Scrabble JWT Authentication Guide

Famous.ai implements a server-side proxy to handle token verification and pearl operations without exposing JWT_SECRET:

// Famous.ai Platform API Proxy (Deno Edge Function)
export const corsHeaders = {
  'Access-Control-Allow-Origin': '*',
  'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type'
};

const PLATFORM_API_URL = 'https://app.base44.com/api/run/.../gameAPISupabase';
const VERIFY_TOKEN_URL = 'https://app.base44.com/api/run/.../verifyGameToken';

Deno.serve(async (req) => {
  if (req.method === 'OPTIONS') {
    return new Response('ok', { headers: corsHeaders });
  }

  const body = await req.json();
  const { action, token } = body;

  // Health check (no token required)
  if (action === 'health_check' || action === 'ping') {
    return new Response(JSON.stringify({ status: 'ok' }), {
      status: 200,
      headers: { 'Content-Type': 'application/json', ...corsHeaders }
    });
  }

  // Token refresh (v4.4.0) - prevents redirect loops
  if (action === 'refresh_token') {
    const { email, user_id } = body;
    
    // Re-validate token with SnappyIdioms.com
    const verifyResponse = await fetch(VERIFY_TOKEN_URL, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}` },
      body: JSON.stringify({ token })
    });
    
    const verifyData = await verifyResponse.json();
    
    if (verifyResponse.ok && verifyData) {
      // Extend session by 24 hours
      const newExpiresAt = Date.now() + (24 * 60 * 60 * 1000);
      return new Response(JSON.stringify({
        success: true,
        refreshed: true,
        user_id: verifyData.user_id || user_id,
        email: verifyData.email || email,
        expires_at: newExpiresAt,
        message: 'Session refreshed successfully'
      }), { status: 200, headers: { 'Content-Type': 'application/json', ...corsHeaders } });
    }
    
    // Token expired - try identity-based refresh
    if (email || user_id) {
      const refreshResponse = await fetch(PLATFORM_API_URL, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({
          action: 'refresh_session',
          email: email,
          user_id: user_id
        })
      });
      
      const refreshData = await refreshResponse.json();
      
      if (refreshResponse.ok && refreshData?.success) {
        return new Response(JSON.stringify({
          success: true,
          refreshed: true,
          user_id: refreshData.user_id,
          new_token: refreshData.token,
          expires_at: Date.now() + (24 * 60 * 60 * 1000)
        }), { status: 200, headers: { 'Content-Type': 'application/json', ...corsHeaders } });
      }
    }
    
    return new Response(JSON.stringify({
      success: false,
      error: 'Token refresh failed'
    }), { status: 401, headers: { 'Content-Type': 'application/json', ...corsHeaders } });
  }

  // Token verification (delegates to SnappyIdioms.com)
  if (action === 'validate_token' || action === 'verify_token') {
    const verifyResponse = await fetch(VERIFY_TOKEN_URL, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}` },
      body: JSON.stringify({ token })
    });
    
    const verifyData = await verifyResponse.json();
    
    return new Response(JSON.stringify({
      valid: verifyResponse.ok,
      ...verifyData
    }), {
      status: verifyResponse.ok ? 200 : 401,
      headers: { 'Content-Type': 'application/json', ...corsHeaders }
    });
  }

  // Pearl operations (proxy to game API)
  if (action === 'award_pearls') {
    const platformResponse = await fetch(PLATFORM_API_URL, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}` },
      body: JSON.stringify(body)
    });
    
    const responseData = await platformResponse.json();
    
    return new Response(JSON.stringify(responseData), {
      status: platformResponse.status,
      headers: { 'Content-Type': 'application/json', ...corsHeaders }
    });
  }
});