From 1fddab558b318e9a95702422123da1e4431e0b36 Mon Sep 17 00:00:00 2001
From: chungjeongsu <wjdwlgh2000@gmail.com>
Date: Thu, 2 Apr 2026 10:11:46 +0900
Subject: [PATCH] =?UTF-8?q?[#19]=20fix:=20=ED=86=A0=ED=81=B0=20=EB=82=B4?=
 =?UTF-8?q?=EB=B6=80=20claims=EB=A1=9C=20travelItineraryId=EC=99=80=20user?=
 =?UTF-8?q?Id=20=ED=8C=8C=EC=8B=B1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../SecondaryTokenAuthenticator.js            | 31 +++++++------------
 src/index.js                                  |  2 +-
 2 files changed, 13 insertions(+), 20 deletions(-)

diff --git a/src/collaboration/SecondaryTokenAuthenticator.js b/src/collaboration/SecondaryTokenAuthenticator.js
index 0062d1f..494c2a5 100644
--- a/src/collaboration/SecondaryTokenAuthenticator.js
+++ b/src/collaboration/SecondaryTokenAuthenticator.js
@@ -40,17 +40,24 @@ export class SecondaryTokenAuthenticator {
       };
     }
 
-    const rawTravelDocId = this.extractTravelDocId(req);
-    if (!rawTravelDocId) {
+    const rawTravelDocId = payload?.travelItineraryId;
+    if (typeof rawTravelDocId !== "string" && typeof rawTravelDocId !== "number") {
       return {
         ok: false,
-        statusCode: 400,
-        message: "Missing travelItineraryId query parameter"
+        statusCode: 401,
+        message: "Secondary token must include travelItineraryId"
       };
     }
 
     const userId = String(rawUserId);
-    const travelDocId = rawTravelDocId;
+    const travelDocId = String(rawTravelDocId).trim();
+    if (!travelDocId) {
+      return {
+        ok: false,
+        statusCode: 401,
+        message: "Secondary token must include travelItineraryId"
+      };
+    }
 
     return {
       ok: true,
@@ -83,20 +90,6 @@ export class SecondaryTokenAuthenticator {
     return { ok: true, token };
   }
 
-  extractTravelDocId(req) {
-    const travelItineraryId = this.getRequestUrl(req).searchParams.get("travelItineraryId");
-    if (!travelItineraryId) {
-      return null;
-    }
-
-    const normalizedTravelItineraryId = travelItineraryId.trim();
-    if (!normalizedTravelItineraryId) {
-      return null;
-    }
-
-    return normalizedTravelItineraryId;
-  }
-
   isSecondaryTokenUsed(token) {
     this.pruneUsedSecondaryTokens();
     return this.usedSecondaryTokens.has(token);
diff --git a/src/index.js b/src/index.js
index 2d32d2c..2615e82 100644
--- a/src/index.js
+++ b/src/index.js
@@ -38,7 +38,7 @@ travelDocWebSocketServer.start();
 server.listen(port, () => {
   console.log(`HTTP server listening on http://localhost:${port}`);
   console.log(
-    `WebSocket server listening on ws://localhost:${port}?secondaryToken=Bearer%20{jwt}&travelItineraryId={travelItineraryId}`
+    `WebSocket server listening on ws://localhost:${port}?secondaryToken=Bearer%20{jwt}`
   );
   console.log(`Y-LevelDB path: ${yLeveldbPath}`);
 });