Function verifyUserToken

packages/memos-core/src/hub/auth.ts:58–78

(token: string, secret: string)

}

export function verifyUserToken(token: string, secret: string): Omit<UserTokenPayload, "exp"> | null {
  const idx = token.lastIndexOf(".");
  if (idx <= 0) return null;
  const body = token.slice(0, idx);
  const sig = token.slice(idx + 1);
  const expected = sign(body, secret);

  try {
    if (!timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) return null;
    const parsed = JSON.parse(unbase64url(body).toString("utf8")) as UserTokenPayload;
    if (parsed.exp < Date.now()) return null;
    return {
      userId: parsed.userId,
      username: parsed.username,
      role: parsed.role,
      status: parsed.status,
    };
  } catch {
    return null;
  }
}