revojs 0.2.42 → 0.2.43

package/dist/crypto/index.d.ts

@@ -0,0 +1,30 @@
+import { type Scope } from "../scope";
+export type CryptoPurpose = string;
+export type SecretAlgorithm = "HMAC" | "AES-GCM";
+export declare function useSecretKey(scope: Scope, purpose: CryptoPurpose, algorithm: SecretAlgorithm): Promise<CryptoKey>;
+export declare function sign(scope: Scope, purpose: CryptoPurpose, value: string | Uint8Array): Promise<string>;
+export declare function verify(scope: Scope, purpose: CryptoPurpose, value: string | Uint8Array, signature: string): Promise<boolean>;
+export declare function encrypt(scope: Scope, purpose: CryptoPurpose, value: string, context?: string): Promise<string>;
+export declare function decrypt(scope: Scope, purpose: CryptoPurpose, value: string, context?: string): Promise<string | undefined>;
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPassword(password: string, value: string): Promise<boolean>;
+export declare function isPasswordHash(value: string): boolean;
+export declare function needsPasswordRehash(value: string): boolean;
+export declare function randomToken(length?: number): string;
+export declare function digest(value: string | Uint8Array): Promise<string>;
+export declare function equalsConstantTime(left: string | Uint8Array, right: string | Uint8Array): boolean;
+export declare function derivePassword(password: string, salt: Uint8Array<ArrayBuffer>, iterations: number): Promise<Uint8Array<ArrayBuffer>>;
+export declare function parsePasswordHash(value: string): {
+    iterations: number;
+    salt: Uint8Array<ArrayBuffer>;
+    hash: Uint8Array<ArrayBuffer>;
+} | undefined;
+export declare function toBytes(value: string | Uint8Array): Uint8Array<ArrayBuffer>;
+export declare const encoder: TextEncoder;
+export declare const decoder: TextDecoder;
+export declare const BASE64_ENCODE: Parameters<Uint8Array["toBase64"]>[0];
+export declare const BASE64_DECODE: Parameters<typeof Uint8Array.fromBase64>[1];
+export declare const MIN_SECRET_LENGTH = 32;
+export declare const ENCRYPTION_ALGORITHM = "aes-gcm";
+export declare const PASSWORD_ALGORITHM = "pbkdf2-sha256";
+export declare const PASSWORD_ITERATIONS = 100000;

package/dist/crypto/index.js

@@ -0,0 +1,136 @@
+import { useVariables } from "../scope/index.js";
+//#region src/crypto/index.ts
+async function useSecretKey(scope, purpose, algorithm) {
+	const { applicationSecret } = useVariables(scope);
+	if (!applicationSecret) throw new Error("Missing required variable \"applicationSecret\"");
+	if (applicationSecret.length < 32) throw new Error(`The variable "applicationSecret" must be at least 32 characters long.`);
+	const material = await crypto.subtle.importKey("raw", encoder.encode(applicationSecret), "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: encoder.encode("revojs"),
+		info: encoder.encode(purpose)
+	}, material, algorithm === "HMAC" ? {
+		name: "HMAC",
+		hash: "SHA-256",
+		length: 256
+	} : {
+		name: "AES-GCM",
+		length: 256
+	}, false, algorithm === "HMAC" ? ["sign", "verify"] : ["encrypt", "decrypt"]);
+}
+async function sign(scope, purpose, value) {
+	const key = await useSecretKey(scope, purpose, "HMAC");
+	return new Uint8Array(await crypto.subtle.sign("HMAC", key, toBytes(value))).toBase64(BASE64_ENCODE);
+}
+async function verify(scope, purpose, value, signature) {
+	const key = await useSecretKey(scope, purpose, "HMAC");
+	try {
+		return await crypto.subtle.verify("HMAC", key, Uint8Array.fromBase64(signature, BASE64_DECODE), toBytes(value));
+	} catch {
+		return false;
+	}
+}
+async function encrypt(scope, purpose, value, context = "") {
+	const key = await useSecretKey(scope, purpose, "AES-GCM");
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv,
+		additionalData: encoder.encode(context)
+	}, key, encoder.encode(value));
+	return [
+		ENCRYPTION_ALGORITHM,
+		iv.toBase64(BASE64_ENCODE),
+		new Uint8Array(ciphertext).toBase64(BASE64_ENCODE)
+	].join("$");
+}
+async function decrypt(scope, purpose, value, context = "") {
+	const [algorithm, iv, ciphertext, ...rest] = value.split("$");
+	if (algorithm !== "aes-gcm" || !iv || !ciphertext || rest.length > 0) return;
+	const key = await useSecretKey(scope, purpose, "AES-GCM");
+	try {
+		const plaintext = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: Uint8Array.fromBase64(iv, BASE64_DECODE),
+			additionalData: encoder.encode(context)
+		}, key, Uint8Array.fromBase64(ciphertext, BASE64_DECODE));
+		return decoder.decode(plaintext);
+	} catch {
+		return;
+	}
+}
+async function hashPassword(password) {
+	const salt = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	const hash = await derivePassword(password, salt, PASSWORD_ITERATIONS);
+	return [
+		PASSWORD_ALGORITHM,
+		PASSWORD_ITERATIONS,
+		salt.toBase64(BASE64_ENCODE),
+		hash.toBase64(BASE64_ENCODE)
+	].join("$");
+}
+async function verifyPassword(password, value) {
+	const parsed = parsePasswordHash(value);
+	if (!parsed) return false;
+	return equalsConstantTime(await derivePassword(password, parsed.salt, parsed.iterations), parsed.hash);
+}
+function isPasswordHash(value) {
+	return parsePasswordHash(value) !== void 0;
+}
+function needsPasswordRehash(value) {
+	return parsePasswordHash(value)?.iterations !== PASSWORD_ITERATIONS;
+}
+function randomToken(length = 32) {
+	return crypto.getRandomValues(new Uint8Array(length)).toBase64(BASE64_ENCODE);
+}
+async function digest(value) {
+	return new Uint8Array(await crypto.subtle.digest("SHA-256", toBytes(value))).toHex();
+}
+function equalsConstantTime(left, right) {
+	const leftBytes = toBytes(left);
+	const rightBytes = toBytes(right);
+	let difference = leftBytes.length ^ rightBytes.length;
+	for (let index = 0; index < Math.max(leftBytes.length, rightBytes.length); index++) difference |= (leftBytes[index] ?? 0) ^ (rightBytes[index] ?? 0);
+	return difference === 0;
+}
+async function derivePassword(password, salt, iterations) {
+	const key = await crypto.subtle.importKey("raw", encoder.encode(password.normalize("NFKC")), "PBKDF2", false, ["deriveBits"]);
+	return new Uint8Array(await crypto.subtle.deriveBits({
+		name: "PBKDF2",
+		hash: "SHA-256",
+		salt,
+		iterations
+	}, key, 256));
+}
+function parsePasswordHash(value) {
+	const [algorithm, iterations, salt, hash, ...rest] = value.split("$");
+	if (algorithm !== "pbkdf2-sha256" || !iterations || !salt || !hash || rest.length > 0) return;
+	const count = Number(iterations);
+	if (!Number.isInteger(count) || count < 1 || count > 1e5) return;
+	try {
+		return {
+			iterations: count,
+			salt: Uint8Array.fromBase64(salt, BASE64_DECODE),
+			hash: Uint8Array.fromBase64(hash, BASE64_DECODE)
+		};
+	} catch {
+		return;
+	}
+}
+function toBytes(value) {
+	return typeof value === "string" ? encoder.encode(value) : new Uint8Array(value);
+}
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var BASE64_ENCODE = {
+	alphabet: "base64url",
+	omitPadding: true
+};
+var BASE64_DECODE = { alphabet: "base64url" };
+var MIN_SECRET_LENGTH = 32;
+var ENCRYPTION_ALGORITHM = "aes-gcm";
+var PASSWORD_ALGORITHM = "pbkdf2-sha256";
+var PASSWORD_ITERATIONS = 1e5;
+//#endregion
+export { BASE64_DECODE, BASE64_ENCODE, ENCRYPTION_ALGORITHM, MIN_SECRET_LENGTH, PASSWORD_ALGORITHM, PASSWORD_ITERATIONS, decoder, decrypt, derivePassword, digest, encoder, encrypt, equalsConstantTime, hashPassword, isPasswordHash, needsPasswordRehash, parsePasswordHash, randomToken, sign, toBytes, useSecretKey, verify, verifyPassword };

package/dist/index.d.ts

@@ -1,3 +1,4 @@
 export * from "./assets";
+export * from "./crypto";
 export * from "./router";
 export * from "./scope";

package/dist/index.js

@@ -1,4 +1,5 @@
 import { mimeType, mimeTypes } from "./assets/index.js";
 import { STATE_CONTEXT, VARIABLE_CONTEXT, createScope, defineContext, defineHook, definePlugin, dispatchHook, dispatchHookSingle, getContext, registerHook, registerHooks, setContext, useVariableContext, useVariables } from "./scope/index.js";
+import { BASE64_DECODE, BASE64_ENCODE, ENCRYPTION_ALGORITHM, MIN_SECRET_LENGTH, PASSWORD_ALGORITHM, PASSWORD_ITERATIONS, decoder, decrypt, derivePassword, digest, encoder, encrypt, equalsConstantTime, hashPassword, isPasswordHash, needsPasswordRehash, parsePasswordHash, randomToken, sign, toBytes, useSecretKey, verify, verifyPassword } from "./crypto/index.js";
 import { GROUP_MATCH, HOOK_MATCH, OPTIONAL_PARAMETER_MATCH, OPTIONAL_WILDCARD_MATCH, PARAMETER_MATCH, ROUTE_CONTEXT, ROUTE_RESOLVER_CONTEXT, Router, WILDCARD_MATCH, fillSegments, toSegments, useRoute, useRouteResolverContext } from "./router/index.js";
-export { GROUP_MATCH, HOOK_MATCH, OPTIONAL_PARAMETER_MATCH, OPTIONAL_WILDCARD_MATCH, PARAMETER_MATCH, ROUTE_CONTEXT, ROUTE_RESOLVER_CONTEXT, Router, STATE_CONTEXT, VARIABLE_CONTEXT, WILDCARD_MATCH, createScope, defineContext, defineHook, definePlugin, dispatchHook, dispatchHookSingle, fillSegments, getContext, mimeType, mimeTypes, registerHook, registerHooks, setContext, toSegments, useRoute, useRouteResolverContext, useVariableContext, useVariables };
+export { BASE64_DECODE, BASE64_ENCODE, ENCRYPTION_ALGORITHM, GROUP_MATCH, HOOK_MATCH, MIN_SECRET_LENGTH, OPTIONAL_PARAMETER_MATCH, OPTIONAL_WILDCARD_MATCH, PARAMETER_MATCH, PASSWORD_ALGORITHM, PASSWORD_ITERATIONS, ROUTE_CONTEXT, ROUTE_RESOLVER_CONTEXT, Router, STATE_CONTEXT, VARIABLE_CONTEXT, WILDCARD_MATCH, createScope, decoder, decrypt, defineContext, defineHook, definePlugin, derivePassword, digest, dispatchHook, dispatchHookSingle, encoder, encrypt, equalsConstantTime, fillSegments, getContext, hashPassword, isPasswordHash, mimeType, mimeTypes, needsPasswordRehash, parsePasswordHash, randomToken, registerHook, registerHooks, setContext, sign, toBytes, toSegments, useRoute, useRouteResolverContext, useSecretKey, useVariableContext, useVariables, verify, verifyPassword };

package/dist/module/index.js

@@ -149,6 +149,10 @@ async function createConfig(inputConfig) {
 				isClient: {
 					type: "boolean",
 					default: false
+				},
+				applicationSecret: {
+					type: "string",
+					optional: true
 				}
 			}
 		},

package/dist/package.js

@@ -1,6 +1,6 @@
 //#region package.json
 var name = "revojs";
-var version = "0.2.42";
+var version = "0.2.43";
 var repository = {
 	"type": "git",
 	"url": "git+https://github.com/tellua/revojs.git"

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "revojs",
-    "version": "0.2.42",
+    "version": "0.2.43",
     "license": "MIT",
     "repository": {
         "type": "git",