| 107 | import { |
| 108 | isKiloCredentialExchangeEligible, |
| 109 | verifyKiloTokenForPolicy, |
| 110 | type KiloCredentialExchangeEligibilityPolicy, |
| 111 | } from '@kilocode/worker-utils/kilo-token-policy'; |
| 112 | |
| 113 | export type TurnstileJwtPayload = { |
| 114 | /** |
| 115 | * SECURITY: this guid MUST be generated server side! |
| 116 | * It's used to ensure idempotency, but also to determine the user id. |
| 117 | */ |
| 118 | guid: UUID; |
| 119 | ip: string; |
| 120 | iat: number; |
| 121 | exp: number; |
| 122 | }; |
| 123 | |
| 124 | const warnInSentry = sentryLogger('user.server', 'warning'); |
| 125 | |
| 126 | import { getBlacklistedDomains } from '@/lib/blacklist-domains-config'; |
| 127 | |
| 128 | const blacklistDomainsEnv = getEnvVariable('BLACKLIST_DOMAINS'); |
| 129 | const BLACKLIST_DOMAINS_FROM_ENV = blacklistDomainsEnv |
| 130 | ? blacklistDomainsEnv.split('|').map((domain: string) => domain.trim()) |
| 131 | : []; |
| 132 | |
| 133 | function generateAppleClientSecret(): string { |
| 134 | if (!APPLE_PRIVATE_KEY || !APPLE_KEY_ID || !APPLE_TEAM_ID || !APPLE_CLIENT_ID) { |