From b6f885635661c6c519a019e05d31d24fff191e1d Mon Sep 17 00:00:00 2001
From: Rose Hogenson <rosehogenson@posteo.net>
Date: Sat, 17 Oct 2026 11:41:00 -0700
Subject: Use a more insane cookie format

---
 roseh.moe.go | 37 ++++++++++++++++++++++++++-----------
 1 file changed, 26 insertions(+), 11 deletions(-)

(limited to 'roseh.moe.go')

diff --git a/roseh.moe.go b/roseh.moe.go
index a7842b7..2640250 100644
--- a/roseh.moe.go
+++ b/roseh.moe.go
@@ -706,40 +706,55 @@ func verify(signedMsg, purpose string) (string, bool) {
 	return msg, true
 }
 
-func marshalInt(x int64) []byte {
+func marshalInt(x uint64) []byte {
 	buf := make([]byte, 8)
-	binary.BigEndian.PutUint64(buf, uint64(x))
+	binary.BigEndian.PutUint64(buf, x)
 	for ; len(buf) > 0 && buf[0] == 0; buf = buf[1:] {
 	}
 	return buf
 }
 
-func unmarshalInt(b []byte) (int64, bool) {
+func unmarshalInt(b []byte) (uint64, bool) {
 	if len(b) > 8 {
 		return 0, false
 	}
 	buf := make([]byte, 8)
 	copy(buf[8-len(b):], b)
-	return int64(binary.BigEndian.Uint64(buf)), true
+	return binary.BigEndian.Uint64(buf), true
 }
 
-var myUnixEpoch = time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
-
 func marshalTime(t time.Time) []byte {
-	return marshalInt(int64(t.Sub(myUnixEpoch) / time.Second))
+	t = t.UTC()
+	year, month, day := t.Date()
+	hour, minute, second := t.Clock()
+	u := uint64(year)
+	u = u<<4 | uint64(month)
+	u = u<<5 | uint64(day)
+	u = u<<5 | uint64(hour)
+	u = u<<6 | uint64(minute)
+	u = u<<6 | uint64(second)
+	return marshalInt(u)
 }
 
 func unmarshalTime(b []byte) (time.Time, bool) {
-	n, ok := unmarshalInt(b)
+	u, ok := unmarshalInt(b)
 	if !ok {
 		return time.Time{}, false
 	}
-	return myUnixEpoch.Add(time.Duration(n) * time.Second), true
+	second, u := int(u&0x3f), u>>6
+	minute, u := int(u&0x3f), u>>6
+	hour, u := int(u&0x1f), u>>5
+	day, u := int(u&0x1f), u>>5
+	month, u := time.Month(u&0xf), u>>4
+	year := int(u)
+	return time.Date(year, month, day, hour, minute, second, 0, time.UTC), true
 }
 
+const authVersion = "authv2"
+
 func makeToken() string {
 	t := base64.RawURLEncoding.EncodeToString(marshalTime(time.Now()))
-	return t + mac(t, "auth")
+	return t + mac(t, authVersion)
 }
 
 const authCookieName = "a"
@@ -763,7 +778,7 @@ func cookieAuth(r *http.Request) (time.Duration, bool) {
 	if err != nil {
 		return 0, false
 	}
-	msg, ok := verify(cookie.Value, "auth")
+	msg, ok := verify(cookie.Value, authVersion)
 	if !ok {
 		return 0, false
 	}
-- 
cgit v1.3.1