generated from nhcarrigan/template
hikari
2bc47b79aa
## Summary - **Server**: `authMiddleware` no longer calls `logger.error` for expired tokens — expiry is expected behaviour, not an error. Only tampered signatures and malformed tokens (genuinely suspicious) still log. - **Client**: `fetchJson` now handles 401 responses by clearing `elysium_token` and `elysium_save_signature` from localStorage and redirecting to `/`. Players whose 30-day token has expired will see the login page instead of a stuck "Invalid or expired token" error screen with no recovery path. Closes #241 ✨ This PR was created with help from Hikari~ 🌸 Reviewed-on: #241 Co-authored-by: Hikari <hikari@nhcarrigan.com> Co-committed-by: Hikari <hikari@nhcarrigan.com>
54 lines
1.6 KiB
TypeScript
54 lines
1.6 KiB
TypeScript
/**
|
|
* @file Authentication middleware for validating JWT tokens.
|
|
* @copyright nhcarrigan
|
|
* @license Naomi's Public License
|
|
* @author Naomi Carrigan
|
|
*/
|
|
|
|
import { verifyToken } from "../services/jwt.js";
|
|
import { logger } from "../services/logger.js";
|
|
import type { HonoEnvironment } from "../types/hono.js";
|
|
import type { MiddlewareHandler } from "hono";
|
|
|
|
/**
|
|
* Validates the Authorization Bearer token on each request and attaches the discordId to context.
|
|
* @param context - The Hono context object.
|
|
* @param next - The next middleware handler.
|
|
* @returns A JSON error response if authentication fails, otherwise calls next.
|
|
*/
|
|
export const authMiddleware: MiddlewareHandler<HonoEnvironment> = async(
|
|
context,
|
|
next,
|
|
) => {
|
|
const authorization = context.req.header("Authorization");
|
|
|
|
if (authorization?.startsWith("Bearer ") !== true) {
|
|
return context.json(
|
|
{ error: "Missing or invalid Authorization header" },
|
|
401,
|
|
);
|
|
}
|
|
|
|
const token = authorization.slice(7);
|
|
|
|
try {
|
|
const payload = verifyToken(token);
|
|
context.set("discordId", payload.discordId);
|
|
} catch (error) {
|
|
const isExpiredToken
|
|
= error instanceof Error && error.message === "Token has expired";
|
|
if (!isExpiredToken) {
|
|
void logger.error(
|
|
"auth_middleware",
|
|
error instanceof Error
|
|
? error
|
|
: new Error(String(error)),
|
|
);
|
|
}
|
|
return context.json({ error: "Invalid or expired token" }, 401);
|
|
}
|
|
|
|
// eslint-disable-next-line @typescript-eslint/no-confusing-void-expression -- Need the consistent return!
|
|
return await next();
|
|
};
|