@lukethegenius/magic-link-auth

Passwordless magic-link primitives: code + secret token generation, sha256 hashing, constant-time verification, and an HMAC-signed cookie.

Install

npm install @lukethegenius/magic-link-auth

Usage

import {
  generatePortalCode, generatePortalToken, verifyPortalAccess,
  encodePortalCookie, decodePortalCookie, buildPortalLink,
} from '@lukethegenius/magic-link-auth'

const code = generatePortalCode('ACME')       // "ACME-7K3P-QZ4M" (default prefix: "LINK")
const { token, tokenHash } = generatePortalToken() // store ONLY tokenHash

const link = buildPortalLink(code, token, 'https://app.example.com') // required baseUrl, no hardcoded default

// later, resolving a request:
const ok = verifyPortalAccess(code, token, { id, portal_code: code, portal_enabled: true, portal_token_hash: tokenHash })

const cookie = encodePortalCookie(code, token, secret) // or reads process.env.PORTAL_COOKIE_SECRET
const decoded = decodePortalCookie(cookie, secret)

The code prefix and cookie secret env var name are both configurable (no brand-specific defaults baked in). Storage/uniqueness enforcement is the caller's responsibility.