utils: one storage-grant contract (claims, decode, HS256 mint/verify) - #483
Merged
Conversation
The Transloadit Storage grant (the short-lived JWT Companion's S3 provider accepts) currently exists as four hand-rolled copies: minting in api2 and in the Console's grant route, verification in Companion, and unverified decoding in @uppy/s3. This module is the single wire contract: browser-safe claim types + parsing + unverified decode at the root, deterministic HS256 minting and verification under /node. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One source of truth for the Transloadit Storage grant JWT that today exists as four hand-rolled copies (api2
StorageGrantManager, Companion'sparseGrantClaims, @uppy/s3'sdecodeGrant, and the Console's grant route).StorageGrantClaims/StorageGrantScopetypes,parseStorageGrantClaims(strict shape validation, scope dedupe),decodeStorageGrant(unverified JWT payload decode, UTF-8 safe),normalizeStorageGrantPrefix(Companion's leading-slash strip + trailing-slash)./node:signStorageGrant(deterministic HS256, byte-compatible with api2'sStorageGrantManager) andverifyStorageGrant(timing-safe signature check, HS256-only header, strict claims, expiry).Once published, api2 #8844, uppy #6506 (Companion + @uppy/s3) and content #5810 consume this instead of their local copies (≈ −40…−70 lines across the repos, and the contract cannot drift).
🤖 Generated with Claude Code