the universal sandbox runtime for agents and humans.
pocketenv.io
sandbox
openclaw
agent
claude-code
vercel-sandbox
deno-sandbox
cloudflare-sandbox
atproto
sprites
daytona
1import type { AuthOutput } from "@atproto/xrpc-server";
2import type express from "express";
3import jwt from "jsonwebtoken";
4import { env } from "./env";
5import validateTurnstile from "./turnstile";
6
7type ReqCtx = {
8 req: express.Request;
9};
10
11export default async function authVerifier(ctx: ReqCtx): Promise<AuthOutput> {
12 const challenge = ctx.req.headers["x-challenge"]?.toString();
13 let artifacts = false;
14
15 if (challenge) {
16 const ip: string =
17 ctx.req.headers["cf-connecting-ip"]?.toString() ||
18 ctx.req.headers["x-forwarded-for"]?.toString() ||
19 "unknown";
20 const validation = await validateTurnstile(challenge, ip);
21 artifacts = (validation as { success: boolean }).success;
22 }
23
24 if (!ctx.req.headers.authorization) {
25 return {
26 artifacts,
27 };
28 }
29
30 const bearer = (ctx.req.headers.authorization || "").split(" ")[1]?.trim();
31
32 if (bearer && bearer !== "null") {
33 const credentials = jwt.verify(bearer, env.JWT_SECRET, {
34 ignoreExpiration: true,
35 });
36
37 return {
38 credentials,
39 artifacts,
40 };
41 }
42
43 return {
44 artifacts,
45 };
46}