fix: improve pbkdf2 type safety to match Node.js API (#932)

Author: boorad

example/src/benchmarks/pbkdf2/pbkdf2.ts

@@ -1,4 +1,4 @@
-import rnqc, { type HashAlgorithm } from 'react-native-quick-crypto';
+import rnqc from 'react-native-quick-crypto';
 import * as noble from '@noble/hashes/pbkdf2';
 import { sha256 } from '@noble/hashes/sha2';
 // @ts-expect-error - crypto-browserify is not typed
@@ -37,7 +37,7 @@ const pbkdf2_256_1_32_sync: BenchFn = () => {
 
   bench
     .add('rnqc', () => {
-      rnqc.pbkdf2Sync('password', 'salt', 1, 32, 'sha256' as HashAlgorithm);
+      rnqc.pbkdf2Sync('password', 'salt', 1, 32, 'sha256');
     })
     .add('@noble/hashes/pbkdf2', () => {
       noble.pbkdf2(sha256, 'password', 'salt', { c: 1, dkLen: 32 });

example/src/tests/pbkdf2/fixtures.ts

@@ -1,5 +1,5 @@
 // copied from https://github.com/crypto-browserify/pbkdf2/blob/master/test/fixtures.json
-export type Fixture = {
+interface FixtureBase {
   description?: string;
   key?: string;
   keyHex?: string;
@@ -11,15 +11,26 @@ export type Fixture = {
   saltUint8Array?: number[];
   saltInt32Array?: number[];
   saltFloat64Array?: number[];
+}
+
+export interface ValidFixture extends FixtureBase {
+  iterations: number;
+  dkLen: number;
+  results: Record<string, string>;
+}
+
+export interface InvalidFixture extends FixtureBase {
   iterations: number | string;
   dkLen: number | string;
-  results?: Record<string, string>;
-  exception?: string;
-};
-type Fixtures = {
-  valid: Fixture[];
-  invalid: Fixture[];
-};
+  exception: string;
+}
+
+export type Fixture = ValidFixture | InvalidFixture;
+
+interface Fixtures {
+  valid: ValidFixture[];
+  invalid: InvalidFixture[];
+}
 export const fixtures: Fixtures = {
   valid: [
     {

example/src/tests/pbkdf2/pbkdf2_tests.ts

@@ -2,10 +2,10 @@
 import { Buffer } from 'safe-buffer';
 import { expect } from 'chai';
 import { test } from '../util';
-import { fixtures, type Fixture } from './fixtures';
+import { fixtures, type ValidFixture } from './fixtures';
 
 import crypto from 'react-native-quick-crypto';
-import type { BinaryLike, HashAlgorithm } from 'react-native-quick-crypto';
+import type { BinaryLike } from 'react-native-quick-crypto';
 
 type TestFixture = [string, string, number, number, string];
 
@@ -27,18 +27,11 @@ const SUITE = 'pbkdf2';
     length: number,
     expected: string,
   ) => {
-    crypto.pbkdf2(
-      pass,
-      salt,
-      iterations,
-      length,
-      hash as HashAlgorithm,
-      function (err, result) {
-        expect(err).to.be.null;
-        expect(result).not.to.be.null;
-        expect(result?.toString('hex')).to.equal(expected);
-      },
-    );
+    crypto.pbkdf2(pass, salt, iterations, length, hash, function (err, result) {
+      expect(err).to.be.null;
+      expect(result).not.to.be.null;
+      expect(result?.toString('hex')).to.equal(expected);
+    });
   };
 
   const kTests: TestFixture[] = [
@@ -75,7 +68,7 @@ const SUITE = 'pbkdf2';
 }
 
 test(SUITE, 'handles buffers', () => {
-  const resultSync = crypto.pbkdf2Sync('password', 'salt', 1, 32);
+  const resultSync = crypto.pbkdf2Sync('password', 'salt', 1, 32, 'sha1');
   expect(resultSync?.toString('hex')).to.equal(
     '0c60c80f961f0e71f3a9b524af6012062fe037a6e0f0eb94fe8fc46bdc637164',
   );
@@ -125,8 +118,7 @@ test(
 
 const algos = ['sha1', 'sha224', 'sha256', 'sha384', 'sha512', 'ripemd160'];
 algos.forEach(function (algorithm) {
-  fixtures.valid.forEach(function (f: Fixture) {
-    // TODO: check these types once nitro port is done
+  fixtures.valid.forEach(function (f: ValidFixture) {
     let key: BinaryLike, keyType: string, salt: BinaryLike, saltType: string;
     if (f.keyUint8Array) {
       key = new Uint8Array(f.keyUint8Array);
@@ -160,7 +152,7 @@ algos.forEach(function (algorithm) {
       salt = f.salt as BinaryLike;
       saltType = 'string';
     }
-    const expected = f.results ? f.results[algorithm] : undefined;
+    const expected = f.results[algorithm];
     const description =
       algorithm +
       ' encodes "' +
@@ -180,9 +172,9 @@ algos.forEach(function (algorithm) {
       crypto.pbkdf2(
         key,
         salt,
-        f.iterations as number,
-        f.dkLen as number,
-        algorithm as HashAlgorithm,
+        f.iterations,
+        f.dkLen,
+        algorithm,
         function (err, result) {
           expect(err).to.be.null;
           expect(result).not.to.be.null;
@@ -195,42 +187,16 @@ algos.forEach(function (algorithm) {
       const result = crypto.pbkdf2Sync(
         key,
         salt,
-        f.iterations as number,
-        f.dkLen as number,
-        algorithm as HashAlgorithm,
+        f.iterations,
+        f.dkLen,
+        algorithm,
       );
       expect(result?.toString('hex')).to.equal(expected);
     });
   });
 
-  // // TODO: fix the 'invalid' tests
-  // fixtures.invalid.forEach(function (f: Fixture) {
-  //   const description = algorithm + ' should throw ' + f.exception;
-
-  //   test(SUITE, ' async w/ ' + description, function () {
-  //     function noop() {}
-  //     expect(() => {
-  //       crypto.pbkdf2(
-  //         f.key as BinaryLike,
-  //         f.salt as BinaryLike,
-  //         f.iterations as number,
-  //         f.dkLen as number,
-  //         algorithm as HashAlgorithm,
-  //         noop
-  //       )
-  //     }).to.throw(f.exception);
-  //   });
-
-  //   test(SUITE, ' sync w/' + description, function () {
-  //     expect(() => {
-  //       crypto.pbkdf2Sync(
-  //         f.key as BinaryLike,
-  //         f.salt as BinaryLike,
-  //         f.iterations as number,
-  //         f.dkLen as number,
-  //         algorithm as HashAlgorithm,
-  //       )
-  //     }).to.throw(f.exception);
-  //   });
-  // });
+  // TODO(#931): enable invalid fixture tests once JS-side validation is added
+  // for iterations/keylen. Currently invalid values (negative, NaN, Infinity)
+  // reach the native C layer and trigger assert()/abort() instead of throwing.
+  // See: fixtures.invalid
 });

packages/react-native-quick-crypto/src/pbkdf2.ts

@@ -8,7 +8,7 @@ import {
   lazyDOMException,
   normalizeHashName,
 } from './utils';
-import type { HashAlgorithm, SubtleAlgorithm } from './utils';
+import type { SubtleAlgorithm } from './utils';
 import type { Pbkdf2 } from './specs/pbkdf2.nitro';
 import { promisify } from 'util';
 import type { CryptoKey } from './keys';
@@ -79,12 +79,12 @@ export function pbkdf2Sync(
   salt: Salt,
   iterations: number,
   keylen: number,
-  digest?: HashAlgorithm,
+  digest: string,
 ): Buffer {
   const sanitizedPassword = sanitizeInput(password, WRONG_PASS);
   const sanitizedSalt = sanitizeInput(salt, WRONG_SALT);
 
-  const algo = digest ? normalizeHashName(digest, HashContext.Node) : 'sha1';
+  const algo = normalizeHashName(digest, HashContext.Node);
   getNative();
   const result: ArrayBuffer = native.pbkdf2Sync(
     sanitizedPassword,
@@ -104,7 +104,7 @@ const pbkdf2WithDigest = (
   salt: Salt,
   iterations: number,
   keylen: number,
-  digest: HashAlgorithm,
+  digest: string,
   callback: Pbkdf2Callback,
 ) => pbkdf2(password, salt, iterations, keylen, digest, callback);
 
@@ -142,7 +142,7 @@ export async function pbkdf2DeriveBits(
     sanitizedSalt,
     iterations,
     length / 8,
-    normalizedHash as HashAlgorithm,
+    normalizedHash,
   );
   if (!result) {
     throw lazyDOMException(