laravel-workers 0.4.0 → 0.4.1

package/kernel/encrypter.mjs

@@ -103,4 +103,4 @@ export async function decryptString(payloadBase64, keyBase64) {
 }
 
 // Convenience sync-ish wrappers not possible (crypto.subtle is async). Export async only.
-export default { encryptString, decryptString, timingSafeEqual };
+export default { encryptString, decryptString, timingSafeEqual };

package/kernel/hash.mjs

@@ -1,113 +1,113 @@
-// kernel/hash.mjs � Hash (bcrypt)
-// Uses bcryptjs (pure JS, no native).
-import bcrypt from 'bcryptjs';
-
-// constant-time string/Uint8Array compare � does not early-return on first mismatch
-export function timingSafeEqual(a, b) {
-  const toBytes = (v) => {
-    if (v instanceof Uint8Array) return v;
-    if (typeof v === 'string') return new TextEncoder().encode(v);
-    if (typeof Buffer !== 'undefined' && v && Buffer.isBuffer(v)) return new Uint8Array(v);
-    return new TextEncoder().encode(String(v));
-  };
-  const aBytes = toBytes(a);
-  const bBytes = toBytes(b);
-  if (aBytes.length !== bBytes.length) return false;
-  try {
-    const f = globalThis.crypto && globalThis.crypto.timingSafeEqual;
-    if (typeof f === 'function' && typeof Buffer !== 'undefined') {
-      return f(Buffer.from(aBytes), Buffer.from(bBytes));
-    }
-  } catch {}
-  let diff = 0;
-  for (let i = 0; i < aBytes.length; i++) diff |= aBytes[i] ^ bBytes[i];
-  return diff === 0;
-}
-
-export async function make(value, { rounds = 10 } = {}) {
-  const salt = await bcrypt.genSalt(rounds);
-  const hash = await bcrypt.hash(String(value), salt);
-  // PHP 8.3 password_hash() emits `$2y$`; bcryptjs emits `$2a$`. Store the
-  // PHP prefix (like makeSync below) so password_get_info()-shaped checks
-  // (isHashed, verifyConfiguration, needsRehash) treat our own hashes as
-  // bcrypt - exactly like BcryptHasher.
-  return hash.replace(/^\$2[abxy]\$/, '$2y$');
-}
-
-// Synchronous bcrypt for Eloquent's `hashed` cast. Laravel's
-// castAttributeAsHashedString() runs Hash::make() inside setAttribute(), which is
-// synchronous in PHP, so the compiled Model#set() must hash before returning.
-// bcryptjs' hashSync costs the same CPU as the async form (measured in
-// kernel/tests/budget.test.mjs); callers on the free plan should expect the
-// configured cost (12 by default) per filled password.
-export function makeSync(value, { rounds = 12 } = {}) {
-  const salt = bcrypt.genSaltSync(Number(rounds));
-  const hash = bcrypt.hashSync(String(value), salt);
-  // PHP 8.3 password_hash() emits `$2y$`; bcryptjs emits `$2a$`. Store the
-  // PHP prefix so password_get_info()-shaped checks (verifyConfiguration,
-  // needsRehash) treat our own hashes as bcrypt, exactly like BcryptHasher.
-  return hash.replace(/^\$2[abxy]\$/, '$2y$');
-}
-
-// PHP 8.3 password_get_info() as measured against the vendor oracle: only a
-// full `$2y$NN$` + 53-char digest is bcrypt; `$2a$`/`$2b$` and truncated
-// strings report algo null; any `$argon2(id|i|d)$` prefix is argon2.
-const BCRYPT_2Y_60_RE = /^\$2y\$(\d{2})\$[./A-Za-z0-9]{53}$/;
-const ARGON2_PREFIX_RE = /^\$argon2(id|i|d)\$/;
-
-export function passwordInfo(value) {
-  if (typeof value !== 'string') return { algo: null, algoName: 'unknown', options: [] };
-  const m = BCRYPT_2Y_60_RE.exec(value);
-  if (m) {
-    return { algo: '2y', algoName: 'bcrypt', options: { cost: parseInt(m[1], 10) } };
-  }
-  const a = ARGON2_PREFIX_RE.exec(value);
-  if (a) {
-    return { algo: 'argon2' + a[1], algoName: 'argon2' + a[1], options: [] };
-  }
-  return { algo: null, algoName: 'unknown', options: [] };
-}
-
-// Laravel 13.37 HashManager::isHashed(): `driver()->info($value)['algo'] !== null`.
-// The `hashed` cast must use this exact check (a `$2a$` digest is re-hashed by
-// Laravel on PHP 8.3, while `$2y$` passes through).
-export function isHashedDigest(value) {
-  return passwordInfo(value).algo !== null;
-}
-
-// Laravel 13.37 BcryptHasher::verifyConfiguration():
-//   isUsingCorrectAlgorithm($value) && isUsingValidOptions($value)
-// where PHP's password_get_info() identifies ONLY `$2y$NN$` as bcrypt, and the
-// cost must be an integer <= the configured rounds (a lower cost is valid).
-export function verifyConfiguration(hashed, { rounds = 12 } = {}) {
-  const info = passwordInfo(hashed);
-  if (info.algoName !== 'bcrypt') return false;
-  return info.options.cost <= Number(rounds);
-}
-
-export async function check(value, hashed) {
-  if (!hashed || typeof hashed !== 'string') return false;
-  const ok = await bcrypt.compare(String(value), hashed);
-  return timingSafeEqual(ok ? '1' : '0', '1');
-}
-
-export function needsRehash(hashed, { rounds = 10 } = {}) {
-  if (!hashed || typeof hashed !== 'string') return true;
-  try {
-    const r = bcrypt.getRounds(hashed);
-    return r !== rounds;
-  } catch {
-    return true;
-  }
-}
-
-// Laravel `Hash::isHashed()` (HashManager.php:97-100): `$this->driver()->info(
-// $value)['algo'] !== null` - the same rule as password_get_info(). The kernel
-// used a loose regex, so a `$2a$`/`$2b$` digest or a TRUNCATED one counted as
-// hashed where PHP says it is not (Laravel's own isHashedDigest() is the
-// faithful rule - the driver checks the digest, not its shape).
-export function isHashed(value) {
-  return isHashedDigest(value);
-}
-
-export default { make, makeSync, check, needsRehash, isHashed, isHashedDigest, passwordInfo, verifyConfiguration, timingSafeEqual };
+// kernel/hash.mjs � Hash (bcrypt)
+// Uses bcryptjs (pure JS, no native).
+import bcrypt from 'bcryptjs';
+
+// constant-time string/Uint8Array compare � does not early-return on first mismatch
+export function timingSafeEqual(a, b) {
+  const toBytes = (v) => {
+    if (v instanceof Uint8Array) return v;
+    if (typeof v === 'string') return new TextEncoder().encode(v);
+    if (typeof Buffer !== 'undefined' && v && Buffer.isBuffer(v)) return new Uint8Array(v);
+    return new TextEncoder().encode(String(v));
+  };
+  const aBytes = toBytes(a);
+  const bBytes = toBytes(b);
+  if (aBytes.length !== bBytes.length) return false;
+  try {
+    const f = globalThis.crypto && globalThis.crypto.timingSafeEqual;
+    if (typeof f === 'function' && typeof Buffer !== 'undefined') {
+      return f(Buffer.from(aBytes), Buffer.from(bBytes));
+    }
+  } catch {}
+  let diff = 0;
+  for (let i = 0; i < aBytes.length; i++) diff |= aBytes[i] ^ bBytes[i];
+  return diff === 0;
+}
+
+export async function make(value, { rounds = 10 } = {}) {
+  const salt = await bcrypt.genSalt(rounds);
+  const hash = await bcrypt.hash(String(value), salt);
+  // PHP 8.3 password_hash() emits `$2y$`; bcryptjs emits `$2a$`. Store the
+  // PHP prefix (like makeSync below) so password_get_info()-shaped checks
+  // (isHashed, verifyConfiguration, needsRehash) treat our own hashes as
+  // bcrypt - exactly like BcryptHasher.
+  return hash.replace(/^\$2[abxy]\$/, '$2y$');
+}
+
+// Synchronous bcrypt for Eloquent's `hashed` cast. Laravel's
+// castAttributeAsHashedString() runs Hash::make() inside setAttribute(), which is
+// synchronous in PHP, so the compiled Model#set() must hash before returning.
+// bcryptjs' hashSync costs the same CPU as the async form (measured in
+// kernel/tests/budget.test.mjs); callers on the free plan should expect the
+// configured cost (12 by default) per filled password.
+export function makeSync(value, { rounds = 12 } = {}) {
+  const salt = bcrypt.genSaltSync(Number(rounds));
+  const hash = bcrypt.hashSync(String(value), salt);
+  // PHP 8.3 password_hash() emits `$2y$`; bcryptjs emits `$2a$`. Store the
+  // PHP prefix so password_get_info()-shaped checks (verifyConfiguration,
+  // needsRehash) treat our own hashes as bcrypt, exactly like BcryptHasher.
+  return hash.replace(/^\$2[abxy]\$/, '$2y$');
+}
+
+// PHP 8.3 password_get_info() as measured against the vendor oracle: only a
+// full `$2y$NN$` + 53-char digest is bcrypt; `$2a$`/`$2b$` and truncated
+// strings report algo null; any `$argon2(id|i|d)$` prefix is argon2.
+const BCRYPT_2Y_60_RE = /^\$2y\$(\d{2})\$[./A-Za-z0-9]{53}$/;
+const ARGON2_PREFIX_RE = /^\$argon2(id|i|d)\$/;
+
+export function passwordInfo(value) {
+  if (typeof value !== 'string') return { algo: null, algoName: 'unknown', options: [] };
+  const m = BCRYPT_2Y_60_RE.exec(value);
+  if (m) {
+    return { algo: '2y', algoName: 'bcrypt', options: { cost: parseInt(m[1], 10) } };
+  }
+  const a = ARGON2_PREFIX_RE.exec(value);
+  if (a) {
+    return { algo: 'argon2' + a[1], algoName: 'argon2' + a[1], options: [] };
+  }
+  return { algo: null, algoName: 'unknown', options: [] };
+}
+
+// Laravel 13.37 HashManager::isHashed(): `driver()->info($value)['algo'] !== null`.
+// The `hashed` cast must use this exact check (a `$2a$` digest is re-hashed by
+// Laravel on PHP 8.3, while `$2y$` passes through).
+export function isHashedDigest(value) {
+  return passwordInfo(value).algo !== null;
+}
+
+// Laravel 13.37 BcryptHasher::verifyConfiguration():
+//   isUsingCorrectAlgorithm($value) && isUsingValidOptions($value)
+// where PHP's password_get_info() identifies ONLY `$2y$NN$` as bcrypt, and the
+// cost must be an integer <= the configured rounds (a lower cost is valid).
+export function verifyConfiguration(hashed, { rounds = 12 } = {}) {
+  const info = passwordInfo(hashed);
+  if (info.algoName !== 'bcrypt') return false;
+  return info.options.cost <= Number(rounds);
+}
+
+export async function check(value, hashed) {
+  if (!hashed || typeof hashed !== 'string') return false;
+  const ok = await bcrypt.compare(String(value), hashed);
+  return timingSafeEqual(ok ? '1' : '0', '1');
+}
+
+export function needsRehash(hashed, { rounds = 10 } = {}) {
+  if (!hashed || typeof hashed !== 'string') return true;
+  try {
+    const r = bcrypt.getRounds(hashed);
+    return r !== rounds;
+  } catch {
+    return true;
+  }
+}
+
+// Laravel `Hash::isHashed()` (HashManager.php:97-100): `$this->driver()->info(
+// $value)['algo'] !== null` - the same rule as password_get_info(). The kernel
+// used a loose regex, so a `$2a$`/`$2b$` digest or a TRUNCATED one counted as
+// hashed where PHP says it is not (Laravel's own isHashedDigest() is the
+// faithful rule - the driver checks the digest, not its shape).
+export function isHashed(value) {
+  return isHashedDigest(value);
+}
+
+export default { make, makeSync, check, needsRehash, isHashed, isHashedDigest, passwordInfo, verifyConfiguration, timingSafeEqual };

package/kernel/multipart.mjs

@@ -1,161 +1,161 @@
-// kernel/multipart.mjs — the multipart/form-data parser (the edge has no PHP).
-//
-// The body is the raw bytes; the parts are split on the boundary. A part with a
-// `filename` is an uploaded file (the bytes as they are), the other parts are
-// the form fields.
-const enc = new TextEncoder();
-const dec = new TextDecoder('utf-8', { fatal: false });
-
-function indexOfBytes(hay, needle, from) {
-  outer: for (let i = Math.max(0, from); i + needle.length <= hay.length; i++) {
-    for (let j = 0; j < needle.length; j++) {
-      if (hay[i + j] !== needle[j]) continue outer;
-    }
-    return i;
-  }
-  return -1;
-}
-
-export function parseMultipart(bytes, contentType) {
-  if (!(bytes instanceof Uint8Array)) {
-    throw new Error('multipart/form-data: the body must be the raw bytes');
-  }
-  const m = /boundary=(?:"([^"]+)"|([^;]+))/i.exec(contentType || '');
-  if (!m) throw new Error('multipart/form-data: the boundary is missing');
-  const boundary = (m[1] || m[2] || '').trim();
-  const delim = enc.encode('--' + boundary);
-  const fields = {};
-  const files = {};
-  // PHP's rfc1867 parser (ext/standard/rfc1867.c): the delimiter is
-  // CRLF + "--boundary" - a file whose CONTENT contains the boundary bytes
-  // must not end the part (the edge searched the bare bytes, so such a file
-  // truncated the upload). The FIRST boundary starts the body (no CRLF before
-  // it).
-  const findDelimiter = (from) => {
-    let at = from;
-    for (;;) {
-      const found = indexOfBytes(bytes, delim, at);
-      if (found === -1) return -1;
-      if (found === 0 || (bytes[found - 1] === 10 && bytes[found - 2] === 13)) return found;
-      at = found + 1;
-    }
-  };
-  let pos = findDelimiter(0);
-  if (pos === -1) throw new Error('multipart/form-data: the body has no boundary');
-  pos += delim.length;
-  for (;;) {
-    // the closing delimiter is "--boundary--"
-    if (bytes[pos] === 45 && bytes[pos + 1] === 45) break;
-    if (bytes[pos] === 13 && bytes[pos + 1] === 10) pos += 2;
-    const headEnd = indexOfBytes(bytes, enc.encode('\r\n\r\n'), pos);
-    if (headEnd === -1) break;
-    const head = dec.decode(bytes.subarray(pos, headEnd));
-    const bodyStart = headEnd + 4;
-    const next = findDelimiter(bodyStart);
-    if (next === -1) break;
-    // the part's body ends with a CRLF before the delimiter
-    let end = next;
-    if (end >= 2 && bytes[end - 1] === 10 && bytes[end - 2] === 13) end -= 2;
-    const content = bytes.subarray(bodyStart, end);
-    let name = null;
-    let filename = null;
-    let mime = 'application/octet-stream';
-    for (const line of head.split('\r\n')) {
-      const colon = line.indexOf(':');
-      if (colon === -1) continue;
-      const key = line.slice(0, colon).trim().toLowerCase();
-      const value = line.slice(colon + 1).trim();
-      if (key === 'content-disposition') {
-        const nm = /name="([^"]*)"/i.exec(value);
-        if (nm) name = nm[1];
-        const fn = /filename="([^"]*)"/i.exec(value);
-        if (fn) filename = fn[1];
-      } else if (key === 'content-type') {
-        mime = value;
-      }
-    }
-    if (name !== null) {
-      if (filename !== null) {
-        setFile(files, name, {
-          name,
-          filename,
-          mime,
-          bytes: content,
-          size: content.length,
-          __part: true,
-        });
-      } else {
-        fields[name] = dec.decode(content);
-      }
-    }
-    pos = next + delim.length;
-  }
-  return { fields, files };
-}
-
-// PHP's $_FILES naming: 'photos[]' is an append, 'photos[0]' is an index,
-// 'a[b]' is a key. The parser writes the files into the same shape.
-function setFile(files, name, desc) {
-  const m = /^([^[\]]*)((?:\[[^[\]]*\])*)$/.exec(name);
-  const base = m ? m[1] : name;
-  const brackets = m ? m[2] : '';
-  if (!brackets) {
-    if (base === '') files[''] = desc;
-    else files[base] = desc;
-    return;
-  }
-  // The path: the base + every bracket key ('' means "append").
-  const keys = brackets.slice(1, -1).split('][');
-  let node = files;
-  let container = base;
-  for (let i = 0; i < keys.length; i++) {
-    const key = keys[i];
-    if (container === '') {
-      container = '0';
-      if (!node[container] || typeof node[container] !== 'object') node[container] = [];
-    }
-    let child = node[container];
-    if (!child || typeof child !== 'object' || child.__uploadedFile || child.__part) {
-      // The next key decides the shape: '' or a number is a list, else a map.
-      const next = keys[i + 1];
-      child = next === undefined || next === '' || /^\d+$/.test(next) ? [] : {};
-      node[container] = child;
-    }
-    if (Array.isArray(child)) {
-      if (key === '') {
-        // The last segment: append the file.
-        if (i === keys.length - 1) {
-          child.push(desc);
-          return;
-        }
-        const created = [];
-        child.push(created);
-        node = created;
-        container = '';
-        continue;
-      }
-      const idx = Number(key);
-      if (!Number.isInteger(idx) || idx < 0) continue;
-      if (i === keys.length - 1) {
-        child[idx] = desc;
-        return;
-      }
-      if (!child[idx] || typeof child[idx] !== 'object') child[idx] = [];
-      node = child[idx];
-      container = '';
-      continue;
-    }
-    if (i === keys.length - 1) {
-      child[key] = desc;
-      return;
-    }
-    const next = keys[i + 1];
-    if (!child[key] || typeof child[key] !== 'object') {
-      child[key] = next === '' || /^\d+$/.test(next) ? [] : {};
-    }
-    node = child[key];
-    container = key;
-  }
-}
-
-export default { parseMultipart };
+// kernel/multipart.mjs — the multipart/form-data parser (the edge has no PHP).
+//
+// The body is the raw bytes; the parts are split on the boundary. A part with a
+// `filename` is an uploaded file (the bytes as they are), the other parts are
+// the form fields.
+const enc = new TextEncoder();
+const dec = new TextDecoder('utf-8', { fatal: false });
+
+function indexOfBytes(hay, needle, from) {
+  outer: for (let i = Math.max(0, from); i + needle.length <= hay.length; i++) {
+    for (let j = 0; j < needle.length; j++) {
+      if (hay[i + j] !== needle[j]) continue outer;
+    }
+    return i;
+  }
+  return -1;
+}
+
+export function parseMultipart(bytes, contentType) {
+  if (!(bytes instanceof Uint8Array)) {
+    throw new Error('multipart/form-data: the body must be the raw bytes');
+  }
+  const m = /boundary=(?:"([^"]+)"|([^;]+))/i.exec(contentType || '');
+  if (!m) throw new Error('multipart/form-data: the boundary is missing');
+  const boundary = (m[1] || m[2] || '').trim();
+  const delim = enc.encode('--' + boundary);
+  const fields = {};
+  const files = {};
+  // PHP's rfc1867 parser (ext/standard/rfc1867.c): the delimiter is
+  // CRLF + "--boundary" - a file whose CONTENT contains the boundary bytes
+  // must not end the part (the edge searched the bare bytes, so such a file
+  // truncated the upload). The FIRST boundary starts the body (no CRLF before
+  // it).
+  const findDelimiter = (from) => {
+    let at = from;
+    for (;;) {
+      const found = indexOfBytes(bytes, delim, at);
+      if (found === -1) return -1;
+      if (found === 0 || (bytes[found - 1] === 10 && bytes[found - 2] === 13)) return found;
+      at = found + 1;
+    }
+  };
+  let pos = findDelimiter(0);
+  if (pos === -1) throw new Error('multipart/form-data: the body has no boundary');
+  pos += delim.length;
+  for (;;) {
+    // the closing delimiter is "--boundary--"
+    if (bytes[pos] === 45 && bytes[pos + 1] === 45) break;
+    if (bytes[pos] === 13 && bytes[pos + 1] === 10) pos += 2;
+    const headEnd = indexOfBytes(bytes, enc.encode('\r\n\r\n'), pos);
+    if (headEnd === -1) break;
+    const head = dec.decode(bytes.subarray(pos, headEnd));
+    const bodyStart = headEnd + 4;
+    const next = findDelimiter(bodyStart);
+    if (next === -1) break;
+    // the part's body ends with a CRLF before the delimiter
+    let end = next;
+    if (end >= 2 && bytes[end - 1] === 10 && bytes[end - 2] === 13) end -= 2;
+    const content = bytes.subarray(bodyStart, end);
+    let name = null;
+    let filename = null;
+    let mime = 'application/octet-stream';
+    for (const line of head.split('\r\n')) {
+      const colon = line.indexOf(':');
+      if (colon === -1) continue;
+      const key = line.slice(0, colon).trim().toLowerCase();
+      const value = line.slice(colon + 1).trim();
+      if (key === 'content-disposition') {
+        const nm = /name="([^"]*)"/i.exec(value);
+        if (nm) name = nm[1];
+        const fn = /filename="([^"]*)"/i.exec(value);
+        if (fn) filename = fn[1];
+      } else if (key === 'content-type') {
+        mime = value;
+      }
+    }
+    if (name !== null) {
+      if (filename !== null) {
+        setFile(files, name, {
+          name,
+          filename,
+          mime,
+          bytes: content,
+          size: content.length,
+          __part: true,
+        });
+      } else {
+        fields[name] = dec.decode(content);
+      }
+    }
+    pos = next + delim.length;
+  }
+  return { fields, files };
+}
+
+// PHP's $_FILES naming: 'photos[]' is an append, 'photos[0]' is an index,
+// 'a[b]' is a key. The parser writes the files into the same shape.
+function setFile(files, name, desc) {
+  const m = /^([^[\]]*)((?:\[[^[\]]*\])*)$/.exec(name);
+  const base = m ? m[1] : name;
+  const brackets = m ? m[2] : '';
+  if (!brackets) {
+    if (base === '') files[''] = desc;
+    else files[base] = desc;
+    return;
+  }
+  // The path: the base + every bracket key ('' means "append").
+  const keys = brackets.slice(1, -1).split('][');
+  let node = files;
+  let container = base;
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    if (container === '') {
+      container = '0';
+      if (!node[container] || typeof node[container] !== 'object') node[container] = [];
+    }
+    let child = node[container];
+    if (!child || typeof child !== 'object' || child.__uploadedFile || child.__part) {
+      // The next key decides the shape: '' or a number is a list, else a map.
+      const next = keys[i + 1];
+      child = next === undefined || next === '' || /^\d+$/.test(next) ? [] : {};
+      node[container] = child;
+    }
+    if (Array.isArray(child)) {
+      if (key === '') {
+        // The last segment: append the file.
+        if (i === keys.length - 1) {
+          child.push(desc);
+          return;
+        }
+        const created = [];
+        child.push(created);
+        node = created;
+        container = '';
+        continue;
+      }
+      const idx = Number(key);
+      if (!Number.isInteger(idx) || idx < 0) continue;
+      if (i === keys.length - 1) {
+        child[idx] = desc;
+        return;
+      }
+      if (!child[idx] || typeof child[idx] !== 'object') child[idx] = [];
+      node = child[idx];
+      container = '';
+      continue;
+    }
+    if (i === keys.length - 1) {
+      child[key] = desc;
+      return;
+    }
+    const next = keys[i + 1];
+    if (!child[key] || typeof child[key] !== 'object') {
+      child[key] = next === '' || /^\d+$/.test(next) ? [] : {};
+    }
+    node = child[key];
+    container = key;
+  }
+}
+
+export default { parseMultipart };