Claude Fable 5
9674c0bae2
Some checks failed
CI / Lint, typecheck, test (push) Successful in 3m41s
CD / Build and push images (push) Successful in 3m44s
CI / Build container images (push) Has been skipped
CD / Deploy to Test (push) Successful in 9s
CD / Smoke tests against Test (push) Successful in 1m18s
CD / Promote to Int (push) Successful in 11s
CI / Auth e2e pack (push) Failing after 2m53s
CI / Import/export fidelity gate (push) Has been skipped
New per-user digestFrequency (hourly default | daily | off) on the profile and in the settings UI. A scheduler job (15 min cadence) mails a user once their oldest unread, unmailed notification exceeds the cadence window: one localized mail per batch, grouped per pond then per page with actor names and change/comment counts, enqueued through the mail outbox. Sending marks the batch mailed — never read — and re-checks page read permission per entry at send time; entries the user can no longer read are dropped from the mail but still marked handled, so revoked content cannot queue forever. Every mail carries a signed, single-purpose unsubscribe link: it only flips the setting to off, renders a session-free confirmation page, and sets no cookie. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1
53 lines
1.7 KiB
TypeScript
53 lines
1.7 KiB
TypeScript
import { createHmac, timingSafeEqual } from 'node:crypto';
|
|
|
|
/**
|
|
* Single-purpose unsubscribe tokens for the digest mails (issue #95): a
|
|
* signed `{userId, exp}` blob whose only power is flipping that user's
|
|
* digest setting to `off` — it never creates a session (ADR 0007's "signed
|
|
* tokens" pattern, purpose-bound so it cannot be replayed anywhere else).
|
|
*/
|
|
|
|
const PURPOSE = 'digest-unsubscribe';
|
|
const TTL_SECONDS = 90 * 24 * 60 * 60;
|
|
|
|
function signature(body: string, secret: string): Buffer {
|
|
return createHmac('sha256', secret).update(`${PURPOSE}.${body}`).digest();
|
|
}
|
|
|
|
export function signUnsubscribeToken(userId: string, secret: string, now = Date.now()): string {
|
|
const body = Buffer.from(
|
|
JSON.stringify({ userId, exp: Math.floor(now / 1000) + TTL_SECONDS }),
|
|
'utf8',
|
|
).toString('base64url');
|
|
return `${body}.${signature(body, secret).toString('base64url')}`;
|
|
}
|
|
|
|
/** The user id, or null for anything invalid or expired. Never throws. */
|
|
export function verifyUnsubscribeToken(
|
|
token: string,
|
|
secret: string,
|
|
now = Date.now(),
|
|
): string | null {
|
|
const [body, sig] = token.split('.');
|
|
if (!body || !sig) return null;
|
|
let provided: Buffer;
|
|
try {
|
|
provided = Buffer.from(sig, 'base64url');
|
|
} catch {
|
|
return null;
|
|
}
|
|
const expected = signature(body, secret);
|
|
if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) return null;
|
|
try {
|
|
const payload = JSON.parse(Buffer.from(body, 'base64url').toString('utf8')) as {
|
|
userId?: string;
|
|
exp?: number;
|
|
};
|
|
if (typeof payload.userId !== 'string' || typeof payload.exp !== 'number') return null;
|
|
if (payload.exp * 1000 < now) return null;
|
|
return payload.userId;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|