Initial commit

lib/transcoder-auth.ts

@@ -0,0 +1,27 @@
+// lib/transcoder-auth.ts
+// Timing-safe Bearer token verification for transcoder API endpoints.
+import { createHash, timingSafeEqual } from "crypto";
+
+/**
+ * Verifies the incoming request carries the correct TRANSCODER_SECRET
+ * via an "Authorization: Bearer <token>" header.
+ *
+ * Uses HMAC-SHA256 hashes and timingSafeEqual to prevent timing attacks.
+ */
+export function verifyTranscoderToken(request: Request): boolean {
+  const secret = process.env.TRANSCODER_SECRET;
+  if (!secret) return false;
+
+  const auth = request.headers.get("authorization") ?? "";
+  if (!auth.startsWith("Bearer ")) return false;
+
+  const token = auth.slice(7);
+
+  try {
+    const a = createHash("sha256").update(token).digest();
+    const b = createHash("sha256").update(secret).digest();
+    return timingSafeEqual(a, b);
+  } catch {
+    return false;
+  }
+}