Halit Aksoy
30ad51c493
- New auth module verifies Keycloak access tokens offline against the realm's signing keys (issuer, RS256, typ=Bearer, allowed azp); guests are recognised by the guest realm role - Clients send an auth message after connecting and get on_auth or on_auth_error; unauthenticated sockets are closed after 5 seconds and their messages ignored; a socket can refresh its token but not switch user - A user can be connected from several sockets; a late close of an old socket no longer drops the new one - Malformed messages are ignored instead of throwing - Games store player names and guest flags and send them with the connection info - Legacy ?userKey= clients and /register stay available behind LEGACY_USERKEY_AUTH; legacy keys must be UUIDs so they cannot take a Keycloak user's kc: id - TypeScript target raised to es2020 for async/await
14 lines
349 B
TypeScript
14 lines
349 B
TypeScript
import { AuthUser } from "./AuthUser";
|
|
|
|
export class InvalidTokenError extends Error {
|
|
constructor(message: string) {
|
|
super(message);
|
|
this.name = "InvalidTokenError";
|
|
}
|
|
}
|
|
|
|
export interface TokenVerifier {
|
|
// Resolves to the token's user, or rejects with InvalidTokenError.
|
|
verify(token: string): Promise<AuthUser>;
|
|
}
|