patchwork-os 1.2.0-beta.3.canary.879 → 1.2.0-beta.3.canary.880
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -74,6 +74,12 @@ export declare class LocalPasswordProvider implements AuthProvider {
|
|
|
74
74
|
constructor(credentialFor: (memberId: string) => string | undefined);
|
|
75
75
|
authenticate(presented: Presented, roster: Roster): Promise<Principal | null>;
|
|
76
76
|
}
|
|
77
|
+
/**
|
|
78
|
+
* A syntactically valid record no password verifies against, so the unknown-
|
|
79
|
+
* member path performs a real scrypt derivation instead of returning early.
|
|
80
|
+
* The salt and hash are fixed and meaningless; the point is the CPU time.
|
|
81
|
+
*/
|
|
82
|
+
export declare const DUMMY_RECORD: string;
|
|
77
83
|
/**
|
|
78
84
|
* Try each provider in order; the first that claims the request decides.
|
|
79
85
|
*
|
|
@@ -29,7 +29,7 @@
|
|
|
29
29
|
* is deliberately no `?? implicitOwner()` anywhere in this module, and a test
|
|
30
30
|
* asserts the string never appears.
|
|
31
31
|
*/
|
|
32
|
-
import { verifyPassword } from "./credentials.js";
|
|
32
|
+
import { SCRYPT_PARAMS, verifyPassword } from "./credentials.js";
|
|
33
33
|
import { findMember } from "./roster.js";
|
|
34
34
|
/**
|
|
35
35
|
* Nobody authenticated. Distinct from "authentication failed" only in that
|
|
@@ -73,8 +73,7 @@ export class LocalPasswordProvider {
|
|
|
73
73
|
* member path performs a real scrypt derivation instead of returning early.
|
|
74
74
|
* The salt and hash are fixed and meaningless; the point is the CPU time.
|
|
75
75
|
*/
|
|
76
|
-
const DUMMY_RECORD =
|
|
77
|
-
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
|
|
76
|
+
export const DUMMY_RECORD = `scrypt$${SCRYPT_PARAMS.N}$${SCRYPT_PARAMS.r}$${SCRYPT_PARAMS.p}$AAAAAAAAAAAAAAAAAAAAAA==$${"A".repeat(86)}==`;
|
|
78
77
|
/**
|
|
79
78
|
* Try each provider in order; the first that claims the request decides.
|
|
80
79
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authSeam.js","sourceRoot":"","sources":["../../src/identity/authSeam.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"authSeam.js","sourceRoot":"","sources":["../../src/identity/authSeam.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEjE,OAAO,EAAE,UAAU,EAAe,MAAM,aAAa,CAAC;AAEtD;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,cAAuB,CAAC;AA0BpD,gFAAgF;AAChF,MAAM,OAAO,qBAAqB;IAUb;IATV,IAAI,GAAG,gBAAgB,CAAC;IAEjC;;;;;OAKG;IACH,YACmB,aAAuD;QAAvD,kBAAa,GAAb,aAAa,CAA0C;IACvE,CAAC;IAEJ,KAAK,CAAC,YAAY,CAChB,SAAoB,EACpB,MAAc;QAEd,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC;QACzC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,CAAC,mBAAmB;QAE5D,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAE5C,sEAAsE;QACtE,qEAAqE;QACrE,uCAAuC;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,YAAY,CAAC;QACtC,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAElD,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YAChD,iEAAiE;YACjE,oCAAoC;YACpC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAChC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,aAAa,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,6BAA6B,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;AAE3I;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAoB,EACpB,MAAc,EACd,SAAkC;IAElC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAoB;IAEpB,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC"}
|
|
@@ -36,12 +36,17 @@
|
|
|
36
36
|
* constant, so raising the cost would silently invalidate every existing
|
|
37
37
|
* credential instead of upgrading it.
|
|
38
38
|
*
|
|
39
|
-
* N=2^
|
|
39
|
+
* N=2^17 with r=8, p=1 is ~128 MB of memory per verification (OWASP's scrypt
|
|
40
|
+
* floor; raised from 2^15 in security sweep L8 — records written at 2^15 keep
|
|
41
|
+
* verifying because their cost is read from the record). `maxmem` must be
|
|
40
42
|
* raised above Node's 32 MB default or scrypt throws at these parameters —
|
|
41
43
|
* a footgun that presents as "the correct password is rejected".
|
|
44
|
+
*
|
|
45
|
+
* `DUMMY_RECORD` in authSeam.ts is derived from this, so the unknown-member
|
|
46
|
+
* path costs the same as a real verification.
|
|
42
47
|
*/
|
|
43
48
|
export declare const SCRYPT_PARAMS: {
|
|
44
|
-
readonly N:
|
|
49
|
+
readonly N: 131072;
|
|
45
50
|
readonly r: 8;
|
|
46
51
|
readonly p: 1;
|
|
47
52
|
};
|
|
@@ -39,11 +39,16 @@ const scrypt = promisify(scryptCb);
|
|
|
39
39
|
* constant, so raising the cost would silently invalidate every existing
|
|
40
40
|
* credential instead of upgrading it.
|
|
41
41
|
*
|
|
42
|
-
* N=2^
|
|
42
|
+
* N=2^17 with r=8, p=1 is ~128 MB of memory per verification (OWASP's scrypt
|
|
43
|
+
* floor; raised from 2^15 in security sweep L8 — records written at 2^15 keep
|
|
44
|
+
* verifying because their cost is read from the record). `maxmem` must be
|
|
43
45
|
* raised above Node's 32 MB default or scrypt throws at these parameters —
|
|
44
46
|
* a footgun that presents as "the correct password is rejected".
|
|
47
|
+
*
|
|
48
|
+
* `DUMMY_RECORD` in authSeam.ts is derived from this, so the unknown-member
|
|
49
|
+
* path costs the same as a real verification.
|
|
45
50
|
*/
|
|
46
|
-
export const SCRYPT_PARAMS = { N:
|
|
51
|
+
export const SCRYPT_PARAMS = { N: 131072, r: 8, p: 1 };
|
|
47
52
|
const KEYLEN = 64;
|
|
48
53
|
const MAXMEM = 192 * 1024 * 1024;
|
|
49
54
|
const PREFIX = "scrypt";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/identity/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,IAAI,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAKb,CAAC;AAErB
|
|
1
|
+
{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/identity/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,IAAI,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAKb,CAAC;AAErB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAW,CAAC;AAChE,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAKjC,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,SAA8C,aAAa;IAE3D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;QACnD,GAAG,MAAM;QACT,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;IACH,OAAO;QACL,MAAM;QACN,MAAM,CAAC,CAAC;QACR,MAAM,CAAC,CAAC;QACR,MAAM,CAAC,CAAC;QACR,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC3B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,kEAAkE;AAClE,SAAS,WAAW,CAAC,MAAc;IAOjC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,MAAwB;IAExB,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE;YACpD,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAClE,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "patchwork-os",
|
|
3
|
-
"version": "1.2.0-beta.3.canary.
|
|
3
|
+
"version": "1.2.0-beta.3.canary.880",
|
|
4
4
|
"description": "Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "dist/index.js",
|