refactor: ponytail audit

This commit is contained in:
Amruth Pillai
2026-07-27 20:26:16 +02:00
parent bb1fb3a7d6
commit 9110e86997
157 changed files with 1082 additions and 2177 deletions
+10 -9
View File
@@ -28,16 +28,16 @@ import { getTrustedOrigins } from "./trusted-origins";
const authBaseUrl = env.APP_URL;
const isRateLimitEnabled = process.env.NODE_ENV === "production" && !env.FLAG_DISABLE_API_RATE_LIMIT;
function getOAuthAudiences(): string[] {
const base = authBaseUrl.replace(/\/$/, "");
const oauthAudienceBase = authBaseUrl.replace(/\/$/, "");
const OAUTH_AUDIENCES = [
oauthAudienceBase,
`${oauthAudienceBase}/`,
`${oauthAudienceBase}/mcp`,
`${oauthAudienceBase}/mcp/`,
];
return [base, `${base}/`, `${base}/mcp`, `${base}/mcp/`];
}
const OAUTH_AUDIENCES = getOAuthAudiences();
export async function verifyOAuthToken(token: string): Promise<JWTPayload> {
return await verifyAccessToken(token, {
export function verifyOAuthToken(token: string): Promise<JWTPayload> {
return verifyAccessToken(token, {
jwksUrl: `${authBaseUrl}/api/auth/jwks`,
verifyOptions: {
issuer: `${authBaseUrl}/api/auth`,
@@ -105,6 +105,7 @@ const getAuthConfig = () => {
},
hooks: {
// biome-ignore lint/suspicious/useAwait: Better Auth requires middleware callbacks to return a Promise.
before: createAuthMiddleware(async (ctx) => {
if (!ctx.path.includes("/oauth2/register")) return;