Fix #270 review: use Web Crypto RNG, soften doc claim, reword stale comments

Author: Ayush7614

apps/web/src/__tests__/postmark-webhook.test.ts

@@ -1675,7 +1675,7 @@ describe('Postmark inbound webhook', () => {
 
         // ── MailboxHash is not a capability token (issue #189) ───────────────
         //
-        // `generateTicketId()` is 8 chars of Math.random(), and the Discord/Slack
+        // `generateTicketId()` is short (8 chars) and the Discord/Slack
         // bots posted "Ticket TKT-XXXXXXXX created" into public threads. Display
         // IDs are therefore harvestable, so the plus-address path is gated the
         // same way the header path is: EMAIL-sourced ticket, participating sender.

apps/web/src/app/api/webhooks/postmark/route.ts

@@ -17,8 +17,8 @@
  * BOTH signals are attacker-supplied, so both paths resolve through the same
  * two gates: the ticket must be `source: 'EMAIL'`, and the sender must already
  * be a participant on it. `MailboxHash` is a token we mint, but minting it does
- * not make it a secret — `generateTicketId()` is 8 characters of `Math.random()`
- * and the Discord/Slack bots published "Ticket TKT-XXXXXXXX created" into public
+ * not make it a secret — `generateTicketId()` is short (8 characters) and the
+ * Discord/Slack bots published "Ticket TKT-XXXXXXXX created" into public
  * threads, so display IDs are harvestable. Without the gates, anyone holding one
  * could append to (and reopen) any ticket on any channel.
  *
@@ -66,7 +66,7 @@ const REPLY_TARGET_SELECT = {
  * Resolve a plus-addressed `MailboxHash` to the ticket it names.
  *
  * A display ID is not a secret. `generateTicketId()` draws 8 characters from a
- * 32-character alphabet with `Math.random()`, and the Discord/Slack bots posted
+ * 32-character alphabet, and the Discord/Slack bots posted
  * "Ticket TKT-XXXXXXXX created" into public threads — those threads still carry
  * the IDs. So naming a ticket is not evidence of belonging to it, and this path
  * gets exactly the gates the header path has:

packages/outpost/shared/src/utils.ts

@@ -1,20 +1,23 @@
-import { randomInt } from 'node:crypto';
 import { TICKET_ID_PREFIX, BACKOFF_BASE_MS, BACKOFF_MAX_MS } from './constants.js';
 
 /**
  * Generate a unique ticket ID in the format TKT-XXXXXXXX.
  * Uses 8 random characters from a 32-char alphabet (~1.1 trillion keyspace)
  * to make collisions negligible at scale.
  *
- * Drawn from `crypto.randomInt` (CSPRNG): display IDs are pasted into public
- * threads and are therefore harvestable, so a non-crypto RNG would let an
- * attacker shrink the search space for ID enumeration.
+ * Drawn from Web Crypto (`globalThis.crypto.getRandomValues`, a CSPRNG, so it
+ * works in both Node and browser bundles): display IDs are short and public,
+ * so keeping them unguessable is good hygiene. Authorization still lives at
+ * the gates — knowing an ID alone grants nothing.
  */
 export function generateTicketId(): string {
     const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789'; // Omit ambiguous chars
+    const bytes = new Uint8Array(8);
+    globalThis.crypto.getRandomValues(bytes);
     let id = '';
     for (let i = 0; i < 8; i++) {
-        id += chars[randomInt(chars.length)];
+        // 256 is an exact multiple of 32, so masking is uniform.
+        id += chars[bytes[i]! & 31];
     }
     return `${TICKET_ID_PREFIX}-${id}`;
 }