concept

Login assertions

Server-side verification details for the short-lived assertion returned by U-net login flows.

@union-networks/server

Claims

The assertion is a signed JWS issued by trust-plane for one service, session, and scoped user. It expires quickly and should be exchanged for your own application session.

Validate signature.
Validate `serviceId`.
Validate expiry.
Store only `scopedUserId` as the U-net account handle.

tsVerify claims

import { verifyLoginAssertion } from '@union-networks/server';

export async function POST(request: Request) {
  const { assertionJws } = await request.json();

  const claims = verifyLoginAssertion(assertionJws, {
    secret: process.env.UNET_WEB_LOGIN_ASSERTION_SECRET!,
    serviceId: 'example-shop',
  });

  // Store claims.scopedUserId as the account id for your service.
  await createSession({ scopedUserId: claims.scopedUserId });
  return Response.json({ ok: true });
}