spb/social-runtime-crawler

1import { createHmac, timingSafeEqual } from "node:crypto";23/**4 * Passcode gate. The console is public on the Internet (www.socialcrawl.co) and can launch browsers5 * on a cluster node, so every page and API call requires a signed cookie obtained with SRC_DASHBOARD_PASSCODE.6 */7export const COOKIE = "src_access";8const SECRET = process.env.SRC_DASHBOARD_SECRET ?? process.env.SRC_API_TOKEN ?? "dev-secret";9const PASSCODE = process.env.SRC_DASHBOARD_PASSCODE ?? "";1011export function gateEnabled(): boolean {12  return PASSCODE.length > 0;13}1415export function checkPasscode(input: string): boolean {16  if (!PASSCODE) return true;17  const a = Buffer.from(input);18  const b = Buffer.from(PASSCODE);19  return a.length === b.length && timingSafeEqual(a, b);20}2122export function makeToken(): string {23  const exp = Date.now() + 30 * 24 * 3600 * 1000;24  const body = `${exp}`;25  return `${body}.${createHmac("sha256", SECRET).update(body).digest("hex")}`;26}2728export function verifyToken(token: string | undefined): boolean {29  if (!PASSCODE) return true;30  if (!token) return false;31  const [body, sig] = token.split(".");32  if (!body || !sig) return false;33  const expect = createHmac("sha256", SECRET).update(body).digest("hex");34  if (expect.length !== sig.length || !timingSafeEqual(Buffer.from(expect), Buffer.from(sig))) return false;35  return Number(body) > Date.now();36}37