chore: establish learning module baseline

OpenMAIC/lib/server/access-token.ts

@@ -0,0 +1,39 @@
+import { createHmac, timingSafeEqual } from 'crypto';
+import {
+  parseFreshAccessToken,
+  resolveAccessCodeSessionTtlSeconds,
+  type AccessTokenValidationOptions,
+} from '@/lib/server/access-token-policy';
+
+/** Create an HMAC-signed token: `timestamp.signature` */
+export function createAccessToken(accessCode: string, nowMs = Date.now()): string {
+  if (!Number.isSafeInteger(nowMs) || nowMs < 0) {
+    throw new TypeError('Access token issue time must be a non-negative safe integer');
+  }
+  const timestamp = nowMs.toString();
+  const signature = createHmac('sha256', accessCode).update(timestamp).digest('hex');
+  return `${timestamp}.${signature}`;
+}
+
+/** Verify an HMAC-signed token against the access code */
+export function verifyAccessToken(
+  token: string,
+  accessCode: string,
+  options: AccessTokenValidationOptions = {},
+): boolean {
+  const parsed = parseFreshAccessToken(token, {
+    ...options,
+    ttlSeconds:
+      options.ttlSeconds ??
+      resolveAccessCodeSessionTtlSeconds(process.env.ACCESS_CODE_SESSION_TTL_SECONDS),
+  });
+  if (!parsed) return false;
+
+  const expected = createHmac('sha256', accessCode).update(parsed.issuedAtText).digest('hex');
+
+  const sigBuf = Buffer.from(parsed.signatureHex, 'hex');
+  const expBuf = Buffer.from(expected, 'hex');
+  if (sigBuf.length !== expBuf.length) return false;
+
+  return timingSafeEqual(sigBuf, expBuf);
+}