ranisalt / node-argon2

Node.js bindings for Argon2 hashing algorithm
https://www.npmjs.com/package/argon2
MIT License
1.83k stars 90 forks source link

Typescript declared type "Options.type?: 0 | 2 | 1 | undefined" doesn't match dynamic check in index.js serialize() #357

Open tiagoj opened 1 year ago

tiagoj commented 1 year ago

This is not a show stopper for me, but I thought I would mention it.

Steps to reproduce

"argon2": "^0.29.1"

I'm using this code segment in Typescript

let options = {
    memoryCost: 15 * 2**10, // 15MiB, memoryCost is in KiB
    timeCost: 2,
    parallelism: 1,
    hashLength: 32, // default
    type: argon2.argon2id, // default
    raw: false
  }
 let hash = await argon2.hash(newUser.psw, options)

Note: That because the 'type' I was using is the default anyway, just deleting the 'type' line avoids the bug.

You don't really need to reproduce the issue, just looking at the source shows the mismatch.

Expected behaviour

Typescript declared types should agree with internal dynamic check.

Actual behaviour

If I set id to an integer as required by the typescript type, it results in a runtime error when the type check fails in the serialize() function in index.js

If I set it to a string, the Typescipt compiler issues an error TypeError: id must be a string at serialize (/Users/james/GitRepos/WebMisc/RmaSite/dev/dbApi/node_modules/@phc/format/index.js:59:11) at Module.hash (/Users/james/GitRepos/WebMisc/RmaSite/dev/dbApi/node_modules/argon2/argon2.js:68:10) ...

The odd thing, is that even with the error, using commonJs modules, it seemed to work, but when switching to use EJS (for other reasons), it started catching the error.

Environment

MAC

node: v16.13.0

typescript: Version 4.7.4

ve3 commented 1 year ago

This also happens on Windows 11.

const password = 'mypassword';
const hash = await argon2.hash(
    password, 
    {
        type: argon2.argon2id,
    }
);

If I remove type: argon2.argon2id, option, it runs fine.

ranisalt commented 1 year ago

@ve3 what version of the library are you using? It was solved in the past and now it passes function name to @phc/format

ve3 commented 1 year ago

It is newly installed.

"argon2": "^0.30.3"

Node 18.12.1

seia-soto commented 1 year ago

I can reproduce it on Node.JS v18.10.0 and "argon2": "^0.30.3".

Ttou commented 10 months ago

if set type with number, it runs fine

const hash = await argon2.hash('password', {
  type: argon2.argon2d // error
})

const hash2 = await argon2.hash('password', {
  type: 0 // success
})