Initial import of verae-middleware from zapier monorepo

src/lib/tokens.js

@@ -0,0 +1,97 @@
+/**
+ * @fileoverview API keys and HMAC session tokens for the middleware auth bridge.
+ * @module lib/tokens
+ */
+
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { config } from '../config.js';
+
+const TOKEN_PREFIX = 'zmt_';
+const API_KEY_PREFIX = 'zmw_';
+
+/**
+ * @param {string} payload
+ * @returns {string}
+ */
+function sign(payload) {
+  return createHmac('sha256', config.tokenSecret).update(payload).digest('base64url');
+}
+
+/**
+ * Issue a signed middleware session token embedding tenant + Verae JWT.
+ *
+ * @param {object} params
+ * @param {string} params.tenantId
+ * @param {string} params.veraeToken
+ * @param {string} [params.expiresAt]
+ * @returns {string} Token string starting with `zmt_`
+ */
+export function issueSessionToken({ tenantId, veraeToken, expiresAt }) {
+  const payload = Buffer.from(
+    JSON.stringify({
+      tenantId,
+      veraeToken,
+      expiresAt,
+      nonce: randomBytes(8).toString('hex'),
+    }),
+  ).toString('base64url');
+  const signature = sign(payload);
+  return `${TOKEN_PREFIX}${payload}.${signature}`;
+}
+
+/**
+ * Parse and verify a session token.
+ *
+ * @param {string} token
+ * @returns {{ tenantId: string, veraeToken: string, expiresAt?: string, nonce?: string }|null}
+ */
+export function parseSessionToken(token) {
+  if (!token?.startsWith(TOKEN_PREFIX)) return null;
+
+  const raw = token.slice(TOKEN_PREFIX.length);
+  const dot = raw.lastIndexOf('.');
+  if (dot === -1) return null;
+
+  const payload = raw.slice(0, dot);
+  const signature = raw.slice(dot + 1);
+  const expected = sign(payload);
+
+  const sigBuf = Buffer.from(signature);
+  const expBuf = Buffer.from(expected);
+  if (sigBuf.length !== expBuf.length || !timingSafeEqual(sigBuf, expBuf)) {
+    return null;
+  }
+
+  try {
+    return JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Generate a new public API key (`zmw_…`).
+ * @returns {string}
+ */
+export function generateApiKey() {
+  return `${API_KEY_PREFIX}${randomBytes(24).toString('base64url')}`;
+}
+
+/**
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function isApiKey(value) {
+  return typeof value === 'string' && value.startsWith(API_KEY_PREFIX);
+}
+
+/**
+ * Extract bearer credential from an Authorization header.
+ * @param {string|undefined} header
+ * @returns {string|null}
+ */
+export function extractBearerToken(header) {
+  if (!header) return null;
+  const match = String(header).match(/^Bearer\s+(.+)$/i);
+  return match?.[1] ?? null;
+}