Skip to content

Commit adb51dd

Browse files
mzattahrimzattahri
committed
v3.0.0.
1 parent 8e203f7 commit adb51dd

45 files changed

Lines changed: 7401 additions & 314 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/lint.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: Lint
2+
3+
on:
4+
push:
5+
pull_request:
6+
7+
jobs:
8+
go:
9+
name: Go
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: actions/checkout@v6
13+
14+
- uses: actions/setup-go@v6
15+
with:
16+
go-version: stable
17+
18+
- uses: golangci/golangci-lint-action@v9
19+
with:
20+
version: v2.6.2
21+
22+
js:
23+
name: JavaScript
24+
runs-on: ubuntu-latest
25+
steps:
26+
- uses: actions/checkout@v6
27+
28+
- uses: actions/setup-node@v4
29+
with:
30+
node-version: lts/*
31+
cache: npm
32+
cache-dependency-path: js/package-lock.json
33+
34+
- run: npm ci
35+
working-directory: js
36+
37+
- run: npm run lint
38+
working-directory: js

‎.github/workflows/test.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Test
2+
3+
on:
4+
push:
5+
pull_request:
6+
7+
jobs:
8+
test:
9+
runs-on: ubuntu-latest
10+
11+
steps:
12+
- uses: actions/checkout@v6
13+
14+
- name: Set up Go
15+
uses: actions/setup-go@v6
16+
with:
17+
go-version: stable
18+
19+
- name: Set up Node.js
20+
uses: actions/setup-node@v4
21+
with:
22+
node-version: lts/*
23+
cache: "npm"
24+
cache-dependency-path: js/package-lock.json
25+
26+
- name: Install JS dependencies
27+
run: npm ci
28+
working-directory: js
29+
30+
- name: Run tests
31+
run: make test

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
.gocache/

‎.golangci.yml‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
version: '2'
2+
3+
run:
4+
timeout: 5m
5+
tests: true
6+
modules-download-mode: readonly
7+
8+
linters:
9+
enable:
10+
- errcheck # Check for unchecked errors
11+
- govet # Standard Go vet checks
12+
- ineffassign # Detect ineffectual assignments
13+
- staticcheck # Advanced static analysis (includes gosimple)
14+
- unused # Check for unused code
15+
- misspell # Check spelling
16+
- gocritic # Comprehensive linter with many checks
17+
- revive # Fast, configurable, extensible linter
18+
- gosec # Security-focused linter
19+
- unconvert # Remove unnecessary type conversions
20+
- unparam # Find unused function parameters
21+
- bodyclose # Check HTTP response bodies are closed
22+
- noctx # Find http requests without context
23+
- sqlclosecheck # Check SQL rows/statements are closed
24+
- rowserrcheck # Check SQL rows errors are checked
25+
26+
disable:
27+
- exhaustive # Can be too strict for switch statements
28+
- exhaustruct # Can be too strict for struct initialization
29+
- funlen # Function length check can be subjective
30+
- gochecknoglobals # Globals sometimes needed
31+
- gocyclo # Cyclomatic complexity can be subjective
32+
- godox # Allow TODO/FIXME comments
33+
- lll # Line length too strict
34+
- nestif # Nesting depth can be subjective
35+
- wsl # Whitespace linter too opinionated
36+
37+
settings:
38+
govet:
39+
enable-all: true
40+
disable:
41+
- shadow
42+
- fieldalignment # Struct field ordering for memory optimization is too pedantic
43+
44+
staticcheck:
45+
checks: ['all']
46+
47+
errcheck:
48+
check-type-assertions: true
49+
check-blank: true
50+
51+
gosec:
52+
excludes:
53+
- G104 # Allow some unhandled errors where appropriate
54+
severity: medium
55+
56+
gocritic:
57+
enabled-tags:
58+
- diagnostic
59+
- experimental
60+
- opinionated
61+
- performance
62+
- style
63+
disabled-checks:
64+
- captLocal
65+
66+
revive:
67+
rules:
68+
- name: exported
69+
severity: warning
70+
- name: unexported-return
71+
severity: warning
72+
- name: var-naming
73+
severity: warning
74+
75+
exclusions:
76+
rules:
77+
# Exclude some linters from running on tests files
78+
- path: _test\.go
79+
linters:
80+
- gosec
81+
- unparam
82+
83+
# Exclude known linters from partially hard-vendored code
84+
- path: vendor/
85+
linters:
86+
- all
87+
88+
# Exclude shadow checking on short variable names
89+
- linters:
90+
- govet
91+
text: 'shadow: declaration of "(err|ctx)"'
92+
93+
# Allow capitalized local variable names (SRP uses A, B, M1, M2 per RFC 5054)
94+
- linters:
95+
- gocritic
96+
text: 'captLocal:'
97+
98+
# Internal compute functions have error returns for API consistency
99+
- linters:
100+
- unparam
101+
text: 'result 1 \(error\) is always nil'
102+
path: srp\.go
103+
104+
issues:
105+
# Maximum issues count per one linter
106+
max-issues-per-linter: 0
107+
108+
# Maximum count of issues with the same text
109+
max-same-issues: 0
110+
111+
# Unique issues by line
112+
uniq-by-line: true
113+
114+
output:
115+
formats:
116+
text:
117+
path: stdout
118+
print-linter-name: true
119+
print-issued-lines: true
120+
colors: true
121+
sort-order:
122+
- linter
123+
- file

‎CHANGELOG.md‎

Lines changed: 36 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,43 @@
11
# Changelog
22

3+
## v3.0.0
4+
5+
### Go
6+
7+
- **Changed**: `NewTriplet` now returns `(Triplet, error)` instead of panicking on invalid input
8+
- **Changed**: `SaltLength` increased from 12 to 16 bytes (aligned with JS)
9+
- **Fixed**: Typo `ErrServerNoReady` → `ErrServerNotReady`
10+
- **Added**: Input validation in `Server.Reset()` for username, salt, and verifier
11+
- **Added**: Rate limiting guidance in SECURITY.md
12+
- **Added**: Interoperability tests with RFC 5054 vectors
13+
- **Added**: Makefile with `fmt`, `lint`, and `test` targets
14+
15+
### JavaScript
16+
17+
- **Added**: `generateSalt()` and `generateSaltWithLength()` helper functions
18+
- **Added**: Input validation in `Client.initialize()` and `computeVerifier()`
19+
- **Added**: Constants: `saltLength`, `minSaltLength`, `maxUsernameLength`, `maxPasswordLength`
20+
- **Added**: RFC 5054 test vectors for interoperability testing
21+
- **Added**: Makefile with `fmt`, `lint`, and `test` targets
22+
323
## v2.0.1
424

5-
- Requires Go 1.20;
6-
- Now using Go's new subtle.XORBytes function;
7-
- Added more tests.
25+
- Updated import paths
26+
27+
## v1.1.2
28+
29+
- Minor fixes
830

931
## v1.1.1
1032

11-
- Usernames and passwords are now normalized to NFKD unicode strings;
12-
- Added changelog.
33+
- Restored JSON marshalling of Triplet
34+
35+
## v1.1.0
36+
37+
- Added `Server.Reset` and other minor improvements
38+
- Added `Server.Save` for stateless architectures
39+
- Introduced `Params` to separate DH group from hash and KDF
40+
41+
## v1.0.0
42+
43+
- Initial release

0 commit comments

Comments
 (0)