Initial Product release

src/auth.js

@@ -0,0 +1,43 @@
+const crypto = require('crypto');
+
+const PASSWORD_ITERATIONS = Number(process.env.PASSWORD_HASH_ITERATIONS || 310000);
+const PASSWORD_KEY_LENGTH = 32;
+const PASSWORD_DIGEST = 'sha256';
+const SESSION_BYTES = 32;
+
+function hashPassword(password, salt) {
+  const safePassword = String(password || '');
+  const safeSalt = salt || crypto.randomBytes(16).toString('hex');
+  const hash = crypto.pbkdf2Sync(safePassword, safeSalt, PASSWORD_ITERATIONS, PASSWORD_KEY_LENGTH, PASSWORD_DIGEST).toString('hex');
+  return {
+    salt: safeSalt,
+    hash: hash,
+    iterations: PASSWORD_ITERATIONS
+  };
+}
+
+function verifyPassword(password, record) {
+  if (!record || !record.password_salt || !record.password_hash) {
+    return false;
+  }
+  const iterations = Number(record.password_iterations || PASSWORD_ITERATIONS);
+  const safePassword = String(password || '');
+  const expected = crypto.pbkdf2Sync(safePassword, String(record.password_salt), iterations, PASSWORD_KEY_LENGTH, PASSWORD_DIGEST);
+  const actual = Buffer.from(String(record.password_hash), 'hex');
+  return actual.length === expected.length && crypto.timingSafeEqual(actual, expected);
+}
+
+function createSessionToken() {
+  return crypto.randomBytes(SESSION_BYTES).toString('hex');
+}
+
+function hashSessionToken(token) {
+  return crypto.createHash('sha256').update(String(token || '')).digest('hex');
+}
+
+module.exports = {
+  hashPassword,
+  verifyPassword,
+  createSessionToken,
+  hashSessionToken
+};