@lucidcms/core/dist/services/auth/get-status.mjs.map

The core of the Lucid CMS. It's responsible for spinning up the API and serving the CMS.

{"version":3,"file":"get-status.mjs","names":["constants"],"sources":["../../../src/services/auth/get-status.ts"],"sourcesContent":["import { verify } from \"hono/jwt\";\nimport constants from \"../../constants/constants.js\";\nimport { copy } from \"../../libs/i18n/index.js\";\nimport { UserTokensRepository } from \"../../libs/repositories/index.js\";\nimport hashUserToken from \"../../utils/helpers/hash-user-token.js\";\nimport type { ServiceFn } from \"../../utils/services/types.js\";\n\ntype StatusTokens = {\n\taccessToken?: string;\n\trefreshToken?: string;\n};\n\nconst readUserId = async (\n\ttoken: string | undefined,\n\tsecret: string,\n): Promise<number | null> => {\n\tif (!token) return null;\n\ttry {\n\t\tconst payload = await verify(token, secret, constants.jwt.algorithm);\n\t\treturn typeof payload.id === \"number\" && Number.isInteger(payload.id)\n\t\t\t? payload.id\n\t\t\t: null;\n\t} catch {\n\t\treturn null;\n\t}\n};\n\n/** Resolves whether browser tokens represent an active session without rotating them. */\nconst getStatus: ServiceFn<[StatusTokens], undefined> = async (\n\tcontext,\n\ttokens,\n) => {\n\tconst accessUserId = await readUserId(\n\t\ttokens.accessToken,\n\t\tcontext.config.secrets.accessToken,\n\t);\n\tif (accessUserId !== null) {\n\t\treturn { error: undefined, data: undefined };\n\t}\n\n\tconst refreshUserId = await readUserId(\n\t\ttokens.refreshToken,\n\t\tcontext.config.secrets.refreshToken,\n\t);\n\tif (refreshUserId === null || !tokens.refreshToken) {\n\t\treturn {\n\t\t\terror: {\n\t\t\t\ttype: \"authorisation\",\n\t\t\t\tcode: \"authorisation\",\n\t\t\t\tstatus: 401,\n\t\t\t\tmessage: copy(\"server:core.permissions.unauthorized\"),\n\t\t\t},\n\t\t\tdata: undefined,\n\t\t};\n\t}\n\n\tconst UserTokens = new UserTokensRepository(\n\t\tcontext.db.client,\n\t\tcontext.config.db,\n\t);\n\tconst tokenRes = await UserTokens.selectSingle({\n\t\tselect: [\"user_id\"],\n\t\twhere: [\n\t\t\t{\n\t\t\t\tkey: \"token\",\n\t\t\t\toperator: \"=\",\n\t\t\t\tvalue: hashUserToken(tokens.refreshToken),\n\t\t\t},\n\t\t\t{\n\t\t\t\tkey: \"token_type\",\n\t\t\t\toperator: \"=\",\n\t\t\t\tvalue: constants.userTokens.refresh,\n\t\t\t},\n\t\t\t{\n\t\t\t\tkey: \"revoked_at\",\n\t\t\t\toperator: \"is\",\n\t\t\t\tvalue: null,\n\t\t\t},\n\t\t\t{\n\t\t\t\tkey: \"expiry_date\",\n\t\t\t\toperator: \">\",\n\t\t\t\tvalue: new Date().toISOString(),\n\t\t\t},\n\t\t],\n\t});\n\tif (tokenRes.error) return tokenRes;\n\n\tif (!tokenRes.data || tokenRes.data.user_id !== refreshUserId) {\n\t\treturn {\n\t\t\terror: {\n\t\t\t\ttype: \"authorisation\",\n\t\t\t\tcode: \"authorisation\",\n\t\t\t\tstatus: 401,\n\t\t\t\tmessage: copy(\"server:core.permissions.unauthorized\"),\n\t\t\t},\n\t\t\tdata: undefined,\n\t\t};\n\t}\n\n\treturn { error: undefined, data: undefined };\n};\n\nexport default getStatus;\n"],"mappings":"6OAYA,MAAM,EAAa,MAClB,EACA,IAC4B,CAC5B,GAAI,CAAC,EAAO,OAAO,KACnB,GAAI,CACH,IAAM,EAAU,MAAM,EAAO,EAAO,EAAQA,EAAU,IAAI,SAAS,EACnE,OAAO,OAAO,EAAQ,IAAO,UAAY,OAAO,UAAU,EAAQ,EAAE,EACjE,EAAQ,GACR,IACJ,MAAQ,CACP,OAAO,IACR,CACD,EAGM,EAAkD,MACvD,EACA,IACI,CAKJ,GAAI,MAJuB,EAC1B,EAAO,YACP,EAAQ,OAAO,QAAQ,WACxB,IACqB,KACpB,MAAO,CAAE,MAAO,IAAA,GAAW,KAAM,IAAA,EAAU,EAG5C,IAAM,EAAgB,MAAM,EAC3B,EAAO,aACP,EAAQ,OAAO,QAAQ,YACxB,EACA,GAAI,IAAkB,MAAQ,CAAC,EAAO,aACrC,MAAO,CACN,MAAO,CACN,KAAM,gBACN,KAAM,gBACN,OAAQ,IACR,QAAS,EAAK,sCAAsC,CACrD,EACA,KAAM,IAAA,EACP,EAOD,IAAM,EAAW,MAAM,IAJA,EACtB,EAAQ,GAAG,OACX,EAAQ,OAAO,EAEgB,CAAC,CAAC,aAAa,CAC9C,OAAQ,CAAC,SAAS,EAClB,MAAO,CACN,CACC,IAAK,QACL,SAAU,IACV,MAAO,EAAc,EAAO,YAAY,CACzC,EACA,CACC,IAAK,aACL,SAAU,IACV,MAAOA,EAAU,WAAW,OAC7B,EACA,CACC,IAAK,aACL,SAAU,KACV,MAAO,IACR,EACA,CACC,IAAK,cACL,SAAU,IACV,MAAO,IAAI,KAAK,CAAA,CAAE,YAAY,CAC/B,CACD,CACD,CAAC,EAeD,OAdI,EAAS,MAAc,EAEvB,CAAC,EAAS,MAAQ,EAAS,KAAK,UAAY,EACxC,CACN,MAAO,CACN,KAAM,gBACN,KAAM,gBACN,OAAQ,IACR,QAAS,EAAK,sCAAsC,CACrD,EACA,KAAM,IAAA,EACP,EAGM,CAAE,MAAO,IAAA,GAAW,KAAM,IAAA,EAAU,CAC5C"}