cursedbelt-server 4.22.0 → 4.24.0

package/src/server/worker-argon2/index.spec.ts

@@ -0,0 +1,162 @@
+/**
+ * `cursedbelt-server/worker-argon2`: the Worker's argon2id loads the way workerd lets it, and
+ * agrees with `Bun.password` byte for byte.
+ *
+ * 🔴 The branch that matters cannot run here by accident: under Bun a `.wasm` import is a file
+ * PATH, so `argon2()` in this process compiles — which workerd forbids. These cases hand the
+ * loader what wrangler hands it (a compiled `WebAssembly.Module`) with `WebAssembly.compile`
+ * rigged to throw workerd's own words, so a loader that compiled anyway goes red here rather
+ * than at an owner's lock page (`./password.ts`, the 2026-09-18 `hash-wasm` deploy).
+ *
+ * The shim is driven DIRECTLY rather than through `installBunPasswordShim`: the shim does nothing
+ * when a real `Bun` exists, so testing through it here would test Bun and report on the Worker.
+ * Lifted from `apps/collections/worker/{argon2,password}.test.ts` (commit 7996ded).
+ */
+import { afterEach, describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import noSimdPath from "argon2id/dist/no-simd.wasm";
+import simdPath from "argon2id/dist/simd.wasm";
+import { argon2, installBunPasswordShim, instantiateWasm, loadArgon2, parsePhc, workerPassword } from "./index.js";
+
+const WORKERD_REFUSAL = "WebAssembly.compile(): Wasm code generation disallowed by embedder";
+const realCompile = WebAssembly.compile;
+
+/** workerd's rule, reproduced: instantiating a module is allowed, compiling bytes is not. */
+function forbidCompile(): void {
+	WebAssembly.compile = (() => Promise.reject(new Error(WORKERD_REFUSAL))) as typeof WebAssembly.compile;
+}
+
+afterEach(() => {
+	WebAssembly.compile = realCompile;
+});
+
+/** What wrangler's `CompiledWasm` rule hands the bundle, compiled BEFORE the rule is imposed. */
+async function asWranglerHandsIt(path: string | WebAssembly.Module): Promise<WebAssembly.Module> {
+	return typeof path === "string" ? realCompile(await Bun.file(path).arrayBuffer()) : path;
+}
+
+const PASSWORD = "the tide remembers every shore";
+const hex = (bytes: Uint8Array): string => Buffer.from(bytes).toString("hex");
+
+describe("argon2id on the Worker", () => {
+	it("🔴 derives from a compiled Module with compilation forbidden — byte-identical to Bun.password", async () => {
+		const simd = await asWranglerHandsIt(simdPath);
+		const noSimd = await asWranglerHandsIt(noSimdPath);
+		// Bun's DEFAULT argon2id (m=64 MiB, t=2) — what every production hash in the fleet carries —
+		// and a cheap profile, so the stored parameters are proven to be the ones used.
+		const stored = [
+			await Bun.password.hash(PASSWORD, { algorithm: "argon2id" }),
+			await Bun.password.hash(PASSWORD, { algorithm: "argon2id", memoryCost: 4096, timeCost: 1 }),
+		];
+		forbidCompile();
+		const derive = await loadArgon2(simd, noSimd);
+		for (const phcString of stored) {
+			const phc = parsePhc(phcString);
+			if (!phc) throw new Error(`Bun wrote a hash this module cannot parse: ${phcString}`);
+			const derived = derive({
+				password: new TextEncoder().encode(PASSWORD),
+				salt: phc.salt,
+				passes: phc.t,
+				memorySize: phc.m,
+				parallelism: phc.p,
+				tagLength: phc.hash.length,
+			});
+			expect(hex(derived)).toBe(hex(phc.hash));
+		}
+	});
+
+	it("🔴 a loader that COMPILES goes red under the same rule — the check can fail", async () => {
+		forbidCompile();
+		await expect(
+			instantiateWasm(simdPath, { env: { memory: new WebAssembly.Memory({ initial: 1 }) } }),
+		).rejects.toThrow(WORKERD_REFUSAL);
+	});
+
+	it("keeps ONE hasher per isolate — a 65 MB memory per call would stack against 128 MB", async () => {
+		expect(await argon2()).toBe(await argon2());
+	});
+
+	it("is several times cheaper than the pure-JS derivation it replaced, at the owner's real cost", async () => {
+		const derive = await argon2();
+		const started = process.cpuUsage();
+		derive({
+			password: new TextEncoder().encode(PASSWORD),
+			salt: new Uint8Array(32).fill(7),
+			passes: 2,
+			memorySize: 65_536,
+			parallelism: 1,
+			tagLength: 32,
+		});
+		// CPU, not wall clock, so a loaded gate does not stretch it: WASM measured ~70–180 CPU-ms
+		// on this Mac, `@noble/hashes`' pure JS ~530–600 (and ~2.8 s on workerd). The ceiling sits
+		// between them.
+		const spent = process.cpuUsage(started);
+		expect((spent.user + spent.system) / 1000).toBeLessThan(400);
+	});
+});
+
+describe("the Bun.password shim", () => {
+	it("verifies a hash Bun wrote — the whole reason the owner keeps their password", async () => {
+		const hash = await Bun.password.hash(PASSWORD, { algorithm: "argon2id" });
+		expect(await workerPassword.verify(PASSWORD, hash)).toBe(true);
+	});
+
+	it("refuses a wrong password against a hash Bun wrote", async () => {
+		const hash = await Bun.password.hash(PASSWORD, { algorithm: "argon2id" });
+		expect(await workerPassword.verify("not the password", hash)).toBe(false);
+	});
+
+	it("writes a hash BUN can verify, so a password changed on the edge still works on the Mac", async () => {
+		const hash = await workerPassword.hash(PASSWORD, { memoryCost: 4096, timeCost: 1 });
+		expect(hash.startsWith("$argon2id$v=19$m=4096,t=1,p=1$")).toBe(true);
+		expect(await Bun.password.verify(PASSWORD, hash)).toBe(true);
+	});
+
+	it("honours the STORED cost parameters, not its own defaults", async () => {
+		const cheap = await Bun.password.hash(PASSWORD, { algorithm: "argon2id", memoryCost: 4096, timeCost: 1 });
+		expect(parsePhc(cheap)?.m).toBe(4096);
+		expect(await workerPassword.verify(PASSWORD, cheap)).toBe(true);
+	});
+
+	it("fails closed on junk rather than throwing", async () => {
+		for (const junk of ["", "not-a-hash", "$argon2id$", "$argon2i$v=19$m=1,t=1,p=1$AA$AA"]) {
+			expect(await workerPassword.verify(PASSWORD, junk)).toBe(false);
+		}
+		expect(await workerPassword.verify("", "$argon2id$v=19$m=4096,t=1,p=1$AA$AA")).toBe(false);
+	});
+
+	it("decodes unpadded PHC base64, which is where a salt silently goes wrong", async () => {
+		const parsed = parsePhc(await Bun.password.hash(PASSWORD, { algorithm: "argon2id" }));
+		// Bun's default salt and digest are both 32 bytes — measured, not assumed.
+		expect(parsed?.salt.length).toBe(32);
+		expect(parsed?.hash.length).toBe(32);
+	});
+
+	it("never overwrites a real Bun — so installing it in this process is a no-op", () => {
+		const before = Bun.password;
+		installBunPasswordShim();
+		expect(Bun.password).toBe(before);
+	});
+});
+
+describe("🔴 what wrangler bundles", () => {
+	const dist = join(import.meta.dir, "..", "..", "..", "dist", "server", "worker-argon2", "argon2.js");
+
+	it("dist keeps both .wasm files as STATIC imports — the only shape workerd will run", () => {
+		// wrangler resolves this subpath's `import` condition, i.e. this file. A build that inlined
+		// or dynamically loaded the bytes would deploy fine and refuse every sign-in.
+		const built = readFileSync(dist, "utf8");
+		expect(built).toMatch(/^import \w+ from ["']argon2id\/dist\/simd\.wasm["'];?$/m);
+		expect(built).toMatch(/^import \w+ from ["']argon2id\/dist\/no-simd\.wasm["'];?$/m);
+	});
+
+	it("never imports argon2id's default entry, which compiles inline base64", () => {
+		for (const file of ["argon2.ts", "password.ts", "index.ts"]) {
+			const source = readFileSync(join(import.meta.dir, file), "utf8");
+			expect(source).not.toMatch(/from ["']argon2id["']/);
+		}
+		const built = readFileSync(dist, "utf8");
+		expect(built).not.toMatch(/from ["']argon2id["']/);
+	});
+});

package/src/server/worker-argon2/index.ts

@@ -0,0 +1,9 @@
+/**
+ * `cursedbelt-server/worker-argon2` — argon2id a Cloudflare Worker can afford, and the
+ * `Bun.password` shim that lets the same auth code verify on the Mac and on the edge.
+ *
+ * `./argon2.ts` is the WHY (8.5 s of billed CPU per unlock in pure JS; workerd forbids compiling
+ * WebAssembly, so the `.wasm` is a static import wrangler bundles); `./password.ts` is the shim.
+ */
+export { argon2, instantiateWasm, loadArgon2, type WasmImport } from "./argon2.js";
+export { type BunPasswordShim, installBunPasswordShim, parsePhc, workerPassword } from "./password.js";

package/src/server/worker-argon2/password.ts

@@ -0,0 +1,185 @@
+/**
+ * argon2id on `workerd`, where the obvious answer does not work.
+ *
+ * ## 🔴 The finding, and it applies to every app in this fleet
+ *
+ * **A Worker may not compile WebAssembly at runtime.** `hash-wasm` — the first and
+ * most natural choice, and the one every search result recommends — inlines its
+ * argon2 module as base64 and calls `WebAssembly.compile(bytes)` on first use.
+ * Deployed here on 2026-09-18, that produced:
+ *
+ * ```
+ * [patterns] argon2 verification threw:   ← the pilot's log line, quoted verbatim
+ *   WebAssembly.compile(): Wasm code generation disallowed by embedder
+ * ```
+ *
+ * It **builds, deploys and starts perfectly**, and fails only when somebody tries
+ * to sign in — where it is indistinguishable from a wrong password, because a KDF
+ * that throws must fail closed. That combination is the worst shape a defect can
+ * have, and it is why `verify` below logs the error: a silent `false` cost a
+ * diagnosis on the day this was written. On Workers, WASM must be a *static
+ * import* of a `.wasm` file that wrangler bundles as a module; a library that
+ * carries its bytes inline can never satisfy that.
+ *
+ * So this runs **argon2id as WebAssembly that wrangler bundles as a static module** —
+ * `./argon2.ts`, which instantiates a `WebAssembly.Module` it was handed and never compiles
+ * one. Until 2026-09-23 it was `@noble/hashes/argon2`, pure JavaScript: byte-identical output
+ * and 562 ms per verification on this Mac, which read as acceptable — and on workerd it was
+ * **~2.8 s per derivation**, so one unlock (every account's hash plus the timing equalizer)
+ * billed 8.5 s on the stage and 15 s in production, and was 489 CPU-ms averaged over every
+ * request the app served on 2026-09-22. `./argon2.ts` carries the measurement.
+ * `cursedbelt-server/login-throttle` is what holds the line against a flood, not the KDF's cost.
+ *
+ * ## What this buys, and it is the reason to pay for argon2id at all
+ *
+ * **The owner's existing password hash works on a Worker unchanged.** No re-hash,
+ * no "sign in again on the new host", and above all no downgrade to PBKDF2 to fit
+ * the runtime — `ownerAuth.ts` argues at length for argon2id over a fast KDF, and
+ * a port that quietly swapped it would have thrown that argument away for a
+ * platform detail. Same PHC string, same parameters, same answer.
+ *
+ * ## Why a GLOBAL shim rather than an injected verifier
+ *
+ * `Bun.password` is reached from three files (`auth.ts`, `ownerAuth.ts`,
+ * `cursedbelt-server/password`), and `Bun.` is a *global property access*, not an import — so
+ * a Worker bundle containing it builds fine and throws `Bun is not defined` only
+ * when a login happens. Threading a verifier through three signatures would be
+ * three more places for the Mac and the edge to disagree. Installing the global
+ * instead keeps the auth tier byte-identical on both runtimes, which is the same
+ * argument the apps' `store.ts` make for the async database seam.
+ *
+ * Used by `collections`, `vault` and `patterns` (each app's `worker/index.ts` calls
+ * {@link installBunPasswordShim} first thing). In `vault` this is ONLY the sign-in / lock
+ * verifier: the vault's ciphertext is derived and opened in the browser and never comes near it.
+ */
+import { constantTimeEqualBytes } from "cwip/constant-time";
+import { argon2 } from "./argon2.js";
+
+/** What Bun's `argon2id` default writes, so a hash minted here matches one minted there. */
+const DEFAULT_MEMORY_KIB = 65_536;
+const DEFAULT_ITERATIONS = 2;
+const DEFAULT_PARALLELISM = 1;
+const HASH_BYTES = 32;
+// 32, matching what `Bun.password.hash` actually writes — measured 2026-09-18.
+const SALT_BYTES = 32;
+
+/**
+ * argon2's PHC encoding is base64 **without padding**, and with the standard
+ * alphabet rather than base64url. Getting either wrong yields a salt that decodes
+ * to the wrong bytes and a verification that fails for a correct password.
+ */
+const b64decode = (value: string): Uint8Array => {
+	const padded = value + "===".slice((value.length + 3) % 4);
+	return Uint8Array.from(atob(padded), (ch) => ch.charCodeAt(0));
+};
+
+const b64encode = (bytes: Uint8Array): string =>
+	btoa(String.fromCharCode(...bytes)).replace(/=+$/, "");
+
+interface Phc {
+	m: number;
+	t: number;
+	p: number;
+	salt: Uint8Array;
+	hash: Uint8Array;
+}
+
+/** `$argon2id$v=19$m=65536,t=2,p=1$<salt>$<hash>` → its parts, or null. */
+export function parsePhc(encoded: string): Phc | null {
+	const parts = encoded.split("$");
+	// ["", "argon2id", "v=19", "m=...,t=...,p=...", salt, hash]
+	if (parts.length !== 6 || parts[1] !== "argon2id") return null;
+	const params = new Map(
+		(parts[3] as string).split(",").map((pair) => {
+			const [key, value] = pair.split("=");
+			return [key as string, Number(value)] as const;
+		}),
+	);
+	const m = params.get("m");
+	const t = params.get("t");
+	const p = params.get("p");
+	if (!m || !t || !p) return null;
+	try {
+		return { m, t, p, salt: b64decode(parts[4] as string), hash: b64decode(parts[5] as string) };
+	} catch {
+		return null;
+	}
+}
+
+export interface BunPasswordShim {
+	verify(password: string, hash: string): Promise<boolean>;
+	hash(
+		password: string,
+		options?: { algorithm?: string; memoryCost?: number; timeCost?: number },
+	): Promise<string>;
+}
+
+export const workerPassword: BunPasswordShim = {
+	async verify(password, encoded) {
+		if (!password || !encoded) return false;
+		try {
+			const phc = parsePhc(encoded);
+			if (!phc) return false;
+			const derive = await argon2();
+			const derived = derive({
+				password: new TextEncoder().encode(password),
+				salt: phc.salt,
+				// 🔴 The STORED parameters, never this file's defaults. A hash written
+				// under a different cost must still verify, or rotating the cost locks
+				// the owner out of their own app.
+				passes: phc.t,
+				memorySize: phc.m,
+				parallelism: phc.p,
+				tagLength: phc.hash.length,
+			});
+			// Through the fleet's one constant-time primitive, exactly as
+			// `sync/tokens.ts` compares digests. A `===` here is a timing oracle on the
+			// one comparison in the app where it would matter.
+			return constantTimeEqualBytes(derived, phc.hash);
+		} catch (error) {
+			// A malformed stored hash must fail CLOSED, exactly as `auth.ts` does on
+			// Bun. Returning `false` rather than throwing keeps the refusal a phrase
+			// instead of a 500 that tells a caller the hash is broken.
+			//
+			// 🔴 But it is LOGGED, because a silent `false` here is indistinguishable
+			// from a wrong password — and on 2026-09-18 that cost a diagnosis: a
+			// working credential was refused and the only line anywhere said "invalid
+			// email or password". Never the password, never the hash; the error only.
+			console.error(
+				`[cursedbelt-server/worker-argon2] argon2 verification threw: ${error instanceof Error ? error.message : String(error)}`,
+			);
+			return false;
+		}
+	},
+
+	async hash(password, options = {}) {
+		const salt = new Uint8Array(SALT_BYTES);
+		crypto.getRandomValues(salt);
+		// `memoryCost`/`timeCost` are Bun's names; `cursedbelt-server/password` passes exactly
+		// those two, and its test profile passes much smaller ones.
+		const m = options.memoryCost ?? DEFAULT_MEMORY_KIB;
+		const t = options.timeCost ?? DEFAULT_ITERATIONS;
+		const derive = await argon2();
+		const derived = derive({
+			password: new TextEncoder().encode(password),
+			salt,
+			passes: t,
+			memorySize: m,
+			parallelism: DEFAULT_PARALLELISM,
+			tagLength: HASH_BYTES,
+		});
+		return `$argon2id$v=19$m=${m},t=${t},p=${DEFAULT_PARALLELISM}$${b64encode(salt)}$${b64encode(derived)}`;
+	},
+};
+
+/**
+ * Install the shim, once, before any route can run.
+ *
+ * Idempotent, and it never overwrites a real `Bun` — so importing this module in a
+ * Bun test does nothing, which is what keeps the gate honest about the Mac.
+ */
+export function installBunPasswordShim(): void {
+	const existing = (globalThis as { Bun?: unknown }).Bun;
+	if (existing) return;
+	(globalThis as { Bun?: unknown }).Bun = { password: workerPassword };
+}

package/src/server/worker-argon2/wasm.d.ts

@@ -0,0 +1,9 @@
+/**
+ * A `.wasm` import, as the two runtimes that load this code spell it: wrangler bundles the file
+ * as a `CompiledWasm` module and hands over a `WebAssembly.Module`; Bun hands over the file's
+ * path. `./argon2.ts` accepts both, and is the only importer outside its spec.
+ */
+declare module "*.wasm" {
+	const source: WebAssembly.Module | string;
+	export default source;
+}