@exortek/apikey 1.1.0 → 1.1.2

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @exortek/apikey
 
+## 1.1.2
+
+### Patch Changes
+
+- b9e0647: Publish only the package-root README, CHANGELOG and LICENSE.
+
+  The `files` list matched those names at any depth rather than just the root, so a nested document was published
+  alongside them — `@exortek/oauth2` shipped its `examples/README.md`. The entries are now anchored to the package root.
+
+- 0a94f13: Smaller bundles — the internal argument-guard helpers are now tree-shakeable.
+
+  Each package bundles the guard helpers it uses. They were previously built as one object holding all fourteen, which a
+  bundler cannot take apart, so every package shipped all of them regardless of how many it called. They are now
+  individually importable, and each package pulls in only what it uses.
+
+  No API change: the errors, codes and messages raised by argument validation are identical. Published bundles shrink by
+  roughly 7-18% depending on the package.
+
+## 1.1.1
+
+### Patch Changes
+
+- e53ae64: Fix polynomial-ReDoS (quadratic regex backtracking) surfaced by CodeQL, plus small code-quality fixes.
+  Bundled `@exortek/shared` utilities (base32, base64, duration) are inlined into the packages listed above, so each
+  ships the fix.
+
+  - Replace `/=+$/` trailing-padding strips (base32 / base64 decode, OTP provisioning URI) with linear scans —
+    `"=".repeat(n) + "x"` was O(n²).
+  - Rework the duration parser regex so surrounding whitespace can no longer cause O(n²) matching (trim first, single
+    interior `\s*`).
+  - Strip trailing spaces/dots in filename sanitisation with a linear scan — upload filenames are attacker-controlled.
+  - Cap email length before the regex in magic-link.
+  - Thread the JWT decode label into error messages (removes dead arguments and gives failures which segment broke).
+  - Drop a duplicate character in a UA browser-detection regex character class.
+
+  DoS-hardening and hygiene only — no API or behavioural change for valid input.
+
 ## 1.1.0
 
 ### Minor Changes

package/README.md

@@ -3,11 +3,11 @@
 > Stripe-style prefixed API keys for Node.js 22+ — 3-segment tokens (`sk_live_<id>_<secret>`), HMAC-SHA256 storage hash with optional pepper rotation, scope allowlists, memory + Redis stores, Express + Fastify middleware. Zero non-`@exortek/*` runtime dependencies.
 
 [![npm](https://img.shields.io/npm/v/@exortek/apikey.svg?color=cb3837)](https://www.npmjs.com/package/@exortek/apikey)
-[![tests](https://img.shields.io/badge/tests-passing-brightgreen)](https://github.com/ExorTek/auth/actions/workflows/ci.yml)
+[![tests](https://github.com/ExorTek/auth/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/ExorTek/auth/actions/workflows/ci.yml)
 [![node](https://img.shields.io/node/v/@exortek/apikey.svg?color=339933)](https://nodejs.org)
 [![install size](https://packagephobia.com/badge?p=@exortek/apikey)](https://packagephobia.com/result?p=@exortek/apikey)
 [![types](https://img.shields.io/badge/types-included-3178C6)](./dist/index.d.ts)
-[![license](https://img.shields.io/npm/l/@exortek/apikey.svg?color=blue)](./LICENSE)
+[![license](https://img.shields.io/npm/l/@exortek/apikey.svg?color=blue)](https://github.com/ExorTek/auth/blob/master/LICENSE)
 
 📖 **Docs:** [**auth.memet.dev/apikey**](https://auth.memet.dev/apikey)
 
@@ -325,4 +325,4 @@ Expected verify failures do NOT throw — they surface as `{ valid: false, reaso
 
 ## License
 
-MIT © ExorTek — see [LICENSE](./LICENSE).
+MIT © ExorTek — see [LICENSE](https://github.com/ExorTek/auth/blob/master/LICENSE).

package/dist/index.cjs

@@ -65,7 +65,11 @@ const UNIT_MS = Object.freeze({
   years: 31_536_000_000,
 });
 
-const DURATION_RE = /^\s*(-?\d+(?:\.\d+)?)\s*([a-z]+)?\s*$/i;
+// Note: no leading/trailing `\s*` — the caller trims first. Two `\s*` runs
+// around the optional unit (`\s*([a-z]+)?\s*`) made this O(n^2) on hostile
+// input like `"1" + " ".repeat(n) + "!"`; trimming plus a single interior
+// `\s*` keeps matching linear.
+const DURATION_RE = /^(-?\d+(?:\.\d+)?)\s*([a-z]+)?$/i;
 
 const SUPPORTED_UNITS = 'ms, s, m, h, d, w, y (and long/plural forms)';
 
@@ -95,7 +99,7 @@ function parseDuration(input) {
     throw new TypeError(`parseDuration: expected string or number; got ${typeof input}`);
   }
 
-  const match = DURATION_RE.exec(input);
+  const match = DURATION_RE.exec(input.trim());
   if (!match) {
     throw new Error(
       `parseDuration: could not parse ${JSON.stringify(input)}. Examples: 900 (ms), '15m', '2h', '7d', '500ms', '30s'.`,
@@ -347,20 +351,33 @@ class ApiKeyError extends BaseError {
  * `@exortek/shared/validate`: **schema** for whole options objects,
  * **asserts** for one-liner argument guards at the call site.
  *
- * The consumer surface is {@link defineGuards} (or the raw
- * {@link bindAsserts} for full control). Each package binds the assert
- * set to its own typed error class once (in `internal/guards.js`), so
- * every argument failure throws that package's class —
- * `err instanceof CryptoError` holds and users see at a glance which
- * package raised the error. The bound `parse` bridges
- * `@exortek/shared/validate` schemas to the same error class.
+ * Every guard is exported as a `make…` **factory** taking the binding
+ * package's `wrap` and returning the guard itself. A package binds the
+ * guards it calls once, in its `internal/guards.js`, so every argument
+ * failure throws that package's error class — `err instanceof
+ * CryptoError` holds, and users see at a glance which package raised it.
+ *
+ *   // packages/<pkg>/src/internal/guards.js
+ *   import { makeAssertString, makeInvalidArgument } from '@exortek/shared/asserts';
+ *   import { CryptoError, ErrorCode } from '../errors.js';
+ *
+ *   const wrap = (message, extra) => new CryptoError(ErrorCode.INVALID_ARGUMENT, message, extra);
+ *
+ *   export const assertString = makeAssertString(wrap);
+ *   export const invalidArgument = makeInvalidArgument(wrap);
+ *
+ * Importing each factory by name is what makes the module
+ * tree-shakeable. An earlier version handed back one object carrying
+ * every guard, so all of them shipped in every package's bundle no
+ * matter how few were used — `assertBoolean` reached fifteen published
+ * packages without a single call site. Import what you call.
  *
  * **Path naming convention** (used as the `name` argument):
  *
  *   `<publicFunction>[.options|.config][.<field>]`
  *
- *   - `assertString(name, 'createUser.name')`          — top-level arg
- *   - `assertPositiveInt(n, 'scrypt.options.r')`       — nested option
+ *   - `assertString(name, 'createUser.name')`            — top-level arg
+ *   - `assertPositiveInt(n, 'scrypt.options.r')`         — nested option
  *   - `assertBytesOrString(pwd, 'pepper.wrap.password')` — method arg
  *
  * Keep the path short: the emitted error is `"<name> must be <desc>"`,
@@ -369,301 +386,34 @@ class ApiKeyError extends BaseError {
  * encryptSymmetric()"), not for restating the field.
  */
 
-/**
- * @typedef {{ cause?: unknown }} WrapExtra
- *   Extra options forwarded to the wrap function, so `invalidArgument`
- *   sites that catch an underlying error can preserve the `cause` chain
- *   without falling back to a raw `new PackageError(...)`.
- *
- * @typedef {(message: string, extra?: WrapExtra) => Error} WrapFn
- *   Constructs (never throws) the binding package's error, e.g.
- *   `(m, { cause } = {}) => new CryptoError(ErrorCode.INVALID_ARGUMENT, m, { cause })`.
- *
- * @typedef {{ hint?: string }} AssertOptions
- *   `hint` is appended to the message after an em-dash — use it for
- *   actionable guidance ("pass the exact bytes returned by …").
- *
- * @typedef {{ safeParse: (input: unknown, path?: string) => { ok: true, value: unknown } | { ok: false, errors: string[] } }} ParseableSchema
- */
 
 /**
- * Build the failure message. `description` completes the sentence
- * `"<name> must be <description>"`; `hint` (optional) follows an
- * em-dash.
+ * Construct (not throw) the bound error with a free-form message — for
+ * `throw invalidArgument('…')` sites that don't fit the `X must be Y`
+ * shape (canonicalisation errors, cross-field constraint failures). Pass
+ * `{ cause }` when the failure was triggered by an underlying throw whose
+ * chain matters (e.g. `JSON.stringify` on a bigint).
  *
- * @param {string} name
- * @param {string} description
- * @param {string} [hint]
- * @returns {string}
+ * @type {(wrap: WrapFn) => (msg: string, extra?: WrapExtra) => Error}
  */
-function message(name, description, hint) {
-  return `${name} must be ${description}${hint ? ` — ${hint}` : ''}`;
-}
-
-const ENCODINGS = new Set(['hex', 'base64', 'base64url']);
+const makeInvalidArgument = wrap => (msg, extra) => wrap(msg, extra);
 
 /**
- * Bind the assert set to a package's error class. Call once per
- * package (conventionally in `internal/guards.js`) and import the
- * bound object everywhere:
- *
- *   import { bindAsserts } from '@exortek/shared/asserts';
- *   import { CryptoError, ErrorCode } from '../errors.js';
- *   export const g = bindAsserts((m) => new CryptoError(ErrorCode.INVALID_ARGUMENT, m));
- *
- *   // call sites:
- *   g.assertPositiveInt(options.iterations, 'options.iterations');
- *   const cfg = g.parse(OptionsSchema, options, 'options');
- *
- * @param {WrapFn} wrap
+ * Argument guards bound to `ApiKeyError` — the package-wide binding of
+ * `@exortek/shared/asserts`. Import guards from here, never from the
+ * shared module directly.
  */
-function bindAsserts(wrap) {
-  /**
-   * @param {string} name
-   * @param {string} description
-   * @param {AssertOptions} [opts]
-   * @returns {never}
-   */
-  function fail(name, description, opts) {
-    throw wrap(message(name, description, opts?.hint));
-  }
 
-  /**
-   * Assert that `value` is a plain object (not `null`, not an array,
-   * not a primitive).
-   * @param {unknown} value
-   * @param {string}  name
-   * @param {AssertOptions} [opts]
-   */
-  function assertObject(value, name, opts) {
-    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
-      fail(name, 'an object', opts);
-    }
-  }
-
-  return {
-    /**
-     * Construct (not throw) the bound error with a free-form message —
-     * for `throw g.invalidArgument('…')` sites that don't fit the
-     * `X must be Y` shape (canonicalisation errors, cross-field
-     * constraint failures). Pass `{ cause }` when the argument-shape
-     * failure was triggered by an underlying throw whose chain matters
-     * (e.g. `JSON.stringify` on a bigint).
-     *
-     * @param {string} msg
-     * @param {WrapExtra} [extra]
-     * @returns {Error}
-     */
-    invalidArgument(msg, extra) {
-      return wrap(msg, extra);
-    },
-
-    /**
-     * Validate `input` against a `@exortek/shared/validate` schema;
-     * failures throw the bound error carrying every collected message.
-     * The bridge that keeps schema validation on the package's own
-     * error surface.
-     *
-     * @param {ParseableSchema} schema
-     * @param {unknown} input
-     * @param {string} [path='options']
-     * @returns {unknown} the parsed (possibly defaulted) value
-     */
-    parse(schema, input, path = 'options') {
-      const r = schema.safeParse(input, path);
-      if (!r.ok) {
-        throw wrap(r.errors.join('; '));
-      }
-      return r.value;
-    },
-
-    /**
-     * Assert that `value` is a non-negative safe integer (`0, 1, 2, …`).
-     * @param {unknown} value
-     * @param {string}  name  Argument name to include in the error message.
-     * @param {AssertOptions} [opts]
-     */
-    assertNonNegativeInt(value, name, opts) {
-      if (!Number.isSafeInteger(value) || /** @type {number} */ (value) < 0) {
-        fail(name, 'a non-negative safe integer', opts);
-      }
-    },
-
-    /**
-     * Assert that `value` is a strictly positive safe integer (`1, 2, 3, …`).
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertPositiveInt(value, name, opts) {
-      if (!Number.isSafeInteger(value) || /** @type {number} */ (value) <= 0) {
-        fail(name, 'a positive integer', opts);
-      }
-    },
-
-    /**
-     * Assert that `value` fits in a 48-bit unsigned integer (`0 … 2^48 − 1`).
-     * Used for Unix millisecond timestamps in UUID v7 / ULID.
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertUint48(value, name, opts) {
-      if (
-        !Number.isSafeInteger(value) ||
-        /** @type {number} */ (value) < 0 ||
-        /** @type {number} */ (value) > 0xffffffffffff
-      ) {
-        fail(name, 'a non-negative safe integer ≤ 2^48 − 1 (Unix ms since epoch)', opts);
-      }
-    },
-
-    /**
-     * Assert that `value` is a string (may be empty).
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertString(value, name, opts) {
-      if (typeof value !== 'string') {
-        fail(name, 'a string', opts);
-      }
-    },
-
-    /**
-     * Assert that `value` is a non-empty string.
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertNonEmptyString(value, name, opts) {
-      if (typeof value !== 'string' || value.length === 0) {
-        fail(name, 'a non-empty string', opts);
-      }
-    },
-
-    /**
-     * Assert that `value` is a boolean.
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertBoolean(value, name, opts) {
-      if (typeof value !== 'boolean') {
-        fail(name, 'a boolean', opts);
-      }
-    },
-
-    /**
-     * Assert that `value` is a function.
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertFunction(value, name, opts) {
-      if (typeof value !== 'function') {
-        fail(name, 'a function', opts);
-      }
-    },
-
-    assertObject,
-
-    /**
-     * Assert that `value` is either `undefined` or a plain object —
-     * the "optional options object" pattern.
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertOptionalObject(value, name, opts) {
-      if (value === undefined) {
-        return;
-      }
-      assertObject(value, name, opts);
-    },
-
-    /**
-     * Assert that `value` is a byte buffer (`Buffer` or `Uint8Array`) —
-     * strings are NOT accepted. For already-encoded material where a
-     * string would be ambiguous (ciphertext, signatures, raw key bytes).
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertBytes(value, name, opts) {
-      if (!Buffer.isBuffer(value) && !(value instanceof Uint8Array)) {
-        fail(name, 'a Buffer or Uint8Array', opts);
-      }
-    },
-
-    /**
-     * Assert that `value` is either a string or a byte buffer (`Buffer`
-     * or `Uint8Array`).
-     * @param {unknown} value
-     * @param {string}  name
-     * @param {AssertOptions} [opts]
-     */
-    assertBytesOrString(value, name, opts) {
-      if (typeof value !== 'string' && !Buffer.isBuffer(value) && !(value instanceof Uint8Array)) {
-        fail(name, 'a string or Buffer', opts);
-      }
-    },
-
-    /**
-     * Assert that `encoding` is one of the accepted output/input
-     * encodings. Pass `allowBuffer: false` where a `Buffer` output makes
-     * no sense (verifying a string signature, decoding a token payload).
-     *
-     * @param {unknown} encoding
-     * @param {string}  name
-     * @param {AssertOptions & { allowBuffer?: boolean }} [opts]
-     */
-    assertEncoding(encoding, name, opts) {
-      const allowBuffer = opts?.allowBuffer !== false;
-      const valid = (typeof encoding === 'string' && ENCODINGS.has(encoding)) || (allowBuffer && encoding === 'buffer');
-      if (!valid) {
-        const list = allowBuffer ? "'hex', 'base64', 'base64url', or 'buffer'" : "'hex', 'base64', or 'base64url'";
-        fail(name, list, opts);
-      }
-    },
-  };
-}
 
 /**
- * One-line sugar over {@link bindAsserts} — the overwhelmingly common
- * pattern where a package binds every argument-shape failure to its
- * own error class + `INVALID_ARGUMENT` code. Emits the standard
- * `new ErrorClass(code, message, { cause })` shape, so the underlying
- * `BaseError` `{ cause, status, details }` options object is respected.
- *
- *   // packages/<pkg>/src/internal/guards.js
- *   import { defineGuards } from '@exortek/shared/asserts';
- *   import { PasswordError, ErrorCode } from '../errors.js';
+ * Bind every guard this package calls to ApiKeyError, so an argument-shape
+ * failure anywhere carries one class and one code to branch on.
  *
- *   export const { assertString, invalidArgument, parse } =
- *     defineGuards(PasswordError, ErrorCode.INVALID_ARGUMENT);
- *
- * Reach for the raw {@link bindAsserts} when you need a different
- * mapping (an alt code, a decorated message) — it stays available.
- *
- * @param {new (code: string, message: string, options?: { cause?: unknown }) => Error} ErrorClass
- * @param {string} code
- */
-function defineGuards(ErrorClass, code) {
-  return bindAsserts((message, extra) => new ErrorClass(code, message, extra));
-}
-
-/**
- * Argument guards bound to `ApiKeyError` — the package-wide binding of
- * `@exortek/shared/asserts`. Import guards from here, never from the
- * shared module directly.
+ * @type {import('@exortek/shared/asserts').WrapFn}
  */
+const wrap = (message, extra) => new ApiKeyError(ErrorCode.INVALID_ARGUMENT, message, extra);
 
-
-const { invalidArgument} = defineGuards(
-  ApiKeyError,
-  ErrorCode.INVALID_ARGUMENT,
-);
+const invalidArgument = makeInvalidArgument(wrap);
 
 /**
  * Scope match helpers.