v0.4.0 harden jwt, scram, credential handling, remove legacy adapters

token.go

@@ -5,7 +5,9 @@ import (
 	"sync"
 )
 
-// SimpleTokenValidator implements in-memory token validation
+// SimpleTokenValidator is a concurrent in-memory allowlist of opaque tokens.
+// Its zero value is ready to use. Tokens have no automatic expiration; use JWT
+// for signed expiry or RemoveToken for explicit revocation.
 type SimpleTokenValidator struct {
 	tokens map[[32]byte]struct{} // keyed by SHA-256(token)
 	mu     sync.RWMutex
@@ -20,6 +22,9 @@ func NewSimpleTokenValidator() *SimpleTokenValidator {
 
 // ValidateToken checks if token is valid
 func (v *SimpleTokenValidator) ValidateToken(token string) bool {
+	if token == "" || len(token) > MaxTokenLen {
+		return false
+	}
 	h := sha256.Sum256([]byte(token))
 	v.mu.RLock()
 	defer v.mu.RUnlock()
@@ -27,16 +32,26 @@ func (v *SimpleTokenValidator) ValidateToken(token string) bool {
 	return ok
 }
 
-// AddToken adds token to validator
+// AddToken adds a token to the allowlist. Empty and oversized tokens are ignored.
+// Provision high-entropy tokens, e.g. with crypto/rand.Text; do not use passwords.
 func (v *SimpleTokenValidator) AddToken(token string) {
+	if token == "" || len(token) > MaxTokenLen {
+		return
+	}
 	h := sha256.Sum256([]byte(token))
 	v.mu.Lock()
 	defer v.mu.Unlock()
+	if v.tokens == nil {
+		v.tokens = make(map[[32]byte]struct{})
+	}
 	v.tokens[h] = struct{}{}
 }
 
 // RemoveToken removes token from validator
 func (v *SimpleTokenValidator) RemoveToken(token string) {
+	if token == "" || len(token) > MaxTokenLen {
+		return
+	}
 	h := sha256.Sum256([]byte(token))
 	v.mu.Lock()
 	defer v.mu.Unlock()