| 65 | } |
| 66 | |
| 67 | func (n *nativeAttachmentStore) sign(messageID string, index int, expUnix int64) string { |
| 68 | payload := attachmentTokenPayload(messageID, index, expUnix) |
| 69 | mac := hmac.New(sha256.New, n.secret) |
| 70 | mac.Write([]byte(payload)) |
| 71 | return base64.RawURLEncoding.EncodeToString([]byte(payload)) + "." + |
| 72 | base64.RawURLEncoding.EncodeToString(mac.Sum(nil)) |
| 73 | } |
| 74 | |
| 75 | func (n *nativeAttachmentStore) DownloadURL(agentEmail, messageID string, index int, ttl time.Duration) (string, time.Time, error) { |
| 76 | // Fail closed if wired with no secret — an empty HMAC key makes every token |