Checks what a verified token says before it is trusted. It types the payloads
of session and password reset tokens, and lib/jwt.ts runs their guards when
it verifies one.
Checks whether obj is an AuthPayload. A media or reset token's
payload, which has a purpose, never is.
Checks whether obj is a PasswordResetPayload. It doesn't check
exp, which jwtVerify has already enforced.
Signed into a session token by createJWT, and returned by authenticate
to the auth middleware as ctx.state.user. By then role is the user's live
role, while username is still the one at issue time.
-
exp: number
Seconds since the epoch.
-
iat: number
Seconds since the epoch, compared with
users.tokens_valid_after. - role: Role
- userId: string
- username: string
Signed into a reset link's token by createPasswordResetToken, and returned
by verifyPasswordResetToken to resetPassword.
-
exp: number
Seconds since the epoch.
- purpose: "password-reset"
- userId: string
Usage
import * as mod from "api/model/auth.ts";