@cequrebackends/plugin-security 0.13.0 → 0.14.0

package/dist/auth-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-routes.d.ts","sourceRoot":"","sources":["../src/auth-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAoD/D,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,QA8azD"}
+{"version":3,"file":"auth-routes.d.ts","sourceRoot":"","sources":["../src/auth-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAqD/D,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,QA8azD"}

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export { type TokenStore, InMemoryTokenStore, AdapterTokenStore, REFRESH_TOKEN_C
 export * from './audit';
 export * from './encryption';
 export * from './mfa';
+export { hashPassword, verifyPassword } from './password';
 export { type SecretsProvider, EnvVarSecrets } from './secrets';
 export { signWebhook, verifyWebhookSignature, WEBHOOK_SIGNATURE_HEADER } from './webhooks';
 export declare function defaultSecurity(): CequrePlugin;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAqB,MAAM,2BAA2B,CAAC;AAMjF,cAAc,QAAQ,CAAC;AACvB,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAAE,KAAK,UAAU,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACjH,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,OAAO,CAAC;AACtB,OAAO,EAAE,KAAK,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAI3F,wBAAgB,eAAe,IAAI,YAAY,CAuI9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAqB,MAAM,2BAA2B,CAAC;AAMjF,cAAc,QAAQ,CAAC;AACvB,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAAE,KAAK,UAAU,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACjH,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,OAAO,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,KAAK,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAI3F,wBAAgB,eAAe,IAAI,YAAY,CAuI9C"}

package/dist/index.js

@@ -115,6 +115,57 @@ async function hashBackupCode(code) {
 var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
 var init_mfa = () => {};
 
+// src/password.ts
+async function hashPassword(plaintext) {
+  if (isBun) {
+    return globalThis.Bun.password.hash(plaintext, "bcrypt");
+  }
+  const salt = crypto.getRandomValues(new Uint8Array(SALT_LENGTH));
+  const keyMaterial = await crypto.subtle.importKey("raw", new TextEncoder().encode(plaintext), "PBKDF2", false, ["deriveBits"]);
+  const derivedBits = await crypto.subtle.deriveBits({
+    name: "PBKDF2",
+    salt,
+    iterations: PBKDF2_ITERATIONS,
+    hash: "SHA-256"
+  }, keyMaterial, KEY_LENGTH * 8);
+  const hash = new Uint8Array(derivedBits);
+  return `pbkdf2:${PBKDF2_ITERATIONS}:${btoa(String.fromCharCode(...salt))}:${btoa(String.fromCharCode(...hash))}`;
+}
+async function verifyPassword(plaintext, stored) {
+  if (isBun && !stored.startsWith("pbkdf2:")) {
+    return globalThis.Bun.password.verify(plaintext, stored);
+  }
+  const parts = stored.split(":");
+  if (parts.length !== 4 || parts[0] !== "pbkdf2") {
+    if (isBun) {
+      return globalThis.Bun.password.verify(plaintext, stored);
+    }
+    return false;
+  }
+  const iterations = parseInt(parts[1], 10);
+  const salt = Uint8Array.from(atob(parts[2]), (c) => c.charCodeAt(0));
+  const storedHash = atob(parts[3]);
+  const keyMaterial = await crypto.subtle.importKey("raw", new TextEncoder().encode(plaintext), "PBKDF2", false, ["deriveBits"]);
+  const derivedBits = await crypto.subtle.deriveBits({
+    name: "PBKDF2",
+    salt,
+    iterations,
+    hash: "SHA-256"
+  }, keyMaterial, KEY_LENGTH * 8);
+  const hash = String.fromCharCode(...new Uint8Array(derivedBits));
+  if (hash.length !== storedHash.length)
+    return false;
+  let diff = 0;
+  for (let i = 0;i < hash.length; i++) {
+    diff |= hash.charCodeAt(i) ^ storedHash.charCodeAt(i);
+  }
+  return diff === 0;
+}
+var isBun, PBKDF2_ITERATIONS = 1e5, SALT_LENGTH = 16, KEY_LENGTH = 32;
+var init_password = __esm(() => {
+  isBun = typeof globalThis.Bun !== "undefined";
+});
+
 // src/auth-routes.ts
 var exports_auth_routes = {};
 __export(exports_auth_routes, {
@@ -194,7 +245,7 @@ function setupAuthRoutes(cequre) {
           const existing = await cequre.secureFind(collection.slug, { where: { email: { eq: data.email } }, limit: 1 });
           if (existing.docs.length > 0)
             return new Response(JSON.stringify({ error: "User already exists" }), { status: 409 });
-          const hashedPassword = await Bun.password.hash(data.password, "bcrypt");
+          const hashedPassword = await hashPassword(data.password);
           const registerData = cequre.stripForbiddenFields(collection.slug, { ...data, password: hashedPassword });
           registerData.password = hashedPassword;
           const user = await cequre.secureCreate(collection.slug, registerData);
@@ -239,7 +290,7 @@ function setupAuthRoutes(cequre) {
             await cequre.recordFailedLogin(collection.slug, data.email, lockoutConfig);
             return new Response(JSON.stringify({ error: "Oops! The email or password credentials provided don't match our records." }), { status: 401 });
           }
-          const valid = await Bun.password.verify(data.password, user.password);
+          const valid = await verifyPassword(data.password, user.password);
           if (!valid) {
             await cequre.recordFailedLogin(collection.slug, data.email, lockoutConfig);
             return new Response(JSON.stringify({ error: "Oops! The email or password credentials provided don't match our records." }), { status: 401 });
@@ -503,7 +554,7 @@ function setupAuthRoutes(cequre) {
           if (!verified || verified.collection !== collection.slug) {
             return new Response(JSON.stringify({ error: "Invalid or expired reset token" }), { status: 400, headers: { "Content-Type": "application/json" } });
           }
-          const hashedPassword = await Bun.password.hash(data.password, "bcrypt");
+          const hashedPassword = await hashPassword(data.password);
           await cequre.secureUpdate(collection.slug, verified.userId, { password: hashedPassword });
           await cequre.authEngine.revokeAllForUser(verified.userId);
           const user = await cequre.secureFindById(collection.slug, verified.userId);
@@ -536,6 +587,7 @@ function setupAuthRoutes(cequre) {
 }
 var init_auth_routes = __esm(() => {
   init_mfa();
+  init_password();
 });
 
 // src/auth.ts
@@ -1003,6 +1055,7 @@ class RateLimiter {
 }
 
 // src/index.ts
+init_password();
 init_mfa();
 
 // src/secrets.ts
@@ -1173,6 +1226,7 @@ function defaultSecurity() {
 export {
   verifyWebhookSignature,
   verifyTOTP,
+  verifyPassword,
   verifyAuditHmac,
   verifyAuditChain,
   signWebhook,
@@ -1180,6 +1234,7 @@ export {
   resolveClientIP,
   resolveAuditSecret,
   isEncrypted,
+  hashPassword,
   hashBackupCode,
   generateTOTPSecret,
   generateTOTP,

package/dist/password.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Runtime-agnostic password hashing.
+ *
+ * - On Bun: uses Bun.password (native bcrypt)
+ * - On Node/serverless: uses WebCrypto PBKDF2 (no native deps)
+ *
+ * This allows Cequre apps to run on both Bun (self-hosted) and
+ * Vercel serverless (Node.js) without changing auth code.
+ */
+export declare function hashPassword(plaintext: string): Promise<string>;
+export declare function verifyPassword(plaintext: string, stored: string): Promise<boolean>;
+//# sourceMappingURL=password.d.ts.map

package/dist/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../src/password.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA2BrE;AAED,wBAAsB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA8CxF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cequrebackends/plugin-security",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",