per-user api keys, resolved at both identity doors

a user can mint a long-lived key for an app or a device instead of
carrying a 30-day session, so multiple logins on the mobile apps are
per-device revocable rather than one shared token.

identity was being decided independently in userMiddleware and
originScopeMiddleware, each verifying the token itself. teaching only
one of them a new credential format is how those two stop agreeing, so
both now call resolveAuthToken and neither knows what a bearer string
is. verified: a member's key returns the same status as their jwt on
every route tried, 403s included.

a key carries its holder's full authority — not an escalation, it
equals what the password could already do. scoping wants a scopes
column, not a change here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/_middlewares/origin-validation.ts

@@ -1,7 +1,7 @@
 import type { MiddlewareHandler } from 'hono';
 import * as errors from '../custom-errors';
 import { IS_DEV_BUILD } from '../build-env';
-import { verify } from '../jwt';
+import { resolveAuthToken } from '../auth-token';
 import { isSuperAdmin } from '../super-admin';
 import { isApiRequestAllowed } from '../capabilities/authorize';
 import { isExemptApiPath } from '../capabilities/totality';
@@ -185,17 +185,12 @@ export const originScopeMiddleware: MiddlewareHandler = async function (ctx, nex
   const path = ctx.req.path;
   const origin = resolveOrigin(ctx.req.header('origin'), ctx.req.header('referer'));
 
-  // Verify the caller's token once (if any); a missing/invalid token stays null.
+  // Resolve the caller once (if any); a missing/invalid/revoked credential stays null. This goes through
+  // the shared resolver rather than verifying a JWT here, so an API key is the same caller at this door as
+  // it is at userMiddleware — the two must never disagree about who someone is. See auth-token.ts.
   const authorization = ctx.req.header('authorization');
   const token = authorization ? authorization.split(' ')[1] : ctx.req.query('token') || undefined;
-  let payload: { id?: number } | null = null;
-  if (token) {
-    try {
-      payload = await verify(token);
-    } catch {
-      payload = null;
-    }
-  }
+  const payload = token ? await resolveAuthToken(token) : null;
   const isOwner = payload ? await isSuperAdmin(payload) : false;
 
   // 1. Capability backstop — origin-INDEPENDENT, and the airtight half of this middleware. A valid

src/servers/_middlewares/user-middleware.ts

@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from 'hono';
-import { verify } from '@@/jwt';
+import { resolveAuthToken } from '@@/auth-token';
 import * as errors from '@@/custom-errors';
 import { isOriginAllowed, isMusicOriginExempt } from './origin-validation';
 import { isLockdown, noteBlocked } from '../api/auth/panic';
@@ -36,22 +36,28 @@ export const userMiddleware: MiddlewareHandler = async function (ctx, next) {
   }
 
   try {
-    const user = await verify(token);
+    // Both credentials resolve here — see auth-token.ts. Everything below applies to a session JWT only:
+    // an API key's revocation is a column checked during that lookup, so there is no blacklist to consult
+    // and no issued-at to compare. A password change deliberately does NOT kill a user's API keys; they
+    // are the credential you rotate independently, which is the whole reason they exist.
+    const user = await resolveAuthToken(token);
     if (!user) throw errors.UNAUTHORIZED();
 
-    // Check if token is blacklisted (explicit signout)
-    if (user.jti) {
-      if (await isTokenBlacklisted(user.jti)) throw errors.UNAUTHORIZED();
-    }
+    if (user.via === 'jwt') {
+      // Check if token is blacklisted (explicit signout)
+      if (user.jti) {
+        if (await isTokenBlacklisted(user.jti)) throw errors.UNAUTHORIZED();
+      }
 
-    // Check if token was issued before password change
-    if (user.iat && user.id) {
-      const dbUser = await getUserById(user.id);
-      if (dbUser?.passwordChangedAt) {
-        // iat is in seconds, passwordChangedAt is a Date
-        const tokenIssuedAt = user.iat * 1000;
-        if (tokenIssuedAt < dbUser.passwordChangedAt.getTime()) {
-          throw errors.UNAUTHORIZED();
+      // Check if token was issued before password change
+      if (user.iat && user.id) {
+        const dbUser = await getUserById(user.id);
+        if (dbUser?.passwordChangedAt) {
+          // iat is in seconds, passwordChangedAt is a Date
+          const tokenIssuedAt = user.iat * 1000;
+          if (tokenIssuedAt < dbUser.passwordChangedAt.getTime()) {
+            throw errors.UNAUTHORIZED();
+          }
         }
       }
     }