Authentication & security

import express from 'express';
import { createHmac } from 'node:crypto';

const app = express();
const IDENTITY_SECRET = process.env.HIVE_EMBED_IDENTITY_SECRET!; // server-side only

const b64url = (o: unknown) => Buffer.from(JSON.stringify(o)).toString('base64url');
// Omit optional claims rather than sending null — "email": null is rejected.
const compact = <T extends object>(o: T) =>
  Object.fromEntries(Object.entries(o).filter(([, v]) => v !== undefined && v !== null));

function mintHiveIdentity(user: { id: string; name: string; email?: string | null; plan?: string | null }) {
  const now = Math.floor(Date.now() / 1000);
  const header = b64url({ alg: 'HS256', typ: 'JWT' });
  const payload = b64url(compact({
    sub: user.id,
    name: user.name,
    email: user.email,
    meta: user.plan ? { plan: user.plan } : undefined,
    iat: now,
    exp: now + 60 * 60, // 1 hour (max 24 h)
  }));
  const sig = createHmac('sha256', IDENTITY_SECRET).update(`${header}.${payload}`).digest('base64url');
  return `${header}.${payload}.${sig}`;
}

// Behind your own session auth; returns the token for the current user.
app.get('/api/hive-identity', requireLogin, (req, res) => {
  res.json({ token: mintHiveIdentity(req.user) });
});

import { createHmac } from 'node:crypto';
import { NextResponse } from 'next/server';
import { getCurrentUser } from '@/lib/auth'; // your session helper

export const runtime = 'nodejs';

const b64url = (o: unknown) => Buffer.from(JSON.stringify(o)).toString('base64url');

export async function GET() {
  const user = await getCurrentUser();
  if (!user) return NextResponse.json({ error: 'unauthenticated' }, { status: 401 });

  const now = Math.floor(Date.now() / 1000);
  const header = b64url({ alg: 'HS256', typ: 'JWT' });
  // Only include optional claims that have a value (null would be rejected).
  const payload = b64url({
    sub: user.id,
    ...(user.name ? { name: user.name } : {}),
    ...(user.email ? { email: user.email } : {}),
    iat: now,
    exp: now + 3600,
  });
  const sig = createHmac('sha256', process.env.HIVE_EMBED_IDENTITY_SECRET!)
    .update(`${header}.${payload}`)
    .digest('base64url');

  return NextResponse.json({ token: `${header}.${payload}.${sig}` });
}

import os, time
import jwt  # pip install PyJWT
from fastapi import FastAPI, Depends

app = FastAPI()
IDENTITY_SECRET = os.environ["HIVE_EMBED_IDENTITY_SECRET"]  # server-side only


def mint_hive_identity(user) -> str:
    now = int(time.time())
    claims = {
        "sub": user.id,
        "name": user.name,
        "email": user.email,           # may be None
        "meta": {"plan": user.plan} if user.plan else None,
        "iat": now,
        "exp": now + 3600,  # 1 hour (max 24 h)
    }
    # Omit optional claims rather than sending null: "email": null is rejected.
    claims = {k: v for k, v in claims.items() if v is not None}
    # PyJWT uses the secret string's bytes as the HMAC key — pass it as-is.
    return jwt.encode(claims, IDENTITY_SECRET, algorithm="HS256")


@app.get("/api/hive-identity")
def hive_identity(user=Depends(current_user)):
    return {"token": mint_hive_identity(user)}

using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Text.Json.Serialization;
using Microsoft.AspNetCore.Mvc;

[ApiController, Route("api/hive-identity")]
public class HiveIdentityController : ControllerBase
{
    private static readonly string Secret =
        Environment.GetEnvironmentVariable("HIVE_EMBED_IDENTITY_SECRET")!; // server-side only

    private static string B64Url(byte[] b) =>
        Convert.ToBase64String(b).TrimEnd('=').Replace('+', '-').Replace('/', '_');

    // Omit optional claims rather than sending null: with the default options
    // System.Text.Json writes "email": null, which the API rejects.
    private static readonly JsonSerializerOptions Json = new()
    {
        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
    };

    [HttpGet, Authorize]
    public IActionResult Get()
    {
        var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
        var header = B64Url(JsonSerializer.SerializeToUtf8Bytes(new { alg = "HS256", typ = "JWT" }, Json));
        var payload = B64Url(JsonSerializer.SerializeToUtf8Bytes(new
        {
            sub = User.FindFirst("sub")!.Value,
            name = User.Identity?.Name,               // null → omitted
            email = User.FindFirst("email")?.Value,   // null → omitted
            iat = now,
            exp = now + 3600, // 1 hour (max 24 h)
        }, Json));
        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(Secret));
        var sig = B64Url(hmac.ComputeHash(Encoding.ASCII.GetBytes($"{header}.{payload}")));
        return Ok(new { token = $"{header}.{payload}.{sig}" });
    }
}

import java.nio.charset.StandardCharsets;
import java.util.Base64;
import java.util.LinkedHashMap;
import java.util.Map;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.web.bind.annotation.*;

@RestController
public class HiveIdentityController {
  private static final String SECRET = System.getenv("HIVE_EMBED_IDENTITY_SECRET"); // server-side only
  private static final ObjectMapper JSON = new ObjectMapper();
  private static final Base64.Encoder B64 = Base64.getUrlEncoder().withoutPadding();

  @GetMapping("/api/hive-identity")
  public Map<String, String> identity(@AuthenticationPrincipal AppUser user) throws Exception {
    long now = System.currentTimeMillis() / 1000;
    String header = B64.encodeToString(JSON.writeValueAsBytes(Map.of("alg", "HS256", "typ", "JWT")));
    // Omit optional claims rather than sending null (Map.of would also throw
    // NullPointerException on a null value).
    Map<String, Object> claims = new LinkedHashMap<>();
    claims.put("sub", user.getId());
    if (user.getName() != null) claims.put("name", user.getName());
    if (user.getEmail() != null) claims.put("email", user.getEmail());
    claims.put("iat", now);
    claims.put("exp", now + 3600); // 1 hour (max 24 h)
    String payload = B64.encodeToString(JSON.writeValueAsBytes(claims));
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(SECRET.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
    String sig = B64.encodeToString(mac.doFinal((header + "." + payload).getBytes(StandardCharsets.US_ASCII)));
    return Map.of("token", header + "." + payload + "." + sig);
  }
}