@stefanobalocco/honosignedrequests 1.1.1 → 1.1.2

package/README.md

@@ -128,6 +128,7 @@ These are passed to `SignedRequestsManager` constructor and apply to all storage
 | `validitySignature` | 5000 | Signature validity window in milliseconds |
 | `validityToken` | 3600000 | Session token validity in milliseconds |
 | `tokenLength` | 32 | Token length in bytes (cryptographic secret) |
+| `onError` | undefined | Callback invoked when an error occurs during request validation |
 
 #### SessionsStorageLocal Specific Parameters
 
@@ -147,8 +148,10 @@ These are specific to the in-memory implementation:
   import { SignedRequester } from 'https://cdn.jsdelivr.net/gh/StefanoBalocco/HonoSignedRequests/client/dist/SignedRequester.min.js';
   
   const requester = new SignedRequester();
-  // You can also specify a base URL for request
+  // You can also specify a base URL for requests
   //const requester = new SignedRequester('https://api.example.com');
+  // You can also specify an error handler for encoding/decoding errors
+  //const requester = new SignedRequester('https://api.example.com', (error) => console.error(error));
   
   // Check if we have session data stored
   let needLogin = true;
@@ -194,6 +197,17 @@ These are specific to the in-memory implementation:
 
 ### Client API
 
+#### Constructor
+
+```javascript
+const requester = new SignedRequester(baseUrl?, onError?);
+```
+
+| Parameter | Type | Description |
+|-----------|------|-------------|
+| `baseUrl` | `string` | Optional base URL for all requests. If not provided, relative paths are used. |
+| `onError` | `(error: unknown) => void` | Optional callback invoked when encoding/decoding errors occur. |
+
 #### `setSession(config)`
 
 Initialize session after login.

package/client/dist/SignedRequester.js

@@ -16,7 +16,7 @@ function _base64url_encode(value, onError) {
 }
 function _base64url_decode(value, onError) {
     let returnValue;
-    if (0 < value?.length && /^[A-Za-z0-9_-]*$/.test(value)) {
+    if (0 < value?.length && _base64UrlVerify.test(value)) {
         const padding = value.length % 4;
         const paddedValue = 0 === padding ? value : value.padEnd(value.length + (4 - padding), '=');
         const base64 = paddedValue.replace(/-/g, '+').replace(/_/g, '/');
@@ -30,6 +30,7 @@ function _base64url_decode(value, onError) {
     }
     return returnValue;
 }
+const _base64UrlVerify = /^(?=.)(?:[A-Za-z0-9\-_]{4})*(?:[A-Za-z0-9\-_]{2}(?:==)?|[A-Za-z0-9\-_]{3}=?)?$/;
 class SignedRequester {
     _semaphoreAcquire(wait = true) {
         let returnValue = Promise.resolve(false);

package/client/dist/SignedRequester.min.js

@@ -1 +1 @@
-function t(t,e){let s;if(0<t?.length&&/^[A-Za-z0-9_-]*$/.test(t)){const i=t.length%4,o=(0===i?t:t.padEnd(t.length+(4-i),"=")).replace(/-/g,"+").replace(/_/g,"/");try{const t=atob(o);s=Uint8Array.from(t,t=>t.charCodeAt(0))}catch(t){e?.(t)}}return s}class e{t(t=!0){let e=Promise.resolve(!1);return this.i?t&&(e=new Promise(t=>{this.o.push(t)})):(this.i=!0,e=Promise.resolve(!0)),e}h(){if(this.i)if(0<this.o.length){const t=this.o.shift();t&&t(!0)}else this.i=!1}l(){void 0!==this.u&&(this.u++,localStorage.setItem("sequenceNumber",this.u.toString()))}S(){let e=!1;const s=localStorage.getItem("sessionId"),i=localStorage.getItem("token"),o=localStorage.getItem("sequenceNumber");if(s&&i&&o){const r=parseInt(s),n=parseInt(o),a=t(i,this.m);isNaN(r)||isNaN(n)||!a||(this.p=r,this.N=a,this.u=n,e=!0)}return e}constructor(t,e){this.i=!1,this.o=[],this.v=t,this.m=e}setSession(e){const s=t(e.token,this.m);if(!s)throw new Error("Invalid token format");this.p=e.sessionId,this.N=s,this.u=e.sequenceNumber,localStorage.setItem("sessionId",e.sessionId.toString()),localStorage.setItem("token",e.token),localStorage.setItem("sequenceNumber",e.sequenceNumber.toString())}getSession(){let t;return t=void 0!==this.p&&void 0!==this.N&&void 0!==this.u||this.S(),t}clearSession(){localStorage.removeItem("sessionId"),localStorage.removeItem("token"),localStorage.removeItem("sequenceNumber"),this.p=void 0,this.N=void 0,this.u=void 0}async signedRequest(t,s,i={}){let o,r;await this.t();try{if(void 0!==this.p&&void 0!==this.N&&void 0!==this.u){const r=Date.now(),n=Object.entries(s),a=[["sessionId",this.p],["sequenceNumber",this.u],["timestamp",r],...n.sort((t,e)=>t[0].localeCompare(e[0]))].map(([t,s])=>`${t}=${e.q.has(typeof s)||null===s?String(s):JSON.stringify(s)}`).join(";"),h=await crypto.subtle.importKey("raw",this.N,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),c=new TextEncoder,l=await crypto.subtle.sign("HMAC",h,c.encode(a)),u=function(t,e){let s="";if(0<t?.length)try{const e=Array.from(t,t=>String.fromCharCode(t)).join("");s=btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}catch(t){e?.(t)}return s}(new Uint8Array(l),this.m),d={sessionId:this.p,timestamp:r,signature:u};Object.assign(d,Object.fromEntries(n));const g=i.baseUrl?`${i.baseUrl}${t}`:this.v?`${this.v}${t}`:t,S=i.method||"POST";o=await fetch(g,{method:S,headers:{"Content-Type":"application/json",...i.headers},body:JSON.stringify(d)}),o.ok?this.l():401===o.status&&this.clearSession()}else r=new Error("Session not configured")}catch(t){r=t instanceof Error?t:new Error(String(t))}finally{this.h()}if(r)throw r;return o}async signedRequestJson(t,e,s={}){let i,o;try{const r=await this.signedRequest(t,e,s);r.ok?i=await r.json():o=new Error(`Request failed with status ${r.status}`)}catch(t){o=t instanceof Error?t:new Error(String(t))}if(o)throw o;return i}}e.q=new Set(["undefined","string","number"]);export{e as SignedRequester};
+function t(t,s){let i;if(0<t?.length&&e.test(t)){const e=t.length%4,o=(0===e?t:t.padEnd(t.length+(4-e),"=")).replace(/-/g,"+").replace(/_/g,"/");try{const t=atob(o);i=Uint8Array.from(t,t=>t.charCodeAt(0))}catch(t){s?.(t)}}return i}const e=/^(?=.)(?:[A-Za-z0-9\-_]{4})*(?:[A-Za-z0-9\-_]{2}(?:==)?|[A-Za-z0-9\-_]{3}=?)?$/;class s{t(t=!0){let e=Promise.resolve(!1);return this.i?t&&(e=new Promise(t=>{this.o.push(t)})):(this.i=!0,e=Promise.resolve(!0)),e}h(){if(this.i)if(0<this.o.length){const t=this.o.shift();t&&t(!0)}else this.i=!1}l(){void 0!==this.u&&(this.u++,localStorage.setItem("sequenceNumber",this.u.toString()))}S(){let e=!1;const s=localStorage.getItem("sessionId"),i=localStorage.getItem("token"),o=localStorage.getItem("sequenceNumber");if(s&&i&&o){const r=parseInt(s),n=parseInt(o),a=t(i,this.m);isNaN(r)||isNaN(n)||!a||(this.p=r,this.N=a,this.u=n,e=!0)}return e}constructor(t,e){this.i=!1,this.o=[],this.v=t,this.m=e}setSession(e){const s=t(e.token,this.m);if(!s)throw new Error("Invalid token format");this.p=e.sessionId,this.N=s,this.u=e.sequenceNumber,localStorage.setItem("sessionId",e.sessionId.toString()),localStorage.setItem("token",e.token),localStorage.setItem("sequenceNumber",e.sequenceNumber.toString())}getSession(){let t;return t=void 0!==this.p&&void 0!==this.N&&void 0!==this.u||this.S(),t}clearSession(){localStorage.removeItem("sessionId"),localStorage.removeItem("token"),localStorage.removeItem("sequenceNumber"),this.p=void 0,this.N=void 0,this.u=void 0}async signedRequest(t,e,i={}){let o,r;await this.t();try{if(void 0!==this.p&&void 0!==this.N&&void 0!==this.u){const r=Date.now(),n=Object.entries(e),a=[["sessionId",this.p],["sequenceNumber",this.u],["timestamp",r],...n.sort((t,e)=>t[0].localeCompare(e[0]))].map(([t,e])=>`${t}=${s.q.has(typeof e)||null===e?String(e):JSON.stringify(e)}`).join(";"),h=await crypto.subtle.importKey("raw",this.N,{name:"HMAC",hash:"SHA-256"},!1,["sign"]),c=new TextEncoder,l=await crypto.subtle.sign("HMAC",h,c.encode(a)),u=function(t,e){let s="";if(0<t?.length)try{const e=Array.from(t,t=>String.fromCharCode(t)).join("");s=btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}catch(t){e?.(t)}return s}(new Uint8Array(l),this.m),d={sessionId:this.p,timestamp:r,signature:u};Object.assign(d,Object.fromEntries(n));const g=i.baseUrl?`${i.baseUrl}${t}`:this.v?`${this.v}${t}`:t,S=i.method||"POST";o=await fetch(g,{method:S,headers:{"Content-Type":"application/json",...i.headers},body:JSON.stringify(d)}),o.ok?this.l():401===o.status&&this.clearSession()}else r=new Error("Session not configured")}catch(t){r=t instanceof Error?t:new Error(String(t))}finally{this.h()}if(r)throw r;return o}async signedRequestJson(t,e,s={}){let i,o;try{const r=await this.signedRequest(t,e,s);r.ok?i=await r.json():o=new Error(`Request failed with status ${r.status}`)}catch(t){o=t instanceof Error?t:new Error(String(t))}if(o)throw o;return i}}s.q=new Set(["undefined","string","number"]);export{s as SignedRequester};

package/dist/Common.d.ts

@@ -4,3 +4,5 @@ export declare function randomBytes(bytes: number): Uint8Array<ArrayBuffer>;
 export declare function randomInt(min: number, max: number): number;
 export declare function constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean;
 export declare function hmacSha256(keyBytes: Uint8Array<ArrayBuffer>, data: string): Promise<Uint8Array<ArrayBuffer>>;
+export declare const base64Verify: RegExp;
+export declare const base64UrlVerify: RegExp;

package/dist/Common.js

@@ -1,5 +1,5 @@
 export function fromBase64Url(b64url) {
-    const pad = (4 - (b64url.length % 4)) % 4;
+    const pad = (4 - (b64url?.length % 4)) % 4;
     const b64 = (b64url + "=".repeat(pad)).replace(/-/g, "+").replace(/_/g, "/");
     const binary = atob(b64);
     const cFL = binary.length;
@@ -43,3 +43,5 @@ export async function hmacSha256(keyBytes, data) {
     const signature = await crypto.subtle.sign("HMAC", key, textEncoder.encode(data));
     return new Uint8Array(signature);
 }
+export const base64Verify = /^(?=.)(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+export const base64UrlVerify = /^(?=.)(?:[A-Za-z0-9\-_]{4})*(?:[A-Za-z0-9\-_]{2}(?:==)?|[A-Za-z0-9\-_]{3}=?)?$/;

package/dist/SignedRequestsManager.js

@@ -1,4 +1,4 @@
-import { constantTimeEqual, fromBase64Url, hmacSha256 } from './Common.js';
+import { base64UrlVerify, constantTimeEqual, fromBase64Url, hmacSha256 } from './Common.js';
 import { SessionsStorageLocal } from './SessionsStorageLocal.js';
 export class SignedRequestsManager {
     static _primitives = new Set(['string', 'number', 'boolean']);
@@ -61,12 +61,13 @@ export class SignedRequestsManager {
                     break;
                 }
                 case 'POST': {
-                    switch (context.req.header('Content-Type')) {
+                    switch (context.req.header('Content-Type')?.split(';')[0].trim().toLowerCase()) {
                         case 'application/json': {
                             Object.assign(parameters, await context.req.json());
                             break;
                         }
-                        default: {
+                        case 'multipart/form-data':
+                        case 'application/x-www-form-urlencoded': {
                             Object.assign(parameters, await context.req.parseBody());
                             break;
                         }
@@ -75,11 +76,18 @@ export class SignedRequestsManager {
             }
             const sessionId = parseInt(parameters.sessionId, 10);
             const timestamp = parseInt(parameters.timestamp, 10);
-            const signature = fromBase64Url(parameters.signature);
-            if (sessionId && timestamp && signature) {
-                const { sessionId: _, timestamp: __, signature: ___, ...other } = parameters;
-                const otherParameters = Object.entries(other);
-                session = await this.validate(sessionId, timestamp, otherParameters, signature);
+            if (sessionId && timestamp) {
+                if (parameters.signature) {
+                    if (base64UrlVerify.test(parameters.signature)) {
+                        const signature = fromBase64Url(parameters.signature);
+                        const { sessionId: _, timestamp: __, signature: ___, ...other } = parameters;
+                        const otherParameters = Object.entries(other);
+                        session = await this.validate(sessionId, timestamp, otherParameters, signature);
+                    }
+                    else {
+                        throw new Error('Invalid signature format');
+                    }
+                }
             }
         }
         catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stefanobalocco/honosignedrequests",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "An hono middleware to manage signed requests, including a client implementation.",
   "author": "Stefano Balocco <stefano.balocco@gmail.com>",
   "license": "BSD-3-Clause",
@@ -25,6 +25,13 @@
       "import": "./client/dist/SignedRequester.min.js"
     }
   },
+  "scripts": {
+    "build": "npm run build:server && npm run build:client && npm run build:tests",
+    "build:server": "tsc",
+    "build:client": "tsc -p client/tsconfig.json && terser client/dist/SignedRequester.js -o client/dist/SignedRequester.min.js --toplevel -m -c --mangle-props regex=/^_/",
+    "build:tests": "tsc -p tests/tsconfig.json",
+    "run:tests": "npx ava tests/dist/*.test.js --verbose"
+  },
   "devDependencies": {
     "@hono/node-server": "^1.13.7",
     "@types/node": "^22.10.5",
@@ -49,12 +56,5 @@
     "signed-requests",
     "session",
     "authentication"
-  ],
-  "scripts": {
-    "build": "npm run build:server && npm run build:client && npm run build:tests",
-    "build:server": "tsc",
-    "build:client": "tsc -p client/tsconfig.json && terser client/dist/SignedRequester.js -o client/dist/SignedRequester.min.js --toplevel -m -c --mangle-props regex=/^_/",
-    "build:tests": "tsc -p tests/tsconfig.json",
-    "run:tests": "npx ava tests/dist/*.test.js --verbose"
-  }
-}
+  ]
+}