From db9d5cf5e40fdba25fcdc502763c014f6d43c1c6 Mon Sep 17 00:00:00 2001
From: Alex Holliday <ajhollid@gmail.com>
Date: Thu, 12 Mar 2026 11:25:32 -0700
Subject: [PATCH] verifyJWT types

---
 server/src/middleware/verifyJWT.ts | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/server/src/middleware/verifyJWT.ts b/server/src/middleware/verifyJWT.ts
index 6c2b0a229..4bec4c077 100644
--- a/server/src/middleware/verifyJWT.ts
+++ b/server/src/middleware/verifyJWT.ts
@@ -3,10 +3,15 @@ import { NextFunction, Request, Response } from "express";
 import jwt from "jsonwebtoken";
 import { AppError } from "@/utils/AppError.js";
 import { Settings } from "@/types/settings.js";
+import type { User } from "@/types/user.js";
 
 const SERVICE_NAME = "verifyJWT";
 const TOKEN_PREFIX = "Bearer ";
 
+const isUser = (payload: unknown): payload is User => {
+	return typeof payload === "object" && payload !== null && "id" in payload && "teamId" in payload && "role" in payload;
+};
+
 export const createVerifyJWT = (settingsService: { getSettings: () => Settings }) => {
 	return (req: Request, res: Response, next: NextFunction) => {
 		const token = req.headers["authorization"];
@@ -31,21 +36,22 @@ export const createVerifyJWT = (settingsService: { getSettings: () => Settings }
 			next(error);
 			return;
 		}
-		jwt.verify(parsedToken, jwtSecret, (err: any, decoded: any) => {
+		jwt.verify(parsedToken, jwtSecret, (err: jwt.VerifyErrors | null, decoded: jwt.JwtPayload | string | undefined) => {
 			if (err) {
 				const error = new AppError({
-					message: "Failed to authenticate token",
-					details: err,
+					message: err instanceof Error ? err.message : "Failed to authenticate token",
 					status: 401,
 					service: SERVICE_NAME,
+					details: err instanceof Error ? { error: err } : undefined,
 					method: "verifyJWT",
 				});
 				next(error);
 				return;
-			} else {
-				// Token is valid, carry on
+			} else if (isUser(decoded)) {
 				req.user = decoded;
 				next();
+			} else {
+				next(new AppError({ message: "Invalid token payload", status: 401, service: SERVICE_NAME, method: "verifyJWT" }));
 			}
 		});
 	};