Harden authentication, tenant isolation and security boundaries

src/lib/tokens.ts

@@ -0,0 +1,9 @@
+import { createHash, randomBytes } from "node:crypto";
+
+export function hashToken(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+export function newToken(): string { return randomBytes(32).toString("hex"); }
+export function isPublicToken(token: unknown): token is string {
+  return typeof token === "string" && /^(?:[a-f0-9]{64}|[a-f0-9-]{36})$/i.test(token);
+}