kinetex 1.3.0 → 1.4.0

package/dist/cjs/dedup.js

@@ -75,29 +75,54 @@ export class DedupMap {
         const effectiveSignal = signal ?? this._globalSignal;
         // Handle abort signal (F-2): if signal is already aborted, don't dedupe
         if (effectiveSignal?.aborted) {
+            // Still a real network call. It used to return before the counters were
+            // touched, so a client whose method filter excluded everything reported
+            // totalRequests 0 and a hitRate of 0 after any number of real requests
+            // — and `misses` is documented as "requests that triggered a real
+            // network call". Both bypasses below now count.
+            this._misses++;
             return factory();
         }
         if (!this.methods.has(method.toUpperCase())) {
+            this._misses++;
             return factory();
         }
-        const key = this.keyFn(method, url, headers);
+        // The method is canonicalised before it reaches the key function. The
+        // methods filter has always been case-insensitive, but the key was built
+        // from the caller's spelling, so `execute("get", u)` and
+        // `execute("GET", u)` were two different keys and never coalesced — the
+        // one case a caller gets wrong most often, and one the library otherwise
+        // treats as equal everywhere.
+        const canonicalMethod = method.toUpperCase();
+        const key = this.keyFn(canonicalMethod, url, headers);
         const existing = this.inflight.get(key);
         if (existing) {
-            // Within window: return cached result
-            if (existing.resolvedAt !== null &&
-                effectiveWindowMs > 0 &&
-                Date.now() - existing.resolvedAt <= effectiveWindowMs) {
+            // In-flight: share the promise. This is coalescing, not caching, so it
+            // is not gated on the window.
+            if (existing.resolvedAt === null) {
                 this._hits++;
-                // Return the typed promise directly - preserves error type
                 return existing.promise;
             }
-            // In-flight: share the promise
-            if (existing.resolvedAt === null) {
+            // Within window: return cached result
+            if (effectiveWindowMs > 0 && Date.now() - existing.resolvedAt <= effectiveWindowMs) {
                 this._hits++;
+                // Return the typed promise directly - preserves error type
                 return existing.promise;
             }
-            // Expired window — fall through to new request
-            this.inflight.delete(key);
+            if (effectiveWindowMs > 0) {
+                // This caller's own window has lapsed — drop the stale entry and lead.
+                this.inflight.delete(key);
+            }
+            else {
+                // This caller explicitly asked for no window, so it gets its own
+                // request. It used to fall through to `inflight.delete(key)` and lead
+                // as well, which destroyed a window some *other* caller had
+                // established and was still relying on: one `windowMs: 0` call was
+                // enough to empty the cache for everyone, and the next windowed caller
+                // had to go to the network for a result that was still in hand.
+                this._misses++;
+                return factory();
+            }
         }
         this._misses++;
         // Create entry and register it in the inflight map BEFORE starting the async work
@@ -132,6 +157,16 @@ export class DedupMap {
         })().then((result) => {
             entry.resolvedAt = Date.now();
             entry.result = result;
+            // This entry may have lost the key while the factory was running: an
+            // abort, a `clear()`, or an `invalidate()` all drop it, and a later
+            // caller for the same URL then becomes the leader. Registering a
+            // window timer here regardless re-inserted a timer for a key someone
+            // else now owns, and when it fired it deleted their still-in-flight
+            // entry — so the request after that started a third copy. The
+            // identity check is what makes "who owns this key" decidable.
+            if (this.inflight.get(key) !== entry) {
+                return result;
+            }
             if (effectiveWindowMs <= 0) {
                 this.inflight.delete(key);
             }
@@ -155,7 +190,10 @@ export class DedupMap {
         }, (err) => {
             entry.resolvedAt = Date.now();
             entry.error = err;
-            this.inflight.delete(key);
+            // Same ownership rule as the success path: an entry that has already
+            // been dropped must not delete the entry that replaced it.
+            if (this.inflight.get(key) === entry)
+                this.inflight.delete(key);
             const existingTimeout = this.timeouts.get(key);
             if (existingTimeout !== undefined) {
                 clearTimeout(existingTimeout);

package/dist/cjs/digest.js

@@ -8,7 +8,7 @@
  * WWW-Authenticate challenge, compute the response hash, and format the
  * Authorization header in one call.
  */
-import { randomBytes } from "./utils.js";
+import { randomBytes, uint8ArrayToBase64 } from "./utils.js";
 // ============================================================================
 // §1  MD5 — Pure JS (no Web Crypto dependency)
 // ============================================================================
@@ -133,16 +133,37 @@ function md5(input) {
  * console.log(challenge.realm); // "testrealm@host.com"
  * ```
  */
+/** Decode a hex digest string into its raw bytes. */
+function hexToBytes(hex) {
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = parseInt(hex.substr(i * 2, 2), 16);
+    }
+    return out;
+}
+/** Decode `quoted-pair` escapes (RFC 7230 §3.2.6) in a quoted-string body. */
+function unescapeQuoted(value) {
+    return value.replace(/\\(.)/g, "$1");
+}
 export function parseDigestChallenge(header) {
     const challenge = {
         algorithm: "MD5",
     };
     const cleaned = header.replace(/^Digest\s+/i, "").trim();
-    const regex = /(\w+)\s*=\s*(?:"([^"]*)"|([^,\s]+))/g;
+    // A quoted-string may contain a `quoted-pair` (RFC 7230 §3.2.6): `"` and
+    // `\\` are literal characters, not delimiters. The previous `"([^"]*)"`
+    // stopped at the first quote regardless of a preceding backslash, so
+    // `realm="a\"b"` parsed as `a\` and left `b"` to be re-scanned as if it
+    // were another parameter — a realm containing a quote silently truncated
+    // the challenge, and `realm="x\", qop="auth-int"` did the same to `qop`.
+    // Round-tripping a header produced by `formatDigestAuth` was therefore
+    // lossy for exactly the values that need escaping.
+    const quotedString = '"((?:[^"\\\\]|\\\\.)*)"';
+    const regex = new RegExp(`(\\w+)\\s*=\\s*(?:${quotedString}|([^,\\s]+))`, "g");
     let match;
     while ((match = regex.exec(cleaned)) !== null) {
         const key = match[1].toLowerCase();
-        const value = (match[2] ?? match[3]);
+        const value = match[2] !== undefined ? unescapeQuoted(match[2]) : match[3];
         switch (key) {
             case "realm":
                 challenge.realm = value;
@@ -428,7 +449,11 @@ export async function computeDigestResponse(challenge, username, password, metho
     const realm = challenge.realm;
     const _cnonce = cnonce || randomBytes(5);
     const _nc = nc || "00000001";
-    const algo = resolveHashAlgo(challenge.algorithm);
+    const resolved = resolveHashAlgo(challenge.algorithm);
+    if (resolved === null) {
+        throw new Error(`Unsupported digest algorithm: ${challenge.algorithm}`);
+    }
+    const { algo, sess } = resolved;
     async function hash(s) {
         if (algo === "MD5")
             return md5(s);
@@ -436,12 +461,44 @@ export async function computeDigestResponse(challenge, username, password, metho
             return sha512256Hex(s);
         return await sha256Hex(s);
     }
-    const ha1 = await hash(`${username}:${realm}:${password}`);
+    // `-sess` binds the session (RFC 7616 §3.4.4/§3.4.5): the client nonce and
+    // the server nonce are folded into HA1, so the same credentials cannot be
+    // replayed under a different nonce. It requires `qop` to be present,
+    // because without one there is no cnonce to fold in.
+    // With `userhash=true`, RFC 7616 §3.4.4 substitutes the hashed username
+    // for the plaintext one everywhere it appears — including inside HA1.
+    const user = challenge.userhash
+        ? uint8ArrayToBase64(hexToBytes(await hash(`${username}:${realm}`)))
+        : username;
+    let ha1 = await hash(`${user}:${realm}:${password}`);
+    if (sess) {
+        if (!challenge.qop) {
+            throw new Error(`Digest algorithm ${challenge.algorithm} requires a qop parameter`);
+        }
+        ha1 = await hash(`${ha1}:${nonce}:${_cnonce}`);
+    }
     const ha2 = await hash(`${method}:${uri}`);
     let response;
     const qopList = qop.split(/\s*,\s*/).filter(Boolean);
-    if (qopList.includes("auth") || qopList.includes("auth-int")) {
-        response = await hash(`${ha1}:${nonce}:${_nc}:${_cnonce}:${qopList[0]}:${ha2}`);
+    if (qopList.length > 0) {
+        // RFC 7616 §3.4.3: with `qop=auth-int`, HA2 is
+        //   H(method:uri:H(entity-body))
+        // and the entity-body hash is part of the response. This API is not given
+        // the body, so that hash cannot be produced — and the old code took
+        // `qopList[0]` and used it in the response while still hashing
+        // H(method:uri). A server offering `qop="auth-int,auth"`, which RFC 7616
+        // §3.4.4 explicitly says a client may see, was therefore answered with a
+        // `qop=auth-int` header carrying a response computed as if it were `auth`:
+        // a client that claims a protection it does not implement, and fails
+        // against every conforming server.
+        //
+        // So: prefer `auth`, which is the only one implementable here, and refuse
+        // rather than answer wrongly when only `auth-int` is offered.
+        if (!qopList.includes("auth")) {
+            throw new Error(`Digest challenge offers only unsupported qop values: ${qopList.join(", ")}. ` +
+                `"auth-int" requires the entity body, which this API does not receive.`);
+        }
+        response = await hash(`${ha1}:${nonce}:${_nc}:${_cnonce}:auth:${ha2}`);
     }
     else {
         response = await hash(`${ha1}:${nonce}:${ha2}`);
@@ -455,13 +512,64 @@ export async function computeDigestResponse(challenge, username, password, metho
  * @param algorithm - Algorithm string from the challenge (e.g. "MD5", "SHA-256")
  * @returns The resolved algorithm identifier
  */
+/**
+ * Compute the `username*` value for a challenge offering `userhash=true`
+ * (RFC 7616 §3.4.4): `base64(H(username : realm))`.
+ *
+ * A server that sends `userhash=true` is telling the client *not* to send the
+ * username in the clear. The previous code parsed the flag, exposed it on the
+ * public {@link DigestChallenge} type with a JSDoc promising support, and then
+ * ignored it — sending a plain `username="admin"` back to a server that had
+ * explicitly asked for it to be hashed. That is a privacy regression, and the
+ * server rejects the request too, because HA1 was built from the unhashed name.
+ *
+ * @returns the base64 hashed username, or `null` when `userhash` is not offered
+ */
+export async function computeUsernameStar(challenge, username) {
+    if (!challenge.userhash)
+        return null;
+    const resolved = resolveHashAlgo(challenge.algorithm);
+    if (resolved === null) {
+        throw new Error(`Unsupported digest algorithm: ${challenge.algorithm}`);
+    }
+    const { algo } = resolved;
+    const digest = algo === "MD5"
+        ? md5(`${username}:${challenge.realm}`)
+        : algo === "SHA-512-256"
+            ? sha512256Hex(`${username}:${challenge.realm}`)
+            : await sha256Hex(`${username}:${challenge.realm}`);
+    return uint8ArrayToBase64(hexToBytes(digest));
+}
+/**
+ * Resolve the challenge's `algorithm` field to a base hash plus the
+ * `-sess` session-binding flag (RFC 7616 §3.4.4/§3.4.5).
+ *
+ * Two separate defects lived here. First, "anything unrecognised is MD5" was
+ * a silent downgrade: `SCRAM-SHA-256` and `garbage` were answered with a
+ * 32-hex MD5 under a header naming a different algorithm, so the server's
+ * rejection blamed an algorithm the caller never chose. Second, the
+ * `-sess` forms stripped to `MD5SESS`/`SHA256SESS`, matched nothing, and then
+ * fell through the `hash` dispatch to its SHA-256 default — so `MD5-sess`
+ * was computed with SHA-256, and `SHA-256-sess` happened to work only by
+ * accident. An unrecognised algorithm is now an error.
+ *
+ * @returns the base algorithm and whether HA1 is session-bound, or `null`
+ *          when the algorithm is not one we can compute
+ */
 function resolveHashAlgo(algorithm) {
-    const upper = algorithm.toUpperCase().replace(/-/g, "");
-    if (upper === "SHA256")
-        return "SHA-256";
-    if (upper === "SHA512256")
-        return "SHA-512-256";
-    return "MD5";
+    const trimmed = algorithm.trim();
+    const sess = /-sess$/i.test(trimmed);
+    const base = trimmed
+        .replace(/-sess$/i, "")
+        .toUpperCase()
+        .replace(/-/g, "");
+    if (base === "MD5")
+        return { algo: "MD5", sess };
+    if (base === "SHA256")
+        return { algo: "SHA-256", sess };
+    if (base === "SHA512256")
+        return { algo: "SHA-512-256", sess };
+    return null;
 }
 // ============================================================================
 // §5  DIGEST AUTHORIZATION HEADER FORMATTING
@@ -491,23 +599,49 @@ function resolveHashAlgo(algorithm) {
  *   "/dir/index.html", "f2/wE", "00000001");
  * ```
  */
-export function formatDigestAuth(challenge, username, response, uri, cnonce, nc) {
+/**
+ * Escape a value for a `quoted-string` (RFC 7230 §3.2.6): backslash and double
+ * quote are escaped, everything else passes through.
+ *
+ * A username or URI containing `"` previously terminated the quoted string
+ * early and everything after it was parsed as further auth-params — a
+ * username of `evil", qop=auth, x="` produced a header carrying an attacker-
+ * chosen `qop` and an extra parameter. `realm` and `opaque` come from the
+ * *server*, so a hostile or compromised one could inject into the client's own
+ * outgoing Authorization header.
+ */
+function quoted(value) {
+    return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+export function formatDigestAuth(challenge, username, response, uri, cnonce, nc, usernameStar) {
     const parts = [];
     const _cnonce = cnonce || randomBytes(5);
     const _nc = nc || "00000001";
-    parts.push(`username="${username}"`);
-    parts.push(`realm="${challenge.realm}"`);
-    parts.push(`nonce="${challenge.nonce}"`);
-    parts.push(`uri="${uri}"`);
-    parts.push(`response="${response}"`);
+    if (challenge.userhash) {
+        if (usernameStar === undefined) {
+            throw new Error("challenge offers userhash=true: pass the value from computeUsernameStar() " +
+                "as `usernameStar` — sending a plaintext username would defeat it");
+        }
+        parts.push(`username*="${quoted(usernameStar)}"`);
+    }
+    else {
+        if (usernameStar !== undefined) {
+            throw new Error("usernameStar was given but the challenge does not offer userhash");
+        }
+        parts.push(`username="${quoted(username)}"`);
+    }
+    parts.push(`realm="${quoted(challenge.realm)}"`);
+    parts.push(`nonce="${quoted(challenge.nonce)}"`);
+    parts.push(`uri="${quoted(uri)}"`);
+    parts.push(`response="${quoted(response)}"`);
     if (challenge.opaque)
-        parts.push(`opaque="${challenge.opaque}"`);
+        parts.push(`opaque="${quoted(challenge.opaque)}"`);
     if (challenge.algorithm && challenge.algorithm !== "MD5")
         parts.push(`algorithm=${challenge.algorithm}`);
     if (challenge.qop) {
-        parts.push(`qop=${challenge.qop.split(/\s*,\s*/)[0]}`);
+        parts.push(`qop=auth`);
         parts.push(`nc=${_nc}`);
-        parts.push(`cnonce="${_cnonce}"`);
+        parts.push(`cnonce="${quoted(_cnonce)}"`);
     }
     return `Digest ${parts.join(", ")}`;
 }
@@ -548,7 +682,8 @@ export async function createDigestAuthorization(wwwAuth, username, password, met
     const cnonce = randomBytes(5);
     const nc = "00000001";
     const response = await computeDigestResponse(challenge, username, password, method, uri, cnonce, nc);
-    return formatDigestAuth(challenge, username, response, uri, cnonce, nc);
+    const usernameStar = await computeUsernameStar(challenge, username);
+    return formatDigestAuth(challenge, username, response, uri, cnonce, nc, usernameStar ?? undefined);
 }
 /**
  * Stateful Digest-auth authorizer.
@@ -573,6 +708,7 @@ export function createDigestAuthorizer() {
         counters.set(scope, next);
         const nc = next.toString(16).padStart(8, "0");
         const response = await computeDigestResponse(challenge, username, password, method, uri, cnonce, nc);
-        return formatDigestAuth(challenge, username, response, uri, cnonce, nc);
+        const usernameStar = await computeUsernameStar(challenge, username);
+        return formatDigestAuth(challenge, username, response, uri, cnonce, nc, usernameStar ?? undefined);
     };
 }