40 lines
1.7 KiB
TypeScript
40 lines
1.7 KiB
TypeScript
|
import crypto from "crypto"
|
||
|
|
|
||
|
|
// Signed OAuth `state` for the e-sign connect flow — carries the initiating
|
||
|
|
// owner + provider + a random nonce (bound to a cookie by the connect route),
|
||
|
|
// plus an issued-at so a leaked state can't be replayed. Mirrors the hardened
|
||
|
|
// accounting OAuth state; fails closed if BETTER_AUTH_SECRET is missing.
|
||
|
|
|
||
|
|
const STATE_TTL_MS = 10 * 60 * 1000 // 10 minutes
|
||
|
|
|
||
|
|
export const ESIGN_NONCE_COOKIE = "esign_oauth_nonce"
|
||
|
|
|
||
|
|
function secret(): string {
|
||
|
|
const s = process.env.BETTER_AUTH_SECRET
|
||
|
|
if (!s) throw new Error("BETTER_AUTH_SECRET is not set — required to sign OAuth state")
|
||
|
|
return s
|
||
|
|
}
|
||
|
|
|
||
|
|
export type EsignOAuthState = { ownerId: string; provider: string; nonce: string }
|
||
|
|
|
||
|
|
export function signState(data: EsignOAuthState): string {
|
||
|
|
const payload = Buffer.from(JSON.stringify({ ...data, iat: Date.now() })).toString("base64url")
|
||
|
|
const sig = crypto.createHmac("sha256", secret()).update(payload).digest("base64url")
|
||
|
|
return `${payload}.${sig}`
|
||
|
|
}
|
||
|
|
|
||
|
|
export function verifyState(state: string): EsignOAuthState | null {
|
||
|
|
const [payload, sig] = state.split(".")
|
||
|
|
if (!payload || !sig) return null
|
||
|
|
const expect = crypto.createHmac("sha256", secret()).update(payload).digest("base64url")
|
||
|
|
if (sig.length !== expect.length || !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expect))) return null
|
||
|
|
try {
|
||
|
|
const obj = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as EsignOAuthState & { iat?: number }
|
||
|
|
if (!obj.iat || Date.now() - obj.iat > STATE_TTL_MS) return null
|
||
|
|
if (!obj.ownerId || !obj.provider || !obj.nonce) return null
|
||
|
|
return { ownerId: obj.ownerId, provider: obj.provider, nonce: obj.nonce }
|
||
|
|
} catch {
|
||
|
|
return null
|
||
|
|
}
|
||
|
|
}
|