@bsv/wallet-toolbox 1.6.36 → 1.6.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bsv/wallet-toolbox",
-  "version": "1.6.36",
+  "version": "1.6.38",
   "description": "BRC100 conforming wallet, wallet storage and wallet signer components",
   "main": "./out/src/index.js",
   "types": "./out/src/index.d.ts",
@@ -33,7 +33,7 @@
   "dependencies": {
     "@bsv/auth-express-middleware": "^1.2.3",
     "@bsv/payment-express-middleware": "^1.2.3",
-    "@bsv/sdk": "^1.8.6",
+    "@bsv/sdk": "^1.8.10",
     "express": "^4.21.2",
     "idb": "^8.0.2",
     "knex": "^3.1.0",

package/src/sdk/__test/validationHelpers.test.ts

@@ -0,0 +1,22 @@
+import { Utils } from '@bsv/sdk'
+import { validateBase64String } from '../validationHelpers'
+describe('validationHelpers tests', () => {
+  jest.setTimeout(99999999)
+
+  test('0 validateBase64String', async () => {
+    const validB64 = 'SGVsbG8gV29ybGQh' // "Hello World!"
+
+    const s = validateBase64String(validB64, 'testParam', 1, 20)
+    expect(s).toBe(validB64)
+
+    {
+      const invalidB64 = 'SGVsbG8g29ybGQh'
+      expect(() => validateBase64String(invalidB64, 'testParam', 1, 20)).toThrow()
+    }
+
+    {
+      const invalidB64 = 'SGVsbG8gV29ybGQh='
+      expect(() => validateBase64String(invalidB64, 'testParam', 1, 20)).toThrow()
+    }
+  })
+})

package/src/sdk/validationHelpers.ts

@@ -165,20 +165,67 @@ function validateOptionalBase64String(
   return validateBase64String(s, name, min, max)
 }
 
-function validateBase64String(s: string, name: string, min?: number, max?: number): string {
-  // Remove any whitespace and check if the string length is valid for Base64
+/**
+ * Validate a Base64 string (structure and decoded size).
+ *
+ * @param s - base64 string
+ * @param name - parameter name used in error messages
+ * @param min - optional minimum decoded byte length
+ * @param max - optional maximum decoded byte length
+ * @returns validated base64 string
+ * @throws WERR_INVALID_PARAMETER when invalid
+ */
+export function validateBase64String(s: string, name: string, min?: number, max?: number): string {
   s = s.trim()
-  const base64Regex = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/
-  const paddingMatch = /=+$/.exec(s)
-  const paddingCount = paddingMatch ? paddingMatch[0].length : 0
+  if (s.length === 0) {
+    throw new WERR_INVALID_PARAMETER(name, 'valid base64 string')
+  }
 
-  if (paddingCount > 2 || (s.length % 4 !== 0 && paddingCount !== 0) || !base64Regex.test(s)) {
-    throw new WERR_INVALID_PARAMETER(name, `balid base64 string`)
+  let paddingCount = 0
+  let validCharCount = 0
+
+  for (let i = 0; i < s.length; i++) {
+    const char = s.charCodeAt(i)
+    if (char >= 65 && char <= 90) continue // A-Z
+    if (char >= 97 && char <= 122) continue // a-z
+    if (char >= 48 && char <= 57) continue // 0-9
+    if (char === 43) continue // +
+    if (char === 47) continue // /
+    if (char === 61) {
+      // =
+      if (i < s.length - 2) {
+        throw new WERR_INVALID_PARAMETER(name, 'valid base64 string')
+      }
+      paddingCount++
+      continue
+    }
+    throw new WERR_INVALID_PARAMETER(name, 'valid base64 string')
   }
 
-  const bytes = Utils.toArray(s, 'base64').length
-  if (min !== undefined && bytes < min) throw new WERR_INVALID_PARAMETER(name, `at least ${min} length.`)
-  if (max !== undefined && bytes > max) throw new WERR_INVALID_PARAMETER(name, `no more than ${max} length.`)
+  // Padding rules
+  if (paddingCount > 2) {
+    throw new WERR_INVALID_PARAMETER(name, 'valid base64 string')
+  }
+  if (paddingCount > 0 && s.length % 4 !== 0) {
+    throw new WERR_INVALID_PARAMETER(name, 'valid base64 string')
+  }
+
+  // Length must be multiple of 4 if no padding, or valid with padding
+  const mod = s.length % 4
+  if (mod !== 0 && mod !== 4 - paddingCount) {
+    throw new WERR_INVALID_PARAMETER(name, 'valid base64 string')
+  }
+
+  // Calculate decoded byte length: (valid chars * 6) / 8
+  const encodedLength = s.length - paddingCount
+  const bytes = Math.floor((encodedLength * 3) / 4)
+
+  if (min !== undefined && bytes < min) {
+    throw new WERR_INVALID_PARAMETER(name, `at least ${min} bytes`)
+  }
+  if (max !== undefined && bytes > max) {
+    throw new WERR_INVALID_PARAMETER(name, `no more than ${max} bytes`)
+  }
 
   return s
 }
@@ -513,6 +560,7 @@ export function validateOriginator(s?: string): string | undefined {
   for (const sp of sps) {
     validateStringLength(sp, 'originator part', 1, 63)
   }
+  return s
 }
 
 export function validateInternalizeActionArgs(args: InternalizeActionArgs): ValidInternalizeActionArgs {