Identity tokens

import { createHmac, randomUUID } from 'node:crypto';

const b64url = (value) => Buffer.from(value).toString('base64url');

/**
 * Mint a KauZap identity token (JWT, HS256) on your server. Never do this in the browser:
 * the secret must stay on your backend.
 *
 * @param {object} opts
 * @param {string} opts.secret Identity secret for the property (Settings, Developers).
 * @param {string} opts.kid Key id of that secret, sent in the JWT header.
 * @param {string} opts.propertyKey The property's public key (pk_...), sent as `iss`.
 * @param {string} opts.sub Your stable user id.
 * @param {string} [opts.name]
 * @param {string} [opts.email]
 * @param {string} [opts.phone]
 * @param {Record<string, unknown>} [opts.attributes] Shown to agents in the customer panel.
 * @param {number} [opts.ttlSeconds] Lifetime, at most 600 seconds. Default 300.
 * @param {number} [opts.now] Current time in milliseconds. Default Date.now().
 * @returns {string}
 */
export function mintIdentityToken({
  secret,
  kid,
  propertyKey,
  sub,
  name,
  email,
  phone,
  attributes,
  ttlSeconds = 300,
  now = Date.now(),
}) {
  if (!secret || !kid || !propertyKey || !sub) {
    throw new Error('secret, kid, propertyKey and sub are required');
  }
  if (!(ttlSeconds > 0 && ttlSeconds <= 600)) {
    throw new Error('ttlSeconds must be between 1 and 600');
  }
  const iat = Math.floor(now / 1000);
  // JSON.stringify drops the optional claims you left undefined.
  const claims = {
    iss: propertyKey,
    sub,
    name,
    email,
    phone,
    attributes,
    iat,
    exp: iat + ttlSeconds,
    jti: randomUUID(),
  };
  const header = b64url(JSON.stringify({ alg: 'HS256', typ: 'JWT', kid }));
  const input = `${header}.${b64url(JSON.stringify(claims))}`;
  const signature = createHmac('sha256', secret).update(input).digest('base64url');
  return `${input}.${signature}`;
}