feat: auth flow 👀

Author: guidefari

.vscode/settings.json

@@ -0,0 +1,7 @@
+{
+  "editor.formatOnSave": true,
+  "editor.codeActionsOnSave": {
+    "source.fixAll.biome": "explicit",
+    "source.organizeImports.biome": "explicit"
+  }
+}

bun.lock

@@ -3,6 +3,7 @@
 import { domain } from "./dns";
 import { email } from "./email";
 import { allSecrets } from "./secret";
+import { www } from "./www";
 
 export const vpc = new sst.aws.Vpc("gbfm_network");
 
@@ -52,7 +53,7 @@ export const service = new sst.aws.Service("gbfm_vps", {
 		target: "release",
 		dockerfile: "vps/Dockerfile",
 	},
-link: [database, email, ...allSecrets],
+link: [database, email, www, ...allSecrets],
 });
 
 export const vps_gateway = new sst.aws.ApiGatewayV2("gbfm_vps_gateway", {

infra/vps.ts

@@ -5,4 +5,6 @@ node_modules/
 .bun/
 
 # env
-.env
+*.env*
+
+**.DS_Store

vps/.gitignore

@@ -0,0 +1,59 @@
+import type { Context, Next } from 'hono'
+import { verify } from 'hono/jwt'
+import { env } from '@/env'
+import { getAuthorByEmailOrId } from '@/db/author.repo'
+
+/**
+ * Authenticates a user by verifying the JWT token in the Authorization header.
+ * 
+ * @example
+ * ```ts
+import { authenticate } from './middleware/auth'
+
+// Apply to specific routes
+auth.get('/protected-route', authenticate, async (c) => {
+  const user = c.get('user')
+  return c.json({ message: 'Protected data', user })
+})
+
+// Or apply to all routes in a group
+const protectedRoutes = new Hono()
+protectedRoutes.use('*', authenticate)
+
+protectedRoutes.get('/profile', async (c) => {
+  const user = c.get('user')
+  return c.json({ user })
+})
+ */
+export const authenticate = async (c: Context, next: Next) => {
+  const authHeader = c.req.header('Authorization')
+  
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    return c.json({ error: 'Authorization header required' }, 401)
+  }
+
+  const token = authHeader.substring(7)
+
+  try {
+    const payload = await verify(token, env.ACCESS_TOKEN_SECRET)
+    
+    if (payload.type !== 'access') {
+      return c.json({ error: 'Invalid token type' }, 401)
+    }
+
+    const authorId = payload.sub
+    if (!authorId || typeof authorId !== 'string') {
+      return c.json({ error: 'Invalid token payload' }, 401)
+    }
+
+    const author = await getAuthorByEmailOrId({ authorId })
+    if (author.length === 0) {
+      return c.json({ error: 'User not found' }, 404)
+    }
+
+    c.set('user', author[0])
+    await next()
+  } catch (error) {
+    return c.json({ error: 'Invalid or expired token' }, 401)
+  }
+}