ThreadCount
057da00fd2
Uniform stock management for healthcare linen rooms: the coordinator app, the phone counter and the staff app, for your own server. Built from e2d6d42 on 2026-09-13. Licensed under the Functional Source License (FSL-1.1-ALv2).
34 lines
1.7 KiB
JavaScript
34 lines
1.7 KiB
JavaScript
/* Mint an approval link token for the e2e suite and print it.
|
|
*
|
|
* The real token only ever exists inside an email to a ward manager, which the suite has no way to
|
|
* read. Rather than skip the emailed-link path — the one route into this product that works
|
|
* without a session, and therefore the one most worth testing — the suite mints its own using the
|
|
* same signing code the app uses.
|
|
*
|
|
* Refuses to run in production. It needs SESSION_SECRET, so anyone who could use it can already
|
|
* forge one — but a guard costs nothing and states the intent.
|
|
*
|
|
* node scripts/approval-mint.cjs <requestId> <managerStaffId> -> prints the token
|
|
*/
|
|
require("dotenv/config");
|
|
const { createHash, createHmac } = require("crypto");
|
|
|
|
if (process.env.NODE_ENV === "production") {
|
|
console.error("refusing to run in production");
|
|
process.exit(2);
|
|
}
|
|
|
|
const [rid, mid] = process.argv.slice(2);
|
|
if (!rid || !mid) { console.error("usage: approval-mint.cjs <requestId> <managerStaffId>"); process.exit(2); }
|
|
if (!process.env.SESSION_SECRET) { console.error("SESSION_SECRET not set"); process.exit(2); }
|
|
|
|
// Mirrors lib/approvallink.ts exactly — including the domain separation, which is the point of
|
|
// the test: a token signed with the plain session secret must NOT be accepted.
|
|
const key = createHash("sha256").update("threadcount:approval:v1:" + process.env.SESSION_SECRET).digest();
|
|
const b64url = (b) => b.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
|
|
|
|
const ttl = Number(process.argv[4] || 14 * 24 * 60 * 60 * 1000);
|
|
const payload = b64url(Buffer.from(JSON.stringify({ rid, mid, exp: Date.now() + ttl })));
|
|
const sig = b64url(createHmac("sha256", key).update(payload).digest());
|
|
console.log(`${payload}.${sig}`);
|