mitigator 1.0.0 → 1.0.1

package/dist/index.d.cts

@@ -300,25 +300,19 @@ interface PasskeyRegistrationResult {
  * decoding both sides from base64url, per the WebAuthn Level 2 spec §7.1.
  */
 declare const verifyPasskeyRegistration: (clientDataJSONStr: string, expectedChallenge: string, expectedOrigin?: string) => PasskeyRegistrationResult;
+interface AuthenticatorDataResult {
+    rpIdHash: Buffer$1;
+    flags: number;
+    signCount: number;
+    aaguid?: Buffer$1;
+    credentialId?: string;
+    publicKeyBytes?: string;
+}
 /**
  * Parses WebAuthn raw authenticator data (authData) buffer to extract the
  * aaguid, credential ID, and public key bytes according to the FIDO2 spec.
  */
-declare const parseAuthenticatorData: (authData: Buffer$1) => {
-    rpIdHash: Buffer$1<ArrayBufferLike>;
-    flags: number;
-    signCount: number;
-    aaguid?: undefined;
-    credentialId?: undefined;
-    publicKeyBytes?: undefined;
-} | {
-    rpIdHash: Buffer$1<ArrayBufferLike>;
-    flags: number;
-    signCount: number;
-    aaguid: Buffer$1<ArrayBufferLike>;
-    credentialId: string;
-    publicKeyBytes: string;
-} | null;
+declare const parseAuthenticatorData: (authData: Buffer$1) => AuthenticatorDataResult | null;
 /**
  * Result returned by `verifyPasskeyAssertion`.
  */
@@ -373,6 +367,7 @@ interface PasskeyAssertionResult {
  */
 declare const verifyPasskeyAssertion: (clientDataJSONStr: string, expectedChallenge: string, expectedOrigin: string, storedSignCount: number, authData: Buffer$1, signature: Buffer$1, publicKeyPem: string) => PasskeyAssertionResult;
 
+type index$7_AuthenticatorDataResult = AuthenticatorDataResult;
 type index$7_PasskeyAssertionResult = PasskeyAssertionResult;
 type index$7_PasskeyRegistrationResult = PasskeyRegistrationResult;
 declare const index$7_basicAuth: typeof basicAuth;
@@ -393,7 +388,7 @@ declare const index$7_verifyPasskeyAssertion: typeof verifyPasskeyAssertion;
 declare const index$7_verifyPasskeyRegistration: typeof verifyPasskeyRegistration;
 declare const index$7_verifyPasskeySignature: typeof verifyPasskeySignature;
 declare namespace index$7 {
-  export { type index$7_PasskeyAssertionResult as PasskeyAssertionResult, type index$7_PasskeyRegistrationResult as PasskeyRegistrationResult, index$7_basicAuth as basicAuth, index$7_can as can, index$7_canAccess as canAccess, index$7_generateCSRF as generateCSRF, index$7_generateHmacChallenge as generateHmacChallenge, index$7_generateHoneyToken as generateHoneyToken, index$7_generatePasskeyChallenge as generatePasskeyChallenge, index$7_hasRole as hasRole, index$7_isHoneyToken as isHoneyToken, index$7_isJwtValid as isJwtValid, index$7_parseAuthenticatorData as parseAuthenticatorData, index$7_suggestMFA as suggestMFA, index$7_verifyCSRF as verifyCSRF, index$7_verifyHmacResponse as verifyHmacResponse, index$7_verifyPasskeyAssertion as verifyPasskeyAssertion, index$7_verifyPasskeyRegistration as verifyPasskeyRegistration, index$7_verifyPasskeySignature as verifyPasskeySignature };
+  export { type index$7_AuthenticatorDataResult as AuthenticatorDataResult, type index$7_PasskeyAssertionResult as PasskeyAssertionResult, type index$7_PasskeyRegistrationResult as PasskeyRegistrationResult, index$7_basicAuth as basicAuth, index$7_can as can, index$7_canAccess as canAccess, index$7_generateCSRF as generateCSRF, index$7_generateHmacChallenge as generateHmacChallenge, index$7_generateHoneyToken as generateHoneyToken, index$7_generatePasskeyChallenge as generatePasskeyChallenge, index$7_hasRole as hasRole, index$7_isHoneyToken as isHoneyToken, index$7_isJwtValid as isJwtValid, index$7_parseAuthenticatorData as parseAuthenticatorData, index$7_suggestMFA as suggestMFA, index$7_verifyCSRF as verifyCSRF, index$7_verifyHmacResponse as verifyHmacResponse, index$7_verifyPasskeyAssertion as verifyPasskeyAssertion, index$7_verifyPasskeyRegistration as verifyPasskeyRegistration, index$7_verifyPasskeySignature as verifyPasskeySignature };
 }
 
 /**

package/dist/index.d.ts

@@ -300,25 +300,19 @@ interface PasskeyRegistrationResult {
  * decoding both sides from base64url, per the WebAuthn Level 2 spec §7.1.
  */
 declare const verifyPasskeyRegistration: (clientDataJSONStr: string, expectedChallenge: string, expectedOrigin?: string) => PasskeyRegistrationResult;
+interface AuthenticatorDataResult {
+    rpIdHash: Buffer$1;
+    flags: number;
+    signCount: number;
+    aaguid?: Buffer$1;
+    credentialId?: string;
+    publicKeyBytes?: string;
+}
 /**
  * Parses WebAuthn raw authenticator data (authData) buffer to extract the
  * aaguid, credential ID, and public key bytes according to the FIDO2 spec.
  */
-declare const parseAuthenticatorData: (authData: Buffer$1) => {
-    rpIdHash: Buffer$1<ArrayBufferLike>;
-    flags: number;
-    signCount: number;
-    aaguid?: undefined;
-    credentialId?: undefined;
-    publicKeyBytes?: undefined;
-} | {
-    rpIdHash: Buffer$1<ArrayBufferLike>;
-    flags: number;
-    signCount: number;
-    aaguid: Buffer$1<ArrayBufferLike>;
-    credentialId: string;
-    publicKeyBytes: string;
-} | null;
+declare const parseAuthenticatorData: (authData: Buffer$1) => AuthenticatorDataResult | null;
 /**
  * Result returned by `verifyPasskeyAssertion`.
  */
@@ -373,6 +367,7 @@ interface PasskeyAssertionResult {
  */
 declare const verifyPasskeyAssertion: (clientDataJSONStr: string, expectedChallenge: string, expectedOrigin: string, storedSignCount: number, authData: Buffer$1, signature: Buffer$1, publicKeyPem: string) => PasskeyAssertionResult;
 
+type index$7_AuthenticatorDataResult = AuthenticatorDataResult;
 type index$7_PasskeyAssertionResult = PasskeyAssertionResult;
 type index$7_PasskeyRegistrationResult = PasskeyRegistrationResult;
 declare const index$7_basicAuth: typeof basicAuth;
@@ -393,7 +388,7 @@ declare const index$7_verifyPasskeyAssertion: typeof verifyPasskeyAssertion;
 declare const index$7_verifyPasskeyRegistration: typeof verifyPasskeyRegistration;
 declare const index$7_verifyPasskeySignature: typeof verifyPasskeySignature;
 declare namespace index$7 {
-  export { type index$7_PasskeyAssertionResult as PasskeyAssertionResult, type index$7_PasskeyRegistrationResult as PasskeyRegistrationResult, index$7_basicAuth as basicAuth, index$7_can as can, index$7_canAccess as canAccess, index$7_generateCSRF as generateCSRF, index$7_generateHmacChallenge as generateHmacChallenge, index$7_generateHoneyToken as generateHoneyToken, index$7_generatePasskeyChallenge as generatePasskeyChallenge, index$7_hasRole as hasRole, index$7_isHoneyToken as isHoneyToken, index$7_isJwtValid as isJwtValid, index$7_parseAuthenticatorData as parseAuthenticatorData, index$7_suggestMFA as suggestMFA, index$7_verifyCSRF as verifyCSRF, index$7_verifyHmacResponse as verifyHmacResponse, index$7_verifyPasskeyAssertion as verifyPasskeyAssertion, index$7_verifyPasskeyRegistration as verifyPasskeyRegistration, index$7_verifyPasskeySignature as verifyPasskeySignature };
+  export { type index$7_AuthenticatorDataResult as AuthenticatorDataResult, type index$7_PasskeyAssertionResult as PasskeyAssertionResult, type index$7_PasskeyRegistrationResult as PasskeyRegistrationResult, index$7_basicAuth as basicAuth, index$7_can as can, index$7_canAccess as canAccess, index$7_generateCSRF as generateCSRF, index$7_generateHmacChallenge as generateHmacChallenge, index$7_generateHoneyToken as generateHoneyToken, index$7_generatePasskeyChallenge as generatePasskeyChallenge, index$7_hasRole as hasRole, index$7_isHoneyToken as isHoneyToken, index$7_isJwtValid as isJwtValid, index$7_parseAuthenticatorData as parseAuthenticatorData, index$7_suggestMFA as suggestMFA, index$7_verifyCSRF as verifyCSRF, index$7_verifyHmacResponse as verifyHmacResponse, index$7_verifyPasskeyAssertion as verifyPasskeyAssertion, index$7_verifyPasskeyRegistration as verifyPasskeyRegistration, index$7_verifyPasskeySignature as verifyPasskeySignature };
 }
 
 /**

package/dist/index.js

@@ -243,7 +243,11 @@ var isJwtValid = (token, secretOrPublicKey, algorithm = "HS256") => {
     if (!header.alg || header.alg.toLowerCase() === "none" || header.alg !== algorithm)
       return false;
     const payload = JSON.parse(Buffer2.from(payloadB64, "base64url").toString("utf8"));
-    if (payload.exp && Date.now() >= payload.exp * 1e3) return false;
+    const nowSec = Math.floor(Date.now() / 1e3);
+    const clockToleranceSec = 60;
+    if (payload.exp && nowSec >= payload.exp) return false;
+    if (payload.nbf && nowSec + clockToleranceSec < payload.nbf) return false;
+    if (payload.iat && nowSec + clockToleranceSec < payload.iat) return false;
     const dataToSign = `${headerB64}.${payloadB64}`;
     const signatureBuffer = Buffer2.from(signatureB64, "base64url");
     if (algorithm.startsWith("HS")) {
@@ -958,28 +962,20 @@ var TokenBucket = class {
   buckets = /* @__PURE__ */ new Map();
   async consume(id, tokens = 1) {
     const now = Date.now();
-    const bucket = this.buckets.get(id);
+    let bucket = this.buckets.get(id);
     if (bucket) {
       const delta = (now - bucket.lastRefill) / 1e3;
       const refill = delta * this.refillRatePerSecond;
       bucket.tokens = Math.min(this.capacity, bucket.tokens + refill);
       bucket.lastRefill = now;
     } else {
-      const newBucket = { tokens: this.capacity, lastRefill: now };
-      if (newBucket.tokens >= tokens) {
-        newBucket.tokens -= tokens;
-        this.buckets.set(id, newBucket);
-        return true;
-      }
-      this.buckets.set(id, newBucket);
-      return false;
+      bucket = { tokens: this.capacity, lastRefill: now };
+      this.buckets.set(id, bucket);
     }
     if (bucket.tokens >= tokens) {
       bucket.tokens -= tokens;
-      this.buckets.set(id, bucket);
       return true;
     }
-    this.buckets.set(id, bucket);
     return false;
   }
 };