Function verifyAccessToken

apps/api/src/auth/token.ts:27–49

(
  token: string,
  secret: string,
  now = nowSec(),
)

}

export function verifyAccessToken(
  token: string,
  secret: string,
  now = nowSec(),
): AccessClaims | null {
  const parts = token.split(".");
  if (parts.length !== 3) return null;
  const [h, b, s] = parts as [string, string, string];
  const expected = b64(sig(`${h}.${b}`, secret));
  const got = Buffer.from(s);
  const exp = Buffer.from(expected);
  if (got.length !== exp.length || !timingSafeEqual(got, exp)) return null;
  let claims: AccessClaims;
  try {
    claims = JSON.parse(Buffer.from(b, "base64url").toString("utf8"));
  } catch {
    return null;
  }
  if (typeof claims.exp !== "number" || claims.exp < now || typeof claims.sub !== "string") {
    return null;
  }
  return claims;
}

/** Opaque refresh token; only its hash is persisted. */
export function generateRefreshToken(): { token: string; tokenHash: string } {