为什么verifyTokens函数从未被调用？技术排查求助

代码展示 #

auth.mjs #

import jwt from 'jsonwebtoken'; 

export function generateToken(userInfo){
    if(!userInfo) {
        return null;
    }
    
    const payload = { username: userInfo.username, exp: Math.floor(Date.now() / 1000) + 30}; 
    const secret = Buffer.from(process.env.JWT_SECRET).toString('base64');

    return jwt.sign(payload, secret, {algorithm: 'HS512'});
    
}

export async function verifyTokens(username, token) {
    console.error("Still inside verifyTokens");
    try{
        console.error('Inside verifyToken');
        const response = await new Promise((resolve, reject) => {
            jwt.verify(token, Buffer.from(process.env.JWT_SECRET.toString('base64'), {algorithm: 'HS512'}, (err, decoded) => {
               if (err) {
                   reject (err);
               } else {
                   resolve(decoded);
               }
            })
        ))
        
            if (response.username !== username) {
                console.error('response.username !== username');
                return {
                    verified: false,
                    message: 'invalid user'
                }
            }
            
            console.error('response.username === username');
            
            return {
                verified: true,
                message: 'verified'
            }
    } catch (error) {
        console.error('Verified Tokens Error: ' + error);
        throw {
            verified: false,
            message: 'invalid token'
        }
    }
    
}

export default generateToken;

verify.mjs #

import buildResponse from '../utils/util.mjs';
import verifyTokens from '../utils/auth.mjs';


export async function verify(requestBody) {
    if(!requestBody.user || !requestBody.user.username || !requestBody.token) {
        return buildResponse(401, {
            verified: false,
            message: 'incorrect request body'
        })
    }
    
    const user = requestBody.user;
    const token = requestBody.token;
    try {
        console.error("Verifying this token=" + token);
        console.error("Verifying this user.username=" + user.username);
        const verification = await verifyTokens(user.username, token);
        console.error('Are we verified? verification.verified=', verification.verified);
        if(!verification.verified) {
            console.error("We are NOT verified! verification.verified=", verification.verified)
            return await buildResponse(401, verification);
        }
    }
    catch (error) {
        console.error("Error: ", error);
    }
   
    return buildResponse(200, {
        verified: true,
        message: 'success',
        user: user,
        token: token
    })
}

export default verify;

问题现象 #

日志已打印Verifying this token和Verifying this user.username，但Still inside verifyTokens从未出现，说明verifyTokens函数未被实际调用。

核心原因 #

在verify.mjs中，导入方式错误：

• auth.mjs里verifyTokens是命名导出，默认导出的是generateToken函数。
• 当前代码用import verifyTokens from '../utils/auth.mjs';导入的是generateToken，而非目标函数verifyTokens。调用这个错误的函数自然不会触发verifyTokens内部的日志。

修复方案 #

修改verify.mjs中的导入语句为命名导入：

import buildResponse from '../utils/util.mjs';
import { verifyTokens } from '../utils/auth.mjs'; // 改为花括号包裹的命名导入

额外注意事项 #

修复导入问题后，还需修正auth.mjs中jwt.verify的参数错误：
原代码中Buffer.from(process.env.JWT_SECRET.toString('base64')写法错误，应该先将process.env.JWT_SECRET转为Buffer再转base64，正确写法：

jwt.verify(token, Buffer.from(process.env.JWT_SECRET).toString('base64'), {algorithm: 'HS512'}, (err, decoded) => {

内容的提问来源于stack exchange，提问作者Mark