Function verifyUnsubscribeToken

packages/email/src/unsubscribe.ts:14–32

(
  email: string,
  category: string,
  token: string,
)

}

export function verifyUnsubscribeToken(
  email: string,
  category: string,
  token: string,
): boolean {
  const expectedToken = generateUnsubscribeToken(email, category);
  const tokenBuffer = Buffer.from(token, 'hex');
  const expectedBuffer = Buffer.from(expectedToken, 'hex');

  // Handle length mismatch safely to avoid timing leaks
  if (tokenBuffer.length !== expectedBuffer.length) {
    // Compare against zero-filled buffer of same length as token to maintain constant time
    const zeroBuffer = Buffer.alloc(tokenBuffer.length);
    timingSafeEqual(tokenBuffer, zeroBuffer);
    return false;
  }

  return timingSafeEqual(tokenBuffer, expectedBuffer);
}

export function getUnsubscribeUrl(email: string, category: string): string {
  const token = generateUnsubscribeToken(email, category);