Signs and verifies the server's four kinds of token (session, media,
password reset and unsubscribe), all HS256 with the one key. Only a token's signature and
expiry are checked here: lib/auth.ts checks a session or media token
against its user.
It also signs and verifies the tokens instances exchange for federated
sign-in (identity tokens and events), EdDSA with the instance's Ed25519 key,
whose public half other instances fetch: instance-key-service.ts keeps
the key, and the federation services pass it in.
Importing this module throws when GERBEUR_JWT_SECRET is unset.
Signs a session token carrying payload, valid for 7 days.
issueTokens issues it on sign-up, sign-in and password change, and
the client sends it as a bearer token.
Signs a media token for userId, valid for 7 days. Media elements can't send
an Authorization header, so the URLs of private files, thumbnails and
playlist covers carry this token as ?token=, where it lands in logs and
browser history. It only reads media, so a leaked URL doesn't expose the
account.
Signs a password reset token for userId, valid for an hour. The token
isn't single-use by itself: requestPasswordReset stores it, and
resetPassword marks it used.
Signs the token of a digest's unsubscribe link, which turns off cadence
for userId without signing in. It never expires, so the link in an old
email still works; turning the digest back on doesn't revoke it, which is
harmless since all it can do is turn it off again.
Returns a new Ed25519 key pair as JWKs, with a random kid, for
instance-key-service.ts to store when the instance has none. The public
JWK carries the kid, alg and use a JWKS entry needs.
Returns the stored private JWK privateJwk as a key to sign with.
Returns a new session token and media token for user, as sign-up
(POST /api/users), sign-in (POST /api/sessions) and a password change
(PUT /api/me/password) answer them.
Signs payload with the instance's key, from issuer (this instance) to
audience (the instance it is for), valid for expiresIn, with a random
jti. The identity tokens of POST /api/oauth/tokens and the events of
the outbox are signed with it.
Returns the payload of token once its signature checks against jwks,
the keys of issuer, and it is addressed to audience and unexpired.
Returns the payload of a session token whose signature and expiry are valid,
or null. Call authenticate (lib/auth.ts) instead, which also checks the
token against its user.
Returns the user id and issue time of a media token, or null when it is invalid, expired or another kind of token.
Returns the payload of a password reset token, or null when it is invalid, expired or another kind of token. Whether it was used is the caller's check.
Returns the user and cadence of an unsubscribe token, or null when it is invalid or another kind of token.
An instance's key, ready to sign, from importInstanceKey. Its
kid names the public half in the instance's JWKS.
Usage
import * as mod from "api/lib/jwt.ts";