cursedbelt-server 4.13.0 → 4.14.0

package/src/server/guard/passwordVerifier.ts

@@ -29,7 +29,7 @@
  *     every path including a thrown KDF. Callers hand over ownership and must not
  *     touch the buffer afterwards.
  */
-import { timingSafeEqual } from 'node:crypto';
+import { constantTimeEqualBytes } from 'cwip/constant-time';
 import {
   type Argon2idDeriver,
   createSecretEnvelopeManager,
@@ -79,7 +79,7 @@ export function sealPasswordVerifier(userId: string, password: Uint8Array, deriv
  * stored envelope is corruption, not a wrong password, and re-throws.
  *
  * The comparison is constant-time in the sensitive part: argon2id derivation
- * dominates the timing, and GCM tag verification plus the final `timingSafeEqual`
+ * dominates the timing, and GCM tag verification plus the final `constantTimeEqualBytes`
  * are constant-time, so a right and a wrong password of equal length are
  * indistinguishable by timing.
  */
@@ -106,7 +106,7 @@ export function verifyPasswordEnvelope(
     // openWithPassphrase re-derives a one-shot key from the envelope's own salt +
     // the presented password, opens, and zeroizes `password` on every path.
     opened = manager.openWithPassphrase(envelope, refFor(userId), password);
-    return opened.byteLength === VERIFIER_PLAINTEXT.byteLength && timingSafeEqual(opened, VERIFIER_PLAINTEXT);
+    return constantTimeEqualBytes(opened, VERIFIER_PLAINTEXT);
   } catch (error) {
     // GCM's rejection is the wrong-password verdict — the ONLY error we swallow.
     if (isAppError(error) && error.code === 'SECRET_ENVELOPE_AUTH_FAILED') return false;

package/src/server/sync/tokens.ts

@@ -4,10 +4,11 @@
  * per capability, sha256 at rest so a database read never yields a usable credential).
  *
  * The plaintext token is returned exactly once, at mint. Verification compares sha256
- * digests via `timingSafeEqual` — length-independent, no oracle.
+ * digests via cwip's `constantTimeEqualBytes` — no length guard, no early exit.
  */
 import type { Database } from "bun:sqlite";
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
+import { constantTimeEqualBytes } from "cwip/constant-time";
 
 export interface DeviceToken {
 	name: string;
@@ -79,7 +80,7 @@ export function createTokenStore(db: Database): TokenStore {
 			// the lookup timing depend on the presented value.
 			for (const raw of allLive.all() as Row[]) {
 				const want = Buffer.from(raw.token_sha256);
-				if (want.length === got.length && timingSafeEqual(want, got)) {
+				if (constantTimeEqualBytes(want, got)) {
 					if (raw.scope !== scope) return null;
 					return toToken(raw);
 				}