@carecard/auth-util 3.39.0 → 3.40.0

package/.agents/skills/pkg-auth-util-auth-crypto-library/SKILL.md

@@ -159,9 +159,11 @@ depend on those folders being present.
   key credential is verified.
 - Generate salts internally for every credential. Never accept caller-selected
   salts and never persist or log the pepper.
-- Normalize well-formed Unicode passwords to NFC before deriving the tag, but
-  do not trim or impose password policy here. `@carecard/validate` owns policy,
-  while login intentionally permits existing passwords of any length.
+- Normalize password edge whitespace through `@carecard/validate`, then NFC,
+  before deriving the tag. Creation and verification use identical canonical
+  bytes; preserve internal spaces. `@carecard/validate` owns password policy.
+  Trim outer signed-token whitespace before verification or decomposition,
+  preserving the signed contents and canonical signature encoding checks.
 - Return an invalid verification result for unknown key IDs, malformed,
   non-canonical, differently parameterized, or legacy saved hashes. Throw for
   programmer/configuration errors such as an invalid keyring.

package/lib/jwtUtilAuth.js

@@ -108,7 +108,7 @@ function verifyJwtSignature(jwt, verificationJwks) {
     if (typeof jwt !== 'string') {
       return false;
     }
-    const parts = jwt.split('.');
+    const parts = jwt.trim().split('.');
     if (parts.length !== 3) {
       return false;
     }
@@ -129,10 +129,10 @@ function verifyJwtSignature(jwt, verificationJwks) {
 
 function getHeaderPayloadFromJwt(jwt) {
   try {
-    if (typeof jwt !== 'string' || jwt.split('.').length !== 3) {
+    if (typeof jwt !== 'string' || jwt.trim().split('.').length !== 3) {
       return null;
     }
-    const [headerPart, payloadPart] = jwt.split('.');
+    const [headerPart, payloadPart] = jwt.trim().split('.');
     const header = decodeJwtPart(headerPart);
     const payload = decodeJwtPart(payloadPart);
     return isDecodedJwtObject(header) && isDecodedJwtObject(payload) ? { header, payload } : null;

package/lib/pwdUtilAuth.js

@@ -2,6 +2,7 @@
 
 const { argon2, randomBytes, timingSafeEqual } = require('node:crypto');
 const { promisify } = require('node:util');
+const { normalizeInputWhitespace } = require('@carecard/validate');
 
 const deriveArgon2Tag = promisify(argon2);
 const ARGON2_ALGORITHM = 'argon2id';
@@ -17,12 +18,12 @@ const passwordKeyringSecrets = new WeakMap();
 const PASSWORD_HASH_PATTERN =
   /^\$argon2id\$v=19\$m=19456,t=2,p=1\$([A-Za-z0-9+/]{22})\$([A-Za-z0-9+/]{43})$/;
 
-// Pattern: Canonicalization - converts well-formed NFC password text to stable UTF-8 bytes.
+// Pattern: Canonicalization - converts trimmed NFC password text to stable UTF-8 bytes.
 function createPasswordBuffer(password) {
   if (typeof password !== 'string' || !password.isWellFormed()) {
     throw new TypeError('Password must be a well-formed Unicode string.');
   }
-  return Buffer.from(password.normalize('NFC'), 'utf8');
+  return Buffer.from(normalizeInputWhitespace(password).normalize('NFC'), 'utf8');
 }
 
 // Pattern: Serializer Helper - emits canonical unpadded PHC Base64 text.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carecard/auth-util",
-  "version": "3.39.0",
+  "version": "3.40.0",
   "repository": "https://github.com/CareCard-ca/pkg-auth-util.git",
   "description": "Auth utility functions",
   "main": "index.js",
@@ -50,8 +50,8 @@
     "typescript": "6.0.3"
   },
   "dependencies": {
-    "@carecard/common-util": "3.39.0",
-    "@carecard/validate": "3.39.0",
+    "@carecard/common-util": "3.40.0",
+    "@carecard/validate": "3.40.0",
     "@types/express": "5.0.6"
   },
   "overrides": {

package/readme.md

@@ -122,8 +122,10 @@ if (result.isValid && result.needsRehash) {
 
 Keyring entries use `key-id:canonical-base64-32-byte-key`, separated by commas.
 Credential rows persist both the PHC hash and its `hashKeyId`; pepper keys stay
-outside persisted credentials and logs. Passwords retain spaces and normalize
-well-formed Unicode to NFC. `@carecard/validate` owns password policy.
+outside persisted credentials and logs. Passwords trim edge whitespace and
+normalize well-formed Unicode to NFC, preserving internal spaces.
+`@carecard/validate` owns password policy. Signed token verification and
+decomposition trim outer whitespace without rewriting signed token contents.
 
 JWT signing configuration is one strict private Ed25519 JWK. Verification
 configuration is an RFC 7517 JWKS containing one or more public Ed25519 JWKs.