@dwtechs/toker 0.1.0 → 0.1.2

package/README.md

@@ -2,7 +2,7 @@
 [![License: MIT](https://img.shields.io/npm/l/@dwtechs/toker.svg?color=brightgreen)](https://opensource.org/licenses/MIT)
 [![npm version](https://badge.fury.io/js/%40dwtechs%2Ftoker.svg)](https://www.npmjs.com/package/@dwtechs/toker)
 [![last version release date](https://img.shields.io/github/release-date/DWTechs/Toker.js)](https://www.npmjs.com/package/@dwtechs/toker)
-![Jest:coverage](https://img.shields.io/badge/Jest:coverage-100%25-brightgreen.svg)
+![Jest:coverage](https://img.shields.io/badge/Jest:coverage-93%25-brightgreen.svg)
 
 - [Synopsis](#synopsis)
 - [Support](#support)
@@ -20,7 +20,7 @@
 
 **[Toker.js](https://github.com/DWTechs/Toker.js)** is an open source JWT management library for Node.js to sign, verify and parse bearer safely.
 
-- 📦 Only 1 dependency to check inputs variables
+- 📦 Only 2 dependencies to check inputs variables and secure hash creation and comparison
 - 🪶 Very lightweight
 - 🧪 Thoroughly tested
 - 🚚 Shipped as EcmaScrypt module
@@ -227,21 +227,6 @@ function parseBearer(authorization: string | undefined): string {}
 
 Toker uses a structured error system that helps you identify and handle specific error cases. All errors extend from a base `TokerError` class.
 
-### Error Classes Hierarchy
-
-```
-TokerError (abstract base class)
-├── MissingAuthorizationError
-├── InvalidBearerFormatError
-├── InvalidTokenError
-├── ExpiredTokenError
-├── InactiveTokenError
-├── InvalidSignatureError
-├── InvalidIssuerError
-├── InvalidSecretsError
-├── InvalidDurationError
-├── InvalidBase64Secret
-```
 
 ### Common Properties
 

package/dist/toker.d.ts

@@ -38,66 +38,60 @@ export type Payload = {
   exp: number;
   typ: Type;
 };
-
-// Error classes
-export abstract class TokerError extends Error {
-  abstract readonly code: string;
-  abstract readonly statusCode: number;
+export declare abstract class TokerError extends Error {
+    abstract readonly code: string;
+    abstract readonly statusCode: number;
+    constructor(message: string, causedBy?: Error);
 }
-
-export class MissingAuthorizationError extends TokerError {
-  readonly code: string;
-  readonly statusCode: number;
+export declare class MissingAuthorizationError extends TokerError {
+    readonly code = "MISSING_AUTHORIZATION";
+    readonly statusCode = 401;
+    constructor();
 }
-
-export class InvalidBearerFormatError extends TokerError {
-  readonly code: string;
-  readonly statusCode: number;
+export declare class InvalidBearerFormatError extends TokerError {
+    readonly code = "INVALID_BEARER_FORMAT";
+    readonly statusCode = 401;
+    constructor();
 }
-
-export class InvalidTokenError extends TokerError {
-  readonly code: string;
-  readonly statusCode: number;
+export declare class InvalidTokenError extends TokerError {
+    readonly code = "INVALID_TOKEN";
+    readonly statusCode = 401;
+    constructor(causedBy?: Error);
 }
-
-export class ExpiredTokenError extends TokerError {
-  readonly code: string;
-  readonly statusCode: number;
+export declare class ExpiredTokenError extends TokerError {
+    readonly code = "EXPIRED_TOKEN";
+    readonly statusCode = 401;
+    constructor();
 }
-
-export class InactiveTokenError extends TokerError {
-  readonly code: string;
-  readonly statusCode: number;
+export declare class InactiveTokenError extends TokerError {
+    readonly code = "INACTIVE_TOKEN";
+    readonly statusCode = 401;
+    constructor();
 }
-
-export class InvalidSignatureError extends TokerError {
-  readonly code: string;
-  readonly statusCode: number;
+export declare class InvalidSignatureError extends TokerError {
+    readonly code = "INVALID_SIGNATURE";
+    readonly statusCode = 401;
+    constructor(causedBy?: Error);
 }
-
-// export class MissingClaimsError extends TokerError {
-//   readonly code: string;
-//   readonly statusCode: number;
-// }
-
-export class InvalidIssuerError extends TokerError {
-  readonly code: string;
-  readonly statusCode: number;
+export declare class InvalidIssuerError extends TokerError {
+    readonly code = "INVALID_ISSUER";
+    readonly statusCode = 400;
+    constructor();
 }
-
-export class InvalidSecretsError extends TokerError {
-  readonly code: string;
-  readonly statusCode: number;
+export declare class InvalidSecretsError extends TokerError {
+    readonly code = "INVALID_SECRETS";
+    readonly statusCode = 500;
+    constructor(causedBy?: Error);
 }
-
-export class InvalidDurationError extends TokerError {
-  readonly code: string;
-  readonly statusCode: number;
+export declare class InvalidDurationError extends TokerError {
+    readonly code = "INVALID_DURATION";
+    readonly statusCode = 400;
+    constructor(causedBy?: Error);
 }
-
-export class InvalidBase64Secret extends TokerError {
-  readonly code: string;
-  readonly statusCode: number;
+export declare class InvalidBase64Secret extends TokerError {
+    readonly code = "INVALID_BASE64_SECRET";
+    readonly statusCode = 500;
+    constructor(causedBy?: Error);
 }
 
 declare function sign(iss: number | string, duration: number, type: Type, b64Keys: string[]): string;

package/dist/toker.js

@@ -1,4 +1,4 @@
-/*
+/*
 MIT License
 
 Copyright (c) 2022 DWTechs
@@ -20,90 +20,93 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
-
-https://github.com/DWTechs/Toker.js
-*/
-
+
+https://github.com/DWTechs/Toker.js
+*/
+
 import { isString, isNumber, isArray, isPositive, isJson, isBase64 } from '@dwtechs/checkard';
 import { b64Decode, b64Encode, hash, tse } from '@dwtechs/hashitaka';
 import { Buffer } from 'buffer';
 
 const TOKER_PREFIX = "Toker: ";
+function chainMessage(message, err) {
+    return `${message} - caused by: ${err.message}`;
+}
 class TokerError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = this.constructor.name;
+    constructor(message, causedBy) {
+        super(causedBy ? chainMessage(message, causedBy) : message);
+        this.name = `${TOKER_PREFIX}${this.constructor.name}`;
         if (Error.captureStackTrace) {
             Error.captureStackTrace(this, this.constructor);
         }
     }
 }
 class MissingAuthorizationError extends TokerError {
-    constructor(message = `${TOKER_PREFIX}Authorization header is missing`) {
-        super(message);
+    constructor() {
+        super(`${TOKER_PREFIX}Authorization header is missing`);
         this.code = "MISSING_AUTHORIZATION";
         this.statusCode = 401;
     }
 }
 class InvalidBearerFormatError extends TokerError {
-    constructor(message = `${TOKER_PREFIX}Authorization header must be in the format 'Bearer <token>'`) {
-        super(message);
+    constructor() {
+        super(`${TOKER_PREFIX}Authorization header must be in the format 'Bearer <token>'`);
         this.code = "INVALID_BEARER_FORMAT";
         this.statusCode = 401;
     }
 }
 class InvalidTokenError extends TokerError {
-    constructor(message = `${TOKER_PREFIX}Invalid or malformed JWT token`) {
-        super(message);
+    constructor(causedBy) {
+        super(`${TOKER_PREFIX}Invalid or malformed JWT token`, causedBy);
         this.code = "INVALID_TOKEN";
         this.statusCode = 401;
     }
 }
 class ExpiredTokenError extends TokerError {
-    constructor(message = `${TOKER_PREFIX}JWT token has expired`) {
-        super(message);
+    constructor() {
+        super(`${TOKER_PREFIX}JWT token has expired`);
         this.code = "EXPIRED_TOKEN";
         this.statusCode = 401;
     }
 }
 class InactiveTokenError extends TokerError {
-    constructor(message = `${TOKER_PREFIX}JWT token cannot be used yet (nbf claim)`) {
-        super(message);
+    constructor() {
+        super(`${TOKER_PREFIX}JWT token cannot be used yet (nbf claim)`);
         this.code = "INACTIVE_TOKEN";
         this.statusCode = 401;
     }
 }
 class InvalidSignatureError extends TokerError {
-    constructor(message = `${TOKER_PREFIX}JWT token signature is invalid`) {
-        super(message);
+    constructor(causedBy) {
+        super(`${TOKER_PREFIX}JWT token signature is invalid`, causedBy);
         this.code = "INVALID_SIGNATURE";
         this.statusCode = 401;
     }
 }
 class InvalidIssuerError extends TokerError {
-    constructor(message = `${TOKER_PREFIX}iss must be a string or a number`) {
-        super(message);
+    constructor() {
+        super(`${TOKER_PREFIX}iss must be a string or a number`);
         this.code = "INVALID_ISSUER";
         this.statusCode = 400;
     }
 }
 class InvalidSecretsError extends TokerError {
-    constructor(message = `${TOKER_PREFIX}b64Keys must be an array`) {
-        super(message);
+    constructor(causedBy) {
+        super(`${TOKER_PREFIX}b64Keys must be an array`, causedBy);
         this.code = "INVALID_SECRETS";
         this.statusCode = 500;
     }
 }
 class InvalidDurationError extends TokerError {
-    constructor(message = `${TOKER_PREFIX}duration must be a positive number`) {
-        super(message);
+    constructor(causedBy) {
+        super(`${TOKER_PREFIX}duration must be a positive number`, causedBy);
         this.code = "INVALID_DURATION";
         this.statusCode = 400;
     }
 }
 class InvalidBase64Secret extends TokerError {
-    constructor(message = `${TOKER_PREFIX}could not decode the base64 secret`) {
-        super(message);
+    constructor(causedBy) {
+        super(`${TOKER_PREFIX}could not decode the base64 secret`, causedBy);
         this.code = "INVALID_BASE64_SECRET";
         this.statusCode = 500;
     }
@@ -117,22 +120,28 @@ const header = {
 function sign(iss, duration, type, b64Keys) {
     if (!isString(iss, "!0") && !isNumber(iss, true))
         throw new InvalidIssuerError();
-    if (!isArray(b64Keys, ">", 0))
-        throw new InvalidSecretsError();
-    if (!isNumber(duration, false) || !isPositive(duration, true))
-        throw new InvalidDurationError();
+    try {
+        isArray(b64Keys, ">", 0, true);
+    }
+    catch (err) {
+        throw new InvalidSecretsError(err);
+    }
+    try {
+        isPositive(duration, true, true);
+    }
+    catch (err) {
+        throw new InvalidDurationError(err);
+    }
     header.kid = randomPick(b64Keys);
     const b64Secret = b64Keys[header.kid];
     const secret = b64Decode(b64Secret, true);
-    if (!secret)
-        throw new InvalidBase64Secret();
     const iat = Math.floor(Date.now() / 1000);
-    const nbf = iat + 1;
+    const nbf = iat;
     const exp = duration > 60 ? iat + duration : iat + 60 * 15;
     const typ = type === "refresh" ? type : "access";
     const payload = { iss, iat, nbf, exp, typ };
-    const b64Header = b64Encode(JSON.stringify(header));
-    const b64Payload = b64Encode(JSON.stringify(payload));
+    const b64Header = b64Encode(JSON.stringify(header), true);
+    const b64Payload = b64Encode(JSON.stringify(payload), true);
     const b64Signature = hash(`${b64Header}.${b64Payload}`, secret);
     return `${b64Header}.${b64Payload}.${b64Signature}`;
 }
@@ -143,14 +152,25 @@ function verify(token, b64Keys, ignoreExpiration = false) {
     const [b64Header, b64Payload, b64Signature] = segments;
     if (!b64Header || !b64Payload || !b64Signature)
         throw new InvalidTokenError();
-    if (!isArray(b64Keys, ">", 0))
-        throw new InvalidSecretsError();
-    const headerString = b64Decode(b64Header);
-    const payloadString = b64Decode(b64Payload);
-    if (!isJson(headerString) || !isJson(payloadString))
-        throw new InvalidTokenError();
-    const header = JSON.parse(headerString);
-    const payload = JSON.parse(payloadString);
+    try {
+        isArray(b64Keys, ">", 0, true);
+    }
+    catch (err) {
+        throw new InvalidSecretsError(err);
+    }
+    let headerStr;
+    let payloadStr;
+    try {
+        headerStr = b64Decode(b64Header, true);
+        payloadStr = b64Decode(b64Payload, true);
+        isJson(headerStr, true);
+        isJson(payloadStr, true);
+    }
+    catch (err) {
+        throw new InvalidTokenError(err);
+    }
+    const header = JSON.parse(headerStr);
+    const payload = JSON.parse(payloadStr);
     if (header.alg !== "HS256")
         throw new InvalidTokenError();
     if (header.typ !== "JWT")
@@ -163,13 +183,24 @@ function verify(token, b64Keys, ignoreExpiration = false) {
     if (!ignoreExpiration && payload.exp < now)
         throw new ExpiredTokenError();
     const b64Secret = b64Keys[header.kid];
-    if (!isBase64(b64Secret, true))
-        throw new InvalidBase64Secret();
-    const secret = b64Decode(b64Secret);
+    try {
+        isBase64(b64Secret, true, true);
+    }
+    catch (err) {
+        throw new InvalidBase64Secret(err);
+    }
+    const secret = b64Decode(b64Secret, true);
     const expectedSignature = hash(`${b64Header}.${b64Payload}`, secret);
     const safeA = Buffer.from(expectedSignature);
     const safeB = Buffer.from(b64Signature);
-    if (!tse(safeA, safeB))
+    let signaturesMatch;
+    try {
+        signaturesMatch = tse(safeA, safeB);
+    }
+    catch (err) {
+        throw new InvalidSignatureError(err);
+    }
+    if (!signaturesMatch)
         throw new InvalidSignatureError();
     return payload;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dwtechs/toker",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Open source JWT management library for Node.js to sign, verify and parse bearer safely.",
   "keywords": [
     "jwt",
@@ -37,8 +37,8 @@
     "dist/"
   ],
   "dependencies": {
-    "@dwtechs/checkard": "3.2.3",
-    "@dwtechs/hashitaka": "0.2.1"
+    "@dwtechs/checkard": "3.5.1",
+    "@dwtechs/hashitaka": "0.3.1"
   },
   "devDependencies": {
     "@babel/preset-env": "7.26.0",