Initial commit

node_modules/csrf/HISTORY.md

@@ -0,0 +1,113 @@
+3.1.0 / 2019-04-09
+==================
+
+  * Include a TypeScript definition file
+  * deps: tsscmp@1.0.6
+    - Use `crypto.timingSafeEqual` when available
+  * deps: uid-safe@2.1.5
+    - perf: remove only trailing `=`
+
+3.0.6 / 2017-03-14
+==================
+
+  * Remove `base64-url` dependency
+
+3.0.5 / 2017-03-07
+==================
+
+  * deps: uid-safe@2.1.4
+    - Remove `base64-url` dependency
+
+3.0.4 / 2016-11-13
+==================
+
+  * deps: base64-url@1.3.3
+  * deps: uid-safe@2.1.3
+    - deps: base64-url@1.3.3
+
+3.0.3 / 2016-05-26
+==================
+
+  * deps: tsscmp@1.0.5
+
+3.0.2 / 2016-05-22
+==================
+
+  * Use `tsscmp` module for timing-safe token verification
+  * deps: base64-url@1.2.2
+  * deps: uid-safe@2.1.1
+    - deps: base64-url@1.2.2
+
+3.0.1 / 2016-01-28
+==================
+
+  * deps: rndm@1.2.0
+  * deps: uid-safe@2.1.0
+    - Use `random-bytes` for byte source
+
+3.0.0 / 2015-05-09
+==================
+
+  * Remove `tokenize` export
+  * Remove `tokenize` option
+  * Return a prototype-based object rather than functions
+    - This means the resulting functions need to be called as methods
+  * Throw when missing secret to `tokens.create()`
+  * deps: uid-safe@~2.0.0
+    - Use global `Promise` when returning a promise
+
+2.0.7 / 2015-05-03
+==================
+
+  * Fix compatibility with `crypto.DEFAULT_ENCODING` global changes
+
+2.0.6 / 2015-02-13
+==================
+
+  * deps: base64-url@1.2.1
+  * deps: uid-safe@~1.1.0
+    - Use `crypto.randomBytes`, if available
+    - deps: base64-url@1.2.1
+
+2.0.5 / 2015-01-31
+==================
+
+  * deps: base64-url@1.2.0
+  * deps: uid-safe@~1.0.3
+    - Fix error branch that would throw
+    - deps: base64-url@1.2.0
+
+2.0.4 / 2015-01-08
+==================
+
+  * deps: uid-safe@~1.0.2
+    - Remove dependency on `mz`
+
+2.0.3 / 2014-12-30
+==================
+
+  * Slight speed improvement for `verify`
+  * deps: base64-url@1.1.0
+  * deps: rndm@~1.1.0
+
+2.0.2 / 2014-11-09
+==================
+
+  * deps: scmp@1.0.0
+
+2.0.1 / 2014-08-22
+==================
+
+  * Rename module to `csrf`
+
+2.0.0 / 2014-06-18
+==================
+
+  * Use `uid-safe` module
+  * Use `base64-url` module
+  * Remove sync `.secret()` -- use `.secretSync()` instead
+
+1.0.4 / 2014-06-11
+==================
+
+  * Make sure CSRF tokens are URL safe

node_modules/csrf/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
+Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

node_modules/csrf/README.md

@@ -0,0 +1,143 @@
+# CSRF
+
+[![NPM Version][npm-version-image]][npm-url]
+[![NPM Downloads][npm-downloads-image]][npm-url]
+[![Node.js Version][node-image]][node-url]
+[![Build Status][travis-image]][travis-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
+Logic behind CSRF token creation and verification.
+
+Read [Understanding-CSRF](https://github.com/pillarjs/understanding-csrf)
+for more information on CSRF. Use this module to create custom CSRF middleware.
+
+Looking for a CSRF framework for your favorite framework that uses this
+module?
+
+  * Express/connect: [csurf](https://www.npmjs.com/package/csurf) or
+    [alt-xsrf](https://www.npmjs.com/package/alt-xsrf)
+  * Koa: [koa-csrf](https://www.npmjs.com/package/koa-csrf) or
+    [koa-atomic-session](https://www.npmjs.com/package/koa-atomic-session)
+
+### Install
+
+```sh
+$ npm install csrf
+```
+
+### TypeScript
+
+This module includes a [TypeScript](https://www.typescriptlang.org/)
+declaration file to enable auto complete in compatible editors and type
+information for TypeScript projects.
+
+## API
+
+<!-- eslint-disable no-unused-vars -->
+
+```js
+var Tokens = require('csrf')
+```
+
+### new Tokens([options])
+
+Create a new token generation/verification instance. The `options` argument is
+optional and will just use all defaults if missing.
+
+#### Options
+
+Tokens accepts these properties in the options object.
+
+##### saltLength
+
+The length of the internal salt to use, in characters. Internally, the salt
+is a base 62 string. Defaults to `8` characters.
+
+##### secretLength
+
+The length of the secret to generate, in bytes. Note that the secret is
+passed around base-64 encoded and that this length refers to the underlying
+bytes, not the length of the base-64 string. Defaults to `18` bytes.
+
+#### tokens.create(secret)
+
+Create a new CSRF token attached to the given `secret`. The `secret` is a
+string, typically generated from the `tokens.secret()` or `tokens.secretSync()`
+methods. This token is what you should add into HTML `<form>` blocks and
+expect the user's browser to provide back.
+
+<!-- eslint-disable no-undef, no-unused-vars -->
+
+```js
+var secret = tokens.secretSync()
+var token = tokens.create(secret)
+```
+
+#### tokens.secret(callback)
+
+Asynchronously create a new `secret`, which is a string. The secret is to
+be kept on the server, typically stored in a server-side session for the
+user. The secret should be at least per user.
+
+<!-- eslint-disable no-undef -->
+
+```js
+tokens.secret(function (err, secret) {
+  if (err) throw err
+  // do something with the secret
+})
+```
+
+#### tokens.secret()
+
+Asynchronously create a new `secret` and return a `Promise`. Please see
+`tokens.secret(callback)` documentation for full details.
+
+**Note**: To use promises in Node.js _prior to 0.12_, promises must be
+"polyfilled" using `global.Promise = require('bluebird')`.
+
+<!-- eslint-disable no-undef -->
+
+```js
+tokens.secret().then(function (secret) {
+  // do something with the secret
+})
+```
+
+#### tokens.secretSync()
+
+A synchronous version of `tokens.secret(callback)`. Please see
+`tokens.secret(callback)` documentation for full details.
+
+<!-- eslint-disable no-undef, no-unused-vars -->
+
+```js
+var secret = tokens.secretSync()
+```
+
+#### tokens.verify(secret, token)
+
+Check whether a CSRF token is valid for the given `secret`, returning
+a Boolean.
+
+<!-- eslint-disable no-undef -->
+
+```js
+if (!tokens.verify(secret, token)) {
+  throw new Error('invalid token!')
+}
+```
+
+## License
+
+[MIT](LICENSE)
+
+[coveralls-image]: https://badgen.net/coveralls/c/github/pillarjs/csrf/master
+[coveralls-url]: https://coveralls.io/r/pillarjs/csrf?branch=master
+[node-image]: https://badgen.net/npm/node/csrf
+[node-url]: https://nodejs.org/en/download
+[npm-downloads-image]: https://badgen.net/npm/dm/csrf
+[npm-url]: https://npmjs.org/package/csrf
+[npm-version-image]: https://badgen.net/npm/v/csrf
+[travis-image]: https://badgen.net/travis/pillarjs/csrf/master
+[travis-url]: https://travis-ci.org/pillarjs/csrf

node_modules/csrf/index.d.ts

@@ -0,0 +1,48 @@
+declare class Tokens {
+  /**
+   * Token generation/verification class.
+   */
+  constructor(options?: Tokens.Options);
+
+  /**
+   * Create a new CSRF token.
+   */
+  create(secret: string): string;
+
+  /**
+   * Create a new secret key.
+   */
+  secret(): Promise<string>;
+
+  /**
+   * Create a new secret key.
+   */
+  secret(callback: Tokens.SecretCallback): void;
+
+  /**
+   * Create a new secret key synchronously.
+   */
+  secretSync(): string;
+
+  /**
+   * Verify if a given token is valid for a given secret.
+   */
+  verify(secret: string, token: string): boolean;
+}
+
+declare namespace Tokens {
+  export type SecretCallback = (err: Error | null, secret: string) => void;
+
+  export interface Options {
+    /**
+     * The string length of the salt (default: 8)
+     */
+    saltLength?: number;
+    /**
+     * The byte length of the secret key (default: 18)
+     */
+    secretLength?: number;
+  }
+}
+
+export = Tokens;

node_modules/csrf/index.js

@@ -0,0 +1,159 @@
+/*!
+ * csrf
+ * Copyright(c) 2014 Jonathan Ong
+ * Copyright(c) 2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict'
+
+/**
+ * Module dependencies.
+ * @private
+ */
+
+var rndm = require('rndm')
+var uid = require('uid-safe')
+var compare = require('tsscmp')
+var crypto = require('crypto')
+
+/**
+ * Module variables.
+ * @private
+ */
+
+var EQUAL_GLOBAL_REGEXP = /=/g
+var PLUS_GLOBAL_REGEXP = /\+/g
+var SLASH_GLOBAL_REGEXP = /\//g
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = Tokens
+
+/**
+ * Token generation/verification class.
+ *
+ * @param {object} [options]
+ * @param {number} [options.saltLength=8] The string length of the salt
+ * @param {number} [options.secretLength=18] The byte length of the secret key
+ * @public
+ */
+
+function Tokens (options) {
+  if (!(this instanceof Tokens)) {
+    return new Tokens(options)
+  }
+
+  var opts = options || {}
+
+  var saltLength = opts.saltLength !== undefined
+    ? opts.saltLength
+    : 8
+
+  if (typeof saltLength !== 'number' || !isFinite(saltLength) || saltLength < 1) {
+    throw new TypeError('option saltLength must be finite number > 1')
+  }
+
+  var secretLength = opts.secretLength !== undefined
+    ? opts.secretLength
+    : 18
+
+  if (typeof secretLength !== 'number' || !isFinite(secretLength) || secretLength < 1) {
+    throw new TypeError('option secretLength must be finite number > 1')
+  }
+
+  this.saltLength = saltLength
+  this.secretLength = secretLength
+}
+
+/**
+ * Create a new CSRF token.
+ *
+ * @param {string} secret The secret for the token.
+ * @public
+ */
+
+Tokens.prototype.create = function create (secret) {
+  if (!secret || typeof secret !== 'string') {
+    throw new TypeError('argument secret is required')
+  }
+
+  return this._tokenize(secret, rndm(this.saltLength))
+}
+
+/**
+ * Create a new secret key.
+ *
+ * @param {function} [callback]
+ * @public
+ */
+
+Tokens.prototype.secret = function secret (callback) {
+  return uid(this.secretLength, callback)
+}
+
+/**
+ * Create a new secret key synchronously.
+ * @public
+ */
+
+Tokens.prototype.secretSync = function secretSync () {
+  return uid.sync(this.secretLength)
+}
+
+/**
+ * Tokenize a secret and salt.
+ * @private
+ */
+
+Tokens.prototype._tokenize = function tokenize (secret, salt) {
+  return salt + '-' + hash(salt + '-' + secret)
+}
+
+/**
+ * Verify if a given token is valid for a given secret.
+ *
+ * @param {string} secret
+ * @param {string} token
+ * @public
+ */
+
+Tokens.prototype.verify = function verify (secret, token) {
+  if (!secret || typeof secret !== 'string') {
+    return false
+  }
+
+  if (!token || typeof token !== 'string') {
+    return false
+  }
+
+  var index = token.indexOf('-')
+
+  if (index === -1) {
+    return false
+  }
+
+  var salt = token.substr(0, index)
+  var expected = this._tokenize(secret, salt)
+
+  return compare(token, expected)
+}
+
+/**
+ * Hash a string with SHA1, returning url-safe base64
+ * @param {string} str
+ * @private
+ */
+
+function hash (str) {
+  return crypto
+    .createHash('sha1')
+    .update(str, 'ascii')
+    .digest('base64')
+    .replace(PLUS_GLOBAL_REGEXP, '-')
+    .replace(SLASH_GLOBAL_REGEXP, '_')
+    .replace(EQUAL_GLOBAL_REGEXP, '')
+}

node_modules/csrf/package.json

@@ -0,0 +1,90 @@
+{
+  "_from": "csrf@3.1.0",
+  "_id": "csrf@3.1.0",
+  "_inBundle": false,
+  "_integrity": "sha512-uTqEnCvWRk042asU6JtapDTcJeeailFy4ydOQS28bj1hcLnYRiqi8SsD2jS412AY1I/4qdOwWZun774iqywf9w==",
+  "_location": "/csrf",
+  "_phantomChildren": {},
+  "_requested": {
+    "type": "version",
+    "registry": true,
+    "raw": "csrf@3.1.0",
+    "name": "csrf",
+    "escapedName": "csrf",
+    "rawSpec": "3.1.0",
+    "saveSpec": null,
+    "fetchSpec": "3.1.0"
+  },
+  "_requiredBy": [
+    "/csurf"
+  ],
+  "_resolved": "https://registry.npmjs.org/csrf/-/csrf-3.1.0.tgz",
+  "_shasum": "ec75e9656d004d674b8ef5ba47b41fbfd6cb9c30",
+  "_spec": "csrf@3.1.0",
+  "_where": "/home/runner/Socketio-Chat-Template/node_modules/csurf",
+  "author": {
+    "name": "Jonathan Ong",
+    "email": "me@jongleberry.com",
+    "url": "http://jongleberry.com"
+  },
+  "bugs": {
+    "url": "https://github.com/pillarjs/csrf/issues"
+  },
+  "bundleDependencies": false,
+  "contributors": [
+    {
+      "name": "Douglas Christopher Wilson",
+      "email": "doug@somethingdoug.com"
+    }
+  ],
+  "dependencies": {
+    "rndm": "1.2.0",
+    "tsscmp": "1.0.6",
+    "uid-safe": "2.1.5"
+  },
+  "deprecated": false,
+  "description": "primary logic behind csrf tokens",
+  "devDependencies": {
+    "beautify-benchmark": "0.2.4",
+    "benchmark": "2.1.4",
+    "bluebird": "3.5.4",
+    "eslint": "5.16.0",
+    "eslint-config-standard": "12.0.0",
+    "eslint-plugin-import": "2.16.0",
+    "eslint-plugin-markdown": "1.0.0",
+    "eslint-plugin-node": "8.0.1",
+    "eslint-plugin-promise": "4.1.1",
+    "eslint-plugin-standard": "4.0.0",
+    "istanbul": "0.4.5",
+    "mocha": "6.1.2"
+  },
+  "engines": {
+    "node": ">= 0.8"
+  },
+  "files": [
+    "LICENSE",
+    "HISTORY.md",
+    "README.md",
+    "index.d.ts",
+    "index.js"
+  ],
+  "homepage": "https://github.com/pillarjs/csrf#readme",
+  "keywords": [
+    "csrf",
+    "tokens"
+  ],
+  "license": "MIT",
+  "name": "csrf",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pillarjs/csrf.git"
+  },
+  "scripts": {
+    "bench": "node benchmark/index.js",
+    "lint": "eslint --plugin markdown --ext js,md .",
+    "test": "mocha --trace-deprecation --reporter spec --bail --check-leaks test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --trace-deprecation --reporter dot --check-leaks test/",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --trace-deprecation --reporter spec --check-leaks test/"
+  },
+  "version": "3.1.0"
+}