Repository navigation
Conversation
Token hashes, encryption key IDs, hashed plugin index names and context-bound passkey challenges are all derived from SHA-256 and kept in the database. Fixed vectors make any change to how they are computed fail loudly instead of silently orphaning existing rows.
…h @noble/hashes arctic and @oslojs/crypto are deprecated on npm and print warnings on every install. arctic was only used for generateCodeVerifier(), which is the same 32 random base64url bytes as generateToken() in @emdash-cms/auth. SHA-256 and HMAC move to @noble/hashes, which is synchronous, so the public token helpers in @emdash-cms/auth keep their signatures. The passkey code still uses @oslojs/crypto and @oslojs/webauthn and is left for a separate change. The Cloudflare dev optimizeDeps list follows the new imports so the first authenticated request does not trigger a re-optimize and reload.
🦋 Changeset detectedLatest commit: 66fe122 The changes in this PR will be included in the next version bump. This PR includes changesets to release 13 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
github-actions
Bot
added
review/needs-review
![emdashbot[bot]](https://avatars.githubusercontent.com/in/3255304?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
The approach is sound. Replacing the deprecated arctic and moving SHA-256 and HMAC from @oslojs/crypto to @noble/hashes clears the install deprecation warnings (#3550) with low risk. Both reviewers approved and neither raised any findings. Hash inputs and encodings are unchanged, and generateToken() keeps the same format and entropy as before. The local constant-time comparison works on fixed-length HMAC digests. Passkey code still uses the oslo packages, and the dependency manifests, Vite optimizeDeps entries, new fixed-vector tests and changeset all look correct. Review was static; tests and builds were not run.
Reviewed by anthropic/claude-opus-5-5 and openai/gpt-6.1-sol.
🚀 Deploying Preview to Cloudflare 🚀Preview URL: https://daniel-auth-noble-hashes.try.emdashcms.com, https://daniel-auth-noble-hashes-emdash-playground.emdash-cms.workers.dev (commit 66fe122)This URL reflects your latest Preview deploymentPreview Deployments by commit
|
@emdash-cms/admin
@emdash-cms/auth
@emdash-cms/auth-atproto
@emdash-cms/blocks
@emdash-cms/cloudflare
@emdash-cms/contentful-to-portable-text
emdash
create-emdash
@emdash-cms/gutenberg-to-portable-text
@emdash-cms/plugin-cli
@emdash-cms/plugin-test
@emdash-cms/plugin-types
@emdash-cms/registry-client
@emdash-cms/registry-lexicons
@emdash-cms/registry-loader
@emdash-cms/registry-moderation
@emdash-cms/registry-verification
upgrade-emdash
@emdash-cms/sandbox-workerd
@emdash-cms/x402
@emdash-cms/plugin-ai-moderation
@emdash-cms/plugin-ai-search
@emdash-cms/plugin-atproto
@emdash-cms/plugin-audit-log
@emdash-cms/plugin-color
@emdash-cms/plugin-embeds
@emdash-cms/plugin-field-kit
@emdash-cms/plugin-forms
@emdash-cms/plugin-webhook-notifier
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Removes the deprecated
arcticpackage and moves SHA-256 and HMAC hashing outside the passkey code from the deprecated@oslojs/cryptoto@noble/hashes. arctic was only used to make random codes in the device flow and the authorization code flow, andgenerateToken()from@emdash-cms/authmakes the same 32 random bytes.@noble/hashesis synchronous, so the token helpers in@emdash-cms/authkeep their signatures. The constant-time compare is now a small local function.The hashes come out the same, so existing API tokens, invites, magic links, encryption keys and plugin storage indexes keep working. The Cloudflare dev
optimizeDepslist follows the new imports.Passkeys still use the oslo packages, so those stay for now. This removes arctic and
@oslojs/jwtfrom whatemdashinstalls, and every oslo package from@emdash-cms/plugin-cli.Part of #3550
Type of change
Your connection to this change
I'm a Maintainer, and I took this on while triaging #3550.
Checklist
pnpm typecheckpassespnpm lintpassespnpm testpasses (or targeted tests for my change)pnpm formathas been runmessages.pochanges except in translation PRs — a workflow extracts catalogs on merge tomain. (n/a: no admin UI change)AI assistance disclosure
Screenshots / test output
New tests pin the SHA-256 output of token hashes, the encryption key ID, a hashed plugin index name and a context-bound passkey challenge. They passed on
mainbefore the switch and still pass, along with the existing PKCE, site transfer and plugin multihash vectors. On workerd, the site transfer test checks the@noble/hashesfallback against one of those vectors. That fallback's internal name changes fromoslotonoble; it isn't exported.On the Cloudflare starter template with a cold Vite cache, dev bypass, an API token request, the device flow and both passkey option routes work, and Vite doesn't have to add
@noble/hashesor an oslo package after startup. Without the newoptimizeDepsentries, the same requests cause two re-optimize and reload cycles.