@edge-base/server 0.2.9 → 0.3.2

package/src/lib/auth-d1-service.ts

@@ -14,6 +14,7 @@
  */
 
 import type { AuthDb } from './auth-db-adapter.js';
+import { authSecretLookupKeys, hashAuthSecret } from './auth-token.js';
 
 // ─── Types ───
 
@@ -660,11 +661,12 @@ export async function createEmailToken(
   input: CreateEmailTokenInput,
 ): Promise<void> {
   const now = new Date().toISOString();
+  const tokenHash = await hashAuthSecret(input.token);
 
   await db.run(
     `INSERT INTO _email_tokens (token, userId, type, expiresAt, createdAt)
      VALUES (?, ?, ?, ?, ?)`,
-    [input.token, input.userId, input.type, input.expiresAt, now],
+    [tokenHash, input.userId, input.type, input.expiresAt, now],
   );
 }
 
@@ -676,9 +678,10 @@ export async function getEmailToken(
   db: AuthDb,
   token: string,
 ): Promise<Record<string, unknown> | null> {
+  const lookupKeys = await authSecretLookupKeys(token);
   const row = await db.first(
-    `SELECT * FROM _email_tokens WHERE token = ?`,
-    [token],
+    `SELECT * FROM _email_tokens WHERE token IN (${lookupKeys.map(() => '?').join(', ')})`,
+    lookupKeys,
   );
 
   if (!row) return null;
@@ -686,7 +689,10 @@ export async function getEmailToken(
   // Check expiration
   if (new Date(row.expiresAt as string) < new Date()) {
     // Clean up expired token
-    await db.run(`DELETE FROM _email_tokens WHERE token = ?`, [token]);
+    await db.run(
+      `DELETE FROM _email_tokens WHERE token IN (${lookupKeys.map(() => '?').join(', ')})`,
+      lookupKeys,
+    );
     return null;
   }
 
@@ -702,9 +708,10 @@ export async function getEmailTokenByType(
   token: string,
   type: string,
 ): Promise<Record<string, unknown> | null> {
+  const lookupKeys = await authSecretLookupKeys(token);
   return await db.first(
-    `SELECT * FROM _email_tokens WHERE token = ? AND type = ?`,
-    [token, type],
+    `SELECT * FROM _email_tokens WHERE token IN (${lookupKeys.map(() => '?').join(', ')}) AND type = ?`,
+    [...lookupKeys, type],
   );
 }
 
@@ -715,7 +722,11 @@ export async function deleteEmailToken(
   db: AuthDb,
   token: string,
 ): Promise<void> {
-  await db.run(`DELETE FROM _email_tokens WHERE token = ?`, [token]);
+  const lookupKeys = await authSecretLookupKeys(token);
+  await db.run(
+    `DELETE FROM _email_tokens WHERE token IN (${lookupKeys.map(() => '?').join(', ')})`,
+    lookupKeys,
+  );
 }
 
 /**
@@ -923,6 +934,25 @@ export async function createRecoveryCodes(
   );
 }
 
+/**
+ * Replace all recovery codes for a user with a freshly generated batch.
+ */
+export async function replaceRecoveryCodes(
+  db: AuthDb,
+  userId: string,
+  codes: Array<{ id: string; codeHash: string }>,
+): Promise<void> {
+  const now = new Date().toISOString();
+  await db.batch([
+    { sql: `DELETE FROM _mfa_recovery_codes WHERE userId = ?`, params: [userId] },
+    ...codes.map((code) => ({
+      sql: `INSERT INTO _mfa_recovery_codes (id, userId, codeHash, used, createdAt)
+         VALUES (?, ?, ?, 0, ?)`,
+      params: [code.id, userId, code.codeHash, now],
+    })),
+  ]);
+}
+
 /**
  * List unused recovery codes for a user.
  */

package/src/lib/auth-token.ts

@@ -0,0 +1,66 @@
+const encoder = new TextEncoder();
+
+function toHex(value: ArrayBuffer): string {
+  return Array.from(new Uint8Array(value))
+    .map((byte) => byte.toString(16).padStart(2, '0'))
+    .join('');
+}
+
+function timingSafeStringEqual(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  let result = 0;
+  for (let i = 0; i < a.length; i += 1) {
+    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return result === 0;
+}
+
+async function hmacSha256Hex(key: string, value: string): Promise<string> {
+  const cryptoKey = await crypto.subtle.importKey(
+    'raw',
+    encoder.encode(key),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign'],
+  );
+  const signature = await crypto.subtle.sign('HMAC', cryptoKey, encoder.encode(value));
+  return toHex(signature);
+}
+
+export async function hashAuthSecret(secret: string): Promise<string> {
+  const digest = await crypto.subtle.digest('SHA-256', encoder.encode(secret));
+  return `sha256:${toHex(digest)}`;
+}
+
+export async function authSecretLookupKeys(secret: string): Promise<string[]> {
+  const hashed = await hashAuthSecret(secret);
+  return secret.startsWith('sha256:') ? [secret] : [hashed, secret];
+}
+
+export async function verifyAuthSecret(secret: string, storedHash: string): Promise<boolean> {
+  const candidate = await hashAuthSecret(secret);
+  return timingSafeStringEqual(candidate, storedHash);
+}
+
+export async function hashOtpSecret(otp: string, serverSecret: string): Promise<string> {
+  const digest = await hmacSha256Hex(serverSecret, `edgebase:auth:otp:${otp}`);
+  return `hmac-sha256:${digest}`;
+}
+
+export async function verifyOtpSecret(
+  otp: string,
+  storedHash: string,
+  serverSecret: string,
+): Promise<boolean> {
+  if (storedHash.startsWith('hmac-sha256:')) {
+    const candidate = await hashOtpSecret(otp, serverSecret);
+    return timingSafeStringEqual(candidate, storedHash);
+  }
+
+  // Backward compatibility for short-lived OTPs stored before HMAC hashing.
+  if (storedHash.startsWith('sha256:')) {
+    return verifyAuthSecret(otp, storedHash);
+  }
+
+  return false;
+}