Function verifySessionToken

backend/src/auth/session.utils.ts:38–66

(token: string)

 * Verify and decode a session token.
 */
export function verifySessionToken(token: string): SessionPayload | null {
  try {
    const secret = getSessionSecret();
    const decoded = Buffer.from(token, 'base64').toString('utf-8');
    const lastDot = decoded.lastIndexOf('.');
    if (lastDot === -1) return null;

    const payload = decoded.slice(0, lastDot);
    const signature = decoded.slice(lastDot + 1);

    const hmac = crypto.createHmac('sha256', secret);
    hmac.update(payload);
    const expectedSignature = hmac.digest('hex');

    if (signature.length !== expectedSignature.length) return null;
    const signatureMatch = crypto.timingSafeEqual(
      Buffer.from(signature),
      Buffer.from(expectedSignature),
    );
    if (!signatureMatch) return null;

    const parsed = JSON.parse(payload) as SessionPayload;
    if (typeof parsed.ts !== 'number') return null;
    if (Date.now() - parsed.ts > SESSION_COOKIE_MAX_AGE) return null;
    return parsed;
  } catch {
    return null;
  }
}