Session tokens

import { createHmac } from "node:crypto";

const SESSION_SECRET = process.env.SESSION_SECRET;
const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");

export function sessionToken({ player, currency, publicKey }) {
  const claims = {
    sub: player, // your stable player ID: 1 to 128 letters, digits, - or _
    tenant: "lucky-star", // your casino ID
    iss: "https://www.luckystar.example", // your session issuer, exactly as in Settings
    aud: "og-rgs-v1",
    currency, // one of your currencies, such as "USD"
    exp: Math.floor(Date.now() / 1000) + 900, // at most one hour ahead
  };
  // The player's device key: the session may sign bets only with this key.
  if (publicKey) claims.cnf = { jwk: { kty: "OKP", crv: "Ed25519", x: publicKey } };
  const unsigned = encode({ alg: "HS256", typ: "JWT" }) + "." + encode(claims);
  return unsigned + "." + createHmac("sha256", SESSION_SECRET).update(unsigned).digest("base64url");
}

import { sessionToken } from "./session-token.mjs";

// `player` is the player your own login authenticated for this request.
export async function gameSession(request, player) {
  const { publicKey } = await request.json(); // absent on the element's first call
  const token = sessionToken({ player: player.id, currency: "USD", publicKey });
  return new Response(token, {
    headers: { "content-type": "text/plain", "cache-control": "no-store" },
  });
}