pipework 0.251.0 → 0.252.1

package/src/auth/auth/sessions.ts

@@ -0,0 +1,565 @@
+import { verify as cryptoVerify } from 'node:crypto'
+import { SignJWT, jwtVerify } from 'jose'
+import { parseExpiry } from './parse-expiry.js'
+import { sql } from '../../data/db/sql.js'
+import type { DB } from '../../data/db/index.js'
+import { UnauthorizedError, AuthUnavailableError, isPipeworkError } from '../../core/errors/index.js'
+import type { AuthStrategy, AuthRequest, AuthContext, BaseAuth } from './types.js'
+import { assertUuid } from './uuid.js'
+import type { CookieConfig } from './cookie.js'
+import { resolveCookieConfig, buildSetCookieHeader, buildClearCookieHeader, parseCookieHeader, assertSameSiteRequest } from './cookie.js'
+import { checkSigningKeys, importSigningKey } from './signing-keys.js'
+import type { ResolvedCookieConfig } from './cookie.js'
+import type { HttpRequest, HttpResponse } from '../../request/http/types.js'
+import { refuseScopedHandle } from '../tenant/scoped-db.js'
+
+/** Session configuration — signing keys, issuer, audience, token TTLs, refresh rotation. */
+export interface SessionConfig {
+  readonly signing: { algorithm: 'ES256'; privateKey: string; publicKey: string }
+  readonly issuer: string
+  readonly audience: string
+  /**
+   * `cookie` also delivers the access token as an HttpOnly cookie (default name `__pipework_access`,
+   * SameSite Lax so a link from another site arrives signed in, Path `/`), set and cleared with the refresh cookie.
+   */
+  readonly accessToken: { expiresIn: string; cookie?: CookieConfig }
+  readonly refreshToken: { expiresIn: string; rotateOnUse: boolean; reuseDetection: boolean; cookie?: CookieConfig }
+  readonly versionCheck: boolean
+  readonly versionCacheTtlMs?: number
+  readonly resolveRoles?: (db: DB, userId: string, tenantId: string) => Promise<string[]>
+  readonly environment?: string
+  /** Origins allowed to send the refresh cookie to `refreshHttp` / `revokeHttp` / `revokeRefreshCookie` / `revokeAllHttp`, besides the request's own host. */
+  readonly trustedOrigins?: readonly string[]
+}
+
+/** Access + refresh token pair returned by issueTokens(). */
+export interface TokenPair {
+  readonly accessToken: string
+  readonly refreshToken: string
+  readonly expiresIn: number
+}
+
+/** Decoded JWT payload — userId, tenantId, roles, version. */
+export interface TokenPayload {
+  readonly sub: string
+  readonly tid: string
+  readonly av: number
+  readonly roles: string[] | undefined
+}
+
+/** Result from HTTP token operations — the token pair plus whether cookies were set. */
+export interface HttpTokenResult {
+  readonly accessToken: string
+  readonly expiresIn: number
+}
+
+/**
+ * The committed result of a refresh transaction. `refresh()` translates the
+ * non-`ok` variants into thrown `UnauthorizedError`s *after* the transaction
+ * commits, so a reuse-revocation is never rolled back by the signalling throw.
+ */
+type RefreshOutcome =
+  | { readonly kind: 'ok'; readonly pair: TokenPair }
+  | { readonly kind: 'invalid' }
+  | { readonly kind: 'expired' }
+  | { readonly kind: 'reuse' }
+
+export type { HttpRequest, HttpResponse }
+
+/** What `sessions.strategy()` authenticates: the token's user and org, its roles, and where the token came from. */
+export type SessionAuth = BaseAuth & { readonly roles: readonly string[]; readonly via: 'cookie' | 'header' }
+
+/** Options for `sessions.strategy()`. */
+export interface SessionStrategyOptions {
+  /** Origins (e.g. `https://app.example.com`) besides the request's own host allowed to send cookie-authenticated requests. */
+  readonly trustedOrigins?: readonly string[]
+  /**
+   * A cookie-authenticated GET/HEAD/OPTIONS that a browser marks cross-site (and not a top-level navigation,
+   * and whose Origin is neither ours nor trusted) is refused with 403 under `'refuse'` (default); `'allow'`
+   * lets such reads through. Bearer-header auth is never checked.
+   */
+  readonly crossSiteReads?: 'refuse' | 'allow'
+}
+
+/** Session manager with JWT issue/refresh/revoke lifecycle and cookie-based HTTP helpers. */
+export interface Sessions {
+  issueTokens(db: DB, user: { id: string; tenantId: string; roles?: readonly string[] }): Promise<TokenPair>
+  refresh(db: DB, refreshToken: string): Promise<TokenPair>
+  revokeAll(db: DB, userId: string): Promise<void>
+  bumpVersion(db: DB, userId: string): Promise<void>
+  verifyAccessToken(token: string): Promise<TokenPayload>
+  /**
+   * The user a token these sessions signed names, checking signature, issuer and audience but not
+   * expiry or revocation; null otherwise. Synchronous and without the database, for rate-limit
+   * keys — never for authorization.
+   */
+  signedSubject(token: string): string | null
+  checkVersion(db: DB, userId: string, tokenVersion: number): Promise<boolean>
+  cleanExpiredTokens(db: DB): Promise<number>
+  /**
+   * The auth strategy for these sessions: `Authorization: Bearer` first, else the access cookie when
+   * `accessToken.cookie` is set. A cookie-authenticated request must come from the
+   * API's own origin or a trusted origin, else 403 `CROSS_SITE_REQUEST`; a read (GET/HEAD/OPTIONS) also passes as a
+   * top-level navigation or with no Sec-Fetch-Site and no Origin (see `crossSiteReads`). It never refreshes: the client
+   * calls the refresh route on a 401 "Access token expired" (a refresh here would trip reuse detection
+   * on concurrent requests). On an optional-auth route a token it refuses (expired, revoked, not ours)
+   * reads as signed out.
+   */
+  strategy(options?: SessionStrategyOptions): AuthStrategy<SessionAuth>
+  /** Throws 403 `CROSS_SITE_REQUEST` when a cookie-authenticated request is cross-site by the rule `refreshHttp` applies. */
+  assertSameSiteCookie(request: Pick<HttpRequest, 'headers'> & { readonly method?: string }): void
+  /** Revokes the refresh token in the request's refresh cookie, if any; sets no cookie. Refuses a cross-site request like `refreshHttp`. */
+  revokeRefreshCookie(db: DB, request: Pick<HttpRequest, 'headers'> & { readonly method?: string }): Promise<void>
+  issueTokensHttp(response: HttpResponse, db: DB, user: { id: string; tenantId: string; roles?: readonly string[] }): Promise<HttpTokenResult>
+  refreshHttp(response: HttpResponse, db: DB, request: Pick<HttpRequest, 'headers'> & { readonly method?: string }): Promise<HttpTokenResult>
+  revokeHttp(response: HttpResponse, db: DB, request: Pick<HttpRequest, 'headers'> & { readonly method?: string }): Promise<void>
+  /** Pass `request` to have the cookie-site check run before anything is revoked. */
+  revokeAllHttp(response: HttpResponse, db: DB, userId: string, request?: Pick<HttpRequest, 'headers'> & { readonly method?: string }): Promise<void>
+}
+
+/**
+ * Creates a Sessions manager with JWT access/refresh tokens, rotation, reuse detection, and cookie helpers.
+ * Its tables come from blueprint `sessions: {}`; `tenantId` must be a uuid.
+ */
+export function createSessions(config: SessionConfig): Sessions {
+  const environment = config.environment ?? 'production'
+  if (environment === 'production') {
+    validateSigningKeys(config)
+  }
+
+  const verifyKey = checkSigningKeys(config.signing, 'createSessions')
+  let privateKey: CryptoKey | null = null
+  let publicKey: CryptoKey | null = null
+  const versionCache = new Map<string, { version: number; expiresAt: number }>()
+  const cacheTtl = config.versionCacheTtlMs ?? 60_000
+
+  async function getPrivateKey(): Promise<CryptoKey> {
+    if (!privateKey) privateKey = await importSigningKey('private', config.signing, 'createSessions')
+    return privateKey
+  }
+
+  async function getPublicKey(): Promise<CryptoKey> {
+    if (!publicKey) publicKey = await importSigningKey('public', config.signing, 'createSessions')
+    return publicKey
+  }
+
+
+  async function getOrCreateVersion(db: DB, userId: string): Promise<number> {
+    const rows = await db.execute(
+      sql`INSERT INTO pipework_auth_versions (user_id, version) VALUES (${userId}, 1)
+          ON CONFLICT (user_id) DO NOTHING
+          RETURNING version`
+    )
+    if (rows.length > 0) return rows[0]!['version'] as number
+
+    const existing = await db.execute(
+      sql`SELECT version FROM pipework_auth_versions WHERE user_id = ${userId}`
+    )
+    const row = existing[0]
+    if (row === undefined) return 1
+    return row['version'] as number
+  }
+
+  async function issueTokens(
+    db: DB,
+    user: { id: string; tenantId: string; roles?: readonly string[] },
+    familyId: string = crypto.randomUUID(),
+  ): Promise<TokenPair> {
+    assertUuid(user.tenantId, 'tenantId')
+    const key = await getPrivateKey()
+    const version = config.versionCheck ? await getOrCreateVersion(db, user.id) : 1
+    const expiresInSeconds = parseExpiry(config.accessToken.expiresIn)
+
+    const accessToken = await new SignJWT({ tid: user.tenantId, av: version, roles: user.roles })
+      .setProtectedHeader({ alg: config.signing.algorithm })
+      .setSubject(user.id)
+      .setIssuer(config.issuer)
+      .setAudience(config.audience)
+      .setIssuedAt()
+      .setExpirationTime(`${expiresInSeconds}s`)
+      .sign(key)
+
+    const refreshTokenValue = crypto.randomUUID()
+    const refreshHash = await hashToken(refreshTokenValue)
+    const refreshExpiresIn = parseExpiry(config.refreshToken.expiresIn)
+    const expiresAt = new Date(Date.now() + refreshExpiresIn * 1000)
+
+    await db.execute(
+      sql`INSERT INTO pipework_refresh_tokens (user_id, tenant_id, token_hash, family_id, expires_at)
+          VALUES (${user.id}, ${user.tenantId}, ${refreshHash}, ${familyId}::uuid, ${expiresAt.toISOString()}::timestamptz)`
+    )
+
+    return { accessToken, refreshToken: refreshTokenValue, expiresIn: expiresInSeconds }
+  }
+
+  async function refresh(db: DB, refreshToken: string): Promise<TokenPair> {
+    const tokenHash = await hashToken(refreshToken)
+
+    // The transaction must COMMIT in every branch, including reuse. Signalling
+    // reuse by throwing from inside the transaction would roll back the very
+    // family-revocation it just performed — so the transaction returns an
+    // outcome and the throw happens after it commits.
+    const outcome = await db.transaction(async (tx): Promise<RefreshOutcome> => {
+      const rows = await tx.execute(
+        sql`SELECT id, user_id, tenant_id, family_id, revoked_at, expires_at
+            FROM pipework_refresh_tokens
+            WHERE token_hash = ${tokenHash}
+            FOR UPDATE`
+      )
+
+      if (rows.length === 0) {
+        return { kind: 'invalid' }
+      }
+
+      const row = rows[0]!
+      const userId = row['user_id'] as string
+      const tenantId = row['tenant_id'] as string
+      const familyId = row['family_id'] as string
+      const revokedAt = row['revoked_at'] as string | null
+      const expiresAt = new Date(row['expires_at'] as string)
+
+      if (expiresAt < new Date()) {
+        return { kind: 'expired' }
+      }
+
+      if (revokedAt !== null) {
+        if (config.refreshToken.reuseDetection) {
+          await tx.execute(
+            sql`UPDATE pipework_refresh_tokens SET revoked_at = now()
+                WHERE family_id = ${familyId}::uuid AND revoked_at IS NULL`
+          )
+        }
+        return { kind: 'reuse' }
+      }
+
+      if (config.refreshToken.rotateOnUse) {
+        await tx.execute(
+          sql`UPDATE pipework_refresh_tokens SET revoked_at = now() WHERE token_hash = ${tokenHash}`
+        )
+      }
+
+      const roles = config.resolveRoles
+        ? await config.resolveRoles(tx, userId, tenantId)
+        : undefined
+
+      // Rotation stays within the same family — a replayed older token must be
+      // able to revoke every token descended from it, including this new one.
+      const pair = await issueTokens(
+        tx,
+        roles ? { id: userId, tenantId, roles } : { id: userId, tenantId },
+        familyId,
+      )
+      return { kind: 'ok', pair }
+    })
+
+    switch (outcome.kind) {
+      case 'invalid':
+        throw new UnauthorizedError('Invalid refresh token')
+      case 'expired':
+        throw new UnauthorizedError('Refresh token expired')
+      case 'reuse':
+        throw new UnauthorizedError('Refresh token reuse detected — all sessions revoked')
+      case 'ok':
+        return outcome.pair
+    }
+  }
+
+  async function revokeAll(db: DB, userId: string): Promise<void> {
+    await db.execute(
+      sql`UPDATE pipework_refresh_tokens SET revoked_at = now()
+          WHERE user_id = ${userId} AND revoked_at IS NULL`
+    )
+  }
+
+  async function bumpVersion(db: DB, userId: string): Promise<void> {
+    await db.execute(
+      sql`INSERT INTO pipework_auth_versions (user_id, version, updated_at)
+          VALUES (${userId}, 2, now())
+          ON CONFLICT (user_id)
+          DO UPDATE SET version = pipework_auth_versions.version + 1, updated_at = now()`
+    )
+    versionCache.delete(userId)
+  }
+
+  async function verifyAccessToken(token: string): Promise<TokenPayload> {
+    const key = await getPublicKey()
+    try {
+      const { payload } = await jwtVerify(token, key, {
+        algorithms: [config.signing.algorithm],
+        issuer: config.issuer,
+        audience: config.audience,
+      })
+      return {
+        sub: payload.sub!,
+        tid: payload['tid'] as string,
+        av: payload['av'] as number,
+        roles: payload['roles'] as string[] | undefined,
+      }
+    } catch (error) {
+      if ((error as { code?: unknown } | null)?.code === 'ERR_JWT_EXPIRED') {
+        throw new UnauthorizedError('Access token expired')
+      }
+      throw new UnauthorizedError('Invalid access token')
+    }
+  }
+
+  function signedSubject(token: unknown): string | null {
+    try {
+      if (typeof token !== 'string') return null
+      const parts = token.split('.')
+      if (parts.length !== 3) return null
+      const [header, body, signature] = parts as [string, string, string]
+      const head = JSON.parse(Buffer.from(header, 'base64url').toString('utf8')) as { alg?: unknown }
+      if (head.alg !== config.signing.algorithm) return null
+      const signed = cryptoVerify(
+        'sha256', Buffer.from(`${header}.${body}`), { key: verifyKey, dsaEncoding: 'ieee-p1363' },
+        Buffer.from(signature, 'base64url'),
+      )
+      if (!signed) return null
+      const claims = JSON.parse(Buffer.from(body, 'base64url').toString('utf8')) as
+        { sub?: unknown; iss?: unknown; aud?: unknown }
+      if (claims.iss !== config.issuer) return null
+      const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud]
+      if (!audiences.includes(config.audience)) return null
+      return typeof claims.sub === 'string' && claims.sub !== '' ? claims.sub : null
+    } catch {
+      return null
+    }
+  }
+
+  async function checkVersion(db: DB, userId: string, tokenVersion: number): Promise<boolean> {
+    const cached = versionCache.get(userId)
+    if (cached && cached.expiresAt > Date.now()) {
+      return cached.version === tokenVersion
+    }
+
+    const rows = await db.execute(
+      sql`SELECT version FROM pipework_auth_versions WHERE user_id = ${userId}`
+    )
+    const currentVersion = rows.length > 0 ? (rows[0]!['version'] as number) : 1
+    versionCache.set(userId, { version: currentVersion, expiresAt: Date.now() + cacheTtl })
+    return currentVersion === tokenVersion
+  }
+
+  async function cleanExpiredTokens(db: DB): Promise<number> {
+    const rows = await db.execute(
+      sql`DELETE FROM pipework_refresh_tokens WHERE expires_at < now() RETURNING id`
+    )
+    return rows.length
+  }
+
+  function getCookieConfig(): ResolvedCookieConfig {
+    const cookie = config.refreshToken.cookie
+    if (cookie === undefined) {
+      throw new Error('Cookie-based session methods require refreshToken.cookie configuration')
+    }
+    return resolveCookieConfig(cookie, config.environment ?? 'production')
+  }
+
+  function getAccessCookieConfig(): ResolvedCookieConfig | null {
+    const cookie = config.accessToken.cookie
+    if (cookie === undefined) return null
+    return resolveCookieConfig(cookie, environment, { name: '__pipework_access', sameSite: 'lax' })
+  }
+
+  // A browser sends Sec-Fetch-Site or Origin on every POST, so a request with neither is not a browser's
+  // and carries no cross-site risk: server-side proxies and native clients keep working.
+  function assertSameSiteCookie(request: { readonly headers: Readonly<Record<string, string | undefined>>; readonly method?: string }): void {
+    if (request.headers['sec-fetch-site'] === undefined && request.headers['origin'] === undefined) return
+    assertSameSiteRequest({ headers: request.headers }, config.trustedOrigins ?? [])
+  }
+
+  function getRefreshMaxAge(): number {
+    return parseExpiry(config.refreshToken.expiresIn)
+  }
+
+  function setCookies(response: HttpResponse, values: string[]): void {
+    response.header('Set-Cookie', values.length === 1 ? values[0]! : values)
+  }
+
+  function sessionCookies(resolved: ResolvedCookieConfig, pair: TokenPair): string[] {
+    const values = [buildSetCookieHeader(resolved, pair.refreshToken, getRefreshMaxAge())]
+    const access = getAccessCookieConfig()
+    if (access !== null) values.push(buildSetCookieHeader(access, pair.accessToken, pair.expiresIn))
+    return values
+  }
+
+  function clearCookies(resolved: ResolvedCookieConfig): string[] {
+    const values = [buildClearCookieHeader(resolved)]
+    const access = getAccessCookieConfig()
+    if (access !== null) values.push(buildClearCookieHeader(access))
+    return values
+  }
+
+  async function issueTokensHttp(
+    response: HttpResponse,
+    db: DB,
+    user: { id: string; tenantId: string; roles?: readonly string[] },
+  ): Promise<HttpTokenResult> {
+    const resolved = getCookieConfig()
+    const pair = await issueTokens(db, user)
+    setCookies(response, sessionCookies(resolved, pair))
+    return { accessToken: pair.accessToken, expiresIn: pair.expiresIn }
+  }
+
+  async function refreshHttp(
+    response: HttpResponse,
+    db: DB,
+    request: Pick<HttpRequest, 'headers'> & { readonly method?: string },
+  ): Promise<HttpTokenResult> {
+    const resolved = getCookieConfig()
+    const token = parseCookieHeader(request.headers['cookie'], resolved.name)
+    if (token === undefined) {
+      throw new UnauthorizedError('Missing refresh token cookie')
+    }
+    assertSameSiteCookie(request)
+    const pair = await refresh(db, token)
+    setCookies(response, sessionCookies(resolved, pair))
+    return { accessToken: pair.accessToken, expiresIn: pair.expiresIn }
+  }
+
+  async function revokeToken(db: DB, token: string): Promise<void> {
+    const tokenHash = await hashToken(token)
+    await db.execute(
+      sql`UPDATE pipework_refresh_tokens SET revoked_at = now()
+          WHERE token_hash = ${tokenHash} AND revoked_at IS NULL`
+    )
+  }
+
+  async function revokeHttp(
+    response: HttpResponse,
+    db: DB,
+    request: Pick<HttpRequest, 'headers'> & { readonly method?: string },
+  ): Promise<void> {
+    const resolved = getCookieConfig()
+    const token = parseCookieHeader(request.headers['cookie'], resolved.name)
+    if (token === undefined) {
+      throw new UnauthorizedError('Missing refresh token cookie')
+    }
+    assertSameSiteCookie(request)
+    await revokeToken(db, token)
+    setCookies(response, clearCookies(resolved))
+  }
+
+  async function revokeRefreshCookie(db: DB, request: Pick<HttpRequest, 'headers'> & { readonly method?: string }): Promise<void> {
+    const resolved = getCookieConfig()
+    const token = parseCookieHeader(request.headers['cookie'], resolved.name)
+    if (token === undefined) return
+    assertSameSiteCookie(request)
+    await revokeToken(db, token)
+  }
+
+  async function revokeAllHttp(
+    response: HttpResponse,
+    db: DB,
+    userId: string,
+    request?: Pick<HttpRequest, 'headers'> & { readonly method?: string },
+  ): Promise<void> {
+    const resolved = getCookieConfig()
+    if (request !== undefined) assertSameSiteCookie(request)
+    await revokeAll(db, userId)
+    setCookies(response, clearCookies(resolved))
+  }
+
+  function strategy(options: SessionStrategyOptions = {}): AuthStrategy<SessionAuth> {
+    const trusted = [...(config.trustedOrigins ?? []), ...(options.trustedOrigins ?? [])]
+    const crossSiteReads = options.crossSiteReads ?? 'refuse'
+    const tokens = new WeakMap<object, string>()
+    const accessCookieName = getAccessCookieConfig()?.name
+
+    return {
+      name: 'sessions',
+      extract(request: AuthRequest): Promise<SessionAuth | null> {
+        try {
+          return Promise.resolve(extractSync(request))
+        } catch (error) {
+          return Promise.reject(error instanceof Error ? error : new Error(String(error)))
+        }
+      },
+      async verify(extracted: SessionAuth, context: AuthContext): Promise<SessionAuth> {
+        const token = tokens.get(extracted)
+        if (token === undefined) throw new UnauthorizedError('Invalid access token')
+        const payload = await verifyAccessToken(token)
+        if (config.versionCheck) {
+          let current: boolean
+          try {
+            current = await checkVersion(context.db(), payload.sub, payload.av)
+          } catch (error) {
+            if (isPipeworkError(error)) throw error
+            throw new AuthUnavailableError('Authentication is unavailable: the session version check failed', { cause: error })
+          }
+          if (!current) throw new UnauthorizedError('Session revoked')
+        }
+        return { userId: payload.sub, tenantId: payload.tid, roles: payload.roles ?? [], via: extracted.via }
+      },
+    }
+
+    function extractSync(request: AuthRequest): SessionAuth | null {
+      let token: string | undefined
+      let via: 'cookie' | 'header' = 'header'
+      const authorization = request.headers['authorization']
+      if (authorization !== undefined && /^bearer /i.test(authorization)) {
+        token = authorization.slice(7).trim()
+      } else if (accessCookieName !== undefined) {
+        const cookie = request.cookies[accessCookieName]
+        if (cookie !== undefined && cookie !== '') {
+          token = cookie
+          via = 'cookie'
+          assertSameSiteRequest(request, trusted, crossSiteReads)
+        }
+      }
+      if (token === undefined || token === '') return null
+      const extracted: SessionAuth = { userId: '', tenantId: '', roles: [], via }
+      tokens.set(extracted, token)
+      return extracted
+    }
+  }
+
+  return refuseScopedHandle({
+    issueTokens, refresh, revokeAll, bumpVersion, verifyAccessToken, signedSubject, checkVersion, cleanExpiredTokens,
+    strategy, assertSameSiteCookie, revokeRefreshCookie, issueTokensHttp, refreshHttp, revokeHttp, revokeAllHttp,
+  }, 'sessions', 'session and refresh-token rows belong to the user, across tenants')
+}
+
+const TEST_KEY_PATTERNS = [
+  'test', 'example', 'dummy', 'placeholder', 'changeme', 'insecure', 'dev-only',
+]
+
+function validateSigningKeys(config: SessionConfig): void {
+  const problems: string[] = []
+  const { privateKey, publicKey } = config.signing
+
+  if (privateKey.length < 100) {
+    problems.push('Private key appears too short for ES256. Ensure you are using a real PKCS#8 key.')
+  }
+
+  if (publicKey.length < 80) {
+    problems.push('Public key appears too short for ES256. Ensure you are using a real SPKI key.')
+  }
+
+  const combined = (privateKey + publicKey).toLowerCase()
+  for (const pattern of TEST_KEY_PATTERNS) {
+    if (combined.includes(pattern)) {
+      problems.push(`Signing key material contains "${pattern}" — this looks like a test key.`)
+      break
+    }
+  }
+
+  if (!privateKey.includes('BEGIN') || !publicKey.includes('BEGIN')) {
+    problems.push('Keys should be PEM-encoded (BEGIN PRIVATE KEY / BEGIN PUBLIC KEY).')
+  }
+
+  if (problems.length > 0) {
+    throw new Error(
+      `[pipework] Session signing keys are not suitable for production:\n\n${problems.map(p => `  - ${p}`).join('\n')}\n\n` +
+      '  Generate production keys with: openssl ecparam -genkey -name prime256v1 -noout | openssl pkcs8 -topk8 -nocrypt\n',
+    )
+  }
+}
+
+async function hashToken(token: string): Promise<string> {
+  const encoder = new TextEncoder()
+  const data = encoder.encode(token)
+  const hash = await crypto.subtle.digest('SHA-256', data)
+  return Buffer.from(hash).toString('hex')
+}