Move server-side relay auth out of shared and drop the unused validator

shared/relay/auth/hmac/token.go

@@ -47,31 +47,6 @@ func (m *TimedHMAC) GenerateToken(algo func() hash.Hash) (*Token, error) {
 	}, nil
 }
 
-// Validate checks if the token is valid
-func (m *TimedHMAC) Validate(algo func() hash.Hash, token Token) error {
-	expectedMAC, err := m.generate(algo, token.Payload)
-	if err != nil {
-		return err
-	}
-
-	expectedSignature := base64.StdEncoding.EncodeToString(expectedMAC)
-
-	if !hmac.Equal([]byte(expectedSignature), []byte(token.Signature)) {
-		return fmt.Errorf("signature mismatch")
-	}
-
-	timeAuthInt, err := strconv.ParseInt(token.Payload, 10, 64)
-	if err != nil {
-		return fmt.Errorf("invalid payload: %w", err)
-	}
-
-	if time.Now().Unix() > timeAuthInt {
-		return fmt.Errorf("expired token")
-	}
-
-	return nil
-}
-
 func (m *TimedHMAC) generate(algo func() hash.Hash, payload string) ([]byte, error) {
 	mac := hmac.New(algo, []byte(m.secret))
 	_, err := mac.Write([]byte(payload))

shared/relay/auth/hmac/token_test.go

@@ -2,7 +2,6 @@ package hmac
 
 import (
 	"crypto/sha1"
-	"crypto/sha256"
 	"encoding/base64"
 	"strconv"
 	"testing"
@@ -33,73 +32,3 @@ func TestGenerateCredentials(t *testing.T) {
 		t.Fatalf("expected signature to be base64 encoded, got %v", err)
 	}
 }
-
-func TestValidateCredentials(t *testing.T) {
-	secret := "supersecret"
-	timeToLive := 1 * time.Hour
-	manager := NewTimedHMAC(secret, timeToLive)
-
-	// Test valid token
-	creds, err := manager.GenerateToken(sha1.New)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	if err := manager.Validate(sha1.New, *creds); err != nil {
-		t.Fatalf("expected valid token: %s", err)
-	}
-}
-
-func TestInvalidSignature(t *testing.T) {
-	secret := "supersecret"
-	timeToLive := 1 * time.Hour
-	manager := NewTimedHMAC(secret, timeToLive)
-
-	creds, err := manager.GenerateToken(sha256.New)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	invalidCreds := &Token{
-		Payload:   creds.Payload,
-		Signature: "invalidsignature",
-	}
-
-	if err = manager.Validate(sha1.New, *invalidCreds); err == nil {
-		t.Fatalf("expected invalid token due to signature mismatch")
-	}
-}
-
-func TestExpired(t *testing.T) {
-	secret := "supersecret"
-	v := NewTimedHMAC(secret, -1*time.Hour)
-	expiredCreds, err := v.GenerateToken(sha256.New)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	if err = v.Validate(sha1.New, *expiredCreds); err == nil {
-		t.Fatalf("expected invalid token due to expiration")
-	}
-}
-
-func TestInvalidPayload(t *testing.T) {
-	secret := "supersecret"
-	timeToLive := 1 * time.Hour
-	v := NewTimedHMAC(secret, timeToLive)
-
-	creds, err := v.GenerateToken(sha256.New)
-	if err != nil {
-		t.Fatalf("expected no error, got %v", err)
-	}
-
-	// Test invalid payload
-	invalidPayloadCreds := &Token{
-		Payload:   "invalidtimestamp",
-		Signature: creds.Signature,
-	}
-
-	if err = v.Validate(sha1.New, *invalidPayloadCreds); err == nil {
-		t.Fatalf("expected invalid token due to invalid payload")
-	}
-}