@sockethub/util 1.0.0-alpha.8 → 1.0.0-alpha.9

package/dist/crypto/index.d.ts

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-export declare function getPlatformId(platform: string, actor?: string, _crypto?: Crypto): string;
+export declare function getPlatformId(platform: string, actor?: string, scope?: string, _crypto?: Crypto): string;
 export declare class Crypto {
     randomBytes: typeof randomBytes;
     constructor();
@@ -15,6 +15,16 @@ export declare class Crypto {
      * different (platform, actor) pairs to the same instance.
      */
     hashFull(text: string): string;
+    /**
+     * Stable hash of a credential object, used as the verifier that decides
+     * whether a session may reuse an existing platform connection.
+     *
+     * `object-hash` defaults to SHA-1; pinned to SHA-256 instead, since this
+     * backs an authorization decision. Not an exploit fix — the value is never
+     * exposed to clients, and forging a match needs a second preimage of an
+     * unknown credential object, which SHA-1 does not give you — but a new
+     * security-sensitive verifier should not be built on a deprecated digest.
+     */
     objectHash(object: object): string;
     /**
      * Derive a high-entropy secret from multiple input secrets.

package/dist/crypto/index.js

@@ -19,12 +19,14 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
+  if (mod && typeof mod === "object" || typeof mod === "function") {
+    for (let key of __getOwnPropNames(mod))
+      if (!__hasOwnProp.call(to, key))
+        __defProp(to, key, {
+          get: __accessProp.bind(mod, key),
+          enumerable: true
+        });
+  }
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -33,7 +35,7 @@ var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports,
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // ../../node_modules/object-hash/index.js
-var require_object_hash = __commonJS((exports, module) => {
+var require_object_hash = __commonJS(function(exports, module) {
   var crypto = __require("crypto");
   exports = module.exports = objectHash;
   function objectHash(object, options) {
@@ -10646,9 +10648,12 @@ class SecretValidator {
 // src/crypto/index.ts
 var ALGORITHM = "aes-256-cbc";
 var IV_LENGTH = 16;
-function getPlatformId(platform, actor, _crypto = crypto) {
+function encodeIdComponents(parts) {
+  return JSON.stringify(parts);
+}
+function getPlatformId(platform, actor, scope, _crypto = crypto) {
   if (actor) {
-    return _crypto.hashFull(platform + actor);
+    return _crypto.hashFull(encodeIdComponents([platform, actor, scope ?? ""]));
   }
   return _crypto.hashFull(platform);
 }
@@ -10688,7 +10693,7 @@ class Crypto {
     return createHash2("sha256").update(text).digest("hex");
   }
   objectHash(object) {
-    return import_object_hash.default(object);
+    return import_object_hash.default(object, { algorithm: "sha256" });
   }
   deriveSecret(...secrets) {
     const chars = "JDOwSa4kUbA6ixneEfHcBzC7&dIWZvqYPh8N1mG!05loQ2RjXF9*p@MgKuT$y#3L^s%rVt";
@@ -10743,9 +10748,9 @@ class Crypto {
 }
 var crypto = new Crypto;
 export {
-  getPlatformId,
+  Crypto,
   crypto,
-  Crypto
+  getPlatformId
 };
 
-//# debugId=33D2E85F0FED3EA364756E2164756E21
+//# debugId=B2B82CA1D12BCFD164756E2164756E21