@nivinjoseph/n-sec 6.0.2 → 7.0.1

package/test/hash.test.ts

@@ -164,6 +164,95 @@ await describe("Hash", async () =>
 
             Hash.createUsingSalt(password, salt);
         });
+    });
+
+    await describe("createForPassword", async () =>
+    {
+        await test("must return a 128-character uppercase hex string", () =>
+        {
+            const hash = Hash.createForPassword("password", "some-salt");
+            assert.match(hash, /^[0-9A-F]{128}$/);
+        });
+
+        await test("same password and salt must produce the same output", () =>
+        {
+            const hash1 = Hash.createForPassword("password", "some-salt");
+            const hash2 = Hash.createForPassword("password", "some-salt");
+            assert.strictEqual(hash1, hash2);
+        });
+
+        await test("different passwords with the same salt must produce different outputs", () =>
+        {
+            const hash1 = Hash.createForPassword("password1", "some-salt");
+            const hash2 = Hash.createForPassword("password2", "some-salt");
+            assert.notStrictEqual(hash1, hash2);
+        });
+
+        await test("same password with different salts must produce different outputs", () =>
+        {
+            const hash1 = Hash.createForPassword("password", "salt-1");
+            const hash2 = Hash.createForPassword("password", "salt-2");
+            assert.notStrictEqual(hash1, hash2);
+        });
+
+        await test("passwords differing only in trailing whitespace must produce different outputs", () =>
+        {
+            const hash1 = Hash.createForPassword("password", "some-salt");
+            const hash2 = Hash.createForPassword("password ", "some-salt");
+            assert.notStrictEqual(hash1, hash2);
+        });
+
+        await test("passwords differing only in leading whitespace must produce different outputs", () =>
+        {
+            const hash1 = Hash.createForPassword("password", "some-salt");
+            const hash2 = Hash.createForPassword(" password", "some-salt");
+            assert.notStrictEqual(hash1, hash2);
+        });
+    });
+
+    await describe("verifyPassword", async () =>
+    {
+        await test("must return true for the same password and salt that produced the hash", () =>
+        {
+            const hash = Hash.createForPassword("password", "some-salt");
+            assert.strictEqual(Hash.verifyPassword("password", "some-salt", hash), true);
+        });
+
+        await test("must accept the hash in lowercase as well as uppercase", () =>
+        {
+            const hash = Hash.createForPassword("password", "some-salt");
+            assert.strictEqual(Hash.verifyPassword("password", "some-salt", hash.toLowerCase()), true);
+        });
+
+        await test("must return false for a wrong password", () =>
+        {
+            const hash = Hash.createForPassword("password", "some-salt");
+            assert.strictEqual(Hash.verifyPassword("wrong-password", "some-salt", hash), false);
+        });
+
+        await test("must return false for a wrong salt", () =>
+        {
+            const hash = Hash.createForPassword("password", "some-salt");
+            assert.strictEqual(Hash.verifyPassword("password", "different-salt", hash), false);
+        });
+
+        await test("must return false for a tampered hash", () =>
+        {
+            const hash = Hash.createForPassword("password", "some-salt");
+            // eslint-disable-next-line @typescript-eslint/prefer-string-starts-ends-with
+            const tampered = (hash[0] === "A" ? "B" : "A") + hash.slice(1);
+            assert.strictEqual(Hash.verifyPassword("password", "some-salt", tampered), false);
+        });
+
+        await test("must return false for a hash of the wrong length", () =>
+        {
+            assert.strictEqual(Hash.verifyPassword("password", "some-salt", "ABCD"), false);
+        });
+
+        await test("must return false for a non-hex hash", () =>
+        {
+            assert.strictEqual(Hash.verifyPassword("password", "some-salt", "Z".repeat(128)), false);
+        });
 
 
 

package/test/hmac.test.ts

@@ -8,9 +8,9 @@ await describe("Hmac", async () =>
 {
     await describe("create", async () =>
     {
-        await test("should return string value that is not null, empty, whitespace or same as the key or input", async () =>
+        await test("should return string value that is not null, empty, whitespace or same as the key or input", () =>
         {
-            const key = await SymmetricEncryption.generateKey();
+            const key = SymmetricEncryption.generateKey();
             const value = "hello world";
             const hmac = Hmac.create(key, value);
             // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
@@ -19,30 +19,30 @@ await describe("Hmac", async () =>
             assert.notStrictEqual(hmac, value);
         });
 
-        await test("multiple invocations with the same key and value must return the same output", async () =>
+        await test("multiple invocations with the same key and value must return the same output", () =>
         {
-            const key = await SymmetricEncryption.generateKey();
+            const key = SymmetricEncryption.generateKey();
             const value = "hello world";
             const hmac1 = Hmac.create(key, value);
             const hmac2 = Hmac.create(key, value);
             assert.strictEqual(hmac1, hmac2);
         });
 
-        await test("multiple invocations with different keys and different values must return different outputs", async () =>
+        await test("multiple invocations with different keys and different values must return different outputs", () =>
         {
-            const key1 = await SymmetricEncryption.generateKey();
+            const key1 = SymmetricEncryption.generateKey();
             const value1 = "hello world";
             const hmac1 = Hmac.create(key1, value1);
 
-            const key2 = await SymmetricEncryption.generateKey();
+            const key2 = SymmetricEncryption.generateKey();
             const value2 = "goodbye world";
             const hmac2 = Hmac.create(key2, value2);
             assert.notStrictEqual(hmac1, hmac2);
         });
 
-        await test("multiple invocations with the same key and different values must return different outputs", async () =>
+        await test("multiple invocations with the same key and different values must return different outputs", () =>
         {
-            const key = await SymmetricEncryption.generateKey();
+            const key = SymmetricEncryption.generateKey();
             const value1 = "hello world";
             const value2 = "goodbye world";
             const hmac1 = Hmac.create(key, value1);
@@ -50,10 +50,10 @@ await describe("Hmac", async () =>
             assert.notStrictEqual(hmac1, hmac2);
         });
 
-        await test("multiple invocations with different keys and the same value must return different outputs", async () =>
+        await test("multiple invocations with different keys and the same value must return different outputs", () =>
         {
-            const key1 = await SymmetricEncryption.generateKey();
-            const key2 = await SymmetricEncryption.generateKey();
+            const key1 = SymmetricEncryption.generateKey();
+            const key2 = SymmetricEncryption.generateKey();
             const value = "hello world";
             const hmac1 = Hmac.create(key1, value);
             const hmac2 = Hmac.create(key2, value);

package/test/json-web-token.test.ts

@@ -2,20 +2,29 @@ import { describe, test } from "node:test";
 import assert from "node:assert";
 import { JsonWebToken } from "./../src/api-security/json-web-token.js";
 import { Claim } from "../src/api-security/claim.js";
-import { SymmetricEncryption } from "../src/index.js";
+import { Hmac, SymmetricEncryption } from "../src/index.js";
 import { InvalidTokenException } from "../src/api-security/invalid-token-exception.js";
 import { ExpiredTokenException } from "../src/api-security/expired-token-exception.js";
 
 
+function buildToken(key: string, headerJson: string, bodyJson: string): string
+{
+    const headerHex = Buffer.from(headerJson, "utf8").toString("hex").toUpperCase();
+    const bodyHex = Buffer.from(bodyJson, "utf8").toString("hex").toUpperCase();
+    const signature = Hmac.create(key, `${headerHex}.${bodyHex}`);
+    return `${headerHex}.${bodyHex}.${signature}`;
+}
+
+
 await describe("Json Web Token ", async () =>
 {
     await describe("Hmac", async () =>
     {
 
-        await test("should successfully create a token using hmac with one claim", async () =>
+        await test("should successfully create a token using hmac with one claim", () =>
         {
             const claim = new Claim("this_claim", "ThisValue");
-            const key = await SymmetricEncryption.generateKey();
+            const key = SymmetricEncryption.generateKey();
             const time = Date.now();
             const token = JsonWebToken.fromClaims("issuer1", 1, key, time + 10000000, [claim]).generateToken();
             const jwt = JsonWebToken.fromToken("issuer1", 1, key, token);
@@ -31,7 +40,7 @@ await describe("Json Web Token ", async () =>
         {
             const claim1 = new Claim("this_claim", "ThisValue");
             const claim2 = new Claim("that_claim", "ThatValue");
-            const key = await SymmetricEncryption.generateKey();
+            const key = SymmetricEncryption.generateKey();
             const time = Date.now();
             const token = JsonWebToken.fromClaims("issuer1", 1, key, time + 10000000, [claim1, claim2]).generateToken();
             const jwt = JsonWebToken.fromToken("issuer1", 1, key, token);
@@ -47,7 +56,7 @@ await describe("Json Web Token ", async () =>
         {
             const claim1 = new Claim("this_claim", "ThisValue");
             const claim2 = new Claim("that_claim", "ThatValue");
-            const key = await SymmetricEncryption.generateKey();
+            const key = SymmetricEncryption.generateKey();
             const time = Date.now();
             const token = JsonWebToken.fromClaims("issuer1", 1, key, time + 10000000, [claim1, claim2]).generateToken();
             const jwt = JsonWebToken.fromToken("issuer1", 1, key, token);
@@ -63,7 +72,7 @@ await describe("Json Web Token ", async () =>
         {
             const claim1 = new Claim("this_claim", "ThisValue");
             const claim2 = new Claim("that_claim", "ThatValue");
-            const key = await SymmetricEncryption.generateKey();
+            const key = SymmetricEncryption.generateKey();
             const time = Date.now();
             const token = JsonWebToken.fromClaims("issuer1", 1, key, time + 10000000, [claim1, claim2]).generateToken();
             try
@@ -83,7 +92,7 @@ await describe("Json Web Token ", async () =>
         {
             const claim1 = new Claim("this_claim", "ThisValue");
             const claim2 = new Claim("that_claim", "ThatValue");
-            const key = await SymmetricEncryption.generateKey();
+            const key = SymmetricEncryption.generateKey();
             const time = Date.now();
             const token = JsonWebToken.fromClaims("issuer1", 1, key, time, [claim1, claim2]).generateToken();
             try
@@ -125,8 +134,8 @@ await describe("Json Web Token ", async () =>
         {
             const claim1 = new Claim("this_claim", "ThisValue");
             const claim2 = new Claim("that_claim", "ThatValue");
-            const key = await SymmetricEncryption.generateKey();
-            const key2 = await SymmetricEncryption.generateKey();
+            const key = SymmetricEncryption.generateKey();
+            const key2 = SymmetricEncryption.generateKey();
             const time = Date.now();
             const token = JsonWebToken.fromClaims("issuer1", 1, key, time + 1000000, [claim1, claim2]).generateToken();
             try
@@ -146,7 +155,7 @@ await describe("Json Web Token ", async () =>
         {
             const claim1 = new Claim("this_claim", "ThisValue");
             const claim2 = new Claim("that_claim", "ThatValue");
-            const key = await SymmetricEncryption.generateKey();
+            const key = SymmetricEncryption.generateKey();
             const time = Date.now();
             let token = JsonWebToken.fromClaims("issuer1", 1, key, time + 1000000, [claim1, claim2]).generateToken();
             token = token + "someStuff";
@@ -162,6 +171,63 @@ await describe("Json Web Token ", async () =>
             }
             assert.ok(false);
         });
+
+        await test("should throw an exception when body contains '__proto__' as a claim type", () =>
+        {
+            const key = SymmetricEncryption.generateKey();
+            const headerJson = JSON.stringify({ iss: "issuer1", alg: 1, exp: Date.now() + 10000000 });
+            const bodyJson = `{"__proto__":"evil"}`;
+            const token = buildToken(key, headerJson, bodyJson);
+            try
+            {
+                JsonWebToken.fromToken("issuer1", 1, key, token);
+            }
+            catch (exp)
+            {
+                assert.ok(exp instanceof InvalidTokenException);
+                assert.equal(exp.message, `Token '${token}' is invalid because body contains invalid key '__proto__'.`);
+                return;
+            }
+            assert.ok(false);
+        });
+
+        await test("should throw an exception when body contains 'constructor' as a claim type", () =>
+        {
+            const key = SymmetricEncryption.generateKey();
+            const headerJson = JSON.stringify({ iss: "issuer1", alg: 1, exp: Date.now() + 10000000 });
+            const bodyJson = `{"constructor":"evil"}`;
+            const token = buildToken(key, headerJson, bodyJson);
+            try
+            {
+                JsonWebToken.fromToken("issuer1", 1, key, token);
+            }
+            catch (exp)
+            {
+                assert.ok(exp instanceof InvalidTokenException);
+                assert.equal(exp.message, `Token '${token}' is invalid because body contains invalid key 'constructor'.`);
+                return;
+            }
+            assert.ok(false);
+        });
+
+        await test("should throw an exception when body contains 'prototype' as a claim type", () =>
+        {
+            const key = SymmetricEncryption.generateKey();
+            const headerJson = JSON.stringify({ iss: "issuer1", alg: 1, exp: Date.now() + 10000000 });
+            const bodyJson = `{"prototype":"evil"}`;
+            const token = buildToken(key, headerJson, bodyJson);
+            try
+            {
+                JsonWebToken.fromToken("issuer1", 1, key, token);
+            }
+            catch (exp)
+            {
+                assert.ok(exp instanceof InvalidTokenException);
+                assert.equal(exp.message, `Token '${token}' is invalid because body contains invalid key 'prototype'.`);
+                return;
+            }
+            assert.ok(false);
+        });
     });
 
     // await describe("digital Signature", () =>

package/test/symmetric-encryption.test.ts

@@ -1,7 +1,6 @@
 import assert from "node:assert";
 import { describe, test } from "node:test";
-import { SymmetricEncryption } from "./../src/index.js";
-// import { CryptoException } from "./../src/crypto-exception";
+import { CryptoException, SymmetricEncryption } from "./../src/index.js";
 import "@nivinjoseph/n-ext";
 
 
@@ -9,30 +8,30 @@ await describe("SymmetricEncryption", async () =>
 {
     await describe("generateKey", async () =>
     {
-        await test("must return string value that is not null, empty or whitespace", async () =>
+        await test("must return string value that is not null, empty or whitespace", () =>
         {
-            const key = await SymmetricEncryption.generateKey();
+            const key = SymmetricEncryption.generateKey();
             console.log("key", key);
             // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
             assert.ok(key !== null && !key.isEmptyOrWhiteSpace());
         });
 
 
-        await test("consecutive calls must yield unique values", async () =>
+        await test("consecutive calls must yield unique values", () =>
         {
-            const key1 = await SymmetricEncryption.generateKey();
-            const key2 = await SymmetricEncryption.generateKey();
+            const key1 = SymmetricEncryption.generateKey();
+            const key2 = SymmetricEncryption.generateKey();
             assert.notStrictEqual(key1, key2);
         });
     });
 
     await describe("encrypt", async () =>
     {
-        await test("must return cipher text value when called with key and plain text value", async () =>
+        await test("must return cipher text value when called with key and plain text value", () =>
         {
             const key = "E25B269440F88601C453CD171D76EDDC11D8CF33230742DF8CAD5873D28F78B2";
             const value = "password";
-            const encrypted = await SymmetricEncryption.encrypt(key, value);
+            const encrypted = SymmetricEncryption.encrypt(key, value);
             // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
             assert.ok(encrypted !== null);
             assert.notStrictEqual(encrypted, value);
@@ -172,15 +171,55 @@ await describe("SymmetricEncryption", async () =>
 
     await describe("decrypt", async () =>
     {
-        await test("must return plain text value when called with key and cipher text value", async () =>
+        await test("must return plain text value when called with key and cipher text value", () =>
         {
-            const key = await SymmetricEncryption.generateKey();
+            const key = SymmetricEncryption.generateKey();
             const value = "password";
-            const encrypted = await SymmetricEncryption.encrypt(key, value);
+            const encrypted = SymmetricEncryption.encrypt(key, value);
             const decrypted = SymmetricEncryption.decrypt(key, encrypted);
             assert.strictEqual(decrypted, value);
         });
 
+        await test("round-trips successfully when the same aad is supplied to encrypt and decrypt", () =>
+        {
+            const key = SymmetricEncryption.generateKey();
+            const value = "password";
+            const aad = "user:42|purpose:session";
+            const encrypted = SymmetricEncryption.encrypt(key, value, aad);
+            const decrypted = SymmetricEncryption.decrypt(key, encrypted, aad);
+            assert.strictEqual(decrypted, value);
+        });
+
+        await test("throws CryptoException when decrypting with a different aad than was used to encrypt", () =>
+        {
+            const key = SymmetricEncryption.generateKey();
+            const encrypted = SymmetricEncryption.encrypt(key, "password", "user:42");
+            assert.throws(
+                () => SymmetricEncryption.decrypt(key, encrypted, "user:99"),
+                CryptoException
+            );
+        });
+
+        await test("throws CryptoException when decrypting without aad a ciphertext that was encrypted with aad", () =>
+        {
+            const key = SymmetricEncryption.generateKey();
+            const encrypted = SymmetricEncryption.encrypt(key, "password", "user:42");
+            assert.throws(
+                () => SymmetricEncryption.decrypt(key, encrypted),
+                CryptoException
+            );
+        });
+
+        await test("throws CryptoException when decrypting with aad a ciphertext that was encrypted without aad", () =>
+        {
+            const key = SymmetricEncryption.generateKey();
+            const encrypted = SymmetricEncryption.encrypt(key, "password");
+            assert.throws(
+                () => SymmetricEncryption.decrypt(key, encrypted, "user:42"),
+                CryptoException
+            );
+        });
+
         // await test("decrypt with a valid encryption key", async () =>
         // {
         //     let key = await SymmetricEncryption.generateKey();

package/tsconfig.json

@@ -1,10 +1,13 @@
 {
     "compilerOptions": {
         "module": "NodeNext",
-        "target": "ES2017",
+        "target": "ES2023",
         "lib": [
             "ES2023"
         ],
+        "types": [
+            "node"
+        ],
         "strict": true,
         "strictNullChecks": true,
         "strictFunctionTypes": true,
@@ -23,7 +26,7 @@
         "noEmitHelpers": true,
         "noImplicitOverride": true,
         "pretty": true,
-        "esModuleInterop": false,
+        "esModuleInterop": true,
         "allowSyntheticDefaultImports": true
     }
 }