@vardario/cognito-client 4.0.4 → 4.0.6

package/lib/cognito-client.js

@@ -1,8 +1,5 @@
-import hashJs from 'hash.js';
-import { BigInteger } from 'jsbn';
-import { Buffer } from 'buffer';
 import { ChangePasswordError, ConfirmForgotPasswordError, ConfirmSignUpError, ForgotPasswordError, GlobalSignOutError, InitAuthError, ResendConfirmationCodeError, RespondToAuthChallengeError, RevokeTokenError, SignUpError, UpdateUserAttributesError, VerifyUserAttributeError, COMMON_EXCEPTIONS, CommonError } from './error.js';
-import { calculateSecretHash, calculateSignature, calculateU, decodeJwt, generateA, generateSmallA, getPasswordAuthenticationKey, randomBytes } from './utils.js';
+import { calculateSecretHash, calculateSignature, calculateU, decodeJwt, digest, generateA, generateSmallA, getPasswordAuthenticationKey, randomBytes, uint8ArrayFromString, uint8ArrayToBase64String } from './utils.js';
 /**
  * List of used and supported Cognito API calls.
  * @see https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_Operations.html for more details
@@ -143,16 +140,16 @@ export class CognitoClient {
             AuthParameters: {
                 USERNAME: username,
                 SRP_A: A.toString(16),
-                SECRET_HASH: this.clientSecret && calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+                SECRET_HASH: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
             },
             ClientMetadata: {}
         };
         const challenge = (await cognitoRequest(initiateAuthPayload, ServiceTarget.InitiateAuth, this.cognitoEndpoint));
-        const B = new BigInteger(challenge.ChallengeParameters.SRP_B, 16);
-        const salt = new BigInteger(challenge.ChallengeParameters.SALT, 16);
-        const U = calculateU(A, B);
-        const hkdf = getPasswordAuthenticationKey(this.cognitoPoolName, challenge.ChallengeParameters.USER_ID_FOR_SRP, password, B, U, smallA, salt);
-        const { signature, timeStamp } = calculateSignature(this.cognitoPoolName, challenge.ChallengeParameters.USER_ID_FOR_SRP, challenge.ChallengeParameters.SECRET_BLOCK, hkdf);
+        const B = BigInt('0x' + challenge.ChallengeParameters.SRP_B);
+        const salt = BigInt('0x' + challenge.ChallengeParameters.SALT);
+        const U = await calculateU(A, B);
+        const hkdf = await getPasswordAuthenticationKey(this.cognitoPoolName, challenge.ChallengeParameters.USER_ID_FOR_SRP, password, B, U, smallA, salt);
+        const { signature, timeStamp } = await calculateSignature(this.cognitoPoolName, challenge.ChallengeParameters.USER_ID_FOR_SRP, challenge.ChallengeParameters.SECRET_BLOCK, hkdf);
         const respondToAuthChallengeRequest = {
             ChallengeName: 'PASSWORD_VERIFIER',
             ClientId: this.userPoolClientId,
@@ -162,7 +159,7 @@ export class CognitoClient {
                 USERNAME: challenge.ChallengeParameters.USER_ID_FOR_SRP,
                 TIMESTAMP: timeStamp,
                 SECRET_HASH: this.clientSecret &&
-                    calculateSecretHash(this.clientSecret, this.userPoolClientId, challenge.ChallengeParameters.USER_ID_FOR_SRP)
+                    (await calculateSecretHash(this.clientSecret, this.userPoolClientId, challenge.ChallengeParameters.USER_ID_FOR_SRP))
             },
             ClientMetadata: {}
         };
@@ -185,7 +182,7 @@ export class CognitoClient {
             AuthParameters: {
                 USERNAME: username,
                 PASSWORD: password,
-                SECRET_HASH: this.clientSecret && calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+                SECRET_HASH: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
             },
             ClientMetadata: {}
         };
@@ -207,7 +204,9 @@ export class CognitoClient {
             ClientId: this.userPoolClientId,
             AuthParameters: {
                 REFRESH_TOKEN: refreshToken,
-                SECRET_HASH: this.clientSecret && username && calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+                SECRET_HASH: this.clientSecret &&
+                    username &&
+                    (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
             },
             ClientMetadata: {}
         };
@@ -230,7 +229,7 @@ export class CognitoClient {
             Username: username,
             Password: password,
             UserAttributes: userAttributes,
-            SecretHash: this.clientSecret && calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+            SecretHash: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
         };
         const data = await cognitoRequest(signUpRequest, ServiceTarget.SignUp, this.cognitoEndpoint);
         return {
@@ -251,7 +250,7 @@ export class CognitoClient {
             ClientId: this.userPoolClientId,
             ConfirmationCode: code,
             Username: username,
-            SecretHash: this.clientSecret && calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+            SecretHash: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
         };
         await cognitoRequest(confirmSignUpRequest, ServiceTarget.ConfirmSignUp, this.cognitoEndpoint);
     }
@@ -327,7 +326,7 @@ export class CognitoClient {
         const forgotPasswordRequest = {
             ClientId: this.userPoolClientId,
             Username: username,
-            SecretHash: this.clientSecret && calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+            SecretHash: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
         };
         await cognitoRequest(forgotPasswordRequest, ServiceTarget.ForgotPassword, this.cognitoEndpoint);
     }
@@ -346,7 +345,7 @@ export class CognitoClient {
             Username: username,
             ConfirmationCode: confirmationCode,
             Password: newPassword,
-            SecretHash: this.clientSecret && calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+            SecretHash: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
         };
         await cognitoRequest(confirmForgotPasswordRequest, ServiceTarget.ConfirmForgotPassword, this.cognitoEndpoint);
     }
@@ -360,7 +359,7 @@ export class CognitoClient {
         const resendConfirmationCodeRequest = {
             ClientId: this.userPoolClientId,
             Username: username,
-            SecretHash: this.clientSecret && calculateSecretHash(this.clientSecret, this.userPoolClientId, username)
+            SecretHash: this.clientSecret && (await calculateSecretHash(this.clientSecret, this.userPoolClientId, username))
         };
         await cognitoRequest(resendConfirmationCodeRequest, ServiceTarget.ResendConfirmationCode, this.cognitoEndpoint);
     }
@@ -379,8 +378,7 @@ export class CognitoClient {
         }
         const state = (await randomBytes(32)).toString('hex');
         const pkce = (await randomBytes(128)).toString('hex');
-        const code_challenge = Buffer.from(hashJs.sha256().update(pkce).digest())
-            .toString('base64')
+        const code_challenge = uint8ArrayToBase64String(await digest('SHA-256', uint8ArrayFromString(pkce)))
             .replace(/\+/g, '-')
             .replace(/\//g, '_')
             .replace(/=+$/, '');

package/lib/utils.d.ts

@@ -1,19 +1,22 @@
 /// <reference types="node" resolution-mode="require"/>
-import { BigInteger } from 'jsbn';
-import { Buffer } from 'buffer';
-export declare function padHex(bigInt: BigInteger): string;
-export declare function hashHexString(str: string): string;
-export declare function hashBuffer(buffer: Buffer): string;
-export declare function generateSmallA(): Promise<BigInteger>;
-export declare function generateA(smallA: BigInteger): BigInteger;
-export declare function calculateU(A: BigInteger, B: BigInteger): BigInteger;
-export declare function calculateS(X: BigInteger, B: BigInteger, U: BigInteger, smallA: BigInteger): BigInteger;
-export declare function calculateHKDF(ikm: Buffer, salt: Buffer): number[];
-export declare function getPasswordAuthenticationKey(poolName: string, username: string, password: string, B: BigInteger, U: BigInteger, smallA: BigInteger, salt: BigInteger): number[];
-export declare function calculateSignature(poolName: string, userId: string, secretBlock: string, hkdf: number[], date?: Date): {
+export declare function uint8ArrayFromHexString(hexString: string): Uint8Array;
+export declare function uint8ArrayFromString(str: string): Uint8Array;
+export declare function uint8ArrayFromBase64String(str: string): Uint8Array;
+export declare function uint8ArrayToHexString(bytes: Uint8Array): string;
+export declare function uint8ArrayToBase64String(bytes: Uint8Array): string;
+export declare function padHex(bigInt: bigint): string;
+export declare function hashHexString(str: string): Promise<string>;
+export declare function hashBuffer(buffer: Uint8Array): Promise<string>;
+export declare function generateSmallA(): Promise<bigint>;
+export declare function generateA(smallA: bigint): bigint;
+export declare function calculateU(A: bigint, B: bigint): Promise<bigint>;
+export declare function calculateS(X: bigint, B: bigint, U: bigint, smallA: bigint): bigint;
+export declare function calculateHKDF(ikm: Uint8Array, salt: Uint8Array): Promise<Uint8Array>;
+export declare function getPasswordAuthenticationKey(poolName: string, username: string, password: string, B: bigint, U: bigint, smallA: bigint, salt: bigint): Promise<Uint8Array>;
+export declare function calculateSignature(poolName: string, userId: string, secretBlock: string, hkdf: Uint8Array, date?: Date): Promise<{
     signature: string;
     timeStamp: string;
-};
+}>;
 export declare function decodeJwt<T = unknown>(jwt: string): {
     header: any;
     payload: T;
@@ -21,4 +24,6 @@ export declare function decodeJwt<T = unknown>(jwt: string): {
 };
 export declare function randomBytes(num: number): Promise<Buffer>;
 export declare function formatTimestamp(date: Date): string;
-export declare function calculateSecretHash(clientSecret: string, userPoolClientId: string, username: string): string;
+export declare function calculateSecretHash(clientSecret: string, userPoolClientId: string, username: string): Promise<string>;
+export declare function digest(algorithm: AlgorithmIdentifier, data: Uint8Array): Promise<Uint8Array>;
+export declare function hmac(algorithm: AlgorithmIdentifier, key: Uint8Array, data: Uint8Array): Promise<Uint8Array>;

package/lib/utils.js

@@ -1,9 +1,28 @@
-import hashJs from 'hash.js';
-import { BigInteger } from 'jsbn';
-import { Buffer } from 'buffer';
-import formatInTimeZone from 'date-fns-tz/formatInTimeZone';
-import { random } from '@lukeed/csprng';
-const initN = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1' +
+import * as bigIntMath from './bigint-math.js';
+const WEEK_DAYS = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+const MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+export function uint8ArrayFromHexString(hexString) {
+    return Uint8Array.from(hexString.match(/.{1,2}/g).map(byte => parseInt(byte, 16)));
+}
+export function uint8ArrayFromString(str) {
+    const textEncoder = new TextEncoder();
+    return textEncoder.encode(str);
+}
+export function uint8ArrayFromBase64String(str) {
+    const binaryString = atob(str);
+    const bytes = new Uint8Array(binaryString.length);
+    for (let i = 0; i < binaryString.length; i++) {
+        bytes[i] = binaryString.charCodeAt(i);
+    }
+    return bytes;
+}
+export function uint8ArrayToHexString(bytes) {
+    return bytes.reduce((str, byte) => str + byte.toString(16).padStart(2, '0'), '');
+}
+export function uint8ArrayToBase64String(bytes) {
+    return btoa(String.fromCharCode(...bytes));
+}
+const N = BigInt('0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1' +
     '29024E088A67CC74020BBEA63B139B22514A08798E3404DD' +
     'EF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245' +
     'E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' +
@@ -18,14 +37,13 @@ const initN = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1' +
     'ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6B' +
     'F12FFA06D98A0864D87602733EC86A64521F2B18177B200C' +
     'BBE117577A615D6C770988C0BAD946E208E24FA074E5AB31' +
-    '43DB5BFCE0FD108E4B82D120A93AD2CAFFFFFFFFFFFFFFFF';
-const N = new BigInteger(initN, 16);
-const g = new BigInteger('2', 16);
-const k = new BigInteger(hashHexString(`${padHex(N)}${padHex(g)}`), 16);
+    '43DB5BFCE0FD108E4B82D120A93AD2CAFFFFFFFFFFFFFFFF');
+const g = BigInt('0x2');
+const k = BigInt('0x538282c4354742d7cbbde2359fcf67f9f5b3a6b08791e5011b43b8a5b66d9ee6');
 export function padHex(bigInt) {
     const HEX_MSB_REGEX = /^[89a-f]/i;
-    const isNegative = bigInt.compareTo(BigInteger.ZERO) < 0;
-    let hexStr = bigInt.abs().toString(16);
+    const isNegative = bigInt < 0n;
+    let hexStr = bigIntMath.abs(bigInt).toString(16);
     hexStr = hexStr.length % 2 !== 0 ? `0${hexStr}` : hexStr;
     hexStr = HEX_MSB_REGEX.test(hexStr) ? `00${hexStr}` : hexStr;
     if (isNegative) {
@@ -36,7 +54,7 @@ export function padHex(bigInt) {
             return '0123456789ABCDEF'.charAt(invertedNibble);
         })
             .join('');
-        const flippedBitsBI = new BigInteger(invertedNibbles, 16).add(BigInteger.ONE);
+        const flippedBitsBI = BigInt('0x' + invertedNibbles) + 1n;
         hexStr = flippedBitsBI.toString(16);
         if (hexStr.toUpperCase().startsWith('FF8')) {
             hexStr = hexStr.substring(2);
@@ -44,62 +62,53 @@ export function padHex(bigInt) {
     }
     return hexStr;
 }
-export function hashHexString(str) {
-    return hashBuffer(Buffer.from(str, 'hex'));
+export async function hashHexString(str) {
+    return hashBuffer(uint8ArrayFromHexString(str));
 }
-export function hashBuffer(buffer) {
-    const hash = hashJs.sha256().update(buffer).digest('hex');
-    return new Array(64 - hash.length).join('0') + hash;
+export async function hashBuffer(buffer) {
+    const hashArray = await digest('SHA-256', buffer);
+    return uint8ArrayToHexString(hashArray);
 }
 export async function generateSmallA() {
-    return new BigInteger((await randomBytes(128)).toString('hex'), 16);
+    return BigInt('0x' + (await randomBytes(128)).toString('hex'));
 }
 export function generateA(smallA) {
-    const A = g.modPow(smallA, N);
+    const A = bigIntMath.modPow(g, smallA, N);
     return A;
 }
-export function calculateU(A, B) {
-    return new BigInteger(hashHexString(padHex(A) + padHex(B)), 16);
+export async function calculateU(A, B) {
+    return BigInt('0x' + (await hashHexString(padHex(A) + padHex(B))));
 }
 export function calculateS(X, B, U, smallA) {
-    const gModPowXN = g.modPow(X, N);
-    const bMinusKMult = B.subtract(k.multiply(gModPowXN));
-    return bMinusKMult.modPow(smallA.add(U.multiply(X)), N).mod(N);
-}
-export function calculateHKDF(ikm, salt) {
-    const infoBitsBuffer = Buffer.concat([
-        Buffer.from('Caldera Derived Key', 'utf8'),
-        Buffer.from(String.fromCharCode(1), 'utf8')
+    const gModPowXN = bigIntMath.modPow(g, X, N);
+    const bMinusKMult = B - k * gModPowXN;
+    return bigIntMath.modPow(bMinusKMult, smallA + U * X, N) % N;
+}
+export async function calculateHKDF(ikm, salt) {
+    const infoBitsBuffer = new Uint8Array([
+        ...uint8ArrayFromString('Caldera Derived Key'),
+        ...uint8ArrayFromString(String.fromCharCode(1))
     ]);
-    const prk = hashJs
-        .hmac(hashJs.sha256, salt)
-        .update(ikm)
-        .digest();
-    const hmacResult = hashJs
-        .hmac(hashJs.sha256, prk)
-        .update(infoBitsBuffer)
-        .digest();
+    const prk = await hmac('SHA-256', salt, ikm);
+    const hmacResult = await hmac('SHA-256', prk, infoBitsBuffer);
     return hmacResult.slice(0, 16);
 }
-export function getPasswordAuthenticationKey(poolName, username, password, B, U, smallA, salt) {
+export async function getPasswordAuthenticationKey(poolName, username, password, B, U, smallA, salt) {
     const usernamePassword = `${poolName}${username}:${password}`;
-    const usernamePasswordHash = hashBuffer(Buffer.from(usernamePassword, 'utf-8'));
-    const X = new BigInteger(hashHexString(padHex(salt) + usernamePasswordHash), 16);
+    const usernamePasswordHash = await hashBuffer(uint8ArrayFromString(usernamePassword));
+    const X = BigInt('0x' + (await hashHexString(padHex(salt) + usernamePasswordHash)));
     const S = calculateS(X, B, U, smallA);
-    return calculateHKDF(Buffer.from(padHex(S), 'hex'), Buffer.from(padHex(U), 'hex'));
+    return calculateHKDF(uint8ArrayFromHexString(padHex(S)), uint8ArrayFromHexString(padHex(U)));
 }
-export function calculateSignature(poolName, userId, secretBlock, hkdf, date = new Date()) {
+export async function calculateSignature(poolName, userId, secretBlock, hkdf, date = new Date()) {
     const timeStamp = formatTimestamp(date);
-    const concatBuffer = Buffer.concat([
-        Buffer.from(poolName, 'utf8'),
-        Buffer.from(userId, 'utf8'),
-        Buffer.from(secretBlock, 'base64'),
-        Buffer.from(timeStamp, 'utf8')
+    const concatBuffer = new Uint8Array([
+        ...uint8ArrayFromString(poolName),
+        ...uint8ArrayFromString(userId),
+        ...uint8ArrayFromBase64String(secretBlock),
+        ...uint8ArrayFromString(timeStamp)
     ]);
-    const signature = Buffer.from(hashJs
-        .hmac(hashJs.sha256, hkdf)
-        .update(concatBuffer)
-        .digest()).toString('base64');
+    const signature = uint8ArrayToBase64String(await hmac('SHA-256', hkdf, concatBuffer));
     return {
         signature,
         timeStamp
@@ -114,16 +123,31 @@ export function decodeJwt(jwt) {
     };
 }
 export async function randomBytes(num) {
-    return random(num);
+    return Buffer.from(crypto.getRandomValues(new Uint8Array(num)));
 }
 export function formatTimestamp(date) {
-    return formatInTimeZone(date, 'UTC', "EEE MMM d HH:mm:ss 'UTC' yyyy");
+    return `${WEEK_DAYS[date.getUTCDay()]} ${MONTHS[date.getUTCMonth()]} ${date.getUTCDate()} ${date
+        .getUTCHours()
+        .toString()
+        .padStart(2, '0')}:${date.getUTCMinutes().toString().padStart(2, '0')}:${date
+        .getUTCSeconds()
+        .toString()
+        .padStart(2, '0')} UTC ${date.getUTCFullYear()}`;
 }
-export function calculateSecretHash(clientSecret, userPoolClientId, username) {
+export async function calculateSecretHash(clientSecret, userPoolClientId, username) {
     const message = `${username}${userPoolClientId}`;
-    const hash = Buffer.from(hashJs
-        .hmac(hashJs.sha256, clientSecret)
-        .update(message)
-        .digest()).toString('base64');
+    const hash = uint8ArrayToBase64String(await hmac('SHA-256', uint8ArrayFromString(clientSecret), uint8ArrayFromString(message)));
     return hash;
 }
+export async function digest(algorithm, data) {
+    const hashBuffer = await crypto.subtle.digest(algorithm, data);
+    return new Uint8Array(hashBuffer);
+}
+export async function hmac(algorithm, key, data) {
+    const cryptoKey = await crypto.subtle.importKey('raw', key, {
+        name: 'HMAC',
+        hash: algorithm
+    }, false, ['sign']);
+    const signature = await crypto.subtle.sign('HMAC', cryptoKey, data);
+    return new Uint8Array(signature);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vardario/cognito-client",
-  "version": "4.0.4",
+  "version": "4.0.6",
   "description": "",
   "license": "MIT",
   "author": "Sahin Vardar",
@@ -10,31 +10,26 @@
   },
   "type": "module",
   "main": "lib/index.js",
+  "browser": "lib/browser.js",
   "files": [
     "lib"
   ],
   "scripts": {
-    "build": "tsc --build",
+    "build": "pnpm build:lib && pnpm build:browser",
+    "build:browser": "esbuild src/index.ts --bundle --outfile=lib/browser.js --platform=neutral --external:zod",
+    "build:lib": "tsc --build",
     "format": "prettier --plugin-search-dir . --write . && prettier-package-json --write && eslint --fix .",
     "integration-test": "vitest run integration",
     "prepare": "husky install",
     "test": "vitest run unit",
     "watch": "tsc --build --watch"
   },
-  "dependencies": {
-    "@lukeed/csprng": "^1.1.0",
-    "buffer": "^6.0.3",
-    "date-fns-tz": "^2.0.0",
-    "hash.js": "^1.1.7",
-    "jsbn": "^1.1.0"
-  },
   "devDependencies": {
     "@aws-sdk/client-cognito-identity-provider": "^3.465.0",
-    "@types/jsbn": "^1.2.33",
     "@types/jsdom": "^21.1.5",
-    "@types/randombytes": "^2.0.3",
     "@typescript-eslint/eslint-plugin": "^6.11.0",
     "@typescript-eslint/parser": "^6.11.0",
+    "esbuild": "^0.20.2",
     "eslint": "^8.54.0",
     "eslint-config-prettier": "^9.0.0",
     "eslint-plugin-unused-imports": "^3.0.0",
@@ -46,6 +41,7 @@
     "prettier-package-json": "^2.8.0",
     "semantic-release": "^22.0.8",
     "testcontainers": "^10.2.2",
+    "tsx": "^4.7.1",
     "typescript": "^5.2.2",
     "vitest": "^0.34.6",
     "vitest-fetch-mock": "^0.2.2"