officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

per-user api keys, resolved at both identity doors

Browse Source 
a user can mint a long-lived key for an app or a device instead of
carrying a 30-day session, so multiple logins on the mobile apps are
per-device revocable rather than one shared token.

identity was being decided independently in userMiddleware and
originScopeMiddleware, each verifying the token itself. teaching only
one of them a new credential format is how those two stop agreeing, so
both now call resolveAuthToken and neither knows what a bearer string
is. verified: a member's key returns the same status as their jwt on
every route tried, 403s included.

a key carries its holder's full authority — not an escalation, it
equals what the password could already do. scoping wants a scopes
column, not a change here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-08-08 10:10:14 +00:00
co-authored by Claude Opus 5
parent b077671f19
commit 00997f5ff1
13 changed files with 391 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/servers/_middlewares/user-middleware.ts
+20 -14
View File
@@ -1,5 +1,5 @@
import type { MiddlewareHandler } from 'hono';
import { verify } from '@@/jwt';
import { resolveAuthToken } from '@@/auth-token';
import * as errors from '@@/custom-errors';
import { isOriginAllowed, isMusicOriginExempt } from './origin-validation';
import { isLockdown, noteBlocked } from '../api/auth/panic';
@@ -36,22 +36,28 @@ export const userMiddleware: MiddlewareHandler = async function (ctx, next) {
}
try {
const user = await verify(token);
// Both credentials resolve here — see auth-token.ts. Everything below applies to a session JWT only:
// an API key's revocation is a column checked during that lookup, so there is no blacklist to consult
// and no issued-at to compare. A password change deliberately does NOT kill a user's API keys; they
// are the credential you rotate independently, which is the whole reason they exist.
const user = await resolveAuthToken(token);
if (!user) throw errors.UNAUTHORIZED();
// Check if token is blacklisted (explicit signout)
if (user.jti) {
if (await isTokenBlacklisted(user.jti)) throw errors.UNAUTHORIZED();
}
if (user.via === 'jwt') {
// Check if token is blacklisted (explicit signout)
if (user.jti) {
if (await isTokenBlacklisted(user.jti)) throw errors.UNAUTHORIZED();
}
// Check if token was issued before password change
if (user.iat && user.id) {
const dbUser = await getUserById(user.id);
if (dbUser?.passwordChangedAt) {
// iat is in seconds, passwordChangedAt is a Date
const tokenIssuedAt = user.iat * 1000;
if (tokenIssuedAt < dbUser.passwordChangedAt.getTime()) {
throw errors.UNAUTHORIZED();
// Check if token was issued before password change
if (user.iat && user.id) {
const dbUser = await getUserById(user.id);
if (dbUser?.passwordChangedAt) {
// iat is in seconds, passwordChangedAt is a Date
const tokenIssuedAt = user.iat * 1000;
if (tokenIssuedAt < dbUser.passwordChangedAt.getTime()) {
throw errors.UNAUTHORIZED();
}
}
}
}