julian.kiedaischandClaude Opus 5.5
5ded84cb33
Server F checks the dashboard's entry ticket as itsdangerous does (tools/ticket-oracle: tickets made by itsdangerous 2.2.0 itself), redeems it at /__auth for a session cookie (only the key's SHA-256 is kept) and decides at /sync by the session's grant: none, read or write; a frozen project is read by everyone; every refusal names its reason (one list in packages/protocol/src/sync.ts). A WebSocket from a page of another origin is refused. /svc/* with the service key makes, deletes, freezes and thaws projects, ends a person's grant or all their sessions (connections let go) and lists the sessions. Snapshots, restoring and copying move to F6 (they need the canonical doc.json and an epoch). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
16 lines
855 B
TypeScript
16 lines
855 B
TypeScript
// Tickets as the dashboard signs them, made in Node for the server's tests
|
|
// (the Python oracle shows the same JSON at the same moment: ticket.test.ts).
|
|
|
|
import { deflateSync } from 'node:zlib';
|
|
import { signature, TICKET_SALT } from '../src/ticket.js';
|
|
|
|
export function signTicket(payload: unknown, secret: string, at = Math.floor(Date.now() / 1000), salt = TICKET_SALT): string {
|
|
const json = Buffer.from(JSON.stringify(payload));
|
|
const packed = deflateSync(json);
|
|
const body = packed.length < json.length - 1 ? `.${packed.toString('base64url')}` : json.toString('base64url');
|
|
let stamp = Buffer.alloc(0);
|
|
for (let rest = at; rest > 0; rest = Math.floor(rest / 256)) stamp = Buffer.concat([Buffer.from([rest % 256]), stamp]);
|
|
const value = `${body}.${stamp.toString('base64url')}`;
|
|
return `${value}.${signature(value, secret, salt)}`;
|
|
}
|