@prairielearn/signed-token 2.0.23 → 3.1.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @prairielearn/signed-token
 
+## 3.1.0
+
+### Minor Changes
+
+- 4cbe086: Add `generatePrefixCsrfToken()` and `checkSignedTokenPrefix()` functions for prefix-based CSRF token validation. These functions allow generating a single CSRF token that is valid for all URLs under a given prefix, which is useful for tRPC and similar APIs where multiple endpoints share a common base path.
+
+### Patch Changes
+
+- f929a68: Replace lodash with es-toolkit
+
+## 3.0.0
+
+### Major Changes
+
+- 3914bb4: Upgrade to Node 24
+
 ## 2.0.23
 
 ### Patch Changes

package/dist/index.d.ts

@@ -4,5 +4,31 @@ interface CheckOptions {
 export declare function generateSignedToken(data: any, secretKey: string): string;
 export declare function getCheckedSignedTokenData(token: string, secretKey: string, options?: CheckOptions): any;
 export declare function checkSignedToken(token: string, data: any, secretKey: string, options?: CheckOptions): boolean;
+/**
+ * Generates a CSRF token that is valid for a URL prefix instead of an exact URL.
+ * This is useful for tRPC and similar APIs where a single token should be valid
+ * for all sub-routes under a prefix (e.g., `/foo/bar/trpc` is valid for
+ * `/foo/bar/trpc/getUser` and `/foo/bar/trpc/updateUser`).
+ */
+export declare function generatePrefixCsrfToken(data: {
+    url: string;
+    authn_user_id: string;
+}, secretKey: string): string;
+/**
+ * Validates a prefix-based CSRF token. The token's URL must be a prefix of the
+ * request URL for validation to succeed.
+ *
+ * @param token - The CSRF token to validate
+ * @param requestData - The request URL and authenticated user ID
+ * @param requestData.url - The request URL to validate against
+ * @param requestData.authn_user_id - The authenticated user ID to validate against
+ * @param secretKey - The secret key used for signing
+ * @param options - Optional settings like maxAge
+ * @returns true if the token is valid, false otherwise
+ */
+export declare function checkSignedTokenPrefix(token: string, requestData: {
+    url: string;
+    authn_user_id: string;
+}, secretKey: string, options?: CheckOptions): boolean;
 export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,UAAU,YAAY;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,UAoB/D;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,YAAiB,OAkE3B;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,GAAG,EACT,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,YAAiB,WAY3B","sourcesContent":["import crypto from 'node:crypto';\n\nimport base64url from 'base64url';\nimport debugfn from 'debug';\nimport _ from 'lodash';\n\nconst debug = debugfn('prairielearn:csrf');\nconst sep = '.';\n\ninterface CheckOptions {\n  maxAge?: number;\n}\n\nexport function generateSignedToken(data: any, secretKey: string) {\n  debug(`generateSignedToken(): data = ${JSON.stringify(data)}`);\n  debug(`generateSignedToken(): secretKey = ${secretKey}`);\n  const dataJSON = JSON.stringify(data);\n  const dataString = base64url.default.encode(dataJSON);\n  const dateString = Date.now().toString(36);\n  const checkString = dateString + sep + dataString;\n  const signature = crypto.createHmac('sha256', secretKey).update(checkString).digest('hex');\n  const encodedSignature = base64url.default.encode(signature);\n  debug(\n    `generateSignedToken(): ${JSON.stringify({\n      dataString,\n      dateString,\n      checkString,\n      encodedSignature,\n    })}`,\n  );\n  const token = encodedSignature + sep + checkString;\n  debug(`generateSignedToken(): token = ${token}`);\n  return token;\n}\n\nexport function getCheckedSignedTokenData(\n  token: string,\n  secretKey: string,\n  options: CheckOptions = {},\n) {\n  debug(`getCheckedSignedTokenData(): token = ${token}`);\n  debug(`getCheckedSignedTokenData(): secretKey = ${secretKey}`);\n  debug(`getCheckedSignedTokenData(): options = ${JSON.stringify(options)}`);\n  if (typeof token !== 'string') {\n    debug('getCheckedSignedTokenData(): FAIL - token is not string');\n    return null;\n  }\n\n  // break token apart into the three components\n  const match = token.split(sep);\n  if (match == null) {\n    debug('getCheckedSignedTokenData(): FAIL - could not split token');\n    return null;\n  }\n  const tokenSignature = match[0];\n  const tokenDateString = match[1];\n  const tokenDataString = match[2];\n\n  // check the signature\n  const checkString = tokenDateString + sep + tokenDataString;\n  const checkSignature = crypto.createHmac('sha256', secretKey).update(checkString).digest('hex');\n  const encodedCheckSignature = base64url.default.encode(checkSignature);\n  if (encodedCheckSignature !== tokenSignature) {\n    debug(\n      `getCheckedSignedTokenData(): FAIL - signature mismatch: checkSig=${encodedCheckSignature} != tokenSig=${tokenSignature}`,\n    );\n    return null;\n  }\n\n  // check the age if we have the maxAge parameter\n  if (options.maxAge != null) {\n    let tokenDate;\n    try {\n      tokenDate = new Date(Number.parseInt(tokenDateString, 36));\n    } catch {\n      debug(`getCheckedSignedTokenData(): FAIL - could not parse date: ${tokenDateString}`);\n      return null;\n    }\n    const currentTime = Date.now();\n    const elapsedTime = currentTime - tokenDate.getTime();\n    if (elapsedTime > options.maxAge) {\n      debug(\n        `getCheckedSignedTokenData(): FAIL - too old: elapsedTime=${elapsedTime} > maxAge=${options.maxAge}`,\n      );\n      return null;\n    }\n  }\n\n  // get the data\n  let tokenDataJSON, tokenData;\n  try {\n    tokenDataJSON = base64url.default.decode(tokenDataString);\n  } catch {\n    debug(`getCheckedSignedTokenData(): FAIL - could not base64 decode: ${tokenDateString}`);\n    return null;\n  }\n  try {\n    tokenData = JSON.parse(tokenDataJSON);\n  } catch {\n    debug(`getCheckedSignedTokenData(): FAIL - could not parse JSON: ${tokenDataJSON}`);\n    return null;\n  }\n  debug(`getCheckedSignedTokenData(): tokenData = ${tokenData}`);\n  return tokenData;\n}\n\nexport function checkSignedToken(\n  token: string,\n  data: any,\n  secretKey: string,\n  options: CheckOptions = {},\n) {\n  debug(`checkSignedToken(): token = ${token}`);\n  debug(`checkSignedToken(): data = ${JSON.stringify(data)}`);\n  debug(`checkSignedToken(): secretKey = ${secretKey}`);\n  debug(`checkSignedToken(): options = ${JSON.stringify(options)}`);\n  debug(`checkSignedToken(): data = ${JSON.stringify(data)}`);\n  const tokenData = getCheckedSignedTokenData(token, secretKey, options);\n  debug(`checkSignedToken(): tokenData = ${JSON.stringify(tokenData)}`);\n  if (tokenData == null) return false;\n  if (!_.isEqual(data, tokenData)) return false;\n  return true;\n}\n"]}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,UAAU,YAAY;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,UAoB/D;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,YAAiB,OAkE3B;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,GAAG,EACT,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,YAAiB,WAY3B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,EAC5C,SAAS,EAAE,MAAM,UAGlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,EACnD,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAkCT","sourcesContent":["import crypto from 'node:crypto';\n\nimport base64url from 'base64url';\nimport debugfn from 'debug';\nimport { isEqual } from 'es-toolkit';\n\nconst debug = debugfn('prairielearn:csrf');\nconst sep = '.';\n\ninterface CheckOptions {\n  maxAge?: number;\n}\n\nexport function generateSignedToken(data: any, secretKey: string) {\n  debug(`generateSignedToken(): data = ${JSON.stringify(data)}`);\n  debug(`generateSignedToken(): secretKey = ${secretKey}`);\n  const dataJSON = JSON.stringify(data);\n  const dataString = base64url.default.encode(dataJSON);\n  const dateString = Date.now().toString(36);\n  const checkString = dateString + sep + dataString;\n  const signature = crypto.createHmac('sha256', secretKey).update(checkString).digest('hex');\n  const encodedSignature = base64url.default.encode(signature);\n  debug(\n    `generateSignedToken(): ${JSON.stringify({\n      dataString,\n      dateString,\n      checkString,\n      encodedSignature,\n    })}`,\n  );\n  const token = encodedSignature + sep + checkString;\n  debug(`generateSignedToken(): token = ${token}`);\n  return token;\n}\n\nexport function getCheckedSignedTokenData(\n  token: string,\n  secretKey: string,\n  options: CheckOptions = {},\n) {\n  debug(`getCheckedSignedTokenData(): token = ${token}`);\n  debug(`getCheckedSignedTokenData(): secretKey = ${secretKey}`);\n  debug(`getCheckedSignedTokenData(): options = ${JSON.stringify(options)}`);\n  if (typeof token !== 'string') {\n    debug('getCheckedSignedTokenData(): FAIL - token is not string');\n    return null;\n  }\n\n  // break token apart into the three components\n  const match = token.split(sep);\n  if (match == null) {\n    debug('getCheckedSignedTokenData(): FAIL - could not split token');\n    return null;\n  }\n  const tokenSignature = match[0];\n  const tokenDateString = match[1];\n  const tokenDataString = match[2];\n\n  // check the signature\n  const checkString = tokenDateString + sep + tokenDataString;\n  const checkSignature = crypto.createHmac('sha256', secretKey).update(checkString).digest('hex');\n  const encodedCheckSignature = base64url.default.encode(checkSignature);\n  if (encodedCheckSignature !== tokenSignature) {\n    debug(\n      `getCheckedSignedTokenData(): FAIL - signature mismatch: checkSig=${encodedCheckSignature} != tokenSig=${tokenSignature}`,\n    );\n    return null;\n  }\n\n  // check the age if we have the maxAge parameter\n  if (options.maxAge != null) {\n    let tokenDate;\n    try {\n      tokenDate = new Date(Number.parseInt(tokenDateString, 36));\n    } catch {\n      debug(`getCheckedSignedTokenData(): FAIL - could not parse date: ${tokenDateString}`);\n      return null;\n    }\n    const currentTime = Date.now();\n    const elapsedTime = currentTime - tokenDate.getTime();\n    if (elapsedTime > options.maxAge) {\n      debug(\n        `getCheckedSignedTokenData(): FAIL - too old: elapsedTime=${elapsedTime} > maxAge=${options.maxAge}`,\n      );\n      return null;\n    }\n  }\n\n  // get the data\n  let tokenDataJSON, tokenData;\n  try {\n    tokenDataJSON = base64url.default.decode(tokenDataString);\n  } catch {\n    debug(`getCheckedSignedTokenData(): FAIL - could not base64 decode: ${tokenDateString}`);\n    return null;\n  }\n  try {\n    tokenData = JSON.parse(tokenDataJSON);\n  } catch {\n    debug(`getCheckedSignedTokenData(): FAIL - could not parse JSON: ${tokenDataJSON}`);\n    return null;\n  }\n  debug(`getCheckedSignedTokenData(): tokenData = ${tokenData}`);\n  return tokenData;\n}\n\nexport function checkSignedToken(\n  token: string,\n  data: any,\n  secretKey: string,\n  options: CheckOptions = {},\n) {\n  debug(`checkSignedToken(): token = ${token}`);\n  debug(`checkSignedToken(): data = ${JSON.stringify(data)}`);\n  debug(`checkSignedToken(): secretKey = ${secretKey}`);\n  debug(`checkSignedToken(): options = ${JSON.stringify(options)}`);\n  debug(`checkSignedToken(): data = ${JSON.stringify(data)}`);\n  const tokenData = getCheckedSignedTokenData(token, secretKey, options);\n  debug(`checkSignedToken(): tokenData = ${JSON.stringify(tokenData)}`);\n  if (tokenData == null) return false;\n  if (!isEqual(data, tokenData)) return false;\n  return true;\n}\n\n/**\n * Generates a CSRF token that is valid for a URL prefix instead of an exact URL.\n * This is useful for tRPC and similar APIs where a single token should be valid\n * for all sub-routes under a prefix (e.g., `/foo/bar/trpc` is valid for\n * `/foo/bar/trpc/getUser` and `/foo/bar/trpc/updateUser`).\n */\nexport function generatePrefixCsrfToken(\n  data: { url: string; authn_user_id: string },\n  secretKey: string,\n) {\n  return generateSignedToken({ ...data, type: 'prefix' }, secretKey);\n}\n\n/**\n * Validates a prefix-based CSRF token. The token's URL must be a prefix of the\n * request URL for validation to succeed.\n *\n * @param token - The CSRF token to validate\n * @param requestData - The request URL and authenticated user ID\n * @param requestData.url - The request URL to validate against\n * @param requestData.authn_user_id - The authenticated user ID to validate against\n * @param secretKey - The secret key used for signing\n * @param options - Optional settings like maxAge\n * @returns true if the token is valid, false otherwise\n */\nexport function checkSignedTokenPrefix(\n  token: string,\n  requestData: { url: string; authn_user_id: string },\n  secretKey: string,\n  options: CheckOptions = {},\n): boolean {\n  debug(`checkSignedTokenPrefix(): token = ${token}`);\n  debug(`checkSignedTokenPrefix(): requestData = ${JSON.stringify(requestData)}`);\n\n  const tokenData = getCheckedSignedTokenData(token, secretKey, options);\n  if (tokenData == null) return false;\n\n  // Verify this is a prefix token (prevents token type confusion)\n  if (tokenData.type !== 'prefix') {\n    debug('checkSignedTokenPrefix(): FAIL - token type is not prefix');\n    return false;\n  }\n\n  // Verify user ID matches exactly\n  if (tokenData.authn_user_id !== requestData.authn_user_id) {\n    debug('checkSignedTokenPrefix(): FAIL - authn_user_id mismatch');\n    return false;\n  }\n\n  // Verify the request URL starts with the token's prefix URL.\n  // We treat the prefix as implicitly ending with a trailing slash, so\n  // `/test` matches `/test`, `/test/`, and `/test/nested`, but NOT `/testy`.\n  const prefixUrl = tokenData.url;\n  const requestUrl = requestData.url;\n  const normalizedPrefix = prefixUrl.endsWith('/') ? prefixUrl : prefixUrl + '/';\n  if (requestUrl !== prefixUrl && !requestUrl.startsWith(normalizedPrefix)) {\n    debug(\n      `checkSignedTokenPrefix(): FAIL - URL prefix mismatch: ${requestUrl} does not start with ${prefixUrl}`,\n    );\n    return false;\n  }\n\n  debug('checkSignedTokenPrefix(): SUCCESS');\n  return true;\n}\n"]}

package/dist/index.js

@@ -1,7 +1,7 @@
 import crypto from 'node:crypto';
 import base64url from 'base64url';
 import debugfn from 'debug';
-import _ from 'lodash';
+import { isEqual } from 'es-toolkit';
 const debug = debugfn('prairielearn:csrf');
 const sep = '.';
 export function generateSignedToken(data, secretKey) {
@@ -94,8 +94,58 @@ export function checkSignedToken(token, data, secretKey, options = {}) {
     debug(`checkSignedToken(): tokenData = ${JSON.stringify(tokenData)}`);
     if (tokenData == null)
         return false;
-    if (!_.isEqual(data, tokenData))
+    if (!isEqual(data, tokenData))
         return false;
     return true;
 }
+/**
+ * Generates a CSRF token that is valid for a URL prefix instead of an exact URL.
+ * This is useful for tRPC and similar APIs where a single token should be valid
+ * for all sub-routes under a prefix (e.g., `/foo/bar/trpc` is valid for
+ * `/foo/bar/trpc/getUser` and `/foo/bar/trpc/updateUser`).
+ */
+export function generatePrefixCsrfToken(data, secretKey) {
+    return generateSignedToken({ ...data, type: 'prefix' }, secretKey);
+}
+/**
+ * Validates a prefix-based CSRF token. The token's URL must be a prefix of the
+ * request URL for validation to succeed.
+ *
+ * @param token - The CSRF token to validate
+ * @param requestData - The request URL and authenticated user ID
+ * @param requestData.url - The request URL to validate against
+ * @param requestData.authn_user_id - The authenticated user ID to validate against
+ * @param secretKey - The secret key used for signing
+ * @param options - Optional settings like maxAge
+ * @returns true if the token is valid, false otherwise
+ */
+export function checkSignedTokenPrefix(token, requestData, secretKey, options = {}) {
+    debug(`checkSignedTokenPrefix(): token = ${token}`);
+    debug(`checkSignedTokenPrefix(): requestData = ${JSON.stringify(requestData)}`);
+    const tokenData = getCheckedSignedTokenData(token, secretKey, options);
+    if (tokenData == null)
+        return false;
+    // Verify this is a prefix token (prevents token type confusion)
+    if (tokenData.type !== 'prefix') {
+        debug('checkSignedTokenPrefix(): FAIL - token type is not prefix');
+        return false;
+    }
+    // Verify user ID matches exactly
+    if (tokenData.authn_user_id !== requestData.authn_user_id) {
+        debug('checkSignedTokenPrefix(): FAIL - authn_user_id mismatch');
+        return false;
+    }
+    // Verify the request URL starts with the token's prefix URL.
+    // We treat the prefix as implicitly ending with a trailing slash, so
+    // `/test` matches `/test`, `/test/`, and `/test/nested`, but NOT `/testy`.
+    const prefixUrl = tokenData.url;
+    const requestUrl = requestData.url;
+    const normalizedPrefix = prefixUrl.endsWith('/') ? prefixUrl : prefixUrl + '/';
+    if (requestUrl !== prefixUrl && !requestUrl.startsWith(normalizedPrefix)) {
+        debug(`checkSignedTokenPrefix(): FAIL - URL prefix mismatch: ${requestUrl} does not start with ${prefixUrl}`);
+        return false;
+    }
+    debug('checkSignedTokenPrefix(): SUCCESS');
+    return true;
+}
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,OAAO,MAAM,OAAO,CAAC;AAC5B,OAAO,CAAC,MAAM,QAAQ,CAAC;AAEvB,MAAM,KAAK,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC3C,MAAM,GAAG,GAAG,GAAG,CAAC;AAMhB,MAAM,UAAU,mBAAmB,CAAC,IAAS,EAAE,SAAiB,EAAE;IAChE,KAAK,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,KAAK,CAAC,sCAAsC,SAAS,EAAE,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,UAAU,GAAG,GAAG,GAAG,UAAU,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3F,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7D,KAAK,CACH,0BAA0B,IAAI,CAAC,SAAS,CAAC;QACvC,UAAU;QACV,UAAU;QACV,WAAW;QACX,gBAAgB;KACjB,CAAC,EAAE,CACL,CAAC;IACF,MAAM,KAAK,GAAG,gBAAgB,GAAG,GAAG,GAAG,WAAW,CAAC;IACnD,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AAAA,CACd;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAa,EACb,SAAiB,EACjB,OAAO,GAAiB,EAAE,EAC1B;IACA,KAAK,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC;IACvD,KAAK,CAAC,4CAA4C,SAAS,EAAE,CAAC,CAAC;IAC/D,KAAK,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8CAA8C;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAEjC,sBAAsB;IACtB,MAAM,WAAW,GAAG,eAAe,GAAG,GAAG,GAAG,eAAe,CAAC;IAC5D,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChG,MAAM,qBAAqB,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACvE,IAAI,qBAAqB,KAAK,cAAc,EAAE,CAAC;QAC7C,KAAK,CACH,oEAAoE,qBAAqB,gBAAgB,cAAc,EAAE,CAC1H,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gDAAgD;IAChD,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,SAAS,CAAC;QACd,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,6DAA6D,eAAe,EAAE,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;QACtD,IAAI,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACjC,KAAK,CACH,4DAA4D,WAAW,aAAa,OAAO,CAAC,MAAM,EAAE,CACrG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,eAAe;IACf,IAAI,aAAa,EAAE,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,gEAAgE,eAAe,EAAE,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,6DAA6D,aAAa,EAAE,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,4CAA4C,SAAS,EAAE,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC;AAAA,CAClB;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,IAAS,EACT,SAAiB,EACjB,OAAO,GAAiB,EAAE,EAC1B;IACA,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,KAAK,CAAC,mCAAmC,SAAS,EAAE,CAAC,CAAC;IACtD,KAAK,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClE,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACvE,KAAK,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACtE,IAAI,SAAS,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,IAAI,CAAC;AAAA,CACb","sourcesContent":["import crypto from 'node:crypto';\n\nimport base64url from 'base64url';\nimport debugfn from 'debug';\nimport _ from 'lodash';\n\nconst debug = debugfn('prairielearn:csrf');\nconst sep = '.';\n\ninterface CheckOptions {\n  maxAge?: number;\n}\n\nexport function generateSignedToken(data: any, secretKey: string) {\n  debug(`generateSignedToken(): data = ${JSON.stringify(data)}`);\n  debug(`generateSignedToken(): secretKey = ${secretKey}`);\n  const dataJSON = JSON.stringify(data);\n  const dataString = base64url.default.encode(dataJSON);\n  const dateString = Date.now().toString(36);\n  const checkString = dateString + sep + dataString;\n  const signature = crypto.createHmac('sha256', secretKey).update(checkString).digest('hex');\n  const encodedSignature = base64url.default.encode(signature);\n  debug(\n    `generateSignedToken(): ${JSON.stringify({\n      dataString,\n      dateString,\n      checkString,\n      encodedSignature,\n    })}`,\n  );\n  const token = encodedSignature + sep + checkString;\n  debug(`generateSignedToken(): token = ${token}`);\n  return token;\n}\n\nexport function getCheckedSignedTokenData(\n  token: string,\n  secretKey: string,\n  options: CheckOptions = {},\n) {\n  debug(`getCheckedSignedTokenData(): token = ${token}`);\n  debug(`getCheckedSignedTokenData(): secretKey = ${secretKey}`);\n  debug(`getCheckedSignedTokenData(): options = ${JSON.stringify(options)}`);\n  if (typeof token !== 'string') {\n    debug('getCheckedSignedTokenData(): FAIL - token is not string');\n    return null;\n  }\n\n  // break token apart into the three components\n  const match = token.split(sep);\n  if (match == null) {\n    debug('getCheckedSignedTokenData(): FAIL - could not split token');\n    return null;\n  }\n  const tokenSignature = match[0];\n  const tokenDateString = match[1];\n  const tokenDataString = match[2];\n\n  // check the signature\n  const checkString = tokenDateString + sep + tokenDataString;\n  const checkSignature = crypto.createHmac('sha256', secretKey).update(checkString).digest('hex');\n  const encodedCheckSignature = base64url.default.encode(checkSignature);\n  if (encodedCheckSignature !== tokenSignature) {\n    debug(\n      `getCheckedSignedTokenData(): FAIL - signature mismatch: checkSig=${encodedCheckSignature} != tokenSig=${tokenSignature}`,\n    );\n    return null;\n  }\n\n  // check the age if we have the maxAge parameter\n  if (options.maxAge != null) {\n    let tokenDate;\n    try {\n      tokenDate = new Date(Number.parseInt(tokenDateString, 36));\n    } catch {\n      debug(`getCheckedSignedTokenData(): FAIL - could not parse date: ${tokenDateString}`);\n      return null;\n    }\n    const currentTime = Date.now();\n    const elapsedTime = currentTime - tokenDate.getTime();\n    if (elapsedTime > options.maxAge) {\n      debug(\n        `getCheckedSignedTokenData(): FAIL - too old: elapsedTime=${elapsedTime} > maxAge=${options.maxAge}`,\n      );\n      return null;\n    }\n  }\n\n  // get the data\n  let tokenDataJSON, tokenData;\n  try {\n    tokenDataJSON = base64url.default.decode(tokenDataString);\n  } catch {\n    debug(`getCheckedSignedTokenData(): FAIL - could not base64 decode: ${tokenDateString}`);\n    return null;\n  }\n  try {\n    tokenData = JSON.parse(tokenDataJSON);\n  } catch {\n    debug(`getCheckedSignedTokenData(): FAIL - could not parse JSON: ${tokenDataJSON}`);\n    return null;\n  }\n  debug(`getCheckedSignedTokenData(): tokenData = ${tokenData}`);\n  return tokenData;\n}\n\nexport function checkSignedToken(\n  token: string,\n  data: any,\n  secretKey: string,\n  options: CheckOptions = {},\n) {\n  debug(`checkSignedToken(): token = ${token}`);\n  debug(`checkSignedToken(): data = ${JSON.stringify(data)}`);\n  debug(`checkSignedToken(): secretKey = ${secretKey}`);\n  debug(`checkSignedToken(): options = ${JSON.stringify(options)}`);\n  debug(`checkSignedToken(): data = ${JSON.stringify(data)}`);\n  const tokenData = getCheckedSignedTokenData(token, secretKey, options);\n  debug(`checkSignedToken(): tokenData = ${JSON.stringify(tokenData)}`);\n  if (tokenData == null) return false;\n  if (!_.isEqual(data, tokenData)) return false;\n  return true;\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,OAAO,MAAM,OAAO,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,MAAM,KAAK,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC3C,MAAM,GAAG,GAAG,GAAG,CAAC;AAMhB,MAAM,UAAU,mBAAmB,CAAC,IAAS,EAAE,SAAiB,EAAE;IAChE,KAAK,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,KAAK,CAAC,sCAAsC,SAAS,EAAE,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,UAAU,GAAG,GAAG,GAAG,UAAU,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3F,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7D,KAAK,CACH,0BAA0B,IAAI,CAAC,SAAS,CAAC;QACvC,UAAU;QACV,UAAU;QACV,WAAW;QACX,gBAAgB;KACjB,CAAC,EAAE,CACL,CAAC;IACF,MAAM,KAAK,GAAG,gBAAgB,GAAG,GAAG,GAAG,WAAW,CAAC;IACnD,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AAAA,CACd;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAa,EACb,SAAiB,EACjB,OAAO,GAAiB,EAAE,EAC1B;IACA,KAAK,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC;IACvD,KAAK,CAAC,4CAA4C,SAAS,EAAE,CAAC,CAAC;IAC/D,KAAK,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8CAA8C;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAEjC,sBAAsB;IACtB,MAAM,WAAW,GAAG,eAAe,GAAG,GAAG,GAAG,eAAe,CAAC;IAC5D,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChG,MAAM,qBAAqB,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACvE,IAAI,qBAAqB,KAAK,cAAc,EAAE,CAAC;QAC7C,KAAK,CACH,oEAAoE,qBAAqB,gBAAgB,cAAc,EAAE,CAC1H,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gDAAgD;IAChD,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,SAAS,CAAC;QACd,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,6DAA6D,eAAe,EAAE,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;QACtD,IAAI,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACjC,KAAK,CACH,4DAA4D,WAAW,aAAa,OAAO,CAAC,MAAM,EAAE,CACrG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,eAAe;IACf,IAAI,aAAa,EAAE,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,gEAAgE,eAAe,EAAE,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,6DAA6D,aAAa,EAAE,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,4CAA4C,SAAS,EAAE,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC;AAAA,CAClB;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,IAAS,EACT,SAAiB,EACjB,OAAO,GAAiB,EAAE,EAC1B;IACA,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,KAAK,CAAC,mCAAmC,SAAS,EAAE,CAAC,CAAC;IACtD,KAAK,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClE,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACvE,KAAK,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACtE,IAAI,SAAS,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,IAAI,CAAC;AAAA,CACb;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAA4C,EAC5C,SAAiB,EACjB;IACA,OAAO,mBAAmB,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC;AAAA,CACpE;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAa,EACb,WAAmD,EACnD,SAAiB,EACjB,OAAO,GAAiB,EAAE,EACjB;IACT,KAAK,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;IACpD,KAAK,CAAC,2CAA2C,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAEhF,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,SAAS,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAEpC,gEAAgE;IAChE,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iCAAiC;IACjC,IAAI,SAAS,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;QAC1D,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6DAA6D;IAC7D,qEAAqE;IACrE,2EAA2E;IAC3E,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC;IAChC,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC;IACnC,MAAM,gBAAgB,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;IAC/E,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzE,KAAK,CACH,yDAAyD,UAAU,wBAAwB,SAAS,EAAE,CACvG,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC;AAAA,CACb","sourcesContent":["import crypto from 'node:crypto';\n\nimport base64url from 'base64url';\nimport debugfn from 'debug';\nimport { isEqual } from 'es-toolkit';\n\nconst debug = debugfn('prairielearn:csrf');\nconst sep = '.';\n\ninterface CheckOptions {\n  maxAge?: number;\n}\n\nexport function generateSignedToken(data: any, secretKey: string) {\n  debug(`generateSignedToken(): data = ${JSON.stringify(data)}`);\n  debug(`generateSignedToken(): secretKey = ${secretKey}`);\n  const dataJSON = JSON.stringify(data);\n  const dataString = base64url.default.encode(dataJSON);\n  const dateString = Date.now().toString(36);\n  const checkString = dateString + sep + dataString;\n  const signature = crypto.createHmac('sha256', secretKey).update(checkString).digest('hex');\n  const encodedSignature = base64url.default.encode(signature);\n  debug(\n    `generateSignedToken(): ${JSON.stringify({\n      dataString,\n      dateString,\n      checkString,\n      encodedSignature,\n    })}`,\n  );\n  const token = encodedSignature + sep + checkString;\n  debug(`generateSignedToken(): token = ${token}`);\n  return token;\n}\n\nexport function getCheckedSignedTokenData(\n  token: string,\n  secretKey: string,\n  options: CheckOptions = {},\n) {\n  debug(`getCheckedSignedTokenData(): token = ${token}`);\n  debug(`getCheckedSignedTokenData(): secretKey = ${secretKey}`);\n  debug(`getCheckedSignedTokenData(): options = ${JSON.stringify(options)}`);\n  if (typeof token !== 'string') {\n    debug('getCheckedSignedTokenData(): FAIL - token is not string');\n    return null;\n  }\n\n  // break token apart into the three components\n  const match = token.split(sep);\n  if (match == null) {\n    debug('getCheckedSignedTokenData(): FAIL - could not split token');\n    return null;\n  }\n  const tokenSignature = match[0];\n  const tokenDateString = match[1];\n  const tokenDataString = match[2];\n\n  // check the signature\n  const checkString = tokenDateString + sep + tokenDataString;\n  const checkSignature = crypto.createHmac('sha256', secretKey).update(checkString).digest('hex');\n  const encodedCheckSignature = base64url.default.encode(checkSignature);\n  if (encodedCheckSignature !== tokenSignature) {\n    debug(\n      `getCheckedSignedTokenData(): FAIL - signature mismatch: checkSig=${encodedCheckSignature} != tokenSig=${tokenSignature}`,\n    );\n    return null;\n  }\n\n  // check the age if we have the maxAge parameter\n  if (options.maxAge != null) {\n    let tokenDate;\n    try {\n      tokenDate = new Date(Number.parseInt(tokenDateString, 36));\n    } catch {\n      debug(`getCheckedSignedTokenData(): FAIL - could not parse date: ${tokenDateString}`);\n      return null;\n    }\n    const currentTime = Date.now();\n    const elapsedTime = currentTime - tokenDate.getTime();\n    if (elapsedTime > options.maxAge) {\n      debug(\n        `getCheckedSignedTokenData(): FAIL - too old: elapsedTime=${elapsedTime} > maxAge=${options.maxAge}`,\n      );\n      return null;\n    }\n  }\n\n  // get the data\n  let tokenDataJSON, tokenData;\n  try {\n    tokenDataJSON = base64url.default.decode(tokenDataString);\n  } catch {\n    debug(`getCheckedSignedTokenData(): FAIL - could not base64 decode: ${tokenDateString}`);\n    return null;\n  }\n  try {\n    tokenData = JSON.parse(tokenDataJSON);\n  } catch {\n    debug(`getCheckedSignedTokenData(): FAIL - could not parse JSON: ${tokenDataJSON}`);\n    return null;\n  }\n  debug(`getCheckedSignedTokenData(): tokenData = ${tokenData}`);\n  return tokenData;\n}\n\nexport function checkSignedToken(\n  token: string,\n  data: any,\n  secretKey: string,\n  options: CheckOptions = {},\n) {\n  debug(`checkSignedToken(): token = ${token}`);\n  debug(`checkSignedToken(): data = ${JSON.stringify(data)}`);\n  debug(`checkSignedToken(): secretKey = ${secretKey}`);\n  debug(`checkSignedToken(): options = ${JSON.stringify(options)}`);\n  debug(`checkSignedToken(): data = ${JSON.stringify(data)}`);\n  const tokenData = getCheckedSignedTokenData(token, secretKey, options);\n  debug(`checkSignedToken(): tokenData = ${JSON.stringify(tokenData)}`);\n  if (tokenData == null) return false;\n  if (!isEqual(data, tokenData)) return false;\n  return true;\n}\n\n/**\n * Generates a CSRF token that is valid for a URL prefix instead of an exact URL.\n * This is useful for tRPC and similar APIs where a single token should be valid\n * for all sub-routes under a prefix (e.g., `/foo/bar/trpc` is valid for\n * `/foo/bar/trpc/getUser` and `/foo/bar/trpc/updateUser`).\n */\nexport function generatePrefixCsrfToken(\n  data: { url: string; authn_user_id: string },\n  secretKey: string,\n) {\n  return generateSignedToken({ ...data, type: 'prefix' }, secretKey);\n}\n\n/**\n * Validates a prefix-based CSRF token. The token's URL must be a prefix of the\n * request URL for validation to succeed.\n *\n * @param token - The CSRF token to validate\n * @param requestData - The request URL and authenticated user ID\n * @param requestData.url - The request URL to validate against\n * @param requestData.authn_user_id - The authenticated user ID to validate against\n * @param secretKey - The secret key used for signing\n * @param options - Optional settings like maxAge\n * @returns true if the token is valid, false otherwise\n */\nexport function checkSignedTokenPrefix(\n  token: string,\n  requestData: { url: string; authn_user_id: string },\n  secretKey: string,\n  options: CheckOptions = {},\n): boolean {\n  debug(`checkSignedTokenPrefix(): token = ${token}`);\n  debug(`checkSignedTokenPrefix(): requestData = ${JSON.stringify(requestData)}`);\n\n  const tokenData = getCheckedSignedTokenData(token, secretKey, options);\n  if (tokenData == null) return false;\n\n  // Verify this is a prefix token (prevents token type confusion)\n  if (tokenData.type !== 'prefix') {\n    debug('checkSignedTokenPrefix(): FAIL - token type is not prefix');\n    return false;\n  }\n\n  // Verify user ID matches exactly\n  if (tokenData.authn_user_id !== requestData.authn_user_id) {\n    debug('checkSignedTokenPrefix(): FAIL - authn_user_id mismatch');\n    return false;\n  }\n\n  // Verify the request URL starts with the token's prefix URL.\n  // We treat the prefix as implicitly ending with a trailing slash, so\n  // `/test` matches `/test`, `/test/`, and `/test/nested`, but NOT `/testy`.\n  const prefixUrl = tokenData.url;\n  const requestUrl = requestData.url;\n  const normalizedPrefix = prefixUrl.endsWith('/') ? prefixUrl : prefixUrl + '/';\n  if (requestUrl !== prefixUrl && !requestUrl.startsWith(normalizedPrefix)) {\n    debug(\n      `checkSignedTokenPrefix(): FAIL - URL prefix mismatch: ${requestUrl} does not start with ${prefixUrl}`,\n    );\n    return false;\n  }\n\n  debug('checkSignedTokenPrefix(): SUCCESS');\n  return true;\n}\n"]}

package/dist/index.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.test.d.ts.map

package/dist/index.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":"","sourcesContent":["import { assert, describe, it } from 'vitest';\n\nimport {\n  checkSignedToken,\n  checkSignedTokenPrefix,\n  generatePrefixCsrfToken,\n  generateSignedToken,\n  getCheckedSignedTokenData,\n} from './index.js';\n\nconst SECRET_KEY = 'test-secret-key';\nconst TEST_DATA = { url: '/test', authn_user_id: '123' };\n\ndescribe('generateSignedToken', () => {\n  it('generates a token that can be validated', () => {\n    const token = generateSignedToken(TEST_DATA, SECRET_KEY);\n\n    assert.isString(token);\n    assert.isTrue(checkSignedToken(token, TEST_DATA, SECRET_KEY));\n  });\n\n  it('fails validation with wrong data', () => {\n    const token = generateSignedToken(TEST_DATA, SECRET_KEY);\n\n    assert.isFalse(checkSignedToken(token, { url: '/other', authn_user_id: '123' }, SECRET_KEY));\n  });\n\n  it('fails validation with wrong secret key', () => {\n    const token = generateSignedToken(TEST_DATA, SECRET_KEY);\n\n    assert.isFalse(checkSignedToken(token, TEST_DATA, 'wrong-secret'));\n  });\n});\n\ndescribe('getCheckedSignedTokenData', () => {\n  it('returns null for invalid tokens', () => {\n    assert.isNull(getCheckedSignedTokenData('invalid', SECRET_KEY));\n    assert.isNull(getCheckedSignedTokenData('', SECRET_KEY));\n    assert.isNull(getCheckedSignedTokenData(123 as any, SECRET_KEY));\n  });\n\n  it('returns token data for valid tokens', () => {\n    const token = generateSignedToken(TEST_DATA, SECRET_KEY);\n\n    const result = getCheckedSignedTokenData(token, SECRET_KEY);\n    assert.deepEqual(result, TEST_DATA);\n  });\n});\n\ndescribe('generatePrefixCsrfToken', () => {\n  it('generates a token with type prefix', () => {\n    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);\n\n    const tokenData = getCheckedSignedTokenData(token, SECRET_KEY);\n    assert.equal(tokenData.type, 'prefix');\n    assert.equal(tokenData.url, TEST_DATA.url);\n    assert.equal(tokenData.authn_user_id, TEST_DATA.authn_user_id);\n  });\n});\n\ndescribe('checkSignedTokenPrefix', () => {\n  it('validates token when request URL matches prefix exactly', () => {\n    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);\n\n    assert.isTrue(checkSignedTokenPrefix(token, TEST_DATA, SECRET_KEY));\n  });\n\n  it('validates token when request URL starts with prefix', () => {\n    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);\n\n    // We allow the route itself, both with and without a trailing slash.\n    assert.isTrue(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/test' }, SECRET_KEY));\n    assert.isTrue(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/test/' }, SECRET_KEY));\n\n    // We allow deeply nested routes as well.\n    assert.isTrue(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/test/nested' }, SECRET_KEY));\n    assert.isTrue(\n      checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/test/nested/method' }, SECRET_KEY),\n    );\n  });\n\n  it('rejects token when request URL does not start with prefix', () => {\n    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);\n\n    assert.isFalse(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/other/path' }, SECRET_KEY));\n\n    // We'll forbid paths that match the prefix only partially. In other words,\n    // we'll treat the prefix as if it implicitly ends with a trailing slash.\n    assert.isFalse(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/testy' }, SECRET_KEY));\n  });\n\n  it('rejects token when user ID does not match', () => {\n    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);\n\n    assert.isFalse(\n      checkSignedTokenPrefix(token, { ...TEST_DATA, authn_user_id: '456' }, SECRET_KEY),\n    );\n  });\n\n  it('rejects non-prefix tokens', () => {\n    // Generate a regular token (not a prefix token)\n    const regularToken = generateSignedToken(TEST_DATA, SECRET_KEY);\n\n    // Should fail because it doesn't have type: 'prefix'\n    assert.isFalse(checkSignedTokenPrefix(regularToken, TEST_DATA, SECRET_KEY));\n  });\n\n  it('rejects tampered tokens', () => {\n    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);\n\n    // Tamper with the token\n    const tamperedToken = token.slice(0, -5) + 'XXXXX';\n    assert.isFalse(checkSignedTokenPrefix(tamperedToken, TEST_DATA, SECRET_KEY));\n  });\n\n  it('rejects tokens with wrong secret key', () => {\n    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);\n\n    assert.isFalse(checkSignedTokenPrefix(token, TEST_DATA, 'wrong-secret'));\n  });\n\n  it('rejects invalid token formats', () => {\n    assert.isFalse(checkSignedTokenPrefix('invalid', TEST_DATA, SECRET_KEY));\n    assert.isFalse(checkSignedTokenPrefix('', TEST_DATA, SECRET_KEY));\n  });\n});\n"]}

package/dist/index.test.js

@@ -0,0 +1,87 @@
+import { assert, describe, it } from 'vitest';
+import { checkSignedToken, checkSignedTokenPrefix, generatePrefixCsrfToken, generateSignedToken, getCheckedSignedTokenData, } from './index.js';
+const SECRET_KEY = 'test-secret-key';
+const TEST_DATA = { url: '/test', authn_user_id: '123' };
+describe('generateSignedToken', () => {
+    it('generates a token that can be validated', () => {
+        const token = generateSignedToken(TEST_DATA, SECRET_KEY);
+        assert.isString(token);
+        assert.isTrue(checkSignedToken(token, TEST_DATA, SECRET_KEY));
+    });
+    it('fails validation with wrong data', () => {
+        const token = generateSignedToken(TEST_DATA, SECRET_KEY);
+        assert.isFalse(checkSignedToken(token, { url: '/other', authn_user_id: '123' }, SECRET_KEY));
+    });
+    it('fails validation with wrong secret key', () => {
+        const token = generateSignedToken(TEST_DATA, SECRET_KEY);
+        assert.isFalse(checkSignedToken(token, TEST_DATA, 'wrong-secret'));
+    });
+});
+describe('getCheckedSignedTokenData', () => {
+    it('returns null for invalid tokens', () => {
+        assert.isNull(getCheckedSignedTokenData('invalid', SECRET_KEY));
+        assert.isNull(getCheckedSignedTokenData('', SECRET_KEY));
+        assert.isNull(getCheckedSignedTokenData(123, SECRET_KEY));
+    });
+    it('returns token data for valid tokens', () => {
+        const token = generateSignedToken(TEST_DATA, SECRET_KEY);
+        const result = getCheckedSignedTokenData(token, SECRET_KEY);
+        assert.deepEqual(result, TEST_DATA);
+    });
+});
+describe('generatePrefixCsrfToken', () => {
+    it('generates a token with type prefix', () => {
+        const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);
+        const tokenData = getCheckedSignedTokenData(token, SECRET_KEY);
+        assert.equal(tokenData.type, 'prefix');
+        assert.equal(tokenData.url, TEST_DATA.url);
+        assert.equal(tokenData.authn_user_id, TEST_DATA.authn_user_id);
+    });
+});
+describe('checkSignedTokenPrefix', () => {
+    it('validates token when request URL matches prefix exactly', () => {
+        const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);
+        assert.isTrue(checkSignedTokenPrefix(token, TEST_DATA, SECRET_KEY));
+    });
+    it('validates token when request URL starts with prefix', () => {
+        const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);
+        // We allow the route itself, both with and without a trailing slash.
+        assert.isTrue(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/test' }, SECRET_KEY));
+        assert.isTrue(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/test/' }, SECRET_KEY));
+        // We allow deeply nested routes as well.
+        assert.isTrue(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/test/nested' }, SECRET_KEY));
+        assert.isTrue(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/test/nested/method' }, SECRET_KEY));
+    });
+    it('rejects token when request URL does not start with prefix', () => {
+        const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);
+        assert.isFalse(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/other/path' }, SECRET_KEY));
+        // We'll forbid paths that match the prefix only partially. In other words,
+        // we'll treat the prefix as if it implicitly ends with a trailing slash.
+        assert.isFalse(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/testy' }, SECRET_KEY));
+    });
+    it('rejects token when user ID does not match', () => {
+        const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);
+        assert.isFalse(checkSignedTokenPrefix(token, { ...TEST_DATA, authn_user_id: '456' }, SECRET_KEY));
+    });
+    it('rejects non-prefix tokens', () => {
+        // Generate a regular token (not a prefix token)
+        const regularToken = generateSignedToken(TEST_DATA, SECRET_KEY);
+        // Should fail because it doesn't have type: 'prefix'
+        assert.isFalse(checkSignedTokenPrefix(regularToken, TEST_DATA, SECRET_KEY));
+    });
+    it('rejects tampered tokens', () => {
+        const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);
+        // Tamper with the token
+        const tamperedToken = token.slice(0, -5) + 'XXXXX';
+        assert.isFalse(checkSignedTokenPrefix(tamperedToken, TEST_DATA, SECRET_KEY));
+    });
+    it('rejects tokens with wrong secret key', () => {
+        const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);
+        assert.isFalse(checkSignedTokenPrefix(token, TEST_DATA, 'wrong-secret'));
+    });
+    it('rejects invalid token formats', () => {
+        assert.isFalse(checkSignedTokenPrefix('invalid', TEST_DATA, SECRET_KEY));
+        assert.isFalse(checkSignedTokenPrefix('', TEST_DATA, SECRET_KEY));
+    });
+});
+//# sourceMappingURL=index.test.js.map

package/dist/index.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AAEpB,MAAM,UAAU,GAAG,iBAAiB,CAAC;AACrC,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAEzD,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC;IACpC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAEzD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvB,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAAA,CAC/D,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAEzD,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IAAA,CAC9F,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAEzD,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;IAAA,CACpE,CAAC,CAAC;AAAA,CACJ,CAAC,CAAC;AAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC;IAC1C,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,GAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IAAA,CAClE,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAEzD,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5D,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAAA,CACrC,CAAC,CAAC;AAAA,CACJ,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC;IACxC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAE7D,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;IAAA,CAChE,CAAC,CAAC;AAAA,CACJ,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAAC;IACvC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAE7D,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAAA,CACrE,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAE7D,qEAAqE;QACrE,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAE1F,yCAAyC;QACzC,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAChG,MAAM,CAAC,MAAM,CACX,sBAAsB,CAAC,KAAK,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE,UAAU,CAAC,CACxF,CAAC;IAAA,CACH,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAE7D,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAEhG,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IAAA,CAC5F,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAE7D,MAAM,CAAC,OAAO,CACZ,sBAAsB,CAAC,KAAK,EAAE,EAAE,GAAG,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAClF,CAAC;IAAA,CACH,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC;QACpC,gDAAgD;QAChD,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAEhE,qDAAqD;QACrD,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAAA,CAC7E,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAE7D,wBAAwB;QACxB,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAAA,CAC9E,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAE7D,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;IAAA,CAC1E,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAAA,CACnE,CAAC,CAAC;AAAA,CACJ,CAAC,CAAC","sourcesContent":["import { assert, describe, it } from 'vitest';\n\nimport {\n  checkSignedToken,\n  checkSignedTokenPrefix,\n  generatePrefixCsrfToken,\n  generateSignedToken,\n  getCheckedSignedTokenData,\n} from './index.js';\n\nconst SECRET_KEY = 'test-secret-key';\nconst TEST_DATA = { url: '/test', authn_user_id: '123' };\n\ndescribe('generateSignedToken', () => {\n  it('generates a token that can be validated', () => {\n    const token = generateSignedToken(TEST_DATA, SECRET_KEY);\n\n    assert.isString(token);\n    assert.isTrue(checkSignedToken(token, TEST_DATA, SECRET_KEY));\n  });\n\n  it('fails validation with wrong data', () => {\n    const token = generateSignedToken(TEST_DATA, SECRET_KEY);\n\n    assert.isFalse(checkSignedToken(token, { url: '/other', authn_user_id: '123' }, SECRET_KEY));\n  });\n\n  it('fails validation with wrong secret key', () => {\n    const token = generateSignedToken(TEST_DATA, SECRET_KEY);\n\n    assert.isFalse(checkSignedToken(token, TEST_DATA, 'wrong-secret'));\n  });\n});\n\ndescribe('getCheckedSignedTokenData', () => {\n  it('returns null for invalid tokens', () => {\n    assert.isNull(getCheckedSignedTokenData('invalid', SECRET_KEY));\n    assert.isNull(getCheckedSignedTokenData('', SECRET_KEY));\n    assert.isNull(getCheckedSignedTokenData(123 as any, SECRET_KEY));\n  });\n\n  it('returns token data for valid tokens', () => {\n    const token = generateSignedToken(TEST_DATA, SECRET_KEY);\n\n    const result = getCheckedSignedTokenData(token, SECRET_KEY);\n    assert.deepEqual(result, TEST_DATA);\n  });\n});\n\ndescribe('generatePrefixCsrfToken', () => {\n  it('generates a token with type prefix', () => {\n    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);\n\n    const tokenData = getCheckedSignedTokenData(token, SECRET_KEY);\n    assert.equal(tokenData.type, 'prefix');\n    assert.equal(tokenData.url, TEST_DATA.url);\n    assert.equal(tokenData.authn_user_id, TEST_DATA.authn_user_id);\n  });\n});\n\ndescribe('checkSignedTokenPrefix', () => {\n  it('validates token when request URL matches prefix exactly', () => {\n    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);\n\n    assert.isTrue(checkSignedTokenPrefix(token, TEST_DATA, SECRET_KEY));\n  });\n\n  it('validates token when request URL starts with prefix', () => {\n    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);\n\n    // We allow the route itself, both with and without a trailing slash.\n    assert.isTrue(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/test' }, SECRET_KEY));\n    assert.isTrue(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/test/' }, SECRET_KEY));\n\n    // We allow deeply nested routes as well.\n    assert.isTrue(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/test/nested' }, SECRET_KEY));\n    assert.isTrue(\n      checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/test/nested/method' }, SECRET_KEY),\n    );\n  });\n\n  it('rejects token when request URL does not start with prefix', () => {\n    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);\n\n    assert.isFalse(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/other/path' }, SECRET_KEY));\n\n    // We'll forbid paths that match the prefix only partially. In other words,\n    // we'll treat the prefix as if it implicitly ends with a trailing slash.\n    assert.isFalse(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/testy' }, SECRET_KEY));\n  });\n\n  it('rejects token when user ID does not match', () => {\n    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);\n\n    assert.isFalse(\n      checkSignedTokenPrefix(token, { ...TEST_DATA, authn_user_id: '456' }, SECRET_KEY),\n    );\n  });\n\n  it('rejects non-prefix tokens', () => {\n    // Generate a regular token (not a prefix token)\n    const regularToken = generateSignedToken(TEST_DATA, SECRET_KEY);\n\n    // Should fail because it doesn't have type: 'prefix'\n    assert.isFalse(checkSignedTokenPrefix(regularToken, TEST_DATA, SECRET_KEY));\n  });\n\n  it('rejects tampered tokens', () => {\n    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);\n\n    // Tamper with the token\n    const tamperedToken = token.slice(0, -5) + 'XXXXX';\n    assert.isFalse(checkSignedTokenPrefix(tamperedToken, TEST_DATA, SECRET_KEY));\n  });\n\n  it('rejects tokens with wrong secret key', () => {\n    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);\n\n    assert.isFalse(checkSignedTokenPrefix(token, TEST_DATA, 'wrong-secret'));\n  });\n\n  it('rejects invalid token formats', () => {\n    assert.isFalse(checkSignedTokenPrefix('invalid', TEST_DATA, SECRET_KEY));\n    assert.isFalse(checkSignedTokenPrefix('', TEST_DATA, SECRET_KEY));\n  });\n});\n"]}

package/package.json

@@ -1,27 +1,33 @@
 {
   "name": "@prairielearn/signed-token",
-  "version": "2.0.23",
+  "version": "3.1.0",
   "type": "module",
   "repository": {
     "type": "git",
     "url": "https://github.com/PrairieLearn/PrairieLearn.git",
     "directory": "packages/signed-token"
   },
+  "engines": {
+    "node": ">=24.0.0"
+  },
   "main": "dist/index.js",
   "scripts": {
     "build": "tsgo",
-    "dev": "tsgo --watch --preserveWatchOutput"
+    "dev": "tsgo --watch --preserveWatchOutput",
+    "test": "vitest run"
   },
   "dependencies": {
     "base64url": "^3.0.1",
     "debug": "^4.4.3",
-    "lodash": "^4.17.21"
+    "es-toolkit": "^1.43.0"
   },
   "devDependencies": {
     "@prairielearn/tsconfig": "^0.0.0",
     "@types/debug": "^4.1.12",
-    "@types/node": "^22.19.5",
+    "@types/node": "^24.10.9",
     "@typescript/native-preview": "^7.0.0-dev.20260106.1",
-    "typescript": "^5.9.3"
+    "@vitest/coverage-v8": "^4.0.17",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.17"
   }
 }

package/src/index.test.ts

@@ -0,0 +1,126 @@
+import { assert, describe, it } from 'vitest';
+
+import {
+  checkSignedToken,
+  checkSignedTokenPrefix,
+  generatePrefixCsrfToken,
+  generateSignedToken,
+  getCheckedSignedTokenData,
+} from './index.js';
+
+const SECRET_KEY = 'test-secret-key';
+const TEST_DATA = { url: '/test', authn_user_id: '123' };
+
+describe('generateSignedToken', () => {
+  it('generates a token that can be validated', () => {
+    const token = generateSignedToken(TEST_DATA, SECRET_KEY);
+
+    assert.isString(token);
+    assert.isTrue(checkSignedToken(token, TEST_DATA, SECRET_KEY));
+  });
+
+  it('fails validation with wrong data', () => {
+    const token = generateSignedToken(TEST_DATA, SECRET_KEY);
+
+    assert.isFalse(checkSignedToken(token, { url: '/other', authn_user_id: '123' }, SECRET_KEY));
+  });
+
+  it('fails validation with wrong secret key', () => {
+    const token = generateSignedToken(TEST_DATA, SECRET_KEY);
+
+    assert.isFalse(checkSignedToken(token, TEST_DATA, 'wrong-secret'));
+  });
+});
+
+describe('getCheckedSignedTokenData', () => {
+  it('returns null for invalid tokens', () => {
+    assert.isNull(getCheckedSignedTokenData('invalid', SECRET_KEY));
+    assert.isNull(getCheckedSignedTokenData('', SECRET_KEY));
+    assert.isNull(getCheckedSignedTokenData(123 as any, SECRET_KEY));
+  });
+
+  it('returns token data for valid tokens', () => {
+    const token = generateSignedToken(TEST_DATA, SECRET_KEY);
+
+    const result = getCheckedSignedTokenData(token, SECRET_KEY);
+    assert.deepEqual(result, TEST_DATA);
+  });
+});
+
+describe('generatePrefixCsrfToken', () => {
+  it('generates a token with type prefix', () => {
+    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);
+
+    const tokenData = getCheckedSignedTokenData(token, SECRET_KEY);
+    assert.equal(tokenData.type, 'prefix');
+    assert.equal(tokenData.url, TEST_DATA.url);
+    assert.equal(tokenData.authn_user_id, TEST_DATA.authn_user_id);
+  });
+});
+
+describe('checkSignedTokenPrefix', () => {
+  it('validates token when request URL matches prefix exactly', () => {
+    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);
+
+    assert.isTrue(checkSignedTokenPrefix(token, TEST_DATA, SECRET_KEY));
+  });
+
+  it('validates token when request URL starts with prefix', () => {
+    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);
+
+    // We allow the route itself, both with and without a trailing slash.
+    assert.isTrue(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/test' }, SECRET_KEY));
+    assert.isTrue(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/test/' }, SECRET_KEY));
+
+    // We allow deeply nested routes as well.
+    assert.isTrue(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/test/nested' }, SECRET_KEY));
+    assert.isTrue(
+      checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/test/nested/method' }, SECRET_KEY),
+    );
+  });
+
+  it('rejects token when request URL does not start with prefix', () => {
+    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);
+
+    assert.isFalse(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/other/path' }, SECRET_KEY));
+
+    // We'll forbid paths that match the prefix only partially. In other words,
+    // we'll treat the prefix as if it implicitly ends with a trailing slash.
+    assert.isFalse(checkSignedTokenPrefix(token, { ...TEST_DATA, url: '/testy' }, SECRET_KEY));
+  });
+
+  it('rejects token when user ID does not match', () => {
+    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);
+
+    assert.isFalse(
+      checkSignedTokenPrefix(token, { ...TEST_DATA, authn_user_id: '456' }, SECRET_KEY),
+    );
+  });
+
+  it('rejects non-prefix tokens', () => {
+    // Generate a regular token (not a prefix token)
+    const regularToken = generateSignedToken(TEST_DATA, SECRET_KEY);
+
+    // Should fail because it doesn't have type: 'prefix'
+    assert.isFalse(checkSignedTokenPrefix(regularToken, TEST_DATA, SECRET_KEY));
+  });
+
+  it('rejects tampered tokens', () => {
+    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);
+
+    // Tamper with the token
+    const tamperedToken = token.slice(0, -5) + 'XXXXX';
+    assert.isFalse(checkSignedTokenPrefix(tamperedToken, TEST_DATA, SECRET_KEY));
+  });
+
+  it('rejects tokens with wrong secret key', () => {
+    const token = generatePrefixCsrfToken(TEST_DATA, SECRET_KEY);
+
+    assert.isFalse(checkSignedTokenPrefix(token, TEST_DATA, 'wrong-secret'));
+  });
+
+  it('rejects invalid token formats', () => {
+    assert.isFalse(checkSignedTokenPrefix('invalid', TEST_DATA, SECRET_KEY));
+    assert.isFalse(checkSignedTokenPrefix('', TEST_DATA, SECRET_KEY));
+  });
+});

package/src/index.ts

@@ -2,7 +2,7 @@ import crypto from 'node:crypto';
 
 import base64url from 'base64url';
 import debugfn from 'debug';
-import _ from 'lodash';
+import { isEqual } from 'es-toolkit';
 
 const debug = debugfn('prairielearn:csrf');
 const sep = '.';
@@ -118,6 +118,72 @@ export function checkSignedToken(
   const tokenData = getCheckedSignedTokenData(token, secretKey, options);
   debug(`checkSignedToken(): tokenData = ${JSON.stringify(tokenData)}`);
   if (tokenData == null) return false;
-  if (!_.isEqual(data, tokenData)) return false;
+  if (!isEqual(data, tokenData)) return false;
+  return true;
+}
+
+/**
+ * Generates a CSRF token that is valid for a URL prefix instead of an exact URL.
+ * This is useful for tRPC and similar APIs where a single token should be valid
+ * for all sub-routes under a prefix (e.g., `/foo/bar/trpc` is valid for
+ * `/foo/bar/trpc/getUser` and `/foo/bar/trpc/updateUser`).
+ */
+export function generatePrefixCsrfToken(
+  data: { url: string; authn_user_id: string },
+  secretKey: string,
+) {
+  return generateSignedToken({ ...data, type: 'prefix' }, secretKey);
+}
+
+/**
+ * Validates a prefix-based CSRF token. The token's URL must be a prefix of the
+ * request URL for validation to succeed.
+ *
+ * @param token - The CSRF token to validate
+ * @param requestData - The request URL and authenticated user ID
+ * @param requestData.url - The request URL to validate against
+ * @param requestData.authn_user_id - The authenticated user ID to validate against
+ * @param secretKey - The secret key used for signing
+ * @param options - Optional settings like maxAge
+ * @returns true if the token is valid, false otherwise
+ */
+export function checkSignedTokenPrefix(
+  token: string,
+  requestData: { url: string; authn_user_id: string },
+  secretKey: string,
+  options: CheckOptions = {},
+): boolean {
+  debug(`checkSignedTokenPrefix(): token = ${token}`);
+  debug(`checkSignedTokenPrefix(): requestData = ${JSON.stringify(requestData)}`);
+
+  const tokenData = getCheckedSignedTokenData(token, secretKey, options);
+  if (tokenData == null) return false;
+
+  // Verify this is a prefix token (prevents token type confusion)
+  if (tokenData.type !== 'prefix') {
+    debug('checkSignedTokenPrefix(): FAIL - token type is not prefix');
+    return false;
+  }
+
+  // Verify user ID matches exactly
+  if (tokenData.authn_user_id !== requestData.authn_user_id) {
+    debug('checkSignedTokenPrefix(): FAIL - authn_user_id mismatch');
+    return false;
+  }
+
+  // Verify the request URL starts with the token's prefix URL.
+  // We treat the prefix as implicitly ending with a trailing slash, so
+  // `/test` matches `/test`, `/test/`, and `/test/nested`, but NOT `/testy`.
+  const prefixUrl = tokenData.url;
+  const requestUrl = requestData.url;
+  const normalizedPrefix = prefixUrl.endsWith('/') ? prefixUrl : prefixUrl + '/';
+  if (requestUrl !== prefixUrl && !requestUrl.startsWith(normalizedPrefix)) {
+    debug(
+      `checkSignedTokenPrefix(): FAIL - URL prefix mismatch: ${requestUrl} does not start with ${prefixUrl}`,
+    );
+    return false;
+  }
+
+  debug('checkSignedTokenPrefix(): SUCCESS');
   return true;
 }

package/vitest.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    dir: `${import.meta.dirname}/src`,
+    coverage: {
+      reporter: ['html', 'text-summary', 'cobertura'],
+      include: ['src/**/*.{ts,tsx}'],
+    },
+  },
+});