naibaandcloudcode d6f381d078 feat(idcodec): add hashid obfuscation derived from jwt secret ...

New pkg/idcodec wraps sqids with an alphabet derived from the JWT
secret via HKDF-SHA256 (info="nezha/idcodec/alphabet/v1"). Rotating
NZ_JWTSECRETKEY automatically reshuffles the alphabet, which doubles
as a kill switch for outstanding hashids without touching the encoder
itself.

The base alphabet drops visually-confusable characters (0/O/o/I/l/1)
and MinLength=8 hides small integer ids. Decode round-trips through
Encode to reject inputs that decode by accident under the same
alphabet.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

2026-05-26 03:50:36 +00:00

..

idcodec_test.go

feat(idcodec): add hashid obfuscation derived from jwt secret

2026-05-26 03:50:36 +00:00

idcodec.go

feat(idcodec): add hashid obfuscation derived from jwt secret

2026-05-26 03:50:36 +00:00