hono 4.13.2: bearerAuth

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify hono.bearerAuth in pkg:npm/hono@4.13.2
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/hono@4.13.2
Demonstrate these symbols/APIs:
  - hono.bearerAuth
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:3a32e238ee3cfe5b3c88d933ac32d286a896b75c35ecf56284501ea8e49b4c53","constraints":{"executionContext":"node"},"contract":["bearerAuth throws an Error when initialized without token or verifyToken options","bearerAuth allows authorized requests with valid Bearer token and passes to route handler","bearerAuth responds with 401 when Authorization header is missing","bearerAuth responds with 400 when Authorization header is malformed","bearerAuth responds with 401 when provided Bearer token does not match","bearerAuth supports custom verifyToken function for dynamic credential evaluation"],"goal":"verify hono.bearerAuth in pkg:npm/hono@4.13.2","kind":"HOW","packages":["pkg:npm/hono@4.13.2"],"schemaVersion":1,"symbols":["hono.bearerAuth"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","executionContext":"node","language":"javascript","libc":"glibc","libcVersion":"2.39","moduleSystem":"esm","os":"linux","osVersionBucket":"24","packageManager":"npm","packageManagerVersion":"10.9.8","runtime":"node","runtimeVersion":"22.23.2","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/hono@4.13.2"],"schemaVersion":1,"subject":"pkg:npm/hono@4.13.2","symbols":["hono.bearerAuth"],"verifierAdapter":"node-typescript@1"}

{
  "name": "sample-hono-bearer-auth",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-hono-bearer-auth",
      "version": "1.0.0",
      "license": "MIT-0",
      "dependencies": {
        "hono": "4.13.2"
      }
    },
    "node_modules/hono": {
      "version": "4.13.2",
      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.2.tgz",
      "integrity": "sha512-JydRilDRkYBQMt9qR9U92mXxmbGqsqSn/IKOrh4e7/gEbn+0zSr8igTu0obwJoNGN4sez28DIql7FBHWydoJpA==",
      "license": "MIT",
      "engines": {
        "node": ">=16.9.0"
      }
    }
  }
}

{
  "name": "sample-hono-bearer-auth",
  "version": "1.0.0",
  "type": "module",
  "private": true,
  "license": "MIT-0",
  "dependencies": {
    "hono": "4.13.2"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify hono.bearerAuth in pkg:npm/hono@4.13.2",
  "kind": "HOW",
  "packages": [
    "pkg:npm/hono@4.13.2"
  ],
  "symbols": [
    "hono.bearerAuth"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

import assert from 'node:assert/strict';
import { Hono } from 'hono';
import { bearerAuth } from 'hono/bearer-auth';

// Contract 1: bearerAuth throws an Error when initialized without token or verifyToken options
{
  assert.throws(
    () => {
      bearerAuth({});
    },
    {
      name: 'Error',
      message: 'bearer auth middleware requires options for "token" or "verifyToken"',
    }
  );
}

// Contract 2: bearerAuth allows authorized requests with valid Bearer token and passes to route handler
{
  const app = new Hono();
  const validToken = 'secret-test-token-123';
  app.use('/protected/*', bearerAuth({ token: validToken }));
  app.get('/protected/resource', (c) => c.text('granted'));

  const req = new Request('http://localhost/protected/resource', {
    headers: {
      Authorization: `Bearer ${validToken}`,
    },
  });

  const res = await app.request(req);
  assert.strictEqual(res.status, 200);
  assert.strictEqual(await res.text(), 'granted');
}

// Contract 3: bearerAuth responds with 401 when Authorization header is missing
{
  const app = new Hono();
  app.use('/protected/*', bearerAuth({ token: 'secret-token' }));
  app.get('/protected/resource', (c) => c.text('granted'));

  const req = new Request('http://localhost/protected/resource');
  const res = await app.request(req);

  assert.strictEqual(res.status, 401);
  assert.strictEqual(res.headers.get('WWW-Authenticate'), 'Bearer realm=""');
  assert.strictEqual(await res.text(), 'Unauthorized');
}

// Contract 4: bearerAuth responds with 400 when Authorization header is malformed
{
  const app = new Hono();
  app.use('/protected/*', bearerAuth({ token: 'secret-token' }));
  app.get('/protected/resource', (c) => c.text('granted'));

  const req = new Request('http://localhost/protected/resource', {
    headers: {
      Authorization: 'InvalidFormat',
    },
  });
  const res = await app.request(req);

  assert.strictEqual(res.status, 400);
  assert.strictEqual(res.headers.get('WWW-Authenticate'), 'Bearer error="invalid_request"');
  assert.strictEqual(await res.text(), 'Bad Request');
}

// Contract 5: bearerAuth responds with 401 when provided Bearer token does not match
{
  const app = new Hono();
  app.use('/protected/*', bearerAuth({ token: 'correct-secret-token' }));
  app.get('/protected/resource', (c) => c.text('granted'));

  const req = new Request('http://localhost/protected/resource', {
    headers: {
      Authorization: 'Bearer wrong-secret-token',
    },
  });
  const res = await app.request(req);

  assert.strictEqual(res.status, 401);
  assert.strictEqual(res.headers.get('WWW-Authenticate'), 'Bearer error="invalid_token"');
  assert.strictEqual(await res.text(), 'Unauthorized');
}

// Contract 6: bearerAuth supports custom verifyToken function for dynamic credential evaluation
{
  const app = new Hono();
  app.use(
    '/custom/*',
    bearerAuth({
      verifyToken: async (token, c) => {
        return token === 'custom-dynamic-token';
      },
    })
  );
  app.get('/custom/data', (c) => c.json({ ok: true }));

  const validReq = new Request('http://localhost/custom/data', {
    headers: {
      Authorization: 'Bearer custom-dynamic-token',
    },
  });
  const validRes = await app.request(validReq);
  assert.strictEqual(validRes.status, 200);
  assert.deepStrictEqual(await validRes.json(), { ok: true });

  const invalidReq = new Request('http://localhost/custom/data', {
    headers: {
      Authorization: 'Bearer invalid-dynamic-token',
    },
  });
  const invalidRes = await app.request(invalidReq);
  assert.strictEqual(invalidRes.status, 401);
}

console.log('All hono.bearerAuth contract tests passed.');