PHP WebShell
Текущая директория: /opt/BitGoJS/modules/sdk-hmac/dist/src
Просмотр файла: hmac.js
"use strict";
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = Object.getOwnPropertyDescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
var ownKeys = function(o) {
ownKeys = Object.getOwnPropertyNames || function (o) {
var ar = [];
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
return ar;
};
return ownKeys(o);
};
return function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
__setModuleDefault(result, mod);
return result;
};
})();
Object.defineProperty(exports, "__esModule", { value: true });
exports.calculateHMAC = calculateHMAC;
exports.calculateHMACSubject = calculateHMACSubject;
exports.calculateRequestHMAC = calculateRequestHMAC;
exports.calculateRequestHeaders = calculateRequestHeaders;
exports.verifyResponse = verifyResponse;
const crypto_1 = require("crypto");
const urlLib = __importStar(require("url"));
const sjcl = __importStar(require("@bitgo/sjcl"));
/**
* Calculate the HMAC for the given key and message
* @param key {String} - the key to use for the HMAC
* @param message {String} - the actual message to HMAC
* @returns {*} - the result of the HMAC operation
*/
function calculateHMAC(key, message) {
return (0, crypto_1.createHmac)('sha256', key).update(message).digest('hex');
}
/**
* Calculate the subject string that is to be HMAC'ed for a HTTP request or response
* @param urlPath request url, including query params
* @param text request body text
* @param timestamp request timestamp from `Date.now()`
* @param statusCode Only set for HTTP responses, leave blank for requests
* @param method request method
* @returns {string}
*/
function calculateHMACSubject({ urlPath, text, timestamp, statusCode, method, authVersion, }) {
const urlDetails = urlLib.parse(urlPath);
const queryPath = urlDetails.query && urlDetails.query.length > 0 ? urlDetails.path : urlDetails.pathname;
if (statusCode !== undefined && isFinite(statusCode) && Number.isInteger(statusCode)) {
if (authVersion === 3) {
return [method.toUpperCase(), timestamp, queryPath, statusCode, text].join('|');
}
return [timestamp, queryPath, statusCode, text].join('|');
}
if (authVersion === 3) {
return [method.toUpperCase(), timestamp, '3.0', queryPath, text].join('|');
}
return [timestamp, queryPath, text].join('|');
}
/**
* Calculate the HMAC for an HTTP request
*/
function calculateRequestHMAC({ url: urlPath, text, timestamp, token, method, authVersion, }) {
const signatureSubject = calculateHMACSubject({ urlPath, text, timestamp, method, authVersion });
// calculate the HMAC
return calculateHMAC(token, signatureSubject);
}
/**
* Calculate request headers with HMAC
*/
function calculateRequestHeaders({ url, text, token, method, authVersion, }) {
const timestamp = Date.now();
const hmac = calculateRequestHMAC({ url, text, timestamp, token, method, authVersion });
// calculate the SHA256 hash of the token
const hashDigest = sjcl.hash.sha256.hash(token);
const tokenHash = sjcl.codec.hex.fromBits(hashDigest);
return {
hmac,
timestamp,
tokenHash,
};
}
/**
* Verify the HMAC for an HTTP response
*/
function verifyResponse({ url: urlPath, statusCode, text, timestamp, token, hmac, method, authVersion, }) {
const signatureSubject = calculateHMACSubject({
urlPath,
text,
timestamp,
statusCode,
method,
authVersion,
});
// calculate the HMAC
const expectedHmac = calculateHMAC(token, signatureSubject);
// determine if the response is still within the validity window (5 minute window)
const now = Date.now();
const isInResponseValidityWindow = timestamp >= now - 1000 * 60 * 5 && timestamp <= now;
// verify the HMAC and timestamp
return {
isValid: expectedHmac === hmac,
expectedHmac,
signatureSubject,
isInResponseValidityWindow,
verificationTime: now,
};
}
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaG1hYy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9obWFjLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBa0JBLHNDQUVDO0FBV0Qsb0RBb0JDO0FBS0Qsb0RBWUM7QUFLRCwwREFrQkM7QUFLRCx3Q0FrQ0M7QUFsSUQsbUNBQW9DO0FBQ3BDLDRDQUE4QjtBQUM5QixrREFBb0M7QUFVcEM7Ozs7O0dBS0c7QUFDSCxTQUFnQixhQUFhLENBQUMsR0FBVyxFQUFFLE9BQWU7SUFDeEQsT0FBTyxJQUFBLG1CQUFVLEVBQUMsUUFBUSxFQUFFLEdBQUcsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDakUsQ0FBQztBQUVEOzs7Ozs7OztHQVFHO0FBQ0gsU0FBZ0Isb0JBQW9CLENBQUMsRUFDbkMsT0FBTyxFQUNQLElBQUksRUFDSixTQUFTLEVBQ1QsVUFBVSxFQUNWLE1BQU0sRUFDTixXQUFXLEdBQ2lCO0lBQzVCLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDekMsTUFBTSxTQUFTLEdBQUcsVUFBVSxDQUFDLEtBQUssSUFBSSxVQUFVLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUM7SUFDMUcsSUFBSSxVQUFVLEtBQUssU0FBUyxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxNQUFNLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDckYsSUFBSSxXQUFXLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDdEIsT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDbEYsQ0FBQztRQUNELE9BQU8sQ0FBQyxTQUFTLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDNUQsQ0FBQztJQUNELElBQUksV0FBVyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3RCLE9BQU8sQ0FBQyxNQUFNLENBQUMsV0FBVyxFQUFFLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQzdFLENBQUM7SUFDRCxPQUFPLENBQUMsU0FBUyxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7QUFDaEQsQ0FBQztBQUVEOztHQUVHO0FBQ0gsU0FBZ0Isb0JBQW9CLENBQUMsRUFDbkMsR0FBRyxFQUFFLE9BQU8sRUFDWixJQUFJLEVBQ0osU0FBUyxFQUNULEtBQUssRUFDTCxNQUFNLEVBQ04sV0FBVyxHQUNpQjtJQUM1QixNQUFNLGdCQUFnQixHQUFHLG9CQUFvQixDQUFDLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUM7SUFFakcscUJBQXFCO0lBQ3JCLE9BQU8sYUFBYSxDQUFDLEtBQUssRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO0FBQ2hELENBQUM7QUFFRDs7R0FFRztBQUNILFNBQWdCLHVCQUF1QixDQUFDLEVBQ3RDLEdBQUcsRUFDSCxJQUFJLEVBQ0osS0FBSyxFQUNMLE1BQU0sRUFDTixXQUFXLEdBQ29CO0lBQy9CLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztJQUM3QixNQUFNLElBQUksR0FBRyxvQkFBb0IsQ0FBQyxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLENBQUMsQ0FBQztJQUV4Rix5Q0FBeUM7SUFDekMsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2hELE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN0RCxPQUFPO1FBQ0wsSUFBSTtRQUNKLFNBQVM7UUFDVCxTQUFTO0tBQ1YsQ0FBQztBQUNKLENBQUM7QUFFRDs7R0FFRztBQUNILFNBQWdCLGNBQWMsQ0FBQyxFQUM3QixHQUFHLEVBQUUsT0FBTyxFQUNaLFVBQVUsRUFDVixJQUFJLEVBQ0osU0FBUyxFQUNULEtBQUssRUFDTCxJQUFJLEVBQ0osTUFBTSxFQUNOLFdBQVcsR0FDVztJQUN0QixNQUFNLGdCQUFnQixHQUFHLG9CQUFvQixDQUFDO1FBQzVDLE9BQU87UUFDUCxJQUFJO1FBQ0osU0FBUztRQUNULFVBQVU7UUFDVixNQUFNO1FBQ04sV0FBVztLQUNaLENBQUMsQ0FBQztJQUVILHFCQUFxQjtJQUNyQixNQUFNLFlBQVksR0FBRyxhQUFhLENBQUMsS0FBSyxFQUFFLGdCQUFnQixDQUFDLENBQUM7SUFFNUQsa0ZBQWtGO0lBQ2xGLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztJQUN2QixNQUFNLDBCQUEwQixHQUFHLFNBQVMsSUFBSSxHQUFHLEdBQUcsSUFBSSxHQUFHLEVBQUUsR0FBRyxDQUFDLElBQUksU0FBUyxJQUFJLEdBQUcsQ0FBQztJQUV4RixnQ0FBZ0M7SUFDaEMsT0FBTztRQUNMLE9BQU8sRUFBRSxZQUFZLEtBQUssSUFBSTtRQUM5QixZQUFZO1FBQ1osZ0JBQWdCO1FBQ2hCLDBCQUEwQjtRQUMxQixnQkFBZ0IsRUFBRSxHQUFHO0tBQ3RCLENBQUM7QUFDSixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgY3JlYXRlSG1hYyB9IGZyb20gJ2NyeXB0byc7XG5pbXBvcnQgKiBhcyB1cmxMaWIgZnJvbSAndXJsJztcbmltcG9ydCAqIGFzIHNqY2wgZnJvbSAnQGJpdGdvL3NqY2wnO1xuaW1wb3J0IHtcbiAgQ2FsY3VsYXRlSG1hY1N1YmplY3RPcHRpb25zLFxuICBDYWxjdWxhdGVSZXF1ZXN0SGVhZGVyc09wdGlvbnMsXG4gIENhbGN1bGF0ZVJlcXVlc3RIbWFjT3B0aW9ucyxcbiAgUmVxdWVzdEhlYWRlcnMsXG4gIFZlcmlmeVJlc3BvbnNlSW5mbyxcbiAgVmVyaWZ5UmVzcG9uc2VPcHRpb25zLFxufSBmcm9tICcuL3R5cGVzJztcblxuLyoqXG4gKiBDYWxjdWxhdGUgdGhlIEhNQUMgZm9yIHRoZSBnaXZlbiBrZXkgYW5kIG1lc3NhZ2VcbiAqIEBwYXJhbSBrZXkge1N0cmluZ30gLSB0aGUga2V5IHRvIHVzZSBmb3IgdGhlIEhNQUNcbiAqIEBwYXJhbSBtZXNzYWdlIHtTdHJpbmd9IC0gdGhlIGFjdHVhbCBtZXNzYWdlIHRvIEhNQUNcbiAqIEByZXR1cm5zIHsqfSAtIHRoZSByZXN1bHQgb2YgdGhlIEhNQUMgb3BlcmF0aW9uXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjYWxjdWxhdGVITUFDKGtleTogc3RyaW5nLCBtZXNzYWdlOiBzdHJpbmcpOiBzdHJpbmcge1xuICByZXR1cm4gY3JlYXRlSG1hYygnc2hhMjU2Jywga2V5KS51cGRhdGUobWVzc2FnZSkuZGlnZXN0KCdoZXgnKTtcbn1cblxuLyoqXG4gKiBDYWxjdWxhdGUgdGhlIHN1YmplY3Qgc3RyaW5nIHRoYXQgaXMgdG8gYmUgSE1BQydlZCBmb3IgYSBIVFRQIHJlcXVlc3Qgb3IgcmVzcG9uc2VcbiAqIEBwYXJhbSB1cmxQYXRoIHJlcXVlc3QgdXJsLCBpbmNsdWRpbmcgcXVlcnkgcGFyYW1zXG4gKiBAcGFyYW0gdGV4dCByZXF1ZXN0IGJvZHkgdGV4dFxuICogQHBhcmFtIHRpbWVzdGFtcCByZXF1ZXN0IHRpbWVzdGFtcCBmcm9tIGBEYXRlLm5vdygpYFxuICogQHBhcmFtIHN0YXR1c0NvZGUgT25seSBzZXQgZm9yIEhUVFAgcmVzcG9uc2VzLCBsZWF2ZSBibGFuayBmb3IgcmVxdWVzdHNcbiAqIEBwYXJhbSBtZXRob2QgcmVxdWVzdCBtZXRob2RcbiAqIEByZXR1cm5zIHtzdHJpbmd9XG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjYWxjdWxhdGVITUFDU3ViamVjdCh7XG4gIHVybFBhdGgsXG4gIHRleHQsXG4gIHRpbWVzdGFtcCxcbiAgc3RhdHVzQ29kZSxcbiAgbWV0aG9kLFxuICBhdXRoVmVyc2lvbixcbn06IENhbGN1bGF0ZUhtYWNTdWJqZWN0T3B0aW9ucyk6IHN0cmluZyB7XG4gIGNvbnN0IHVybERldGFpbHMgPSB1cmxMaWIucGFyc2UodXJsUGF0aCk7XG4gIGNvbnN0IHF1ZXJ5UGF0aCA9IHVybERldGFpbHMucXVlcnkgJiYgdXJsRGV0YWlscy5xdWVyeS5sZW5ndGggPiAwID8gdXJsRGV0YWlscy5wYXRoIDogdXJsRGV0YWlscy5wYXRobmFtZTtcbiAgaWYgKHN0YXR1c0NvZGUgIT09IHVuZGVmaW5lZCAmJiBpc0Zpbml0ZShzdGF0dXNDb2RlKSAmJiBOdW1iZXIuaXNJbnRlZ2VyKHN0YXR1c0NvZGUpKSB7XG4gICAgaWYgKGF1dGhWZXJzaW9uID09PSAzKSB7XG4gICAgICByZXR1cm4gW21ldGhvZC50b1VwcGVyQ2FzZSgpLCB0aW1lc3RhbXAsIHF1ZXJ5UGF0aCwgc3RhdHVzQ29kZSwgdGV4dF0uam9pbignfCcpO1xuICAgIH1cbiAgICByZXR1cm4gW3RpbWVzdGFtcCwgcXVlcnlQYXRoLCBzdGF0dXNDb2RlLCB0ZXh0XS5qb2luKCd8Jyk7XG4gIH1cbiAgaWYgKGF1dGhWZXJzaW9uID09PSAzKSB7XG4gICAgcmV0dXJuIFttZXRob2QudG9VcHBlckNhc2UoKSwgdGltZXN0YW1wLCAnMy4wJywgcXVlcnlQYXRoLCB0ZXh0XS5qb2luKCd8Jyk7XG4gIH1cbiAgcmV0dXJuIFt0aW1lc3RhbXAsIHF1ZXJ5UGF0aCwgdGV4dF0uam9pbignfCcpO1xufVxuXG4vKipcbiAqIENhbGN1bGF0ZSB0aGUgSE1BQyBmb3IgYW4gSFRUUCByZXF1ZXN0XG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjYWxjdWxhdGVSZXF1ZXN0SE1BQyh7XG4gIHVybDogdXJsUGF0aCxcbiAgdGV4dCxcbiAgdGltZXN0YW1wLFxuICB0b2tlbixcbiAgbWV0aG9kLFxuICBhdXRoVmVyc2lvbixcbn06IENhbGN1bGF0ZVJlcXVlc3RIbWFjT3B0aW9ucyk6IHN0cmluZyB7XG4gIGNvbnN0IHNpZ25hdHVyZVN1YmplY3QgPSBjYWxjdWxhdGVITUFDU3ViamVjdCh7IHVybFBhdGgsIHRleHQsIHRpbWVzdGFtcCwgbWV0aG9kLCBhdXRoVmVyc2lvbiB9KTtcblxuICAvLyBjYWxjdWxhdGUgdGhlIEhNQUNcbiAgcmV0dXJuIGNhbGN1bGF0ZUhNQUModG9rZW4sIHNpZ25hdHVyZVN1YmplY3QpO1xufVxuXG4vKipcbiAqIENhbGN1bGF0ZSByZXF1ZXN0IGhlYWRlcnMgd2l0aCBITUFDXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjYWxjdWxhdGVSZXF1ZXN0SGVhZGVycyh7XG4gIHVybCxcbiAgdGV4dCxcbiAgdG9rZW4sXG4gIG1ldGhvZCxcbiAgYXV0aFZlcnNpb24sXG59OiBDYWxjdWxhdGVSZXF1ZXN0SGVhZGVyc09wdGlvbnMpOiBSZXF1ZXN0SGVhZGVycyB7XG4gIGNvbnN0IHRpbWVzdGFtcCA9IERhdGUubm93KCk7XG4gIGNvbnN0IGhtYWMgPSBjYWxjdWxhdGVSZXF1ZXN0SE1BQyh7IHVybCwgdGV4dCwgdGltZXN0YW1wLCB0b2tlbiwgbWV0aG9kLCBhdXRoVmVyc2lvbiB9KTtcblxuICAvLyBjYWxjdWxhdGUgdGhlIFNIQTI1NiBoYXNoIG9mIHRoZSB0b2tlblxuICBjb25zdCBoYXNoRGlnZXN0ID0gc2pjbC5oYXNoLnNoYTI1Ni5oYXNoKHRva2VuKTtcbiAgY29uc3QgdG9rZW5IYXNoID0gc2pjbC5jb2RlYy5oZXguZnJvbUJpdHMoaGFzaERpZ2VzdCk7XG4gIHJldHVybiB7XG4gICAgaG1hYyxcbiAgICB0aW1lc3RhbXAsXG4gICAgdG9rZW5IYXNoLFxuICB9O1xufVxuXG4vKipcbiAqIFZlcmlmeSB0aGUgSE1BQyBmb3IgYW4gSFRUUCByZXNwb25zZVxuICovXG5leHBvcnQgZnVuY3Rpb24gdmVyaWZ5UmVzcG9uc2Uoe1xuICB1cmw6IHVybFBhdGgsXG4gIHN0YXR1c0NvZGUsXG4gIHRleHQsXG4gIHRpbWVzdGFtcCxcbiAgdG9rZW4sXG4gIGhtYWMsXG4gIG1ldGhvZCxcbiAgYXV0aFZlcnNpb24sXG59OiBWZXJpZnlSZXNwb25zZU9wdGlvbnMpOiBWZXJpZnlSZXNwb25zZUluZm8ge1xuICBjb25zdCBzaWduYXR1cmVTdWJqZWN0ID0gY2FsY3VsYXRlSE1BQ1N1YmplY3Qoe1xuICAgIHVybFBhdGgsXG4gICAgdGV4dCxcbiAgICB0aW1lc3RhbXAsXG4gICAgc3RhdHVzQ29kZSxcbiAgICBtZXRob2QsXG4gICAgYXV0aFZlcnNpb24sXG4gIH0pO1xuXG4gIC8vIGNhbGN1bGF0ZSB0aGUgSE1BQ1xuICBjb25zdCBleHBlY3RlZEhtYWMgPSBjYWxjdWxhdGVITUFDKHRva2VuLCBzaWduYXR1cmVTdWJqZWN0KTtcblxuICAvLyBkZXRlcm1pbmUgaWYgdGhlIHJlc3BvbnNlIGlzIHN0aWxsIHdpdGhpbiB0aGUgdmFsaWRpdHkgd2luZG93ICg1IG1pbnV0ZSB3aW5kb3cpXG4gIGNvbnN0IG5vdyA9IERhdGUubm93KCk7XG4gIGNvbnN0IGlzSW5SZXNwb25zZVZhbGlkaXR5V2luZG93ID0gdGltZXN0YW1wID49IG5vdyAtIDEwMDAgKiA2MCAqIDUgJiYgdGltZXN0YW1wIDw9IG5vdztcblxuICAvLyB2ZXJpZnkgdGhlIEhNQUMgYW5kIHRpbWVzdGFtcFxuICByZXR1cm4ge1xuICAgIGlzVmFsaWQ6IGV4cGVjdGVkSG1hYyA9PT0gaG1hYyxcbiAgICBleHBlY3RlZEhtYWMsXG4gICAgc2lnbmF0dXJlU3ViamVjdCxcbiAgICBpc0luUmVzcG9uc2VWYWxpZGl0eVdpbmRvdyxcbiAgICB2ZXJpZmljYXRpb25UaW1lOiBub3csXG4gIH07XG59XG4iXX0=Выполнить команду
Для локальной разработки. Не используйте в интернете!