fix: web router

Author: cptchloroplast

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@okkema/worker",
-  "version": "4.7.4",
+  "version": "4.7.5",
   "description": "Cloudflare Workers Toolkit",
   "files": [
     "dist",

package.json

@@ -28,8 +28,14 @@ export const JWK = {
       })
     return resp.json<{ keys: JsonWebKey[] }>()
   },
-  url(issuer): string {
+  url(issuer: string): string {
     const url = new URL(issuer)
+    if (url.protocol !== "https:") {
+      throw new Problem({
+        title: "JWK Error",
+        detail: "JWK issuer must use HTTPS",
+      })
+    }
     if (!url.pathname.endsWith("/")) url.pathname += "/"
     url.pathname += ".well-known/jwks.json"
     return url.href

src/auth/jwk.ts

@@ -186,16 +186,14 @@ export const JWT = {
         detail: "Missing 'Authorization' header.",
         status: 401,
       })
-    let type, token
-    try {
-      ;[type, token] = header.split(" ")
-    } catch {
+    const parts = header.split(" ", 2)
+    if (parts.length !== 2)
       throw new Problem({
         title: "JWT Error",
         detail: "Unable to parse 'Authorization' header.",
         status: 401,
       })
-    }
+    const [type, token] = parts
     if (type !== "Bearer")
       throw new Problem({
         title: "JWT Error",

src/auth/jwt.ts

@@ -1,15 +1,18 @@
 import type { APIContext, MiddlewareNext, MiddlewareHandler } from "astro"
 import { sequence } from "astro:middleware"
 
+const NORMALIZE = /\/+(\/|$)/g // strip double & trailing slash
+
 export function router(routes: Record<string, MiddlewareHandler>) {
     const entries = Object.entries(routes)
     return function (context: APIContext, next: MiddlewareNext) {
         return sequence(
             ...entries.filter(function ([path]) {
-                return context.url.pathname.match(RegExp(`^${(path
-                    .replace(/\/+(\/|$)/g, '$1')) // strip double & trailing splash
-                    .replace(/(\/?)\*/g, '($1.*)?') // wildcard
-                    }/*$`))
+                return context.url.pathname.replace(NORMALIZE, '$1')
+                    .match(RegExp(`^${(path
+                        .replace(NORMALIZE, '$1'))
+                        .replace(/(\/?)\*/g, '($1.*)?') // wildcard
+                        }/*$`))
             // eslint-disable-next-line @typescript-eslint/no-unused-vars
             }).map(([_, handler]) => handler)
         )(context, next)