@selvajs/server 2.0.0-beta.18 → 2.0.0-beta.20

package/dist/tokens/token-codec.js

@@ -1,28 +1,23 @@
-import { randomBytes, createHmac, timingSafeEqual } from 'node:crypto';
+import { randomBytes, createHash, createHmac, timingSafeEqual } from 'node:crypto';
 /**
- * HMAC token codec — the primitive behind capability-URL tokens (share links,
- * invites, and anything shaped like them).
+ * Token codec — the primitive behind capability-URL tokens (share links,
+ * invites, API tokens, and anything shaped like them).
  *
  * ## Format
  *   raw  = `<prefix><base64url(32 random bytes)>`
- *   hash = base64url( HMAC-SHA256(secret, raw) )
+ *   hash = `sha256:` + base64url( SHA-256(raw) )
  *
- * ## Two secrets per token
+ * The raw token is handed back once at mint time and never stored; the store
+ * holds only the hash. With 256 bits of entropy in the raw token, an unkeyed
+ * hash is as unreplayable from a database leak as a keyed one, and rotating
+ * the instance secret no longer invalidates stored tokens.
  *
- *   1. **Per-token entropy** — the 32 random bytes in `mintRawToken()`, handed
- *      back exactly once at mint time and never stored. This is what end-users
- *      carry in `?token=…`.
+ * ## Legacy hashes
  *
- *   2. **Instance-wide HMAC secret** (`config.secret`) — hashes tokens for
- *      storage, so the store holds only `HMAC-SHA256(secret, raw)`. A DB-only
- *      leak can't be replayed: the attacker also needs the secret, and it lives
- *      in env, not the database.
- *
- * Resolution hashes the supplied token with the same secret and looks up an
- * exact match against the stored hash.
- *
- * Rotating the secret invalidates every token minted under it — give each token
- * family (each prefix) its own secret so they rotate independently.
+ * Tokens minted before this format were stored as
+ * `base64url(HMAC-SHA256(secret, raw))`. `lookupHashes` returns those forms
+ * too, under the current and the previous secret, so they keep resolving
+ * through a rotation until they expire.
  */
 /**
  * Minimum accepted secret length, matching the "random ≥32-byte string"
@@ -31,18 +26,23 @@ import { randomBytes, createHmac, timingSafeEqual } from 'node:crypto';
  */
 export const MIN_TOKEN_SECRET_LENGTH = 32;
 export function createTokenCodec(config) {
-    const { prefix, secret } = config;
-    if (secret.length < MIN_TOKEN_SECRET_LENGTH) {
-        throw new Error(`Secret for "${prefix}" tokens must be at least ${MIN_TOKEN_SECRET_LENGTH} characters ` +
-            `(got ${secret.length}). Generate one with: openssl rand -base64 32`);
+    const { prefix, secret, previousSecret } = config;
+    for (const s of [secret, ...(previousSecret ? [previousSecret] : [])]) {
+        if (s.length < MIN_TOKEN_SECRET_LENGTH) {
+            throw new Error(`Secret for "${prefix}" tokens must be at least ${MIN_TOKEN_SECRET_LENGTH} characters ` +
+                `(got ${s.length}). Generate one with: openssl rand -base64 32`);
+        }
     }
+    const hashToken = (raw) => 'sha256:' + createHash('sha256').update(raw).digest('base64url');
     return {
         prefix,
         mintRawToken() {
             return prefix + randomBytes(32).toString('base64url');
         },
-        hashToken(raw) {
-            return createHmac('sha256', secret).update(raw).digest('base64url');
+        hashToken,
+        lookupHashes(raw) {
+            const legacy = [secret, ...(previousSecret ? [previousSecret] : [])].map((key) => createHmac('sha256', key).update(raw).digest('base64url'));
+            return [hashToken(raw), ...legacy];
         },
         hashesEqual(a, b) {
             const ab = Buffer.from(a);
@@ -56,4 +56,17 @@ export function createTokenCodec(config) {
         }
     };
 }
+/**
+ * Look a raw token up by each hash its record may carry. Sequential rather than
+ * one `IN` query so stores keep their single-hash interface; records are never
+ * rewritten here, so there is no rewrite for a lookup to race.
+ */
+export async function findByToken(codec, raw, lookup) {
+    for (const hash of codec.lookupHashes(raw)) {
+        const found = await lookup(hash);
+        if (found)
+            return found;
+    }
+    return null;
+}
 //# sourceMappingURL=token-codec.js.map

package/dist/tokens/token-codec.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-codec.js","sourceRoot":"","sources":["../../src/tokens/token-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAsB1C,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACxD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACd,eAAe,MAAM,6BAA6B,uBAAuB,cAAc;YACtF,QAAQ,MAAM,CAAC,MAAM,+CAA+C,CACrE,CAAC;IACH,CAAC;IAED,OAAO;QACN,MAAM;QACN,YAAY;YACX,OAAO,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvD,CAAC;QACD,SAAS,CAAC,GAAW;YACpB,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrE,CAAC;QACD,WAAW,CAAC,CAAS,EAAE,CAAS;YAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,cAAc,CAAC,KAAa;YAC3B,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"token-codec.js","sourceRoot":"","sources":["../../src/tokens/token-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnF;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AA0B1C,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACxD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACd,eAAe,MAAM,6BAA6B,uBAAuB,cAAc;gBACtF,QAAQ,CAAC,CAAC,MAAM,+CAA+C,CAChE,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,GAAW,EAAU,EAAE,CACzC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAElE,OAAO;QACN,MAAM;QACN,YAAY;YACX,OAAO,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvD,CAAC;QACD,SAAS;QACT,YAAY,CAAC,GAAW;YACvB,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAChF,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CACzD,CAAC;YACF,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,WAAW,CAAC,CAAS,EAAE,CAAS;YAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,cAAc,CAAC,KAAa;YAC3B,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;KACD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,KAAuC,EACvC,GAAW,EACX,MAA2C;IAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/server",
-  "version": "2.0.0-beta.18",
+  "version": "2.0.0-beta.20",
   "description": "Transport-agnostic server building blocks for apps built on the Selva engine (limits, rate limiting, SSRF guard, remote-definition fetch, definition service + render loader); the solve core lives in @selvajs/solve/server",
   "license": "MIT",
   "author": "VektorNode",
@@ -31,6 +31,11 @@
       "types": "./dist/compute/index.d.ts",
       "import": "./dist/compute/index.js"
     },
+    "./config": {
+      "selva-source": "./src/config/index.ts",
+      "types": "./dist/config/index.d.ts",
+      "import": "./dist/config/index.js"
+    },
     "./definitions": {
       "selva-source": "./src/definitions/index.ts",
       "types": "./dist/definitions/index.d.ts",
@@ -116,9 +121,9 @@
   "dependencies": {
     "zod": "^4.6.7",
     "@selvajs/compute": "^5.0.0-beta.9",
-    "@selvajs/notifications": "^0.3.0-beta.6",
-    "@selvajs/platform": "^1.0.0-beta.6",
-    "@selvajs/schemas": "^5.3.0-beta.2"
+    "@selvajs/notifications": "^0.3.0-beta.9",
+    "@selvajs/schemas": "^5.3.0-beta.3",
+    "@selvajs/platform": "^1.0.0-beta.9"
   },
   "peerDependencies": {
     "@sentry/node": ">=8",
@@ -144,7 +149,7 @@
     "typescript": "~6.0.3",
     "vitest": "^5.0.5",
     "@selvajs/config": "0.0.4",
-    "@selvajs/local-provider": "0.16.0-beta.3"
+    "@selvajs/local-provider": "0.16.0-beta.5"
   },
   "scripts": {
     "build": "tsc",