From 18940dd681cad7ecb037a667c3cc8f2e4e7f37ee Mon Sep 17 00:00:00 2001 From: Jonathan Barrow Date: Sat, 21 Jun 2025 17:49:50 -0400 Subject: [PATCH] feat: allow independent services to expire their own tokens --- src/database.ts | 7 +++++++ src/services/nasc/routes/ac.ts | 2 +- src/services/nnas/routes/provider.ts | 2 +- 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/src/database.ts b/src/database.ts index 77d93eb..bcb64af 100644 --- a/src/database.ts +++ b/src/database.ts @@ -5,6 +5,7 @@ import { nintendoPasswordHash, decryptToken, unpackToken } from '@/util'; import { PNID } from '@/models/pnid'; import { Server } from '@/models/server'; import { LOG_ERROR } from '@/logger'; +import { TokenType } from '@/types/common/token-types'; import { config } from '@/config-manager'; import type { HydratedPNIDDocument } from '@/types/mongoose/pnid'; import type { IDeviceAttribute } from '@/types/mongoose/device-attribute'; @@ -118,6 +119,12 @@ export async function getPNIDByTokenAuth(token: string, allowedTypes?: SystemTyp const pnid = await getPNIDByPID(unpackedToken.pid); + // TODO - This is a hack. If `allowedTypes` is not set, it is assumed to be a call from our internal API, + // and we ignore expiration checks on service tokens. Independent services should expire their own tokens + if (unpackedToken.token_type === TokenType.IndependentService && !allowedTypes) { + return pnid; + } + if (pnid) { const expireTime = Math.floor((Number(unpackedToken.expire_time) / 1000)); diff --git a/src/services/nasc/routes/ac.ts b/src/services/nasc/routes/ac.ts index 9797b48..191b249 100644 --- a/src/services/nasc/routes/ac.ts +++ b/src/services/nasc/routes/ac.ts @@ -96,7 +96,7 @@ async function processServiceTokenRequest(server: HydratedServerDocument, pid: n pid: pid, access_level: 0, title_id: BigInt(parseInt(titleID, 16)), - expire_time: BigInt(Date.now() + (3600 * 1000)) + expire_time: BigInt(Date.now()) // TODO - Hack. Independent services expire their own tokens, so we give them the ISSUED time, not an EXPIRE time }; // TODO - Handle null tokens diff --git a/src/services/nnas/routes/provider.ts b/src/services/nnas/routes/provider.ts index 16adbf8..133acbf 100644 --- a/src/services/nnas/routes/provider.ts +++ b/src/services/nnas/routes/provider.ts @@ -96,7 +96,7 @@ router.get('/service_token/@me', async (request: express.Request, response: expr pid: pnid.pid, access_level: pnid.access_level, title_id: BigInt(parseInt(titleID, 16)), - expire_time: BigInt(Date.now() + (3600 * 1000)) + expire_time: BigInt(Date.now()) // TODO - Hack. Independent services expire their own tokens, so we give them the ISSUED time, not an EXPIRE time }; const serviceTokenBuffer = await generateToken(server.aes_key, tokenOptions);