@syncular/server-hono 0.0.6-125 → 0.0.6-135

package/dist/console/routes.js

@@ -21,6 +21,7 @@ import { cors } from 'hono/cors';
 import { describeRoute, resolver, validator as zValidator } from 'hono-openapi';
 import { sql } from 'kysely';
 import { z } from 'zod';
+import { closeUnauthenticatedSocket, parseBearerToken, parseWebSocketAuthToken, } from './live-auth.js';
 import { ApiKeyTypeSchema, ConsoleApiKeyBulkRevokeRequestSchema, ConsoleApiKeyBulkRevokeResponseSchema, ConsoleApiKeyCreateRequestSchema, ConsoleApiKeyCreateResponseSchema, ConsoleApiKeyRevokeResponseSchema, ConsoleApiKeySchema, ConsoleBlobDeleteResponseSchema, ConsoleBlobListQuerySchema, ConsoleBlobListResponseSchema, ConsoleClearEventsResultSchema, ConsoleClientSchema, ConsoleCommitDetailSchema, ConsoleCommitListItemSchema, ConsoleCompactResultSchema, ConsoleEvictResultSchema, ConsoleHandlerSchema, ConsoleOperationEventSchema, ConsoleOperationsQuerySchema, ConsolePaginatedResponseSchema, ConsolePaginationQuerySchema, ConsolePartitionedPaginationQuerySchema, ConsolePartitionQuerySchema, ConsolePruneEventsResultSchema, ConsolePrunePreviewSchema, ConsolePruneResultSchema, ConsoleRequestEventSchema, ConsoleRequestPayloadSchema, ConsoleTimelineItemSchema, ConsoleTimelineQuerySchema, LatencyQuerySchema, LatencyStatsResponseSchema, SyncStatsSchema, TimeseriesQuerySchema, TimeseriesStatsResponseSchema, } from './schemas.js';
 /**
  * Create a simple console event emitter for broadcasting live events.
@@ -345,14 +346,20 @@ export function createConsoleRoutes(options) {
         }
         await next();
     });
-    // Auth middleware
-    const requireAuth = async (c) => {
+    // Route auth middleware. Keep /events/live exempt to preserve websocket
+    // message-based auth handshake fallback when no Authorization header is sent.
+    routes.use('*', async (c, next) => {
+        if (c.req.method === 'OPTIONS' || c.req.path.endsWith('/events/live')) {
+            await next();
+            return;
+        }
         const auth = await options.authenticate(c);
         if (!auth) {
-            return null;
+            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         }
-        return auth;
-    };
+        c.set('consoleAuth', auth);
+        await next();
+    });
     const requestEventSelectColumns = [
         'event_id',
         'partition_id',
@@ -641,16 +648,13 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('query', ConsolePartitionQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { partitionId } = c.req.valid('query');
         const stats = await readSyncStats(options.db, {
             partitionId,
         });
         logSyncEvent({
             event: 'console.stats',
-            consoleUserId: auth.consoleUserId,
+            consoleUserId: c.var.consoleAuth.consoleUserId,
         });
         return c.json(stats, 200);
     });
@@ -677,9 +681,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('query', TimeseriesQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { interval, range, partitionId } = c.req.valid('query');
         const rangeMs = rangeToMs(range);
         const startTime = new Date(Date.now() - rangeMs);
@@ -838,9 +839,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('query', LatencyQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { range, partitionId } = c.req.valid('query');
         const rangeMs = rangeToMs(range);
         const startTime = new Date(Date.now() - rangeMs);
@@ -929,9 +927,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('query', ConsoleTimelineQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { limit, offset, view, partitionId, eventType, actorId, clientId, requestId, traceId, table, outcome, search, from, to, } = c.req.valid('query');
         const items = [];
         const normalizedSearchTerm = search?.trim().toLowerCase() || null;
@@ -1106,9 +1101,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('query', ConsolePartitionedPaginationQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { limit, offset, partitionId } = c.req.valid('query');
         let query = db
             .selectFrom('sync_commits')
@@ -1188,9 +1180,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('param', commitSeqParamSchema), zValidator('query', commitDetailQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { seq } = c.req.valid('param');
         const { partitionId } = c.req.valid('query');
         let commitQuery = db
@@ -1289,9 +1278,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('query', ConsolePartitionedPaginationQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { limit, offset, partitionId } = c.req.valid('query');
         let clientsQuery = db
             .selectFrom('sync_client_cursors')
@@ -1417,9 +1403,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const items = options.handlers.map((handler) => ({
             table: handler.table,
             dependsOn: handler.dependsOn,
@@ -1450,9 +1433,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('query', ConsoleOperationsQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { limit, offset, operationType, partitionId } = c.req.valid('query');
         let query = db
             .selectFrom('sync_operation_events')
@@ -1508,9 +1488,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const watermarkCommitSeq = await computePruneWatermarkCommitSeq(options.db, options.prune);
         // Count commits that would be deleted
         const countRow = await db
@@ -1546,9 +1523,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const watermarkCommitSeq = await computePruneWatermarkCommitSeq(options.db, options.prune);
         const deletedCommits = await pruneSync(options.db, {
             watermarkCommitSeq,
@@ -1556,13 +1530,13 @@ export function createConsoleRoutes(options) {
         });
         logSyncEvent({
             event: 'console.prune',
-            consoleUserId: auth.consoleUserId,
+            consoleUserId: c.var.consoleAuth.consoleUserId,
             deletedCommits,
             watermarkCommitSeq,
         });
         await recordOperationEvent({
             operationType: 'prune',
-            consoleUserId: auth.consoleUserId,
+            consoleUserId: c.var.consoleAuth.consoleUserId,
             requestPayload: {
                 watermarkCommitSeq,
                 keepNewestCommits: options.prune?.keepNewestCommits ?? null,
@@ -1595,9 +1569,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const fullHistoryHours = options.compact?.fullHistoryHours ?? 24 * 7;
         const deletedChanges = await compactChanges(options.db, {
             dialect: options.dialect,
@@ -1605,13 +1576,13 @@ export function createConsoleRoutes(options) {
         });
         logSyncEvent({
             event: 'console.compact',
-            consoleUserId: auth.consoleUserId,
+            consoleUserId: c.var.consoleAuth.consoleUserId,
             deletedChanges,
             fullHistoryHours,
         });
         await recordOperationEvent({
             operationType: 'compact',
-            consoleUserId: auth.consoleUserId,
+            consoleUserId: c.var.consoleAuth.consoleUserId,
             requestPayload: { fullHistoryHours },
             resultPayload: { deletedChanges },
         });
@@ -1658,9 +1629,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('json', NotifyDataChangeRequestSchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const body = c.req.valid('json');
         const result = await notifyExternalDataChange({
             db: options.db,
@@ -1670,14 +1638,14 @@ export function createConsoleRoutes(options) {
         });
         logSyncEvent({
             event: 'console.notify_data_change',
-            consoleUserId: auth.consoleUserId,
+            consoleUserId: c.var.consoleAuth.consoleUserId,
             tables: body.tables,
             commitSeq: result.commitSeq,
             deletedChunks: result.deletedChunks,
         });
         await recordOperationEvent({
             operationType: 'notify_data_change',
-            consoleUserId: auth.consoleUserId,
+            consoleUserId: c.var.consoleAuth.consoleUserId,
             partitionId: body.partitionId ?? null,
             requestPayload: {
                 tables: body.tables,
@@ -1718,9 +1686,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('param', clientIdParamSchema), zValidator('query', evictClientQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { id: clientId } = c.req.valid('param');
         const { partitionId } = c.req.valid('query');
         let deleteQuery = db
@@ -1733,13 +1698,13 @@ export function createConsoleRoutes(options) {
         const evicted = Number(res?.numDeletedRows ?? 0) > 0;
         logSyncEvent({
             event: 'console.evict_client',
-            consoleUserId: auth.consoleUserId,
+            consoleUserId: c.var.consoleAuth.consoleUserId,
             clientId,
             evicted,
         });
         await recordOperationEvent({
             operationType: 'evict_client',
-            consoleUserId: auth.consoleUserId,
+            consoleUserId: c.var.consoleAuth.consoleUserId,
             partitionId: partitionId ?? null,
             targetClientId: clientId,
             requestPayload: { clientId, partitionId: partitionId ?? null },
@@ -1771,9 +1736,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('query', eventsQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { limit, offset, partitionId, eventType, actorId, clientId, requestId, traceId, outcome, } = c.req.valid('query');
         let query = db
             .selectFrom('sync_request_events')
@@ -1839,15 +1801,6 @@ export function createConsoleRoutes(options) {
         const upgradeWebSocket = options.websocket.upgradeWebSocket;
         const heartbeatIntervalMs = options.websocket.heartbeatIntervalMs ?? 30000;
         const wsState = new WeakMap();
-        const closeUnauthenticated = (ws) => {
-            try {
-                ws.send(JSON.stringify({ type: 'error', message: 'UNAUTHENTICATED' }));
-            }
-            catch {
-                // ignore send errors
-            }
-            ws.close(4001, 'Unauthenticated');
-        };
         const cleanup = (ws) => {
             const state = wsState.get(ws);
             if (!state)
@@ -1900,6 +1853,7 @@ export function createConsoleRoutes(options) {
                         heartbeatInterval: null,
                         authTimeout: null,
                         isAuthenticated: false,
+                        startAuthenticatedSession: null,
                     };
                     wsState.set(ws, state);
                     const startAuthenticatedSession = () => {
@@ -1958,6 +1912,7 @@ export function createConsoleRoutes(options) {
                         }, heartbeatIntervalMs);
                         state.heartbeatInterval = heartbeatInterval;
                     };
+                    state.startAuthenticatedSession = startAuthenticatedSession;
                     if (initialAuth) {
                         startAuthenticatedSession();
                         return;
@@ -1967,7 +1922,7 @@ export function createConsoleRoutes(options) {
                         if (!current || current.isAuthenticated) {
                             return;
                         }
-                        closeUnauthenticated(ws);
+                        closeUnauthenticatedSocket(ws);
                         cleanup(ws);
                     }, 5_000);
                 },
@@ -1977,24 +1932,13 @@ export function createConsoleRoutes(options) {
                         return;
                     }
                     if (typeof event.data !== 'string') {
-                        closeUnauthenticated(ws);
+                        closeUnauthenticatedSocket(ws);
                         cleanup(ws);
                         return;
                     }
-                    let token = '';
-                    try {
-                        const parsed = JSON.parse(event.data);
-                        if (parsed.type === 'auth' &&
-                            typeof parsed.token === 'string' &&
-                            parsed.token.trim().length > 0) {
-                            token = parsed.token;
-                        }
-                    }
-                    catch {
-                        // Ignore parse errors and close as unauthenticated below.
-                    }
+                    const token = parseWebSocketAuthToken(event.data);
                     if (!token) {
-                        closeUnauthenticated(ws);
+                        closeUnauthenticatedSocket(ws);
                         cleanup(ws);
                         return;
                     }
@@ -2004,62 +1948,11 @@ export function createConsoleRoutes(options) {
                         return;
                     }
                     if (!auth) {
-                        closeUnauthenticated(ws);
+                        closeUnauthenticatedSocket(ws);
                         cleanup(ws);
                         return;
                     }
-                    currentState.isAuthenticated = true;
-                    if (currentState.authTimeout) {
-                        clearTimeout(currentState.authTimeout);
-                        currentState.authTimeout = null;
-                    }
-                    const listener = (liveEvent) => {
-                        if (partitionId) {
-                            const eventPartitionId = liveEvent.data.partitionId;
-                            if (typeof eventPartitionId !== 'string' ||
-                                eventPartitionId !== partitionId) {
-                                return;
-                            }
-                        }
-                        try {
-                            ws.send(JSON.stringify(liveEvent));
-                        }
-                        catch {
-                            // Connection closed
-                        }
-                    };
-                    emitter.addListener(listener);
-                    currentState.listener = listener;
-                    ws.send(JSON.stringify({
-                        type: 'connected',
-                        timestamp: new Date().toISOString(),
-                    }));
-                    const replayEvents = emitter.replay({
-                        since: replaySince,
-                        limit: replayLimit,
-                        partitionId,
-                    });
-                    for (const replayEvent of replayEvents) {
-                        try {
-                            ws.send(JSON.stringify(replayEvent));
-                        }
-                        catch {
-                            // Connection closed
-                            break;
-                        }
-                    }
-                    const heartbeatInterval = setInterval(() => {
-                        try {
-                            ws.send(JSON.stringify({
-                                type: 'heartbeat',
-                                timestamp: new Date().toISOString(),
-                            }));
-                        }
-                        catch {
-                            clearInterval(heartbeatInterval);
-                        }
-                    }, heartbeatIntervalMs);
-                    currentState.heartbeatInterval = heartbeatInterval;
+                    currentState.startAuthenticatedSession?.();
                 },
                 onClose(_event, ws) {
                     cleanup(ws);
@@ -2105,9 +1998,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('param', eventIdParamSchema), zValidator('query', eventDetailQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { id: eventId } = c.req.valid('param');
         const { partitionId } = c.req.valid('query');
         let eventQuery = db
@@ -2158,9 +2048,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('param', eventIdParamSchema), zValidator('query', eventDetailQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { id: eventId } = c.req.valid('param');
         const { partitionId } = c.req.valid('query');
         let eventQuery = db
@@ -2225,15 +2112,12 @@ export function createConsoleRoutes(options) {
             },
         },
     }), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const res = await db.deleteFrom('sync_request_events').executeTakeFirst();
         const deletedCount = Number(res?.numDeletedRows ?? 0);
         const payloadDeletedCount = await deleteUnreferencedPayloadSnapshots();
         logSyncEvent({
             event: 'console.clear_events',
-            consoleUserId: auth.consoleUserId,
+            consoleUserId: c.var.consoleAuth.consoleUserId,
             deletedCount,
             payloadDeletedCount,
         });
@@ -2263,14 +2147,11 @@ export function createConsoleRoutes(options) {
             },
         },
     }), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const pruneResult = await runEventsPrune();
         const deletedCount = pruneResult.totalDeleted;
         logSyncEvent({
             event: 'console.prune_events',
-            consoleUserId: auth.consoleUserId,
+            consoleUserId: c.var.consoleAuth.consoleUserId,
             deletedCount,
             requestEventsDeleted: pruneResult.requestEventsDeleted,
             operationEventsDeleted: pruneResult.operationEventsDeleted,
@@ -2302,9 +2183,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('query', apiKeysQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { limit, offset, type: keyType, status, expiresWithinDays, } = c.req.valid('query');
         let query = db
             .selectFrom('sync_api_keys')
@@ -2411,9 +2289,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('json', ConsoleApiKeyCreateRequestSchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const body = c.req.valid('json');
         // Generate key components
         const keyId = generateKeyId();
@@ -2446,7 +2321,7 @@ export function createConsoleRoutes(options) {
             .execute();
         logSyncEvent({
             event: 'console.create_api_key',
-            consoleUserId: auth.consoleUserId,
+            consoleUserId: c.var.consoleAuth.consoleUserId,
             keyId,
             keyType: body.keyType,
         });
@@ -2495,9 +2370,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('param', apiKeyIdParamSchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { id: keyId } = c.req.valid('param');
         const row = await db
             .selectFrom('sync_api_keys')
@@ -2555,9 +2427,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('param', apiKeyIdParamSchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { id: keyId } = c.req.valid('param');
         const now = new Date().toISOString();
         const res = await db
@@ -2569,7 +2438,7 @@ export function createConsoleRoutes(options) {
         const revoked = Number(res?.numUpdatedRows ?? 0) > 0;
         logSyncEvent({
             event: 'console.revoke_api_key',
-            consoleUserId: auth.consoleUserId,
+            consoleUserId: c.var.consoleAuth.consoleUserId,
             keyId,
             revoked,
         });
@@ -2604,9 +2473,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('json', ConsoleApiKeyBulkRevokeRequestSchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const body = c.req.valid('json');
         const keyIds = [...new Set(body.keyIds.map((keyId) => keyId.trim()))]
             .filter((keyId) => keyId.length > 0)
@@ -2657,7 +2523,7 @@ export function createConsoleRoutes(options) {
         };
         logSyncEvent({
             event: 'console.bulk_revoke_api_keys',
-            consoleUserId: auth.consoleUserId,
+            consoleUserId: c.var.consoleAuth.consoleUserId,
             requestedCount: response.requestedCount,
             revokedCount: response.revokedCount,
             alreadyRevokedCount: response.alreadyRevokedCount,
@@ -2694,9 +2560,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('param', apiKeyIdParamSchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { id: keyId } = c.req.valid('param');
         const now = new Date().toISOString();
         const existingRow = await db
@@ -2739,7 +2602,7 @@ export function createConsoleRoutes(options) {
             .execute();
         logSyncEvent({
             event: 'console.stage_rotate_api_key',
-            consoleUserId: auth.consoleUserId,
+            consoleUserId: c.var.consoleAuth.consoleUserId,
             oldKeyId: keyId,
             newKeyId,
         });
@@ -2790,9 +2653,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('param', apiKeyIdParamSchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         const { id: keyId } = c.req.valid('param');
         const now = new Date().toISOString();
         // Get existing key
@@ -2843,7 +2703,7 @@ export function createConsoleRoutes(options) {
             .execute();
         logSyncEvent({
             event: 'console.rotate_api_key',
-            consoleUserId: auth.consoleUserId,
+            consoleUserId: c.var.consoleAuth.consoleUserId,
             oldKeyId: keyId,
             newKeyId,
         });
@@ -2889,9 +2749,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), zValidator('query', ConsoleBlobListQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         if (!bucket) {
             return c.json({ error: 'BLOB_STORAGE_NOT_CONFIGURED' }, 501);
         }
@@ -2933,9 +2790,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         if (!bucket) {
             return c.json({ error: 'BLOB_STORAGE_NOT_CONFIGURED' }, 501);
         }
@@ -2974,9 +2828,6 @@ export function createConsoleRoutes(options) {
             },
         },
     }), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
         if (!bucket) {
             return c.json({ error: 'BLOB_STORAGE_NOT_CONFIGURED' }, 501);
         }
@@ -3016,12 +2867,9 @@ export function createTokenAuthenticator(token) {
     return async (c) => {
         if (!expectedToken)
             return null;
-        const authHeader = c.req.header('Authorization')?.trim();
-        if (authHeader?.startsWith('Bearer ')) {
-            const bearerToken = authHeader.slice(7).trim();
-            if (bearerToken === expectedToken) {
-                return { consoleUserId: 'token' };
-            }
+        const bearerToken = parseBearerToken(c.req.header('Authorization'));
+        if (bearerToken === expectedToken) {
+            return { consoleUserId: 'token' };
         }
         return null;
     };