feat(extension): 采集插件功能开发

apps/api/src/auth/auth.crypto.ts

@@ -51,6 +51,8 @@ export type AccessTokenClaims = {
     exp: number;
     iat: number;
 };
+
+export type ExtensionAccessTokenClaims = AccessTokenClaims & { typ: 'extension'; wid: string };
 export function signAccessToken(
     claims: AccessTokenClaims,
     secret: string,
@@ -92,3 +94,20 @@ export function verifyAccessToken(
         return null;
     }
 }
+
+/** Extension tokens have an explicit audience so they can never be accepted by
+ * the normal Web/API guard, even though both are signed by the same key. */
+export function signExtensionAccessToken(
+    claims: ExtensionAccessTokenClaims,
+    secret: string,
+): string {
+    const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url');
+    const payload = Buffer.from(JSON.stringify(claims)).toString('base64url');
+    const signature = createHmac('sha256', secret).update(`${header}.${payload}`).digest('base64url');
+    return `${header}.${payload}.${signature}`;
+}
+
+export function verifyExtensionAccessToken(token: string, secret: string): ExtensionAccessTokenClaims | null {
+    const claims = verifyAccessToken(token, secret) as Partial<ExtensionAccessTokenClaims> | null;
+    return claims?.typ === 'extension' ? claims as ExtensionAccessTokenClaims : null;
+}