@rebasepro/server 0.16.1-canary.gef08a6e → 0.17.0

package/dist/{jwt-DoHkMMWF.js → jwt-5VN4C6ln.js}

@@ -5,8 +5,7 @@ __rebaseCreateRequire(import.meta.url);
 import { i as __toESM, n as __exportAll, r as __require, t as __commonJSMin } from "./rolldown-runtime-dW7B1o5h.js";
 import "./src-Cdsw7DqV.js";
 import { t as logger } from "./logger-DS03e908.js";
-import { createHash, createPrivateKey, createPublicKey, randomBytes } from "crypto";
-import path from "node:path";
+import { createPrivateKey, createPublicKey } from "crypto";
 //#region ../types/src/types/storage_source.ts
 /**
 * Describes a named storage backend — a place files live.
@@ -120,6 +119,105 @@ function normalizeStorageSources(declared, exported) {
 	return Array.from(merged.values());
 }
 //#endregion
+//#region src/utils/portable-crypto.ts
+/**
+* The cryptography the request path needs, on primitives every runtime has.
+*
+* `node:crypto` is the obvious way to hash a string in a Node process and it is
+* the right one for anything that only ever runs during boot, a migration or a
+* CLI command. On the *request* path it is the difference between code that
+* could one day serve a request from somewhere other than a Node process and
+* code that could not — see `contracts/portable-core.txt` and the gate that
+* renders it.
+*
+* The trade is that WebCrypto's digest is **async** where `createHash` is
+* synchronous. That is the whole cost of this file, it is paid at the call
+* sites rather than here, and it is paid deliberately now: a sync-to-async
+* change ripples through every caller, and doing it while the callers are few
+* and the tests are green is enormously cheaper than doing it as one line item
+* inside a runtime port.
+*
+* Not everything moves. Signing and key parsing (`auth/jwt-keys.ts`) still need
+* `node:crypto`, because the portable replacement is a JWT library this package
+* does not depend on yet. Those stay recorded in the contract file rather than
+* hidden behind a wrapper that would imply they had moved.
+*
+* @module
+*/
+var encoder = new TextEncoder();
+/**
+* SHA-256 of a string, lowercase hex — `createHash("sha256").digest("hex")`.
+*
+* Async because `crypto.subtle` is. Every current caller was already inside an
+* `async` function awaiting a database round trip, so the cost at the call site
+* is one keyword.
+*/
+async function sha256Hex(input) {
+	const digest = await crypto.subtle.digest("SHA-256", encoder.encode(input));
+	return hex(new Uint8Array(digest));
+}
+/**
+* Constant-time string comparison, for secrets.
+*
+* Replaces `timingSafeEqual` over two padded Buffers. It stays synchronous —
+* WebCrypto is not involved, and there was never a reason for this one to be
+* async.
+*
+* The comparison is over UTF-8 **bytes**, never `String.length`: sizing a
+* buffer by code units truncates on any multi-byte character, so the trailing
+* bytes go unexamined and a guess matching everything but the final character
+* of a secret containing one non-ASCII character compares equal. That is the
+* exact failure this function exists to prevent, and it is why the encoding
+* happens first.
+*
+* The length difference is folded into the same accumulator as the content
+* rather than checked separately, so there is no second comparison to short-
+* circuit. What remains observable is the *longer* of the two lengths, which is
+* a property of the input the caller already sent.
+*/
+function constantTimeEqual(a, b) {
+	const bytesA = encoder.encode(a);
+	const bytesB = encoder.encode(b);
+	let difference = bytesA.length ^ bytesB.length;
+	const length = Math.max(bytesA.length, bytesB.length);
+	for (let index = 0; index < length; index++) difference |= (bytesA[index] ?? 0) ^ (bytesB[index] ?? 0);
+	return difference === 0;
+}
+/**
+* `bytes` cryptographically random bytes as lowercase hex —
+* `randomBytes(n).toString("hex")`.
+*/
+function randomHex(bytes) {
+	return hex(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+/**
+* A uniform integer in `[0, maxExclusive)` — `randomInt`, without `node:crypto`.
+*
+* Rejection sampling, not `% maxExclusive`: the modulo of a uniform 32-bit
+* draw is biased towards the low values whenever the range does not divide
+* 2^32, and these draws are one-time passcodes. The loop retries with
+* probability under 1/2 per iteration for any range, so it terminates.
+*
+* The bound stops at 2^32 where `node:crypto`'s goes to 2^48, because one
+* `Uint32Array` draw is all any caller has ever needed and a wider one is only
+* worth writing when something needs it. A bound past the ceiling throws
+* rather than silently narrowing.
+*/
+function randomInt(maxExclusive) {
+	if (!Number.isInteger(maxExclusive) || maxExclusive <= 0 || maxExclusive > 2 ** 32) throw new RangeError(`randomInt needs an integer bound in (0, 2^32]; got ${maxExclusive}`);
+	const limit = Math.floor(2 ** 32 / maxExclusive) * maxExclusive;
+	const draw = /* @__PURE__ */ new Uint32Array(1);
+	for (;;) {
+		crypto.getRandomValues(draw);
+		if (draw[0] < limit) return draw[0] % maxExclusive;
+	}
+}
+function hex(bytes) {
+	let out = "";
+	for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
+	return out;
+}
+//#endregion
 //#region ../../node_modules/.pnpm/safe-buffer@5.2.1/node_modules/safe-buffer/index.js
 var require_safe_buffer = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	/*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
@@ -349,14 +447,14 @@ var require_buffer_equal_constant_time = /* @__PURE__ */ __commonJSMin(((exports
 //#region ../../node_modules/.pnpm/jwa@2.0.1/node_modules/jwa/index.js
 var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var Buffer = require_safe_buffer().Buffer;
-	var crypto = __require("crypto");
+	var crypto$1 = __require("crypto");
 	var formatEcdsa = require_ecdsa_sig_formatter();
 	var util$2 = __require("util");
 	var MSG_INVALID_ALGORITHM = "\"%s\" is not a valid algorithm.\n  Supported algorithms are:\n  \"HS256\", \"HS384\", \"HS512\", \"RS256\", \"RS384\", \"RS512\", \"PS256\", \"PS384\", \"PS512\", \"ES256\", \"ES384\", \"ES512\" and \"none\".";
 	var MSG_INVALID_SECRET = "secret must be a string or buffer";
 	var MSG_INVALID_VERIFIER_KEY = "key must be a string or a buffer";
 	var MSG_INVALID_SIGNER_KEY = "key must be a string, a buffer or an object";
-	var supportsKeyObjects = typeof crypto.createPublicKey === "function";
+	var supportsKeyObjects = typeof crypto$1.createPublicKey === "function";
 	if (supportsKeyObjects) {
 		MSG_INVALID_VERIFIER_KEY += " or a KeyObject";
 		MSG_INVALID_SECRET += "or a KeyObject";
@@ -409,14 +507,14 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return function sign(thing, secret) {
 			checkIsSecretKey(secret);
 			thing = normalizeInput(thing);
-			var hmac = crypto.createHmac("sha" + bits, secret);
+			var hmac = crypto$1.createHmac("sha" + bits, secret);
 			return fromBase64((hmac.update(thing), hmac.digest("base64")));
 		};
 	}
 	var bufferEqual;
-	var timingSafeEqual = "timingSafeEqual" in crypto ? function timingSafeEqual(a, b) {
+	var timingSafeEqual = "timingSafeEqual" in crypto$1 ? function timingSafeEqual(a, b) {
 		if (a.byteLength !== b.byteLength) return false;
-		return crypto.timingSafeEqual(a, b);
+		return crypto$1.timingSafeEqual(a, b);
 	} : function timingSafeEqual(a, b) {
 		if (!bufferEqual) bufferEqual = require_buffer_equal_constant_time();
 		return bufferEqual(a, b);
@@ -431,7 +529,7 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return function sign(thing, privateKey) {
 			checkIsPrivateKey(privateKey);
 			thing = normalizeInput(thing);
-			var signer = crypto.createSign("RSA-SHA" + bits);
+			var signer = crypto$1.createSign("RSA-SHA" + bits);
 			return fromBase64((signer.update(thing), signer.sign(privateKey, "base64")));
 		};
 	}
@@ -440,7 +538,7 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			checkIsPublicKey(publicKey);
 			thing = normalizeInput(thing);
 			signature = toBase64(signature);
-			var verifier = crypto.createVerify("RSA-SHA" + bits);
+			var verifier = crypto$1.createVerify("RSA-SHA" + bits);
 			verifier.update(thing);
 			return verifier.verify(publicKey, signature, "base64");
 		};
@@ -449,11 +547,11 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return function sign(thing, privateKey) {
 			checkIsPrivateKey(privateKey);
 			thing = normalizeInput(thing);
-			var signer = crypto.createSign("RSA-SHA" + bits);
+			var signer = crypto$1.createSign("RSA-SHA" + bits);
 			return fromBase64((signer.update(thing), signer.sign({
 				key: privateKey,
-				padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
-				saltLength: crypto.constants.RSA_PSS_SALTLEN_DIGEST
+				padding: crypto$1.constants.RSA_PKCS1_PSS_PADDING,
+				saltLength: crypto$1.constants.RSA_PSS_SALTLEN_DIGEST
 			}, "base64")));
 		};
 	}
@@ -462,12 +560,12 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			checkIsPublicKey(publicKey);
 			thing = normalizeInput(thing);
 			signature = toBase64(signature);
-			var verifier = crypto.createVerify("RSA-SHA" + bits);
+			var verifier = crypto$1.createVerify("RSA-SHA" + bits);
 			verifier.update(thing);
 			return verifier.verify({
 				key: publicKey,
-				padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
-				saltLength: crypto.constants.RSA_PSS_SALTLEN_DIGEST
+				padding: crypto$1.constants.RSA_PKCS1_PSS_PADDING,
+				saltLength: crypto$1.constants.RSA_PSS_SALTLEN_DIGEST
 			}, signature, "base64");
 		};
 	}
@@ -4263,8 +4361,61 @@ var require_jsonwebtoken = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	};
 }));
 //#endregion
-//#region src/storage/keys.ts
+//#region src/auth/jwt-crypto.ts
 var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
+/** Sign a set of claims. Rejects if the key and algorithm disagree. */
+async function signJwt(payload, key, options) {
+	return import_jsonwebtoken.default.sign(payload, key, {
+		algorithm: options.algorithm,
+		...options.expiresIn === void 0 ? {} : { expiresIn: options.expiresIn },
+		...options.keyid === void 0 ? {} : { keyid: options.keyid }
+	});
+}
+/**
+* Verify a token against one key and an explicit algorithm list, and return its
+* claims. Rejects — never returns null — when the token is not valid.
+*
+* `algorithms` has no default and must not acquire one. Letting the verifier
+* read `alg` out of the token's own header is the canonical JWT vulnerability:
+* an attacker takes a published RSA public key, HMACs a payload of their
+* choosing with it, sets `alg: HS256`, and a verifier holding that same public
+* key as "the secret" agrees. The caller decides the algorithm from the key it
+* chose, and {@link decodeProtectedHeader} exists so it can choose that key
+* without trusting anything the token asserts.
+*/
+async function verifyJwt(token, key, options) {
+	return import_jsonwebtoken.default.verify(token, key, { algorithms: options.algorithms });
+}
+/**
+* The token's unverified header — `kid` and `alg` — or an empty object.
+*
+* Unverified is the point: this is read *in order to* pick the key that will
+* verify it, so it cannot itself be verified first. Nothing but key selection
+* may depend on it, and key selection then pins the algorithm.
+*
+* Implemented here rather than via the JWT library because it is plain
+* base64url and JSON, needs no cryptography, and there is no reason for the
+* portable half of this module to wait on the non-portable half.
+*/
+function decodeProtectedHeader(token) {
+	const encoded = token.split(".")[0];
+	if (!encoded) return {};
+	try {
+		const base64 = encoded.replace(/-/g, "+").replace(/_/g, "/");
+		const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
+		const header = JSON.parse(atob(padded));
+		if (typeof header !== "object" || header === null) return {};
+		const { kid, alg } = header;
+		return {
+			...typeof kid === "string" ? { kid } : {},
+			...typeof alg === "string" ? { alg } : {}
+		};
+	} catch {
+		return {};
+	}
+}
+//#endregion
+//#region src/storage/keys.ts
 /**
 * Canonical storage keys and bucket names.
 *
@@ -4297,6 +4448,48 @@ var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
 * `users/alice/..../bob/x` — still comfortably inside alice's prefix, which is
 * exactly right. Only a real `..` segment is refused.
 */
+/**
+* `path.posix.normalize`, without `node:path`.
+*
+* A storage key is a POSIX-shaped string that never touches a filesystem, so
+* reaching for `node:path` to fold `.` and `//` out of it was always a little
+* wrong on its own terms — on Windows the platform `path` would have applied
+* different rules to the same key. It also put the module that every storage
+* read, ownership row and audit line goes through on the list of things that
+* only run in a Node process.
+*
+* This is the algorithm Node implements, transcribed: segments are folded left
+* to right, `..` pops unless it would climb past the root of a relative path,
+* and both the leading and the trailing separator survive the round trip. The
+* `..` branch is unreachable from {@link canonicalStorageKey}, which refuses
+* those keys outright before it gets here — it exists so that this function is
+* *the* normalizer rather than a subset of one, and
+* `storage-keys.property.test.ts` holds it to that with a property test against
+* `path.posix.normalize` itself. Exported for exactly that — nothing outside
+* this module should be normalizing a key.
+*/
+function normalizePosix(input) {
+	if (input.length === 0) return ".";
+	const isAbsolute = input.startsWith("/");
+	const trailingSeparator = input.endsWith("/");
+	const segments = [];
+	for (const segment of input.split("/")) {
+		if (segment === "" || segment === ".") continue;
+		if (segment === "..") {
+			if (segments.length > 0 && segments[segments.length - 1] !== "..") segments.pop();
+			else if (!isAbsolute) segments.push("..");
+			continue;
+		}
+		segments.push(segment);
+	}
+	const joined = segments.join("/");
+	if (joined === "") {
+		if (isAbsolute) return "/";
+		return trailingSeparator ? "./" : ".";
+	}
+	const withTrailing = trailingSeparator ? `${joined}/` : joined;
+	return isAbsolute ? `/${withTrailing}` : withTrailing;
+}
 /** Longest key accepted, in UTF-16 code units. Matches the previous cap. */
 var MAX_STORAGE_KEY_LENGTH = 1024;
 /**
@@ -4331,7 +4524,7 @@ function canonicalStorageKey(rawKey) {
 	const withoutLeadingSlashes = rawKey.replace(/^\/+/, "");
 	if (withoutLeadingSlashes === "") return "";
 	const denotesDirectory = /(?:^|\/)\.?$/.test(withoutLeadingSlashes);
-	const normalized = path.posix.normalize(withoutLeadingSlashes);
+	const normalized = normalizePosix(withoutLeadingSlashes);
 	if (normalized === "." || normalized === "./") return "";
 	const key = normalized.replace(/^\.\//, "").replace(/^\/+/, "");
 	if (key === "") return "";
@@ -4629,7 +4822,7 @@ function isJwtConfigured() {
 /**
 * Generate an access token (short-lived, 1 hour by default)
 */
-function generateAccessToken(uid, roles, aal = "aal1", customClaims) {
+async function generateAccessToken(uid, roles, aal = "aal1", customClaims) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
 	const payload = {
 		uid,
@@ -4637,12 +4830,12 @@ function generateAccessToken(uid, roles, aal = "aal1", customClaims) {
 		...customClaims,
 		aal
 	};
-	if (activeSigningKey) return import_jsonwebtoken.default.sign(payload, activeSigningKey.privateKey, {
+	if (activeSigningKey) return signJwt(payload, activeSigningKey.privateKey, {
 		expiresIn: jwtConfig.accessExpiresIn,
 		algorithm: activeSigningKey.algorithm,
 		keyid: activeSigningKey.kid
 	});
-	return import_jsonwebtoken.default.sign(payload, jwtConfig.secret, {
+	return signJwt(payload, jwtConfig.secret, {
 		expiresIn: jwtConfig.accessExpiresIn,
 		algorithm: "HS256"
 	});
@@ -4682,12 +4875,12 @@ function getAccessTokenExpiry() {
 * checked explicitly: a token minted for reading a file is not a token for
 * being a user.
 */
-function verifyAccessToken(token) {
+async function verifyAccessToken(token) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
 	try {
-		const header = import_jsonwebtoken.default.decode(token, { complete: true })?.header;
-		const namedKey = resolveVerificationKey(signingKeys, header?.kid);
-		const decoded = namedKey ? import_jsonwebtoken.default.verify(token, namedKey.publicKey, { algorithms: [namedKey.algorithm] }) : import_jsonwebtoken.default.verify(token, jwtConfig.secret, { algorithms: ["HS256"] });
+		const header = decodeProtectedHeader(token);
+		const namedKey = resolveVerificationKey(signingKeys, header.kid);
+		const decoded = namedKey ? await verifyJwt(token, namedKey.publicKey, { algorithms: [namedKey.algorithm] }) : await verifyJwt(token, jwtConfig.secret, { algorithms: ["HS256"] });
 		if (decoded.purpose) {
 			logger.error("[JWT] Verification failed: a purpose-scoped token is not an access token", { purpose: decoded.purpose });
 			return null;
@@ -4716,13 +4909,13 @@ function verifyAccessToken(token) {
 * Generate a random refresh token (long-lived, 30 days by default)
 */
 function generateRefreshToken() {
-	return randomBytes(40).toString("hex");
+	return randomHex(40);
 }
 /**
 * Hash a refresh token for database storage (don't store raw tokens)
 */
 function hashRefreshToken(token) {
-	return createHash("sha256").update(token).digest("hex");
+	return sha256Hex(token);
 }
 /**
 * The longest a cookie can live. Chrome (since 104) and RFC 6265bis silently
@@ -4778,9 +4971,9 @@ var MFA_PENDING_PURPOSE = "mfa-pending";
 * first factor may present the second, not a session to be carried around. Five
 * minutes matches the challenge TTL.
 */
-function generateMfaPendingToken(uid, expiresInSeconds = 300) {
+async function generateMfaPendingToken(uid, expiresInSeconds = 300) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
-	return import_jsonwebtoken.default.sign({
+	return signJwt({
 		purpose: MFA_PENDING_PURPOSE,
 		uid
 	}, jwtConfig.secret, {
@@ -4794,10 +4987,10 @@ function generateMfaPendingToken(uid, expiresInSeconds = 300) {
 * Returns `null` for anything else — including a perfectly valid *access*
 * token, which must not be interchangeable with this one in either direction.
 */
-function verifyMfaPendingToken(token) {
+async function verifyMfaPendingToken(token) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
 	try {
-		const decoded = import_jsonwebtoken.default.verify(token, jwtConfig.secret, { algorithms: ["HS256"] });
+		const decoded = await verifyJwt(token, jwtConfig.secret, { algorithms: ["HS256"] });
 		if (decoded.purpose !== "mfa-pending" || !decoded.uid) return null;
 		return { uid: decoded.uid };
 	} catch {
@@ -4821,14 +5014,13 @@ function verifyMfaPendingToken(token) {
 * site that forgets to pass a named source produces a default-scoped token,
 * which fails closed at `/file/*` rather than over-granting.
 */
-function generateDownloadToken(path, expiresInSeconds = 300, storageId) {
+async function generateDownloadToken(path, expiresInSeconds = 300, storageId) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
-	const payload = {
+	return signJwt({
 		purpose: "file-read",
 		path,
 		storageId: canonicalStorageId(storageId)
-	};
-	return import_jsonwebtoken.default.sign(payload, jwtConfig.secret, {
+	}, jwtConfig.secret, {
 		expiresIn: expiresInSeconds,
 		algorithm: "HS256"
 	});
@@ -4843,10 +5035,10 @@ function generateDownloadToken(path, expiresInSeconds = 300, storageId) {
 * five-minute TTL — for at most that long after a deploy, an in-flight token
 * for a *named* source is refused and the client re-fetches `/metadata`.
 */
-function verifyDownloadToken(token) {
+async function verifyDownloadToken(token) {
 	if (!jwtConfig.secret) throw new Error("JWT secret not configured. Call configureJwt() first.");
 	try {
-		const decoded = import_jsonwebtoken.default.verify(token, jwtConfig.secret, { algorithms: ["HS256"] });
+		const decoded = await verifyJwt(token, jwtConfig.secret, { algorithms: ["HS256"] });
 		if (decoded && decoded.purpose === "file-read" && typeof decoded.path === "string") return {
 			purpose: "file-read",
 			path: decoded.path,
@@ -4859,6 +5051,6 @@ function verifyDownloadToken(token) {
 	}
 }
 //#endregion
-export { canonicalStorageKey as C, findStorageSuffixCollision as D, DEFAULT_STORAGE_SOURCE_KEY as E, normalizeStorageSources as O, canonicalStorageId as S, require_jsonwebtoken as T, verifyMfaPendingToken as _, generateMfaPendingToken as a, InvalidStorageKeyError as b, getJwks as c, hasAsymmetricSigningKey as d, hashRefreshToken as f, verifyDownloadToken as g, verifyAccessToken as h, generateDownloadToken as i, storageEnvSuffix as k, getRefreshTokenExpiry as l, jwt_exports as m, configureJwt as n, generateRefreshToken as o, isJwtConfigured as p, generateAccessToken as r, getAccessTokenExpiry as s, MAX_COOKIE_AGE_MS as t, getRefreshTokenTtlMs as u, normalizePemFromEnv as v, tryCanonicalStorageKey as w, canonicalStorageBucket as x, InvalidStorageBucketError as y };
+export { findStorageSuffixCollision as A, canonicalStorageKey as C, randomInt as D, constantTimeEqual as E, storageEnvSuffix as M, sha256Hex as O, canonicalStorageId as S, require_jsonwebtoken as T, verifyMfaPendingToken as _, generateMfaPendingToken as a, InvalidStorageKeyError as b, getJwks as c, hasAsymmetricSigningKey as d, hashRefreshToken as f, verifyDownloadToken as g, verifyAccessToken as h, generateDownloadToken as i, normalizeStorageSources as j, DEFAULT_STORAGE_SOURCE_KEY as k, getRefreshTokenExpiry as l, jwt_exports as m, configureJwt as n, generateRefreshToken as o, isJwtConfigured as p, generateAccessToken as r, getAccessTokenExpiry as s, MAX_COOKIE_AGE_MS as t, getRefreshTokenTtlMs as u, normalizePemFromEnv as v, tryCanonicalStorageKey as w, canonicalStorageBucket as x, InvalidStorageBucketError as y };
 
-//# sourceMappingURL=jwt-DoHkMMWF.js.map
+//# sourceMappingURL=jwt-5VN4C6ln.js.map