@playcademy/sandbox 0.9.0 → 0.9.1-beta.1

package/dist/cli.js

@@ -1128,7 +1128,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.9.0",
+    version: "0.9.1-beta.1",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -110749,10 +110749,10 @@ function createSandboxAuthProvider() {
     },
     async mintGameToken(gameId, userId) {
       const header = btoa(JSON.stringify({ alg: "none", typ: "sandbox" }));
-      const exp = Date.now() + 15 * 60 * 1000;
+      const exp = Math.floor(Date.now() / 1000) + 15 * 60;
       const payload = btoa(JSON.stringify({ sub: gameId, uid: userId, exp }));
       const token = `${header}.${payload}.sandbox`;
-      return { token, exp };
+      return { token, exp: exp * 1000 };
     },
     async validateGameToken(token) {
       try {
@@ -110760,18 +110760,9 @@ function createSandboxAuthProvider() {
         if (parts2.length !== 3) {
           return null;
         }
-        if (parts2[2] === "sandbox") {
-          const payload2 = JSON.parse(atob(parts2[1]));
-          if (payload2.sub && payload2.uid) {
-            if (payload2.exp && payload2.exp < Date.now()) {
-              log.debug("[SandboxAuthProvider] Token expired");
-              return null;
-            }
-            return payload2;
-          }
-        }
         const payload = JSON.parse(atob(parts2[1]));
-        if (payload.sub && payload.uid) {
+        const nowSeconds = Date.now() / 1000;
+        if (typeof payload?.sub === "string" && payload.sub.length > 0 && typeof payload.uid === "string" && payload.uid.length > 0 && typeof payload.exp === "number" && Number.isFinite(payload.exp) && payload.exp > nowSeconds && payload.exp < nowSeconds + MAX_TOKEN_LIFETIME_SECONDS) {
           return payload;
         }
         return null;
@@ -110869,7 +110860,7 @@ function createSandboxAuthProvider() {
     }
   };
 }
-var sandboxApiKeys, sandboxAssessmentPreparationReceipts, ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS, sandboxAssessmentTokens;
+var sandboxApiKeys, sandboxAssessmentPreparationReceipts, ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS, MAX_TOKEN_LIFETIME_SECONDS, sandboxAssessmentTokens;
 var init_auth_provider = __esm(async () => {
   init_src6();
   init_constants();
@@ -110877,6 +110868,7 @@ var init_auth_provider = __esm(async () => {
   sandboxApiKeys = new Map;
   sandboxAssessmentPreparationReceipts = new Map;
   ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS = 5 * 60 * 1000;
+  MAX_TOKEN_LIFETIME_SECONDS = 30 * 24 * 60 * 60;
   sandboxAssessmentTokens = new TimebackCache({
     defaultTTL: 2 * 60 * 60 * 1000,
     maxSize: 1000
@@ -112904,56 +112896,13 @@ function extractBearerToken(authHeader) {
   }
   return authHeader.substring(7);
 }
-function parseSandboxToken(token) {
-  try {
-    const parts2 = token.split(".");
-    if (parts2.length !== 3 || parts2[2] !== "sandbox") {
-      return null;
-    }
-    const header = JSON.parse(atob(parts2[0]));
-    if (header.typ !== "sandbox") {
-      return null;
-    }
-    const payload = JSON.parse(atob(parts2[1]));
-    if (!payload.uid || !payload.sub) {
-      return null;
-    }
-    return {
-      userId: payload.uid,
-      gameSlug: payload.sub
-    };
-  } catch {
-    return null;
-  }
-}
-function parseJwtClaims(token) {
-  try {
-    const parts2 = token.split(".");
-    if (parts2.length === 3 && parts2[1]) {
-      const payload = JSON.parse(atob(parts2[1]));
-      if (payload.uid) {
-        return {
-          userId: payload.uid,
-          gameId: payload.sub
-        };
-      }
-    }
-  } catch {}
-  return null;
-}
-function resolveAuth(token) {
+async function resolveAuth(token) {
   const demoUser = DEMO_TOKENS[token];
   if (demoUser) {
     return { userId: demoUser.id };
   }
-  if (token.includes(".")) {
-    const sandboxClaims = parseSandboxToken(token);
-    if (sandboxClaims) {
-      return sandboxClaims;
-    }
-    return parseJwtClaims(token);
-  }
-  return null;
+  const payload = await sandboxAuth.validateGameToken(token);
+  return payload ? { userId: payload.uid, gameId: payload.sub } : null;
 }
 async function fetchUserFromDatabase(db2, userId) {
   try {
@@ -112966,18 +112915,6 @@ async function fetchUserFromDatabase(db2, userId) {
     throw error88;
   }
 }
-async function resolveGameIdFromSlug(db2, slug2) {
-  try {
-    const game2 = await db2.query.games.findFirst({
-      where: eq(games.slug, slug2),
-      columns: { id: true }
-    });
-    return game2?.id || null;
-  } catch (error88) {
-    console.error("[Auth] Error looking up game by slug:", error88);
-    return null;
-  }
-}
 function isPublicRoute(path, exceptions) {
   return exceptions.some((exception) => {
     if (path === exception) {
@@ -112995,35 +112932,23 @@ async function authenticateRequest(c) {
   const apiKey = c.req.header("x-api-key");
   const token = bearerToken || apiKey;
   if (!token) {
-    return {
-      success: false,
-      error: "No authorization token provided",
-      shouldReturn404: true
-    };
+    return { success: false, error: "No authorization token provided" };
   }
-  const resolved = resolveAuth(token);
+  const resolved = await resolveAuth(token);
   if (!resolved) {
-    return {
-      success: false,
-      error: "Invalid or expired token",
-      shouldReturn404: true
-    };
+    return { success: false, error: "Invalid or expired token" };
   }
   const claims = resolved;
   const db2 = c.get("db");
   if (!db2) {
     console.error("[Auth] Database not available in context");
-    return { success: false, error: "Internal server error", shouldReturn404: false };
+    return { success: false, error: "Internal server error" };
   }
   const user = await fetchUserFromDatabase(db2, claims.userId);
   if (!user) {
-    return { success: false, error: "User not found or token invalid", shouldReturn404: true };
+    return { success: false, error: "User not found or token invalid" };
   }
-  let gameId = claims.gameId;
-  if (!gameId && claims.gameSlug) {
-    gameId = await resolveGameIdFromSlug(db2, claims.gameSlug) ?? undefined;
-  }
-  return { success: true, user, gameId };
+  return { success: true, user, gameId: claims.gameId };
 }
 function setupAuth(options = {}) {
   const { exceptions = [] } = options;
@@ -113043,20 +112968,19 @@ function setupAuth(options = {}) {
       }
       c.set("authError", result.error);
       await next();
-      if (result.shouldReturn404 && c.res.status === 404) {
-        return;
-      }
-      return c.json({ error: "Unauthorized", message: result.error }, 401);
     } catch (error88) {
       console.error("[Auth] Unexpected error in authentication middleware:", error88);
       return c.json({ error: "Internal Server Error", message: "Authentication failed" }, 500);
     }
   };
 }
-var init_auth2 = __esm(() => {
+var sandboxAuth;
+var init_auth2 = __esm(async () => {
   init_drizzle_orm();
   init_tables_index();
   init_constants();
+  await init_providers();
+  sandboxAuth = createSandboxAuthProvider();
 });
 
 // src/server/app.ts
@@ -113075,11 +112999,11 @@ function createApp(db2, options) {
   }));
   return app;
 }
-var init_app = __esm(() => {
+var init_app = __esm(async () => {
   init_dist7();
   init_cors();
   init_logger2();
-  init_auth2();
+  await init_auth2();
 });
 
 // ../../node_modules/.bun/@electric-sql+pglite@0.3.16/node_modules/@electric-sql/pglite/dist/chunk-QY3QWFKW.js
@@ -169208,18 +169132,33 @@ var init_sessions = __esm(async () => {
 });
 
 // src/routes/platform/games/verify.ts
-var gameVerifyRouter;
+function toUserInfo(userData) {
+  return {
+    sub: userData.id,
+    email: userData.email || "",
+    name: userData.name || userData.username || "",
+    email_verified: true,
+    given_name: undefined,
+    family_name: undefined,
+    timeback_id: userData.timebackId || undefined
+  };
+}
+var gameVerifyRouter, sandboxAuth2;
 var init_verify = __esm(async () => {
   init_dist7();
   init_errors2();
   init_constants();
   init_error_handler();
-  await init_api3();
+  await __promiseAll([
+    init_api3(),
+    init_providers()
+  ]);
   gameVerifyRouter = new Hono2;
+  sandboxAuth2 = createSandboxAuthProvider();
   gameVerifyRouter.post("/verify", async (c2) => {
     const body2 = await c2.req.json().catch(() => ({}));
     const token = body2?.token;
-    if (!token) {
+    if (typeof token !== "string" || !token) {
       return c2.json({ error: "Missing token" }, 400);
     }
     const demoUser = DEMO_TOKENS[token];
@@ -169232,49 +169171,25 @@ var init_verify = __esm(async () => {
         return c2.json({ error: "User not found in sandbox" }, 500);
       }
       return c2.json({
-        claims: { sandbox: true },
+        claims: { sandbox: true, exp: Math.floor(Date.now() / 1000) + 15 * 60 },
         gameId: MOCK_GAME_ID,
-        user: {
-          sub: userData.id,
-          email: userData.email || "",
-          name: userData.name || userData.username || "",
-          email_verified: true,
-          given_name: undefined,
-          family_name: undefined,
-          timeback_id: userData.timebackId || undefined
-        }
+        user: toUserInfo(userData)
       });
     }
     if (token.endsWith(".sandbox")) {
+      const payload = await sandboxAuth2.validateGameToken(token);
+      if (!payload) {
+        return c2.json({ error: "Invalid or expired sandbox token" }, 400);
+      }
       try {
-        const parts2 = token.split(".");
-        if (parts2.length === 3) {
-          const payload = JSON.parse(atob(parts2[1]));
-          const userId = payload.uid;
-          const gameIdOrSlug = payload.sub;
-          const db2 = c2.get("db");
-          const userData = await db2.query.users.findFirst({
-            where: (users3, { eq: eq3 }) => eq3(users3.id, userId)
-          });
-          if (!userData) {
-            return c2.json({ error: "User not found in sandbox" }, 500);
-          }
-          return c2.json({
-            claims: payload,
-            gameId: gameIdOrSlug,
-            user: {
-              sub: userData.id,
-              email: userData.email || "",
-              name: userData.name || userData.username || "",
-              email_verified: true,
-              given_name: undefined,
-              family_name: undefined,
-              timeback_id: userData.timebackId || undefined
-            }
-          });
-        } else {
-          throw new Error("Malformed sandbox token: expected 3 parts");
+        const db2 = c2.get("db");
+        const userData = await db2.query.users.findFirst({
+          where: (users3, { eq: eq3 }) => eq3(users3.id, payload.uid)
+        });
+        if (!userData) {
+          return c2.json({ error: "User not found in sandbox" }, 500);
         }
+        return c2.json({ claims: payload, gameId: payload.sub, user: toUserInfo(userData) });
       } catch {
         return c2.json({ error: "Invalid sandbox token" }, 400);
       }
@@ -169782,13 +169697,13 @@ var init_server = __esm(async () => {
   init_port();
   init_package();
   init_config();
-  init_app();
   init_database2();
   init_options();
   await __promiseAll([
     init_api3(),
     init_context(),
-    init_providers()
+    init_providers(),
+    init_app()
   ]);
   version5 = package_default.version;
 });

package/dist/server.js

@@ -1127,7 +1127,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.9.0",
+    version: "0.9.1-beta.1",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -110748,10 +110748,10 @@ function createSandboxAuthProvider() {
     },
     async mintGameToken(gameId, userId) {
       const header = btoa(JSON.stringify({ alg: "none", typ: "sandbox" }));
-      const exp = Date.now() + 15 * 60 * 1000;
+      const exp = Math.floor(Date.now() / 1000) + 15 * 60;
       const payload = btoa(JSON.stringify({ sub: gameId, uid: userId, exp }));
       const token = `${header}.${payload}.sandbox`;
-      return { token, exp };
+      return { token, exp: exp * 1000 };
     },
     async validateGameToken(token) {
       try {
@@ -110759,18 +110759,9 @@ function createSandboxAuthProvider() {
         if (parts2.length !== 3) {
           return null;
         }
-        if (parts2[2] === "sandbox") {
-          const payload2 = JSON.parse(atob(parts2[1]));
-          if (payload2.sub && payload2.uid) {
-            if (payload2.exp && payload2.exp < Date.now()) {
-              log.debug("[SandboxAuthProvider] Token expired");
-              return null;
-            }
-            return payload2;
-          }
-        }
         const payload = JSON.parse(atob(parts2[1]));
-        if (payload.sub && payload.uid) {
+        const nowSeconds = Date.now() / 1000;
+        if (typeof payload?.sub === "string" && payload.sub.length > 0 && typeof payload.uid === "string" && payload.uid.length > 0 && typeof payload.exp === "number" && Number.isFinite(payload.exp) && payload.exp > nowSeconds && payload.exp < nowSeconds + MAX_TOKEN_LIFETIME_SECONDS) {
           return payload;
         }
         return null;
@@ -110868,7 +110859,7 @@ function createSandboxAuthProvider() {
     }
   };
 }
-var sandboxApiKeys, sandboxAssessmentPreparationReceipts, ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS, sandboxAssessmentTokens;
+var sandboxApiKeys, sandboxAssessmentPreparationReceipts, ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS, MAX_TOKEN_LIFETIME_SECONDS, sandboxAssessmentTokens;
 var init_auth_provider = __esm(async () => {
   init_src6();
   init_constants();
@@ -110876,6 +110867,7 @@ var init_auth_provider = __esm(async () => {
   sandboxApiKeys = new Map;
   sandboxAssessmentPreparationReceipts = new Map;
   ASSESSMENT_PREPARATION_RECEIPT_LIFETIME_MS = 5 * 60 * 1000;
+  MAX_TOKEN_LIFETIME_SECONDS = 30 * 24 * 60 * 60;
   sandboxAssessmentTokens = new TimebackCache({
     defaultTTL: 2 * 60 * 60 * 1000,
     maxSize: 1000
@@ -112903,56 +112895,13 @@ function extractBearerToken(authHeader) {
   }
   return authHeader.substring(7);
 }
-function parseSandboxToken(token) {
-  try {
-    const parts2 = token.split(".");
-    if (parts2.length !== 3 || parts2[2] !== "sandbox") {
-      return null;
-    }
-    const header = JSON.parse(atob(parts2[0]));
-    if (header.typ !== "sandbox") {
-      return null;
-    }
-    const payload = JSON.parse(atob(parts2[1]));
-    if (!payload.uid || !payload.sub) {
-      return null;
-    }
-    return {
-      userId: payload.uid,
-      gameSlug: payload.sub
-    };
-  } catch {
-    return null;
-  }
-}
-function parseJwtClaims(token) {
-  try {
-    const parts2 = token.split(".");
-    if (parts2.length === 3 && parts2[1]) {
-      const payload = JSON.parse(atob(parts2[1]));
-      if (payload.uid) {
-        return {
-          userId: payload.uid,
-          gameId: payload.sub
-        };
-      }
-    }
-  } catch {}
-  return null;
-}
-function resolveAuth(token) {
+async function resolveAuth(token) {
   const demoUser = DEMO_TOKENS[token];
   if (demoUser) {
     return { userId: demoUser.id };
   }
-  if (token.includes(".")) {
-    const sandboxClaims = parseSandboxToken(token);
-    if (sandboxClaims) {
-      return sandboxClaims;
-    }
-    return parseJwtClaims(token);
-  }
-  return null;
+  const payload = await sandboxAuth.validateGameToken(token);
+  return payload ? { userId: payload.uid, gameId: payload.sub } : null;
 }
 async function fetchUserFromDatabase(db2, userId) {
   try {
@@ -112965,18 +112914,6 @@ async function fetchUserFromDatabase(db2, userId) {
     throw error88;
   }
 }
-async function resolveGameIdFromSlug(db2, slug2) {
-  try {
-    const game2 = await db2.query.games.findFirst({
-      where: eq(games.slug, slug2),
-      columns: { id: true }
-    });
-    return game2?.id || null;
-  } catch (error88) {
-    console.error("[Auth] Error looking up game by slug:", error88);
-    return null;
-  }
-}
 function isPublicRoute(path, exceptions) {
   return exceptions.some((exception) => {
     if (path === exception) {
@@ -112994,35 +112931,23 @@ async function authenticateRequest(c) {
   const apiKey = c.req.header("x-api-key");
   const token = bearerToken || apiKey;
   if (!token) {
-    return {
-      success: false,
-      error: "No authorization token provided",
-      shouldReturn404: true
-    };
+    return { success: false, error: "No authorization token provided" };
   }
-  const resolved = resolveAuth(token);
+  const resolved = await resolveAuth(token);
   if (!resolved) {
-    return {
-      success: false,
-      error: "Invalid or expired token",
-      shouldReturn404: true
-    };
+    return { success: false, error: "Invalid or expired token" };
   }
   const claims = resolved;
   const db2 = c.get("db");
   if (!db2) {
     console.error("[Auth] Database not available in context");
-    return { success: false, error: "Internal server error", shouldReturn404: false };
+    return { success: false, error: "Internal server error" };
   }
   const user = await fetchUserFromDatabase(db2, claims.userId);
   if (!user) {
-    return { success: false, error: "User not found or token invalid", shouldReturn404: true };
+    return { success: false, error: "User not found or token invalid" };
   }
-  let gameId = claims.gameId;
-  if (!gameId && claims.gameSlug) {
-    gameId = await resolveGameIdFromSlug(db2, claims.gameSlug) ?? undefined;
-  }
-  return { success: true, user, gameId };
+  return { success: true, user, gameId: claims.gameId };
 }
 function setupAuth(options = {}) {
   const { exceptions = [] } = options;
@@ -113042,20 +112967,19 @@ function setupAuth(options = {}) {
       }
       c.set("authError", result.error);
       await next();
-      if (result.shouldReturn404 && c.res.status === 404) {
-        return;
-      }
-      return c.json({ error: "Unauthorized", message: result.error }, 401);
     } catch (error88) {
       console.error("[Auth] Unexpected error in authentication middleware:", error88);
       return c.json({ error: "Internal Server Error", message: "Authentication failed" }, 500);
     }
   };
 }
-var init_auth2 = __esm(() => {
+var sandboxAuth;
+var init_auth2 = __esm(async () => {
   init_drizzle_orm();
   init_tables_index();
   init_constants();
+  await init_providers();
+  sandboxAuth = createSandboxAuthProvider();
 });
 
 // src/server/app.ts
@@ -113074,11 +112998,11 @@ function createApp(db2, options) {
   }));
   return app;
 }
-var init_app = __esm(() => {
+var init_app = __esm(async () => {
   init_dist7();
   init_cors();
   init_logger2();
-  init_auth2();
+  await init_auth2();
 });
 
 // ../../node_modules/.bun/@electric-sql+pglite@0.3.16/node_modules/@electric-sql/pglite/dist/chunk-QY3QWFKW.js
@@ -169207,18 +169131,33 @@ var init_sessions = __esm(async () => {
 });
 
 // src/routes/platform/games/verify.ts
-var gameVerifyRouter;
+function toUserInfo(userData) {
+  return {
+    sub: userData.id,
+    email: userData.email || "",
+    name: userData.name || userData.username || "",
+    email_verified: true,
+    given_name: undefined,
+    family_name: undefined,
+    timeback_id: userData.timebackId || undefined
+  };
+}
+var gameVerifyRouter, sandboxAuth2;
 var init_verify = __esm(async () => {
   init_dist7();
   init_errors2();
   init_constants();
   init_error_handler();
-  await init_api3();
+  await __promiseAll([
+    init_api3(),
+    init_providers()
+  ]);
   gameVerifyRouter = new Hono2;
+  sandboxAuth2 = createSandboxAuthProvider();
   gameVerifyRouter.post("/verify", async (c2) => {
     const body2 = await c2.req.json().catch(() => ({}));
     const token = body2?.token;
-    if (!token) {
+    if (typeof token !== "string" || !token) {
       return c2.json({ error: "Missing token" }, 400);
     }
     const demoUser = DEMO_TOKENS[token];
@@ -169231,49 +169170,25 @@ var init_verify = __esm(async () => {
         return c2.json({ error: "User not found in sandbox" }, 500);
       }
       return c2.json({
-        claims: { sandbox: true },
+        claims: { sandbox: true, exp: Math.floor(Date.now() / 1000) + 15 * 60 },
         gameId: MOCK_GAME_ID,
-        user: {
-          sub: userData.id,
-          email: userData.email || "",
-          name: userData.name || userData.username || "",
-          email_verified: true,
-          given_name: undefined,
-          family_name: undefined,
-          timeback_id: userData.timebackId || undefined
-        }
+        user: toUserInfo(userData)
       });
     }
     if (token.endsWith(".sandbox")) {
+      const payload = await sandboxAuth2.validateGameToken(token);
+      if (!payload) {
+        return c2.json({ error: "Invalid or expired sandbox token" }, 400);
+      }
       try {
-        const parts2 = token.split(".");
-        if (parts2.length === 3) {
-          const payload = JSON.parse(atob(parts2[1]));
-          const userId = payload.uid;
-          const gameIdOrSlug = payload.sub;
-          const db2 = c2.get("db");
-          const userData = await db2.query.users.findFirst({
-            where: (users3, { eq: eq3 }) => eq3(users3.id, userId)
-          });
-          if (!userData) {
-            return c2.json({ error: "User not found in sandbox" }, 500);
-          }
-          return c2.json({
-            claims: payload,
-            gameId: gameIdOrSlug,
-            user: {
-              sub: userData.id,
-              email: userData.email || "",
-              name: userData.name || userData.username || "",
-              email_verified: true,
-              given_name: undefined,
-              family_name: undefined,
-              timeback_id: userData.timebackId || undefined
-            }
-          });
-        } else {
-          throw new Error("Malformed sandbox token: expected 3 parts");
+        const db2 = c2.get("db");
+        const userData = await db2.query.users.findFirst({
+          where: (users3, { eq: eq3 }) => eq3(users3.id, payload.uid)
+        });
+        if (!userData) {
+          return c2.json({ error: "User not found in sandbox" }, 500);
         }
+        return c2.json({ claims: payload, gameId: payload.sub, user: toUserInfo(userData) });
       } catch {
         return c2.json({ error: "Invalid sandbox token" }, 400);
       }
@@ -169781,13 +169696,13 @@ var init_server = __esm(async () => {
   init_port();
   init_package();
   init_config();
-  init_app();
   init_database2();
   init_options();
   await __promiseAll([
     init_api3(),
     init_context(),
-    init_providers()
+    init_providers(),
+    init_app()
   ]);
   version5 = package_default.version;
 });

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@playcademy/sandbox",
-    "version": "0.9.0",
+    "version": "0.9.1-beta.1",
     "description": "Local development server for Playcademy game development",
     "type": "module",
     "exports": {