| 1 | import { createHmac, timingSafeEqual } from 'node:crypto'; |
| 2 | |
| 3 | /** What `git-lfs-authenticate` grants: one user, one repository, one operation, until `expiresAt` (epoch ms). */ |
| 4 | export interface LfsTokenClaims |
| 5 | userId: string; |
| 6 | repositoryId: string; |
| 7 | operation: 'download |
| 8 | expiresAt: number; |
| 9 | } |
| 10 | |
| 11 | function signature(secret: |
| 12 | return createHmac('sha256 |
| 13 | } |
| 14 | |
| 15 | export function signLfsToken(secret |
| 16 | const payload = |
| 17 | return `${payload} |
| 18 | } |
| 19 | |
| 20 | /** The claims of a token this secret signed and that has not expired, or null. */ |
| 21 | export function verifyLfsToken( |
| 22 | secret: string, |
| 23 | token: string, |
| 24 | now = Date. |
| 25 | ): LfsTokenClaims | |
| 26 | const [payload, |
| 27 | if (!payload || |
| 28 | const expected = |
| 29 | const actual = |
| 30 | if (actual.length |
| 31 | return null; |
| 32 | } |
| 33 | const claims = |
| 34 | Buffer.from(payload |
| 35 | ) as LfsTokenClaims; |
| 36 | return claims.expiresAt |
| 37 | } |