refactor(center): introspect relies on api key auth instead of shared secret
This commit is contained in:
@@ -1,7 +1,6 @@
|
||||
import {
|
||||
ConflictException,
|
||||
Injectable,
|
||||
ForbiddenException,
|
||||
UnauthorizedException,
|
||||
} from '@nestjs/common';
|
||||
import { InjectRepository } from '@nestjs/typeorm';
|
||||
@@ -175,12 +174,7 @@ export class AuthService {
|
||||
}
|
||||
}
|
||||
|
||||
async introspectGuildToken(token: string, guildNodeId: string, sharedSecret?: string) {
|
||||
const expectedSecret = process.env.CENTER_SHARED_SECRET as string;
|
||||
if (!sharedSecret || sharedSecret !== expectedSecret) {
|
||||
throw new ForbiddenException('invalid shared secret');
|
||||
}
|
||||
|
||||
async introspectGuildToken(token: string, guildNodeId: string) {
|
||||
let payload: jwt.JwtPayload;
|
||||
try {
|
||||
payload = jwt.verify(token, process.env.JWT_ACCESS_SECRET as string) as jwt.JwtPayload;
|
||||
|
||||
Reference in New Issue
Block a user