@stacksjs/security 0.59.10 → 0.61.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/security",
   "type": "module",
-  "version": "0.59.10",
+  "version": "0.61.0",
   "description": "The Stacks framework security.",
   "author": "Chris Breuer",
   "license": "MIT",
@@ -56,7 +56,6 @@
     "@stacksjs/env": "latest",
     "@stacksjs/types": "latest",
     "@stacksjs/validation": "latest",
-    "bcryptjs": "^2.4.3",
     "crypto-js": "^4.2.0",
     "js-base64": "^3.7.7"
   },

package/src/crypt.ts

@@ -1,12 +1,11 @@
+import { env } from '@stacksjs/env'
 import aes from 'crypto-js/aes'
 import utf8 from 'crypto-js/enc-utf8'
-import { env } from '@stacksjs/env'
 
 function encrypt(message: string): string {
   const passphrase = env.APP_KEY
 
-  if (!passphrase)
-    throw new Error('APP_KEY is not defined')
+  if (!passphrase) throw new Error('APP_KEY is not defined')
 
   return aes.encrypt(message, passphrase).toString()
 }
@@ -14,8 +13,7 @@ function encrypt(message: string): string {
 function decrypt(encrypted: string): string {
   const passphrase = env.APP_KEY
 
-  if (!passphrase)
-    throw new Error('APP_KEY is not defined')
+  if (!passphrase) throw new Error('APP_KEY is not defined')
 
   return aes.decrypt(encrypted, passphrase).toString(utf8)
 }

package/src/hash.ts

@@ -1,54 +1,75 @@
-import bcryptjs from 'bcryptjs'
-import { Base64 } from 'js-base64'
-import md5 from 'crypto-js/md5'
 import { hashing } from '@stacksjs/config'
+import md5 from 'crypto-js/md5'
+import { Base64 } from 'js-base64'
+
+interface MakeOptions {
+  algorithm?: 'bcrypt' | 'base64' | 'argon2'
+  type?: 'argon2id' | 'argon2i' | 'argon2d'
+}
+
+async function make(password: string, options?: MakeOptions) {
+  if (options?.algorithm === 'argon2') return argon2Encode(password, { type: 'argon2id' })
 
-async function make(password: string, algorithm = 'bcrypt') {
-  if (algorithm === 'bcrypt')
-    return bcryptEncode(password)
+  if (options?.algorithm === 'bcrypt') return bcryptEncode(password)
 
-  if (algorithm === 'base64')
-    return base64Encode(password)
+  if (options?.algorithm === 'base64') return base64Encode(password)
 
   throw new Error('Unsupported algorithm')
 }
 
-type Algorithm = 'bcrypt' | 'base64'
+type Algorithm = 'bcrypt' | 'base64' | 'argon2'
 
 async function verify(password: string, hash: string, algorithm?: Algorithm) {
-  if (algorithm === 'bcrypt')
-    return bcryptVerify(password, hash)
+  if (algorithm === 'argon2') return argon2Verify(password, hash)
 
-  if (algorithm === 'base64')
-    return base64Verify(password, hash)
+  if (algorithm === 'bcrypt') return bcryptVerify(password, hash)
+
+  if (algorithm === 'base64') return base64Verify(password, hash)
 
   throw new Error('Unsupported algorithm')
 }
 
-async function bcryptEncode(password: string) {
-  if (!hashing.bcrypt)
-    throw new Error('Bcrypt hashing is not configured')
+export async function bcryptEncode(password: string) {
+  if (!hashing.bcrypt) throw new Error('Bcrypt hashing is not configured')
+
+  const bcryptHash = await Bun.password.hash(password, {
+    algorithm: 'bcrypt',
+    cost: hashing.bcrypt.cost,
+  })
+
+  return bcryptHash
+}
 
-  const salt = bcryptjs.genSaltSync(hashing.bcrypt.rounds)
-  const hash = await bcryptjs.hash(password, salt)
+export async function argon2Encode(password: string, options?: { type: 'argon2id' | 'argon2i' | 'argon2d' }) {
+  if (!hashing.argon2) throw new Error('Argon2 hashing is not configured')
+
+  const argon2Hash = await Bun.password.hash(password, {
+    algorithm: options?.type || 'argon2id',
+    memoryCost: hashing.argon2.memory,
+    timeCost: hashing.argon2.time,
+  })
+
+  return argon2Hash
+}
 
-  return hash
+export async function argon2Verify(password: string, hash: string) {
+  return await Bun.password.verify(password, hash)
 }
 
-async function bcryptVerify(password: string, hash: string) {
-  return await bcryptjs.compare(password, hash)
+export async function bcryptVerify(password: string, hash: string) {
+  return await Bun.password.verify(password, hash)
 }
 
-function base64Encode(password: string) {
+export function base64Encode(password: string) {
   return Base64.encode(password)
 }
 
-function base64Verify(password: string, hash: string) {
+export function base64Verify(password: string, hash: string) {
   return Base64.decode(hash) === password
 }
 
-function md5Encode(password: string) {
+export function md5Encode(password: string) {
   return md5(password)
 }
 
-export { make as makeHash, verify as verifyHash, base64Encode, base64Verify, bcryptEncode, bcryptVerify, md5Encode }
+export { make as makeHash, verify as verifyHash }

package/src/key.ts

@@ -1,6 +1,6 @@
 import { getRandomValues } from 'node:crypto'
-import utf8 from 'crypto-js/enc-utf8'
 import base64 from 'crypto-js/enc-base64'
+import utf8 from 'crypto-js/enc-utf8'
 
 export function generateAppKey() {
   const random = getRandomValues(new Uint8Array(32))

package/dist/crypt.d.ts

@@ -1,3 +0,0 @@
-declare function encrypt(message: string): string;
-declare function decrypt(encrypted: string): string;
-export { encrypt, decrypt };

package/dist/hash.d.ts

@@ -1,9 +0,0 @@
-declare function make(password: string, algorithm?: string): Promise<string>;
-type Algorithm = 'bcrypt' | 'base64';
-declare function verify(password: string, hash: string, algorithm?: Algorithm): Promise<boolean>;
-declare function bcryptEncode(password: string): Promise<string>;
-declare function bcryptVerify(password: string, hash: string): Promise<boolean>;
-declare function base64Encode(password: string): string;
-declare function base64Verify(password: string, hash: string): boolean;
-declare function md5Encode(password: string): CryptoJS.lib.WordArray;
-export { make as makeHash, verify as verifyHash, base64Encode, base64Verify, bcryptEncode, bcryptVerify, md5Encode };

package/dist/index.d.ts

@@ -1,3 +0,0 @@
-export * from './key';
-export * from './crypt';
-export * from './hash';

package/dist/key.d.ts

@@ -1 +0,0 @@
-export declare function generateAppKey(): string;