Function createSessionToken

backend/src/auth/session.utils.ts:26–33

(username: string)

 * Create a signed session token for local auth.
 */
export function createSessionToken(username: string): string {
  const secret = getSessionSecret();
  const payload = JSON.stringify({ username, ts: Date.now() });
  const hmac = crypto.createHmac('sha256', secret);
  hmac.update(payload);
  const signature = hmac.digest('hex');
  return Buffer.from(`${payload}.${signature}`).toString('base64');
}

/**
 * Verify and decode a session token.