move JWT validation to package

apps/accounts/package.json

@@ -17,6 +17,7 @@
 	"dependencies": {
 		"@repo/domain": "workspace:*",
 		"@repo/hono-helpers": "workspace:*",
+		"@repo/jwt": "workspace:*",
 		"hono": "4.12.27",
 		"workers-tagged-logger": "1.0.1"
 	},

apps/accounts/src/accounts.app.ts

@@ -11,8 +11,7 @@ import {
 	updateAccount,
 } from '@repo/domain'
 import { logger, withNotFound, withOnError } from '@repo/hono-helpers'
-
-import { validateAndGetAccountId } from './jwt'
+import { validateAndGetAccountId } from '@repo/jwt'
 
 import type { Context } from 'hono'
 import type { Account } from '@repo/domain'

apps/accounts/src/jwt.ts

@@ -1,57 +0,0 @@
-/**
- * Minimal HS256 JWT validation.
- *
- * The signing key is supplied by the caller from the shared `JWT_SECRET` Secrets
- * Store binding (see context.ts) - the same key the `auth` worker signs with.
- */
-
-function base64urlToBytes(input: string): Uint8Array {
-	const padded = input.replace(/-/g, '+').replace(/_/g, '/')
-	const binary = atob(padded + '='.repeat((4 - (padded.length % 4)) % 4))
-	const bytes = new Uint8Array(binary.length)
-	for (let i = 0; i < binary.length; i++) {
-		bytes[i] = binary.charCodeAt(i)
-	}
-	return bytes
-}
-
-/**
- * Validate an HS256 token and return its `sub` (account id) claim, or `null`
- * when the token is malformed, has a bad signature, or is expired.
- */
-export async function validateAndGetAccountId(
-	token: string,
-	secret: string
-): Promise<string | null> {
-	const parts = token.split('.')
-	if (parts.length !== 3) return null
-	const [header, payload, signature] = parts
-
-	const key = await crypto.subtle.importKey(
-		'raw',
-		new TextEncoder().encode(secret),
-		{ name: 'HMAC', hash: 'SHA-256' },
-		false,
-		['verify']
-	)
-	const valid = await crypto.subtle.verify(
-		'HMAC',
-		key,
-		base64urlToBytes(signature),
-		new TextEncoder().encode(`${header}.${payload}`)
-	)
-	if (!valid) return null
-
-	let claims: { sub?: string; exp?: number }
-	try {
-		claims = JSON.parse(new TextDecoder().decode(base64urlToBytes(payload)))
-	} catch {
-		return null
-	}
-
-	if (typeof claims.exp === 'number' && claims.exp < Math.floor(Date.now() / 1000)) {
-		return null
-	}
-
-	return claims.sub ?? null
-}

apps/api/package.json

@@ -17,6 +17,7 @@
 	},
 	"dependencies": {
 		"@repo/hono-helpers": "workspace:*",
+		"@repo/jwt": "workspace:*",
 		"hono": "4.12.27",
 		"workers-tagged-logger": "1.0.1"
 	},

apps/api/src/http.ts

@@ -1,4 +1,4 @@
-import { validateAndGetAccountId } from './jwt'
+import { validateAndGetAccountId } from '@repo/jwt'
 
 import type { Context } from 'hono'
 import type { App } from './context'

apps/api/src/jwt.ts

@@ -1,57 +0,0 @@
-/**
- * Minimal HS256 JWT validation.
- *
- * The signing key is supplied by the caller from the shared `JWT_SECRET` Secrets
- * Store binding (see context.ts) - the same key the `auth` worker signs with.
- */
-
-function base64urlToBytes(input: string): Uint8Array {
-	const padded = input.replace(/-/g, '+').replace(/_/g, '/')
-	const binary = atob(padded + '='.repeat((4 - (padded.length % 4)) % 4))
-	const bytes = new Uint8Array(binary.length)
-	for (let i = 0; i < binary.length; i++) {
-		bytes[i] = binary.charCodeAt(i)
-	}
-	return bytes
-}
-
-/**
- * Validate an HS256 token and return its `sub` (account id) claim, or `null`
- * when the token is malformed, has a bad signature, or is expired.
- */
-export async function validateAndGetAccountId(
-	token: string,
-	secret: string
-): Promise<string | null> {
-	const parts = token.split('.')
-	if (parts.length !== 3) return null
-	const [header, payload, signature] = parts
-
-	const key = await crypto.subtle.importKey(
-		'raw',
-		new TextEncoder().encode(secret),
-		{ name: 'HMAC', hash: 'SHA-256' },
-		false,
-		['verify']
-	)
-	const valid = await crypto.subtle.verify(
-		'HMAC',
-		key,
-		base64urlToBytes(signature),
-		new TextEncoder().encode(`${header}.${payload}`)
-	)
-	if (!valid) return null
-
-	let claims: { sub?: string; exp?: number }
-	try {
-		claims = JSON.parse(new TextDecoder().decode(base64urlToBytes(payload)))
-	} catch {
-		return null
-	}
-
-	if (typeof claims.exp === 'number' && claims.exp < Math.floor(Date.now() / 1000)) {
-		return null
-	}
-
-	return claims.sub ?? null
-}

apps/auth/package.json

@@ -18,6 +18,7 @@
 	"dependencies": {
 		"@repo/domain": "workspace:*",
 		"@repo/hono-helpers": "workspace:*",
+		"@repo/jwt": "workspace:*",
 		"hono": "4.12.27",
 		"workers-tagged-logger": "1.0.1"
 	},

apps/auth/src/auth.app.ts

@@ -9,8 +9,8 @@ import {
 	setPasswordHash,
 } from '@repo/domain'
 import { logger, withNotFound, withOnError } from '@repo/hono-helpers'
+import { generateToken, TOKEN_TTL_SECONDS, validateAndGetAccountId } from '@repo/jwt'
 
-import { generateToken, TOKEN_TTL_SECONDS, validateAndGetAccountId } from './jwt'
 import { hashPassword, verifyPassword } from './password'
 import { consumeRefreshToken, issueRefreshToken } from './refresh-db'
 

apps/auth/src/jwt.ts

@@ -1,128 +0,0 @@
-/**
- * Minimal HS256 JWT generation.
- *
- * The signing key is supplied by the caller from the `JWT_SECRET` binding
- * (a Cloudflare secret in deployed envs, `.dev.vars` locally) — see context.ts.
- */
-
-/** Token lifetime in seconds (mirrored in the `expires_in` response field). */
-export const TOKEN_TTL_SECONDS = 3600
-
-function base64url(input: ArrayBuffer | string): string {
-	const bytes = typeof input === 'string' ? new TextEncoder().encode(input) : new Uint8Array(input)
-	let binary = ''
-	for (const byte of bytes) {
-		binary += String.fromCharCode(byte)
-	}
-	return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
-}
-
-function base64urlToBytes(input: string): Uint8Array {
-	const padded = input.replace(/-/g, '+').replace(/_/g, '/')
-	const binary = atob(padded + '='.repeat((4 - (padded.length % 4)) % 4))
-	const bytes = new Uint8Array(binary.length)
-	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)
-	return bytes
-}
-
-/**
- * Validate an HS256 token and return its `sub` (account id) claim, or `null` when
- * the token is malformed, has a bad signature, or is expired.
- */
-export async function validateAndGetAccountId(
-	token: string,
-	secret: string
-): Promise<string | null> {
-	const parts = token.split('.')
-	if (parts.length !== 3) return null
-	const [header, payload, signature] = parts
-
-	const key = await crypto.subtle.importKey(
-		'raw',
-		new TextEncoder().encode(secret),
-		{ name: 'HMAC', hash: 'SHA-256' },
-		false,
-		['verify']
-	)
-	const valid = await crypto.subtle.verify(
-		'HMAC',
-		key,
-		base64urlToBytes(signature),
-		new TextEncoder().encode(`${header}.${payload}`)
-	)
-	if (!valid) return null
-
-	let claims: { sub?: string; exp?: number }
-	try {
-		claims = JSON.parse(new TextDecoder().decode(base64urlToBytes(payload)))
-	} catch {
-		return null
-	}
-	if (typeof claims.exp === 'number' && claims.exp < Math.floor(Date.now() / 1000)) return null
-	return claims.sub ?? null
-}
-
-/** Scopes stamped onto every token (as a claim array). */
-const TOKEN_SCOPES = [
-	'profile',
-	'rn',
-	'rn.accounts',
-	'rn.accounts.gc',
-	'rn.api',
-	'rn.chat',
-	'rn.clubs',
-	'rn.commerce',
-	'rn.match.read',
-	'rn.match.write',
-	'rn.notify',
-	'rn.rooms',
-	'rn.storage',
-	'offline_access',
-]
-
-/** Roles granted — the client needs `gameClient` to operate. */
-const TOKEN_ROLES = ['gameClient', /* 'developer', 'moderator', 'junior'*/];
-
-export async function generateToken(
-	accountId: string,
-	platformId: string,
-	platform: string,
-	secret: string
-): Promise<string> {
-	const now = Math.floor(Date.now() / 1000)
-	const header = { alg: 'HS256', typ: 'JWT' }
-	// The client reads `role`/`scope` (and expects a well-formed iss/aud) to
-	// authorize itself; a token with only `sub` is rejected before login finishes.
-	const payload = {
-		iss: 'https://auth.lapis.codes',
-		aud: 'https://auth.lapis.codes/resources',
-		nbf: now,
-		iat: now,
-		exp: now + TOKEN_TTL_SECONDS,
-		auth_time: now,
-		amr: 'cached_login',
-		client_id: 'recroom',
-		sub: accountId,
-		idp: 'local',
-		platform,
-		platform_id: platformId,
-		'rn.ver': '20210129',
-		'rn.plat': '0',
-		role: TOKEN_ROLES,
-		scope: TOKEN_SCOPES,
-		jti: crypto.randomUUID().replace(/-/g, '').toUpperCase(),
-	}
-
-	const signingInput = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(payload))}`
-
-	const key = await crypto.subtle.importKey(
-		'raw',
-		new TextEncoder().encode(secret),
-		{ name: 'HMAC', hash: 'SHA-256' },
-		false,
-		['sign']
-	)
-	const signature = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(signingInput))
-
-	return `${signingInput}.${base64url(signature)}`
-}

apps/cdn/package.json

@@ -16,6 +16,7 @@
 	},
 	"dependencies": {
 		"@repo/hono-helpers": "workspace:*",
+		"@repo/jwt": "workspace:*",
 		"hono": "4.12.27",
 		"workers-tagged-logger": "1.0.1"
 	},

apps/cdn/src/cdn.app.ts

@@ -2,9 +2,9 @@ import { Hono } from 'hono'
 import { useWorkersLogger } from 'workers-tagged-logger'
 
 import { withNotFound, withOnError } from '@repo/hono-helpers'
+import { validateAndGetAccountId } from '@repo/jwt'
 
 import loadingScreenTipData from '../static/loading-screen-tip-data.json'
-import { validateAndGetAccountId } from './jwt'
 
 import type { Context } from 'hono'
 import type { App, Env } from './context'

apps/cdn/src/jwt.ts

@@ -1,57 +0,0 @@
-/**
- * Minimal HS256 JWT validation.
- *
- * The signing key is supplied by the caller from the shared `JWT_SECRET` Secrets
- * Store binding (see context.ts) - the same key the `auth` worker signs with.
- */
-
-function base64urlToBytes(input: string): Uint8Array {
-	const padded = input.replace(/-/g, '+').replace(/_/g, '/')
-	const binary = atob(padded + '='.repeat((4 - (padded.length % 4)) % 4))
-	const bytes = new Uint8Array(binary.length)
-	for (let i = 0; i < binary.length; i++) {
-		bytes[i] = binary.charCodeAt(i)
-	}
-	return bytes
-}
-
-/**
- * Validate an HS256 token and return its `sub` (account id) claim, or `null`
- * when the token is malformed, has a bad signature, or is expired.
- */
-export async function validateAndGetAccountId(
-	token: string,
-	secret: string
-): Promise<string | null> {
-	const parts = token.split('.')
-	if (parts.length !== 3) return null
-	const [header, payload, signature] = parts
-
-	const key = await crypto.subtle.importKey(
-		'raw',
-		new TextEncoder().encode(secret),
-		{ name: 'HMAC', hash: 'SHA-256' },
-		false,
-		['verify']
-	)
-	const valid = await crypto.subtle.verify(
-		'HMAC',
-		key,
-		base64urlToBytes(signature),
-		new TextEncoder().encode(`${header}.${payload}`)
-	)
-	if (!valid) return null
-
-	let claims: { sub?: string; exp?: number }
-	try {
-		claims = JSON.parse(new TextDecoder().decode(base64urlToBytes(payload)))
-	} catch {
-		return null
-	}
-
-	if (typeof claims.exp === 'number' && claims.exp < Math.floor(Date.now() / 1000)) {
-		return null
-	}
-
-	return claims.sub ?? null
-}

apps/clubs/package.json

@@ -16,6 +16,7 @@
 	},
 	"dependencies": {
 		"@repo/hono-helpers": "workspace:*",
+		"@repo/jwt": "workspace:*",
 		"hono": "4.12.27",
 		"workers-tagged-logger": "1.0.1"
 	},

apps/clubs/src/clubs.app.ts

@@ -2,8 +2,7 @@ import { Hono } from 'hono'
 import { useWorkersLogger } from 'workers-tagged-logger'
 
 import { withNotFound, withOnError } from '@repo/hono-helpers'
-
-import { validateAndGetAccountId } from './jwt'
+import { validateAndGetAccountId } from '@repo/jwt'
 
 import type { Context } from 'hono'
 import type { App } from './context'

apps/clubs/src/jwt.ts

@@ -1,57 +0,0 @@
-/**
- * Minimal HS256 JWT validation.
- *
- * The signing key is supplied by the caller from the shared `JWT_SECRET` Secrets
- * Store binding (see context.ts) - the same key the `auth` worker signs with.
- */
-
-function base64urlToBytes(input: string): Uint8Array {
-	const padded = input.replace(/-/g, '+').replace(/_/g, '/')
-	const binary = atob(padded + '='.repeat((4 - (padded.length % 4)) % 4))
-	const bytes = new Uint8Array(binary.length)
-	for (let i = 0; i < binary.length; i++) {
-		bytes[i] = binary.charCodeAt(i)
-	}
-	return bytes
-}
-
-/**
- * Validate an HS256 token and return its `sub` (account id) claim, or `null`
- * when the token is malformed, has a bad signature, or is expired.
- */
-export async function validateAndGetAccountId(
-	token: string,
-	secret: string
-): Promise<string | null> {
-	const parts = token.split('.')
-	if (parts.length !== 3) return null
-	const [header, payload, signature] = parts
-
-	const key = await crypto.subtle.importKey(
-		'raw',
-		new TextEncoder().encode(secret),
-		{ name: 'HMAC', hash: 'SHA-256' },
-		false,
-		['verify']
-	)
-	const valid = await crypto.subtle.verify(
-		'HMAC',
-		key,
-		base64urlToBytes(signature),
-		new TextEncoder().encode(`${header}.${payload}`)
-	)
-	if (!valid) return null
-
-	let claims: { sub?: string; exp?: number }
-	try {
-		claims = JSON.parse(new TextDecoder().decode(base64urlToBytes(payload)))
-	} catch {
-		return null
-	}
-
-	if (typeof claims.exp === 'number' && claims.exp < Math.floor(Date.now() / 1000)) {
-		return null
-	}
-
-	return claims.sub ?? null
-}

apps/econ/package.json

@@ -16,6 +16,7 @@
 	},
 	"dependencies": {
 		"@repo/hono-helpers": "workspace:*",
+		"@repo/jwt": "workspace:*",
 		"hono": "4.12.27",
 		"workers-tagged-logger": "1.0.1"
 	},

apps/econ/src/econ.app.ts

@@ -2,13 +2,13 @@ import { Hono } from 'hono'
 import { useWorkersLogger } from 'workers-tagged-logger'
 
 import { withNotFound, withOnError } from '@repo/hono-helpers'
+import { validateAndGetAccountId } from '@repo/jwt'
 
 import defaultAvatarItems from '../static/default-avatar-items.json'
 import defaultAvatar from '../static/default-avatar.json'
 import myProgress from '../static/my-progress.json'
 import weeklyChallenge from '../static/weekly-challenge.json'
 import { getAvatar, setAvatar } from './avatar-db'
-import { validateAndGetAccountId } from './jwt'
 
 import type { Context } from 'hono'
 import type { Avatar } from './avatar-db'

apps/econ/src/jwt.ts

@@ -1,57 +0,0 @@
-/**
- * Minimal HS256 JWT validation.
- *
- * The signing key is supplied by the caller from the shared `JWT_SECRET` Secrets
- * Store binding (see context.ts) - the same key the `auth` worker signs with.
- */
-
-function base64urlToBytes(input: string): Uint8Array {
-	const padded = input.replace(/-/g, '+').replace(/_/g, '/')
-	const binary = atob(padded + '='.repeat((4 - (padded.length % 4)) % 4))
-	const bytes = new Uint8Array(binary.length)
-	for (let i = 0; i < binary.length; i++) {
-		bytes[i] = binary.charCodeAt(i)
-	}
-	return bytes
-}
-
-/**
- * Validate an HS256 token and return its `sub` (account id) claim, or `null`
- * when the token is malformed, has a bad signature, or is expired.
- */
-export async function validateAndGetAccountId(
-	token: string,
-	secret: string
-): Promise<string | null> {
-	const parts = token.split('.')
-	if (parts.length !== 3) return null
-	const [header, payload, signature] = parts
-
-	const key = await crypto.subtle.importKey(
-		'raw',
-		new TextEncoder().encode(secret),
-		{ name: 'HMAC', hash: 'SHA-256' },
-		false,
-		['verify']
-	)
-	const valid = await crypto.subtle.verify(
-		'HMAC',
-		key,
-		base64urlToBytes(signature),
-		new TextEncoder().encode(`${header}.${payload}`)
-	)
-	if (!valid) return null
-
-	let claims: { sub?: string; exp?: number }
-	try {
-		claims = JSON.parse(new TextDecoder().decode(base64urlToBytes(payload)))
-	} catch {
-		return null
-	}
-
-	if (typeof claims.exp === 'number' && claims.exp < Math.floor(Date.now() / 1000)) {
-		return null
-	}
-
-	return claims.sub ?? null
-}

apps/match/package.json

@@ -17,6 +17,7 @@
 	"dependencies": {
 		"@repo/domain": "workspace:*",
 		"@repo/hono-helpers": "workspace:*",
+		"@repo/jwt": "workspace:*",
 		"hono": "4.12.27",
 		"workers-tagged-logger": "1.0.1"
 	},

apps/match/src/jwt.ts

@@ -1,57 +0,0 @@
-/**
- * Minimal HS256 JWT validation.
- *
- * The signing key is supplied by the caller from the shared `JWT_SECRET` Secrets
- * Store binding (see context.ts) - the same key the `auth` worker signs with.
- */
-
-function base64urlToBytes(input: string): Uint8Array {
-	const padded = input.replace(/-/g, '+').replace(/_/g, '/')
-	const binary = atob(padded + '='.repeat((4 - (padded.length % 4)) % 4))
-	const bytes = new Uint8Array(binary.length)
-	for (let i = 0; i < binary.length; i++) {
-		bytes[i] = binary.charCodeAt(i)
-	}
-	return bytes
-}
-
-/**
- * Validate an HS256 token and return its `sub` (account id) claim, or `null`
- * when the token is malformed, has a bad signature, or is expired.
- */
-export async function validateAndGetAccountId(
-	token: string,
-	secret: string
-): Promise<string | null> {
-	const parts = token.split('.')
-	if (parts.length !== 3) return null
-	const [header, payload, signature] = parts
-
-	const key = await crypto.subtle.importKey(
-		'raw',
-		new TextEncoder().encode(secret),
-		{ name: 'HMAC', hash: 'SHA-256' },
-		false,
-		['verify']
-	)
-	const valid = await crypto.subtle.verify(
-		'HMAC',
-		key,
-		base64urlToBytes(signature),
-		new TextEncoder().encode(`${header}.${payload}`)
-	)
-	if (!valid) return null
-
-	let claims: { sub?: string; exp?: number }
-	try {
-		claims = JSON.parse(new TextDecoder().decode(base64urlToBytes(payload)))
-	} catch {
-		return null
-	}
-
-	if (typeof claims.exp === 'number' && claims.exp < Math.floor(Date.now() / 1000)) {
-		return null
-	}
-
-	return claims.sub ?? null
-}

apps/match/src/match.app.ts

@@ -3,8 +3,8 @@ import { useWorkersLogger } from 'workers-tagged-logger'
 
 import { RoomInstanceType } from '@repo/domain'
 import { withNotFound, withOnError } from '@repo/hono-helpers'
+import { validateAndGetAccountId } from '@repo/jwt'
 
-import { validateAndGetAccountId } from './jwt'
 import {
 	createRoomInstance,
 	getJoinableInstance,

apps/playersettings/package.json

@@ -16,6 +16,7 @@
 	},
 	"dependencies": {
 		"@repo/hono-helpers": "workspace:*",
+		"@repo/jwt": "workspace:*",
 		"hono": "4.12.27",
 		"workers-tagged-logger": "1.0.1"
 	},

apps/playersettings/src/jwt.ts

@@ -1,57 +0,0 @@
-/**
- * Minimal HS256 JWT validation.
- *
- * The signing key is supplied by the caller from the shared `JWT_SECRET` Secrets
- * Store binding (see context.ts) - the same key the `auth` worker signs with.
- */
-
-function base64urlToBytes(input: string): Uint8Array {
-	const padded = input.replace(/-/g, '+').replace(/_/g, '/')
-	const binary = atob(padded + '='.repeat((4 - (padded.length % 4)) % 4))
-	const bytes = new Uint8Array(binary.length)
-	for (let i = 0; i < binary.length; i++) {
-		bytes[i] = binary.charCodeAt(i)
-	}
-	return bytes
-}
-
-/**
- * Validate an HS256 token and return its `sub` (account id) claim, or `null`
- * when the token is malformed, has a bad signature, or is expired.
- */
-export async function validateAndGetAccountId(
-	token: string,
-	secret: string
-): Promise<string | null> {
-	const parts = token.split('.')
-	if (parts.length !== 3) return null
-	const [header, payload, signature] = parts
-
-	const key = await crypto.subtle.importKey(
-		'raw',
-		new TextEncoder().encode(secret),
-		{ name: 'HMAC', hash: 'SHA-256' },
-		false,
-		['verify']
-	)
-	const valid = await crypto.subtle.verify(
-		'HMAC',
-		key,
-		base64urlToBytes(signature),
-		new TextEncoder().encode(`${header}.${payload}`)
-	)
-	if (!valid) return null
-
-	let claims: { sub?: string; exp?: number }
-	try {
-		claims = JSON.parse(new TextDecoder().decode(base64urlToBytes(payload)))
-	} catch {
-		return null
-	}
-
-	if (typeof claims.exp === 'number' && claims.exp < Math.floor(Date.now() / 1000)) {
-		return null
-	}
-
-	return claims.sub ?? null
-}

apps/playersettings/src/playersettings.app.ts

@@ -2,9 +2,9 @@ import { Hono } from 'hono'
 import { useWorkersLogger } from 'workers-tagged-logger'
 
 import { withNotFound, withOnError } from '@repo/hono-helpers'
+import { validateAndGetAccountId } from '@repo/jwt'
 
 import { DEFAULT_SETTINGS } from './default-settings'
-import { validateAndGetAccountId } from './jwt'
 
 import type { Context } from 'hono'
 import type { App } from './context'

apps/rooms/package.json

@@ -17,6 +17,7 @@
 	},
 	"dependencies": {
 		"@repo/hono-helpers": "workspace:*",
+		"@repo/jwt": "workspace:*",
 		"hono": "4.12.27",
 		"workers-tagged-logger": "1.0.1"
 	},

apps/rooms/src/jwt.ts

@@ -1,57 +0,0 @@
-/**
- * Minimal HS256 JWT validation.
- *
- * The signing key is supplied by the caller from the shared `JWT_SECRET` Secrets
- * Store binding (see context.ts) - the same key the `auth` worker signs with.
- */
-
-function base64urlToBytes(input: string): Uint8Array {
-	const padded = input.replace(/-/g, '+').replace(/_/g, '/')
-	const binary = atob(padded + '='.repeat((4 - (padded.length % 4)) % 4))
-	const bytes = new Uint8Array(binary.length)
-	for (let i = 0; i < binary.length; i++) {
-		bytes[i] = binary.charCodeAt(i)
-	}
-	return bytes
-}
-
-/**
- * Validate an HS256 token and return its `sub` (account id) claim, or `null`
- * when the token is malformed, has a bad signature, or is expired.
- */
-export async function validateAndGetAccountId(
-	token: string,
-	secret: string
-): Promise<string | null> {
-	const parts = token.split('.')
-	if (parts.length !== 3) return null
-	const [header, payload, signature] = parts
-
-	const key = await crypto.subtle.importKey(
-		'raw',
-		new TextEncoder().encode(secret),
-		{ name: 'HMAC', hash: 'SHA-256' },
-		false,
-		['verify']
-	)
-	const valid = await crypto.subtle.verify(
-		'HMAC',
-		key,
-		base64urlToBytes(signature),
-		new TextEncoder().encode(`${header}.${payload}`)
-	)
-	if (!valid) return null
-
-	let claims: { sub?: string; exp?: number }
-	try {
-		claims = JSON.parse(new TextDecoder().decode(base64urlToBytes(payload)))
-	} catch {
-		return null
-	}
-
-	if (typeof claims.exp === 'number' && claims.exp < Math.floor(Date.now() / 1000)) {
-		return null
-	}
-
-	return claims.sub ?? null
-}

apps/rooms/src/rooms.app.ts

@@ -2,8 +2,8 @@ import { Hono } from 'hono'
 import { useWorkersLogger } from 'workers-tagged-logger'
 
 import { logger, withNotFound, withOnError } from '@repo/hono-helpers'
+import { validateAndGetAccountId } from '@repo/jwt'
 
-import { validateAndGetAccountId } from './jwt'
 import {
 	cloneRoom,
 	findSubRoom,

apps/storage/package.json

@@ -16,6 +16,7 @@
 	},
 	"dependencies": {
 		"@repo/hono-helpers": "workspace:*",
+		"@repo/jwt": "workspace:*",
 		"hono": "4.12.27",
 		"workers-tagged-logger": "1.0.1"
 	},

apps/storage/src/jwt.ts

@@ -1,57 +0,0 @@
-/**
- * Minimal HS256 JWT validation.
- *
- * The signing key is supplied by the caller from the shared `JWT_SECRET` Secrets
- * Store binding (see context.ts) - the same key the `auth` worker signs with.
- */
-
-function base64urlToBytes(input: string): Uint8Array {
-	const padded = input.replace(/-/g, '+').replace(/_/g, '/')
-	const binary = atob(padded + '='.repeat((4 - (padded.length % 4)) % 4))
-	const bytes = new Uint8Array(binary.length)
-	for (let i = 0; i < binary.length; i++) {
-		bytes[i] = binary.charCodeAt(i)
-	}
-	return bytes
-}
-
-/**
- * Validate an HS256 token and return its `sub` (account id) claim, or `null`
- * when the token is malformed, has a bad signature, or is expired.
- */
-export async function validateAndGetAccountId(
-	token: string,
-	secret: string
-): Promise<string | null> {
-	const parts = token.split('.')
-	if (parts.length !== 3) return null
-	const [header, payload, signature] = parts
-
-	const key = await crypto.subtle.importKey(
-		'raw',
-		new TextEncoder().encode(secret),
-		{ name: 'HMAC', hash: 'SHA-256' },
-		false,
-		['verify']
-	)
-	const valid = await crypto.subtle.verify(
-		'HMAC',
-		key,
-		base64urlToBytes(signature),
-		new TextEncoder().encode(`${header}.${payload}`)
-	)
-	if (!valid) return null
-
-	let claims: { sub?: string; exp?: number }
-	try {
-		claims = JSON.parse(new TextDecoder().decode(base64urlToBytes(payload)))
-	} catch {
-		return null
-	}
-
-	if (typeof claims.exp === 'number' && claims.exp < Math.floor(Date.now() / 1000)) {
-		return null
-	}
-
-	return claims.sub ?? null
-}

apps/storage/src/storage.app.ts

@@ -2,8 +2,7 @@ import { Hono } from 'hono'
 import { useWorkersLogger } from 'workers-tagged-logger'
 
 import { withNotFound, withOnError } from '@repo/hono-helpers'
-
-import { validateAndGetAccountId } from './jwt'
+import { validateAndGetAccountId } from '@repo/jwt'
 
 import type { Context } from 'hono'
 import type { App } from './context'