@revenexx/cover 0.1.8 → 0.1.9

package/nuxt.config.ts

@@ -72,6 +72,9 @@ export default defineNuxtConfig({
 		typesensePort: 8108,
 		typesenseProtocol: "http",
 		typesenseApiKey: "xyz",
+		// HMAC secret for the stateless checkout session tokens — override
+		// via NUXT_CHECKOUT_SESSION_SECRET in multi-tenant deployments.
+		checkoutSessionSecret: "",
 		public: {
 			// Cart state keys the layer's stores read — apps may override, but
 			// the layer must ship working defaults (an undefined TTL turns the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revenexx/cover",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Cover \u2014 revenexx design system for Nuxt. Distributed as a Nuxt layer: generic UI components, theming tokens and stores shared by the demo shop, custom storefronts and the Blokkli theme.",
   "type": "module",
   "main": "./nuxt.config.ts",

package/server/utils/checkoutSession.ts

@@ -1,38 +1,76 @@
-import { randomBytes } from "node:crypto";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 
 const TTL_MS = 2 * 60 * 60 * 1000; // 2 hours
 
 /**
- * In-memory token store: token → expiry timestamp.
+ * Stateless, HMAC-signed checkout session tokens: `{expiry}.{nonce}.{sig}`.
  *
- * Tokens are generated when the checkout flow is loaded, and consumed
- * (one-time use) when an order is submitted. This avoids relying on
- * browser cookies, which can be stripped by reverse proxies.
+ * Deployed sites run multiple runtime containers — an in-memory token store
+ * only validates on the instance that issued the token. A signed token
+ * validates on every instance without shared state. Strict one-time use is
+ * therefore best-effort (per-instance replay cache); order dedup is anchored
+ * by the payments app's idempotency key, which is this same token.
  *
- * Note: in-memory state is per-process. For multi-instance deployments
- * replace this with a shared store (Redis, DB, etc.).
+ * The signing secret is shared by all instances: NUXT_CHECKOUT_SESSION_SECRET
+ * (runtimeConfig.checkoutSessionSecret), falling back to the tenant API key.
  */
-const tokenStore = new Map<string, number>();
+function sessionSecret(): string {
+	const config = useRuntimeConfig();
+	return (config.checkoutSessionSecret as string)
+		|| (config.revenexxApiKey as string)
+		|| "cover-checkout-session";
+}
+
+function sign(payload: string): string {
+	return createHmac("sha256", sessionSecret()).update(payload).digest("hex");
+}
+
+/** Per-instance replay cache (best-effort one-time use). */
+const consumed = new Map<string, number>();
+
+function pruneConsumed(): void {
+	const now = Date.now();
+	for (const [token, expiry] of consumed) {
+		if (now > expiry) {
+			consumed.delete(token);
+		}
+	}
+}
 
 export function createCheckoutSession(): string {
-	const token = randomBytes(32).toString("hex");
-	tokenStore.set(token, Date.now() + TTL_MS);
-	return token;
+	const expiry = Date.now() + TTL_MS;
+	const nonce = randomBytes(16).toString("hex");
+	const payload = `${expiry}.${nonce}`;
+	return `${payload}.${sign(payload)}`;
 }
 
 /**
- * Validates and consumes a checkout session token (one-time use).
- * Returns true if the token was valid and has been removed from the store.
+ * Validates a checkout session token (signature + expiry) and marks it
+ * consumed on this instance.
  */
 export function consumeCheckoutSession(token: string): boolean {
 	if (!token) {
 		return false;
 	}
-	const expiry = tokenStore.get(token);
-	if (expiry === undefined || Date.now() > expiry) {
-		tokenStore.delete(token);
+	const parts = token.split(".");
+	if (parts.length !== 3) {
+		return false;
+	}
+	const [expiryRaw, nonce, signature] = parts as [string, string, string];
+	const expected = sign(`${expiryRaw}.${nonce}`);
+	const a = Buffer.from(signature, "utf8");
+	const b = Buffer.from(expected, "utf8");
+	if (a.length !== b.length || !timingSafeEqual(a, b)) {
+		return false;
+	}
+	const expiry = Number(expiryRaw);
+	if (!Number.isFinite(expiry) || Date.now() > expiry) {
+		return false;
+	}
+	if (consumed.has(token)) {
 		return false;
 	}
-	tokenStore.delete(token);
+	pruneConsumed();
+	consumed.set(token, expiry);
 	return true;
 }