mrpc-js 0.1.0 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mrpc-js",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Zero-dependency mRPC request encoder and HMAC-SHA256 response validator",
   "keywords": [
     "mrpc",

package/src/mrpc.js

@@ -18,6 +18,7 @@ export async function create_mRPC(user_id, token, version, payload) {
         request_tag: tag,
         seed: seed,
         data: payload,
+        timestamp: Date.now(),
         auth: await auth_hash(seed, token, payload)
     };
 
@@ -30,22 +31,25 @@ export async function create_mRPC(user_id, token, version, payload) {
  * @param {Record<string, any>} response
  * @param {string} tag
  * @param {string} token
+ * @param {number} [window=300] - Time window for request in seconds
  * @returns {Promise<boolean>}
  */
 
-export async function validate_mRPC_response(response, tag, token) {
-    const valid_keys = ['success', 'request_tag', 'seed', 'data', 'auth'];
+export async function validate_mRPC_response(response, tag, token, window= 300) {
     const key_types = {
         success: 'boolean',
+        action: 'string',
+        timestamp: 'number',
         request_tag: 'string',
         seed: 'string',
         data: 'object',
         auth: 'string'
     }
+    const valid_keys = Object.keys(key_types);
 
     const keys = Object.keys(response);
 
-    if (keys.length !== 5) {
+    if (keys.length !== valid_keys.length) {
         return false;
     }
 
@@ -62,6 +66,11 @@ export async function validate_mRPC_response(response, tag, token) {
     if(response.request_tag !== tag) {
         return false;
     }
+
+    if(!time_check(response.timestamp, window)) {
+        return false;
+    }
+
     const hash = await auth_hash(response.seed, token, response.data);
 
     return hash === response.auth;
@@ -73,6 +82,17 @@ function random_hex(length=32) {
     return  Array.from(buf).map(byte => byte.toString(16).padStart(2, '0')).join('');
 }
 
+function time_check(timestamp, window ) {
+    const ms_window = window * 1000;
+    const now = Date.now();
+
+    if(now < (timestamp - ms_window)) {
+        return false;
+    }
+    return now <= (timestamp + ms_window);
+
+}
+
 async function auth_hash(seed, token, payload) {
     const crypto_api = globalThis.crypto;
     const data_string = JSON.stringify(payload) + seed;