ideal-auth 1.3.0 → 1.3.2

package/dist/auth-instance.js

@@ -4,7 +4,17 @@ export function createAuthInstance(deps) {
     let cachedPayload;
     let cachedUser;
     let didAutoTouch = false;
+    function validateSecret() {
+        if (!deps.secret || deps.secret.length < 32) {
+            throw new Error('secret must be at least 32 characters');
+        }
+    }
     async function readSession() {
+        // Fail closed on reads — no secret means no session, not an error
+        if (!deps.secret || deps.secret.length < 32) {
+            cachedPayload = null;
+            return null;
+        }
         if (cachedPayload !== undefined)
             return cachedPayload;
         const raw = await deps.cookie.get(deps.cookieName);
@@ -50,6 +60,7 @@ export function createAuthInstance(deps) {
         return Object.keys(data).length > 0 ? data : undefined;
     }
     async function writeSession(user, options) {
+        validateSecret();
         const maxAge = options?.remember ? deps.rememberMaxAge : deps.maxAge;
         const now = Math.floor(Date.now() / 1000);
         const payload = {

package/dist/auth.js

@@ -15,6 +15,7 @@ const SESSION_DEFAULTS = {
  * createAuth<SessionUser>({ ... })
  */
 export function createAuth(config) {
+    // Structural validations — code-level config, always known at definition time
     if (config.resolveUser && config.sessionFields) {
         throw new Error('Provide either resolveUser or sessionFields, not both');
     }
@@ -25,25 +26,20 @@ export function createAuth(config) {
         throw new Error('sessionFields must contain at least one field besides id');
     }
     const configAutoTouch = config.session?.autoTouch ?? false;
-    return (options) => {
-        if (!config.secret || config.secret.length < 32) {
-            throw new Error('secret must be at least 32 characters');
-        }
-        return createAuthInstance({
-            secret: config.secret,
-            cookie: config.cookie,
-            cookieName: config.session?.cookieName ?? SESSION_DEFAULTS.cookieName,
-            maxAge: config.session?.maxAge ?? SESSION_DEFAULTS.maxAge,
-            rememberMaxAge: config.session?.rememberMaxAge ?? SESSION_DEFAULTS.rememberMaxAge,
-            cookieOptions: config.session?.cookie ?? {},
-            autoTouch: options?.autoTouch ?? configAutoTouch,
-            resolveUser: config.resolveUser,
-            sessionFields: config.sessionFields,
-            hash: config.hash,
-            resolveUserByCredentials: config.resolveUserByCredentials,
-            credentialKey: config.credentialKey ?? 'password',
-            passwordField: config.passwordField ?? 'password',
-            attemptUser: config.attemptUser,
-        });
-    };
+    return (options) => createAuthInstance({
+        secret: config.secret,
+        cookie: config.cookie,
+        cookieName: config.session?.cookieName ?? SESSION_DEFAULTS.cookieName,
+        maxAge: config.session?.maxAge ?? SESSION_DEFAULTS.maxAge,
+        rememberMaxAge: config.session?.rememberMaxAge ?? SESSION_DEFAULTS.rememberMaxAge,
+        cookieOptions: config.session?.cookie ?? {},
+        autoTouch: options?.autoTouch ?? configAutoTouch,
+        resolveUser: config.resolveUser,
+        sessionFields: config.sessionFields,
+        hash: config.hash,
+        resolveUserByCredentials: config.resolveUserByCredentials,
+        credentialKey: config.credentialKey ?? 'password',
+        passwordField: config.passwordField ?? 'password',
+        attemptUser: config.attemptUser,
+    });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ideal-auth",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "Auth primitives for the JS ecosystem. Zero framework dependencies.",
   "scripts": {
     "build": "tsc",