homeio

1import "server-only";
2
3import { createHmac, timingSafeEqual } from "node:crypto";
4import { serverEnv } from "@/lib/server/env";
5import {
6  buildSessionPayload,
7  isSessionExpired,
8  parseSessionToken,
9} from "@/lib/shared/auth/session";
10
11function signPayload(payload: string) {
12  return createHmac("sha256", serverEnv.AUTH_SESSION_SECRET)
13    .update(payload)
14    .digest("hex");
15}
16
17export function createSessionToken(
18  sessionId: string,
19  expiresAtEpochSeconds: number,
20) {
21  const payload = buildSessionPayload(sessionId, expiresAtEpochSeconds);
22  const signature = signPayload(payload);
23  return `${payload}.${signature}`;
24}
25
26export function verifySessionToken(token: string) {
27  const parsed = parseSessionToken(token);
28  if (!parsed) return null;
29  if (isSessionExpired(parsed.expiresAtEpochSeconds)) return null;
30
31  const expectedSignature = signPayload(parsed.payload);
32
33  const expectedBuffer = Buffer.from(expectedSignature, "utf8");
34  const actualBuffer = Buffer.from(parsed.signature, "utf8");
35
36  if (expectedBuffer.length !== actualBuffer.length) return null;
37  if (!timingSafeEqual(expectedBuffer, actualBuffer)) return null;
38
39  return {
40    sessionId: parsed.sessionId,
41    expiresAtEpochSeconds: parsed.expiresAtEpochSeconds,
42  };
43}
44