class

KemalIdentity::RandomSource

The only source of randomness in the shard.

Injected rather than called directly so that token generation is reproducible under test. src/CLAUDE.md bans Random::Secure everywhere in src/ except SecureRandomSource below; spec/unit/source_hygiene_spec.cr enforces that ban.

Constants

TOKEN_BYTES = 32

Minimum entropy for any secret this shard hands to a browser. Session tokens, remember-me tokens and action tokens all use at least this many bytes (docs/02-security-model.md, token discipline rule 1).

Class methods

token_length(count : Int32 = TOKEN_BYTES) : Int32

The exact length of token(count)'s output, for the pre-I/O shape check.

Source

Instance methods

bytes(count : Int32) : Bytes

count cryptographically random bytes.

Source

token(count : Int32 = TOKEN_BYTES) : String

A URL-safe secret of count random bytes, base64url encoded without padding.

Padding is stripped so the value carries no =, which keeps it safe in a cookie value and in a URL without further escaping, and keeps its length fixed — the shape check on the hot path is an exact length comparison, performed before any hashing or I/O.

Source