deno-expert

# Deno Code Review for `auth-service` Project

## Overview
Reviewed the `auth-service` module, focusing on the `validateJWT` function in `src/auth.ts`. The code handles JWT validation but has several areas for improvement.

## Issues Found
- **Security**: The function uses `Deno.readTextFile` without verifying file permissions. A malicious user could replace the JWT secret file.
- **Performance**: The secret is read from disk on every validation call. Cache it in memory using `Deno.cache` or environment variables.
- **Error Handling**: Missing proper error handling for malformed JWTs. Currently throws raw errors that could leak stack traces.

## Optimizations
- **Cache the Secret**:
  ```typescript
  let cachedSecret: string | null = null;
  
  async function getSecret(): Promise<string> {
    if (cachedSecret) return cachedSecret;
    cachedSecret = await Deno.readTextFile('./secrets/jwt.key');
    return cachedSecret;
  }
  ```

- **Add Validation Middleware**:
  ```typescript
  import { validate } from 'https://deno.land/x/validasaur/mod.ts';
  
  const [passes, errors] = await validate(jwtPayload, {
    userId: { required: true, type: 'string' }
  });
  ```

## Best Practices
1. Use `Deno.env.get('JWT_SECRET')` for secrets in production.
2. Add rate limiting to prevent brute-force attacks.
3. Log validation failures (without sensitive data) for debugging.

## Next Steps
Would you like me to draft a PR with these changes? Or focus on another part of the codebase?