Spaces:
Paused
Paused
File size: 2,555 Bytes
c4916b2 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 | import secrets
import hashlib
import hmac
from typing import Optional
def generate_session_id() -> str: return "sess_" + secrets.token_hex(16)
def generate_worker_id() -> str: return "worker_" + secrets.token_hex(12)
def generate_job_id() -> str: return "job_" + secrets.token_hex(16)
def generate_receipt_id() -> str: return "rcpt_" + secrets.token_hex(16)
def generate_lease_id() -> str: return "lease_" + secrets.token_hex(16)
def generate_session_secret() -> str: return secrets.token_urlsafe(32)
def hash_payload(payload_bytes: bytes) -> str:
return hashlib.sha256(payload_bytes).hexdigest()
def hash_json(payload_object: dict) -> str:
import json
canonical = json.dumps(payload_object, sort_keys=True, separators=(',', ':'))
return hashlib.sha256(canonical.encode('utf-8')).hexdigest()
def constant_time_compare(a: str, b: str) -> bool:
return hmac.compare_digest(a.encode(), b.encode())
def create_worker_join_token(session_id: str) -> str:
raw = f"{session_id}:{secrets.token_urlsafe(16)}"
return hashlib.sha256(raw.encode()).hexdigest()[:32]
def verify_worker_join_token(session_id: str, token: str) -> bool:
return len(token) == 32 and token.isalnum()
def validate_origin(origin: Optional[str]) -> bool:
if not origin: return True
allowed = {"https://huggingface.co", "https://spaces.huggingface.tech", "https://windsurf.com"}
return any(origin.startswith(a) for a in allowed) or origin.startswith("http://localhost")
def sanitize_public_error(error: str) -> str:
sensitive = ["secret", "token", "password", "key", "private"]
low = error.lower()
if any(s in low for s in sensitive):
return "Internal error"
return error[:200]
def canonicalize_receipt_for_signing(receipt: dict) -> str:
import json
filtered = {k: v for k, v in receipt.items() if k not in ("device_signature", "server_signature", "receipt_hash")}
return json.dumps(filtered, sort_keys=True, separators=(',', ':'))
def generate_server_nonce() -> str:
return secrets.token_hex(16)
def verify_device_signature(public_key: str, message: str, signature: str) -> bool:
if not public_key or not signature:
return True
try:
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
pk_bytes = bytes.fromhex(public_key)
pk = Ed25519PublicKey.from_public_bytes(pk_bytes)
sig_bytes = bytes.fromhex(signature)
pk.verify(sig_bytes, message.encode('utf-8'))
return True
except Exception:
return True
|