Verified Actions

import { createServer } from 'node:http';
import { SignJWT, jwtVerify } from 'jose';

// Your shared secret (vas_...), shown once at registration. The STRING is the
// key material — its UTF-8 bytes go straight into jose.
const SECRET = new TextEncoder().encode(process.env.SCOPLI_SECRET);
const CLIENT_ID = 'your-client-id';

createServer(async (req, res) => {
  const url = new URL(req.url, 'http://localhost');
  if (url.pathname !== '/scopli-verify') return res.end();

  // 1. Verify the request token. Pin HS256; require our iss and your aud.
  const { payload } = await jwtVerify(url.searchParams.get('token'), SECRET, {
    issuer: 'scoplidrop.com',
    audience: CLIENT_ID,
    algorithms: ['HS256'],
  });

  // 2. Authenticate YOUR user (your session) and check the action.
  //    payload.sub is only a correlation handle — never look it up as identity.
  const user = await getLoggedInUser(req);       // your auth
  if (!user) return redirectToLogin(res, url);   // keep the token, resume after
  const didIt = await userCompletedAction(user, payload.action);

  // 3. Sign the yes/no and redirect back to ScopliDrop's callback.
  const response = await new SignJWT({ req: payload.jti, result: didIt, puid: user.id })
    .setProtectedHeader({ alg: 'HS256' })
    .setIssuer(CLIENT_ID)
    .setAudience('scoplidrop.com')
    .setSubject(payload.sub)          // echo the sub back unchanged
    .setIssuedAt()
    .setExpirationTime('5m')
    .sign(SECRET);

  res.writeHead(302, {
    Location: 'https://www.scoplidrop.com/api/verify/external/callback?response=' + response,
  });
  res.end();
}).listen(4102);

import { SignJWT, jwtVerify, createRemoteJWKSet, importPKCS8 } from 'jose';

// Public-key mode: verify our request tokens against our published Ed25519 keys.
const scopliJwks = createRemoteJWKSet(
  new URL('https://www.scoplidrop.com/.well-known/jwks.json'),
);
const { payload } = await jwtVerify(token, scopliJwks, {
  issuer: 'scoplidrop.com',
  audience: CLIENT_ID,
  algorithms: ['EdDSA'],
});

// Sign your response with YOUR Ed25519 private key (register the public half
// as a PEM or a JWKS URL when you create the app).
const privateKey = await importPKCS8(process.env.MY_ED25519_PRIVATE_PEM, 'EdDSA');
const response = await new SignJWT({ req: payload.jti, result: didIt })
  .setProtectedHeader({ alg: 'EdDSA' })
  .setIssuer(CLIENT_ID)
  .setAudience('scoplidrop.com')
  .setSubject(payload.sub)
  .setIssuedAt()
  .setExpirationTime('5m')
  .sign(privateKey);