mrpc-js 0.1.0

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "mrpc-js",
+  "version": "0.1.0",
+  "description": "Zero-dependency mRPC request encoder and HMAC-SHA256 response validator",
+  "keywords": [
+    "mrpc",
+    "mouse-php",
+    "hmac",
+    "crypto",
+    "rpc"
+  ],
+  "license": "MIT",
+  "author": "Kurtis Milliren",
+  "type": "module",
+  "main": "./src/index.js",
+  "exports": {
+    ".": "./src/index.js"
+  },
+  "files": [
+    "src",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "node --test"
+  }
+}

package/src/index.js

@@ -0,0 +1 @@
+export { create_mRPC, validate_mRPC_response } from './mrpc.js';

package/src/mrpc.js

@@ -0,0 +1,102 @@
+/**
+ * Creates an mRPC request
+ *
+ * @param {number} user_id
+ * @param {string} token
+ * @param {string} version
+ * @param {Record<string, any>} payload
+ * @returns {Promise<{user_id: number, version: string, request_tag: string, seed: string, data: Record<string, any>, auth: string}>}
+ */
+
+export async function create_mRPC(user_id, token, version, payload) {
+    const seed = random_hex();
+    const tag = random_hex();
+
+    const json_out = {
+        user_id: user_id,
+        version: version,
+        request_tag: tag,
+        seed: seed,
+        data: payload,
+        auth: await auth_hash(seed, token, payload)
+    };
+
+    return json_out;
+}
+
+/**
+ * Validates a mRPC response from a server
+ *
+ * @param {Record<string, any>} response
+ * @param {string} tag
+ * @param {string} token
+ * @returns {Promise<boolean>}
+ */
+
+export async function validate_mRPC_response(response, tag, token) {
+    const valid_keys = ['success', 'request_tag', 'seed', 'data', 'auth'];
+    const key_types = {
+        success: 'boolean',
+        request_tag: 'string',
+        seed: 'string',
+        data: 'object',
+        auth: 'string'
+    }
+
+    const keys = Object.keys(response);
+
+    if (keys.length !== 5) {
+        return false;
+    }
+
+    for (const key of keys) {
+        if (!valid_keys.includes(key)) {
+            return false;
+        }
+
+        if (typeof response[key] !== key_types[key]) {
+            return false;
+        }
+    }
+
+    if(response.request_tag !== tag) {
+        return false;
+    }
+    const hash = await auth_hash(response.seed, token, response.data);
+
+    return hash === response.auth;
+}
+
+function random_hex(length=32) {
+    const crypto_api = globalThis.crypto;
+    const buf = crypto_api.getRandomValues(new Uint8Array(length));
+    return  Array.from(buf).map(byte => byte.toString(16).padStart(2, '0')).join('');
+}
+
+async function auth_hash(seed, token, payload) {
+    const crypto_api = globalThis.crypto;
+    const data_string = JSON.stringify(payload) + seed;
+
+    const encoder = new TextEncoder();
+    const key_bytes = encoder.encode(token);
+    const data_bytes = encoder.encode(data_string);
+
+    const crypto_key = await crypto_api.subtle.importKey(
+        'raw',
+        key_bytes,
+        { name: 'HMAC', hash: 'SHA-256' },
+        false,
+        ['sign']
+    );
+
+    const signature_buffer = await crypto_api.subtle.sign(
+        'HMAC',
+        crypto_key,
+        data_bytes
+    );
+
+    return Array.from(new Uint8Array(signature_buffer))
+        .map(b => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+