Skip to content

v0.8.18

v0.8.18 — fix ctx.auth.token strip in toAuthContext (#121)
@cyanheads cyanheads tagged this 07 May 00:16 
toAuthContext silently dropped info.token, so ctx.auth.token was always
undefined in tool/resource handlers even though
claimParser.buildAuthInfoFromClaims() set it from the verified JWT and
both jwt/oauth strategies populated it. The [key: string]: unknown index
signature on AuthContext made the access compile cleanly, hiding the bug
from typecheck and createMockContext({ auth: { token } }) unit tests.
Tool handlers needing PAT pass-through / on-behalf-of forwarding had no
public API path to the validated bearer (authContext ALS isn't
re-exported from /auth).

- core: AuthContext gains typed token?: string. toAuthContext spreads
  info.token in both call sites — withAuthInfo (initial request context,
  including auto-task callerAuth capture) and the ALS bridge in
  createRequestContext (handler-created child contexts). Logger
  pino-redact paths (token, *.token, *.*.token) already mask the field
  framework-wide; naive ctx.log.info({ auth: ctx.auth }) doesn't leak
  the bearer.
- tests: ALS-bridge path now asserts the full ctx.auth shape including
  token; withAuthInfo gains explicit token round-trip and token-omitted
  coverage. Existing tests passed token in but never asserted it —
  exactly how this slipped through.
- deps: hono ^4.12.17 → ^4.12.18 (GHSA-p77w-8qqv-26rm cache leakage,
  GHSA-qp7p-654g-cw7p hono/jsx CSS injection, GHSA-hm8q-7f3q-5f36 JWT
  NumericDate validation — framework doesn't use the affected surfaces,
  peer floor bumped to protect downstream consumers); chrono-node
  ^2.9.0 → ^2.9.1; @opentelemetry/sdk-node /
  exporter-trace-otlp-http / exporter-metrics-otlp-http /
  instrumentation-http ^0.216.0 → ^0.217.0;
  @opentelemetry/instrumentation-pino ^0.62.0 → ^0.63.0.

Devcheck clean (13 checks); full suite 3044 passed / 9 skipped + 3 worker
passed + 107 integration passed.
Assets 2
Loading