authentication improvements

apps/match/src/context.ts

@@ -2,6 +2,10 @@ import type { HonoApp } from '@repo/hono-helpers'
 import type { SharedHonoEnv, SharedHonoVariables } from '@repo/hono-helpers/src/types'
 
 export type Env = SharedHonoEnv & {
+	// Shared Secrets Store binding for the HS256 JWT signing key. Resolve the value
+	// with `await env.JWT_SECRET.get()`; all workers bind the same store so tokens
+	// signed by `auth` verify here.
+	JWT_SECRET: SecretsStoreSecret
 	// Per-player presence (the room instance they're currently in). Written by
 	// matchmake/goto, read by the heartbeat, cleared on login — mirrors the
 	// reference server's HeartbeatDB.

apps/match/src/jwt.ts

@@ -1,10 +1,9 @@
 /**
  * Minimal HS256 JWT validation.
  *
- * Uses the same placeholder dev secret as the `auth` worker (`apps/auth/src/jwt.ts`).
- * Swap both for a shared secret binding before this is used for anything real.
+ * The signing key is supplied by the caller from the shared `JWT_SECRET` Secrets
+ * Store binding (see context.ts) - the same key the `auth` worker signs with.
  */
-const DEV_SECRET = 'dev-insecure-signing-key-change-me'
 
 function base64urlToBytes(input: string): Uint8Array {
 	const padded = input.replace(/-/g, '+').replace(/_/g, '/')
@@ -22,7 +21,7 @@ function base64urlToBytes(input: string): Uint8Array {
  */
 export async function validateAndGetAccountId(
 	token: string,
-	secret: string = DEV_SECRET
+	secret: string
 ): Promise<string | null> {
 	const parts = token.split('.')
 	if (parts.length !== 3) return null

apps/match/src/match.app.ts

@@ -4,11 +4,7 @@ import { useWorkersLogger } from 'workers-tagged-logger'
 import { withNotFound, withOnError } from '@repo/hono-helpers'
 
 import { validateAndGetAccountId } from './jwt'
-import {
-	createRoomInstance,
-	getJoinableInstance,
-	getRoomInstancesByRoom,
-} from './room-instance-db'
+import { createRoomInstance, getJoinableInstance, getRoomInstancesByRoom } from './room-instance-db'
 import { getOrCreateDormRoom, getRoomById, getRoomByName } from './rooms-db'
 
 import type { Context } from 'hono'
@@ -60,7 +56,7 @@ async function authedId(c: Context<App>): Promise<number | null> {
 	if (!authHeader.toLowerCase().startsWith('bearer ')) return null
 
 	const token = authHeader.slice('Bearer '.length)
-	const accountId = await validateAndGetAccountId(token)
+	const accountId = await validateAndGetAccountId(token, await c.env.JWT_SECRET.get())
 	if (!accountId) return null
 
 	const id = Number.parseInt(accountId, 10)

apps/match/src/test/integration/api.test.ts

@@ -1,4 +1,4 @@
-import { env } from 'cloudflare:test'
+import { adminSecretsStore, env } from 'cloudflare:test'
 import { exports } from 'cloudflare:workers'
 import { beforeAll, describe, expect, test } from 'vitest'
 
@@ -35,6 +35,8 @@ const TEST_ROOMS = [
 ]
 
 beforeAll(async () => {
+	// Seed the shared JWT signing key into the local Secrets Store so .get() resolves.
+	await adminSecretsStore(env.JWT_SECRET).create('test-signing-key')
 	await env.DB.prepare(
 		`CREATE TABLE IF NOT EXISTS rooms (
 			data TEXT NOT NULL,
@@ -64,10 +66,10 @@ beforeAll(async () => {
 	])
 })
 
-// Mint a token the way the `auth` worker does, using the same dev secret, so the
+// Mint a token the way the `auth` worker does, signing with the shared test key seeded into the JWT_SECRET store, so the
 // match worker's validation accepts it. Kept inline to avoid a cross-package
 // import.
-const DEV_SECRET = 'dev-insecure-signing-key-change-me'
+const TEST_SECRET = 'test-signing-key'
 
 function b64url(input: ArrayBuffer | string): string {
 	const bytes = typeof input === 'string' ? new TextEncoder().encode(input) : new Uint8Array(input)
@@ -83,7 +85,7 @@ async function bearer(sub = '42'): Promise<Record<string, string>> {
 	)}`
 	const key = await crypto.subtle.importKey(
 		'raw',
-		new TextEncoder().encode(DEV_SECRET),
+		new TextEncoder().encode(TEST_SECRET),
 		{ name: 'HMAC', hash: 'SHA-256' },
 		false,
 		['sign']

apps/match/wrangler.jsonc

@@ -25,6 +25,16 @@
 		}
 	],
 	"logpush": false,
+	// Shared Secrets Store holding the HS256 JWT signing key. Every worker binds the
+	// same store as JWT_SECRET so tokens signed by `auth` verify here. The "local"
+	// store_id placeholder is replaced with RECFLARE_SECRETS_STORE at deploy time.
+	"secrets_store_secrets": [
+		{
+			"binding": "JWT_SECRET",
+			"store_id": "local",
+			"secret_name": "JWT_SECRET"
+		}
+	],
 	"upload_source_maps": true,
 	"observability": {
 		"logs": {