gerbeur/api/model/auth.ts

import { isRole, type Role } from "../../shared/user.ts";

export interface AuthPayload {
  userId: string;
  username: string;
  role: Role;
  exp: number;
  iat?: number;
}

export function isAuthPayload(obj: unknown): obj is AuthPayload {
  return !!obj &&
    typeof obj === "object" &&
    // Purpose-scoped tokens (password reset, media) are never session tokens.
    !("purpose" in obj) &&
    "userId" in obj && typeof obj.userId === "string" &&
    "username" in obj && typeof obj.username === "string" &&
    "role" in obj && isRole(obj.role) &&
    "exp" in obj && typeof obj.exp === "number";
}

export interface PasswordResetPayload {
  purpose: "password-reset";
  userId: string;
  exp: number;
}

export function isPasswordResetPayload(
  obj: unknown,
): obj is PasswordResetPayload {
  return !!obj && typeof obj === "object" &&
    "purpose" in obj &&
    (obj as Record<string, unknown>).purpose === "password-reset" &&
    "userId" in obj &&
    typeof (obj as Record<string, unknown>).userId === "string";
}