dtp/gadget
1
0
Fork 0
Code Actions Packages Projects Releases Activity

JWT processing fixed

Browse Source
This commit is contained in:
Rob Colbert 2026-05-01 16:43:56 -04:00
parent e2dcaf25a0
commit f353c2153a
1 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
gadget-code/src/services/session.ts
View File

@ -16,6 +16,7 @@ import { WebVisit } from "../models/web-visit.js";
import UserService from "../services/user.js"; import UserService from "../services/user.js";
import { DtpService } from "../lib/service.js"; import { DtpService } from "../lib/service.js";
import { PopulateOptions } from "mongoose";
export enum SessionType { export enum SessionType {
WEB = "web", WEB = "web",
@ -30,6 +31,13 @@ interface UserWebToken {
} }
class SessionService extends DtpService { class SessionService extends DtpService {
private populateWebToken: PopulateOptions[] = [
{
path: "user",
select: "-passwordSalt -password",
},
];
get name(): string { get name(): string {
return "SessionService"; return "SessionService";
} }
@ -48,13 +56,13 @@ class SessionService extends DtpService {
webToken.user = user._id; webToken.user = user._id;
const payload: UserWebToken = { const payload: UserWebToken = {
_id: user._id.toString(), _id: user._id,
email: user.email, email: user.email,
displayName: user.displayName, displayName: user.displayName,
webToken: webToken._id, webToken: webToken._id,
}; };
const token = jwt.sign(payload, env.auth.jwtSecret, { const token = jwt.sign(payload, env.auth.jwtSecret, {
expiresIn: "1h", expiresIn: "24h",
}); });
webToken.token = token; webToken.token = token;
@ -69,13 +77,16 @@ class SessionService extends DtpService {
const payload = jwt.verify(token, env.auth.jwtSecret) as UserWebToken; const payload = jwt.verify(token, env.auth.jwtSecret) as UserWebToken;
const userId = payload._id; const userId = payload._id;
const webToken = await WebToken.findOne({ _id: payload.webToken }); const webToken = await WebToken.findOne({
_id: payload.webToken,
}).populate(this.populateWebToken);
if (!webToken) { if (!webToken) {
const error = new Error("Invalid JSON Web Token"); const error = new Error("Invalid JSON Web Token");
error.name = "InvalidToken"; error.name = "InvalidToken";
error.statusCode = 401; error.statusCode = 401;
throw error; throw error;
} }
if (webToken.expires < NOW) { if (webToken.expires < NOW) {
await WebToken.deleteOne({ _id: webToken._id }); await WebToken.deleteOne({ _id: webToken._id });
const error = new Error("JSON Web Token has expired"); const error = new Error("JSON Web Token has expired");