PDS - inspect bearer tokens (#2688)

* inspect bearer tokens to determine if theyre access tokens or service auth tokens * changeset
bluesky-social · Aug 5, 2024 · 269cbc8 · 269cbc8
1 parent b0a5fa3
commit 269cbc8
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 4 deletions.
diff --git a/.changeset/curvy-jeans-dream.md b/.changeset/curvy-jeans-dream.md
@@ -0,0 +1,5 @@
+---
+"@atproto/pds": patch
+---
+
+Inspect bearer auth token on uploadBlob
diff --git a/packages/pds/src/auth-verifier.ts b/packages/pds/src/auth-verifier.ts
@@ -249,11 +249,14 @@ export class AuthVerifier {
   accessOrUserServiceAuth =
     (opts: Partial<AccessOpts> = {}) =>
     async (ctx: ReqCtx): Promise<UserServiceAuthOutput | AccessOutput> => {
-      try {
-        return await this.accessStandard(opts)(ctx)
-      } catch {
-        return await this.userServiceAuth(ctx)
+      const token = bearerTokenFromReq(ctx.req)
+      if (token) {
+        const payload = jose.decodeJwt(token)
+        if (payload['lxm']) {
+          return this.userServiceAuth(ctx)
+        }
       }
+      return this.accessStandard(opts)(ctx)
     }
 
   modService = async (ctx: ReqCtx): Promise<ModServiceOutput> => {