Opus finding
Token-shape check accepts payload-only token (`body.`) but rejects empty-mac form; inconsistent guard, narrowly safe
lowmaintainabilitymedium
- apps/web/lib/optin-token.ts:67-70
- apps/web/lib/optin-token.test.ts:78-82
The guard `dot === token.length - 1` correctly rejects `body.` (no mac). However, `.onlymac` (dot at index 0, empty payload) passes the shape guard and proceeds to compute HMAC over the empty string, then compares against decoded `onlymac`. This is safe (HMAC of empty string != arbitrary bytes), but it's a wasted code path and an inconsistent symmetry — if you reject `body.` you should also reject `.mac`. Since timingSafeEqual rejects on length mismatch and JSON.parse rejects empty string, the net result is `kind: invalid` regardless, but the asymmetry is a maintenance hazard.
Recommendation
Tighten the guard to `dot <= 0 || dot === token.length - 1` so both empty halves short-circuit identically.