feat: add governed public self-enrollment links

src/govoplan_scheduling/backend/security.py

@@ -4,6 +4,7 @@ import base64
 import hashlib
 import hmac
 import os
+import secrets
 
 
 _ALGORITHM = "pbkdf2_sha256"
@@ -11,6 +12,22 @@ _DEFAULT_ITERATIONS = 260_000
 _SALT_BYTES = 16
 
 
+def new_public_credential() -> str:
+    """Create a URL-safe credential with at least 256 bits of entropy."""
+
+    return secrets.token_urlsafe(32)
+
+
+def public_credential_hash(value: str) -> str:
+    return hashlib.sha256(value.encode("utf-8")).hexdigest()
+
+
+def verify_public_credential(value: str, expected_hash: str | None) -> bool:
+    if not expected_hash:
+        return False
+    return hmac.compare_digest(public_credential_hash(value), expected_hash)
+
+
 def hash_participant_password(
     password: str,
     *,
@@ -58,4 +75,10 @@ def verify_participant_password(password: str, encoded: str | None) -> bool:
     return hmac.compare_digest(actual, expected)
 
 
-__all__ = ["hash_participant_password", "verify_participant_password"]
+__all__ = [
+    "hash_participant_password",
+    "new_public_credential",
+    "public_credential_hash",
+    "verify_participant_password",
+    "verify_public_credential",
+]