@guren/server 1.0.0-rc.9 → 1.0.0

package/dist/chunk-H32L2NE3.js

@@ -0,0 +1,372 @@
+import {
+  MessageSigner,
+  generateAppKey,
+  normalizeAppKey
+} from "./chunk-ONSDE37A.js";
+
+// src/encryption/Encrypter.ts
+import { createCipheriv, createDecipheriv, randomBytes, createHmac } from "crypto";
+var Encrypter = class {
+  /**
+   * Encryption key.
+   */
+  key;
+  previousKeys;
+  /**
+   * Cipher algorithm.
+   */
+  cipher;
+  constructor(config) {
+    this.key = Buffer.from(normalizeAppKey(config.key).slice("base64:".length), "base64");
+    this.previousKeys = (config.previousKeys ?? []).map(
+      (key) => Buffer.from(normalizeAppKey(key).slice("base64:".length), "base64")
+    );
+    this.cipher = config.cipher ?? "aes-256-gcm";
+  }
+  /**
+   * Encrypt a value.
+   */
+  encrypt(value, options = {}) {
+    const serialize = options.serialize !== false;
+    const data = serialize ? JSON.stringify(value) : String(value);
+    if (this.cipher === "aes-256-gcm") {
+      return this.encryptGcm(data);
+    }
+    return this.encryptCbc(data);
+  }
+  /**
+   * Decrypt a value.
+   */
+  decrypt(payload, options = {}) {
+    const deserialize = options.deserialize !== false;
+    let parsed;
+    try {
+      parsed = JSON.parse(Buffer.from(payload, "base64").toString("utf8"));
+    } catch {
+      throw new Error("Invalid encrypted payload.");
+    }
+    let decrypted;
+    if (parsed.tag) {
+      decrypted = this.decryptGcm(parsed);
+    } else if (parsed.mac) {
+      decrypted = this.decryptCbc(parsed);
+    } else {
+      throw new Error("Invalid encrypted payload format.");
+    }
+    if (deserialize) {
+      try {
+        return JSON.parse(decrypted);
+      } catch {
+        return decrypted;
+      }
+    }
+    return decrypted;
+  }
+  /**
+   * Encrypt a string (no serialization).
+   */
+  encryptString(value) {
+    return this.encrypt(value, { serialize: false });
+  }
+  /**
+   * Decrypt a string (no deserialization).
+   */
+  decryptString(payload) {
+    return this.decrypt(payload, { deserialize: false });
+  }
+  /**
+   * Encrypt using AES-256-GCM.
+   */
+  encryptGcm(data) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", this.key, iv);
+    const encrypted = Buffer.concat([
+      cipher.update(data, "utf8"),
+      cipher.final()
+    ]);
+    const tag = cipher.getAuthTag();
+    const payload = {
+      iv: iv.toString("base64"),
+      value: encrypted.toString("base64"),
+      tag: tag.toString("base64")
+    };
+    return Buffer.from(JSON.stringify(payload)).toString("base64");
+  }
+  /**
+   * Decrypt using AES-256-GCM.
+   */
+  decryptGcm(payload) {
+    return this.tryDecryptWithKeys((key) => {
+      const iv = Buffer.from(payload.iv, "base64");
+      const encrypted = Buffer.from(payload.value, "base64");
+      const tag = Buffer.from(payload.tag, "base64");
+      const decipher = createDecipheriv("aes-256-gcm", key, iv);
+      decipher.setAuthTag(tag);
+      const decrypted = Buffer.concat([
+        decipher.update(encrypted),
+        decipher.final()
+      ]);
+      return decrypted.toString("utf8");
+    });
+  }
+  /**
+   * Encrypt using AES-256-CBC with HMAC.
+   */
+  encryptCbc(data) {
+    const iv = randomBytes(16);
+    const cipher = createCipheriv("aes-256-cbc", this.key, iv);
+    const encrypted = Buffer.concat([
+      cipher.update(data, "utf8"),
+      cipher.final()
+    ]);
+    const mac = this.createMac(iv, encrypted);
+    const payload = {
+      iv: iv.toString("base64"),
+      value: encrypted.toString("base64"),
+      mac
+    };
+    return Buffer.from(JSON.stringify(payload)).toString("base64");
+  }
+  /**
+   * Decrypt using AES-256-CBC with HMAC verification.
+   */
+  decryptCbc(payload) {
+    return this.tryDecryptWithKeys((key) => {
+      const iv = Buffer.from(payload.iv, "base64");
+      const encrypted = Buffer.from(payload.value, "base64");
+      const expectedMac = this.createMac(iv, encrypted, key);
+      if (!this.secureCompare(payload.mac, expectedMac)) {
+        throw new Error("MAC verification failed.");
+      }
+      const decipher = createDecipheriv("aes-256-cbc", key, iv);
+      const decrypted = Buffer.concat([
+        decipher.update(encrypted),
+        decipher.final()
+      ]);
+      return decrypted.toString("utf8");
+    });
+  }
+  /**
+   * Create HMAC for CBC mode.
+   */
+  createMac(iv, encrypted, key = this.key) {
+    const hmac2 = createHmac("sha256", key);
+    hmac2.update(iv);
+    hmac2.update(encrypted);
+    return hmac2.digest("hex");
+  }
+  /**
+   * Constant-time string comparison.
+   */
+  secureCompare(a, b) {
+    if (a.length !== b.length) {
+      return false;
+    }
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+      result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return result === 0;
+  }
+  /**
+   * Get the encryption key (base64).
+   */
+  getKey() {
+    return this.key.toString("base64");
+  }
+  tryDecryptWithKeys(run) {
+    const keys = [this.key, ...this.previousKeys];
+    let lastError;
+    for (const key of keys) {
+      try {
+        return run(key);
+      } catch (error) {
+        lastError = error;
+      }
+    }
+    throw lastError ?? new Error("Failed to decrypt payload.");
+  }
+};
+function generateKey() {
+  return generateAppKey();
+}
+var globalEncrypter = null;
+function createEncrypter(config) {
+  return new Encrypter(config);
+}
+function setEncrypter(encrypter) {
+  globalEncrypter = encrypter;
+}
+function getEncrypter() {
+  if (!globalEncrypter) {
+    throw new Error("Encrypter not initialized. Call setEncrypter() first.");
+  }
+  return globalEncrypter;
+}
+function encrypt(value, options) {
+  return getEncrypter().encrypt(value, options);
+}
+function decrypt(payload, options) {
+  return getEncrypter().decrypt(payload, options);
+}
+
+// src/encryption/signed-url.ts
+var PURPOSE = "signed-url";
+var SIGNATURE_PARAM = "signature";
+var EXPIRES_PARAM = "expires";
+function canonicalizeUrl(value) {
+  const url = new URL(value);
+  url.searchParams.delete(SIGNATURE_PARAM);
+  const params = Array.from(url.searchParams.entries()).sort(([left], [right]) => left.localeCompare(right));
+  url.search = "";
+  for (const [key, paramValue] of params) {
+    url.searchParams.append(key, paramValue);
+  }
+  return { canonical: `${url.pathname}${url.search}`, url };
+}
+function signUrl(value, keyring, options = {}) {
+  const url = new URL(value);
+  if (typeof options.expiresIn === "number") {
+    url.searchParams.set(EXPIRES_PARAM, String(Math.floor((Date.now() + options.expiresIn) / 1e3)));
+  }
+  const { canonical } = canonicalizeUrl(url.toString());
+  const signer = new MessageSigner(keyring);
+  const signature = signer.sign({ url: canonical }, { purpose: PURPOSE });
+  url.searchParams.set(SIGNATURE_PARAM, signature);
+  return url.toString();
+}
+function verifySignedUrl(value, keyring, options = {}) {
+  const url = new URL(value);
+  const signature = url.searchParams.get(SIGNATURE_PARAM);
+  if (!signature) {
+    return false;
+  }
+  const expires = url.searchParams.get(EXPIRES_PARAM);
+  if (options.requireExpiration && !expires) {
+    return false;
+  }
+  if (expires && Number(expires) < Math.floor(Date.now() / 1e3)) {
+    return false;
+  }
+  const { canonical } = canonicalizeUrl(value);
+  const signer = new MessageSigner(keyring);
+  const payload = signer.verify(signature, { purpose: PURPOSE });
+  return payload?.url === canonical;
+}
+
+// src/encryption/Random.ts
+import { randomBytes as randomBytes2, randomUUID, randomInt as cryptoRandomInt } from "crypto";
+var CHARSETS = {
+  alphanumeric: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
+  alphabetic: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",
+  numeric: "0123456789",
+  hex: "0123456789abcdef",
+  "base64": "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",
+  "url-safe": "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"
+};
+function randomString(length, options = {}) {
+  const { charset = "alphanumeric" } = options;
+  const chars = CHARSETS[charset];
+  const bytes = randomBytes2(length);
+  let result = "";
+  for (let i = 0; i < length; i++) {
+    result += chars[bytes[i] % chars.length];
+  }
+  return result;
+}
+function random(length) {
+  return randomBytes2(length);
+}
+function randomHex(length) {
+  return randomBytes2(length).toString("hex");
+}
+function randomBase64(length) {
+  return randomBytes2(length).toString("base64");
+}
+function randomBase64Url(length) {
+  return randomBytes2(length).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function uuid() {
+  return randomUUID();
+}
+function randomInt(min, max) {
+  return cryptoRandomInt(min, max + 1);
+}
+function urlSafeToken(length = 32) {
+  return randomBase64Url(Math.ceil(length * 0.75)).slice(0, length);
+}
+function generatePassword(length = 16, options = {}) {
+  const {
+    uppercase = true,
+    lowercase = true,
+    numbers = true,
+    symbols = true
+  } = options;
+  let chars = "";
+  if (uppercase) chars += "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+  if (lowercase) chars += "abcdefghijklmnopqrstuvwxyz";
+  if (numbers) chars += "0123456789";
+  if (symbols) chars += "!@#$%^&*()-_=+[]{}|;:,.<>?";
+  if (chars.length === 0) {
+    chars = CHARSETS.alphanumeric;
+  }
+  const bytes = randomBytes2(length);
+  let result = "";
+  for (let i = 0; i < length; i++) {
+    result += chars[bytes[i] % chars.length];
+  }
+  return result;
+}
+function generateOtp(length = 6) {
+  return randomString(length, { charset: "numeric" });
+}
+function generateSlug(length = 10) {
+  return randomString(length, { charset: "hex" });
+}
+function shuffle(array) {
+  const result = [...array];
+  for (let i = result.length - 1; i > 0; i--) {
+    const j = randomInt(0, i);
+    [result[i], result[j]] = [result[j], result[i]];
+  }
+  return result;
+}
+function pick(array) {
+  if (array.length === 0) {
+    throw new Error("Cannot pick from empty array.");
+  }
+  return array[randomInt(0, array.length - 1)];
+}
+function sample(array, count) {
+  if (count > array.length) {
+    throw new Error("Sample count exceeds array length.");
+  }
+  const shuffled = shuffle(array);
+  return shuffled.slice(0, count);
+}
+
+export {
+  Encrypter,
+  generateKey,
+  createEncrypter,
+  setEncrypter,
+  getEncrypter,
+  encrypt,
+  decrypt,
+  signUrl,
+  verifySignedUrl,
+  randomString,
+  random,
+  randomHex,
+  randomBase64,
+  randomBase64Url,
+  uuid,
+  randomInt,
+  urlSafeToken,
+  generatePassword,
+  generateOtp,
+  generateSlug,
+  shuffle,
+  pick,
+  sample
+};