feat: add jwt verification

server/src/api/routes/index.js

@@ -1,9 +1,23 @@
 import { Router } from 'express'
+import passport from 'passport'
+import { Strategy as JwtStrategy, ExtractJwt } from 'passport-jwt'
 import sessions from './sessions.js'
 import quests from './quests.js'
 import commands from './commands.js'
-import { authMiddleware } from '../../middleware/auth.js'
 import authRouter from './auth.js'
+import config from '../../config.js'
+
+const jwtOptions = {
+  jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+  secretOrKey: config.jwtSecret,
+  issuer: 'linuxodyssey.xyz',
+}
+
+passport.use(
+  new JwtStrategy(jwtOptions, function verifyJwt(jwtPayload, done) {
+    return done(null, jwtPayload)
+  })
+)
 
 const router = Router()
 
@@ -12,7 +26,11 @@ router.get('/', (req, res) => {
 })
 
 router.use(authRouter)
-router.use('/sessions', authMiddleware, sessions)
+router.use(
+  '/sessions',
+  passport.authenticate('jwt', { session: false }),
+  sessions
+)
 router.use('/quests', quests)
 router.use('/commands', commands)
 

server/src/utils/auth.js

@@ -32,7 +32,7 @@ export function genUserJWT(user) {
     jwt.sign(
       { _id: user.id, username: user.username, email: user.email },
       config.jwtSecret,
-      { expiresIn: config.expiry },
+      { expiresIn: config.expiry, issuer: 'linuxodyssey.xyz' },
       (err, token) => {
         if (err) {
           reject(err)