@xivdyetools/auth 1.0.2 → 1.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +171 -158
- package/dist/hmac.d.ts.map +1 -1
- package/dist/hmac.js +4 -3
- package/dist/hmac.js.map +1 -1
- package/dist/jwt.js.map +1 -1
- package/dist/timing.d.ts.map +1 -1
- package/dist/timing.js +4 -2
- package/dist/timing.js.map +1 -1
- package/package.json +75 -71
- package/src/discord.test.ts +243 -243
- package/src/discord.ts +143 -143
- package/src/hmac.test.ts +325 -325
- package/src/hmac.ts +223 -222
- package/src/index.ts +54 -54
- package/src/jwt.test.ts +337 -337
- package/src/jwt.ts +265 -265
- package/src/timing.test.ts +114 -117
- package/src/timing.ts +86 -84
package/README.md
CHANGED
|
@@ -1,158 +1,171 @@
|
|
|
1
|
-
# @xivdyetools/auth
|
|
2
|
-
|
|
3
|
-
Shared authentication utilities for the xivdyetools ecosystem. Provides secure JWT verification, HMAC signing, timing-safe comparison, and Discord signature verification.
|
|
4
|
-
|
|
5
|
-
## Installation
|
|
6
|
-
|
|
7
|
-
```bash
|
|
8
|
-
npm install @xivdyetools/auth
|
|
9
|
-
```
|
|
10
|
-
|
|
11
|
-
## Features
|
|
12
|
-
|
|
13
|
-
- **JWT Verification** - HMAC-SHA256 JWT verification with algorithm validation
|
|
14
|
-
- **HMAC Signing** - Create and verify HMAC-SHA256 signatures
|
|
15
|
-
- **Timing-Safe Comparison** - Constant-time string comparison to prevent timing attacks
|
|
16
|
-
- **Discord Verification** - Ed25519 signature verification for Discord interactions
|
|
17
|
-
- **Tree-Shakeable** - Subpath exports for minimal bundle size
|
|
18
|
-
|
|
19
|
-
## Usage
|
|
20
|
-
|
|
21
|
-
### JWT Verification
|
|
22
|
-
|
|
23
|
-
```typescript
|
|
24
|
-
import { verifyJWT, decodeJWT, isJWTExpired } from '@xivdyetools/auth';
|
|
25
|
-
|
|
26
|
-
// Verify JWT with signature and expiration checking
|
|
27
|
-
const payload = await verifyJWT(token, process.env.JWT_SECRET);
|
|
28
|
-
if (!payload) {
|
|
29
|
-
// Invalid signature, expired, or wrong algorithm
|
|
30
|
-
}
|
|
31
|
-
|
|
32
|
-
// Decode without verification (debugging only)
|
|
33
|
-
const decoded = decodeJWT(token);
|
|
34
|
-
|
|
35
|
-
// Check if JWT is expired
|
|
36
|
-
if (isJWTExpired(payload)) {
|
|
37
|
-
// Token has expired
|
|
38
|
-
}
|
|
39
|
-
```
|
|
40
|
-
|
|
41
|
-
### HMAC Signing
|
|
42
|
-
|
|
43
|
-
```typescript
|
|
44
|
-
import { hmacSign, hmacVerify, verifyBotSignature } from '@xivdyetools/auth';
|
|
45
|
-
|
|
46
|
-
// Sign data with HMAC-SHA256 (base64url output)
|
|
47
|
-
const signature = await hmacSign(data, secret);
|
|
48
|
-
|
|
49
|
-
// Verify signature
|
|
50
|
-
const isValid = await hmacVerify(data, signature, secret);
|
|
51
|
-
|
|
52
|
-
// Verify bot request signature (with timestamp validation)
|
|
53
|
-
const isValidBot = await verifyBotSignature(
|
|
54
|
-
signature, // X-Request-Signature header
|
|
55
|
-
timestamp, // X-Request-Timestamp header
|
|
56
|
-
userDiscordId,
|
|
57
|
-
userName,
|
|
58
|
-
secret,
|
|
59
|
-
{ maxAgeMs: 5 * 60 * 1000 } // Optional: 5 minute max age
|
|
60
|
-
);
|
|
61
|
-
```
|
|
62
|
-
|
|
63
|
-
### Timing-Safe Comparison
|
|
64
|
-
|
|
65
|
-
```typescript
|
|
66
|
-
import { timingSafeEqual } from '@xivdyetools/auth';
|
|
67
|
-
|
|
68
|
-
// Constant-time string comparison (prevents timing attacks)
|
|
69
|
-
const isEqual = await timingSafeEqual(userInput, expectedValue);
|
|
70
|
-
```
|
|
71
|
-
|
|
72
|
-
### Discord Signature Verification
|
|
73
|
-
|
|
74
|
-
```typescript
|
|
75
|
-
import { verifyDiscordRequest } from '@xivdyetools/auth';
|
|
76
|
-
|
|
77
|
-
// Verify Discord interaction signature
|
|
78
|
-
const result = await verifyDiscordRequest(request, env.DISCORD_PUBLIC_KEY);
|
|
79
|
-
|
|
80
|
-
if (!result.valid) {
|
|
81
|
-
return new Response('Unauthorized', { status: 401 });
|
|
82
|
-
}
|
|
83
|
-
|
|
84
|
-
// result.body contains the parsed interaction
|
|
85
|
-
const interaction = result.body;
|
|
86
|
-
```
|
|
87
|
-
|
|
88
|
-
## Subpath Exports
|
|
89
|
-
|
|
90
|
-
Import only what you need for optimal tree-shaking:
|
|
91
|
-
|
|
92
|
-
```typescript
|
|
93
|
-
// JWT utilities only
|
|
94
|
-
import { verifyJWT, decodeJWT } from '@xivdyetools/auth/jwt';
|
|
95
|
-
|
|
96
|
-
// HMAC utilities only
|
|
97
|
-
import { hmacSign, hmacVerify } from '@xivdyetools/auth/hmac';
|
|
98
|
-
|
|
99
|
-
// Timing utilities only
|
|
100
|
-
import { timingSafeEqual } from '@xivdyetools/auth/timing';
|
|
101
|
-
|
|
102
|
-
// Discord utilities only
|
|
103
|
-
import { verifyDiscordRequest } from '@xivdyetools/auth/discord';
|
|
104
|
-
```
|
|
105
|
-
|
|
106
|
-
## API Reference
|
|
107
|
-
|
|
108
|
-
### JWT (`@xivdyetools/auth/jwt`)
|
|
109
|
-
|
|
110
|
-
| Function | Description |
|
|
111
|
-
|----------|-------------|
|
|
112
|
-
| `verifyJWT(token, secret)` | Verify JWT signature, algorithm (HS256 only), and expiration |
|
|
113
|
-
| `verifyJWTSignatureOnly(token, secret, maxAgeMs?)` | Verify signature only (for refresh token grace periods) |
|
|
114
|
-
| `decodeJWT(token)` | Decode JWT without verification (debugging only) |
|
|
115
|
-
| `isJWTExpired(payload)` | Check if JWT payload is expired |
|
|
116
|
-
| `getJWTTimeToExpiry(payload)` | Get milliseconds until JWT expires |
|
|
117
|
-
|
|
118
|
-
### HMAC (`@xivdyetools/auth/hmac`)
|
|
119
|
-
|
|
120
|
-
| Function | Description |
|
|
121
|
-
|----------|-------------|
|
|
122
|
-
| `createHmacKey(secret, usage)` | Create CryptoKey for HMAC operations |
|
|
123
|
-
| `hmacSign(data, secret)` | Sign data, return base64url signature |
|
|
124
|
-
| `hmacSignHex(data, secret)` | Sign data, return hex signature |
|
|
125
|
-
| `hmacVerify(data, signature, secret)` | Verify base64url signature |
|
|
126
|
-
| `hmacVerifyHex(data, signature, secret)` | Verify hex signature |
|
|
127
|
-
| `verifyBotSignature(sig, ts, userId, userName, secret, opts?)` | Verify bot request signature |
|
|
128
|
-
|
|
129
|
-
### Timing (`@xivdyetools/auth/timing`)
|
|
130
|
-
|
|
131
|
-
| Function | Description |
|
|
132
|
-
|----------|-------------|
|
|
133
|
-
| `timingSafeEqual(a, b)` | Constant-time string comparison |
|
|
134
|
-
| `timingSafeEqualBytes(a, b)` | Constant-time Uint8Array comparison |
|
|
135
|
-
|
|
136
|
-
### Discord (`@xivdyetools/auth/discord`)
|
|
137
|
-
|
|
138
|
-
| Function | Description |
|
|
139
|
-
|----------|-------------|
|
|
140
|
-
| `verifyDiscordRequest(request, publicKey, opts?)` | Verify Discord Ed25519 signature |
|
|
141
|
-
| `unauthorizedResponse()` | Return 401 response |
|
|
142
|
-
| `badRequestResponse(message?)` | Return 400 response |
|
|
143
|
-
|
|
144
|
-
## Security Features
|
|
145
|
-
|
|
146
|
-
- **Algorithm Validation**: JWT verification only accepts HS256, preventing algorithm confusion attacks
|
|
147
|
-
- **Timing-Safe Comparison**: Uses `crypto.subtle.timingSafeEqual()` with XOR fallback
|
|
148
|
-
- **Timestamp Validation**: Bot signatures include clock skew tolerance and max age checks
|
|
149
|
-
- **Body Size Limits**: Discord verification enforces 100KB max body size by default
|
|
150
|
-
|
|
151
|
-
## Dependencies
|
|
152
|
-
|
|
153
|
-
- `@xivdyetools/crypto` - Base64URL and hex encoding utilities
|
|
154
|
-
- `discord-interactions` - Discord Ed25519 signature verification
|
|
155
|
-
|
|
156
|
-
##
|
|
157
|
-
|
|
158
|
-
|
|
1
|
+
# @xivdyetools/auth
|
|
2
|
+
|
|
3
|
+
Shared authentication utilities for the xivdyetools ecosystem. Provides secure JWT verification, HMAC signing, timing-safe comparison, and Discord signature verification.
|
|
4
|
+
|
|
5
|
+
## Installation
|
|
6
|
+
|
|
7
|
+
```bash
|
|
8
|
+
npm install @xivdyetools/auth
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
## Features
|
|
12
|
+
|
|
13
|
+
- **JWT Verification** - HMAC-SHA256 JWT verification with algorithm validation
|
|
14
|
+
- **HMAC Signing** - Create and verify HMAC-SHA256 signatures
|
|
15
|
+
- **Timing-Safe Comparison** - Constant-time string comparison to prevent timing attacks
|
|
16
|
+
- **Discord Verification** - Ed25519 signature verification for Discord interactions
|
|
17
|
+
- **Tree-Shakeable** - Subpath exports for minimal bundle size
|
|
18
|
+
|
|
19
|
+
## Usage
|
|
20
|
+
|
|
21
|
+
### JWT Verification
|
|
22
|
+
|
|
23
|
+
```typescript
|
|
24
|
+
import { verifyJWT, decodeJWT, isJWTExpired } from '@xivdyetools/auth';
|
|
25
|
+
|
|
26
|
+
// Verify JWT with signature and expiration checking
|
|
27
|
+
const payload = await verifyJWT(token, process.env.JWT_SECRET);
|
|
28
|
+
if (!payload) {
|
|
29
|
+
// Invalid signature, expired, or wrong algorithm
|
|
30
|
+
}
|
|
31
|
+
|
|
32
|
+
// Decode without verification (debugging only)
|
|
33
|
+
const decoded = decodeJWT(token);
|
|
34
|
+
|
|
35
|
+
// Check if JWT is expired
|
|
36
|
+
if (isJWTExpired(payload)) {
|
|
37
|
+
// Token has expired
|
|
38
|
+
}
|
|
39
|
+
```
|
|
40
|
+
|
|
41
|
+
### HMAC Signing
|
|
42
|
+
|
|
43
|
+
```typescript
|
|
44
|
+
import { hmacSign, hmacVerify, verifyBotSignature } from '@xivdyetools/auth';
|
|
45
|
+
|
|
46
|
+
// Sign data with HMAC-SHA256 (base64url output)
|
|
47
|
+
const signature = await hmacSign(data, secret);
|
|
48
|
+
|
|
49
|
+
// Verify signature
|
|
50
|
+
const isValid = await hmacVerify(data, signature, secret);
|
|
51
|
+
|
|
52
|
+
// Verify bot request signature (with timestamp validation)
|
|
53
|
+
const isValidBot = await verifyBotSignature(
|
|
54
|
+
signature, // X-Request-Signature header
|
|
55
|
+
timestamp, // X-Request-Timestamp header
|
|
56
|
+
userDiscordId,
|
|
57
|
+
userName,
|
|
58
|
+
secret,
|
|
59
|
+
{ maxAgeMs: 5 * 60 * 1000 } // Optional: 5 minute max age
|
|
60
|
+
);
|
|
61
|
+
```
|
|
62
|
+
|
|
63
|
+
### Timing-Safe Comparison
|
|
64
|
+
|
|
65
|
+
```typescript
|
|
66
|
+
import { timingSafeEqual } from '@xivdyetools/auth';
|
|
67
|
+
|
|
68
|
+
// Constant-time string comparison (prevents timing attacks)
|
|
69
|
+
const isEqual = await timingSafeEqual(userInput, expectedValue);
|
|
70
|
+
```
|
|
71
|
+
|
|
72
|
+
### Discord Signature Verification
|
|
73
|
+
|
|
74
|
+
```typescript
|
|
75
|
+
import { verifyDiscordRequest } from '@xivdyetools/auth';
|
|
76
|
+
|
|
77
|
+
// Verify Discord interaction signature
|
|
78
|
+
const result = await verifyDiscordRequest(request, env.DISCORD_PUBLIC_KEY);
|
|
79
|
+
|
|
80
|
+
if (!result.valid) {
|
|
81
|
+
return new Response('Unauthorized', { status: 401 });
|
|
82
|
+
}
|
|
83
|
+
|
|
84
|
+
// result.body contains the parsed interaction
|
|
85
|
+
const interaction = result.body;
|
|
86
|
+
```
|
|
87
|
+
|
|
88
|
+
## Subpath Exports
|
|
89
|
+
|
|
90
|
+
Import only what you need for optimal tree-shaking:
|
|
91
|
+
|
|
92
|
+
```typescript
|
|
93
|
+
// JWT utilities only
|
|
94
|
+
import { verifyJWT, decodeJWT } from '@xivdyetools/auth/jwt';
|
|
95
|
+
|
|
96
|
+
// HMAC utilities only
|
|
97
|
+
import { hmacSign, hmacVerify } from '@xivdyetools/auth/hmac';
|
|
98
|
+
|
|
99
|
+
// Timing utilities only
|
|
100
|
+
import { timingSafeEqual } from '@xivdyetools/auth/timing';
|
|
101
|
+
|
|
102
|
+
// Discord utilities only
|
|
103
|
+
import { verifyDiscordRequest } from '@xivdyetools/auth/discord';
|
|
104
|
+
```
|
|
105
|
+
|
|
106
|
+
## API Reference
|
|
107
|
+
|
|
108
|
+
### JWT (`@xivdyetools/auth/jwt`)
|
|
109
|
+
|
|
110
|
+
| Function | Description |
|
|
111
|
+
|----------|-------------|
|
|
112
|
+
| `verifyJWT(token, secret)` | Verify JWT signature, algorithm (HS256 only), and expiration |
|
|
113
|
+
| `verifyJWTSignatureOnly(token, secret, maxAgeMs?)` | Verify signature only (for refresh token grace periods) |
|
|
114
|
+
| `decodeJWT(token)` | Decode JWT without verification (debugging only) |
|
|
115
|
+
| `isJWTExpired(payload)` | Check if JWT payload is expired |
|
|
116
|
+
| `getJWTTimeToExpiry(payload)` | Get milliseconds until JWT expires |
|
|
117
|
+
|
|
118
|
+
### HMAC (`@xivdyetools/auth/hmac`)
|
|
119
|
+
|
|
120
|
+
| Function | Description |
|
|
121
|
+
|----------|-------------|
|
|
122
|
+
| `createHmacKey(secret, usage)` | Create CryptoKey for HMAC operations |
|
|
123
|
+
| `hmacSign(data, secret)` | Sign data, return base64url signature |
|
|
124
|
+
| `hmacSignHex(data, secret)` | Sign data, return hex signature |
|
|
125
|
+
| `hmacVerify(data, signature, secret)` | Verify base64url signature |
|
|
126
|
+
| `hmacVerifyHex(data, signature, secret)` | Verify hex signature |
|
|
127
|
+
| `verifyBotSignature(sig, ts, userId, userName, secret, opts?)` | Verify bot request signature |
|
|
128
|
+
|
|
129
|
+
### Timing (`@xivdyetools/auth/timing`)
|
|
130
|
+
|
|
131
|
+
| Function | Description |
|
|
132
|
+
|----------|-------------|
|
|
133
|
+
| `timingSafeEqual(a, b)` | Constant-time string comparison |
|
|
134
|
+
| `timingSafeEqualBytes(a, b)` | Constant-time Uint8Array comparison |
|
|
135
|
+
|
|
136
|
+
### Discord (`@xivdyetools/auth/discord`)
|
|
137
|
+
|
|
138
|
+
| Function | Description |
|
|
139
|
+
|----------|-------------|
|
|
140
|
+
| `verifyDiscordRequest(request, publicKey, opts?)` | Verify Discord Ed25519 signature |
|
|
141
|
+
| `unauthorizedResponse()` | Return 401 response |
|
|
142
|
+
| `badRequestResponse(message?)` | Return 400 response |
|
|
143
|
+
|
|
144
|
+
## Security Features
|
|
145
|
+
|
|
146
|
+
- **Algorithm Validation**: JWT verification only accepts HS256, preventing algorithm confusion attacks
|
|
147
|
+
- **Timing-Safe Comparison**: Uses `crypto.subtle.timingSafeEqual()` with XOR fallback
|
|
148
|
+
- **Timestamp Validation**: Bot signatures include clock skew tolerance and max age checks
|
|
149
|
+
- **Body Size Limits**: Discord verification enforces 100KB max body size by default
|
|
150
|
+
|
|
151
|
+
## Dependencies
|
|
152
|
+
|
|
153
|
+
- `@xivdyetools/crypto` - Base64URL and hex encoding utilities
|
|
154
|
+
- `discord-interactions` - Discord Ed25519 signature verification
|
|
155
|
+
|
|
156
|
+
## Connect With Me
|
|
157
|
+
|
|
158
|
+
**Flash Galatine** | Midgardsormr (Aether)
|
|
159
|
+
|
|
160
|
+
🎮 **FFXIV**: [Lodestone Character](https://na.finalfantasyxiv.com/lodestone/character/7677106/)
|
|
161
|
+
📝 **Blog**: [Project Galatine](https://blog.projectgalatine.com/)
|
|
162
|
+
💻 **GitHub**: [@FlashGalatine](https://github.com/FlashGalatine)
|
|
163
|
+
📺 **Twitch**: [flashgalatine](https://www.twitch.tv/flashgalatine)
|
|
164
|
+
🌐 **BlueSky**: [projectgalatine.com](https://bsky.app/profile/projectgalatine.com)
|
|
165
|
+
❤️ **Patreon**: [ProjectGalatine](https://patreon.com/ProjectGalatine)
|
|
166
|
+
☕ **Ko-Fi**: [flashgalatine](https://ko-fi.com/flashgalatine)
|
|
167
|
+
💬 **Discord**: [Join Server](https://discord.gg/5VUSKTZCe5)
|
|
168
|
+
|
|
169
|
+
## License
|
|
170
|
+
|
|
171
|
+
MIT © 2025-2026 Flash Galatine
|
package/dist/hmac.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"hmac.d.ts","sourceRoot":"","sources":["../src/hmac.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAM,GAAG,QAAQ,GAAG,MAAe,GACzC,OAAO,CAAC,SAAS,CAAC,CAcpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAK5E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAelB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,
|
|
1
|
+
{"version":3,"file":"hmac.d.ts","sourceRoot":"","sources":["../src/hmac.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAM,GAAG,QAAQ,GAAG,MAAe,GACzC,OAAO,CAAC,SAAS,CAAC,CAcpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAK5E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAelB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CAiClB"}
|
package/dist/hmac.js
CHANGED
|
@@ -127,8 +127,9 @@ export async function hmacVerifyHex(data, signature, secret) {
|
|
|
127
127
|
*/
|
|
128
128
|
export async function verifyBotSignature(signature, timestamp, userDiscordId, userName, secret, options = {}) {
|
|
129
129
|
const { maxAgeMs = 5 * 60 * 1000, clockSkewMs = 60 * 1000 } = options;
|
|
130
|
-
// Validate required fields
|
|
131
|
-
|
|
130
|
+
// Validate required fields (signature and timestamp are required;
|
|
131
|
+
// userDiscordId and userName are optional for system-level bot requests)
|
|
132
|
+
if (!signature || !timestamp) {
|
|
132
133
|
return false;
|
|
133
134
|
}
|
|
134
135
|
// Validate timestamp format
|
|
@@ -149,7 +150,7 @@ export async function verifyBotSignature(signature, timestamp, userDiscordId, us
|
|
|
149
150
|
return false;
|
|
150
151
|
}
|
|
151
152
|
// Verify the signature
|
|
152
|
-
const message = `${timestamp}:${userDiscordId}:${userName}`;
|
|
153
|
+
const message = `${timestamp}:${userDiscordId ?? ''}:${userName ?? ''}`;
|
|
153
154
|
return hmacVerifyHex(message, signature, secret);
|
|
154
155
|
}
|
|
155
156
|
//# sourceMappingURL=hmac.js.map
|
package/dist/hmac.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"hmac.js","sourceRoot":"","sources":["../src/hmac.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,UAAU,EACV,UAAU,GACX,MAAM,qBAAqB,CAAC;AAY7B;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,QAAoC,MAAM;IAE1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEvC,MAAM,SAAS,GACb,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAElD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,OAAO,EACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,MAAc;IACzD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,OAAO,oBAAoB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,OAAO,UAAU,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,SAAiB,EACjB,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAEvD,6DAA6D;QAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,EACN,GAAG,EACH,cAAc,EACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CACrB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,SAAiB,EACjB,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAE7C,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,EACN,GAAG,EACH,cAAc,EACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CACrB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAA6B,EAC7B,SAA6B,EAC7B,aAAiC,EACjC,QAA4B,EAC5B,MAAc,EACd,UAA+B,EAAE;IAEjC,MAAM,EAAE,QAAQ,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAEtE,
|
|
1
|
+
{"version":3,"file":"hmac.js","sourceRoot":"","sources":["../src/hmac.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,UAAU,EACV,UAAU,GACX,MAAM,qBAAqB,CAAC;AAY7B;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,QAAoC,MAAM;IAE1C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEvC,MAAM,SAAS,GACb,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAElD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,OAAO,EACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,MAAc;IACzD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,OAAO,oBAAoB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,OAAO,UAAU,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,SAAiB,EACjB,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAEvD,6DAA6D;QAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,EACN,GAAG,EACH,cAAc,EACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CACrB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,SAAiB,EACjB,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAE7C,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,EACN,GAAG,EACH,cAAc,EACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CACrB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAA6B,EAC7B,SAA6B,EAC7B,aAAiC,EACjC,QAA4B,EAC5B,MAAc,EACd,UAA+B,EAAE;IAEjC,MAAM,EAAE,QAAQ,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAEtE,kEAAkE;IAClE,yEAAyE;IACzE,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4BAA4B;IAC5B,MAAM,YAAY,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kDAAkD;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,aAAa,GAAG,YAAY,GAAG,IAAI,CAAC,CAAC,0BAA0B;IACrE,MAAM,GAAG,GAAG,GAAG,GAAG,aAAa,CAAC;IAEhC,oBAAoB;IACpB,IAAI,GAAG,GAAG,QAAQ,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0DAA0D;IAC1D,IAAI,aAAa,GAAG,GAAG,GAAG,WAAW,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uBAAuB;IACvB,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,aAAa,IAAI,EAAE,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;IACxE,OAAO,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC"}
|
package/dist/jwt.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,eAAe,EACf,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AA+B1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAe,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAa,EACb,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAEpD,6BAA6B;QAC7B,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAc,IAAI,CAAC,KAAK,CAAC,UAAU,
|
|
1
|
+
{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,eAAe,EACf,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AA+B1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAe,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAa,EACb,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAEpD,6BAA6B;QAC7B,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAc,IAAI,CAAC,KAAK,CAAC,UAAU,CAAc,CAAC;QAE9D,+EAA+E;QAC/E,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mEAAmE;QACnE,uEAAuE;QACvE,MAAM,cAAc,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAE1D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACxC,MAAM,EACN,GAAG,EACH,cAAc,EACd,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAC/B,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,iBAAiB;QACjB,MAAM,WAAW,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,OAAO,GAAe,IAAI,CAAC,KAAK,CAAC,WAAW,CAAe,CAAC;QAElE,mBAAmB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAa,EACb,MAAc,EACd,QAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAEpD,6BAA6B;QAC7B,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAc,IAAI,CAAC,KAAK,CAAC,UAAU,CAAc,CAAC;QAE9D,8CAA8C;QAC9C,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mEAAmE;QACnE,uEAAuE;QACvE,MAAM,cAAc,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAE1D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACxC,MAAM,EACN,GAAG,EACH,cAAc,EACd,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAC/B,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,iBAAiB;QACjB,MAAM,WAAW,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,OAAO,GAAe,IAAI,CAAC,KAAK,CAAC,WAAW,CAAe,CAAC;QAElE,6BAA6B;QAC7B,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;YAC1C,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;AACxC,CAAC"}
|
package/dist/timing.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"timing.d.ts","sourceRoot":"","sources":["../src/timing.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;GAcG;
|
|
1
|
+
{"version":3,"file":"timing.d.ts","sourceRoot":"","sources":["../src/timing.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;GAcG;AAEH,wBAAsB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA4B5E;AAED;;;;;;GAMG;AAEH,wBAAsB,oBAAoB,CACxC,CAAC,EAAE,UAAU,EACb,CAAC,EAAE,UAAU,GACZ,OAAO,CAAC,OAAO,CAAC,CAkBlB"}
|
package/dist/timing.js
CHANGED
|
@@ -22,6 +22,7 @@
|
|
|
22
22
|
* const isValid = await timingSafeEqual(providedToken, expectedToken);
|
|
23
23
|
* ```
|
|
24
24
|
*/
|
|
25
|
+
// eslint-disable-next-line @typescript-eslint/require-await -- async API contract; timingSafeEqual may be async in other runtimes
|
|
25
26
|
export async function timingSafeEqual(a, b) {
|
|
26
27
|
const encoder = new TextEncoder();
|
|
27
28
|
const aBytes = encoder.encode(a);
|
|
@@ -36,7 +37,7 @@ export async function timingSafeEqual(a, b) {
|
|
|
36
37
|
bPadded.set(bBytes);
|
|
37
38
|
// Use crypto.subtle.timingSafeEqual if available (Cloudflare Workers)
|
|
38
39
|
try {
|
|
39
|
-
const result =
|
|
40
|
+
const result = crypto.subtle.timingSafeEqual(aPadded, bPadded);
|
|
40
41
|
// Also check original lengths matched
|
|
41
42
|
return result && aBytes.length === bBytes.length;
|
|
42
43
|
}
|
|
@@ -56,6 +57,7 @@ export async function timingSafeEqual(a, b) {
|
|
|
56
57
|
* @param b - Second array to compare
|
|
57
58
|
* @returns true if arrays are equal, false otherwise
|
|
58
59
|
*/
|
|
60
|
+
// eslint-disable-next-line @typescript-eslint/require-await -- async API contract; timingSafeEqual may be async in other runtimes
|
|
59
61
|
export async function timingSafeEqualBytes(a, b) {
|
|
60
62
|
const maxLength = Math.max(a.length, b.length);
|
|
61
63
|
const aPadded = new Uint8Array(maxLength);
|
|
@@ -63,7 +65,7 @@ export async function timingSafeEqualBytes(a, b) {
|
|
|
63
65
|
aPadded.set(a);
|
|
64
66
|
bPadded.set(b);
|
|
65
67
|
try {
|
|
66
|
-
const result =
|
|
68
|
+
const result = crypto.subtle.timingSafeEqual(aPadded, bPadded);
|
|
67
69
|
return result && a.length === b.length;
|
|
68
70
|
}
|
|
69
71
|
catch {
|
package/dist/timing.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"timing.js","sourceRoot":"","sources":["../src/timing.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IACxD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEjC,kEAAkE;IAClE,8DAA8D;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAEzD,wEAAwE;IACxE,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEpB,sEAAsE;IACtE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,
|
|
1
|
+
{"version":3,"file":"timing.js","sourceRoot":"","sources":["../src/timing.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;GAcG;AACH,kIAAkI;AAClI,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IACxD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEjC,kEAAkE;IAClE,8DAA8D;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAEzD,wEAAwE;IACxE,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEpB,sEAAsE;IACtE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/D,sCAAsC;QACtC,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,uFAAuF;QACvF,IAAI,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,kIAAkI;AAClI,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,CAAa,EACb,CAAa;IAEb,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAE/C,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACf,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAEf,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,CAAC;IACpB,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,71 +1,75 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "@xivdyetools/auth",
|
|
3
|
-
"version": "1.0.
|
|
4
|
-
"description": "Shared authentication utilities for xivdyetools ecosystem",
|
|
5
|
-
"type": "module",
|
|
6
|
-
"main": "./dist/index.js",
|
|
7
|
-
"types": "./dist/index.d.ts",
|
|
8
|
-
"exports": {
|
|
9
|
-
".": {
|
|
10
|
-
"types": "./dist/index.d.ts",
|
|
11
|
-
"import": "./dist/index.js"
|
|
12
|
-
},
|
|
13
|
-
"./jwt": {
|
|
14
|
-
"types": "./dist/jwt.d.ts",
|
|
15
|
-
"import": "./dist/jwt.js"
|
|
16
|
-
},
|
|
17
|
-
"./hmac": {
|
|
18
|
-
"types": "./dist/hmac.d.ts",
|
|
19
|
-
"import": "./dist/hmac.js"
|
|
20
|
-
},
|
|
21
|
-
"./timing": {
|
|
22
|
-
"types": "./dist/timing.d.ts",
|
|
23
|
-
"import": "./dist/timing.js"
|
|
24
|
-
},
|
|
25
|
-
"./discord": {
|
|
26
|
-
"types": "./dist/discord.d.ts",
|
|
27
|
-
"import": "./dist/discord.js"
|
|
28
|
-
}
|
|
29
|
-
},
|
|
30
|
-
"files": [
|
|
31
|
-
"dist",
|
|
32
|
-
"src"
|
|
33
|
-
],
|
|
34
|
-
"
|
|
35
|
-
"
|
|
36
|
-
"
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
"
|
|
40
|
-
"
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
"
|
|
45
|
-
},
|
|
46
|
-
"
|
|
47
|
-
"@cloudflare/workers-types":
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
"
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
"
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
"
|
|
62
|
-
"
|
|
63
|
-
"
|
|
64
|
-
"
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
"
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
1
|
+
{
|
|
2
|
+
"name": "@xivdyetools/auth",
|
|
3
|
+
"version": "1.0.3",
|
|
4
|
+
"description": "Shared authentication utilities for xivdyetools ecosystem",
|
|
5
|
+
"type": "module",
|
|
6
|
+
"main": "./dist/index.js",
|
|
7
|
+
"types": "./dist/index.d.ts",
|
|
8
|
+
"exports": {
|
|
9
|
+
".": {
|
|
10
|
+
"types": "./dist/index.d.ts",
|
|
11
|
+
"import": "./dist/index.js"
|
|
12
|
+
},
|
|
13
|
+
"./jwt": {
|
|
14
|
+
"types": "./dist/jwt.d.ts",
|
|
15
|
+
"import": "./dist/jwt.js"
|
|
16
|
+
},
|
|
17
|
+
"./hmac": {
|
|
18
|
+
"types": "./dist/hmac.d.ts",
|
|
19
|
+
"import": "./dist/hmac.js"
|
|
20
|
+
},
|
|
21
|
+
"./timing": {
|
|
22
|
+
"types": "./dist/timing.d.ts",
|
|
23
|
+
"import": "./dist/timing.js"
|
|
24
|
+
},
|
|
25
|
+
"./discord": {
|
|
26
|
+
"types": "./dist/discord.d.ts",
|
|
27
|
+
"import": "./dist/discord.js"
|
|
28
|
+
}
|
|
29
|
+
},
|
|
30
|
+
"files": [
|
|
31
|
+
"dist",
|
|
32
|
+
"src"
|
|
33
|
+
],
|
|
34
|
+
"dependencies": {
|
|
35
|
+
"discord-interactions": "^4.4.0",
|
|
36
|
+
"@xivdyetools/crypto": "1.0.0"
|
|
37
|
+
},
|
|
38
|
+
"devDependencies": {
|
|
39
|
+
"@cloudflare/workers-types": "^4.20260207.0",
|
|
40
|
+
"@vitest/coverage-v8": "^4.0.18",
|
|
41
|
+
"vitest": "^4.0.18"
|
|
42
|
+
},
|
|
43
|
+
"peerDependencies": {
|
|
44
|
+
"@cloudflare/workers-types": "^4.0.0"
|
|
45
|
+
},
|
|
46
|
+
"peerDependenciesMeta": {
|
|
47
|
+
"@cloudflare/workers-types": {
|
|
48
|
+
"optional": true
|
|
49
|
+
}
|
|
50
|
+
},
|
|
51
|
+
"keywords": [
|
|
52
|
+
"xivdyetools",
|
|
53
|
+
"auth",
|
|
54
|
+
"jwt",
|
|
55
|
+
"hmac",
|
|
56
|
+
"discord",
|
|
57
|
+
"cloudflare-workers"
|
|
58
|
+
],
|
|
59
|
+
"author": "XIVDyeTools",
|
|
60
|
+
"license": "MIT",
|
|
61
|
+
"repository": {
|
|
62
|
+
"type": "git",
|
|
63
|
+
"url": "https://github.com/FlashGalatine/xivdyetools.git",
|
|
64
|
+
"directory": "packages/auth"
|
|
65
|
+
},
|
|
66
|
+
"scripts": {
|
|
67
|
+
"build": "tsc -p tsconfig.build.json",
|
|
68
|
+
"type-check": "tsc --noEmit",
|
|
69
|
+
"test": "vitest run",
|
|
70
|
+
"test:watch": "vitest",
|
|
71
|
+
"test:coverage": "vitest run --coverage",
|
|
72
|
+
"clean": "rimraf dist",
|
|
73
|
+
"lint": "eslint src"
|
|
74
|
+
}
|
|
75
|
+
}
|