Function onAuthenticate

apps/collab/src/index.ts:186–236

({ token, documentName }: onAuthenticatePayload)

  },

  async onAuthenticate({ token, documentName }: onAuthenticatePayload) {
    if (!token) {
      throw new Error('Authentication required')
    }

    // Verify JWT using same secret + algorithm as backend
    let payload: any
    try {
      payload = jwt.verify(token, SECRET_KEY, { algorithms: ['HS256'] })
    } catch {
      throw new Error('Invalid token')
    }

    const boardUuid = extractBoardUuid(documentName)
    if (!boardUuid) {
      throw new Error('Invalid document name')
    }

    // Verify board membership via backend API (with timeout)
    let response: Response
    try {
      response = await fetchWithTimeout(
        `${API_URL}/api/v1/boards/${boardUuid}/membership`,
        {
          headers: {
            Authorization: `Bearer ${token}`,
          },
        },
      )
    } catch (err) {
      console.error(
        `[collab] Membership check failed for ${boardUuid}:`,
        err,
      )
      throw new Error('Authentication service unavailable')
    }

    if (!response.ok) {
      throw new Error('Not authorized for this board')
    }

    const membership = await response.json()

    return {
      user: {
        id: payload.sub,
        name: membership.username || 'Unknown',
        role: membership.role,
      },
    }
  },

  async onConnect({ documentName, instance }: onConnectPayload) {
    const boardUuid = extractBoardUuid(documentName)