initial upload

internal/app/security.go

@@ -0,0 +1,67 @@
+package app
+
+import (
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base32"
+	"encoding/base64"
+	"encoding/hex"
+	"errors"
+	"strings"
+)
+
+var codeEncoding = base32.NewEncoding("0123456789ABCDEFGHJKMNPQRSTVWXYZ").
+	WithPadding(base32.NoPadding)
+
+func randomBytes(size int) ([]byte, error) {
+	value := make([]byte, size)
+	if _, err := rand.Read(value); err != nil {
+		return nil, err
+	}
+	return value, nil
+}
+
+func randomToken(size int) (string, error) {
+	value, err := randomBytes(size)
+	if err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(value), nil
+}
+
+func deploymentCode() (string, error) {
+	value, err := randomBytes(7)
+	if err != nil {
+		return "", err
+	}
+	encoded := codeEncoding.EncodeToString(value)
+	if len(encoded) < 10 {
+		return "", errors.New("generated deployment code is too short")
+	}
+	return "TAPM-" + encoded[:5] + "-" + encoded[5:10], nil
+}
+
+func normalizeCode(value string) string {
+	return strings.ToUpper(strings.ReplaceAll(strings.TrimSpace(value), " ", ""))
+}
+
+func hashValue(value string) [32]byte {
+	return sha256.Sum256([]byte(value))
+}
+
+func hashHex(value string) string {
+	sum := hashValue(value)
+	return hex.EncodeToString(sum[:])
+}
+
+func signValue(secret []byte, value string) string {
+	mac := hmac.New(sha256.New, secret)
+	_, _ = mac.Write([]byte(value))
+	return base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
+}
+
+func verifySignature(secret []byte, value, signature string) bool {
+	expected := signValue(secret, value)
+	return hmac.Equal([]byte(expected), []byte(signature))
+}