@cakioe/hmac-signer 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 cleveng
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,279 @@
-# Temporary Holding Version
+# HMAC SHA256 Signer
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A lightweight HMAC-SHA256 signing and verification library written in Rust.
+
+Supports both native Rust applications and WebAssembly (WASM), allowing the same implementation to be used in Rust, JavaScript, and TypeScript projects.
+
+## Features
+
+- HMAC-SHA256 signature generation.
+- HMAC-SHA256 signature verification.
+- Optional timestamp tolerance validation.
+- Hexadecimal signature encoding.
+- Constant-time signature verification.
+- Native Rust library support.
+- WebAssembly support.
+- TypeScript type definitions through `wasm-bindgen`.
+
+## Installation
+
+### Rust
+
+Add the dependency to your `Cargo.toml`:
+
+```toml
+[dependencies]
+hmac-signer = "1.0.0"
+```
+
+### TypeScript / JavaScript
+
+Install from npm:
+
+```bash
+pnpm add hmac-signer
+```
+
+Or:
+
+```bash
+npm install hmac-signer
+```
+
+## Usage
+
+### Rust usage
+
+Import the signer:
+
+```rust
+use hmac_signer::{HmacSha256Signer, HmacSha256SignerTrait};
+```
+
+#### Create a signer
+
+```rust
+let signer = HmacSha256Signer::new("your-secret-key");
+```
+
+#### Generate a signature
+
+```rust
+let timestamp = 1793352268_i64;
+let body = br#"{"amount":100,"currency":"USD"}"#;
+
+let signature = signer.sign(timestamp, body)?;
+
+println!("Signature: {}", signature);
+```
+
+#### Verify a signature
+
+```rust
+let valid = signer.verify(
+    timestamp,
+    body,
+    &signature,
+    Some(300),
+)?;
+
+println!("Valid: {}", valid);
+```
+
+#### Disable timestamp validation
+
+Pass `None` as the tolerance parameter:
+
+```rust
+let valid = signer.verify(
+    timestamp,
+    body,
+    &signature,
+    None,
+)?;
+```
+
+### TypeScript / JavaScript usage
+
+Import the signer:
+
+```typescript
+import { HmacSha256Signer } from 'hmac-signer';
+```
+
+#### Create a signer by typescript
+
+```typescript
+const signer = new HmacSha256Signer('your-secret-key');
+```
+
+#### Generate a signature by typescript
+
+```typescript
+const timestamp = BigInt(Math.floor(Date.now() / 1000));
+
+const body = new TextEncoder().encode(
+  JSON.stringify({
+    amount: 100,
+    currency: 'USD',
+  })
+);
+
+const signature = signer.sign(timestamp, body);
+
+console.log(signature);
+```
+
+#### Verify a signature by typescript
+
+```typescript
+const valid = signer.verify(timestamp, body, signature, 300n);
+
+console.log(valid);
+```
+
+#### Disable timestamp validation by typescript
+
+Pass `undefined`:
+
+```typescript
+const valid = signer.verify(timestamp, body, signature, undefined);
+```
+
+## Signature Format
+
+The signature is generated using HMAC-SHA256.
+
+The signed message format is:
+
+```text
+timestamp + "." + request_body
+```
+
+The signature generation algorithm:
+
+```text
+HMAC-SHA256(
+    secret,
+    timestamp + "." + request_body
+)
+```
+
+The resulting digest is encoded as a lowercase hexadecimal string.
+
+Example:
+
+```text
+timestamp = 1793352268
+body      = {"amount":100}
+
+message   = 1793352268.{"amount":100}
+
+signature = HMAC-SHA256(secret, message)
+```
+
+## Timestamp Tolerance
+
+The `verify` method accepts an optional `tolerance` parameter.
+
+| Parameter   | Description                                       |
+| ----------- | ------------------------------------------------- |
+| `Some(300)` | Allow a timestamp difference of up to 300 seconds |
+| `Some(60)`  | Allow a timestamp difference of up to 60 seconds  |
+| `Some(0)`   | Require the timestamp to match the current second |
+| `None`      | Disable timestamp validation                      |
+
+If the timestamp is outside the allowed window, verification returns an error.
+
+## API Reference
+
+### HmacSha256Signer
+
+Creates an HMAC-SHA256 signer.
+
+```rust
+HmacSha256Signer::new(secret: impl Into<String>) -> Self
+```
+
+### sign
+
+Generates a signature.
+
+```rust
+fn sign(
+    &self,
+    timestamp: i64,
+    body: &[u8],
+) -> Result<String, anyhow::Error>
+```
+
+### verify
+
+Verifies a signature.
+
+```rust
+fn verify(
+    &self,
+    timestamp: i64,
+    body: &[u8],
+    signature: &str,
+    tolerance: Option<i64>,
+) -> Result<bool, anyhow::Error>
+```
+
+## Building from Source
+
+### Native Rust
+
+```bash
+cargo build --release
+```
+
+Run tests:
+
+```bash
+cargo test
+```
+
+### WebAssembly
+
+Install the WASM target:
+
+```bash
+rustup target add wasm32-unknown-unknown
+```
+
+Install `wasm-pack`:
+
+```bash
+cargo install wasm-pack
+```
+
+Build the WASM package:
+
+```bash
+wasm-pack build --target bundler --release -- --features wasm
+
+wasm-pack build \
+  --target bundler \
+  --release \
+  --scope cakioe \
+  --out-dir pkg \
+  --out-name hmac_signer \
+  -- --features wasm
+```
+
+The generated npm package will be available in the `pkg/` directory.
+
+## Security Considerations
+
+- Keep your secret key confidential.
+- Always use HTTPS when transmitting signatures.
+- Use timestamp validation to reduce replay attack risks.
+- Verify the original raw request body instead of re-serialized JSON.
+- Use sufficiently random secret keys.
+- Implement replay protection when strict request uniqueness is required.
+
+## License
+
+MIT

package/hmac_signer.d.ts

@@ -0,0 +1,8 @@
+/* tslint:disable */
+/* eslint-disable */
+
+export class HmacSha256Signer {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+}

package/hmac_signer.js

@@ -0,0 +1,9 @@
+/* @ts-self-types="./hmac_signer.d.ts" */
+import * as wasm from "./hmac_signer_bg.wasm";
+import { __wbg_set_wasm } from "./hmac_signer_bg.js";
+
+__wbg_set_wasm(wasm);
+wasm.__wbindgen_start();
+export {
+    HmacSha256Signer
+} from "./hmac_signer_bg.js";

package/hmac_signer_bg.js

@@ -0,0 +1,60 @@
+export class HmacSha256Signer {
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        HmacSha256SignerFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_hmacsha256signer_free(ptr, 0);
+    }
+}
+if (Symbol.dispose) HmacSha256Signer.prototype[Symbol.dispose] = HmacSha256Signer.prototype.free;
+export function __wbg___wbindgen_throw_4c88d8bf264fd984(arg0, arg1) {
+    throw new Error(getStringFromWasm0(arg0, arg1));
+}
+export function __wbindgen_init_externref_table() {
+    const table = wasm.__wbindgen_externrefs;
+    table.set(0, undefined);
+    table.set(1024, undefined);
+    table.set(1025, null);
+    table.set(1026, true);
+    table.set(1027, false);
+}
+const HmacSha256SignerFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_hmacsha256signer_free(ptr, 1));
+
+function getStringFromWasm0(ptr, len) {
+    ptr = ptr >>> 0;
+    return decodeText(getUint8ArrayMemory0().subarray(ptr, ptr + len));
+}
+
+let cachedUint8ArrayMemory0 = null;
+function getUint8ArrayMemory0() {
+    if (cachedUint8ArrayMemory0 === null || cachedUint8ArrayMemory0.byteLength === 0) {
+        cachedUint8ArrayMemory0 = new Uint8Array(wasm.memory.buffer);
+    }
+    return cachedUint8ArrayMemory0;
+}
+
+let cachedTextDecoder = new TextDecoder('utf-8', { ignoreBOM: true });
+cachedTextDecoder.decode();
+const MAX_SAFARI_DECODE_BYTES = 2146435072;
+let numBytesDecoded = 0;
+function decodeText(bytes) {
+    numBytesDecoded += bytes.length;
+    if (numBytesDecoded >= MAX_SAFARI_DECODE_BYTES) {
+        cachedTextDecoder = new TextDecoder('utf-8', { ignoreBOM: true });
+        cachedTextDecoder.decode();
+        numBytesDecoded = bytes.length;
+    }
+    return cachedTextDecoder.decode(bytes);
+}
+
+
+let wasm;
+export function __wbg_set_wasm(val) {
+    wasm = val;
+}

package/package.json

@@ -1,6 +1,26 @@
 {
   "name": "@cakioe/hmac-signer",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "type": "module",
+  "collaborators": [
+    "cleveng <cleveng@gmail.com>"
+  ],
+  "description": "Hmac Signer By Rust",
+  "version": "1.0.0",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cleveng/hmac-signer.git"
+  },
+  "files": [
+    "hmac_signer_bg.wasm",
+    "hmac_signer.js",
+    "hmac_signer_bg.js",
+    "hmac_signer.d.ts"
+  ],
+  "main": "hmac_signer.js",
+  "types": "hmac_signer.d.ts",
+  "sideEffects": [
+    "./hmac_signer.js",
+    "./snippets/*"
+  ]
+}