fix: secure assistant generation telemetry

packages/api/src/assistant-generation-access.ts

@@ -0,0 +1,34 @@
+import { createHmac, hkdfSync, timingSafeEqual } from "node:crypto";
+
+import { env } from "@homarr/common/env";
+
+const getGenerationTelemetrySecret = () =>
+  Buffer.from(
+    hkdfSync("sha256", Buffer.from(env.SECRET_ENCRYPTION_KEY, "hex"), "", "assistant-generation-telemetry", 32),
+  );
+
+const getGenerationTelemetryPayload = ({
+  userId,
+  threadId,
+  generationId,
+}: {
+  userId: string;
+  threadId: string;
+  generationId: string;
+}) => `${userId}\0${threadId}\0${generationId}`;
+
+export const createAssistantGenerationAccessToken = (input: {
+  userId: string;
+  threadId: string;
+  generationId: string;
+}) =>
+  createHmac("sha256", getGenerationTelemetrySecret()).update(getGenerationTelemetryPayload(input)).digest("base64url");
+
+export const verifyAssistantGenerationAccessToken = (
+  input: { userId: string; threadId: string; generationId: string },
+  accessToken: string,
+) => {
+  const expected = Buffer.from(createAssistantGenerationAccessToken(input));
+  const actual = Buffer.from(accessToken);
+  return expected.length === actual.length && timingSafeEqual(expected, actual);
+};