[dev] Validating userId in payload

[rgbkrk]

I'm walking through the docs for LiveStore 0.4.0 before I do our migration and have some questions.

Taking the example

import { makeDurableObject } from '@livestore/sync-cf/cf-worker'

export class SyncBackendDO extends makeDurableObject({
  onPush: async (message, { storeId, payload }) => {
    console.log(`Push to store ${storeId}:`, message.batch)

    // Custom business logic
    if (payload?.userId) {
      await notifyUser(payload.userId, message.batch)
    }
  },
  onPull: async (message, { storeId }) => {
    console.log(`Pull from store ${storeId}`)
  },
  enabledTransports: new Set(['ws', 'http']), // Disable DO RPC
  otel: {
    baseUrl: 'https://otel.example.com',
    serviceName: 'livestore-sync',
  }
}) {}

Alongside the sync/auth

import { makeWorker } from '@livestore/sync-cf/cf-worker'

export default makeWorker({
  validatePayload: (payload, { storeId }) => {
    if (!payload?.authToken) {
      throw new Error('Missing auth token')
    }
    if (payload.authToken !== process.env.EXPECTED_TOKEN) {
      throw new Error('Invalid auth token')
    }
    console.log(`Validated connection for store: ${storeId}`)
  },
  enableCORS: true,
  durableObject: {
    name: 'SYNC_BACKEND_DO'
  }
})

How can I verify that userId in the onPush matches that from the (presumed) JWT in the authToken? Ideally I would know which user was pushing in this case so that I could validate that the message was allowed.

[schickling]

Thanks for the thoughtful question! You can already guarantee that the userId you trust inside onPush matches the identity encoded in the JWT that opened the connection, but it’s important to remember that the Durable Object sees the original payload the client sent—validatePayload can only accept or reject the handshake, it doesn’t rewrite the payload. The safe pattern is to validate during connection setup and then re-run the exact same JWT verification inside onPush (or look up cached claims on the server) before touching your business logic.

import { makeWorker, makeDurableObject } from '@livestore/sync-cf/cf-worker'
import { verifyJwt } from './jwt.ts' // wrap your preferred JWT library (jose, etc.)

type SyncPayload = { authToken?: string; userId?: string }

type Claims = { sub?: string }

const ensureAuthorized = (payload: unknown): Claims & { authToken: string } => {
  if (payload === undefined || payload === null || typeof payload !== 'object') {
    throw new Error('Missing auth payload')
  }

  const { authToken, userId } = payload as SyncPayload
  if (!authToken) {
    throw new Error('Missing auth token')
  }

  const claims: Claims = verifyJwt(authToken)
  if (!claims.sub) {
    throw new Error('Token missing subject claim')
  }

  if (userId !== undefined && userId !== claims.sub) {
    throw new Error('Payload userId mismatch')
  }

  return { ...claims, authToken }
}

export default makeWorker({
  syncBackendBinding: 'SYNC_BACKEND_DO',
  validatePayload: (payload) => {
    ensureAuthorized(payload)
  },
})

export class SyncBackendDO extends makeDurableObject({
  onPush: async (message, { payload }) => {
    const { sub: userId } = ensureAuthorized(payload)
    await ensureTenantAccess(userId!, message.batch)
  },
}) {}

Because the Durable Object always gets the original payload, it must repeat the JWT verification (or retrieve cached claims keyed by authToken/clientId) before trusting payload.userId. For HTTP transport, remember that the payload isn’t forwarded today, so include the authorization context inside your events if you need the same checks there.

Feel free to adapt the helper to cache verified claims, project additional attributes, or integrate stricter authorization checks as needed.