amber-backend/pb_hooks/whoami.pb.js

/// <reference path="../pb_data/types.d.ts" />

// Token introspection for amber-api (the facts service).
//
// GET /api/amber/whoami   (auth: users)  → { id }
//
// WHY THIS EXISTS: amber-api has to know whether an inbound request carries a
// valid Amber user token before it will spend an ffprobe on a caller-supplied
// URL. PocketBase auth tokens are stateless JWTs signed with a per-user secret
// that only PocketBase holds, so **offline verification is impossible by
// design** — a third-party service cannot check one itself. The only correct
// check is to present the token here and see whether PocketBase accepts it,
// which `$apis.requireAuth("users")` does before this handler ever runs.
//
// So the handler body is deliberately trivial: reaching it *is* the answer. It
// returns the one fact amber-api needs and nothing else — no email, no username,
// no profile list. A token-introspection endpoint is a tempting place to leak
// account data, and amber-api has no business knowing any of it.
//
// It used to return `nsfwEnabled` too, on the reasoning that a future amber-api
// surface might scope results by it. No such surface was ever built, adult
// content is not something Amber serves, and an account flag nobody reads is
// exactly the kind of thing this endpoint should not be handing out.
//
// amber-api caches positives for ~10 minutes and negatives for ~30 seconds, so
// this route sees roughly one request per device per 10 minutes — cheap enough
// to sit in front of every probe lookup.
//
// NOTE: PocketBase runs each routerAdd handler in its own isolated JSVM, so
// anything a handler needs must be declared INSIDE it — file-scope helpers throw
// ReferenceError at request time. Nothing is hoisted here; keep it that way.
routerAdd("GET", "/api/amber/whoami", (e) => {
  return e.json(200, { id: e.auth.id })
}, $apis.requireAuth("users"))