修复认证挑战与可信代理安全边界（07-17-auth-challenge-trusted-proxy-hardening）

server/src/utils/crypto.js

@@ -5,6 +5,32 @@ function sha256Hex(input) {
   return crypto.createHash("sha256").update(input).digest("hex");
 }
 
+function generateSixDigitCode() {
+  return String(crypto.randomInt(0, 1_000_000)).padStart(6, "0");
+}
+
+function hashAuthCode({ employeeId, code, purpose, pepper }) {
+  return crypto
+    .createHmac("sha256", pepper)
+    .update(`${purpose}:${employeeId}:${code}`)
+    .digest("hex");
+}
+
+function timingSafeEqualHex(left, right) {
+  if (
+    typeof left !== "string" ||
+    typeof right !== "string" ||
+    !/^[0-9a-f]+$/i.test(left) ||
+    !/^[0-9a-f]+$/i.test(right)
+  ) {
+    return false;
+  }
+
+  const leftBuffer = Buffer.from(left, "hex");
+  const rightBuffer = Buffer.from(right, "hex");
+  return leftBuffer.length === rightBuffer.length && crypto.timingSafeEqual(leftBuffer, rightBuffer);
+}
+
 function randomRefreshToken() {
   return crypto.randomBytes(32).toString("base64url");
 }
@@ -19,9 +45,11 @@ async function verifyPassword(password, passwordHash) {
 }
 
 module.exports = {
+  generateSixDigitCode,
   hashPassword,
+  hashAuthCode,
   randomRefreshToken,
   sha256Hex,
+  timingSafeEqualHex,
   verifyPassword,
 };
-