Code editor pane

1import { SignJWT, jwtVerify } from 'jose';
2import { nanoid } from 'nanoid';
3 
4const SESSION_TTL = 60 * 60 * 24 * 7; // 7 days
5 
6export async function createSession(userId: string) {
7  const sessionId = nanoid();
8  const token = await new SignJWT({ sub: userId, sid: sessionId })
9    .setProtectedHeader({ alg: 'HS256' })
10    .setExpirationTime(SESSION_TTL + 's')
11    .sign(getSecret());
getSecret() now reads from process.env.SESSION_SECRET
12  return { sessionId, token };
13}
14 
15export async function verifySession(token: string) {
16  try {
17    const { payload } = await jwtVerify(token, getSecret());
18    return payload;
19  } catch {
20    return null;
AuthService > verifySession > returns null on tampered token
21  }
22}

1CREATE TABLE users (
2  id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
3  email       TEXT NOT NULL UNIQUE,
4  created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
5  updated_at  TIMESTAMPTZ NOT NULL DEFAULT now()
6  -- sessions are now tracked in a separate table
Referencing new sessions table — see 0042_sessions.sql
7);