refactored/cleaned up authentication

app/authenticator.rb

···
 require 'openssl'
 
 class Authenticator
+  class InvalidTokenError < StandardError
+  end
+
   def initialize(hostname:)
     @@pkey_cache ||= {}
     @hostname = hostname
···
     return nil unless auth_header.start_with?('Bearer ')
 
     token = auth_header.gsub(/\ABearer /, '')
-    data = JSON.parse(Base64.decode64(token.split('.')[1]))
+    parts = token.split('.')
+    raise InvalidTokenError, "Invalid JWT token" if parts.length != 3
+
+    begin
+      decoded_data = Base64.decode64(parts[1])
+      data = JSON.parse(decoded_data)
+    rescue StandardError => e
+      raise InvalidTokenError, "Invalid JWT token"
+    end
+
     did = data['iss']
-    return nil if data['aud'] != "did:web:#{@hostname}" || data['lxm'] != endpoint
+    return nil if did.nil? || data['aud'] != "did:web:#{@hostname}" || data['lxm'] != endpoint
 
     pkey = pkey_for_user(did)
 

app/server.rb

···
       content_type :json
       [status, JSON.generate({ error: name, message: message })]
     end
+
+    def get_user_did
+      if settings.development?
+        if did = params[:user]
+          return did
+        else
+          halt json_error('AuthMissing', 'Missing "user" parameter', status: 401)
+        end
+      else
+        auth_header = env['HTTP_AUTHORIZATION']
+        if auth_header.to_s.strip.empty?
+          halt json_error('AuthMissing', 'Missing authentication header', status: 401)
+        end
+
+        begin
+          did = @authenticator.decode_user_from_jwt(auth_header, 'blue.feeds.lycan.searchPosts')
+        rescue StandardError => e
+          halt json_error('InvalidToken', e.message, status: 401)
+        end
+
+        if did
+          return did
+        else
+          halt json_error('InvalidToken', "Invalid JWT token", status: 401)
+        end
+      end
+    end
+
+    def load_user
+      did = get_user_did
+
+      if user = User.find_by(did: did)
+        return user
+      else
+        halt json_error('AccountNotFound', 'Account not found', status: 401)
+      end
+    end
   end
 
   before do
···
   get '/xrpc/blue.feeds.lycan.searchPosts' do
     headers['access-control-allow-origin'] = '*'
 
-    if settings.development?
-      user = User.find_by(did: params[:user])
-      return json_error('UserNotFound', 'Missing "user" parameter') if user.nil?
-    else
-      begin
-        auth_header = env['HTTP_AUTHORIZATION']
-        did = @authenticator.decode_user_from_jwt(auth_header, 'blue.feeds.lycan.searchPosts')
-      rescue StandardError => e
-        p e
-      end
-
-      user = did && User.find_by(did: did)
-      return json_error('UserNotFound', 'Missing authentication header') if user.nil?
-    end
+    @user = load_user
 
     if params[:query].to_s.strip.empty?
       return json_error('MissingParameter', 'Missing "query" parameter')
···
     query = QueryParser.new(params[:query])
 
     collection = case params[:collection]
-    when 'likes'   then user.likes
-    when 'pins'    then user.pins
-    when 'quotes'  then user.quotes
-    when 'reposts' then user.reposts
+    when 'likes'   then @user.likes
+    when 'pins'    then @user.pins
+    when 'quotes'  then @user.quotes
+    when 'reposts' then @user.reposts
     else return json_error('InvalidParameter', 'Invalid search collection')
     end
 
···
 
     post_uris = case params[:collection]
     when 'quotes'
-      items.map { |x| "at://#{user.did}/app.bsky.feed.post/#{x.rkey}" }
+      items.map { |x| "at://#{@user.did}/app.bsky.feed.post/#{x.rkey}" }
     else
       items.map(&:post).map(&:at_uri)
     end