0c9e6d7c58
Route git push and gh pr through the sandbox supervisor broker so project computers never receive GITHUB_TOKEN/GH_TOKEN. Remove NOPASSWD sudo from the computer image. Localize awareness strip copy via Lingui and wire computer-image-tools.test.sh into the validate-computer-image job. Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
19 lines
738 B
TypeScript
19 lines
738 B
TypeScript
import { createHmac, timingSafeEqual } from "node:crypto";
|
|
|
|
const PREFIX = "rgb1.";
|
|
|
|
/** Opaque run-scoped token for the sandbox GitHub broker (not a GitHub PAT). */
|
|
export function signGithubBrokerRunToken(runId: string, secret: string): string {
|
|
const digest = createHmac("sha256", secret).update(runId, "utf8").digest("base64url");
|
|
return `${PREFIX}${digest}`;
|
|
}
|
|
|
|
export function verifyGithubBrokerRunToken(token: string, secret: string, runId: string): boolean {
|
|
if (!token.startsWith(PREFIX)) return false;
|
|
const expected = signGithubBrokerRunToken(runId, secret);
|
|
const a = Buffer.from(token, "utf8");
|
|
const b = Buffer.from(expected, "utf8");
|
|
if (a.length !== b.length) return false;
|
|
return timingSafeEqual(a, b);
|
|
}
|