fix(types): only accept 'none' as the last entry of AuthConfig - #148
Merged
Conversation
commit: |
mandarini
approved these changes
Sep 8, 2026
mandarini
force-pushed
the
fix/auth-config-types
branch
from
September 8, 2026 10:05
ff78a14 to
8ee541b
Compare
`auth` took `AuthModeWithKey[]`, which let `'none'` sit anywhere in the list. It matches every request, so any mode after it is unreachable, and a list of just `['none']` says nothing that a bare `auth: 'none'` doesn't — both were accepted silently. `AuthConfig` moves that rule into the type: a list is one or more credentialed modes, optionally followed by `'none'`. The optional-user form `['user', 'none']` is unaffected, which is what the e2e apps and the docs use. The deprecated `allow` keeps the looser element type so code mid-migration still compiles, so `requiresCredentials` still scans the whole list rather than checking the last entry.
AuthConfig reached the single-mode form through AuthModeWithKey, which also carries 'none'. Splitting it into `'none' | CredentialedAuthMode` makes the union say what it accepts — a bare mode, an ordered list, or 'none' — rather than leaving a reader to subtract 'none' from one member and find it again in another. The type is equivalent to what it replaced, so no call site moves; what changes is that the unwrapped form is now stated, tested and documented instead of inherited.
mandarini
force-pushed
the
fix/auth-config-types
branch
from
September 9, 2026 11:06
8ee541b to
1f9d8eb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previously
authacceptedAuthModeWithKey[], which let'none'appear anywhere in the list even though it matches every request — making later modes unreachable and['none']indistinguishable from a bare'none', both silently accepted.AuthConfig, restricting theauthoption to a single mode, an ordered list of credentialed modes, or that list with'none'only as the final entry; the deprecatedallowkeeps the old looser type so mid-migration code still compiles, andrequiresCredentialsstill scans the full list for itCredentialedAuthMode(AuthModeWithKeyminus'none') as the building block forAuthConfig, giving the unwrapped single-mode form its own name instead of leaving it implicit'none'goes last, or alone" rule, and add type-level tests in src/types.test.ts