string {
+  // A backslash never occurs in base64 or PEM armor, so this cannot change a valid key.
+  const pem = value.replaceAll("\\n", "\n").replaceAll("\r\n", "\n").trim();
+  const expected = field === "publicKeyPem" ? "PUBLIC KEY" : "PRIVATE KEY";
+  const match = PEM.exec(pem);
+  const label = match?.[1] ?? /^-----BEGIN ([A-Z0-9 ]+)-----/.exec(pem)?.[1];
+  if (label === undefined) throw new TypeError(`RS256 ${field} is not a PEM: expected "-----BEGIN ${expected}-----"`);
+  if (field === "privateKeyPem" && label === "RSA PRIVATE KEY") throw new TypeError("RS256 privateKeyPem is a PKCS#1 key (BEGIN RSA PRIVATE KEY); convert it to PKCS#8: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key-pkcs8.pem");
+  if (field === "privateKeyPem" && label === "ENCRYPTED PRIVATE KEY") throw new TypeError("RS256 privateKeyPem is encrypted; remove the passphrase first: openssl pkcs8 -in key.pem -out key-plain.pem");
+  if (field === "privateKeyPem" && label.endsWith("PUBLIC KEY")) throw new TypeError("RS256 privateKeyPem contains a PUBLIC KEY; pass the private key (BEGIN PRIVATE KEY)");
+  if (field === "publicKeyPem" && label === "RSA PUBLIC KEY") throw new TypeError("RS256 publicKeyPem is a PKCS#1 public key (BEGIN RSA PUBLIC KEY); convert it to SPKI: openssl rsa -RSAPublicKey_in -in public.pem -pubout -out public-spki.pem");
+  if (field === "publicKeyPem" && label.endsWith("PRIVATE KEY")) throw new TypeError("RS256 publicKeyPem contains a private key; give verifiers only the public key: openssl pkey -in key.pem -pubout -out public.pem");
+  if (label !== expected || match === undefined || match === null) throw new TypeError(`RS256 ${field} is not a PEM: expected "-----BEGIN ${expected}-----"`);
+  if (!/^[A-Za-z0-9+/=\s]+$/.test(match[2]!)) throw new TypeError(`RS256 ${field} has an invalid base64 body`);
+  return pem;
+}
+
+/** Web Crypto says only "Invalid keyData"; name the key that failed. */
+async function importKey(which: "private" | "public", work: () => Promise<CryptoKey>): Promise<CryptoKey> {
+  try {
+    return await work();
+  } catch (error) {
+    throw new Error(`RS256 ${which} key could not be imported (${error instanceof Error ? error.message : String(error)}); check that it is an RSA ${which === "private" ? "PKCS#8 private" : "SPKI public"} key in PEM`, { cause: error });
+  }
+}
+
 /** Convenience factory for {@link Rs256Algorithm}. */
 export function rs256(keys: Rs256KeyMaterial): Rs256Algorithm {
   return new Rs256Algorithm(keys);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.98.25",
+  "version": "0.98.26",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",