Remove uneeded session ID from auth token

src/app.ts

@@ -53,8 +53,6 @@ interface AppEnv extends HonoEnv {
     pubkey?: string;
     /** Hex secret key for the current user. Optional, but easiest way to use legacy Mastodon apps. */
     seckey?: string;
-    /** UUID from the access token. Used for WebSocket event signing. */
-    session?: string;
     /** NIP-98 signed event proving the pubkey is owned by the user. */
     proof?: Event<27235>;
   };

src/controllers/api/oauth.ts

@@ -137,19 +137,12 @@ const oauthAuthorizeController: AppController = async (c) => {
   // Parsed FormData values.
   const { pubkey, nip19: nip19id, redirect_uri: redirectUri } = result.data;
 
-  /**
-   * Normally the auth token is just an npub, which is public information.
-   * The sessionId helps us know that Request "B" and Request "A" came from the same person.
-   * Useful for sending websocket events to the correct client.
-   */
-  const sessionId: string = uuid62.v4();
-
   if (pubkey) {
     const encoded = nip19.npubEncode(pubkey!);
-    const url = addCodeToRedirectUri(redirectUri, `${encoded}_${sessionId}`);
+    const url = addCodeToRedirectUri(redirectUri, encoded);
     return c.redirect(url);
   } else if (nip19id) {
-    const url = addCodeToRedirectUri(redirectUri, `${nip19id}_${sessionId}`);
+    const url = addCodeToRedirectUri(redirectUri, nip19id);
     return c.redirect(url);
   }
 

src/controllers/api/streaming.ts

@@ -1,7 +1,6 @@
-import { AppController } from '@/app.ts';
+import { type AppController } from '@/app.ts';
-import { z } from '@/deps.ts';
+import { nip19, z } from '@/deps.ts';
 import { type DittoFilter } from '@/filter.ts';
-import { TOKEN_REGEX } from '@/middleware/auth19.ts';
 import { Sub } from '@/subs.ts';
 import { toStatus } from '@/transformers/nostr-to-mastoapi.ts';
 
@@ -39,7 +38,7 @@ const streamingController: AppController = (c) => {
     return c.json({ error: 'Missing access token' }, 401);
   }
 
-  const match = token.match(new RegExp(`^${TOKEN_REGEX.source}$`));
+  const match = token.match(new RegExp(`^${nip19.BECH32_REGEX.source}$`));
   if (!match) {
     return c.json({ error: 'Invalid access token' }, 401);
   }

src/middleware/auth19.ts

@@ -1,10 +1,8 @@
 import { type AppMiddleware } from '@/app.ts';
 import { getPublicKey, HTTPException, nip19 } from '@/deps.ts';
 
-/** The token includes a Bech32 Nostr ID (npub, nsec, etc) and an optional session ID. */
-const TOKEN_REGEX = new RegExp(`(${nip19.BECH32_REGEX.source})(?:_(\\w+))?`);
 /** We only accept "Bearer" type. */
-const BEARER_REGEX = new RegExp(`^Bearer (${TOKEN_REGEX.source})$`);
+const BEARER_REGEX = new RegExp(`^Bearer (${nip19.BECH32_REGEX.source})$`);
 
 /** NIP-19 auth middleware. */
 const auth19: AppMiddleware = async (c, next) => {
@@ -12,8 +10,7 @@ const auth19: AppMiddleware = async (c, next) => {
   const match = authHeader?.match(BEARER_REGEX);
 
   if (match) {
-    const [_, _token, bech32, session] = match;
+    const [_, bech32] = match;
-    c.set('session', session);
 
     try {
       const decoded = nip19.decode(bech32!);
@@ -47,4 +44,4 @@ const requireAuth: AppMiddleware = async (c, next) => {
   await next();
 };
 
-export { auth19, requireAuth, TOKEN_REGEX };
+export { auth19, requireAuth };