@lucidcms/core/dist/services/auth/refresh-token/verify-token.mjs

The core of the Lucid CMS. It's responsible for spinning up the API and serving the CMS.

import{copy as e}from"../../../libs/i18n/copy.mjs";import t from"../../../constants/constants.mjs";import n from"../../../libs/repositories/user-tokens.mjs";import r from"../../../libs/kv/cache-keys.mjs";import i from"../access-token/clear-token.mjs";import a from"../../../utils/helpers/hash-user-token.mjs";import o from"../../../libs/http/utils/create-service-context.mjs";import s from"./clear-token.mjs";import c from"./revoke-user-tokens.mjs";import{getCookie as l}from"hono/cookie";import{verify as u}from"hono/jwt";const d=async d=>{let f=d.get(`config`);try{let p=l(d,t.cookies.refreshToken);if(!p)return{error:{type:`authorisation`,name:e(`server:core.auth.refresh.token.error.name`),message:e(`server:core.auth.refresh.token.missing`)},data:void 0};let m=new n(d.get(`database`).client,f.db),h=await u(p,f.secrets.refreshToken,t.jwt.algorithm),g=a(p),_=await m.selectSingle({select:[`user_id`,`expiry_date`,`revoked_at`,`revoke_reason`,`replaced_by_token_id`],where:[{key:`token`,operator:`=`,value:g},{key:`token_type`,operator:`=`,value:t.userTokens.refresh}]});if(_.error)return _;if(!_.data||_.data.user_id!==h.id)return{error:{type:`authorisation`,name:e(`server:core.auth.refresh.token.error.name`),message:e(`server:core.auth.refresh.token.missing`)},data:void 0};if(_.data.revoked_at!==null){if(_.data.replaced_by_token_id!==null){await c(o(d),{userId:_.data.user_id,revokeReason:t.refreshTokenRevokeReasons.reuseDetected});let[n,r]=await Promise.all([s(d,{revokeReason:t.refreshTokenRevokeReasons.reuseDetected}),i(d)]);return n.error?n:r.error?r:{error:{type:`authorisation`,name:e(`server:core.auth.refresh.token.error.name`),message:e(`server:core.auth.refresh.token.error.message`)},data:void 0}}return{error:{type:`authorisation`,name:e(`server:core.auth.refresh.token.error.name`),message:e(`server:core.auth.refresh.token.missing`)},data:void 0}}if(!_.data.expiry_date)return{error:{type:`authorisation`,name:e(`server:core.auth.refresh.token.error.name`),message:e(`server:core.auth.refresh.token.missing`)},data:void 0};let v=new Date(_.data.expiry_date).getTime();if(Number.isNaN(v)||v<=Date.now())return{error:{type:`authorisation`,name:e(`server:core.auth.refresh.token.error.name`),message:e(`server:core.auth.refresh.token.missing`)},data:void 0};let y=o(d),b=y.kv,x=await b.get(y,{key:r.auth.refresh(p),hash:!0});return x&&x.user_id===_.data.user_id?{error:void 0,data:{user_id:x.user_id}}:(await b.set(y,{key:r.auth.refresh(p),value:{user_id:_.data.user_id},expirationTtl:t.refreshTokenExpiration,hash:!0}),{error:void 0,data:{user_id:_.data.user_id}})}catch{let[t,n]=await Promise.all([s(d),i(d)]);return t.error?t:n.error?n:{error:{type:`authorisation`,name:e(`server:core.auth.refresh.token.error.name`),message:e(`server:core.auth.refresh.token.error.message`)},data:void 0}}};export{d as default};
//# sourceMappingURL=verify-token.mjs.map