cursedbelt-server 4.13.0 → 4.13.1

package/dist/server/auth/password.js

@@ -1,4 +1,5 @@
-import { pbkdf2 as pbkdf2Cb, timingSafeEqual } from 'node:crypto';
+import { pbkdf2 as pbkdf2Cb } from 'node:crypto';
+import { constantTimeEqual } from 'cwip/constant-time';
 import { promisify } from 'node:util';
 /**
  * Password hashing on `Bun.password` (argon2id — memory-hard, thread-pooled, zero
@@ -49,11 +50,8 @@ export async function verifyPassword(plain, stored) {
     if (!salt || !expectedHex)
         return false;
     const derived = (await pbkdf2(plain, salt, LEGACY_ITERATIONS, LEGACY_KEYLEN, LEGACY_DIGEST)).toString('hex');
-    // timingSafeEqual throws on length mismatch; a length diff is already a non-match
-    // and short-circuiting leaks nothing a compare wouldn't.
-    if (derived.length !== expectedHex.length)
-        return false;
-    return timingSafeEqual(Buffer.from(derived), Buffer.from(expectedHex));
+    // cwip's fold: no length guard to own, no early exit (task 322).
+    return constantTimeEqual(derived, expectedHex);
 }
 /**
  * True when a stored hash is a legacy (non-argon2id) digest and should be upgraded.

package/dist/server/guard/passwordVerifier.d.ts

@@ -14,7 +14,7 @@ export declare function sealPasswordVerifier(userId: string, password: Uint8Arra
  * stored envelope is corruption, not a wrong password, and re-throws.
  *
  * The comparison is constant-time in the sensitive part: argon2id derivation
- * dominates the timing, and GCM tag verification plus the final `timingSafeEqual`
+ * dominates the timing, and GCM tag verification plus the final `constantTimeEqualBytes`
  * are constant-time, so a right and a wrong password of equal length are
  * indistinguishable by timing.
  */

package/dist/server/guard/passwordVerifier.js

@@ -29,7 +29,7 @@
  *     every path including a thrown KDF. Callers hand over ownership and must not
  *     touch the buffer afterwards.
  */
-import { timingSafeEqual } from 'node:crypto';
+import { constantTimeEqualBytes } from 'cwip/constant-time';
 import { createSecretEnvelopeManager, mintEnvelopeSalt, parseSecretEnvelope, serializeSecretEnvelope, zeroize, } from 'cwip/guard';
 import { isAppError } from '../errors.js';
 /**
@@ -68,7 +68,7 @@ export function sealPasswordVerifier(userId, password, deriver) {
  * stored envelope is corruption, not a wrong password, and re-throws.
  *
  * The comparison is constant-time in the sensitive part: argon2id derivation
- * dominates the timing, and GCM tag verification plus the final `timingSafeEqual`
+ * dominates the timing, and GCM tag verification plus the final `constantTimeEqualBytes`
  * are constant-time, so a right and a wrong password of equal length are
  * indistinguishable by timing.
  */
@@ -90,7 +90,7 @@ export function verifyPasswordEnvelope(userId, envelopeJson, password, deriver)
         // openWithPassphrase re-derives a one-shot key from the envelope's own salt +
         // the presented password, opens, and zeroizes `password` on every path.
         opened = manager.openWithPassphrase(envelope, refFor(userId), password);
-        return opened.byteLength === VERIFIER_PLAINTEXT.byteLength && timingSafeEqual(opened, VERIFIER_PLAINTEXT);
+        return constantTimeEqualBytes(opened, VERIFIER_PLAINTEXT);
     }
     catch (error) {
         // GCM's rejection is the wrong-password verdict — the ONLY error we swallow.

package/dist/server/sync/tokens.d.ts

@@ -4,7 +4,7 @@
  * per capability, sha256 at rest so a database read never yields a usable credential).
  *
  * The plaintext token is returned exactly once, at mint. Verification compares sha256
- * digests via `timingSafeEqual` — length-independent, no oracle.
+ * digests via cwip's `constantTimeEqualBytes` — no length guard, no early exit.
  */
 import type { Database } from "bun:sqlite";
 export interface DeviceToken {

package/dist/server/sync/tokens.js

@@ -1,4 +1,5 @@
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
+import { constantTimeEqualBytes } from "cwip/constant-time";
 const sha256 = (value) => createHash("sha256").update(value).digest();
 export function createTokenStore(db) {
     db.exec(`
@@ -35,7 +36,7 @@ export function createTokenStore(db) {
             // the lookup timing depend on the presented value.
             for (const raw of allLive.all()) {
                 const want = Buffer.from(raw.token_sha256);
-                if (want.length === got.length && timingSafeEqual(want, got)) {
+                if (constantTimeEqualBytes(want, got)) {
                     if (raw.scope !== scope)
                         return null;
                     return toToken(raw);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.13.0",
+	"version": "4.13.1",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split \u2014 storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",

package/src/server/auth/password.ts

@@ -1,4 +1,5 @@
-import { pbkdf2 as pbkdf2Cb, timingSafeEqual } from 'node:crypto';
+import { pbkdf2 as pbkdf2Cb } from 'node:crypto';
+import { constantTimeEqual } from 'cwip/constant-time';
 import { promisify } from 'node:util';
 
 /**
@@ -55,10 +56,8 @@ export async function verifyPassword(plain: string, stored: string): Promise<boo
   const derived = (
     await pbkdf2(plain, salt, LEGACY_ITERATIONS, LEGACY_KEYLEN, LEGACY_DIGEST)
   ).toString('hex');
-  // timingSafeEqual throws on length mismatch; a length diff is already a non-match
-  // and short-circuiting leaks nothing a compare wouldn't.
-  if (derived.length !== expectedHex.length) return false;
-  return timingSafeEqual(Buffer.from(derived), Buffer.from(expectedHex));
+  // cwip's fold: no length guard to own, no early exit (task 322).
+  return constantTimeEqual(derived, expectedHex);
 }
 
 /**

package/src/server/guard/passwordVerifier.ts

@@ -29,7 +29,7 @@
  *     every path including a thrown KDF. Callers hand over ownership and must not
  *     touch the buffer afterwards.
  */
-import { timingSafeEqual } from 'node:crypto';
+import { constantTimeEqualBytes } from 'cwip/constant-time';
 import {
   type Argon2idDeriver,
   createSecretEnvelopeManager,
@@ -79,7 +79,7 @@ export function sealPasswordVerifier(userId: string, password: Uint8Array, deriv
  * stored envelope is corruption, not a wrong password, and re-throws.
  *
  * The comparison is constant-time in the sensitive part: argon2id derivation
- * dominates the timing, and GCM tag verification plus the final `timingSafeEqual`
+ * dominates the timing, and GCM tag verification plus the final `constantTimeEqualBytes`
  * are constant-time, so a right and a wrong password of equal length are
  * indistinguishable by timing.
  */
@@ -106,7 +106,7 @@ export function verifyPasswordEnvelope(
     // openWithPassphrase re-derives a one-shot key from the envelope's own salt +
     // the presented password, opens, and zeroizes `password` on every path.
     opened = manager.openWithPassphrase(envelope, refFor(userId), password);
-    return opened.byteLength === VERIFIER_PLAINTEXT.byteLength && timingSafeEqual(opened, VERIFIER_PLAINTEXT);
+    return constantTimeEqualBytes(opened, VERIFIER_PLAINTEXT);
   } catch (error) {
     // GCM's rejection is the wrong-password verdict — the ONLY error we swallow.
     if (isAppError(error) && error.code === 'SECRET_ENVELOPE_AUTH_FAILED') return false;

package/src/server/sync/tokens.ts

@@ -4,10 +4,11 @@
  * per capability, sha256 at rest so a database read never yields a usable credential).
  *
  * The plaintext token is returned exactly once, at mint. Verification compares sha256
- * digests via `timingSafeEqual` — length-independent, no oracle.
+ * digests via cwip's `constantTimeEqualBytes` — no length guard, no early exit.
  */
 import type { Database } from "bun:sqlite";
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
+import { constantTimeEqualBytes } from "cwip/constant-time";
 
 export interface DeviceToken {
 	name: string;
@@ -79,7 +80,7 @@ export function createTokenStore(db: Database): TokenStore {
 			// the lookup timing depend on the presented value.
 			for (const raw of allLive.all() as Row[]) {
 				const want = Buffer.from(raw.token_sha256);
-				if (want.length === got.length && timingSafeEqual(want, got)) {
+				if (constantTimeEqualBytes(want, got)) {
 					if (raw.scope !== scope) return null;
 					return toToken(raw);
 				}