The other five base64url copies (GRYT-898) - #379
Merged
Conversation
#378 said "three copies" and was wrong. It found them by grepping the exported name, which missed every private one, so `identity-keys.ts`, `identity-seed.ts`, `server-pins.ts` and `lib/reports/assertion.ts` kept hand-rolling the same `btoa` pair. Grepping for `btoa` rather than for the name is what found the rest, and is how this should have been scoped the first time. All four now use @gryt/crypto. Where a caller hands over an `ArrayBuffer` the coercion stays local and only the encoding is shared. `server-pins.ts` is the one worth a second look. Its decoder added padding by hand before `atob`; crypto's takes either alphabet and padding or none of it, so the padding is gone rather than moved. Checked rather than assumed — the old decoder and the new one agree across 2425 cases, every length from 0 to 96 bytes. What is deliberately left is the other shape: `atob` used to turn a JWT payload straight into a string for `JSON.parse`, in account-api, device-delegation, identity-certificate and keycloak. Those are base64url to text, not to bytes, and routing them through the shared decoder means adding a TextDecoder at each site. Worth doing and not the same change. `yarn lint` clean, and identity-vault, message-vault, message-key, message-key-offer and server-notice all pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Review-required path, so this is yours to merge.
#378 said "three copies" and was wrong. It found them by grepping the exported name, which missed every private one. Grepping for
btoainstead turned up five more:auth/identity-keys.tsbase64UrlEncode+base64UrlDecodeauth/identity-seed.tsbase64Urlauth/server-pins.tsbase64UrlToBytes+base64UrlEncodelib/reports/assertion.tsbtoaon a SHA-256 digestAll four files now use
@gryt/crypto. Where a caller hands over anArrayBuffer, the coercion stays local and only the encoding is shared.What to look at
server-pins.ts. Its decoder added padding by hand beforeatob. Crypto's takes either alphabet and padding or none of it, so the padding is gone rather than moved — that is the one place the shape of the call changed. Old decoder against new: 2425 cases, every length 0 to 96 bytes, zero mismatches.identity-seed.tsandidentity-keys.tsare the identity core, but the substitution there is the same one #378 already proved, and both are covered by the vault suites below.Deliberately left
atobused to turn a JWT payload straight into a string forJSON.parse— inaccount-api.ts,device-delegation.ts,identity-certificate.tsandkeycloak.ts. That is base64url to text, not to bytes, and routing it through the shared decoder means adding aTextDecoderat each site. Worth doing, not the same change, and I did not want to bury it in this one.Verification
yarn lintclean.identity-vault,message-vault,message-key,message-key-offerandserver-noticeall pass, against the published@gryt/crypto@0.3.0.🤖 Generated with Claude Code