@psctickets/common 1.0.38 → 1.0.39
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -18,10 +18,37 @@ const verifyTokenMiddleware = (req, _res, next) => __awaiter(void 0, void 0, voi
|
|
|
18
18
|
var _a;
|
|
19
19
|
let user;
|
|
20
20
|
try {
|
|
21
|
-
|
|
22
|
-
|
|
21
|
+
// Check if this is an internal service-to-service call
|
|
22
|
+
const internalApiKey = req.headers["x-internal-api-key"];
|
|
23
|
+
if (internalApiKey) {
|
|
24
|
+
// Verify internal API key
|
|
25
|
+
const expectedApiKey = process.env.INTERNAL_API_KEY;
|
|
26
|
+
if (!expectedApiKey || internalApiKey !== expectedApiKey) {
|
|
27
|
+
throw new UnAuthorizedRequest_1.UnauthorizedRequest("Invalid internal API key");
|
|
28
|
+
}
|
|
29
|
+
// Get JWT token from header (Authorization header or x-jwt-token)
|
|
30
|
+
const authHeader = req.headers.authorization;
|
|
31
|
+
const signInToken = (authHeader && authHeader.startsWith("Bearer ")
|
|
32
|
+
? authHeader.substring(7)
|
|
33
|
+
: authHeader) || req.headers["x-jwt-token"];
|
|
34
|
+
if (!signInToken) {
|
|
35
|
+
throw new UnAuthorizedRequest_1.UnauthorizedRequest("JWT token not provided in header");
|
|
36
|
+
}
|
|
37
|
+
user = jsonwebtoken_1.default.verify(signInToken, process.env.JWT_KEY);
|
|
38
|
+
}
|
|
39
|
+
else {
|
|
40
|
+
// Normal cookie-based authentication
|
|
41
|
+
const signInToken = (_a = req.session) === null || _a === void 0 ? void 0 : _a.jwt;
|
|
42
|
+
if (!signInToken) {
|
|
43
|
+
throw new UnAuthorizedRequest_1.UnauthorizedRequest("JWT token not found in session");
|
|
44
|
+
}
|
|
45
|
+
user = jsonwebtoken_1.default.verify(signInToken, process.env.JWT_KEY);
|
|
46
|
+
}
|
|
23
47
|
}
|
|
24
48
|
catch (error) {
|
|
49
|
+
if (error instanceof UnAuthorizedRequest_1.UnauthorizedRequest) {
|
|
50
|
+
throw error;
|
|
51
|
+
}
|
|
25
52
|
throw new UnAuthorizedRequest_1.UnauthorizedRequest("Invalid token");
|
|
26
53
|
}
|
|
27
54
|
req.currentUser = user;
|