e9e829e579
- general.continue/send - structuredViews.tagApplied/filterDone/filterTodo/propertyStatus - wizard.taskA/taskB - richTextEditor.preview*Tip (7 clés SlashPreview) - wizard.* au niveau racine (48 clés FR + 48 EN) - Total: 0 clé manquante pour FR et EN - 0 erreur TypeScript
49 lines
1.7 KiB
TypeScript
49 lines
1.7 KiB
TypeScript
/**
|
|
* Mobile auth helper — validates Bearer token and returns userId
|
|
* Token format: base64url(userId:timestamp:hmac)
|
|
*/
|
|
import { createHmac, timingSafeEqual } from 'crypto'
|
|
|
|
function getSecret(): string {
|
|
const secret = process.env.NEXTAUTH_SECRET
|
|
if (!secret) {
|
|
throw new Error('NEXTAUTH_SECRET is required for mobile auth')
|
|
}
|
|
return secret
|
|
}
|
|
|
|
export function createMobileToken(userId: string): string {
|
|
const ts = Date.now()
|
|
const payload = `${userId}:${ts}`
|
|
const sig = createHmac('sha256', getSecret()).update(payload).digest('hex')
|
|
return Buffer.from(`${payload}:${sig}`).toString('base64url')
|
|
}
|
|
|
|
export function verifyMobileToken(token: string): string | null {
|
|
try {
|
|
const decoded = Buffer.from(token, 'base64url').toString('utf-8')
|
|
const lastColon = decoded.lastIndexOf(':')
|
|
if (lastColon === -1) return null
|
|
const sig = decoded.slice(lastColon + 1)
|
|
const payload = decoded.slice(0, lastColon)
|
|
const secondColon = payload.lastIndexOf(':')
|
|
if (secondColon === -1) return null
|
|
const userId = payload.slice(0, secondColon)
|
|
const ts = payload.slice(secondColon + 1)
|
|
const expected = createHmac('sha256', getSecret()).update(payload).digest('hex')
|
|
const sigBuf = Buffer.from(sig)
|
|
const expectedBuf = Buffer.from(expected)
|
|
if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) return null
|
|
if (Date.now() - Number(ts) > 90 * 24 * 60 * 60 * 1000) return null
|
|
return userId
|
|
} catch {
|
|
return null
|
|
}
|
|
}
|
|
|
|
export function getMobileUserId(request: Request): string | null {
|
|
const auth = request.headers.get('Authorization')
|
|
if (!auth?.startsWith('Bearer ')) return null
|
|
return verifyMobileToken(auth.slice(7))
|
|
}
|