ideal-auth 1.2.0 → 1.3.1

package/dist/auth-instance.js

@@ -4,7 +4,13 @@ export function createAuthInstance(deps) {
     let cachedPayload;
     let cachedUser;
     let didAutoTouch = false;
+    function validateSecret() {
+        if (!deps.secret || deps.secret.length < 32) {
+            throw new Error('secret must be at least 32 characters');
+        }
+    }
     async function readSession() {
+        validateSecret();
         if (cachedPayload !== undefined)
             return cachedPayload;
         const raw = await deps.cookie.get(deps.cookieName);
@@ -50,6 +56,7 @@ export function createAuthInstance(deps) {
         return Object.keys(data).length > 0 ? data : undefined;
     }
     async function writeSession(user, options) {
+        validateSecret();
         const maxAge = options?.remember ? deps.rememberMaxAge : deps.maxAge;
         const now = Math.floor(Date.now() / 1000);
         const payload = {

package/dist/auth.js

@@ -15,9 +15,7 @@ const SESSION_DEFAULTS = {
  * createAuth<SessionUser>({ ... })
  */
 export function createAuth(config) {
-    if (!config.secret || config.secret.length < 32) {
-        throw new Error('secret must be at least 32 characters');
-    }
+    // Structural validations — code-level config, always known at definition time
     if (config.resolveUser && config.sessionFields) {
         throw new Error('Provide either resolveUser or sessionFields, not both');
     }

package/dist/token-verifier/index.js

@@ -1,13 +1,16 @@
 import { generateToken } from '../crypto/token';
 import { signData, verifySignature } from '../crypto/hmac';
 const DEFAULT_EXPIRY_MS = 60 * 60 * 1000; // 1 hour
-export function createTokenVerifier(config) {
-    if (!config.secret || config.secret.length < 32) {
+function validateSecret(secret) {
+    if (!secret || secret.length < 32) {
         throw new Error('secret must be at least 32 characters');
     }
+}
+export function createTokenVerifier(config) {
     const expiryMs = config.expiryMs ?? DEFAULT_EXPIRY_MS;
     return {
         createToken(userId) {
+            validateSecret(config.secret);
             const encodedUserId = Buffer.from(userId, 'utf8').toString('base64url');
             const id = generateToken(20);
             const iat = Date.now();
@@ -17,6 +20,8 @@ export function createTokenVerifier(config) {
             return `${payload}.${signature}`;
         },
         verifyToken(token) {
+            if (!config.secret || config.secret.length < 32)
+                return null;
             const parts = token.split('.');
             if (parts.length !== 5)
                 return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ideal-auth",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "description": "Auth primitives for the JS ecosystem. Zero framework dependencies.",
   "scripts": {
     "build": "tsc",