Verify a request

import { MemoryNonceStore, MemoryRevocationList, Verifier } from "@afauthhq/server";
import { AFAuthError } from "@afauthhq/core";

const verifier = new Verifier({
  serviceDid: "did:web:api.example.com",
  nonceStore: new MemoryNonceStore(),         // §5.6 — see the warning below
  revocationList: new MemoryRevocationList(),  // §8.3 — durable in production
});

export async function handleSignedRequest(req: Request): Promise<Response> {
  try {
    const body = req.body ? await req.text() : null;
    const verified = await verifier.verify({
      method: req.method,
      url: req.url,
      headers: req.headers,
      body,
    });

    // verified.agentDid is the authenticated identity. Authorize per
    // your own policy, then serve or forward.
    return new Response(JSON.stringify({ ok: true, agent: verified.agentDid }), {
      headers: { "content-type": "application/json" },
    });
  } catch (err) {
    if (err instanceof AFAuthError) return err.toResponse();
    throw err;
  }
}