From 13153e8f85fee453d22399f62f01391d8ab96756 Mon Sep 17 00:00:00 2001
From: gearnode <bryan@frimin.fr>
Date: Wed, 5 Mar 2025 17:35:03 +0100
Subject: [PATCH] Add cookie signer helpers

Signed-off-by: gearnode <bryan@frimin.fr>
---
 pkg/api/console/v1/cookie_signer.go | 50 +++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 pkg/api/console/v1/cookie_signer.go

diff --git a/pkg/api/console/v1/cookie_signer.go b/pkg/api/console/v1/cookie_signer.go
new file mode 100644
index 000000000..7be8dae22
--- /dev/null
+++ b/pkg/api/console/v1/cookie_signer.go
@@ -0,0 +1,50 @@
+package console_v1
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+	"strings"
+)
+
+func signCookieValue(value string, secret string) string {
+	if secret == "" {
+		panic(fmt.Errorf("cookie secret is not set"))
+	}
+
+	h := hmac.New(sha256.New, []byte(secret))
+
+	h.Write([]byte(value))
+
+	signature := base64.URLEncoding.EncodeToString(h.Sum(nil))
+
+	return fmt.Sprintf("%s.%s", value, signature)
+}
+
+func verifyCookieValue(signedValue string, secret string) (string, error) {
+	if secret == "" {
+		panic(fmt.Errorf("cookie secret is not set"))
+	}
+
+	parts := strings.Split(signedValue, ".")
+	if len(parts) != 2 {
+		return "", fmt.Errorf("invalid signed cookie format")
+	}
+
+	value, signature := parts[0], parts[1]
+
+	expectedSignedValue := signCookieValue(value, secret)
+	expectedParts := strings.Split(expectedSignedValue, ".")
+	if len(expectedParts) != 2 {
+		return "", fmt.Errorf("error computing signature")
+	}
+
+	expectedSignature := expectedParts[1]
+
+	if signature != expectedSignature {
+		return "", fmt.Errorf("cookie signature verification failed")
+	}
+
+	return value, nil
+}