chrisandClaude Opus 5.5
6791b62d87
- Fastify API with cookie (web) and bearer (mobile) sessions, follows, pinned friends, featured songs, account deletion, Redis-backed rate limits - Providers: Spotify (OAuth), Last.fm, ListenBrainz, Plex (PIN flow and server discovery), Jellyfin (token auth, revoked on disconnect) - Worker polls on an adaptive schedule in a Redis sorted set, so polling scales horizontally and API usage tracks whether anyone is watching - Track resolver links songs across services via ISRC (Deezer, Spotify), iTunes search and song.link - Realtime updates over WebSocket fan out through Redis pub/sub - User-supplied server URLs are restricted to public addresses, checked both up front and at connect time to defeat DNS rebinding Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8
23 lines
1.0 KiB
TypeScript
23 lines
1.0 KiB
TypeScript
import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
|
|
import { env } from '../env';
|
|
|
|
const key = Buffer.from(env.TOKEN_ENCRYPTION_KEY, 'base64');
|
|
|
|
/** AES-256-GCM. Output: base64(iv | tag | ciphertext). */
|
|
export function encrypt(plaintext: string): string {
|
|
const iv = randomBytes(12);
|
|
const cipher = createCipheriv('aes-256-gcm', key, iv);
|
|
const ct = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
|
|
return Buffer.concat([iv, cipher.getAuthTag(), ct]).toString('base64');
|
|
}
|
|
|
|
export function decrypt(payload: string): string {
|
|
const buf = Buffer.from(payload, 'base64');
|
|
const decipher = createDecipheriv('aes-256-gcm', key, buf.subarray(0, 12));
|
|
decipher.setAuthTag(buf.subarray(12, 28));
|
|
return Buffer.concat([decipher.update(buf.subarray(28)), decipher.final()]).toString('utf8');
|
|
}
|
|
|
|
export const sha256 = (s: string) => createHash('sha256').update(s).digest('hex');
|
|
export const randomToken = (bytes = 32) => randomBytes(bytes).toString('base64url');
|