/**
 * Access token management for RDP (and formerly VNC) sessions.
 * Tokens are cryptographically random 64-character hex strings with a TTL.
 */
import crypto from "node:crypto";
import { logger } from "../logger.js";
const tokens = new Map();
// Cleanup expired tokens every 5 minutes to prevent unbounded memory growth.
setInterval(() => {
    const now = Date.now();
    for (const [key, val] of tokens) {
        if (val.expiresAt < now)
            tokens.delete(key);
    }
}, 5 * 60 * 1_000).unref();
/**
 * Generate a time-limited access token.
 * Returns the token string and the ISO expiry timestamp.
 */
export function generateToken(ttlMinutes, reason) {
    const token = crypto.randomBytes(32).toString("hex");
    const expiresAt = Date.now() + ttlMinutes * 60 * 1_000;
    tokens.set(token, { expiresAt, reason });
    logger.system(`Access token generated (ttl=${ttlMinutes}m, reason="${reason}")`);
    return { token, expiresAt: new Date(expiresAt).toISOString() };
}
/**
 * Validate a token. Returns the token entry if valid, null if expired or unknown.
 */
export function validateToken(token) {
    const entry = tokens.get(token);
    if (!entry)
        return null;
    if (entry.expiresAt < Date.now()) {
        tokens.delete(token);
        return null;
    }
    return entry;
}
/**
 * Revoke a token immediately.
 */
export function revokeToken(token) {
    tokens.delete(token);
}
//# sourceMappingURL=token.js.map