From dda57860cb6c76b5838c33ebf05e42c08f6b6994 Mon Sep 17 00:00:00 2001
From: Hongbo Wu <hongbo@omnivore.app>
Date: Wed, 7 Jun 2023 13:08:21 +0800
Subject: [PATCH] use jsonwebtoken verify instead of decode for older version
 of the lib

---
 packages/thumbnail-handler/src/index.ts | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/packages/thumbnail-handler/src/index.ts b/packages/thumbnail-handler/src/index.ts
index 41e6ab640..da49bc8e4 100644
--- a/packages/thumbnail-handler/src/index.ts
+++ b/packages/thumbnail-handler/src/index.ts
@@ -228,14 +228,24 @@ export const findThumbnail = async (
 
 export const thumbnailHandler = Sentry.GCPFunction.wrapHttpFunction(
   async (req, res) => {
+    if (!process.env.JWT_SECRET) {
+      console.error('JWT_SECRET not exists')
+      return res.status(500).send('JWT_SECRET_NOT_EXISTS')
+    }
+
     const token = req.headers?.authorization
     if (!token) {
       console.debug('no token')
       return res.status(401).send('UNAUTHORIZED')
     }
-    const { uid } = jwt.decode(token) as { uid: string }
-    if (!uid) {
-      console.debug('no uid')
+    let uid = ''
+    try {
+      const decoded = jwt.verify(token, process.env.JWT_SECRET) as {
+        uid: string
+      }
+      uid = decoded.uid
+    } catch (e) {
+      console.debug('invalid token')
       return res.status(401).send('UNAUTHORIZED')
     }