// Authorization middleware, Access token must exist and can be verified by Authing application public key
const checkJwt = jwt({
  // Dynamically obtain the signature verification public key from the Authing application service discovery address
  secret: jwksRsa.expressJwtSecret({
    cache: true,
    rateLimit: true,
    jwksRequestsPerMinute: 5,
    jwksUri: `https://{APP_DOMAIN}.authing.cn/oidc/.well-known/jwks.json`
  }),

  // Verify audience and issuer
  audience: 'APP_ID',
  issuer: [`https://{APP_DOMAIN}.authing.cn/oidc`],
  algorithms: ['RS256']
});