auth/daemon_token.ts

Daemon token primitives — schema, generation, and validation.

Pure auth operations with no I/O or state management. The middleware, rotation, and persistence logic lives in daemon_token_middleware.ts.

Declarations
#

5 declarations

view source

DAEMON_TOKEN_HEADER
#

DaemonToken
#

DaemonTokenState
#

auth/daemon_token.ts view source

DaemonTokenState

Mutable runtime state for daemon token rotation.

This is runtime state (not AppDeps or *Options) — it changes during operation. Created at server startup, passed to the middleware factory.

current_token

Current valid token.

type string

previous_token

Previous token, still valid during the race window. null before first rotation.

type string | null

rotated_at

When the last rotation occurred.

type Date

keeper_account_id

The account ID of the keeper (resolved at startup, set by on_bootstrap).

type string | null

generate_daemon_token
#

validate_daemon_token
#

auth/daemon_token.ts view source

(provided: string, state: DaemonTokenState): boolean

Validate a daemon token against the current state.

Accepts both the current and previous token (2-token race window). Uses timing-safe comparison.

provided

the token from the X-Daemon-Token header

type string

state

the daemon token state

type DaemonTokenState

returns

boolean

true if the token is valid

Depends on
#

Imported by
#