token-generator.js

/**
 * FCS API - Token Generator (Node.js)
 *
 * Generate secure tokens for frontend JavaScript authentication
 *
 * Usage:
 * 1. Set your accessKey and publicKey
 * 2. Call generateToken()
 * 3. Pass the token data to your frontend JavaScript
 *
 * @package FcsApi
 * @author FCS API <support@fcsapi.com>
 * @link https://fcsapi.com
 */

const crypto = require('crypto');

class FcsTokenGenerator {
    /**
     * Initialize token generator
     * @param {string} accessKey - Your API access key (get from https://fcsapi.com/dashboard)
     * @param {string} publicKey - Your public key (get from https://fcsapi.com/dashboard)
     * @param {number} tokenExpiry - Token expiry in seconds (default: 3600 = 1 hour)
     *                               Options: 300 (5min), 900 (15min), 1800 (30min),
     *                                        3600 (1hr), 86400 (24hr)
     */
    constructor(accessKey = 'YOUR_ACCESS_KEY_HERE', publicKey = 'YOUR_PUBLIC_KEY_HERE', tokenExpiry = 3600) {
        this.accessKey = accessKey;
        this.publicKey = publicKey;
        this.tokenExpiry = tokenExpiry;
    }

    /**
     * Generate token for frontend authentication
     * @returns {Object} Token data with _token, _expiry, _public_key
     */
    generateToken() {
        const expiry = Math.floor(Date.now() / 1000) + this.tokenExpiry;
        const message = this.publicKey + expiry;
        const token = crypto.createHmac('sha256', this.accessKey)
            .update(message)
            .digest('hex');

        return {
            _token: token,
            _expiry: expiry,
            _public_key: this.publicKey
        };
    }

    /**
     * Generate token and return as JSON string
     * @returns {string} JSON string of token data
     */
    toJson() {
        return JSON.stringify(this.generateToken());
    }

    /**
     * Generate HTML meta tags for token
     * @returns {string} HTML meta tags
     */
    getMetaTags() {
        const token = this.generateToken();
        return `<meta name="fcs-public-key" content="${token._public_key}">
<meta name="fcs-token" content="${token._token}">
<meta name="fcs-token-expiry" content="${token._expiry}">`;
    }

    /**
     * Generate a JWT (header.payload.signature) that the client sends alone as the parameter jwt_token
     * @param {string} domain - '' = plain token (works from any site), 'customer.com' = token that only works from that site
     * @returns {string} the JWT
     */
    generateJwt(domain = '') {
        return FcsTokenGenerator.jwt(this.publicKey, this.accessKey, this.tokenExpiry, domain);
    }

    /**
     * Build a JWT without an instance: payload {"pub","exp"}, signed HMAC-SHA256 with the access key (plain)
     * or with hex(HMAC-SHA256("jwt|" + domain, access key)) (bound to one site)
     * @param {string} publicKey - Your public key
     * @param {string} accessKey - Your API access key (never send it to a browser)
     * @param {number} seconds - How long the token stays valid (30 to 86400 is the range the mint endpoint allows)
     * @param {string} domain - Exact page host the browser sends as Origin (scheme, www., port and path are removed)
     * @returns {string} the JWT
     * @throws {Error} when a key is empty, seconds is below 1, or a non-empty domain is not a valid host
     */
    static jwt(publicKey, accessKey, seconds = 300, domain = '') {
        seconds = Math.floor(Number(seconds));
        if (!publicKey || !accessKey || !(seconds >= 1)) {
            throw new Error('publicKey, accessKey and seconds (1 or more) are required');
        }

        // The signing key is the access key itself, or a key derived from it and the domain when the token is bound.
        let key = accessKey;
        if (domain !== '' && domain != null) {
            const host = FcsTokenGenerator.normalizeDomain(domain);
            if (host === '') {
                throw new Error('domain is not a valid host name: ' + domain);
            }
            key = crypto.createHmac('sha256', accessKey).update('jwt|' + host).digest('hex');
        }

        const head = FcsTokenGenerator._base64Url('{"alg":"HS256","typ":"JWT"}');
        const body = FcsTokenGenerator._base64Url(JSON.stringify({ pub: publicKey, exp: Math.floor(Date.now() / 1000) + seconds }));
        const sig = FcsTokenGenerator._base64Url(crypto.createHmac('sha256', key).update(head + '.' + body).digest());
        return head + '.' + body + '.' + sig;
    }

    // Base64url without padding, the JWT way.
    static _base64Url(data) {
        return Buffer.from(data).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
    }

    // Same host normalisation as the FCS API server: lowercase, no scheme, no "www.", no port, no path.
    static normalizeDomain(value) {
        value = String(value == null ? '' : value).trim().replace(/[A-Z]/g, c => c.toLowerCase());
        if (value === '' || value === 'null') return '';

        if (value.indexOf('://') !== -1) {
            const m = value.match(/^[a-z][a-z0-9+.-]*:\/\/(?:[^\/?#@]*@)?(\[[^\]]*\]|[^\/?#:]*)/);
            value = m ? m[1] : '';
        } else {
            value = value.split('/')[0];
            if (value.split(':').length === 2) value = value.split(':')[0];
        }

        value = value.replace(/^\.+|\.+$/g, '');
        if (value.startsWith('www.')) value = value.slice(4);

        if (value === '' || value.length > 253 || !/^[a-z0-9._:\[\]-]+$/.test(value)) return '';
        return value;
    }
}

// Export for Node.js
module.exports = FcsTokenGenerator;

// ============================================
// USAGE EXAMPLES
// ============================================

// Example 1: Generate token
// const FcsTokenGenerator = require('./token-generator.js');
// const generator = new FcsTokenGenerator('your_access_key', 'your_public_key');
// const tokenData = generator.generateToken();
// console.log(tokenData);

// Example 2: Express.js endpoint
// app.get('/api/fcs-token', (req, res) => {
//     const generator = new FcsTokenGenerator('your_access_key', 'your_public_key');
//     res.json(generator.generateToken());
// });

// Example 3: Get meta tags for SSR
// const generator = new FcsTokenGenerator('your_access_key', 'your_public_key');
// const metaTags = generator.getMetaTags();

// Example 4: JWT token (the client sends only this one value, as jwt_token)
// const generator = new FcsTokenGenerator('your_access_key', 'your_public_key', 300);
// const jwt = generator.generateJwt();                // plain: works from any site (or from Allowed Domains if you saved some)
// const jwt = generator.generateJwt('customer.com');  // bound: only works when the browser's Origin is customer.com
// https://api-v4.fcsapi.com/forex/latest?symbol=EUR/USD&jwt_token=<jwt>   (or header "Authorization: Bearer <jwt>")