@mandujs/core 0.54.32 → 0.55.0-beta.1

package/src/middleware/csrf.ts

@@ -1,328 +1,328 @@
-/**
- * CSRF Middleware Plugin
- *
- * Double-submit cookie pattern (stateless, no session required).
- *
- *   cookie:  __csrf=<token>
- *   header:  x-csrf-token: <token>   (or form field _csrf)
- *
- * Both values MUST match AND the token's HMAC signature MUST verify.
- *
- * Internally delegates to `Bun.CSRF.generate` / `Bun.CSRF.verify` when
- * available (Bun ≥ 1.3). Verified present and stable in Bun 1.3.10:
- *   Bun.CSRF.generate(secret, { maxAge? }) → URL-safe base64 token
- *   Bun.CSRF.verify(token, { secret, maxAge? }) → boolean
- *
- * A pure `crypto.subtle` + `crypto.getRandomValues` fallback is provided for
- * compatibility. The exported `csrf()` API is identical either way.
- *
- * @example
- * ```ts
- * import { csrf } from "@mandujs/core/middleware";
- *
- * export default Mandu.filling()
- *   .use(csrf({ secret: process.env.CSRF_SECRET! }))
- *   .post((ctx) => ctx.ok({ ok: true }));
- * ```
- */
-import type { ManduContext, CookieOptions } from "../filling/context";
-
-// ========== Types ==========
-
-export interface CsrfMiddlewareOptions {
-  /** Required. Used to HMAC-sign CSRF tokens. */
-  secret: string;
-  /** Cookie name. Default: "__csrf". */
-  cookieName?: string;
-  /** Header name checked on unsafe methods. Default: "x-csrf-token". */
-  headerName?: string;
-  /** Form field name checked as fallback. Default: "_csrf". */
-  fieldName?: string;
-  /** Methods that skip validation. Default: ["GET","HEAD","OPTIONS"]. */
-  safeMethods?: string[];
-  /** Cookie attribute overrides (merged with sensible defaults). */
-  cookieOptions?: {
-    /** Default: false — client JS needs to read the token to submit it in a header. */
-    httpOnly?: boolean;
-    /** Default: NODE_ENV === "production". */
-    secure?: boolean;
-    /** Default: "lax". */
-    sameSite?: "strict" | "lax" | "none";
-    /** Default: "/". */
-    path?: string;
-    /** Default: 86400 (1 day). */
-    maxAge?: number;
-    /** Optional cookie domain. */
-    domain?: string;
-  };
-}
-
-/** Middleware signature matching `jwt.ts`. */
-type Middleware = (ctx: ManduContext) => Promise<Response | void>;
-
-// ========== Implementation ==========
-
-const DEFAULT_COOKIE_NAME = "__csrf";
-const DEFAULT_HEADER_NAME = "x-csrf-token";
-const DEFAULT_FIELD_NAME = "_csrf";
-const DEFAULT_SAFE_METHODS: readonly string[] = ["GET", "HEAD", "OPTIONS"];
-const DEFAULT_MAX_AGE = 86400; // 1 day
-/** Guard against memory-exhaustion attacks via oversized tokens. */
-const MAX_TOKEN_LENGTH = 512;
-
-/**
- * CSRF protection middleware (double-submit cookie pattern).
- *
- * Behavior:
- *  1. Ensures a signed CSRF token cookie is present. Issues a fresh one if
- *     the existing cookie is missing or its signature fails to verify.
- *  2. For safe methods (GET/HEAD/OPTIONS): continues without further checks.
- *  3. For unsafe methods: reads the submitted token from the configured
- *     header (preferred) or form field (fallback for form content types),
- *     then confirms:
- *       (a) submitted token === cookie token (constant-time equality)
- *       (b) the token's HMAC signature still verifies with `secret`
- *     Any failure returns 403 without leaking which check failed.
- */
-export function csrf(options: CsrfMiddlewareOptions): Middleware {
-  if (!options.secret || typeof options.secret !== "string") {
-    throw new Error("[Mandu CSRF] `secret` is required and must be a non-empty string");
-  }
-
-  const {
-    secret,
-    cookieName = DEFAULT_COOKIE_NAME,
-    headerName = DEFAULT_HEADER_NAME,
-    fieldName = DEFAULT_FIELD_NAME,
-    safeMethods = DEFAULT_SAFE_METHODS,
-  } = options;
-
-  const normalizedSafeMethods = new Set(safeMethods.map((m) => m.toUpperCase()));
-  const cookieOptions = resolveCookieOptions(options.cookieOptions);
-  const maxAgeSec = cookieOptions.maxAge ?? DEFAULT_MAX_AGE;
-
-  return async (ctx: ManduContext): Promise<Response | void> => {
-    const method = ctx.request.method.toUpperCase();
-
-    // 1. Ensure a valid CSRF cookie is present for the next unsafe request.
-    const existing = ctx.cookies.get(cookieName);
-    let activeCookieToken: string | null = null;
-
-    if (typeof existing === "string" && isAcceptableToken(existing)) {
-      const valid = await verifyToken(existing, secret, maxAgeSec);
-      if (valid) {
-        // Keep existing token (no unnecessary rotation).
-        activeCookieToken = existing;
-      }
-    }
-
-    if (activeCookieToken === null) {
-      activeCookieToken = await generateToken(secret, maxAgeSec);
-      ctx.cookies.set(cookieName, activeCookieToken, cookieOptions);
-    }
-
-    // 2. Safe methods pass through.
-    if (normalizedSafeMethods.has(method)) {
-      return;
-    }
-
-    // 3. Unsafe methods: read + validate submitted token.
-    const submitted = await extractSubmittedToken(ctx, headerName, fieldName);
-
-    if (!submitted || !isAcceptableToken(submitted)) {
-      return ctx.forbidden("CSRF token missing or invalid");
-    }
-
-    // Constant-time equality between submitted token and cookie token.
-    if (!safeEqual(submitted, activeCookieToken)) {
-      return ctx.forbidden("CSRF token missing or invalid");
-    }
-
-    // HMAC verification on the submitted token (prevents forged cookies from
-    // sibling subdomains since they cannot sign with our secret).
-    const verified = await verifyToken(submitted, secret, maxAgeSec);
-    if (!verified) {
-      return ctx.forbidden("CSRF token missing or invalid");
-    }
-
-    // Valid — continue.
-  };
-}
-
-// ========== Helpers ==========
-
-/**
- * Resolve cookie options with production-safe defaults.
- *
- * `httpOnly: false` by default: a CSRF token cookie needs to be readable by
- * client-side JS so the app can echo it back in the header. Callers who set
- * the token from the server (e.g. via a hidden form field) may opt into
- * `httpOnly: true`.
- */
-function resolveCookieOptions(overrides?: CsrfMiddlewareOptions["cookieOptions"]): CookieOptions {
-  const isProd = typeof process !== "undefined" && process.env?.NODE_ENV === "production";
-  return {
-    httpOnly: overrides?.httpOnly ?? false,
-    secure: overrides?.secure ?? isProd,
-    sameSite: overrides?.sameSite ?? "lax",
-    path: overrides?.path ?? "/",
-    maxAge: overrides?.maxAge ?? DEFAULT_MAX_AGE,
-    domain: overrides?.domain,
-  };
-}
-
-/** Read submitted token from header, falling back to form field if applicable. */
-async function extractSubmittedToken(
-  ctx: ManduContext,
-  headerName: string,
-  fieldName: string
-): Promise<string | null> {
-  // Header wins when present (cheap, safe, no body consumption).
-  const headerVal = ctx.headers.get(headerName);
-  if (typeof headerVal === "string" && headerVal.length > 0) {
-    return headerVal;
-  }
-
-  // Form fallback: only when the request advertises a form-like content type.
-  // JSON bodies are NOT scanned — header submission is the canonical path.
-  const contentType = (ctx.headers.get("content-type") ?? "").toLowerCase();
-  const isForm =
-    contentType.includes("application/x-www-form-urlencoded") ||
-    contentType.includes("multipart/form-data");
-  if (!isForm) return null;
-
-  try {
-    // Clone so downstream handlers can still read the body.
-    const form = await ctx.request.clone().formData();
-    const fieldVal = form.get(fieldName);
-    return typeof fieldVal === "string" ? fieldVal : null;
-  } catch {
-    return null;
-  }
-}
-
-/** Validate token shape before running expensive crypto. */
-function isAcceptableToken(token: string): boolean {
-  return (
-    typeof token === "string" &&
-    token.length > 0 &&
-    token.length <= MAX_TOKEN_LENGTH
-  );
-}
-
-/**
- * Constant-time string comparison to avoid timing-oracle attacks.
- * Returns `false` immediately on length mismatch (lengths themselves are not
- * secret for our fixed-format tokens), then XORs character codes over the
- * full length before folding into a single diff bit.
- */
-function safeEqual(a: string, b: string): boolean {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) {
-    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return diff === 0;
-}
-
-// ========== Token crypto (Bun.CSRF preferred, fallback to crypto.subtle) ==========
-
-/**
- * Runtime capability probe for `Bun.CSRF`. Done once at module load — avoids
- * re-checking on every request and allows non-Bun runtimes to use the
- * fallback implementation.
- */
-const bunCsrf = resolveBunCsrf();
-
-function resolveBunCsrf():
-  | {
-      generate: (secret: string, options?: { maxAge?: number }) => string;
-      verify: (token: string, options: { secret: string; maxAge?: number }) => boolean;
-    }
-  | null {
-  if (typeof globalThis === "undefined") return null;
-  const bun = (globalThis as { Bun?: { CSRF?: unknown } }).Bun;
-  if (!bun || typeof bun !== "object" || bun === null) return null;
-  const csrfApi = (bun as { CSRF?: unknown }).CSRF;
-  if (!csrfApi || typeof csrfApi !== "object") return null;
-  const api = csrfApi as {
-    generate?: unknown;
-    verify?: unknown;
-  };
-  if (typeof api.generate !== "function" || typeof api.verify !== "function") {
-    return null;
-  }
-  return api as {
-    generate: (secret: string, options?: { maxAge?: number }) => string;
-    verify: (token: string, options: { secret: string; maxAge?: number }) => boolean;
-  };
-}
-
-async function generateToken(secret: string, maxAgeSec: number): Promise<string> {
-  if (bunCsrf) {
-    // Bun.CSRF handles timestamp + random + HMAC in native code.
-    return bunCsrf.generate(secret, { maxAge: maxAgeSec });
-  }
-  return fallbackGenerate(secret);
-}
-
-async function verifyToken(token: string, secret: string, maxAgeSec: number): Promise<boolean> {
-  if (bunCsrf) {
-    try {
-      return bunCsrf.verify(token, { secret, maxAge: maxAgeSec });
-    } catch {
-      return false;
-    }
-  }
-  return fallbackVerify(token, secret);
-}
-
-// ----- Fallback (no Bun.CSRF available) -----
-
-/**
- * Token format: `<random-b64url>.<hmac-b64url>`
- *   - random: 32 bytes via `crypto.getRandomValues`
- *   - hmac:   HMAC-SHA256(random, secret)
- *
- * Same pattern as `packages/core/src/filling/session.ts` (`hmacSign`,
- * line 216-227) so we don't introduce a second crypto code path.
- */
-async function fallbackGenerate(secret: string): Promise<string> {
-  const random = new Uint8Array(32);
-  crypto.getRandomValues(random);
-  const randomPart = base64UrlEncode(random);
-  const sig = await hmacSignB64Url(randomPart, secret);
-  return `${randomPart}.${sig}`;
-}
-
-async function fallbackVerify(token: string, secret: string): Promise<boolean> {
-  const dotIdx = token.lastIndexOf(".");
-  if (dotIdx <= 0 || dotIdx === token.length - 1) return false;
-  const randomPart = token.slice(0, dotIdx);
-  const signature = token.slice(dotIdx + 1);
-  if (!randomPart || !signature) return false;
-  const expected = await hmacSignB64Url(randomPart, secret);
-  // Constant-time comparison on signatures.
-  return safeEqual(signature, expected);
-}
-
-async function hmacSignB64Url(data: string, secret: string): Promise<string> {
-  const encoder = new TextEncoder();
-  const key = await crypto.subtle.importKey(
-    "raw",
-    encoder.encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
-  return base64UrlEncode(new Uint8Array(sig));
-}
-
-function base64UrlEncode(bytes: Uint8Array): string {
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
-  }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
+/**
+ * CSRF Middleware Plugin
+ *
+ * Double-submit cookie pattern (stateless, no session required).
+ *
+ *   cookie:  __csrf=<token>
+ *   header:  x-csrf-token: <token>   (or form field _csrf)
+ *
+ * Both values MUST match AND the token's HMAC signature MUST verify.
+ *
+ * Internally delegates to `Bun.CSRF.generate` / `Bun.CSRF.verify` when
+ * available (Bun ≥ 1.3). Verified present and stable in Bun 1.3.10:
+ *   Bun.CSRF.generate(secret, { maxAge? }) → URL-safe base64 token
+ *   Bun.CSRF.verify(token, { secret, maxAge? }) → boolean
+ *
+ * A pure `crypto.subtle` + `crypto.getRandomValues` fallback is provided for
+ * compatibility. The exported `csrf()` API is identical either way.
+ *
+ * @example
+ * ```ts
+ * import { csrf } from "@mandujs/core/middleware";
+ *
+ * export default Mandu.filling()
+ *   .use(csrf({ secret: process.env.CSRF_SECRET! }))
+ *   .post((ctx) => ctx.ok({ ok: true }));
+ * ```
+ */
+import type { ManduContext, CookieOptions } from "../filling/context";
+
+// ========== Types ==========
+
+export interface CsrfMiddlewareOptions {
+  /** Required. Used to HMAC-sign CSRF tokens. */
+  secret: string;
+  /** Cookie name. Default: "__csrf". */
+  cookieName?: string;
+  /** Header name checked on unsafe methods. Default: "x-csrf-token". */
+  headerName?: string;
+  /** Form field name checked as fallback. Default: "_csrf". */
+  fieldName?: string;
+  /** Methods that skip validation. Default: ["GET","HEAD","OPTIONS"]. */
+  safeMethods?: string[];
+  /** Cookie attribute overrides (merged with sensible defaults). */
+  cookieOptions?: {
+    /** Default: false — client JS needs to read the token to submit it in a header. */
+    httpOnly?: boolean;
+    /** Default: NODE_ENV === "production". */
+    secure?: boolean;
+    /** Default: "lax". */
+    sameSite?: "strict" | "lax" | "none";
+    /** Default: "/". */
+    path?: string;
+    /** Default: 86400 (1 day). */
+    maxAge?: number;
+    /** Optional cookie domain. */
+    domain?: string;
+  };
+}
+
+/** Middleware signature matching `jwt.ts`. */
+type Middleware = (ctx: ManduContext) => Promise<Response | void>;
+
+// ========== Implementation ==========
+
+const DEFAULT_COOKIE_NAME = "__csrf";
+const DEFAULT_HEADER_NAME = "x-csrf-token";
+const DEFAULT_FIELD_NAME = "_csrf";
+const DEFAULT_SAFE_METHODS: readonly string[] = ["GET", "HEAD", "OPTIONS"];
+const DEFAULT_MAX_AGE = 86400; // 1 day
+/** Guard against memory-exhaustion attacks via oversized tokens. */
+const MAX_TOKEN_LENGTH = 512;
+
+/**
+ * CSRF protection middleware (double-submit cookie pattern).
+ *
+ * Behavior:
+ *  1. Ensures a signed CSRF token cookie is present. Issues a fresh one if
+ *     the existing cookie is missing or its signature fails to verify.
+ *  2. For safe methods (GET/HEAD/OPTIONS): continues without further checks.
+ *  3. For unsafe methods: reads the submitted token from the configured
+ *     header (preferred) or form field (fallback for form content types),
+ *     then confirms:
+ *       (a) submitted token === cookie token (constant-time equality)
+ *       (b) the token's HMAC signature still verifies with `secret`
+ *     Any failure returns 403 without leaking which check failed.
+ */
+export function csrf(options: CsrfMiddlewareOptions): Middleware {
+  if (!options.secret || typeof options.secret !== "string") {
+    throw new Error("[Mandu CSRF] `secret` is required and must be a non-empty string");
+  }
+
+  const {
+    secret,
+    cookieName = DEFAULT_COOKIE_NAME,
+    headerName = DEFAULT_HEADER_NAME,
+    fieldName = DEFAULT_FIELD_NAME,
+    safeMethods = DEFAULT_SAFE_METHODS,
+  } = options;
+
+  const normalizedSafeMethods = new Set(safeMethods.map((m) => m.toUpperCase()));
+  const cookieOptions = resolveCookieOptions(options.cookieOptions);
+  const maxAgeSec = cookieOptions.maxAge ?? DEFAULT_MAX_AGE;
+
+  return async (ctx: ManduContext): Promise<Response | void> => {
+    const method = ctx.request.method.toUpperCase();
+
+    // 1. Ensure a valid CSRF cookie is present for the next unsafe request.
+    const existing = ctx.cookies.get(cookieName);
+    let activeCookieToken: string | null = null;
+
+    if (typeof existing === "string" && isAcceptableToken(existing)) {
+      const valid = await verifyToken(existing, secret, maxAgeSec);
+      if (valid) {
+        // Keep existing token (no unnecessary rotation).
+        activeCookieToken = existing;
+      }
+    }
+
+    if (activeCookieToken === null) {
+      activeCookieToken = await generateToken(secret, maxAgeSec);
+      ctx.cookies.set(cookieName, activeCookieToken, cookieOptions);
+    }
+
+    // 2. Safe methods pass through.
+    if (normalizedSafeMethods.has(method)) {
+      return;
+    }
+
+    // 3. Unsafe methods: read + validate submitted token.
+    const submitted = await extractSubmittedToken(ctx, headerName, fieldName);
+
+    if (!submitted || !isAcceptableToken(submitted)) {
+      return ctx.forbidden("CSRF token missing or invalid");
+    }
+
+    // Constant-time equality between submitted token and cookie token.
+    if (!safeEqual(submitted, activeCookieToken)) {
+      return ctx.forbidden("CSRF token missing or invalid");
+    }
+
+    // HMAC verification on the submitted token (prevents forged cookies from
+    // sibling subdomains since they cannot sign with our secret).
+    const verified = await verifyToken(submitted, secret, maxAgeSec);
+    if (!verified) {
+      return ctx.forbidden("CSRF token missing or invalid");
+    }
+
+    // Valid — continue.
+  };
+}
+
+// ========== Helpers ==========
+
+/**
+ * Resolve cookie options with production-safe defaults.
+ *
+ * `httpOnly: false` by default: a CSRF token cookie needs to be readable by
+ * client-side JS so the app can echo it back in the header. Callers who set
+ * the token from the server (e.g. via a hidden form field) may opt into
+ * `httpOnly: true`.
+ */
+function resolveCookieOptions(overrides?: CsrfMiddlewareOptions["cookieOptions"]): CookieOptions {
+  const isProd = typeof process !== "undefined" && process.env?.NODE_ENV === "production";
+  return {
+    httpOnly: overrides?.httpOnly ?? false,
+    secure: overrides?.secure ?? isProd,
+    sameSite: overrides?.sameSite ?? "lax",
+    path: overrides?.path ?? "/",
+    maxAge: overrides?.maxAge ?? DEFAULT_MAX_AGE,
+    domain: overrides?.domain,
+  };
+}
+
+/** Read submitted token from header, falling back to form field if applicable. */
+async function extractSubmittedToken(
+  ctx: ManduContext,
+  headerName: string,
+  fieldName: string
+): Promise<string | null> {
+  // Header wins when present (cheap, safe, no body consumption).
+  const headerVal = ctx.headers.get(headerName);
+  if (typeof headerVal === "string" && headerVal.length > 0) {
+    return headerVal;
+  }
+
+  // Form fallback: only when the request advertises a form-like content type.
+  // JSON bodies are NOT scanned — header submission is the canonical path.
+  const contentType = (ctx.headers.get("content-type") ?? "").toLowerCase();
+  const isForm =
+    contentType.includes("application/x-www-form-urlencoded") ||
+    contentType.includes("multipart/form-data");
+  if (!isForm) return null;
+
+  try {
+    // Clone so downstream handlers can still read the body.
+    const form = await ctx.request.clone().formData();
+    const fieldVal = form.get(fieldName);
+    return typeof fieldVal === "string" ? fieldVal : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Validate token shape before running expensive crypto. */
+function isAcceptableToken(token: string): boolean {
+  return (
+    typeof token === "string" &&
+    token.length > 0 &&
+    token.length <= MAX_TOKEN_LENGTH
+  );
+}
+
+/**
+ * Constant-time string comparison to avoid timing-oracle attacks.
+ * Returns `false` immediately on length mismatch (lengths themselves are not
+ * secret for our fixed-format tokens), then XORs character codes over the
+ * full length before folding into a single diff bit.
+ */
+function safeEqual(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+
+// ========== Token crypto (Bun.CSRF preferred, fallback to crypto.subtle) ==========
+
+/**
+ * Runtime capability probe for `Bun.CSRF`. Done once at module load — avoids
+ * re-checking on every request and allows non-Bun runtimes to use the
+ * fallback implementation.
+ */
+const bunCsrf = resolveBunCsrf();
+
+function resolveBunCsrf():
+  | {
+      generate: (secret: string, options?: { maxAge?: number }) => string;
+      verify: (token: string, options: { secret: string; maxAge?: number }) => boolean;
+    }
+  | null {
+  if (typeof globalThis === "undefined") return null;
+  const bun = (globalThis as { Bun?: { CSRF?: unknown } }).Bun;
+  if (!bun || typeof bun !== "object" || bun === null) return null;
+  const csrfApi = (bun as { CSRF?: unknown }).CSRF;
+  if (!csrfApi || typeof csrfApi !== "object") return null;
+  const api = csrfApi as {
+    generate?: unknown;
+    verify?: unknown;
+  };
+  if (typeof api.generate !== "function" || typeof api.verify !== "function") {
+    return null;
+  }
+  return api as {
+    generate: (secret: string, options?: { maxAge?: number }) => string;
+    verify: (token: string, options: { secret: string; maxAge?: number }) => boolean;
+  };
+}
+
+async function generateToken(secret: string, maxAgeSec: number): Promise<string> {
+  if (bunCsrf) {
+    // Bun.CSRF handles timestamp + random + HMAC in native code.
+    return bunCsrf.generate(secret, { maxAge: maxAgeSec });
+  }
+  return fallbackGenerate(secret);
+}
+
+async function verifyToken(token: string, secret: string, maxAgeSec: number): Promise<boolean> {
+  if (bunCsrf) {
+    try {
+      return bunCsrf.verify(token, { secret, maxAge: maxAgeSec });
+    } catch {
+      return false;
+    }
+  }
+  return fallbackVerify(token, secret);
+}
+
+// ----- Fallback (no Bun.CSRF available) -----
+
+/**
+ * Token format: `<random-b64url>.<hmac-b64url>`
+ *   - random: 32 bytes via `crypto.getRandomValues`
+ *   - hmac:   HMAC-SHA256(random, secret)
+ *
+ * Same pattern as `packages/core/src/filling/session.ts` (`hmacSign`,
+ * line 216-227) so we don't introduce a second crypto code path.
+ */
+async function fallbackGenerate(secret: string): Promise<string> {
+  const random = new Uint8Array(32);
+  crypto.getRandomValues(random);
+  const randomPart = base64UrlEncode(random);
+  const sig = await hmacSignB64Url(randomPart, secret);
+  return `${randomPart}.${sig}`;
+}
+
+async function fallbackVerify(token: string, secret: string): Promise<boolean> {
+  const dotIdx = token.lastIndexOf(".");
+  if (dotIdx <= 0 || dotIdx === token.length - 1) return false;
+  const randomPart = token.slice(0, dotIdx);
+  const signature = token.slice(dotIdx + 1);
+  if (!randomPart || !signature) return false;
+  const expected = await hmacSignB64Url(randomPart, secret);
+  // Constant-time comparison on signatures.
+  return safeEqual(signature, expected);
+}
+
+async function hmacSignB64Url(data: string, secret: string): Promise<string> {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
+  return base64UrlEncode(new Uint8Array(sig));
+}
+
+function base64UrlEncode(bytes: Uint8Array): string {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}