hamid
60 lines
2.6 KiB
TypeScript
60 lines
2.6 KiB
TypeScript
/**
|
|
* JWT helpers shared by the edge middleware and server components.
|
|
*
|
|
* Pure functions with no `next/headers` dependency, so they are safe to import
|
|
* from `middleware.ts` (edge runtime) and from RSCs alike. They only inspect the
|
|
* token's `exp` claim — a cheap liveness check for routing/UX, NOT a security
|
|
* boundary. The signature is never verified here; the API server is the only
|
|
* authority that actually trusts the token.
|
|
*/
|
|
export interface JwtPayload {
|
|
exp?: number;
|
|
sub?: string;
|
|
[claim: string]: unknown;
|
|
}
|
|
|
|
// JWTs use base64url (no padding, `-`/`_` instead of `+`/`/`); atob expects
|
|
// standard base64, so normalise before decoding.
|
|
function base64UrlDecode(segment: string): string {
|
|
const base64 = segment.replace(/-/g, '+').replace(/_/g, '/');
|
|
const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');
|
|
return atob(padded);
|
|
}
|
|
|
|
export function decodeJwtPayload(token: string | undefined): JwtPayload | null {
|
|
if (!token) return null;
|
|
const segment = token.split('.')[1];
|
|
if (!segment) return null;
|
|
try {
|
|
return JSON.parse(base64UrlDecode(segment)) as JwtPayload;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
/** Compact serialization part counts: a JWS is 3, a JWE is 5 (header.key.iv.ciphertext.tag). */
|
|
const JWE_PART_COUNT = 5;
|
|
|
|
export function isTokenAlive(token: string | undefined): boolean {
|
|
if (!token) return false;
|
|
|
|
const payload = decodeJwtPayload(token);
|
|
if (payload) return typeof payload.exp === 'number' && payload.exp * 1000 > Date.now();
|
|
|
|
/*
|
|
* The server issues an **encrypted** access token (JWE — `JwtService._createSecurityTokenAsync`
|
|
* pairs SigningCredentials with EncryptingCredentials), so its claims, `exp` included, are
|
|
* ciphertext that no client-side decode will ever read. Treating that as "not alive" is what
|
|
* made every real session look logged-out to this gate: the middleware bounced private routes
|
|
* to /login, and an authenticated hit on '/' fell through the guest-front-door branch and got
|
|
* rewritten to the marketing page — the "app just shows a loading skeleton at /fa" symptom.
|
|
*
|
|
* A well-formed but unreadable token is therefore treated as alive. That is sound here and only
|
|
* here: this is a routing/UX hint, never a security boundary (the API is the sole authority on
|
|
* the token), and the access cookie's own 15-minute `maxAge` bounds how long the optimism can
|
|
* last — an expired cookie is simply absent, which is still a clean `false`. A stale token that
|
|
* slips through gets a 401 on the first call, which the fetch layer's silent refresh handles.
|
|
*/
|
|
return token.split('.').length === JWE_PART_COUNT;
|
|
}
|