@rudderjs/hash 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Suleiman Shahbari
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,67 @@
+# @rudderjs/hash
+
+One-way password hashing for RudderJS. Built-in drivers: **bcrypt** (default) and **argon2**.
+
+## Installation
+
+```bash
+pnpm add @rudderjs/hash
+```
+
+For argon2 support:
+
+```bash
+pnpm add argon2
+```
+
+## Setup
+
+```ts
+// config/hash.ts
+export default {
+  driver: 'bcrypt',
+  bcrypt: { rounds: 12 },
+  argon2: { memory: 65536, time: 3, threads: 4 },
+}
+
+// bootstrap/providers.ts
+import { hash } from '@rudderjs/hash'
+export default [hash(configs.hash), ...]
+```
+
+## Usage
+
+```ts
+import { Hash } from '@rudderjs/hash'
+
+// Hash a password
+const hashed = await Hash.make('password')
+
+// Verify a password
+const valid = await Hash.check('password', hashed) // true
+
+// Check if rehash is needed (e.g. after changing rounds)
+if (Hash.needsRehash(hashed)) {
+  const newHash = await Hash.make('password')
+}
+```
+
+## Drivers
+
+### Bcrypt (default)
+
+Uses `bcryptjs` (pure JS, no native compilation needed).
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `rounds` | `12` | Cost factor (2^rounds iterations) |
+
+### Argon2
+
+Uses the `argon2` package (native, requires compilation). Uses argon2id variant.
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `memory` | `65536` | Memory cost in KiB |
+| `time` | `3` | Time cost (iterations) |
+| `threads` | `4` | Parallelism factor |

package/dist/index.d.ts

@@ -0,0 +1,64 @@
+import { ServiceProvider, type Application } from '@rudderjs/core';
+export interface HashDriver {
+    make(value: string): Promise<string>;
+    check(value: string, hashed: string): Promise<boolean>;
+    needsRehash(hashed: string): boolean;
+}
+export declare class HashRegistry {
+    private static driver;
+    static set(driver: HashDriver): void;
+    static get(): HashDriver | null;
+    /** @internal */
+    static reset(): void;
+}
+export declare class Hash {
+    private static driver;
+    /** Hash a plain-text value. */
+    static make(value: string): Promise<string>;
+    /** Check a plain-text value against a hash. */
+    static check(value: string, hashed: string): Promise<boolean>;
+    /** Determine if a hash needs to be rehashed (e.g. cost changed). */
+    static needsRehash(hashed: string): boolean;
+}
+export interface BcryptConfig {
+    rounds?: number;
+}
+export declare class BcryptDriver implements HashDriver {
+    private readonly rounds;
+    constructor(config?: BcryptConfig);
+    make(value: string): Promise<string>;
+    check(value: string, hashed: string): Promise<boolean>;
+    needsRehash(hashed: string): boolean;
+}
+export interface Argon2Config {
+    memory?: number;
+    time?: number;
+    threads?: number;
+}
+export declare class Argon2Driver implements HashDriver {
+    private readonly memory;
+    private readonly time;
+    private readonly threads;
+    constructor(config?: Argon2Config);
+    make(value: string): Promise<string>;
+    check(value: string, hashed: string): Promise<boolean>;
+    needsRehash(hashed: string): boolean;
+}
+export interface HashConfig {
+    driver: 'bcrypt' | 'argon2';
+    bcrypt?: BcryptConfig;
+    argon2?: Argon2Config;
+}
+/**
+ * Returns a HashServiceProvider class configured for the given hash config.
+ *
+ * Built-in drivers:  bcrypt  (default, uses bcryptjs)
+ *                    argon2  (requires argon2: pnpm add argon2)
+ *
+ * Usage in bootstrap/providers.ts:
+ *   import { hash } from '@rudderjs/hash'
+ *   import configs from '../config/index.js'
+ *   export default [..., hash(configs.hash), ...]
+ */
+export declare function hash(config: HashConfig): new (app: Application) => ServiceProvider;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAIlE,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACpC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACtD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;CACrC;AAID,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAC,MAAM,CAA0B;IAE/C,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI;IACpC,MAAM,CAAC,GAAG,IAAI,UAAU,GAAG,IAAI;IAC/B,gBAAgB;IAChB,MAAM,CAAC,KAAK,IAAI,IAAI;CACrB;AAID,qBAAa,IAAI;IACf,OAAO,CAAC,MAAM,CAAC,MAAM;IAMrB,+BAA+B;IAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI3C,+CAA+C;IAC/C,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7D,oEAAoE;IACpE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;CAG5C;AAID,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,qBAAa,YAAa,YAAW,UAAU;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;gBAEnB,MAAM,CAAC,EAAE,YAAY;IAI3B,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKpC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK5D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;CAKrC;AAID,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,qBAAa,YAAa,YAAW,UAAU;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;gBAEpB,MAAM,CAAC,EAAE,YAAY;IAM3B,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUpC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK5D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;CAUrC;AAID,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC3B,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,MAAM,CAAC,EAAE,YAAY,CAAA;CACtB;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,KAAK,GAAG,EAAE,WAAW,KAAK,eAAe,CAqBlF"}

package/dist/index.js

@@ -0,0 +1,115 @@
+import { ServiceProvider } from '@rudderjs/core';
+// ─── Hash Registry ────────────────────────────────────────
+export class HashRegistry {
+    static driver = null;
+    static set(driver) { this.driver = driver; }
+    static get() { return this.driver; }
+    /** @internal */
+    static reset() { this.driver = null; }
+}
+// ─── Hash Facade ──────────────────────────────────────────
+export class Hash {
+    static driver() {
+        const d = HashRegistry.get();
+        if (!d)
+            throw new Error('[RudderJS Hash] No hash driver registered. Add hash() to providers.');
+        return d;
+    }
+    /** Hash a plain-text value. */
+    static make(value) {
+        return this.driver().make(value);
+    }
+    /** Check a plain-text value against a hash. */
+    static check(value, hashed) {
+        return this.driver().check(value, hashed);
+    }
+    /** Determine if a hash needs to be rehashed (e.g. cost changed). */
+    static needsRehash(hashed) {
+        return this.driver().needsRehash(hashed);
+    }
+}
+export class BcryptDriver {
+    rounds;
+    constructor(config) {
+        this.rounds = config?.rounds ?? 12;
+    }
+    async make(value) {
+        const bcrypt = (await import('bcryptjs')).default;
+        return bcrypt.hash(value, this.rounds);
+    }
+    async check(value, hashed) {
+        const bcrypt = (await import('bcryptjs')).default;
+        return bcrypt.compare(value, hashed);
+    }
+    needsRehash(hashed) {
+        const match = hashed.match(/^\$2[aby]?\$(\d{2})\$/);
+        if (!match)
+            return true;
+        return parseInt(match[1], 10) !== this.rounds;
+    }
+}
+export class Argon2Driver {
+    memory;
+    time;
+    threads;
+    constructor(config) {
+        this.memory = config?.memory ?? 65536;
+        this.time = config?.time ?? 3;
+        this.threads = config?.threads ?? 4;
+    }
+    async make(value) {
+        const argon2 = await import('argon2');
+        return argon2.hash(value, {
+            type: 2, // argon2id
+            memoryCost: this.memory,
+            timeCost: this.time,
+            parallelism: this.threads,
+        });
+    }
+    async check(value, hashed) {
+        const argon2 = await import('argon2');
+        return argon2.verify(hashed, value);
+    }
+    needsRehash(hashed) {
+        // Argon2 encodes params in the hash: $argon2id$v=19$m=65536,t=3,p=4$...
+        const match = hashed.match(/\$m=(\d+),t=(\d+),p=(\d+)\$/);
+        if (!match)
+            return true;
+        return (parseInt(match[1], 10) !== this.memory ||
+            parseInt(match[2], 10) !== this.time ||
+            parseInt(match[3], 10) !== this.threads);
+    }
+}
+// ─── Service Provider Factory ─────────────────────────────
+/**
+ * Returns a HashServiceProvider class configured for the given hash config.
+ *
+ * Built-in drivers:  bcrypt  (default, uses bcryptjs)
+ *                    argon2  (requires argon2: pnpm add argon2)
+ *
+ * Usage in bootstrap/providers.ts:
+ *   import { hash } from '@rudderjs/hash'
+ *   import configs from '../config/index.js'
+ *   export default [..., hash(configs.hash), ...]
+ */
+export function hash(config) {
+    class HashServiceProvider extends ServiceProvider {
+        register() { }
+        async boot() {
+            let driver;
+            if (config.driver === 'bcrypt') {
+                driver = new BcryptDriver(config.bcrypt);
+            }
+            else if (config.driver === 'argon2') {
+                driver = new Argon2Driver(config.argon2);
+            }
+            else {
+                throw new Error(`[RudderJS Hash] Unknown driver "${config.driver}". Available: bcrypt, argon2`);
+            }
+            HashRegistry.set(driver);
+            this.app.instance('hash', driver);
+        }
+    }
+    return HashServiceProvider;
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAoB,MAAM,gBAAgB,CAAA;AAUlE,6DAA6D;AAE7D,MAAM,OAAO,YAAY;IACf,MAAM,CAAC,MAAM,GAAsB,IAAI,CAAA;IAE/C,MAAM,CAAC,GAAG,CAAC,MAAkB,IAAY,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA,CAAC,CAAC;IAC/D,MAAM,CAAC,GAAG,KAA+B,OAAO,IAAI,CAAC,MAAM,CAAA,CAAC,CAAC;IAC7D,gBAAgB;IAChB,MAAM,CAAC,KAAK,KAA6B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA,CAAC,CAAC;;AAG/D,6DAA6D;AAE7D,MAAM,OAAO,IAAI;IACP,MAAM,CAAC,MAAM;QACnB,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,CAAA;QAC5B,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;QAC9F,OAAO,CAAC,CAAA;IACV,CAAC;IAED,+BAA+B;IAC/B,MAAM,CAAC,IAAI,CAAC,KAAa;QACvB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,+CAA+C;IAC/C,MAAM,CAAC,KAAK,CAAC,KAAa,EAAE,MAAc;QACxC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAC3C,CAAC;IAED,oEAAoE;IACpE,MAAM,CAAC,WAAW,CAAC,MAAc;QAC/B,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC;CACF;AAQD,MAAM,OAAO,YAAY;IACN,MAAM,CAAQ;IAE/B,YAAY,MAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,EAAE,CAAA;IACpC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACtB,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAA;QACjD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,MAAc;QACvC,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAA;QACjD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACtC,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,MAAM,CAAA;IAChD,CAAC;CACF;AAUD,MAAM,OAAO,YAAY;IACN,MAAM,CAAQ;IACd,IAAI,CAAQ;IACZ,OAAO,CAAQ;IAEhC,YAAY,MAAqB;QAC/B,IAAI,CAAC,MAAM,GAAI,MAAM,EAAE,MAAM,IAAK,KAAK,CAAA;QACvC,IAAI,CAAC,IAAI,GAAM,MAAM,EAAE,IAAI,IAAO,CAAC,CAAA;QACnC,IAAI,CAAC,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACtB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAA;QACrC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE;YACxB,IAAI,EAAS,CAAC,EAAE,WAAW;YAC3B,UAAU,EAAG,IAAI,CAAC,MAAM;YACxB,QAAQ,EAAK,IAAI,CAAC,IAAI;YACtB,WAAW,EAAE,IAAI,CAAC,OAAO;SAC1B,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,MAAc;QACvC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAA;QACrC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,wEAAwE;QACxE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAA;QACzD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,MAAM;YACvC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI;YACrC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CACzC,CAAA;IACH,CAAC;CACF;AAUD,6DAA6D;AAE7D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,IAAI,CAAC,MAAkB;IACrC,MAAM,mBAAoB,SAAQ,eAAe;QAC/C,QAAQ,KAAU,CAAC;QAEnB,KAAK,CAAC,IAAI;YACR,IAAI,MAAkB,CAAA;YAEtB,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC1C,CAAC;iBAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,MAAgB,8BAA8B,CAAC,CAAA;YAC3G,CAAC;YAED,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACxB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;KACF;IAED,OAAO,mBAAmB,CAAA;AAC5B,CAAC"}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@rudderjs/hash",
+  "version": "0.0.1",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/rudderjs/rudder",
+    "directory": "packages/hash"
+  },
+  "type": "module",
+  "files": [
+    "dist"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "dependencies": {
+    "bcryptjs": "^2.4.3",
+    "@rudderjs/core": "0.0.8"
+  },
+  "optionalDependencies": {
+    "argon2": "^0.41.0"
+  },
+  "devDependencies": {
+    "@types/bcryptjs": "^2.4.6",
+    "@types/node": "^20.0.0",
+    "typescript": "^5.4.0",
+    "tsx": "^4.0.0"
+  },
+  "author": "Suleiman Shahbari",
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "dev": "tsc -p tsconfig.build.json --watch",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src",
+    "clean": "rm -rf dist",
+    "test": "tsc -p tsconfig.test.json && node --test dist-test/index.test.js; EXIT=$?; rm -rf dist-test; exit $EXIT"
+  }
+}