Checks session and media tokens against the live user row, not just their signature. The auth middleware, the WebSocket route, the media routes and the routes open to anonymous callers all authenticate through it.
Returns the payload of a valid session token, or null. Besides the signature and expiry, it refuses a token whose user is gone or which predates a password change. The returned role comes from the database, not the token, since a token lasts 7 days and a role can change under it.
Returns the user id behind the ?token= of a file, thumbnail or playlist
cover URL, or null when it isn't valid. A session token is accepted too, for
clients from before media tokens.
Returns the caller's user id on a route open to anonymous callers, or null
when the request has no token. A placeholder such as Bearer undefined
counts as no token. An invalid token throws instead of reading as anonymous,
so that a stale session gets a 401 the client signs out on, rather than a
misleading 404 on a private resource.
Usage
import * as mod from "api/lib/auth.ts";