@flaghoist/server 0.3.0 → 0.3.1

package/dist/index.cjs

@@ -479,17 +479,19 @@ async function safeEqual(a, b) {
 }
 var MIN_SECRET_LENGTH = 16;
 var warnedWeakSecrets = /* @__PURE__ */ new Set();
+function weakSecretKey(secret) {
+  let hash = 5381;
+  for (let i = 0; i < secret.length; i++) hash = (hash << 5) + hash ^ secret.charCodeAt(i);
+  return hash >>> 0;
+}
 function warnIfWeakSecret(kind, secret) {
   if (secret.length >= MIN_SECRET_LENGTH) return;
-  void (async () => {
-    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
-    const id = Array.from(new Uint8Array(digest).slice(0, 6)).map((b) => b.toString(16).padStart(2, "0")).join("");
-    if (warnedWeakSecrets.has(id)) return;
-    warnedWeakSecrets.add(id);
-    console.warn(
-      `[flaghoist] the ${kind} is ${secret.length} characters. Use a long random value (for example \`openssl rand -hex 32\`); a short secret is guessable, especially since Flaghoist does not rate limit authentication.`
-    );
-  })();
+  const key = weakSecretKey(secret);
+  if (warnedWeakSecrets.has(key)) return;
+  warnedWeakSecrets.add(key);
+  console.warn(
+    `[flaghoist] the ${kind} is ${secret.length} characters. Use a long random value (for example \`openssl rand -hex 32\`); a short secret is guessable, especially since Flaghoist does not rate limit authentication.`
+  );
 }
 function apiKey(expected) {
   warnIfWeakSecret("read API key", expected);

package/dist/index.js

@@ -449,17 +449,19 @@ async function safeEqual(a, b) {
 }
 var MIN_SECRET_LENGTH = 16;
 var warnedWeakSecrets = /* @__PURE__ */ new Set();
+function weakSecretKey(secret) {
+  let hash = 5381;
+  for (let i = 0; i < secret.length; i++) hash = (hash << 5) + hash ^ secret.charCodeAt(i);
+  return hash >>> 0;
+}
 function warnIfWeakSecret(kind, secret) {
   if (secret.length >= MIN_SECRET_LENGTH) return;
-  void (async () => {
-    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
-    const id = Array.from(new Uint8Array(digest).slice(0, 6)).map((b) => b.toString(16).padStart(2, "0")).join("");
-    if (warnedWeakSecrets.has(id)) return;
-    warnedWeakSecrets.add(id);
-    console.warn(
-      `[flaghoist] the ${kind} is ${secret.length} characters. Use a long random value (for example \`openssl rand -hex 32\`); a short secret is guessable, especially since Flaghoist does not rate limit authentication.`
-    );
-  })();
+  const key = weakSecretKey(secret);
+  if (warnedWeakSecrets.has(key)) return;
+  warnedWeakSecrets.add(key);
+  console.warn(
+    `[flaghoist] the ${kind} is ${secret.length} characters. Use a long random value (for example \`openssl rand -hex 32\`); a short secret is guessable, especially since Flaghoist does not rate limit authentication.`
+  );
 }
 function apiKey(expected) {
   warnIfWeakSecret("read API key", expected);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flaghoist/server",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Hono app factory for Flaghoist: OFREP evaluate, admin CRUD, and pluggable auth.",
   "license": "Apache-2.0",
   "type": "module",
@@ -49,8 +49,8 @@
     "@flaghoist/core": "0.1.2"
   },
   "devDependencies": {
-    "@flaghoist/dashboard": "0.0.0",
-    "@flaghoist/adapter-memory": "0.1.2"
+    "@flaghoist/adapter-memory": "0.1.2",
+    "@flaghoist/dashboard": "0.0.0"
   },
   "publishConfig": {
     "access": "public"