@cakioe/hmac-signer 0.0.0-stage → 1.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 cleveng
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,282 @@
-# Temporary Holding Version
+# HMAC SHA256 Signer
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A lightweight HMAC-SHA256 signing and verification library written in Rust.
+
+Supports both native Rust applications and WebAssembly (WASM), allowing the same implementation to be used in Rust, JavaScript, and TypeScript projects.
+
+## Features
+
+- HMAC-SHA256 signature generation.
+- HMAC-SHA256 signature verification.
+- Optional timestamp tolerance validation.
+- Hexadecimal signature encoding.
+- Constant-time signature verification.
+- Native Rust library support.
+- WebAssembly support.
+- TypeScript type definitions through `wasm-bindgen`.
+
+## Installation
+
+### Rust
+
+Add the dependency to your `Cargo.toml`:
+
+```toml
+[dependencies]
+hmac-signer = "1.0.0"
+```
+
+### TypeScript / JavaScript
+
+Install from npm:
+
+```bash
+pnpm add hmac-signer
+```
+
+Or:
+
+```bash
+npm install hmac-signer
+```
+
+## Usage
+
+### Rust usage
+
+Import the signer:
+
+```rust
+use hmac_signer::{HmacSha256Signer, HmacSha256SignerTrait};
+```
+
+#### Create a signer
+
+```rust
+let signer = HmacSha256Signer::new("your-secret-key");
+```
+
+#### Generate a signature
+
+```rust
+let timestamp = 1793352268_i64;
+let body = br#"{"amount":100,"currency":"USD"}"#;
+
+let signature = signer.sign(timestamp, body)?;
+
+println!("Signature: {}", signature);
+```
+
+#### Verify a signature
+
+```rust
+let valid = signer.verify(
+    timestamp,
+    body,
+    &signature,
+    Some(300),
+)?;
+
+println!("Valid: {}", valid);
+```
+
+#### Disable timestamp validation
+
+Pass `None` as the tolerance parameter:
+
+```rust
+let valid = signer.verify(
+    timestamp,
+    body,
+    &signature,
+    None,
+)?;
+```
+
+### TypeScript / JavaScript usage
+
+Import the signer:
+
+```typescript
+import { HmacSha256Signer } from 'hmac-signer';
+```
+
+#### Create a signer by typescript
+
+```typescript
+const signer = new HmacSha256Signer('your-secret-key');
+```
+
+#### Generate a signature by typescript
+
+```typescript
+const timestamp = BigInt(Math.floor(Date.now() / 1000));
+
+const body = new TextEncoder().encode(
+  JSON.stringify({
+    amount: 100,
+    currency: 'USD',
+  })
+);
+
+const signature = signer.sign(timestamp, body);
+
+console.log(signature);
+```
+
+#### Verify a signature by typescript
+
+```typescript
+const valid = signer.verify(timestamp, body, signature, 300n);
+
+console.log(valid);
+```
+
+#### Disable timestamp validation by typescript
+
+Pass `undefined`:
+
+```typescript
+const valid = signer.verify(timestamp, body, signature, undefined);
+```
+
+## Signature Format
+
+The signature is generated using HMAC-SHA256.
+
+The signed message format is:
+
+```text
+timestamp + "." + request_body
+```
+
+The signature generation algorithm:
+
+```text
+HMAC-SHA256(
+    secret,
+    timestamp + "." + request_body
+)
+```
+
+The resulting digest is encoded as a lowercase hexadecimal string.
+
+Example:
+
+```text
+timestamp = 1793352268
+body      = {"amount":100}
+
+message   = 1793352268.{"amount":100}
+
+signature = HMAC-SHA256(secret, message)
+```
+
+## Timestamp Tolerance
+
+The `verify` method accepts an optional `tolerance` parameter.
+
+| Parameter   | Description                                       |
+| ----------- | ------------------------------------------------- |
+| `Some(300)` | Allow a timestamp difference of up to 300 seconds |
+| `Some(60)`  | Allow a timestamp difference of up to 60 seconds  |
+| `Some(0)`   | Require the timestamp to match the current second |
+| `None`      | Disable timestamp validation                      |
+
+If the timestamp is outside the allowed window, verification returns an error.
+
+## API Reference
+
+### HmacSha256Signer
+
+Creates an HMAC-SHA256 signer.
+
+```rust
+HmacSha256Signer::new(secret: impl Into<String>) -> Self
+```
+
+### sign
+
+Generates a signature.
+
+```rust
+fn sign(
+    &self,
+    timestamp: i64,
+    body: &[u8],
+) -> Result<String, anyhow::Error>
+```
+
+### verify
+
+Verifies a signature.
+
+```rust
+fn verify(
+    &self,
+    timestamp: i64,
+    body: &[u8],
+    signature: &str,
+    tolerance: Option<i64>,
+) -> Result<bool, anyhow::Error>
+```
+
+## Building from Source
+
+### Native Rust
+
+```bash
+cargo build --release
+```
+
+Run tests:
+
+```bash
+cargo test
+```
+
+### WebAssembly
+
+Install the WASM target:
+
+```bash
+rustup target add wasm32-unknown-unknown
+```
+
+Install `wasm-pack`:
+
+```bash
+cargo install wasm-pack
+```
+
+Build the WASM package:
+
+```bash
+wasm-pack build --target bundler --release -- --features wasm
+
+wasm-pack build \
+  --target bundler \
+  --release \
+  --scope cakioe \
+  --out-dir pkg \
+  --out-name hmac_signer \
+  -- --features wasm
+
+cd pkg
+npm stage publish --access public
+```
+
+The generated npm package will be available in the `pkg/` directory.
+
+## Security Considerations
+
+- Keep your secret key confidential.
+- Always use HTTPS when transmitting signatures.
+- Use timestamp validation to reduce replay attack risks.
+- Verify the original raw request body instead of re-serialized JSON.
+- Use sufficiently random secret keys.
+- Implement replay protection when strict request uniqueness is required.
+
+## License
+
+MIT

package/hmac_signer.d.ts

@@ -0,0 +1,10 @@
+/* tslint:disable */
+/* eslint-disable */
+
+export class HmacSha256Signer {
+    free(): void;
+    [Symbol.dispose](): void;
+    constructor(secret: string);
+    sign(timestamp: bigint, body: Uint8Array | number[]): string;
+    verify(timestamp: bigint, body: Uint8Array | number[], signature: string, tolerance?: bigint | null): boolean;
+}

package/hmac_signer.js

@@ -0,0 +1,9 @@
+/* @ts-self-types="./hmac_signer.d.ts" */
+import * as wasm from "./hmac_signer_bg.wasm";
+import { __wbg_set_wasm } from "./hmac_signer_bg.js";
+
+__wbg_set_wasm(wasm);
+wasm.__wbindgen_start();
+export {
+    HmacSha256Signer
+} from "./hmac_signer_bg.js";

package/hmac_signer_bg.js

@@ -0,0 +1,198 @@
+export class HmacSha256Signer {
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        HmacSha256SignerFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_hmacsha256signer_free(ptr, 0);
+    }
+    /**
+     * @param {string} secret
+     */
+    constructor(secret) {
+        const ptr0 = passStringToWasm0(secret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.hmacsha256signer_new(ptr0, len0);
+        this.__wbg_ptr = ret;
+        HmacSha256SignerFinalization.register(this, this.__wbg_ptr, this);
+        return this;
+    }
+    /**
+     * @param {bigint} timestamp
+     * @param {Uint8Array | number[]} body
+     * @returns {string}
+     */
+    sign(timestamp, body) {
+        let deferred4_0;
+        let deferred4_1;
+        try {
+            const val2 = BigInt.asIntN(64, timestamp);
+            const ptr0 = passArray8ToWasm0(body, wasm.__wbindgen_malloc);
+            const len0 = WASM_VECTOR_LEN;
+            const ret = wasm.hmacsha256signer_sign(this.__wbg_ptr, val2, ptr0, len0);
+            var ptr3 = ret[0];
+            var len3 = ret[1];
+            if (ret[3]) {
+                ptr3 = 0; len3 = 0;
+                throw takeFromExternrefTable0(ret[2]);
+            }
+            deferred4_0 = ptr3;
+            deferred4_1 = len3;
+            return getStringFromWasm0(ptr3, len3);
+        } finally {
+            wasm.__wbindgen_free(deferred4_0, deferred4_1, 1);
+        }
+    }
+    /**
+     * @param {bigint} timestamp
+     * @param {Uint8Array | number[]} body
+     * @param {string} signature
+     * @param {bigint | null} [tolerance]
+     * @returns {boolean}
+     */
+    verify(timestamp, body, signature, tolerance) {
+        const val3 = BigInt.asIntN(64, timestamp);
+        const val4 = BigInt.asIntN(64, (isLikeNone(tolerance) ? BigInt(0) : tolerance));
+        let ptr0, len0, ptr1, len1;
+        try {
+            ptr0 = passArray8ToWasm0(body, wasm.__wbindgen_malloc);
+            len0 = WASM_VECTOR_LEN;
+            ptr1 = passStringToWasm0(signature, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+            len1 = WASM_VECTOR_LEN;
+        } catch (e) {
+            if (ptr1) { wasm.__wbindgen_free(ptr1, len1 * 1, 1); }
+            if (ptr0) { wasm.__wbindgen_free(ptr0, len0 * 1, 1); }
+            throw e;
+        }
+        const ret = wasm.hmacsha256signer_verify(this.__wbg_ptr, val3, ptr0, len0, ptr1, len1, !isLikeNone(tolerance), val4);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return ret[0] !== 0;
+    }
+}
+if (Symbol.dispose) HmacSha256Signer.prototype[Symbol.dispose] = HmacSha256Signer.prototype.free;
+export function __wbg___wbindgen_throw_4c88d8bf264fd984(arg0, arg1) {
+    throw new Error(getStringFromWasm0(arg0, arg1));
+}
+export function __wbindgen_generic_0000000000000001(arg0, arg1) {
+    // Cast intrinsic for `Ref(String) -> Externref`.
+    const ret = getStringFromWasm0(arg0, arg1);
+    return ret;
+}
+export function __wbindgen_init_externref_table() {
+    const table = wasm.__wbindgen_externrefs;
+    table.set(0, undefined);
+    table.set(1024, undefined);
+    table.set(1025, null);
+    table.set(1026, true);
+    table.set(1027, false);
+}
+const HmacSha256SignerFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_hmacsha256signer_free(ptr, 1));
+
+function getStringFromWasm0(ptr, len) {
+    ptr = ptr >>> 0;
+    return decodeText(getUint8ArrayMemory0().subarray(ptr, ptr + len));
+}
+
+let cachedUint8ArrayMemory0 = null;
+function getUint8ArrayMemory0() {
+    if (cachedUint8ArrayMemory0 === null || cachedUint8ArrayMemory0.byteLength === 0) {
+        cachedUint8ArrayMemory0 = new Uint8Array(wasm.memory.buffer);
+    }
+    return cachedUint8ArrayMemory0;
+}
+
+function isLikeNone(x) {
+    return x === undefined || x === null;
+}
+
+function passArray8ToWasm0(arg, malloc) {
+    const ptr = malloc(arg.length * 1, 1) >>> 0;
+    getUint8ArrayMemory0().set(arg, ptr / 1);
+    WASM_VECTOR_LEN = arg.length;
+    return ptr;
+}
+
+function passStringToWasm0(arg, malloc, realloc) {
+    if (realloc === undefined) {
+        const buf = cachedTextEncoder.encode(arg);
+        const ptr = malloc(buf.length, 1) >>> 0;
+        getUint8ArrayMemory0().subarray(ptr, ptr + buf.length).set(buf);
+        WASM_VECTOR_LEN = buf.length;
+        return ptr;
+    }
+
+    let len = arg.length;
+    let ptr = malloc(len, 1) >>> 0;
+
+    const mem = getUint8ArrayMemory0();
+
+    let offset = 0;
+
+    for (; offset < len; offset++) {
+        const code = arg.charCodeAt(offset);
+        if (code > 0x7F) break;
+        mem[ptr + offset] = code;
+    }
+    if (offset !== len) {
+        if (offset !== 0) {
+            arg = arg.slice(offset);
+        }
+        ptr = realloc(ptr, len, len = offset + arg.length * 3, 1) >>> 0;
+        const view = getUint8ArrayMemory0().subarray(ptr + offset, ptr + len);
+        const ret = cachedTextEncoder.encodeInto(arg, view);
+
+        offset += ret.written;
+        ptr = realloc(ptr, len, offset, 1) >>> 0;
+    }
+
+    WASM_VECTOR_LEN = offset;
+    return ptr;
+}
+
+function takeFromExternrefTable0(idx) {
+    const value = wasm.__wbindgen_externrefs.get(idx);
+    wasm.__externref_table_dealloc(idx);
+    return value;
+}
+
+let cachedTextDecoder = new TextDecoder('utf-8', { ignoreBOM: true });
+cachedTextDecoder.decode();
+const MAX_SAFARI_DECODE_BYTES = 2146435072;
+let numBytesDecoded = 0;
+function decodeText(bytes) {
+    numBytesDecoded += bytes.length;
+    if (numBytesDecoded >= MAX_SAFARI_DECODE_BYTES) {
+        cachedTextDecoder = new TextDecoder('utf-8', { ignoreBOM: true });
+        cachedTextDecoder.decode();
+        numBytesDecoded = bytes.length;
+    }
+    return cachedTextDecoder.decode(bytes);
+}
+
+const cachedTextEncoder = new TextEncoder();
+
+if (!('encodeInto' in cachedTextEncoder)) {
+    cachedTextEncoder.encodeInto = function (arg, view) {
+        const buf = cachedTextEncoder.encode(arg);
+        view.set(buf);
+        return {
+            read: arg.length,
+            written: buf.length
+        };
+    };
+}
+
+let WASM_VECTOR_LEN = 0;
+
+
+let wasm;
+export function __wbg_set_wasm(val) {
+    wasm = val;
+}

package/package.json

@@ -1,6 +1,26 @@
 {
   "name": "@cakioe/hmac-signer",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "type": "module",
+  "collaborators": [
+    "cleveng <cleveng@gmail.com>"
+  ],
+  "description": "Hmac Signer By Rust",
+  "version": "1.0.1",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/cleveng/hmac-signer.git"
+  },
+  "files": [
+    "hmac_signer_bg.wasm",
+    "hmac_signer.js",
+    "hmac_signer_bg.js",
+    "hmac_signer.d.ts"
+  ],
+  "main": "hmac_signer.js",
+  "types": "hmac_signer.d.ts",
+  "sideEffects": [
+    "./hmac_signer.js",
+    "./snippets/*"
+  ]
+}