fix: update plugin api call

web/src/app/api/upload/route.ts

@@ -7,6 +7,7 @@ import {
 } from "@/db/schema";
 import { parseDataSafe } from "@/lib/parseDataSafe";
 import { sql } from "drizzle-orm";
+import jwt from "jsonwebtoken";
 import { NextResponse } from "next/server";
 import { z } from "zod";
 
@@ -17,7 +18,7 @@ const corsHeaders = {
 };
 
 const UploadRequest = z.object({
-  user_id: z.string(),
+  // user_id: z.string(),
   workflow_id: z.string().optional(),
   workflow_name: z.string().optional(),
   workflow: workflowType,
@@ -35,8 +36,39 @@ export async function OPTIONS(request: Request) {
   });
 }
 
+const APIKeyBodyRequest = z.object({
+  user_id: z.string().optional(),
+  org_id: z.string().optional(),
+  iat: z.number(),
+});
+
+function parseJWT(token: string) {
+  try {
+    // Verify the token - this also decodes it
+    const decoded = jwt.verify(token, process.env.JWT_SECRET!);
+    return APIKeyBodyRequest.parse(decoded);
+  } catch (err) {
+    // Handle error (token is invalid, expired, etc.)
+    console.error(err);
+    return null;
+  }
+}
+
 export async function POST(request: Request) {
-  console.log("hi");
+  const token = request.headers.get("Authorization")?.split(" ")?.[1]; // Assuming token is sent as "Bearer your_token"
+  const userData = token ? parseJWT(token) : undefined;
+  if (!userData) {
+    return new NextResponse("Invalid or expired token", {
+      status: 401,
+      headers: corsHeaders,
+    });
+  }
+
+  console.log(userData);
+
+  const { user_id, org_id } = userData;
+
+  if (!user_id) return new NextResponse("Invalid user_id", { status: 401 });
 
   const [data, error] = await parseDataSafe(
     UploadRequest,
@@ -47,7 +79,7 @@ export async function POST(request: Request) {
   if (!data || error) return error;
 
   const {
-    user_id,
+    // user_id,
     workflow,
     workflow_api,
     workflow_id: _workflow_id,