Function verifyInstallState

apps/api/src/github/github-state.ts:24–47

(state: string)

/**
 * Signing key for the install state.
 *
 * `BETTER_AUTH_SECRET` is read here rather than through `env.ts` because better-auth owns the
 * variable and validates it at startup; this module only borrows it.
 */
function getKey(): Uint8Array {
    const secret = process.env.BETTER_AUTH_SECRET;
    if (secret == null) throw new Error("BETTER_AUTH_SECRET is not set");
    return new TextEncoder().encode(secret);
}

/**
 * Opaque, tamper-evident proof that WE started an install for a specific organization, carried
 * through GitHub and handed back on the callback.
 *
 * A signed JWT via `jose` rather than hand-rolled `base64url(payload).hmac`: the previous version
 * open-coded the signature comparison, the expiry check and the purpose tag, and `jose` does all
 * three - including pinning the algorithm on verify, which is the footgun that makes hand-rolled
 * token code worth avoiding.
 *
 * NOT encrypted - the payload is readable by anyone holding the link, which is fine because it
 * only names an organization the holder is already installing for. It is also NOT authorization to
 * bind any particular installation: state cannot name one, because it is minted before the
 * installation exists. See `handleInstallation` for what actually gates the bind.
 */
export async function createInstallState(organizationId: string, returnPath?: string): Promise<string> {
    return await new SignJWT({ organizationId, returnPath })