shelving 1.150.2 → 1.150.4

package/feedback/Feedbacks.js

@@ -4,7 +4,7 @@ export class Feedbacks extends Feedback {
     /** List of named messages. */
     messages;
     constructor(messages) {
-        super("Multiple errors");
+        super(Object.values(messages).join("\n"));
         this.messages = messages;
     }
 }

package/package.json

@@ -11,7 +11,7 @@
 		"state-management",
 		"query-builder"
 	],
-	"version": "1.150.2",
+	"version": "1.150.4",
 	"repository": "https://github.com/dhoulb/shelving",
 	"author": "Dave Houlbrooke <dave@shax.com>",
 	"license": "0BSD",

package/util/http.js

@@ -118,9 +118,9 @@ export function getErrorResponse(reason, debug = false) {
     const status = reason instanceof RequestError ? reason.code : 500;
     // Throw `Error` to return `{ message: "etc" }` to the client (but only if `debug` is true so we don't leak error details to the client).
     if (debug && isError(reason)) {
-        // Manually destructure because `Error.prototype.message` is not enumerable.
-        const { message, ...rest } = reason;
-        return Response.json({ message, ...rest }, { status });
+        // Manually destructure because `message` and `cause` on `Error` are not enumerable.
+        const { message, cause, ...rest } = reason;
+        return Response.json({ message, cause, ...rest }, { status });
     }
     // Otherwise return a generic error message with no details.
     return new Response(undefined, { status });

package/util/jwt.js

@@ -2,13 +2,13 @@ import { UnauthorizedError } from "../error/RequestError.js";
 import { ValueError } from "../error/ValueError.js";
 import { decodeBase64URLBytes, decodeBase64URLString, encodeBase64URL } from "./base64.js";
 import { getBytes, requireBytes } from "./bytes.js";
-import { DAY } from "./constants.js";
+import { DAY, MINUTE, SECOND } from "./constants.js";
 // Constants.
 const HASH = "SHA-512";
 const ALGORITHM = { name: "HMAC", hash: HASH };
 const HEADER = { alg: "HS512", typ: "JWT" };
 const EXPIRY_MS = DAY * 10;
-const SKEW_MS = 60; // Allow 1 minute clock skew.
+const SKEW_MS = MINUTE; // Allow 1 minute clock skew.
 const SECRET_BYTES = 64; // Minimum 64 bytes / 512 bits
 function _getKey(caller, secret, ...usages) {
     const bytes = getBytes(secret);
@@ -94,12 +94,12 @@ export async function verifyToken(token, secret, caller = verifyToken) {
         throw new UnauthorizedError("JWT signature does not match", { received: token, caller });
     // Validate payload.
     const { nbf, iat, exp } = payloadData;
-    const now = Math.floor(Date.now() / 1000);
-    if (typeof nbf === "number" && nbf < now - SKEW_MS)
+    const now = Date.now();
+    if (typeof nbf === "number" && now < nbf * SECOND - SKEW_MS)
         throw new UnauthorizedError("JWT cannot be used yet", { received: payloadData, expected: now, caller });
-    if (typeof iat === "number" && iat > now + SKEW_MS)
+    if (typeof iat === "number" && now < iat * SECOND - SKEW_MS)
         throw new UnauthorizedError("JWT not issued yet", { received: payloadData, expected: now, caller });
-    if (typeof exp === "number" && exp < now - SKEW_MS)
+    if (typeof exp === "number" && now > exp * SECOND + SKEW_MS)
         throw new UnauthorizedError("JWT has expired", { received: payloadData, expected: now, caller });
     return payloadData;
 }