pinstripe 0.31.0 → 0.31.1

package/lib/commands/purge_used_hashes.js

@@ -0,0 +1,14 @@
+
+export default {
+    meta(){
+        this.schedule('*/5 * * * *');
+    },
+
+    minutesUntilExpiry: 30,
+
+    async run(){
+        await this.database.withoutTenantScope.usedHashes.where({
+            expiresAtLt: new Date()
+        }).delete();
+    }
+};

package/lib/migrations/1708772281_create_used_hash.js

@@ -0,0 +1,9 @@
+
+export default {
+    async migrate(){
+        await this.database.table('usedHashes', async usedHashes => {
+            await usedHashes.addColumn('value', 'string', { index: true });
+            await usedHashes.addColumn('expiresAt', 'datetime', { index: true });
+        });
+    }
+};

package/lib/migrations/_file_importer.js

@@ -0,0 +1,2 @@
+
+export { Migration as default } from 'pinstripe/database';

package/lib/models/_file_importer.js

@@ -0,0 +1,2 @@
+
+export { Row as default } from 'pinstripe/database';

package/lib/models/used_hash.js

@@ -0,0 +1,7 @@
+
+export default {
+    meta(){
+        this.mustNotBeBlank('value');
+        this.mustNotBeBlank('expiresAt');
+    }
+};

package/lib/proof_of_work.js

@@ -5,6 +5,8 @@ import { Class } from './class.js';
 import { Singleton } from './singleton.js';
 
 const HASH_CASH_TARGET = Math.pow(2, 32 - 20);
+const DEFAULT_DIFFICULTY = 1 / 20;
+const DEFAULT_EXPIRY_IN_SECONDS = 10 * 60;
 
 export const ProofOfWork = Class.extend().include({
     meta(){
@@ -12,10 +14,10 @@ export const ProofOfWork = Class.extend().include({
     },
 
     async generateProofOfWork(input, options = {}){
-        const { difficulty = 1, steps = 1000, onProgress = () => {}, abortSignal = { aborted: false } } = options;
+        const { difficulty = DEFAULT_DIFFICULTY, steps = 1000, onProgress = () => {}, abortSignal = { aborted: false } } = options;
         const inputHash = await this.createSha1Hash(JSON.stringify(input));
         const salt = await this.createSha1Hash(Math.random());
-        const timestamp = this.getUTCTimestamp();
+        const timestamp = Math.floor(Date.now() / 1000);
         const target = this.calculateTarget(difficulty, steps);
         const solution = [];
         
@@ -42,9 +44,11 @@ export const ProofOfWork = Class.extend().include({
     },
 
     async verifyProofOfWork(input, proofOfWork, options = {}){
-        const { difficulty = 1 } = options;
+        const { difficulty = DEFAULT_DIFFICULTY, expiryInSeconds = DEFAULT_EXPIRY_IN_SECONDS } = options;
         const { salt, timestamp, solution } = JSON.parse(proofOfWork);
+        if(Math.floor(Date.now() / 1000) - timestamp > expiryInSeconds) return false;
         const steps = solution.length;
+        if(typeof steps !== 'number' || steps <= 0) return false;
         const inputHash = await this.createSha1Hash(JSON.stringify(input));
         const target = this.calculateTarget(difficulty, steps);
         for(let i = 0; i < steps; i++){
@@ -72,19 +76,6 @@ export const ProofOfWork = Class.extend().include({
     
     calculateTarget(difficulty, steps){
         return (HASH_CASH_TARGET / difficulty) * steps;
-    },
-    
-    getUTCTimestamp() {
-        const now = new Date();
-      
-        const year = now.getUTCFullYear() % 100;
-        const month = String(now.getUTCMonth() + 1).padStart(2, '0');
-        const day = String(now.getUTCDate()).padStart(2, '0');
-        const hours = String(now.getUTCHours()).padStart(2, '0');
-        const minutes = String(now.getUTCMinutes()).padStart(2, '0');
-        const seconds = String(now.getUTCSeconds()).padStart(2, '0');
-      
-        return `${year}${month}${day}${hours}${minutes}${seconds}`;
     }
 });
 

package/lib/services/only_once.js

@@ -0,0 +1,24 @@
+
+import crypto from 'crypto';
+
+export default {
+    create(){
+        return this;
+    },
+
+    async hasBeenUsed(key){
+        return await this.database.withoutTenantScope.usedHashes.where({value: this.createHash(key)}).count() > 0;
+    },
+
+    async markAsUsed(key, options = {}){
+        const { expiresAt = new Date(Date.now() + (1000 * 60 * 60 * 24)) } = options;
+        await this.database.usedHashes.insert({
+            value: this.createHash(key),
+            expiresAt
+        });
+    },
+
+    createHash(key){
+        return crypto.createHash('sha1').update(JSON.stringify(key)).digest('base64');
+    }
+};

package/lib/services/render_form.js

@@ -1,4 +1,3 @@
-import * as crypto from 'crypto';
 
 import { ValidationError } from '../validation_error.js';
 import { Inflector } from '../inflector.js';
@@ -25,13 +24,16 @@ export default {
             try {
                 if(requiresProofOfWork){
                     if(!this.params._proofOfWork) throw new ValidationError({ _proofOfWork: 'Must not be blank' });
-                    if(!verifyProofOfWork(values, this.params._proofOfWork)) throw new ValidationError({ _proofOfWork: 'Must be a valid stamp' });
+                    if(!await verifyProofOfWork(values, this.params._proofOfWork)) throw new ValidationError({ _proofOfWork: 'Must be a valid' });
+                    if(await this.onlyOnce.hasBeenUsed({ proofOfWork: this.params._proofOfWork })) throw new ValidationError({ _proofOfWork: 'Must be unused' });
                 }
-                return await formAdapter.submit(values, success) || this.renderHtml`
+                const out = await formAdapter.submit(values, success) || this.renderHtml`
                     <span data-component="pinstripe-anchor" data-target="_parent">
                         <script type="pinstripe">this.parent.trigger('click');</script>
                     </span>
                 `;
+                if(requiresProofOfWork) await this.onlyOnce.markAsUsed({ proofOfWork: this.params._proofOfWork });
+                return out;
             } catch(e){
                 if(!(e instanceof ValidationError)){
                     throw e;

package/package.json

@@ -2,7 +2,7 @@
   "type": "module",
   "name": "pinstripe",
   "description": "A slick web framework for Node.js.",
-  "version": "0.31.0",
+  "version": "0.31.1",
   "author": "Jody Salt",
   "license": "MIT",
   "exports": {
@@ -53,5 +53,5 @@
     "url": "git://github.com/blognami/pinstripe.git",
     "directory": "packages/pinstripe"
   },
-  "gitHead": "d1a939e12913a99d7b2817987d9942a95c3e6ec5"
+  "gitHead": "73c659004059facb56e4f96e32d2d443e989d348"
 }