pook/compliancebot
1
0
Fork 0
Code Issues 1.1k Pull requests 82 Projects Releases Packages Wiki Activity Actions

feat: download token utility (HMAC-SHA256, 1h expiry) #202

Merged
pook merged 1 commit from feat/download-token-utility into main 2026-04-09 06:15:02 -04:00
Conversation 0 Commits 1 Files changed 2 +148
pook commented 2026-04-09 02:54:40 -04:00
Owner
Copy link

Summary

  • Add generateDownloadToken(documentId) and validateDownloadToken(token, documentId) utility functions
  • HMAC-SHA256 signing with API_SECRET, 1-hour expiry encoded in token payload
  • Timing-safe comparison to prevent timing attacks
  • 8 unit tests covering: happy path, wrong document ID, expired token, tampered signature, malformed input

Refs

Closes #96, #197

Test plan

  • bun test packages/api/tests/unit/download-token.test.ts — 8/8 pass
  • TypeScript type-check passes (no new errors)

🤖 Generated with Claude Code

## Summary - Add `generateDownloadToken(documentId)` and `validateDownloadToken(token, documentId)` utility functions - HMAC-SHA256 signing with `API_SECRET`, 1-hour expiry encoded in token payload - Timing-safe comparison to prevent timing attacks - 8 unit tests covering: happy path, wrong document ID, expired token, tampered signature, malformed input ## Refs Closes #96, #197 ## Test plan - [x] `bun test packages/api/tests/unit/download-token.test.ts` — 8/8 pass - [x] TypeScript type-check passes (no new errors) 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Add generateDownloadToken and validateDownloadToken functions for
secure document download links with 1-hour expiry. Uses HMAC-SHA256
with API_SECRET for signing, timing-safe comparison for validation.

Refs: #96, #197

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
pook merged commit 349b2973fc into main 2026-04-09 06:15:02 -04:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent-task

Task for autonomous agent execution

  
agent-task

Paperclip autonomous agent task

No labels
agent-task
agent-task
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pook/compliancebot!202
No description provided.