Skip to content

utils: one storage-grant contract (claims, decode, HS256 mint/verify) - #483

Merged
kvz merged 2 commits into
mainfrom
storage-grant-codec
Aug 31, 2026
Merged

utils: one storage-grant contract (claims, decode, HS256 mint/verify)#483
kvz merged 2 commits into
mainfrom
storage-grant-codec

Conversation

@kvz

@kvzkvz commented Aug 31, 2026

Copy link
Copy Markdown
Member

One source of truth for the Transloadit Storage grant JWT that today exists as four hand-rolled copies (api2 StorageGrantManager, Companion's parseGrantClaims, @uppy/s3's decodeGrant, and the Console's grant route).

  • Root (browser-safe): StorageGrantClaims/StorageGrantScope types, parseStorageGrantClaims (strict shape validation, scope dedupe), decodeStorageGrant (unverified JWT payload decode, UTF-8 safe), normalizeStorageGrantPrefix (Companion's leading-slash strip + trailing-slash).
  • /node: signStorageGrant (deterministic HS256, byte-compatible with api2's StorageGrantManager) and verifyStorageGrant (timing-safe signature check, HS256-only header, strict claims, expiry).
  • Vectors: fixed-input golden token, mint→verify roundtrip, tamper/expiry/shape rejections, unicode prefixes, base64url padding, scope dedupe.

Once published, api2 #8844, uppy #6506 (Companion + @uppy/s3) and content #5810 consume this instead of their local copies (≈ −40…−70 lines across the repos, and the contract cannot drift).

🤖 Generated with Claude Code

@kvz@claude
utils: one storage-grant contract (claims, decode, HS256 mint/verify)
79dde7f
The Transloadit Storage grant (the short-lived JWT Companion's S3
provider accepts) currently exists as four hand-rolled copies: minting
in api2 and in the Console's grant route, verification in Companion,
and unverified decoding in @uppy/s3. This module is the single wire
contract: browser-safe claim types + parsing + unverified decode at the
root, deterministic HS256 minting and verification under /node.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@kvzkvz mentioned this pull request Aug 31, 2026
Open
@kvz
kvz merged commit 69e55d4 into mainAug 31, 2026
@kvz
kvz deleted the storage-grant-codec branch August 31, 2026 17:09
@kvzkvz mentioned this pull request Aug 31, 2026
Merged
kvz added a commit that referenced this pull request Aug 31, 2026
@kvz
Add the missed changeset for the storage-grant codec (#483) (#484)
0c329bb
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kvz
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
utils: one storage-grant contract (claims, decode, HS256 mint/verify) by kvz · Pull Request #483 · transloadit/node-sdk · GitHub
Skip to content
utils: one storage-grant contract (claims, decode, HS256 mint/verify) - #483
Merged
kvz merged 2 commits into
mainfrom 
storage-grant-codec
Aug 31, 2026
Merged
utils: one storage-grant contract (claims, decode, HS256 mint/verify)#483
kvz merged 2 commits into
mainfrom 
storage-grant-codec
Conversation
@kvz
@kvzkvz
commented
Aug 31, 2026

Copy link


Copy Markdown

Member
One source of truth for the Transloadit Storage grant JWT that today exists as four hand-rolled copies (api2 StorageGrantManager, Companion's parseGrantClaims, @uppy/s3's decodeGrant, and the Console's grant route).
  • Root (browser-safe): StorageGrantClaims/StorageGrantScope types, parseStorageGrantClaims (strict shape validation, scope dedupe), decodeStorageGrant (unverified JWT payload decode, UTF-8 safe), normalizeStorageGrantPrefix (Companion's leading-slash strip + trailing-slash).
  • /node: signStorageGrant (deterministic HS256, byte-compatible with api2's StorageGrantManager) and verifyStorageGrant (timing-safe signature check, HS256-only header, strict claims, expiry).
  • Vectors: fixed-input golden token, mint→verify roundtrip, tamper/expiry/shape rejections, unicode prefixes, base64url padding, scope dedupe.
Once published, api2 #8844, uppy #6506 (Companion + @uppy/s3) and content #5810 consume this instead of their local copies (≈ −40…−70 lines across the repos, and the contract cannot drift).
🤖 Generated with Claude Code
@kvz@claude
utils: one storage-grant contract (claims, decode, HS256 mint/verify)
79dde7f
The Transloadit Storage grant (the short-lived JWT Companion's S3
provider accepts) currently exists as four hand-rolled copies: minting
in api2 and in the Console's grant route, verification in Companion,
and unverified decoding in @uppy/s3. This module is the single wire
contract: browser-safe claim types + parsing + unverified decode at the
root, deterministic HS256 minting and verification under /node.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@kvzkvz
mentioned this pull request
Aug 31, 2026
 Open

@kvz
kvz
merged commit 69e55d4
into
mainAug 31, 2026
@kvz
kvz
deleted the

storage-grant-codec

branch
August 31, 2026 17:09
@kvzkvz
mentioned this pull request
Aug 31, 2026
 Merged

kvz added a commit
that referenced
this pull request
Aug 31, 2026
@kvz
Add the missed changeset for the storage-grant codec (#483) (#484)
0c329bb
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@kvz

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
utils: one storage-grant contract (claims, decode, HS256 mint/verify) by kvz · Pull Request #483 · transloadit/node-sdk · GitHub
Skip to content
utils: one storage-grant contract (claims, decode, HS256 mint/verify) - #483
Merged
kvz merged 2 commits into
mainfrom 
storage-grant-codec
Aug 31, 2026
Merged
utils: one storage-grant contract (claims, decode, HS256 mint/verify)#483
kvz merged 2 commits into
mainfrom 
storage-grant-codec
Conversation
@kvz
@kvzkvz
commented
Aug 31, 2026

Copy link


Copy Markdown

Member
One source of truth for the Transloadit Storage grant JWT that today exists as four hand-rolled copies (api2 StorageGrantManager, Companion's parseGrantClaims, @uppy/s3's decodeGrant, and the Console's grant route).
  • Root (browser-safe): StorageGrantClaims/StorageGrantScope types, parseStorageGrantClaims (strict shape validation, scope dedupe), decodeStorageGrant (unverified JWT payload decode, UTF-8 safe), normalizeStorageGrantPrefix (Companion's leading-slash strip + trailing-slash).
  • /node: signStorageGrant (deterministic HS256, byte-compatible with api2's StorageGrantManager) and verifyStorageGrant (timing-safe signature check, HS256-only header, strict claims, expiry).
  • Vectors: fixed-input golden token, mint→verify roundtrip, tamper/expiry/shape rejections, unicode prefixes, base64url padding, scope dedupe.
Once published, api2 #8844, uppy #6506 (Companion + @uppy/s3) and content #5810 consume this instead of their local copies (≈ −40…−70 lines across the repos, and the contract cannot drift).
🤖 Generated with Claude Code
@kvz@claude
utils: one storage-grant contract (claims, decode, HS256 mint/verify)
79dde7f
The Transloadit Storage grant (the short-lived JWT Companion's S3
provider accepts) currently exists as four hand-rolled copies: minting
in api2 and in the Console's grant route, verification in Companion,
and unverified decoding in @uppy/s3. This module is the single wire
contract: browser-safe claim types + parsing + unverified decode at the
root, deterministic HS256 minting and verification under /node.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@kvzkvz
mentioned this pull request
Aug 31, 2026
 Open

@kvz
kvz
merged commit 69e55d4
into
mainAug 31, 2026
@kvz
kvz
deleted the

storage-grant-codec

branch
August 31, 2026 17:09
@kvzkvz
mentioned this pull request
Aug 31, 2026
 Merged

kvz added a commit
that referenced
this pull request
Aug 31, 2026
@kvz
Add the missed changeset for the storage-grant codec (#483) (#484)
0c329bb
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@kvz

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
utils: one storage-grant contract (claims, decode, HS256 mint/verify) by kvz · Pull Request #483 · transloadit/node-sdk · GitHub
Skip to content
utils: one storage-grant contract (claims, decode, HS256 mint/verify) - #483
Merged
kvz merged 2 commits into
mainfrom 
storage-grant-codec
Aug 31, 2026
Merged
utils: one storage-grant contract (claims, decode, HS256 mint/verify)#483
kvz merged 2 commits into
mainfrom 
storage-grant-codec
Conversation
@kvz
@kvzkvz
commented
Aug 31, 2026

Copy link


Copy Markdown

Member
One source of truth for the Transloadit Storage grant JWT that today exists as four hand-rolled copies (api2 StorageGrantManager, Companion's parseGrantClaims, @uppy/s3's decodeGrant, and the Console's grant route).
  • Root (browser-safe): StorageGrantClaims/StorageGrantScope types, parseStorageGrantClaims (strict shape validation, scope dedupe), decodeStorageGrant (unverified JWT payload decode, UTF-8 safe), normalizeStorageGrantPrefix (Companion's leading-slash strip + trailing-slash).
  • /node: signStorageGrant (deterministic HS256, byte-compatible with api2's StorageGrantManager) and verifyStorageGrant (timing-safe signature check, HS256-only header, strict claims, expiry).
  • Vectors: fixed-input golden token, mint→verify roundtrip, tamper/expiry/shape rejections, unicode prefixes, base64url padding, scope dedupe.
Once published, api2 #8844, uppy #6506 (Companion + @uppy/s3) and content #5810 consume this instead of their local copies (≈ −40…−70 lines across the repos, and the contract cannot drift).
🤖 Generated with Claude Code
@kvz@claude
utils: one storage-grant contract (claims, decode, HS256 mint/verify)
79dde7f
The Transloadit Storage grant (the short-lived JWT Companion's S3
provider accepts) currently exists as four hand-rolled copies: minting
in api2 and in the Console's grant route, verification in Companion,
and unverified decoding in @uppy/s3. This module is the single wire
contract: browser-safe claim types + parsing + unverified decode at the
root, deterministic HS256 minting and verification under /node.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@kvzkvz
mentioned this pull request
Aug 31, 2026
 Open

@kvz
kvz
merged commit 69e55d4
into
mainAug 31, 2026
@kvz
kvz
deleted the

storage-grant-codec

branch
August 31, 2026 17:09
@kvzkvz
mentioned this pull request
Aug 31, 2026
 Merged

kvz added a commit
that referenced
this pull request
Aug 31, 2026
@kvz
Add the missed changeset for the storage-grant codec (#483) (#484)
0c329bb
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@kvz

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
utils: one storage-grant contract (claims, decode, HS256 mint/verify) by kvz · Pull Request #483 · transloadit/node-sdk · GitHub
Skip to content
utils: one storage-grant contract (claims, decode, HS256 mint/verify) - #483
Merged
kvz merged 2 commits into
mainfrom 
storage-grant-codec
Aug 31, 2026
Merged
utils: one storage-grant contract (claims, decode, HS256 mint/verify)#483
kvz merged 2 commits into
mainfrom 
storage-grant-codec
Conversation
@kvz
@kvzkvz
commented
Aug 31, 2026

Copy link


Copy Markdown

Member
One source of truth for the Transloadit Storage grant JWT that today exists as four hand-rolled copies (api2 StorageGrantManager, Companion's parseGrantClaims, @uppy/s3's decodeGrant, and the Console's grant route).
  • Root (browser-safe): StorageGrantClaims/StorageGrantScope types, parseStorageGrantClaims (strict shape validation, scope dedupe), decodeStorageGrant (unverified JWT payload decode, UTF-8 safe), normalizeStorageGrantPrefix (Companion's leading-slash strip + trailing-slash).
  • /node: signStorageGrant (deterministic HS256, byte-compatible with api2's StorageGrantManager) and verifyStorageGrant (timing-safe signature check, HS256-only header, strict claims, expiry).
  • Vectors: fixed-input golden token, mint→verify roundtrip, tamper/expiry/shape rejections, unicode prefixes, base64url padding, scope dedupe.
Once published, api2 #8844, uppy #6506 (Companion + @uppy/s3) and content #5810 consume this instead of their local copies (≈ −40…−70 lines across the repos, and the contract cannot drift).
🤖 Generated with Claude Code
@kvz@claude
utils: one storage-grant contract (claims, decode, HS256 mint/verify)
79dde7f
The Transloadit Storage grant (the short-lived JWT Companion's S3
provider accepts) currently exists as four hand-rolled copies: minting
in api2 and in the Console's grant route, verification in Companion,
and unverified decoding in @uppy/s3. This module is the single wire
contract: browser-safe claim types + parsing + unverified decode at the
root, deterministic HS256 minting and verification under /node.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@kvzkvz
mentioned this pull request
Aug 31, 2026
 Open

@kvz
kvz
merged commit 69e55d4
into
mainAug 31, 2026
@kvz
kvz
deleted the

storage-grant-codec

branch
August 31, 2026 17:09
@kvzkvz
mentioned this pull request
Aug 31, 2026
 Merged

kvz added a commit
that referenced
this pull request
Aug 31, 2026
@kvz
Add the missed changeset for the storage-grant codec (#483) (#484)
0c329bb
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@kvz

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
utils: one storage-grant contract (claims, decode, HS256 mint/verify) by kvz · Pull Request #483 · transloadit/node-sdk · GitHub
Skip to content
utils: one storage-grant contract (claims, decode, HS256 mint/verify) - #483
Merged
kvz merged 2 commits into
mainfrom 
storage-grant-codec
Aug 31, 2026
Merged
utils: one storage-grant contract (claims, decode, HS256 mint/verify)#483
kvz merged 2 commits into
mainfrom 
storage-grant-codec
Conversation
@kvz
@kvzkvz
commented
Aug 31, 2026

Copy link


Copy Markdown

Member
One source of truth for the Transloadit Storage grant JWT that today exists as four hand-rolled copies (api2 StorageGrantManager, Companion's parseGrantClaims, @uppy/s3's decodeGrant, and the Console's grant route).
  • Root (browser-safe): StorageGrantClaims/StorageGrantScope types, parseStorageGrantClaims (strict shape validation, scope dedupe), decodeStorageGrant (unverified JWT payload decode, UTF-8 safe), normalizeStorageGrantPrefix (Companion's leading-slash strip + trailing-slash).
  • /node: signStorageGrant (deterministic HS256, byte-compatible with api2's StorageGrantManager) and verifyStorageGrant (timing-safe signature check, HS256-only header, strict claims, expiry).
  • Vectors: fixed-input golden token, mint→verify roundtrip, tamper/expiry/shape rejections, unicode prefixes, base64url padding, scope dedupe.
Once published, api2 #8844, uppy #6506 (Companion + @uppy/s3) and content #5810 consume this instead of their local copies (≈ −40…−70 lines across the repos, and the contract cannot drift).
🤖 Generated with Claude Code
@kvz@claude
utils: one storage-grant contract (claims, decode, HS256 mint/verify)
79dde7f
The Transloadit Storage grant (the short-lived JWT Companion's S3
provider accepts) currently exists as four hand-rolled copies: minting
in api2 and in the Console's grant route, verification in Companion,
and unverified decoding in @uppy/s3. This module is the single wire
contract: browser-safe claim types + parsing + unverified decode at the
root, deterministic HS256 minting and verification under /node.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@kvzkvz
mentioned this pull request
Aug 31, 2026
 Open

@kvz
kvz
merged commit 69e55d4
into
mainAug 31, 2026
@kvz
kvz
deleted the

storage-grant-codec

branch
August 31, 2026 17:09
@kvzkvz
mentioned this pull request
Aug 31, 2026
 Merged

kvz added a commit
that referenced
this pull request
Aug 31, 2026
@kvz
Add the missed changeset for the storage-grant codec (#483) (#484)
0c329bb
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@kvz

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
})();
utils: one storage-grant contract (claims, decode, HS256 mint/verify) by kvz · Pull Request #483 · transloadit/node-sdk · GitHub
Skip to content
utils: one storage-grant contract (claims, decode, HS256 mint/verify) - #483
Merged
kvz merged 2 commits into
mainfrom 
storage-grant-codec
Aug 31, 2026
Merged
utils: one storage-grant contract (claims, decode, HS256 mint/verify)#483
kvz merged 2 commits into
mainfrom 
storage-grant-codec
Conversation
@kvz
@kvzkvz
commented
Aug 31, 2026

Copy link


Copy Markdown

Member
One source of truth for the Transloadit Storage grant JWT that today exists as four hand-rolled copies (api2 StorageGrantManager, Companion's parseGrantClaims, @uppy/s3's decodeGrant, and the Console's grant route).
  • Root (browser-safe): StorageGrantClaims/StorageGrantScope types, parseStorageGrantClaims (strict shape validation, scope dedupe), decodeStorageGrant (unverified JWT payload decode, UTF-8 safe), normalizeStorageGrantPrefix (Companion's leading-slash strip + trailing-slash).
  • /node: signStorageGrant (deterministic HS256, byte-compatible with api2's StorageGrantManager) and verifyStorageGrant (timing-safe signature check, HS256-only header, strict claims, expiry).
  • Vectors: fixed-input golden token, mint→verify roundtrip, tamper/expiry/shape rejections, unicode prefixes, base64url padding, scope dedupe.
Once published, api2 #8844, uppy #6506 (Companion + @uppy/s3) and content #5810 consume this instead of their local copies (≈ −40…−70 lines across the repos, and the contract cannot drift).
🤖 Generated with Claude Code
@kvz@claude
utils: one storage-grant contract (claims, decode, HS256 mint/verify)
79dde7f
The Transloadit Storage grant (the short-lived JWT Companion's S3
provider accepts) currently exists as four hand-rolled copies: minting
in api2 and in the Console's grant route, verification in Companion,
and unverified decoding in @uppy/s3. This module is the single wire
contract: browser-safe claim types + parsing + unverified decode at the
root, deterministic HS256 minting and verification under /node.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@kvzkvz
mentioned this pull request
Aug 31, 2026
 Open

@kvz
kvz
merged commit 69e55d4
into
mainAug 31, 2026
@kvz
kvz
deleted the

storage-grant-codec

branch
August 31, 2026 17:09
@kvzkvz
mentioned this pull request
Aug 31, 2026
 Merged

kvz added a commit
that referenced
this pull request
Aug 31, 2026
@kvz
Add the missed changeset for the storage-grant codec (#483) (#484)
0c329bb
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@kvz