@mybucks.online/core 2.2.0 → 2.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mybucks.online/core",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "description": "Core module of Mybucks.online Crypto Wallet",
   "main": "index.js",
   "type": "module",

package/src/random.js

@@ -1,4 +1,3 @@
-import { randomInt } from "crypto";
 import zxcvbn from "zxcvbn";
 import {
   PASSPHRASE_MIN_ZXCVBN_SCORE,
@@ -10,6 +9,18 @@ const LOWER = "abcdefghijklmnopqrstuvwxyz";
 const DIGITS = "0123456789";
 const SYMBOLS = "`~!@#$%^&*()-_+={}[]\\|:;\"'<>,.?/";
 
+function randomInt(max) {
+  if (max > 255) {
+    throw new RangeError(`max must be <= 255, got ${max}`);
+  }
+  const arr = new Uint8Array(1);
+  const limit = 256 - (256 % max);
+  do {
+    globalThis.crypto.getRandomValues(arr);
+  } while (arr[0] >= limit);
+  return arr[0] % max;
+}
+
 function randomChar(charset) {
   return charset[randomInt(charset.length)];
 }

package/src/token.js

@@ -87,7 +87,12 @@ export function generateToken(passphrase, pin, network, legacy = false) {
     ]);
   }
 
-  const base64Encoded = payloadBuffer.toString("base64");
+  // Convert Base64 to Base64URL so token remains safe in URL hash/query contexts.
+  const base64Encoded = payloadBuffer
+    .toString("base64")
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/=+$/g, "");
   const padding = nanoid(12);
   return padding.slice(0, 6) + base64Encoded + padding.slice(6);
 }
@@ -100,7 +105,15 @@ export function generateToken(passphrase, pin, network, legacy = false) {
  */
 export function parseToken(token) {
   const payload = token.slice(6, token.length - 6);
-  const decoded = Buffer.from(payload, "base64");
+  // Normalize payload for robust URL transport:
+  // - URLSearchParams converts "+" to " "
+  // - base64url may use "-" and "_" and omit padding
+  const normalized = payload
+    .replace(/ /g, "+")
+    .replace(/-/g, "+")
+    .replace(/_/g, "/");
+  const padded = normalized + "=".repeat((4 - (normalized.length % 4)) % 4);
+  const decoded = Buffer.from(padded, "base64");
 
   if (decoded[0] === TOKEN_VERSION_COMPACT) {
     let i = 1;

package/test/index.test.js

@@ -8,6 +8,7 @@ import {
   generateToken,
   parseToken,
 } from "../index.js";
+import { randomPassphrase, randomPIN } from "../src/random.js";
 
 const DEMO_PASSPHRASE = "DemoAccount5&";
 const DEMO_PIN = "112324";
@@ -326,6 +327,40 @@ describe("parseToken", () => {
     assert.strictEqual(network, DEMO_NETWORK);
     assert.strictEqual(legacy, false);
   });
+
+  test("should parse token after hash-fragment character normalization", () => {
+    const plusToken =
+      "tmeNhvAhsxe1lhSWwtJyhZLkQ+LUk2dzZeLi1TI0FPQzwIMWNuZ3I0ZTkHcG9seWdvbg==GB_ha6";
+    const spaceToken =
+      "tmeNhvAhsxe1lhSWwtJyhZLkQ LUk2dzZeLi1TI0FPQzwIMWNuZ3I0ZTkHcG9seWdvbg==GB_ha6";
+    assert.deepStrictEqual(
+      parseToken(spaceToken),
+      parseToken(plusToken),
+      "space should be treated as '+'"
+    );
+
+    const plusToken2 =
+      "gUerR9AhtTbmhANnYtST08PnFRLUMsZyUxMy1+OHc8byIINXJ6cG5oamkHcG9seWdvbg==2lSvB2";
+    const dashToken2 =
+      "gUerR9AhtTbmhANnYtST08PnFRLUMsZyUxMy1-OHc8byIINXJ6cG5oamkHcG9seWdvbg==2lSvB2";
+    assert.deepStrictEqual(
+      parseToken(dashToken2),
+      parseToken(plusToken2),
+      "'-' should be treated as '+' in payload normalization"
+    );
+  });
+
+  test("should parse token when base64 padding is stripped", () => {
+    const tokenWithPadding =
+      "tmeNhvAhsxe1lhSWwtJyhZLkQ+LUk2dzZeLi1TI0FPQzwIMWNuZ3I0ZTkHcG9seWdvbg==GB_ha6";
+    const tokenWithoutPadding =
+      "tmeNhvAhsxe1lhSWwtJyhZLkQ+LUk2dzZeLi1TI0FPQzwIMWNuZ3I0ZTkHcG9seWdvbgGB_ha6";
+    assert.deepStrictEqual(
+      parseToken(tokenWithoutPadding),
+      parseToken(tokenWithPadding),
+      "missing '=' padding should be recovered"
+    );
+  });
 });
 
 describe("generateToken and parseToken", () => {
@@ -382,4 +417,24 @@ describe("generateToken and parseToken", () => {
     );
     assert.strictEqual(legacy, true);
   });
+
+  test("should round-trip random passphrase and PIN for 100 cases (integration)", () => {
+    const testNetwork = "polygon";
+
+    for (let i = 0; i < 100; i++) {
+      const testPassphrase = randomPassphrase();
+      const testPin = randomPIN();
+      const token = generateToken(testPassphrase, testPin, testNetwork, false);
+
+      const [passphrase, pin, network, legacy] = parseToken(token);
+      assert.strictEqual(
+        passphrase,
+        testPassphrase,
+        `passphrase mismatch at case ${i}`,
+      );
+      assert.strictEqual(pin, testPin, `pin mismatch at case ${i}`);
+      assert.strictEqual(network, testNetwork, `network mismatch at case ${i}`);
+      assert.strictEqual(legacy, false, `legacy flag mismatch at case ${i}`);
+    }
+  });
 });