Discord

src/servers/api/browser/relay-auth.ts

@@ -0,0 +1,31 @@
+import { createHmac } from 'node:crypto';
+
+const RELAY_TOKEN_CONTEXT = 'officer-browser-relay-v1';
+
+const { JWT_SECRET } = process.env;
+
+if (!JWT_SECRET) {
+  throw new Error('JWT_SECRET is required for browser relay auth');
+}
+
+export function deriveRelayToken(userId: number, port: number): string {
+  return createHmac('sha256', JWT_SECRET!)
+    .update(`${RELAY_TOKEN_CONTEXT}:${port}:${userId}`)
+    .digest('hex');
+}
+
+const tokenToUser = new Map<string, number>();
+
+export function registerUserToken(userId: number, port: number): string {
+  const token = deriveRelayToken(userId, port);
+  tokenToUser.set(token, userId);
+  return token;
+}
+
+export function resolveUserFromToken(token: string): number | null {
+  return tokenToUser.get(token) ?? null;
+}
+
+export function getRelayAuthHeader(): string {
+  return 'x-officer-relay-token';
+}