Add persistent cross-game player bank (Refs #146)

src/lib/server/auth/access.ts

@@ -37,6 +37,7 @@ export function routePermission(routeId: string | null, method: string): RoutePe
         return 'admin';
 
     if (within(routeId, '/api/agent')) return 'machine';
+    if (routeId === '/api/bank/[action]' && method === 'POST') return 'machine';
     if (routeId === '/api/telemetry' && method === 'POST') return 'machine';
     if (routeId === '/api/leaderboard' && reading) return 'public';
     if ((routeId === '/login' || routeId === '/setup') && reading) return 'public';

src/lib/server/auth/bank.ts

@@ -0,0 +1,41 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+
+const digest = (value: string) => createHash('sha256').update(value).digest();
+const valid = (value: unknown): value is string =>
+    typeof value === 'string' && /^ec_bank_[A-Za-z0-9_-]{32,128}$/.test(value);
+
+/** Dedicated, unique credentials; telemetry and browser credentials never authorize spending. */
+export function authenticateBank(
+    request: Request
+): { ok: true; server: string } | { ok: false; status: 401 | 503; code: string } {
+    let entries: [string, string][];
+    try {
+        const config: unknown = JSON.parse(process.env.EC_BANK_TOKENS ?? '{}');
+        if (!config || typeof config !== 'object' || Array.isArray(config)) throw new Error();
+        const values = Object.entries(config);
+        if (
+            !values.length ||
+            values.some(
+                ([server, token]) =>
+                    !server || !valid(token) || token === process.env.EC_TELEMETRY_TOKEN
+            )
+        )
+            throw new Error();
+        entries = values as [string, string][];
+        if (new Set(entries.map(([, token]) => token)).size !== entries.length) throw new Error();
+    } catch {
+        return { ok: false, status: 503, code: 'unconfigured' };
+    }
+    const token = request.headers
+        .get('authorization')
+        ?.match(/^Bearer (ec_bank_[A-Za-z0-9_-]{32,128})$/i)?.[1];
+    if (!token) return { ok: false, status: 401, code: 'unauthorized' };
+    const supplied = digest(token);
+    let matched: string | undefined;
+    for (const [server, expected] of entries) {
+        if (timingSafeEqual(supplied, digest(expected))) matched = server;
+    }
+    return matched
+        ? { ok: true, server: matched }
+        : { ok: false, status: 401, code: 'unauthorized' };
+}