Code Improvements & Bug Fixes

Author: alxdrlitreev

lib/session.js

@@ -5,7 +5,7 @@
 // helpers like getAddr() / getSigningClient() resolve to the per-request
 // wallet without explicit plumbing.
 
-import { createCipheriv, createDecipheriv, randomBytes, createHash } from 'crypto';
+import { createCipheriv, createDecipheriv, randomBytes, createHash, createHmac } from 'crypto';
 import { AsyncLocalStorage } from 'async_hooks';
 import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'fs';
 import { join } from 'path';
@@ -178,6 +178,7 @@ export async function sessionFromMnemonic(mnemonic) {
   const provAddr = toBech32('sentprov', data);
 
   session = {
+    kind: 'mnemonic',
     addr,
     provAddr,
     wallet,
@@ -357,7 +358,7 @@ export function buildClearCookie({ secure }) {
 export function buildKeplrToken(addr, pubkeyB64) {
   if (!_key) throw new Error('Session key not initialized');
   const payload = `${addr}|${pubkeyB64 || ''}`;
-  const mac = createHash('sha256').update(_key).update('|').update(payload).digest('base64url');
+  const mac = createHmac('sha256', _key).update(payload).digest('base64url');
   return `${Buffer.from(payload, 'utf8').toString('base64url')}.${mac}`;
 }
 
@@ -370,7 +371,7 @@ export function parseKeplrToken(token) {
   const mac = token.slice(dot + 1);
   let payload;
   try { payload = Buffer.from(payloadB64, 'base64url').toString('utf8'); } catch { return null; }
-  const expect = createHash('sha256').update(_key).update('|').update(payload).digest('base64url');
+  const expect = createHmac('sha256', _key).update(payload).digest('base64url');
   if (expect !== mac) return null;
   const [addr, pubkeyB64] = payload.split('|');
   if (!addr || !addr.startsWith('sent1')) return null;

server.js

@@ -4,6 +4,7 @@
 // Cache (cached/cacheInvalidate/cacheClear) imported from blue-js-sdk.
 
 import 'dotenv/config';
+import { randomBytes as _cryptoRandomBytes } from 'crypto';
 import express from 'express';
 import QRCode from 'qrcode';
 import { fileURLToPath } from 'url';
@@ -1341,7 +1342,7 @@ function gcKeplrChallenges() {
 
 app.post('/api/wallet/keplr-challenge', rateLimit('kchal', 30, 60_000), (req, res) => {
   gcKeplrChallenges();
-  const nonce = `spm-login-${Date.now()}-${Math.random().toString(36).slice(2, 12)}`;
+  const nonce = `spm-login-${Date.now()}-${_cryptoRandomBytes(16).toString('hex')}`;
   keplrChallenges.set(nonce, Date.now() + KEPLR_CHALLENGE_TTL_MS);
   res.json({ nonce });
 });