chore: JWT unification (jose everywhere) + logout cache clear

dashboard/app/api/v1/events/route.ts

@@ -12,7 +12,7 @@ import { apiError } from "@/server/api-error";
 export const GET = withCors(async (req) => {
   let user;
   try {
-    user = requireUser(req);
+    user = await requireUser(req);
   } catch (err) {
     if (err instanceof UnauthorizedError) {
       return apiError("UNAUTHORIZED", err.message, 401);
@@ -33,7 +33,7 @@ export const GET = withCors(async (req) => {
 export const POST = withCors(async (req) => {
   let user;
   try {
-    user = requireUser(req);
+    user = await requireUser(req);
   } catch (err) {
     if (err instanceof UnauthorizedError) {
       return apiError("UNAUTHORIZED", err.message, 401);

dashboard/app/api/v1/events/stats/route.ts

@@ -8,7 +8,7 @@ import { apiError } from "@/server/api-error";
 export const GET = withCors(async (req) => {
   let user;
   try {
-    user = requireUser(req);
+    user = await requireUser(req);
   } catch (err) {
     if (err instanceof UnauthorizedError) {
       return apiError("UNAUTHORIZED", err.message, 401);

dashboard/app/api/v1/music/stats/route.ts

@@ -22,7 +22,7 @@ export const GET = withCors(async (req: NextRequest) => {
     if (cookie) {
       userId = cookie.id;
     } else {
-      userId = requireUser(req).id;
+      userId = (await requireUser(req)).id;
     }
   } catch (err) {
     if (err instanceof UnauthorizedError) {

dashboard/app/api/v1/reports/generate/route.ts

@@ -16,7 +16,7 @@ import { apiError } from "@/server/api-error";
 export const POST = withCors(async (req) => {
   let user;
   try {
-    user = requireUser(req);
+    user = await requireUser(req);
   } catch (err) {
     if (err instanceof UnauthorizedError) {
       return apiError("UNAUTHORIZED", err.message, 401);

dashboard/app/api/v1/sessions/[id]/route.ts

@@ -13,7 +13,7 @@ export function PATCH(req: NextRequest, ctx: RouteContext): Promise<NextResponse
   return withCors(async (r) => {
     let user;
     try {
-      user = requireUser(r);
+      user = await requireUser(r);
     } catch (err) {
       if (err instanceof UnauthorizedError) {
         return apiError("UNAUTHORIZED", err.message, 401);

dashboard/app/api/v1/sessions/route.ts

@@ -7,7 +7,7 @@ import { apiError } from "@/server/api-error";
 export const POST = withCors(async (req) => {
   let user;
   try {
-    user = requireUser(req);
+    user = await requireUser(req);
   } catch (err) {
     if (err instanceof UnauthorizedError) {
       return apiError("UNAUTHORIZED", err.message, 401);

dashboard/app/api/v1/sessions/top/route.ts

@@ -7,7 +7,7 @@ import { apiError } from "@/server/api-error";
 export const GET = withCors(async (req) => {
   let user;
   try {
-    user = requireUser(req);
+    user = await requireUser(req);
   } catch (err) {
     if (err instanceof UnauthorizedError) {
       return apiError("UNAUTHORIZED", err.message, 401);

dashboard/app/api/v1/tracks/[id]/route.ts

@@ -13,7 +13,7 @@ export function PATCH(req: NextRequest, ctx: RouteContext): Promise<NextResponse
   return withCors(async (r) => {
     let user;
     try {
-      user = requireUser(r);
+      user = await requireUser(r);
     } catch (err) {
       if (err instanceof UnauthorizedError) {
         return apiError("UNAUTHORIZED", err.message, 401);

dashboard/app/api/v1/tracks/route.ts

@@ -8,7 +8,7 @@ import { apiError } from "@/server/api-error";
 export const POST = withCors(async (req) => {
   let user;
   try {
-    user = requireUser(req);
+    user = await requireUser(req);
   } catch (err) {
     if (err instanceof UnauthorizedError) {
       return apiError("UNAUTHORIZED", err.message, 401);

dashboard/app/api/v1/user/settings/route.ts

@@ -8,7 +8,7 @@ import { apiError } from "@/server/api-error";
 export const GET = withCors(async (req) => {
   let user;
   try {
-    user = requireUser(req);
+    user = await requireUser(req);
   } catch (err) {
     if (err instanceof UnauthorizedError) {
       return apiError("UNAUTHORIZED", err.message, 401);
@@ -22,7 +22,7 @@ export const GET = withCors(async (req) => {
 export const PUT = withCors(async (req) => {
   let user;
   try {
-    user = requireUser(req);
+    user = await requireUser(req);
   } catch (err) {
     if (err instanceof UnauthorizedError) {
       return apiError("UNAUTHORIZED", err.message, 401);

dashboard/app/dashboard/logout-button.tsx

@@ -2,9 +2,11 @@
 
 import { useState } from "react";
 import { useRouter } from "next/navigation";
+import { useQueryClient } from "@tanstack/react-query";
 
 export function LogoutButton() {
-  const router = useRouter();
+  const router      = useRouter();
+  const queryClient = useQueryClient();
   const [pending, setPending] = useState(false);
 
   return (
@@ -16,6 +18,7 @@ export function LogoutButton() {
         try {
           await fetch("/api/auth/logout", { method: "POST" });
         } finally {
+          queryClient.clear();
           router.replace("/login");
           router.refresh();
         }

dashboard/package.json

@@ -17,7 +17,6 @@
     "framer-motion": "^12.38.0",
     "google-auth-library": "^10.6.2",
     "jose": "^6.2.3",
-    "jsonwebtoken": "^9.0.3",
     "next": "16.2.6",
     "pg": "^8.20.0",
     "prisma": "^7.8.0",
@@ -31,7 +30,6 @@
   "devDependencies": {
     "@tailwindcss/postcss": "^4",
     "@types/d3": "^7.4.3",
-    "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^20",
     "@types/pg": "^8.20.0",
     "@types/react": "^19",

dashboard/server/auth.ts

@@ -1,5 +1,5 @@
 import { OAuth2Client } from "google-auth-library";
-import jwt from "jsonwebtoken";
+import { SignJWT } from "jose";
 import { prisma } from "@/server/db";
 
 function requireEnv(name: string): string {
@@ -41,13 +41,14 @@ async function upsertUser(data: {
   });
 }
 
-function issueJWT(userId: string, email: string): string {
-  const expiresIn = (process.env.JWT_EXPIRES_IN ?? "7d") as jwt.SignOptions["expiresIn"];
-  return jwt.sign(
-    { sub: userId, email },
-    requireEnv("JWT_SECRET"),
-    { expiresIn },
-  );
+async function issueJWT(userId: string, email: string): Promise<string> {
+  const secret    = requireEnv("JWT_SECRET");
+  const expiresIn = process.env["JWT_EXPIRES_IN"] ?? "7d";
+  return new SignJWT({ sub: userId, email })
+    .setProtectedHeader({ alg: "HS256" })
+    .setIssuedAt()
+    .setExpirationTime(expiresIn)
+    .sign(new TextEncoder().encode(secret));
 }
 
 export async function authenticateGoogleUser(googleIdToken: string): Promise<string> {

dashboard/server/jwt.ts

@@ -1,5 +1,4 @@
 import type { NextRequest } from "next/server";
-import jwt from "jsonwebtoken";
 import { jwtVerify } from "jose";
 import { SESSION_COOKIE } from "@/server/cookies";
 
@@ -21,13 +20,16 @@ function isPayload(v: unknown): v is JwtPayload {
   return typeof r["sub"] === "string" && typeof r["email"] === "string";
 }
 
-export async function verifyJwt(token: string): Promise<JwtPayload> {
-  const secret = process.env.JWT_SECRET;
+function getSecretKey(): Uint8Array {
+  const secret = process.env["JWT_SECRET"];
   if (!secret) throw new Error("JWT_SECRET is not set");
+  return new TextEncoder().encode(secret);
+}
 
+export async function verifyJwt(token: string): Promise<JwtPayload> {
   let payload: unknown;
   try {
-    const result = await jwtVerify(token, new TextEncoder().encode(secret));
+    const result = await jwtVerify(token, getSecretKey());
     payload = result.payload;
   } catch {
     throw new UnauthorizedError("Invalid or expired token");
@@ -45,20 +47,9 @@ function extractToken(req: NextRequest): string | null {
   return req.cookies.get(SESSION_COOKIE)?.value ?? null;
 }
 
-export function requireUser(req: NextRequest): { id: string; email: string } {
+export async function requireUser(req: NextRequest): Promise<{ id: string; email: string }> {
   const token = extractToken(req);
   if (!token) throw new UnauthorizedError("Missing authentication credentials");
-
-  const secret = process.env.JWT_SECRET;
-  if (!secret) throw new Error("JWT_SECRET is not set");
-
-  let decoded: unknown;
-  try {
-    decoded = jwt.verify(token, secret);
-  } catch {
-    throw new UnauthorizedError("Invalid or expired token");
-  }
-  if (!isPayload(decoded)) throw new UnauthorizedError("Invalid token payload");
-
-  return { id: decoded.sub, email: decoded.email };
+  const payload = await verifyJwt(token);
+  return { id: payload.sub, email: payload.email };
 }