93 lines
3.2 KiB
TypeScript
93 lines
3.2 KiB
TypeScript
import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
|
|
|
|
export type MeetingRole = "host" | "participant";
|
|
|
|
export type MeetingTokenPayload = {
|
|
eventSlug: string;
|
|
participantId: string;
|
|
// Self-declared, persisted client-side (localStorage, not sessionStorage)
|
|
// identity for participants — participantId is fresh per /join call, so
|
|
// without this a kick could always be undone by simply rejoining. Only
|
|
// used to make a kick stick across a rejoin (see rooms.ts kickedClientIds);
|
|
// never used to key live room membership, so a client choosing an
|
|
// arbitrary/colliding value can only affect their own future kick status,
|
|
// never another participant's connection. Still bypassable by clearing
|
|
// localStorage or joining from a different browser — there's no real
|
|
// identity to anchor to for an unauthenticated participant.
|
|
clientId?: string;
|
|
name: string;
|
|
role: MeetingRole;
|
|
exp: number; // unix ms
|
|
};
|
|
|
|
function secret(): string {
|
|
const value = process.env.MEETING_SESSION_SECRET;
|
|
if (!value) throw new Error("MEETING_SESSION_SECRET is not set");
|
|
return value;
|
|
}
|
|
|
|
function base64url(input: Buffer | string): string {
|
|
return Buffer.from(input).toString("base64url");
|
|
}
|
|
|
|
function sign(data: string): string {
|
|
return createHmac("sha256", secret()).update(data).digest("base64url");
|
|
}
|
|
|
|
/** Issues a short-lived, self-contained, signed token for one meeting session. */
|
|
export function createMeetingToken(args: {
|
|
eventSlug: string;
|
|
name: string;
|
|
role: MeetingRole;
|
|
clientId?: string;
|
|
ttlMs?: number;
|
|
}): { token: string; participantId: string } {
|
|
const participantId = randomUUID();
|
|
const clientId =
|
|
typeof args.clientId === "string" && args.clientId.length > 0 && args.clientId.length <= 100
|
|
? args.clientId
|
|
: undefined;
|
|
const payload: MeetingTokenPayload = {
|
|
eventSlug: args.eventSlug,
|
|
participantId,
|
|
clientId,
|
|
name: args.name,
|
|
role: args.role,
|
|
exp: Date.now() + (args.ttlMs ?? 6 * 60 * 60 * 1000), // 6h default
|
|
};
|
|
const body = base64url(JSON.stringify(payload));
|
|
const signature = sign(body);
|
|
return { token: `${body}.${signature}`, participantId };
|
|
}
|
|
|
|
/** Verifies signature + expiry. Returns null if invalid/expired/tampered. */
|
|
export function verifyMeetingToken(token: unknown): MeetingTokenPayload | null {
|
|
if (typeof token !== "string" || token.length > 4096) return null;
|
|
const parts = token.split(".");
|
|
if (parts.length !== 2) return null;
|
|
const [body, signature] = parts;
|
|
|
|
const expected = sign(body);
|
|
const a = Buffer.from(signature);
|
|
const b = Buffer.from(expected);
|
|
if (a.length !== b.length || !timingSafeEqual(a, b)) return null;
|
|
|
|
try {
|
|
const payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8")) as MeetingTokenPayload;
|
|
if (
|
|
!Number.isFinite(payload.exp) ||
|
|
payload.exp < Date.now() ||
|
|
typeof payload.eventSlug !== "string" ||
|
|
payload.eventSlug.length > 200 ||
|
|
typeof payload.participantId !== "string" ||
|
|
payload.participantId.length > 100 ||
|
|
typeof payload.name !== "string" ||
|
|
payload.name.length > 120 ||
|
|
(payload.role !== "host" && payload.role !== "participant")
|
|
) return null;
|
|
return payload;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|