From 3dae506a6cb29e4a62bce583987da558d6d3ae3d Mon Sep 17 00:00:00 2001
From: Z User <z@container>
Date: Thu, 29 Oct 2026 01:06:50 +0000
Subject: [PATCH] fix: use base64url (not base64) for session token
 verification in middleware
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The login route encodes the payload with base64url but the middleware was
decoding with base64 — mismatch caused session verification to always fail,
making protected APIs return 401 even after successful login.
---
 src/middleware.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/middleware.ts b/src/middleware.ts
index ba34fe2..fc79437 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -47,10 +47,11 @@ async function verifySession(token: string | undefined): Promise<boolean> {
   const adminPassword = process.env.ADMIN_PASSWORD
   if (!adminPassword) return false
   try {
-    // Session token format: base64(payload).hmac
+    // Session token format: base64url(payload).hmac
     const [payloadB64, signature] = token.split('.')
     if (!payloadB64 || !signature) return false
-    const payload = JSON.parse(Buffer.from(payloadB64, 'base64').toString())
+    // Use base64url to match the encoding in the login route
+    const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString())
     if (payload.exp && Date.now() > payload.exp) return false
     // Verify HMAC
     const crypto = await import('crypto')