@dainprotocol/tunnel 1.1.0 → 1.1.2

package/dist/client/index.js

@@ -27,7 +27,7 @@ class DainTunnel extends events_1.EventEmitter {
             throw new Error('Invalid API key format. Expected: sk_agent_{agentId}_{orgId}_{secret}');
         }
         this.apiKey = apiKey;
-        this.tunnelId = parsed.agentId; // agentId is the tunnel identifier
+        this.tunnelId = `${parsed.orgId}_${parsed.agentId}`; // orgId_agentId to prevent collisions
         this.secret = parsed.secret; // secret for HMAC signatures
     }
     /**

package/dist/server/index.js

@@ -202,17 +202,23 @@ class DainTunnelServer {
                 ws.close(1008, "Invalid API key format");
                 return;
             }
-            // Validate HMAC signature
+            // Validate HMAC signature using constant-time comparison
             const expectedSignature = (0, crypto_1.createHmac)('sha256', parsed.secret)
                 .update(challenge)
                 .digest('hex');
-            if (expectedSignature !== signature) {
+            // Convert to buffers for timing-safe comparison
+            const expectedSigBuffer = Buffer.from(expectedSignature, 'hex');
+            const receivedSigBuffer = Buffer.from(signature, 'hex');
+            // Constant-time comparison to prevent timing attacks
+            if (expectedSigBuffer.length !== receivedSigBuffer.length ||
+                !(0, crypto_1.timingSafeEqual)(expectedSigBuffer, receivedSigBuffer)) {
                 ws.close(1008, "Invalid signature");
                 return;
             }
-            // Verify that tunnelId matches the agentId from the API key
-            if (tunnelId !== parsed.agentId) {
-                ws.close(1008, "Tunnel ID does not match API key");
+            // Verify that tunnelId matches orgId_agentId from the API key
+            const expectedTunnelId = `${parsed.orgId}_${parsed.agentId}`;
+            if (tunnelId !== expectedTunnelId) {
+                ws.close(1008, `Tunnel ID does not match API key. Expected: ${expectedTunnelId}, Got: ${tunnelId}`);
                 return;
             }
             // If tunnel already exists, remove old one

package/package.json

@@ -1,25 +1,17 @@
 {
   "name": "@dainprotocol/tunnel",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "",
   "main": "dist/index.js",
   "private": false,
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "build": "tsc",
-    "build:types": "tsc --emitDeclarationOnly",
-    "test": "jest",
-    "test:watch": "jest --watch",
-    "prepublishOnly": "npm run build && npm run build:types",
-    "start-server": "ts-node src/server/start.ts"
-  },
   "keywords": [],
   "author": "Ryan",
   "license": "ISC",
   "dependencies": {
-    "@dainprotocol/service-sdk": "^1.3.0",
+    "@dainprotocol/service-sdk": "^1.3.3",
     "@types/body-parser": "^1.19.5",
     "@types/cors": "^2.8.17",
     "@types/eventsource": "^3.0.0",
@@ -28,7 +20,6 @@
     "@types/uuid": "^10.0.0",
     "@types/ws": "^8.5.12",
     "body-parser": "^1.20.2",
-    "bs58": "^6.0.0",
     "cors": "^2.8.5",
     "dotenv": "^16.4.5",
     "eventsource": "^3.0.6",
@@ -77,5 +68,12 @@
         "./dist/server/*.d.ts"
       ]
     }
+  },
+  "scripts": {
+    "build": "tsc",
+    "build:types": "tsc --emitDeclarationOnly",
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "start-server": "ts-node src/server/start.ts"
   }
-}
+}