Initial implementation of Bluetooth toy control app

Next.js app with a browser-side buttplug/buttplug-wasm control layer
(server never touches real-time device commands), SQLite storage via
Drizzle, single-secret auth, recordings/replay with device remapping,
a usage stats dashboard, Docker deployment, and Gitea CI.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W8WkFF5ppURBAB918593Eb

lib/auth/session.ts

@@ -0,0 +1,37 @@
+import { SignJWT, jwtVerify } from "jose";
+import { getEnv } from "@/lib/env";
+
+export const SESSION_COOKIE_NAME = "bp_session";
+const SESSION_MAX_AGE_SECONDS = 60 * 60 * 24 * 30; // 30 days
+
+function signingKey(): Uint8Array {
+  return new TextEncoder().encode(getEnv().AUTH_SECRET);
+}
+
+export async function createSessionToken(): Promise<string> {
+  return new SignJWT({})
+    .setProtectedHeader({ alg: "HS256" })
+    .setSubject("app")
+    .setIssuedAt()
+    .setExpirationTime(`${SESSION_MAX_AGE_SECONDS}s`)
+    .sign(signingKey());
+}
+
+export async function verifySessionToken(token: string | undefined | null): Promise<boolean> {
+  if (!token) return false;
+  try {
+    await jwtVerify(token, signingKey());
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export const sessionCookieOptions = {
+  name: SESSION_COOKIE_NAME,
+  httpOnly: true,
+  secure: true,
+  sameSite: "lax" as const,
+  path: "/",
+  maxAge: SESSION_MAX_AGE_SECONDS,
+};

lib/auth/timing-safe-compare.ts

@@ -0,0 +1,14 @@
+import { timingSafeEqual } from "node:crypto";
+
+/**
+ * Constant-time string comparison. `timingSafeEqual` throws on mismatched
+ * buffer lengths, which would itself leak length via which branch throws -
+ * so a length mismatch is treated as a plain (also constant-time-irrelevant,
+ * since it never reaches the byte comparison) false rather than propagating.
+ */
+export function timingSafeStringEqual(a: string, b: string): boolean {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual(bufA, bufB);
+}