@stonyx/oauth 0.1.1-alpha.30 → 0.1.1-alpha.32

package/dist/ticket-store.d.ts

@@ -75,8 +75,24 @@ export interface RedeemedTicket {
  * The extraction is tracked at `abofs/stonyx-oauth#58`.
  */
 export default class TicketStore {
+    /**
+     * Live tickets, keyed by the **SHA-256 of the ticket**, never by the ticket.
+     *
+     * Same discipline as `OAuth.pendingStates`, which holds `bindingHash` and
+     * never the binding value: a ticket is a client-presented secret looked up
+     * server-side, so a heap dump, a debug serialisation or an accidental log of
+     * this map should yield a useless digest rather than a live redeemable
+     * credential. The two secret stores in this module now agree.
+     *
+     * No constant-time comparison is needed and none is used: lookup is a hash
+     * probe on a 256-bit high-entropy key, not a secret-dependent byte
+     * comparison, so there is no early-exit timing signal to exploit. That is
+     * the same reason `redeem` can stay an ordinary `Map.get`.
+     */
     tickets: Map<string, TicketRecord>;
     ttl: number;
+    /** SHA-256 of a ticket, hex — the only form this store keeps on the heap. */
+    static hash(ticket: string): string;
     /**
      * Mints a ticket for a freshly created session.
      *

package/dist/ticket-store.js

@@ -1,4 +1,4 @@
-import { randomBytes } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 /**
  * Lifetime of an exchange ticket.
  *
@@ -67,8 +67,26 @@ export const TICKET_BYTES = 32;
  * The extraction is tracked at `abofs/stonyx-oauth#58`.
  */
 export default class TicketStore {
+    /**
+     * Live tickets, keyed by the **SHA-256 of the ticket**, never by the ticket.
+     *
+     * Same discipline as `OAuth.pendingStates`, which holds `bindingHash` and
+     * never the binding value: a ticket is a client-presented secret looked up
+     * server-side, so a heap dump, a debug serialisation or an accidental log of
+     * this map should yield a useless digest rather than a live redeemable
+     * credential. The two secret stores in this module now agree.
+     *
+     * No constant-time comparison is needed and none is used: lookup is a hash
+     * probe on a 256-bit high-entropy key, not a secret-dependent byte
+     * comparison, so there is no early-exit timing signal to exploit. That is
+     * the same reason `redeem` can stay an ordinary `Map.get`.
+     */
     tickets = new Map();
     ttl = TICKET_TTL_MS;
+    /** SHA-256 of a ticket, hex — the only form this store keeps on the heap. */
+    static hash(ticket) {
+        return createHash('sha256').update(ticket).digest('hex');
+    }
     /**
      * Mints a ticket for a freshly created session.
      *
@@ -77,7 +95,7 @@ export default class TicketStore {
      */
     issue(sessionId, expiresAt) {
         const ticket = randomBytes(TICKET_BYTES).toString('base64url');
-        this.tickets.set(ticket, { sessionId, expiresAt, createdAt: Date.now() });
+        this.tickets.set(TicketStore.hash(ticket), { sessionId, expiresAt, createdAt: Date.now() });
         return ticket;
     }
     /**
@@ -95,10 +113,11 @@ export default class TicketStore {
      * holder of a ticket they did not mint has no business having.
      */
     redeem(ticket) {
-        const record = ticket ? this.tickets.get(ticket) : undefined;
+        const key = ticket ? TicketStore.hash(ticket) : null;
+        const record = key ? this.tickets.get(key) : undefined;
         if (!record)
             return null;
-        this.tickets.delete(ticket);
+        this.tickets.delete(key);
         if (Date.now() - record.createdAt > this.ttl)
             return null;
         return { sessionId: record.sessionId, expiresAt: record.expiresAt };

package/package.json

@@ -4,7 +4,7 @@
     "stonyx-async",
     "stonyx-module"
   ],
-  "version": "0.1.1-alpha.30",
+  "version": "0.1.1-alpha.32",
   "description": "OAuth2 authentication module for the Stonyx framework",
   "repository": {
     "type": "git",

package/src/ticket-store.ts

@@ -1,4 +1,4 @@
-import { randomBytes } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 
 /**
  * Lifetime of an exchange ticket.
@@ -81,9 +81,28 @@ export interface RedeemedTicket {
  * The extraction is tracked at `abofs/stonyx-oauth#58`.
  */
 export default class TicketStore {
+  /**
+   * Live tickets, keyed by the **SHA-256 of the ticket**, never by the ticket.
+   *
+   * Same discipline as `OAuth.pendingStates`, which holds `bindingHash` and
+   * never the binding value: a ticket is a client-presented secret looked up
+   * server-side, so a heap dump, a debug serialisation or an accidental log of
+   * this map should yield a useless digest rather than a live redeemable
+   * credential. The two secret stores in this module now agree.
+   *
+   * No constant-time comparison is needed and none is used: lookup is a hash
+   * probe on a 256-bit high-entropy key, not a secret-dependent byte
+   * comparison, so there is no early-exit timing signal to exploit. That is
+   * the same reason `redeem` can stay an ordinary `Map.get`.
+   */
   tickets = new Map<string, TicketRecord>();
   ttl = TICKET_TTL_MS;
 
+  /** SHA-256 of a ticket, hex — the only form this store keeps on the heap. */
+  static hash(ticket: string): string {
+    return createHash('sha256').update(ticket).digest('hex');
+  }
+
   /**
    * Mints a ticket for a freshly created session.
    *
@@ -92,7 +111,7 @@ export default class TicketStore {
    */
   issue(sessionId: string, expiresAt: number): string {
     const ticket = randomBytes(TICKET_BYTES).toString('base64url');
-    this.tickets.set(ticket, { sessionId, expiresAt, createdAt: Date.now() });
+    this.tickets.set(TicketStore.hash(ticket), { sessionId, expiresAt, createdAt: Date.now() });
     return ticket;
   }
 
@@ -111,10 +130,11 @@ export default class TicketStore {
    * holder of a ticket they did not mint has no business having.
    */
   redeem(ticket: string): RedeemedTicket | null {
-    const record = ticket ? this.tickets.get(ticket) : undefined;
+    const key = ticket ? TicketStore.hash(ticket) : null;
+    const record = key ? this.tickets.get(key) : undefined;
     if (!record) return null;
 
-    this.tickets.delete(ticket);
+    this.tickets.delete(key!);
 
     if (Date.now() - record.createdAt > this.ttl) return null;