homeio

1import "server-only";
2
3import { createHmac, timingSafeEqual } from "node:crypto";
4import { serverEnv } from "@/lib/server/env";
5import {
6  PARTIAL_AUTH_TOKEN_TTL_SECONDS,
7  buildPartialAuthPayload,
8  isPartialAuthExpired,
9  parsePartialAuthToken,
10} from "@/lib/shared/auth/partial-auth";
11
12function signPayload(payload: string) {
13  return createHmac("sha256", serverEnv.AUTH_SESSION_SECRET)
14    .update(payload)
15    .digest("hex");
16}
17
18export type PartialAuthIssued = {
19  token: string;
20  expiresAtEpochSeconds: number;
21};
22
23/**
24 * Issues a partial-auth token for `userId` that expires in
25 * {@link PARTIAL_AUTH_TOKEN_TTL_SECONDS}. Uses {@link Date.now} for the
26 * timestamp; tests can wrap by mocking the system clock.
27 */
28export function createPartialAuthToken(userId: string): PartialAuthIssued {
29  const expiresAtEpochSeconds =
30    Math.floor(Date.now() / 1000) + PARTIAL_AUTH_TOKEN_TTL_SECONDS;
31  const payload = buildPartialAuthPayload(userId, expiresAtEpochSeconds);
32  const signature = signPayload(payload);
33  return {
34    token: `${payload}.${signature}`,
35    expiresAtEpochSeconds,
36  };
37}
38
39/**
40 * Returns `{ userId }` for a valid, unexpired partial-auth token, or `null`
41 * if the token is malformed, expired, or carries a bad signature. The
42 * `partial.` prefix is in the signed bytes, so a session token cannot be
43 * re-presented here even though both formats use {@link AUTH_SESSION_SECRET}.
44 */
45export function verifyPartialAuthToken(token: string) {
46  const parsed = parsePartialAuthToken(token);
47  if (!parsed) return null;
48  if (isPartialAuthExpired(parsed.expiresAtEpochSeconds)) return null;
49
50  const expectedSignature = signPayload(parsed.payload);
51  const expectedBuffer = Buffer.from(expectedSignature, "utf8");
52  const actualBuffer = Buffer.from(parsed.signature, "utf8");
53
54  if (expectedBuffer.length !== actualBuffer.length) return null;
55  if (!timingSafeEqual(expectedBuffer, actualBuffer)) return null;
56
57  return {
58    userId: parsed.userId,
59    expiresAtEpochSeconds: parsed.expiresAtEpochSeconds,
60  };
61}
62