ideal-auth 1.2.0 → 1.3.0

package/dist/auth.js

@@ -15,9 +15,6 @@ const SESSION_DEFAULTS = {
  * createAuth<SessionUser>({ ... })
  */
 export function createAuth(config) {
-    if (!config.secret || config.secret.length < 32) {
-        throw new Error('secret must be at least 32 characters');
-    }
     if (config.resolveUser && config.sessionFields) {
         throw new Error('Provide either resolveUser or sessionFields, not both');
     }
@@ -28,20 +25,25 @@ export function createAuth(config) {
         throw new Error('sessionFields must contain at least one field besides id');
     }
     const configAutoTouch = config.session?.autoTouch ?? false;
-    return (options) => createAuthInstance({
-        secret: config.secret,
-        cookie: config.cookie,
-        cookieName: config.session?.cookieName ?? SESSION_DEFAULTS.cookieName,
-        maxAge: config.session?.maxAge ?? SESSION_DEFAULTS.maxAge,
-        rememberMaxAge: config.session?.rememberMaxAge ?? SESSION_DEFAULTS.rememberMaxAge,
-        cookieOptions: config.session?.cookie ?? {},
-        autoTouch: options?.autoTouch ?? configAutoTouch,
-        resolveUser: config.resolveUser,
-        sessionFields: config.sessionFields,
-        hash: config.hash,
-        resolveUserByCredentials: config.resolveUserByCredentials,
-        credentialKey: config.credentialKey ?? 'password',
-        passwordField: config.passwordField ?? 'password',
-        attemptUser: config.attemptUser,
-    });
+    return (options) => {
+        if (!config.secret || config.secret.length < 32) {
+            throw new Error('secret must be at least 32 characters');
+        }
+        return createAuthInstance({
+            secret: config.secret,
+            cookie: config.cookie,
+            cookieName: config.session?.cookieName ?? SESSION_DEFAULTS.cookieName,
+            maxAge: config.session?.maxAge ?? SESSION_DEFAULTS.maxAge,
+            rememberMaxAge: config.session?.rememberMaxAge ?? SESSION_DEFAULTS.rememberMaxAge,
+            cookieOptions: config.session?.cookie ?? {},
+            autoTouch: options?.autoTouch ?? configAutoTouch,
+            resolveUser: config.resolveUser,
+            sessionFields: config.sessionFields,
+            hash: config.hash,
+            resolveUserByCredentials: config.resolveUserByCredentials,
+            credentialKey: config.credentialKey ?? 'password',
+            passwordField: config.passwordField ?? 'password',
+            attemptUser: config.attemptUser,
+        });
+    };
 }

package/dist/token-verifier/index.js

@@ -1,13 +1,16 @@
 import { generateToken } from '../crypto/token';
 import { signData, verifySignature } from '../crypto/hmac';
 const DEFAULT_EXPIRY_MS = 60 * 60 * 1000; // 1 hour
-export function createTokenVerifier(config) {
-    if (!config.secret || config.secret.length < 32) {
+function validateSecret(secret) {
+    if (!secret || secret.length < 32) {
         throw new Error('secret must be at least 32 characters');
     }
+}
+export function createTokenVerifier(config) {
     const expiryMs = config.expiryMs ?? DEFAULT_EXPIRY_MS;
     return {
         createToken(userId) {
+            validateSecret(config.secret);
             const encodedUserId = Buffer.from(userId, 'utf8').toString('base64url');
             const id = generateToken(20);
             const iat = Date.now();
@@ -17,6 +20,8 @@ export function createTokenVerifier(config) {
             return `${payload}.${signature}`;
         },
         verifyToken(token) {
+            if (!config.secret || config.secret.length < 32)
+                return null;
             const parts = token.split('.');
             if (parts.length !== 5)
                 return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ideal-auth",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Auth primitives for the JS ecosystem. Zero framework dependencies.",
   "scripts": {
     "build": "tsc",