@oneuptime/common 12.0.3 → 12.0.4

package/build/dist/Server/Utils/CodeRepository/GitHub/GitHubInstallationBinding.js

@@ -0,0 +1,136 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import ProjectService from "../../../Services/ProjectService";
+import ObjectID from "../../../../Types/ObjectID";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import CaptureSpan from "../../Telemetry/CaptureSpan";
+/*
+ * A GitHub App installation ID is a small, guessable integer, and the single
+ * GitHub App JWT this instance holds will mint a `ghs_` token for ANY of them
+ * (GitHubUtil.getInstallationAccessToken does not — and cannot — know which
+ * tenant asked). So the installation ID alone is not a capability: on its own
+ * it is just an attacker-supplied number.
+ *
+ * Project.gitHubAppInstallationId is the ONE authoritative record of which
+ * project an installation belongs to. It is written only by the GitHub App
+ * install callback, and only after GitHub itself has confirmed — via the
+ * OAuth user-to-server round trip — that the person completing the install
+ * controls that installation. Both `create` and `update` on that column are
+ * closed to API callers, so nothing outside that callback can assert a
+ * binding.
+ *
+ * Every path that turns an installation ID into GitHub access must therefore
+ * re-derive the binding from here rather than trusting the ID it was handed.
+ * Checking that a CodeRepository row is in the caller's project is NOT enough
+ * on its own: the attacker owns their own project, so they control both sides
+ * of that comparison.
+ */
+export default class GitHubInstallationBinding {
+    /*
+     * The installation this project owns, or null if it has none. Callers
+     * filtering a whole project's repositories should read it once and compare
+     * in memory rather than asking per row — every row in such a list shares
+     * the same project, so the answer cannot differ between them.
+     */
+    static async getBoundInstallationId(projectId) {
+        const project = await ProjectService.findOneBy({
+            query: {
+                _id: projectId.toString(),
+            },
+            select: {
+                _id: true,
+                gitHubAppInstallationId: true,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        return (project === null || project === void 0 ? void 0 : project.gitHubAppInstallationId) || null;
+    }
+    // True only if `installationId` is the installation bound to `projectId`.
+    static async isInstallationBoundToProject(data) {
+        if (!data.installationId) {
+            return false;
+        }
+        const project = await ProjectService.findOneBy({
+            query: {
+                _id: data.projectId.toString(),
+                gitHubAppInstallationId: data.installationId.toString(),
+            },
+            select: {
+                _id: true,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        return Boolean(project);
+    }
+    /*
+     * Convenience for the many callers that hold a CodeRepository row and are
+     * about to use its installation ID against GitHub. Returns false for a row
+     * that carries no project or no installation, so a half-populated row can
+     * never be mistaken for a permitted one.
+     *
+     * Row-level checks like this stay necessary even with the write boundary
+     * closed, because a database that was exploited before the fix can still
+     * hold rows whose installation ID never belonged to their project.
+     */
+    static async isRepositoryInstallationBound(repository) {
+        if (!repository.projectId || !repository.gitHubAppInstallationId) {
+            return false;
+        }
+        return GitHubInstallationBinding.isInstallationBoundToProject({
+            projectId: repository.projectId,
+            installationId: repository.gitHubAppInstallationId,
+        });
+    }
+    /*
+     * Fail-closed variant for the places where continuing without a binding
+     * would hand out cross-tenant access.
+     */
+    static async assertInstallationBoundToProject(data) {
+        const isBound = await GitHubInstallationBinding.isInstallationBoundToProject(data);
+        if (!isBound) {
+            /*
+             * Deliberately vague: a probing caller must not be able to tell
+             * "this installation belongs to someone else" from "no such
+             * installation", or the error itself becomes the enumeration oracle
+             * this check exists to close.
+             */
+            throw new BadDataException("This GitHub App installation is not connected to this project. Please connect the repository from Project Settings using the GitHub App.");
+        }
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [ObjectID]),
+    __metadata("design:returntype", Promise)
+], GitHubInstallationBinding, "getBoundInstallationId", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], GitHubInstallationBinding, "isInstallationBoundToProject", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], GitHubInstallationBinding, "isRepositoryInstallationBound", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], GitHubInstallationBinding, "assertInstallationBoundToProject", null);
+//# sourceMappingURL=GitHubInstallationBinding.js.map

package/build/dist/Server/Utils/CodeRepository/GitHub/GitHubInstallationBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubInstallationBinding.js","sourceRoot":"","sources":["../../../../../../Server/Utils/CodeRepository/GitHub/GitHubInstallationBinding.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,cAAc,MAAM,kCAAkC,CAAC;AAE9D,OAAO,QAAQ,MAAM,4BAA4B,CAAC;AAClD,OAAO,gBAAgB,MAAM,8CAA8C,CAAC;AAC5E,OAAO,WAAW,MAAM,6BAA6B,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,OAAO,OAAO,yBAAyB;IAC5C;;;;;OAKG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,sBAAsB,CACxC,SAAmB;QAEnB,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,SAAS,CAAC;YAC7D,KAAK,EAAE;gBACL,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE;aAC1B;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,uBAAuB,EAAE,IAAI;aAC9B;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,uBAAuB,KAAI,IAAI,CAAC;IAClD,CAAC;IAED,0EAA0E;IAEtD,AAAb,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,IAGhD;QACC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,SAAS,CAAC;YAC7D,KAAK,EAAE;gBACL,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE;gBAC9B,uBAAuB,EAAE,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE;aACxD;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;;;;OASG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,UAGjD;QACC,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,uBAAuB,EAAE,CAAC;YACjE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,yBAAyB,CAAC,4BAA4B,CAAC;YAC5D,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,cAAc,EAAE,UAAU,CAAC,uBAAuB;SACnD,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,IAGpD;QACC,MAAM,OAAO,GACX,MAAM,yBAAyB,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAErE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb;;;;;eAKG;YACH,MAAM,IAAI,gBAAgB,CACxB,0IAA0I,CAC3I,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AA9FqB;IADnB,WAAW,EAAE;;qCAED,QAAQ;;6DAgBpB;AAImB;IADnB,WAAW,EAAE;;;;mEAuBb;AAamB;IADnB,WAAW,EAAE;;;;oEAab;AAOmB;IADnB,WAAW,EAAE;;;;uEAmBb"}

package/build/dist/Server/Utils/PasswordHash.js

@@ -0,0 +1,237 @@
+import { EncryptionSecret } from "../EnvironmentConfig";
+import BadDataException from "../../Types/Exception/BadDataException";
+import HashedString from "../../Types/HashedString";
+import crypto from "crypto";
+/*
+ * Password hashing for user credentials.
+ *
+ * WHY THIS IS NOT A PLAIN HASH
+ *
+ * SHA-256 is designed to be fast, and that is exactly wrong for a password.
+ * A commodity GPU computes billions of SHA-256 digests per second, so a
+ * leaked User table is a dictionary attack that finishes over lunch — a
+ * per-user salt stops the attacker amortising that work across accounts, but
+ * it does nothing to slow down any single guess.
+ *
+ * scrypt is deliberately expensive in BOTH time and memory. The memory cost
+ * is the important half: it is what stops an attacker buying a thousandfold
+ * speedup with GPUs or custom silicon, because memory bandwidth is the one
+ * thing that hardware cannot cheaply parallelise.
+ *
+ * THE CONSTRUCTION
+ *
+ *   input   = HMAC-SHA256(key = EncryptionSecret, message = password)
+ *   derived = scrypt(input, salt, 32 bytes, { N, r, p })
+ *
+ * The HMAC step carries the instance-wide EncryptionSecret as a "pepper".
+ * The pepper lives in configuration, not in the database, so a dump of
+ * Postgres alone is not enough to start guessing — the attacker also needs
+ * the deployment's secret. It also normalises the password to a fixed 32
+ * bytes before scrypt sees it, which sidesteps every question about very
+ * long or oddly-encoded inputs.
+ *
+ * THE STORED FORMAT
+ *
+ *   scrypt$N=16384,r=8,p=1$<64 hex characters>
+ *
+ * The hash carries the algorithm and the cost parameters it was produced
+ * with. That is what makes raising the cost later a non-event: old hashes
+ * keep verifying against the parameters recorded in them, and each user's
+ * hash is re-derived at their next successful login. Nothing about a cost
+ * bump requires a migration or a forced password reset.
+ *
+ * The salt is NOT in this string — it lives in the row's own salt column
+ * (see TableColumn.hashSaltColumn), which is where the previous scheme put
+ * it and where the write path keeps it in step with the hash.
+ */
+/*
+ * N is the CPU/memory cost. Memory used is 128 * N * r bytes, so the values
+ * below cost 16 MiB and roughly 50ms per hash on current server hardware.
+ *
+ * That is a deliberate middle: enough to make offline guessing expensive,
+ * cheap enough that a burst of logins does not exhaust the libuv thread pool
+ * or the box's memory. Raising N is a one-line change — bump it here, and
+ * every user is migrated to the new cost as they log in.
+ */
+const CURRENT_PARAMS = {
+    N: 16384,
+    r: 8,
+    p: 1,
+};
+/** Bytes of derived key. 32 bytes = the 64 hex characters stored. */
+const KEY_LENGTH_IN_BYTES = 32;
+const SCHEME_NAME = "scrypt";
+/*
+ * Refuse absurd parameters read back out of the database. Stored values are
+ * ours, not an attacker's, but a corrupted row must fail the login rather
+ * than ask Node to allocate gigabytes.
+ */
+const MAX_N = 1048576; // 2^20
+const MAX_R = 32;
+const MAX_P = 16;
+export default class PasswordHash {
+    /**
+     * A fresh, cryptographically random salt: 32 bytes as 64 hex characters.
+     *
+     * A salt is not a secret — its one job is to be UNIQUE per user, so that no
+     * precomputed table and no cracked password is ever worth anything against
+     * a second account.
+     */
+    static generateSalt() {
+        return crypto.randomBytes(32).toString("hex");
+    }
+    /** The `algorithm$params$` prefix that hashes written today carry. */
+    static getCurrentPrefix() {
+        return `${SCHEME_NAME}$${PasswordHash.encodeParams(CURRENT_PARAMS)}$`;
+    }
+    static getCurrentParams() {
+        return Object.assign({}, CURRENT_PARAMS);
+    }
+    static encodeParams(params) {
+        return `N=${params.N},r=${params.r},p=${params.p}`;
+    }
+    /**
+     * Pull the parameters and derived key back out of a stored value.
+     *
+     * Returns null for anything that is not one of our scrypt hashes — which
+     * includes every password written before this scheme existed. Callers use
+     * null to mean "fall back to the legacy comparison", so this must never
+     * throw on unrecognised input.
+     */
+    static parse(storedValue) {
+        const parts = storedValue.split("$");
+        if (parts.length !== 3 || parts[0] !== SCHEME_NAME) {
+            return null;
+        }
+        const match = parts[1].match(/^N=(\d+),r=(\d+),p=(\d+)$/);
+        if (!match) {
+            return null;
+        }
+        const params = {
+            N: Number(match[1]),
+            r: Number(match[2]),
+            p: Number(match[3]),
+        };
+        const isSane = params.N > 1 &&
+            params.N <= MAX_N &&
+            (params.N & (params.N - 1)) === 0 && // scrypt requires a power of two
+            params.r > 0 &&
+            params.r <= MAX_R &&
+            params.p > 0 &&
+            params.p <= MAX_P;
+        if (!isSane || !parts[2]) {
+            return null;
+        }
+        return { params: params, derivedKey: parts[2] };
+    }
+    /**
+     * The pepper step. Keyed with the instance's EncryptionSecret, so the
+     * database alone cannot be attacked offline.
+     */
+    static applyPepper(plainValue) {
+        return crypto
+            .createHmac("sha256", EncryptionSecret.toString())
+            .update(plainValue, "utf8")
+            .digest();
+    }
+    static derive(data) {
+        const { N, r, p } = data.params;
+        return new Promise((resolve, reject) => {
+            crypto.scrypt(PasswordHash.applyPepper(data.plainValue), data.salt, KEY_LENGTH_IN_BYTES, {
+                N: N,
+                r: r,
+                p: p,
+                /*
+                 * Node rejects the call outright when 128 * N * r exceeds
+                 * maxmem, and its default is a flat 32 MiB. Scale the ceiling
+                 * with the parameters instead, so raising N does not silently
+                 * become "Invalid scrypt params" at runtime.
+                 */
+                maxmem: 128 * N * r * 2,
+            }, (error, derivedKey) => {
+                if (error) {
+                    return reject(error);
+                }
+                return resolve(derivedKey.toString("hex"));
+            });
+        });
+    }
+    /**
+     * Hash a password for storage, at today's cost parameters.
+     *
+     * The returned string records the algorithm and the parameters used, so it
+     * stays verifiable after those parameters change.
+     */
+    static async hash(data) {
+        if (!data.plainValue) {
+            return "";
+        }
+        if (!data.salt) {
+            throw new BadDataException("A salt is required to hash a password.");
+        }
+        const derivedKey = await PasswordHash.derive({
+            plainValue: data.plainValue,
+            salt: data.salt,
+            params: CURRENT_PARAMS,
+        });
+        return `${PasswordHash.getCurrentPrefix()}${derivedKey}`;
+    }
+    /**
+     * Check a password against a stored value, whichever scheme wrote it.
+     *
+     * Three schemes are in circulation and all three have to keep working, or
+     * the change that introduced the next one locks people out:
+     *
+     *   scrypt$...   this one. Verified at the parameters recorded in the hash.
+     *   salted SHA   `SHA256("v2:" + salt + ":" + secret + ":" + password)`.
+     *   bare SHA     `SHA256(secret + password)`, from before salts existed.
+     *
+     * The last two are told apart by whether the row has a salt, which is the
+     * same rule they were written under. Anything not carrying a recognised
+     * scheme prefix is one of them.
+     */
+    static async verify(data) {
+        if (!data.plainValue || !data.storedValue) {
+            return false;
+        }
+        const parsed = PasswordHash.parse(data.storedValue);
+        if (!parsed) {
+            return await HashedString.verifyValue({
+                plainValue: data.plainValue,
+                hashedValue: data.storedValue,
+                encryptionSecret: EncryptionSecret,
+                salt: data.salt || null,
+            });
+        }
+        /*
+         * A scrypt hash is meaningless without the salt it was derived with.
+         * Reaching here without one means the caller did not select the salt
+         * column, which would otherwise look exactly like a wrong password.
+         */
+        if (!data.salt) {
+            throw new BadDataException("Cannot verify a salted password hash without its salt. Select the salt column alongside the hash.");
+        }
+        const derivedKey = await PasswordHash.derive({
+            plainValue: data.plainValue,
+            salt: data.salt,
+            params: parsed.params,
+        });
+        return HashedString.isEqual(derivedKey, parsed.derivedKey);
+    }
+    /**
+     * Should this stored value be re-hashed the next time the password is
+     * known to be correct?
+     *
+     * True for every hash that is not exactly what `hash()` writes today: the
+     * two SHA-256 schemes that came before, and any scrypt hash carrying
+     * parameters that are no longer current. This is the whole upgrade
+     * mechanism — raising the cost above is enough to start migrating users.
+     */
+    static needsUpgrade(storedValue) {
+        if (!storedValue) {
+            return false;
+        }
+        return !storedValue.startsWith(PasswordHash.getCurrentPrefix());
+    }
+}
+//# sourceMappingURL=PasswordHash.js.map

package/build/dist/Server/Utils/PasswordHash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordHash.js","sourceRoot":"","sources":["../../../../Server/Utils/PasswordHash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,YAAY,MAAM,0BAA0B,CAAC;AACpD,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAiB;IACnC,CAAC,EAAE,KAAK;IACR,CAAC,EAAE,CAAC;IACJ,CAAC,EAAE,CAAC;CACL,CAAC;AAEF,qEAAqE;AACrE,MAAM,mBAAmB,GAAW,EAAE,CAAC;AAEvC,MAAM,WAAW,GAAW,QAAQ,CAAC;AAErC;;;;GAIG;AACH,MAAM,KAAK,GAAW,OAAO,CAAC,CAAC,OAAO;AACtC,MAAM,KAAK,GAAW,EAAE,CAAC;AACzB,MAAM,KAAK,GAAW,EAAE,CAAC;AAazB,MAAM,CAAC,OAAO,OAAO,YAAY;IAC/B;;;;;;OAMG;IACI,MAAM,CAAC,YAAY;QACxB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,sEAAsE;IAC/D,MAAM,CAAC,gBAAgB;QAC5B,OAAO,GAAG,WAAW,IAAI,YAAY,CAAC,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC;IACxE,CAAC;IAEM,MAAM,CAAC,gBAAgB;QAC5B,yBAAY,cAAc,EAAG;IAC/B,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,MAAoB;QAC9C,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC;IACrD,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,KAAK,CAAC,WAAmB;QACtC,MAAM,KAAK,GAAkB,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAA6B,KAAK,CAAC,CAAC,CAAY,CAAC,KAAK,CAC/D,2BAA2B,CAC5B,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAiB;YAC3B,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACpB,CAAC;QAEF,MAAM,MAAM,GACV,MAAM,CAAC,CAAC,GAAG,CAAC;YACZ,MAAM,CAAC,CAAC,IAAI,KAAK;YACjB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,iCAAiC;YACtE,MAAM,CAAC,CAAC,GAAG,CAAC;YACZ,MAAM,CAAC,CAAC,IAAI,KAAK;YACjB,MAAM,CAAC,CAAC,GAAG,CAAC;YACZ,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC;QAEpB,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,WAAW,CAAC,UAAkB;QAC3C,OAAO,MAAM;aACV,UAAU,CAAC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE,CAAC;aACjD,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;aAC1B,MAAM,EAAE,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,MAAM,CAAC,IAIrB;QACC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAEhC,OAAO,IAAI,OAAO,CAChB,CAAC,OAAgC,EAAE,MAA8B,EAAE,EAAE;YACnE,MAAM,CAAC,MAAM,CACX,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EACzC,IAAI,CAAC,IAAI,EACT,mBAAmB,EACnB;gBACE,CAAC,EAAE,CAAC;gBACJ,CAAC,EAAE,CAAC;gBACJ,CAAC,EAAE,CAAC;gBACJ;;;;;mBAKG;gBACH,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;aACxB,EACD,CAAC,KAAmB,EAAE,UAAkB,EAAQ,EAAE;gBAChD,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvB,CAAC;gBAED,OAAO,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7C,CAAC,CACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAGxB;QACC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,wCAAwC,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,UAAU,GAAW,MAAM,YAAY,CAAC,MAAM,CAAC;YACnD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,cAAc;SACvB,CAAC,CAAC;QAEH,OAAO,GAAG,YAAY,CAAC,gBAAgB,EAAE,GAAG,UAAU,EAAE,CAAC;IAC3D,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAI1B;QACC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAA8B,YAAY,CAAC,KAAK,CAC1D,IAAI,CAAC,WAAW,CACjB,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,MAAM,YAAY,CAAC,WAAW,CAAC;gBACpC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,gBAAgB,EAAE,gBAAgB;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;aACxB,CAAC,CAAC;QACL,CAAC;QAED;;;;WAIG;QACH,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CACxB,mGAAmG,CACpG,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAW,MAAM,YAAY,CAAC,MAAM,CAAC;YACnD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;OAQG;IACI,MAAM,CAAC,YAAY,CAAC,WAAmB;QAC5C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClE,CAAC;CACF"}

package/build/dist/Types/Database/ColumnLength.js

@@ -12,7 +12,15 @@ var ColumnLength;
     ColumnLength[ColumnLength["Password"] = 500] = "Password";
     ColumnLength[ColumnLength["ShortURL"] = 100] = "ShortURL";
     ColumnLength[ColumnLength["ShortText"] = 100] = "ShortText";
-    ColumnLength[ColumnLength["HashedString"] = 64] = "HashedString";
+    /*
+     * Wide enough for a self-describing password hash, not just a bare digest.
+     * User passwords are stored as `scrypt$N=...,r=...,p=...$<64 hex>` (~90
+     * characters) so the cost parameters travel with the hash and can be
+     * raised later without a migration. The columns that still store a plain
+     * SHA-256 digest — session refresh tokens, master passwords — simply do
+     * not use the extra room.
+     */
+    ColumnLength[ColumnLength["HashedString"] = 255] = "HashedString";
     ColumnLength[ColumnLength["Phone"] = 30] = "Phone";
     ColumnLength[ColumnLength["OTP"] = 8] = "OTP";
 })(ColumnLength || (ColumnLength = {}));

package/build/dist/Types/Database/ColumnLength.js.map

@@ -1 +1 @@
-{"version":3,"file":"ColumnLength.js","sourceRoot":"","sources":["../../../../Types/Database/ColumnLength.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAEhD,IAAK,YAeJ;AAfD,WAAK,YAAY;IACf,sDAAY,CAAA;IACZ,iDAAU,CAAA;IACV,mDAAW,CAAA;IACX,qDAAY,CAAA;IACZ,kDAAU,CAAA;IACV,gDAAS,CAAA;IACT,+DAAiB,CAAA;IACjB,yDAAc,CAAA;IACd,yDAAc,CAAA;IACd,yDAAc,CAAA;IACd,2DAAe,CAAA;IACf,gEAAiB,CAAA;IACjB,kDAAU,CAAA;IACV,6CAAO,CAAA;AACT,CAAC,EAfI,YAAY,KAAZ,YAAY,QAehB;AAMD,MAAM,CAAC,MAAM,+BAA+B,GAC1C,CAAC,IAAqB,EAAsB,EAAE;IAC5C,IAAI,IAAI,KAAK,eAAe,CAAC,OAAO,EAAE,CAAC;QACrC,OAAO,YAAY,CAAC,OAAO,CAAC;IAC9B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,YAAY,CAAC,IAAI,CAAC;IAC3B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,YAAY,CAAC,KAAK,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;QACpC,OAAO,YAAY,CAAC,MAAM,CAAC;IAC7B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,YAAY,CAAC,KAAK,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,YAAY,CAAC,IAAI,CAAC;IAC3B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,YAAY,CAAC,WAAW,CAAC;IAClC,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,QAAQ,EAAE,CAAC;QACtC,OAAO,YAAY,CAAC,QAAQ,CAAC;IAC/B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,QAAQ,EAAE,CAAC;QACtC,OAAO,YAAY,CAAC,QAAQ,CAAC;IAC/B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,QAAQ,EAAE,CAAC;QACtC,OAAO,YAAY,CAAC,QAAQ,CAAC;IAC/B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,SAAS,EAAE,CAAC;QACvC,OAAO,YAAY,CAAC,SAAS,CAAC;IAChC,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,YAAY,EAAE,CAAC;QAC1C,OAAO,YAAY,CAAC,YAAY,CAAC;IACnC,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,YAAY,CAAC,KAAK,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,GAAG,EAAE,CAAC;QACjC,OAAO,YAAY,CAAC,GAAG,CAAC;IAC1B,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEJ,eAAe,YAAY,CAAC"}
+{"version":3,"file":"ColumnLength.js","sourceRoot":"","sources":["../../../../Types/Database/ColumnLength.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAEhD,IAAK,YAuBJ;AAvBD,WAAK,YAAY;IACf,sDAAY,CAAA;IACZ,iDAAU,CAAA;IACV,mDAAW,CAAA;IACX,qDAAY,CAAA;IACZ,kDAAU,CAAA;IACV,gDAAS,CAAA;IACT,+DAAiB,CAAA;IACjB,yDAAc,CAAA;IACd,yDAAc,CAAA;IACd,yDAAc,CAAA;IACd,2DAAe,CAAA;IACf;;;;;;;OAOG;IACH,iEAAkB,CAAA;IAClB,kDAAU,CAAA;IACV,6CAAO,CAAA;AACT,CAAC,EAvBI,YAAY,KAAZ,YAAY,QAuBhB;AAMD,MAAM,CAAC,MAAM,+BAA+B,GAC1C,CAAC,IAAqB,EAAsB,EAAE;IAC5C,IAAI,IAAI,KAAK,eAAe,CAAC,OAAO,EAAE,CAAC;QACrC,OAAO,YAAY,CAAC,OAAO,CAAC;IAC9B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,YAAY,CAAC,IAAI,CAAC;IAC3B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,YAAY,CAAC,KAAK,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;QACpC,OAAO,YAAY,CAAC,MAAM,CAAC;IAC7B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,YAAY,CAAC,KAAK,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,YAAY,CAAC,IAAI,CAAC;IAC3B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,YAAY,CAAC,WAAW,CAAC;IAClC,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,QAAQ,EAAE,CAAC;QACtC,OAAO,YAAY,CAAC,QAAQ,CAAC;IAC/B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,QAAQ,EAAE,CAAC;QACtC,OAAO,YAAY,CAAC,QAAQ,CAAC;IAC/B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,QAAQ,EAAE,CAAC;QACtC,OAAO,YAAY,CAAC,QAAQ,CAAC;IAC/B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,SAAS,EAAE,CAAC;QACvC,OAAO,YAAY,CAAC,SAAS,CAAC;IAChC,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,YAAY,EAAE,CAAC;QAC1C,OAAO,YAAY,CAAC,YAAY,CAAC;IACnC,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,YAAY,CAAC,KAAK,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,GAAG,EAAE,CAAC;QACjC,OAAO,YAAY,CAAC,GAAG,CAAC;IAC1B,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEJ,eAAe,YAAY,CAAC"}

package/build/dist/Types/Database/TableColumn.js.map

@@ -1 +1 @@
-{"version":3,"file":"TableColumn.js","sourceRoot":"","sources":["../../../../Types/Database/TableColumn.ts"],"names":[],"mappings":"AAKA,OAAO,kBAAkB,CAAC;AAE1B,MAAM,WAAW,GAAW,MAAM,CAAC,aAAa,CAAC,CAAC;AAuBlD,eAAe,CAAC,KAA0B,EAA0B,EAAE;IACpE,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,cAAc,GAA2B,CACpD,MAAS,EACT,WAAmB,EACE,EAAE;IACvB,OAAO,OAAO,CAAC,WAAW,CACxB,WAAW,EACX,MAAM,EACN,WAAW,CACW,CAAC;AAC3B,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,eAAe,GAA4B,CACtD,MAAS,EACwB,EAAE;IACnC,MAAM,SAAS,GAAoC,EAAE,CAAC;IACtD,MAAM,IAAI,GAAkB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YAClD,SAAS,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAClC,WAAW,EACX,MAAM,EACN,GAAG,CACmB,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC"}
+{"version":3,"file":"TableColumn.js","sourceRoot":"","sources":["../../../../Types/Database/TableColumn.ts"],"names":[],"mappings":"AAKA,OAAO,kBAAkB,CAAC;AAE1B,MAAM,WAAW,GAAW,MAAM,CAAC,aAAa,CAAC,CAAC;AAkClD,eAAe,CAAC,KAA0B,EAA0B,EAAE;IACpE,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,cAAc,GAA2B,CACpD,MAAS,EACT,WAAmB,EACE,EAAE;IACvB,OAAO,OAAO,CAAC,WAAW,CACxB,WAAW,EACX,MAAM,EACN,WAAW,CACW,CAAC;AAC3B,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,eAAe,GAA4B,CACtD,MAAS,EACwB,EAAE;IACnC,MAAM,SAAS,GAAoC,EAAE,CAAC;IACtD,MAAM,IAAI,GAAkB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YAClD,SAAS,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAClC,WAAW,EACX,MAAM,EACN,GAAG,CACmB,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC"}

package/build/dist/Types/Database/UnsynchronizedIndex.js

@@ -0,0 +1,46 @@
+/*
+ * Options for an index whose definition TypeORM cannot express, and which must
+ * therefore be owned by a migration rather than by the schema builder.
+ *
+ * WHY THIS EXISTS
+ *
+ * TypeORM's schema builder matches database indexes to entity metadata BY NAME
+ * (RdbmsSchemaBuilder.dropOldIndices: `metadata.indices.find((i) => i.name ===
+ * tableIndex.name)`) and DROPS every index it cannot find a match for. An index
+ * created only in a migration is invisible to entity metadata, so the next
+ * `npm run generate-postgres-migration` emits a DROP for it — silently, mixed
+ * in with whatever change was actually being made.
+ *
+ * That is not hypothetical. An audit of every hand-named index ever created by
+ * a migration against a fully-migrated database found ten that had been deleted
+ * this way and never restored, including the unique guards on six `slug`
+ * columns and the LOWER(name) index serving the telemetry ingest hot path.
+ * Migration 1775735059360 is a representative example: two unrelated column
+ * default changes, plus a DROP of an expression index, plus a down() that
+ * "restores" it without the expression.
+ *
+ * HOW THIS FIXES IT
+ *
+ * Declaring the index on the entity BY NAME with these options makes the schema
+ * builder skip it in both directions: `dropOldIndices` returns early on
+ * `synchronize === false`, and `createNewIndices` only considers indexes with
+ * `synchronize === true`. The migration stays the single source of truth for
+ * the real definition, and the declaration exists purely so TypeORM leaves it
+ * alone.
+ *
+ * The columns passed alongside these options are documentation — the schema
+ * builder never reads them for an unsynchronized index. Where the real
+ * definition is partial or an expression, say so in a comment at the call site.
+ *
+ * THE CAST
+ *
+ * `synchronize` is a real, supported option: the @Index decorator forwards it
+ * into IndexMetadataArgs (typeorm/decorator/Index.js), IndexMetadataArgs
+ * declares it, and RdbmsSchemaBuilder reads it. Only the public IndexOptions
+ * type omits it — a gap in TypeORM's own typings rather than a misuse.
+ */
+const UNSYNCHRONIZED_INDEX = {
+    synchronize: false,
+};
+export default UNSYNCHRONIZED_INDEX;
+//# sourceMappingURL=UnsynchronizedIndex.js.map

package/build/dist/Types/Database/UnsynchronizedIndex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UnsynchronizedIndex.js","sourceRoot":"","sources":["../../../../Types/Database/UnsynchronizedIndex.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,oBAAoB,GAAiB;IACzC,WAAW,EAAE,KAAK;CACH,CAAC;AAElB,eAAe,oBAAoB,CAAC"}

package/build/dist/Types/HashedString.js

@@ -4,6 +4,28 @@ import BadDataException from "./Exception/BadDataException";
 import BadOperationException from "./Exception/BadOperationException";
 import { ObjectType } from "./JSON";
 import CryptoJS from "crypto-js";
+/*
+ * SHA-256 hashing for values that are ALREADY high-entropy: session refresh
+ * tokens, email verification tokens, reset tokens, permission fingerprints.
+ * Those are random values the server minted, so there is nothing to guess and
+ * a fast hash is the right tool — it also keeps them searchable by hash,
+ * which is how they are looked up.
+ *
+ * User passwords are NOT hashed here any more. A password is low-entropy and
+ * guessable, so it goes through scrypt in Common/Server/Utils/PasswordHash,
+ * which is deliberately slow and memory-hard. What remains in this class is
+ * the two SHA-256 schemes passwords used to be stored under, kept so those
+ * rows still verify (and are then upgraded) at their owner's next login:
+ *
+ *   no salt   `SHA256(secret + value)`, from before per-user salts existed.
+ *   salted    `SHA256("v2:" + salt + ":" + secret + ":" + value)`.
+ *
+ * Neither records its scheme in the digest — it is a bare hex SHA-256 either
+ * way — so they are told apart by whether the row carries a salt. The "v2"
+ * prefix and the separators exist for domain separation: without them a
+ * crafted salt could make a salted input collide with an unsalted one.
+ */
+const SALTED_HASH_SCHEME_VERSION = "v2";
 export default class HashedString extends DatabaseProperty {
     get value() {
         return this._value;
@@ -48,21 +70,89 @@ export default class HashedString extends DatabaseProperty {
     isValueHashed() {
         return this.isHashed;
     }
-    async hashValue(encryptionSecret) {
+    /**
+     * Adopt an already-computed digest.
+     *
+     * For hashes this class does not compute itself — user passwords go
+     * through scrypt in Common/Server/Utils/PasswordHash, which is server-only
+     * because this type is also bundled into the browser. The guard is the
+     * same one hashValue() carries: a value is hashed once and never re-hashed
+     * over the top of itself.
+     */
+    setHashedValue(hashedValue) {
+        if (this.isHashed) {
+            throw new BadOperationException("Value is already hashed");
+        }
+        this.isHashed = true;
+        this.value = hashedValue;
+    }
+    /**
+     * The exact byte string fed to SHA-256.
+     *
+     * The unsalted branch MUST stay byte-for-byte identical forever: every
+     * password hashed before per-user salts existed is verified through it.
+     */
+    static buildValueToHash(value, encryptionSecret, salt) {
+        if (!salt) {
+            return (encryptionSecret || "") + value;
+        }
+        return `${SALTED_HASH_SCHEME_VERSION}:${salt}:${encryptionSecret || ""}:${value}`;
+    }
+    static computeHash(value, encryptionSecret, salt) {
+        if (!value) {
+            return "";
+        }
+        return CryptoJS.SHA256(HashedString.buildValueToHash(value, encryptionSecret, salt || null)).toString();
+    }
+    async hashValue(encryptionSecret, salt) {
         if (!this.value) {
             return "";
         }
         if (this.isHashed) {
             throw new BadOperationException("Value is already hashed");
         }
-        const valueToHash = (encryptionSecret || "") + this.value;
         this.isHashed = true;
-        this.value = CryptoJS.SHA256(valueToHash).toString();
+        this.value = HashedString.computeHash(this.value, encryptionSecret, salt || null);
         return this.value;
     }
-    static async hashValue(value, encryptionSecret) {
+    static async hashValue(value, encryptionSecret, salt) {
         const hashstring = new HashedString(value, false);
-        return await hashstring.hashValue(encryptionSecret);
+        return await hashstring.hashValue(encryptionSecret, salt || null);
+    }
+    /**
+     * Compare two already-hashed values without leaking, through timing, how
+     * many leading characters matched. Comparing digests with `===` lets an
+     * attacker who can measure response time recover a stored hash one
+     * character at a time; recovering the hash is what makes offline cracking
+     * possible in the first place.
+     *
+     * Lengths are compared up front. Digests here are always the same length,
+     * so an early exit only happens on malformed input, where the length is
+     * not the secret.
+     */
+    static isEqual(a, b) {
+        if (a.length !== b.length) {
+            return false;
+        }
+        let difference = 0;
+        for (let i = 0; i < a.length; i++) {
+            difference |= a.charCodeAt(i) ^ b.charCodeAt(i);
+        }
+        return difference === 0;
+    }
+    /**
+     * Verify a plaintext value against a stored hash.
+     *
+     * Pass the salt stored alongside the hash. Pass null/undefined for records
+     * written before per-user salts existed — those verify against the legacy
+     * unsalted scheme, and the caller should re-hash them with a fresh salt
+     * once the value is known to be correct.
+     */
+    static async verifyValue(data) {
+        if (!data.plainValue || !data.hashedValue) {
+            return false;
+        }
+        return HashedString.isEqual(HashedString.computeHash(data.plainValue, data.encryptionSecret, data.salt || null), data.hashedValue);
     }
     static fromDatabase(_value) {
         if (_value) {

package/build/dist/Types/HashedString.js.map

@@ -1 +1 @@
-{"version":3,"file":"HashedString.js","sourceRoot":"","sources":["../../../Types/HashedString.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,gBAAgB,MAAM,6BAA6B,CAAC;AAC3D,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,qBAAqB,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAc,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,QAAQ,MAAM,WAAW,CAAC;AAGjC,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,gBAAgB;IAIxD,IAAW,KAAK;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,IAAW,KAAK,CAAC,CAAS;QACxB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,YAAmB,KAAa,EAAE,gBAAyB,KAAK;QAC9D,KAAK,EAAE,CAAC;QAXF,aAAQ,GAAY,KAAK,CAAC;QAE1B,WAAM,GAAW,EAAE,CAAC;QAU1B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC;IAChC,CAAC;IAEe,MAAM;QACpB,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,YAAY;YAC9B,KAAK,EAAG,IAAqB,CAAC,QAAQ,EAAE;SACzC,CAAC;IACJ,CAAC;IAEM,MAAM,CAAU,QAAQ,CAAC,IAAgB;QAC9C,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,YAAY,EAAE,CAAC;YAC9C,OAAO,IAAI,YAAY,CAAE,IAAI,CAAC,OAAO,CAAY,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IAEe,QAAQ;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEM,MAAM,CAAC,QAAQ;QACpB,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnC,CAAC;IAES,MAAM,CAAU,UAAU,CAClC,KAAgD;QAEhD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,KAAK,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YAED,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC1B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,aAAa;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,gBAAiC;QACtD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,WAAW,GAAW,CAAC,gBAAgB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QAClE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAErB,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,SAAS,CAC3B,KAAa,EACb,gBAAiC;QAEjC,MAAM,UAAU,GAAiB,IAAI,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChE,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACtD,CAAC;IAES,MAAM,CAAU,YAAY,CAAC,MAAc;QACnD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,IAAI,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,MAAM,CAAC,UAAU,CAAC,KAAa;QACpC,OAAO,IAAI,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;CACF"}
+{"version":3,"file":"HashedString.js","sourceRoot":"","sources":["../../../Types/HashedString.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,gBAAgB,MAAM,6BAA6B,CAAC;AAC3D,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,qBAAqB,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAc,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,QAAQ,MAAM,WAAW,CAAC;AAGjC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,0BAA0B,GAAW,IAAI,CAAC;AAEhD,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,gBAAgB;IAIxD,IAAW,KAAK;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,IAAW,KAAK,CAAC,CAAS;QACxB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,YAAmB,KAAa,EAAE,gBAAyB,KAAK;QAC9D,KAAK,EAAE,CAAC;QAXF,aAAQ,GAAY,KAAK,CAAC;QAE1B,WAAM,GAAW,EAAE,CAAC;QAU1B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC;IAChC,CAAC;IAEe,MAAM;QACpB,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,YAAY;YAC9B,KAAK,EAAG,IAAqB,CAAC,QAAQ,EAAE;SACzC,CAAC;IACJ,CAAC;IAEM,MAAM,CAAU,QAAQ,CAAC,IAAgB;QAC9C,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,YAAY,EAAE,CAAC;YAC9C,OAAO,IAAI,YAAY,CAAE,IAAI,CAAC,OAAO,CAAY,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IAEe,QAAQ;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEM,MAAM,CAAC,QAAQ;QACpB,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnC,CAAC;IAES,MAAM,CAAU,UAAU,CAClC,KAAgD;QAEhD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,KAAK,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YAED,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC1B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,aAAa;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACI,cAAc,CAAC,WAAmB;QACvC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,gBAAgB,CAC7B,KAAa,EACb,gBAAiC,EACjC,IAAmB;QAEnB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC;QAC1C,CAAC;QAED,OAAO,GAAG,0BAA0B,IAAI,IAAI,IAC1C,gBAAgB,IAAI,EACtB,IAAI,KAAK,EAAE,CAAC;IACd,CAAC;IAEM,MAAM,CAAC,WAAW,CACvB,KAAa,EACb,gBAAiC,EACjC,IAAoB;QAEpB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,CACpB,YAAY,CAAC,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,IAAI,IAAI,CAAC,CACrE,CAAC,QAAQ,EAAE,CAAC;IACf,CAAC;IAEM,KAAK,CAAC,SAAS,CACpB,gBAAiC,EACjC,IAAoB;QAEpB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAErB,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,WAAW,CACnC,IAAI,CAAC,KAAK,EACV,gBAAgB,EAChB,IAAI,IAAI,IAAI,CACb,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,SAAS,CAC3B,KAAa,EACb,gBAAiC,EACjC,IAAoB;QAEpB,MAAM,UAAU,GAAiB,IAAI,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChE,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;;;;;OAUG;IACI,MAAM,CAAC,OAAO,CAAC,CAAS,EAAE,CAAS;QACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,UAAU,GAAW,CAAC,CAAC;QAE3B,KAAK,IAAI,CAAC,GAAW,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,UAAU,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAK/B;QACC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,YAAY,CAAC,OAAO,CACzB,YAAY,CAAC,WAAW,CACtB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,IAAI,IAAI,IAAI,CAClB,EACD,IAAI,CAAC,WAAW,CACjB,CAAC;IACJ,CAAC;IAES,MAAM,CAAU,YAAY,CAAC,MAAc;QACnD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,IAAI,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,MAAM,CAAC,UAAU,CAAC,KAAa;QACpC,OAAO,IAAI,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;CACF"}