@catbee/utils 2.0.0-next.0 → 2.0.0

package/crypto/index.mjs

@@ -1,7 +1,7 @@
 /*
  * The MIT License
  * 
- * Copyright (c) 2025 Catbee Technologies. https://catbee.in/license
+ * Copyright (c) 2026 Catbee Technologies. https://catbee.in/license
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -22,12 +22,14 @@
  * SOFTWARE.
  */
 
-import { scrypt, createHmac, createHash, randomBytes, timingSafeEqual, createCipheriv, createDecipheriv } from 'crypto';
+import { pbkdf2, scrypt, createHmac, createHash, randomBytes, timingSafeEqual, createCipheriv, createDecipheriv } from 'crypto';
 import { promisify } from 'util';
 import { uuid } from '@catbee/utils/id';
 
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var pbkdf2Async = promisify(pbkdf2);
+var scryptAsync = promisify(scrypt);
 function hmac(algorithm, input, secret, encoding = "hex") {
   return createHmac(algorithm, secret).update(input).digest(encoding);
 }
@@ -83,13 +85,13 @@ function safeCompare(a, b) {
   throw new Error("Cannot compare: inputs must be strings, Buffers, or Uint8Arrays");
 }
 __name(safeCompare, "safeCompare");
-var scryptAsync = promisify(scrypt);
 async function encrypt(data, key, options = {}) {
   const algorithm = options.algorithm || "aes-256-gcm";
   const inputEncoding = options.inputEncoding || "utf8";
   const outputEncoding = options.outputEncoding || "hex";
   const iv = randomBytes(16);
-  const derivedKey = typeof key === "string" ? await scryptAsync(key, iv.slice(0, 8), 32) : key;
+  const salt = randomBytes(8);
+  const derivedKey = typeof key === "string" ? await scryptAsync(key, salt, 32) : key;
   const cipher = createCipheriv(algorithm, derivedKey, iv);
   let ciphertext;
   if (typeof data === "string") {
@@ -107,7 +109,8 @@ async function encrypt(data, key, options = {}) {
     ciphertext,
     iv,
     authTag,
-    algorithm
+    algorithm,
+    salt
   };
 }
 __name(encrypt, "encrypt");
@@ -115,7 +118,7 @@ async function decrypt(encryptedData, key, options = {}) {
   const algorithm = options.algorithm || encryptedData.algorithm || "aes-256-gcm";
   const inputEncoding = options.inputEncoding || "hex";
   const outputEncoding = options.outputEncoding || "utf8";
-  const derivedKey = typeof key === "string" ? await scryptAsync(key, encryptedData.iv.slice(0, 8), 32) : key;
+  const derivedKey = typeof key === "string" ? await scryptAsync(key, encryptedData.salt, 32) : key;
   const decipher = createDecipheriv(algorithm, derivedKey, encryptedData.iv);
   if (encryptedData.authTag && algorithm.includes("gcm")) {
     decipher.setAuthTag(encryptedData.authTag);
@@ -162,5 +165,47 @@ function verifySignedToken(token, secret) {
   }
 }
 __name(verifySignedToken, "verifySignedToken");
+async function pbkdf2Hash(password, salt, keyLength = 32, iterations = 31e4) {
+  return pbkdf2Async(password, salt, iterations, keyLength, "sha256");
+}
+__name(pbkdf2Hash, "pbkdf2Hash");
+function generateNonce(byteLength = 16, encoding = "hex") {
+  return randomBytes(byteLength).toString(encoding);
+}
+__name(generateNonce, "generateNonce");
+function secureRandomInt(min, max) {
+  if (min > max) throw new Error("min must be less than or equal to max");
+  const range = max - min + 1;
+  const bytesNeeded = Math.ceil(Math.log2(range) / 8);
+  const maxValid = Math.floor(256 ** bytesNeeded / range) * range;
+  let randomValue;
+  do {
+    const bytes = randomBytes(bytesNeeded);
+    randomValue = bytes.reduce((acc, byte, i) => acc + byte * 256 ** i, 0);
+  } while (randomValue >= maxValid);
+  return min + randomValue % range;
+}
+__name(secureRandomInt, "secureRandomInt");
+async function hashPassword(password, saltLength = 16, keyLength = 32) {
+  const salt = randomBytes(saltLength);
+  const scryptAsync2 = promisify(scrypt);
+  const derivedKey = await scryptAsync2(password, salt, keyLength);
+  return `${salt.toString("base64")}:${derivedKey.toString("base64")}`;
+}
+__name(hashPassword, "hashPassword");
+async function verifyPassword(password, hash2) {
+  try {
+    const [saltB64, keyB64] = hash2.split(":");
+    if (!saltB64 || !keyB64) return false;
+    const salt = Buffer.from(saltB64, "base64");
+    const key = Buffer.from(keyB64, "base64");
+    const scryptAsync2 = promisify(scrypt);
+    const derivedKey = await scryptAsync2(password, salt, key.length);
+    return timingSafeEqual(key, derivedKey);
+  } catch {
+    return false;
+  }
+}
+__name(verifyPassword, "verifyPassword");
 
-export { createSignedToken, decrypt, encrypt, generateApiKey, generateRandomBytes, generateRandomBytesAsString, hash, hmac, md5, randomString, safeCompare, sha1, sha256, sha256Hmac, verifySignedToken };
+export { createSignedToken, decrypt, encrypt, generateApiKey, generateNonce, generateRandomBytes, generateRandomBytesAsString, hash, hashPassword, hmac, md5, pbkdf2Hash, randomString, safeCompare, secureRandomInt, sha1, sha256, sha256Hmac, verifyPassword, verifySignedToken };