[{"_1":2,"_176":-5,"_177":-5},"loaderData",{"_3":4,"_92":93},"root",{"_5":6,"_35":36,"_65":66},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":32,"_33":20,"_34":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","4e736cb42e83c17c10d9f33412034a74b06f3941","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_67":68},"__internal_clerk_state",{"_69":70,"_71":46,"_72":73,"_74":73,"_75":20,"_76":73,"_77":73,"_78":73,"_79":73,"_80":81,"_90":20,"_91":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_82":20,"_19":20,"_83":73,"_84":85,"_86":73,"_87":46,"_88":20,"_89":73},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_94":95,"_96":97,"_98":99,"_100":101,"_150":151,"_173":174,"_175":-5},"handle","ianmenethil","name","ZenServer","path","src/utils/crypto.ts","project",{"_102":103,"_96":97,"_104":105,"_106":-5,"_107":20,"_108":109,"_110":73,"_111":-5,"_12":112,"_113":114,"_115":116,"_117":116,"_118":-5,"_119":32,"_14":120,"_121":122,"_123":122,"_124":125,"_126":125,"_127":125,"_128":122,"_129":122,"_23":130,"_133":134,"_136":137,"_149":20},"id","619e7f00-58a9-11f0-a700-f69ea79377d9","createdAt",["D",1751614495896],"deletedAt","legacyEnvVars","privacy","unlisted","description","imageUrl","5856754a-b1b9-4358-87d1-77f1d9f79e45","pinnedFileId","9f5c41ce-58a9-11f0-947f-f69ea79377d9","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","7559f40a-a274-4a9b-8f8b-7486509c3949","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_94":95,"_131":132},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18ycXU1U2ZIVEk3NnhGTXRySE0wbWdYQncxSnYifQ","org",{"_94":95,"_135":132,"_12":112},"avatar","branch",{"_138":139,"_96":44,"_102":140,"_141":103,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":97,"_148":95},"version",883,"619ecc08-58a9-11f0-a700-f69ea79377d9","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_102":152,"_96":153,"_154":155,"_156":157,"_158":140,"_159":160,"_161":116,"_104":162,"_138":163,"_164":165,"_166":167,"_168":20,"_169":-5,"_98":170},"4a830952-5e6d-11f0-a4b5-0224a6c84d84","crypto.ts","fileId","8cc5d7c8-5a93-11f0-828e-f69ea79377d9","parentId","9f14f27e-58a9-11f0-9a99-f69ea79377d9","branchId","branchVersion",612,"latest",["D",1752248394291],1,"fileType","script","content","/**\r\n * Enhanced cryptographic utilities for ZenServer.\r\n * Provides secure hashing, HMAC, encryption, and random generation.\r\n * Centralized to eliminate duplicate crypto implementations across the codebase.\r\n */\r\n\r\nimport sha3 from \"https://esm.sh/js-sha3@0.9.3\";\r\n\r\nconst { sha3_512, sha3_256 } = sha3;\r\n\r\n// ========================================\r\n// Core Crypto Functions\r\n// ========================================\r\n\r\n/**\r\n * Generates SHA3-512 hash of the provided payload.\r\n * Used for payment fingerprint generation.\r\n */\r\nexport function makeHash(payload: string): string {\r\n if (typeof payload !== \"string\") {\r\n throw new Error(\"Payload must be a string\");\r\n }\r\n return sha3_512(payload);\r\n}\r\n\r\n/**\r\n * Generates HMAC signature using proper HMAC construction.\r\n * Uses SHA3-256 as the underlying hash function.\r\n */\r\nexport function generateHMAC(\r\n data: any,\r\n timestamp: string,\r\n secret: string\r\n): string {\r\n const message = `${JSON.stringify(data)}:${timestamp}`;\r\n\r\n // Proper HMAC construction: HMAC(K, m) = H((K ⊕ opad) || H((K ⊕ ipad) || m))\r\n const key = secret.padEnd(128, \"\\0\").substring(0, 128); // Ensure key is exactly 128 bytes\r\n const ipad = new Array(128)\r\n .fill(0x36)\r\n .map((x, i) => x ^ key.charCodeAt(i))\r\n .map((x) => String.fromCharCode(x))\r\n .join(\"\");\r\n const opad = new Array(128)\r\n .fill(0x5c)\r\n .map((x, i) => x ^ key.charCodeAt(i))\r\n .map((x) => String.fromCharCode(x))\r\n .join(\"\");\r\n\r\n const inner = sha3_256(ipad + message);\r\n return sha3_256(opad + inner);\r\n}\r\n\r\n/**\r\n * Validates HMAC signature for incoming requests or responses.\r\n */\r\nexport function validateHMAC(\r\n data: any,\r\n timestamp: string,\r\n signature: string,\r\n secret: string\r\n): boolean {\r\n try {\r\n const expectedSignature = generateHMAC(data, timestamp, secret);\r\n return constantTimeEquals(signature, expectedSignature);\r\n } catch {\r\n return false;\r\n }\r\n}\r\n\r\n/**\r\n * Constant-time string comparison to prevent timing attacks.\r\n */\r\nexport function constantTimeEquals(a: string, b: string): boolean {\r\n if (a.length !== b.length) {\r\n return false;\r\n }\r\n\r\n let result = 0;\r\n for (let i = 0; i < a.length; i++) {\r\n result |= a.charCodeAt(i) ^ b.charCodeAt(i);\r\n }\r\n\r\n return result === 0;\r\n}\r\n\r\n// ========================================\r\n// Base64URL Encoding (URL-Safe Base64)\r\n// ========================================\r\n\r\n/**\r\n * Converts bytes to base64url (URL-safe base64 without padding).\r\n * Industry standard for tokens and identifiers in URLs.\r\n */\r\nexport function bytesToBase64Url(bytes: Uint8Array): string {\r\n return btoa(String.fromCharCode(...bytes))\r\n .replace(/\\+/g, \"-\")\r\n .replace(/\\//g, \"_\")\r\n .replace(/=/g, \"\");\r\n}\r\n\r\n/**\r\n * Converts base64url string back to bytes.\r\n */\r\nexport function base64UrlToBytes(base64url: string): Uint8Array {\r\n // Add padding if needed\r\n let padded = base64url.replace(/-/g, \"+\").replace(/_/g, \"/\");\r\n while (padded.length % 4) {\r\n padded += \"=\";\r\n }\r\n\r\n const binaryString = atob(padded);\r\n const bytes = new Uint8Array(binaryString.length);\r\n for (let i = 0; i < binaryString.length; i++) {\r\n bytes[i] = binaryString.charCodeAt(i);\r\n }\r\n return bytes;\r\n}\r\n\r\n/**\r\n * Converts string to base64url encoding.\r\n */\r\nexport function stringToBase64Url(str: string): string {\r\n const encoder = new TextEncoder();\r\n const bytes = encoder.encode(str);\r\n return bytesToBase64Url(bytes);\r\n}\r\n\r\n/**\r\n * Converts base64url string back to original string.\r\n */\r\nexport function base64UrlToString(base64url: string): string {\r\n const bytes = base64UrlToBytes(base64url);\r\n const decoder = new TextDecoder();\r\n return decoder.decode(bytes);\r\n}\r\n\r\n// ========================================\r\n// Random Generation\r\n// ========================================\r\n\r\n/**\r\n * Generates cryptographically secure random string.\r\n */\r\nexport function generateSecureRandom(length: number): string {\r\n if (length <= 0 || !Number.isInteger(length)) {\r\n throw new Error(\"Length must be a positive integer\");\r\n }\r\n\r\n const bytes = crypto.getRandomValues(new Uint8Array(Math.ceil(length / 2)));\r\n return Array.from(bytes)\r\n .map((b) => b.toString(16).padStart(2, \"0\"))\r\n .join(\"\")\r\n .substring(0, length);\r\n}\r\n\r\n/**\r\n * Generates a secure nonce (32 bytes = 64 hex characters).\r\n */\r\nexport function generateNonce(): string {\r\n const bytes = crypto.getRandomValues(new Uint8Array(32));\r\n return Array.from(bytes)\r\n .map((b) => b.toString(16).padStart(2, \"0\"))\r\n .join(\"\");\r\n}\r\n\r\n/**\r\n * Generates a secure random UUID v4.\r\n */\r\nexport function generateUUID(): string {\r\n return crypto.randomUUID();\r\n}\r\n\r\n/**\r\n * Generates a secure random string of specified length using given character set.\r\n */\r\nexport function generateRandomString(\r\n length: number,\r\n charset = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\"\r\n): string {\r\n if (length <= 0 || !Number.isInteger(length)) {\r\n throw new Error(\"Length must be a positive integer\");\r\n }\r\n\r\n const bytes = crypto.getRandomValues(new Uint8Array(length));\r\n return Array.from(bytes)\r\n .map((byte) => charset[byte % charset.length])\r\n .join(\"\");\r\n}\r\n\r\n/**\r\n * Generates cryptographically secure random bytes.\r\n */\r\nexport function getRandomBytes(length: number): Uint8Array {\r\n if (length <= 0 || !Number.isInteger(length)) {\r\n throw new Error(\"Length must be a positive integer\");\r\n }\r\n return crypto.getRandomValues(new Uint8Array(length));\r\n}\r\n\r\n// ========================================\r\n// Application-Specific Token Generation\r\n// ========================================\r\n\r\n/**\r\n * Generates a secure booking token for public link sharing.\r\n * Industry standard: 32-byte (256-bit) random token, base64url encoded.\r\n * Used by: AuthService\r\n */\r\nexport function generateBookingToken(): string {\r\n const bytes = getRandomBytes(32);\r\n return bytesToBase64Url(bytes);\r\n}\r\n\r\n/**\r\n * Generates an API key for configuration.\r\n * Industry standard: 256-bit (32-byte) random key, base64url encoded.\r\n * Used by: AuthService\r\n */\r\nexport function generateApiKey(): string {\r\n const bytes = getRandomBytes(32);\r\n return bytesToBase64Url(bytes);\r\n}\r\n\r\n/**\r\n * Generates a pay token (one-time access token).\r\n * Returns a 22-character URL-safe base64 string.\r\n * Used by: AdminHandler\r\n * @returns 22-character URL-safe token\r\n */\r\nexport function generatePayToken(): string {\r\n // Generate UUID and remove hyphens for 128-bit entropy\r\n const uuid = generateUUID().replace(/-/g, \"\");\r\n\r\n // Take first 22 characters for URL-safe token\r\n // This provides ~132 bits of entropy (22 * 6 bits per base64 char)\r\n return uuid.substring(0, 22);\r\n}\r\n\r\n/**\r\n * Generates a cryptographically secure session ID.\r\n * Replaces insecure Math.random() implementations.\r\n * Used by: Database service\r\n */\r\nexport function generateSessionId(): string {\r\n const timestamp = Date.now().toString(36);\r\n const randomBytes = getRandomBytes(8);\r\n const randomHex = Array.from(randomBytes)\r\n .map((b) => b.toString(16).padStart(2, \"0\"))\r\n .join(\"\");\r\n\r\n return `${timestamp}_${randomHex}`;\r\n}\r\n\r\n/**\r\n * Generates a correlation ID for request tracking.\r\n * Used by: Logger service\r\n */\r\nexport function generateCorrelationId(): string {\r\n return generateUUID();\r\n}\r\n\r\n/**\r\n * Generate a cryptographically secure random token with optional entropy mixing.\r\n * Used by: CSRF middleware\r\n * @param entropySource - Optional additional entropy source (like SESSION_SECRET)\r\n * @returns 64-character hexadecimal string\r\n */\r\nexport function generateSecureToken(entropySource?: string): string {\r\n const array = new Uint8Array(32);\r\n crypto.getRandomValues(array);\r\n\r\n // Add entropy source as additional mixing if provided\r\n if (entropySource) {\r\n // Create a simple hash of the random bytes + entropy source\r\n const combined = Array.from(array).join(\"\") + entropySource;\r\n const encoder = new TextEncoder();\r\n const data = encoder.encode(combined);\r\n\r\n // Use crypto.subtle to create a hash, but since we need sync operation,\r\n // we'll use a simple mixing approach\r\n const mixed = new Uint8Array(32);\r\n for (let i = 0; i < 32; i++) {\r\n mixed[i] =\r\n array[i] ^ (entropySource.charCodeAt(i % entropySource.length) & 0xff);\r\n }\r\n\r\n return Array.from(mixed, (byte) => byte.toString(16).padStart(2, \"0\")).join(\r\n \"\"\r\n );\r\n }\r\n\r\n return Array.from(array, (byte) => byte.toString(16).padStart(2, \"0\")).join(\r\n \"\"\r\n );\r\n}\r\n\r\n// ========================================\r\n// Password Hashing\r\n// ========================================\r\n\r\n/**\r\n * Hashes a password using PBKDF2 with SHA-256.\r\n * More secure than plain hashing.\r\n */\r\nexport async function hashPassword(\r\n password: string,\r\n salt?: string\r\n): Promise<{\r\n hash: string;\r\n salt: string;\r\n}> {\r\n const passwordSalt = salt || generateRandomString(32);\r\n const encoder = new TextEncoder();\r\n\r\n // Import password as key material\r\n const keyMaterial = await crypto.subtle.importKey(\r\n \"raw\",\r\n encoder.encode(password),\r\n \"PBKDF2\",\r\n false,\r\n [\"deriveBits\"]\r\n );\r\n\r\n // Derive key using PBKDF2\r\n const derivedKey = await crypto.subtle.deriveBits(\r\n {\r\n name: \"PBKDF2\",\r\n salt: encoder.encode(passwordSalt),\r\n iterations: 100000,\r\n hash: \"SHA-256\",\r\n },\r\n keyMaterial,\r\n 256 // 32 bytes\r\n );\r\n\r\n const hashArray = new Uint8Array(derivedKey);\r\n const hashHex = Array.from(hashArray)\r\n .map((b) => b.toString(16).padStart(2, \"0\"))\r\n .join(\"\");\r\n\r\n return {\r\n hash: hashHex,\r\n salt: passwordSalt,\r\n };\r\n}\r\n\r\n/**\r\n * Verifies a password against a hash.\r\n */\r\nexport async function verifyPassword(\r\n password: string,\r\n hash: string,\r\n salt: string\r\n): Promise {\r\n try {\r\n const { hash: newHash } = await hashPassword(password, salt);\r\n return constantTimeEquals(newHash, hash);\r\n } catch {\r\n return false;\r\n }\r\n}\r\n\r\n// ========================================\r\n// Standard Hash Functions\r\n// ========================================\r\n\r\n/**\r\n * Creates a SHA-256 hash of data using Web Crypto API.\r\n */\r\nexport async function sha256(data: string): Promise {\r\n const encoder = new TextEncoder();\r\n const dataBuffer = encoder.encode(data);\r\n const hashBuffer = await crypto.subtle.digest(\"SHA-256\", dataBuffer);\r\n const hashArray = new Uint8Array(hashBuffer);\r\n\r\n return Array.from(hashArray)\r\n .map((b) => b.toString(16).padStart(2, \"0\"))\r\n .join(\"\");\r\n}\r\n\r\n/**\r\n * Creates a SHA-512 hash of data using Web Crypto API.\r\n */\r\nexport async function sha512(data: string): Promise {\r\n const encoder = new TextEncoder();\r\n const dataBuffer = encoder.encode(data);\r\n const hashBuffer = await crypto.subtle.digest(\"SHA-512\", dataBuffer);\r\n const hashArray = new Uint8Array(hashBuffer);\r\n\r\n return Array.from(hashArray)\r\n .map((b) => b.toString(16).padStart(2, \"0\"))\r\n .join(\"\");\r\n}\r\n\r\n// ========================================\r\n// Timestamp Tokens\r\n// ========================================\r\n\r\n/**\r\n * Generates a secure timestamp-based token.\r\n */\r\nexport function generateTimestampToken(): string {\r\n const timestamp = Date.now().toString();\r\n const randomBytes = getRandomBytes(8);\r\n const randomHex = Array.from(randomBytes)\r\n .map((b) => b.toString(16).padStart(2, \"0\"))\r\n .join(\"\");\r\n\r\n return `${timestamp}_${randomHex}`;\r\n}\r\n\r\n/**\r\n * Validates a timestamp token and extracts the timestamp.\r\n */\r\nexport function validateTimestampToken(\r\n token: string,\r\n maxAgeMs: number = 15 * 60 * 1000 // 15 minutes\r\n): { valid: boolean; timestamp?: number; age?: number } {\r\n try {\r\n const parts = token.split(\"_\");\r\n if (parts.length !== 2) {\r\n return { valid: false };\r\n }\r\n\r\n const timestamp = parseInt(parts[0], 10);\r\n if (isNaN(timestamp)) {\r\n return { valid: false };\r\n }\r\n\r\n const now = Date.now();\r\n const age = now - timestamp;\r\n\r\n if (age > maxAgeMs || age < 0) {\r\n return { valid: false, timestamp, age };\r\n }\r\n\r\n return { valid: true, timestamp, age };\r\n } catch {\r\n return { valid: false };\r\n }\r\n}\r\n\r\n// ========================================\r\n// AES-GCM Encryption\r\n// ========================================\r\n\r\n/**\r\n * Creates an encrypted token using AES-GCM.\r\n */\r\nexport async function encryptToken(\r\n data: string,\r\n key: CryptoKey\r\n): Promise<{ encrypted: string; iv: string }> {\r\n const encoder = new TextEncoder();\r\n const dataBuffer = encoder.encode(data);\r\n const iv = crypto.getRandomValues(new Uint8Array(12)); // 96-bit IV for GCM\r\n\r\n const encryptedBuffer = await crypto.subtle.encrypt(\r\n {\r\n name: \"AES-GCM\",\r\n iv: iv,\r\n },\r\n key,\r\n dataBuffer\r\n );\r\n\r\n const encrypted = Array.from(new Uint8Array(encryptedBuffer))\r\n .map((b) => b.toString(16).padStart(2, \"0\"))\r\n .join(\"\");\r\n\r\n const ivHex = Array.from(iv)\r\n .map((b) => b.toString(16).padStart(2, \"0\"))\r\n .join(\"\");\r\n\r\n return { encrypted, iv: ivHex };\r\n}\r\n\r\n/**\r\n * Decrypts a token using AES-GCM.\r\n */\r\nexport async function decryptToken(\r\n encrypted: string,\r\n iv: string,\r\n key: CryptoKey\r\n): Promise {\r\n // Convert hex strings back to Uint8Array\r\n const encryptedBytes = new Uint8Array(\r\n encrypted.match(/.{1,2}/g)?.map((byte) => parseInt(byte, 16)) || []\r\n );\r\n\r\n const ivBytes = new Uint8Array(\r\n iv.match(/.{1,2}/g)?.map((byte) => parseInt(byte, 16)) || []\r\n );\r\n\r\n const decryptedBuffer = await crypto.subtle.decrypt(\r\n {\r\n name: \"AES-GCM\",\r\n iv: ivBytes,\r\n },\r\n key,\r\n encryptedBytes\r\n );\r\n\r\n const decoder = new TextDecoder();\r\n return decoder.decode(decryptedBuffer);\r\n}\r\n\r\n/**\r\n * Generates an AES-GCM key for encryption/decryption.\r\n */\r\nexport async function generateEncryptionKey(): Promise {\r\n return await crypto.subtle.generateKey(\r\n {\r\n name: \"AES-GCM\",\r\n length: 256,\r\n },\r\n true, // extractable\r\n [\"encrypt\", \"decrypt\"]\r\n );\r\n}\r\n\r\n/**\r\n * Imports an encryption key from raw bytes.\r\n */\r\nexport async function importEncryptionKey(\r\n keyBytes: Uint8Array\r\n): Promise {\r\n return await crypto.subtle.importKey(\r\n \"raw\",\r\n keyBytes,\r\n {\r\n name: \"AES-GCM\",\r\n length: 256,\r\n },\r\n true,\r\n [\"encrypt\", \"decrypt\"]\r\n );\r\n}\r\n\r\n// ========================================\r\n// Default Export\r\n// ========================================\r\n\r\nexport default {\r\n // Core functions\r\n makeHash,\r\n generateHMAC,\r\n validateHMAC,\r\n constantTimeEquals,\r\n\r\n // Base64URL encoding\r\n bytesToBase64Url,\r\n base64UrlToBytes,\r\n stringToBase64Url,\r\n base64UrlToString,\r\n\r\n // Random generation\r\n generateSecureRandom,\r\n generateNonce,\r\n generateUUID,\r\n generateRandomString,\r\n getRandomBytes,\r\n\r\n // Application-specific tokens\r\n generateBookingToken,\r\n generateApiKey,\r\n generatePayToken,\r\n generateSessionId,\r\n generateCorrelationId,\r\n generateSecureToken,\r\n\r\n // Password hashing\r\n hashPassword,\r\n verifyPassword,\r\n\r\n // Standard hashes\r\n sha256,\r\n sha512,\r\n\r\n // Timestamp tokens\r\n generateTimestampToken,\r\n validateTimestampToken,\r\n\r\n // Encryption\r\n encryptToken,\r\n decryptToken,\r\n generateEncryptionKey,\r\n importEncryptionKey,\r\n};\r\n","deleted","label",[171,172,153],"src","utils","permalink","https://www.val.town/x/ianmenethil/ZenServer/code/src/utils/crypto.ts","extension","actionData","errors"]