use latest arena-core (#133)

* use latest arena-core

* fixed tests

* fixing tests

* update dependencies

* updated yarn

* update yarn

* fixed tests

* fixed tests

* fixed tests

Author: SteRiccio

.yarn/install-state.gz

@@ -6,4 +6,4 @@ npmScopes:
     npmAuthToken: "${NPM_TOKEN}"
     npmRegistryServer: "https://npm.pkg.github.com"
 
-yarnPath: .yarn/releases/yarn-4.12.0.cjs
+yarnPath: .yarn/releases/yarn-4.13.0.cjs

.yarn/releases/yarn-4.12.0.cjs

@@ -0,0 +1,11 @@
+import type { Config } from 'jest'
+
+const config: Config = {
+  roots: ['<rootDir>/dist/'],
+  testEnvironment: 'node',
+  verbose: true,
+  transform: { '^.+\\.[jt]s$': 'ts-jest' },
+  transformIgnorePatterns: ['/node_modules/(?!(change-case|uuid|otplib|@otplib|@scure/base|@noble)/)'],
+}
+
+export default config

.yarn/releases/yarn-4.13.0.cjs

@@ -4,11 +4,12 @@
     "name": "OpenForis",
     "email": "openforis.arena@gmail.com"
   },
-  "version": "1.2.23",
+  "version": "1.2.24",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "@machinomy/types-node-db-migrate": "^0.0.2",
     "@types/bcryptjs": "^3.0.0",
     "@types/compression": "^1.8.1",
@@ -22,12 +23,12 @@
     "@types/passport": "^1.0.17",
     "@types/passport-jwt": "^4.0.1",
     "@types/passport-local": "^1.0.38",
-    "@types/supertest": "^6.0.3",
-    "@typescript-eslint/eslint-plugin": "^8.57.1",
-    "@typescript-eslint/parser": "^8.57.1",
+    "@types/supertest": "^7.2.0",
+    "@typescript-eslint/eslint-plugin": "^8.57.2",
+    "@typescript-eslint/parser": "^8.57.2",
     "copyfiles": "^2.4.1",
     "dotenv": "^17.3.1",
-    "eslint": "^9.39.4",
+    "eslint": "^10.1.0",
     "husky": "9.1.7",
     "jest": "^30.3.0",
     "lint-staged": "^16.4.0",
@@ -37,12 +38,12 @@
     "supertest": "^7.2.2",
     "ts-jest": "^29.4.6",
     "ts-node": "^10.9.2",
-    "typescript": "^5.9.3",
-    "typescript-eslint": "^8.57.1"
+    "typescript": "^6.0.2",
+    "typescript-eslint": "^8.57.2"
   },
   "dependencies": {
     "@godaddy/terminus": "^4.12.1",
-    "@openforis/arena-core": "^1.0.94",
+    "@openforis/arena-core": "^1.0.95",
     "bcryptjs": "^3.0.3",
     "compression": "^1.8.1",
     "cookie-parser": "^1.4.7",
@@ -54,7 +55,7 @@
     "jsonwebtoken": "^9.0.3",
     "lodash.throttle": "^4.1.1",
     "log4js": "^6.9.1",
-    "otplib": "^12.0.1",
+    "otplib": "^13.4.0",
     "passport": "^0.7.0",
     "passport-jwt": "^4.0.1",
     "passport-local": "^1.0.0",
@@ -93,7 +94,7 @@
     "url": "https://github.com/openforis/arena-server/issues"
   },
   "homepage": "https://github.com/openforis/arena-server#readme",
-  "packageManager": "yarn@4.12.0",
+  "packageManager": "yarn@4.13.0",
   "publishConfig": {
     "registry": "https://npm.pkg.github.com"
   }

.yarnrc.yml

@@ -9,7 +9,7 @@ export class JobRegistry extends Map<string, JobConstructor> {
       JobRegistry.instance = new Map<string, JobConstructor>()
 
       if (ProcessEnv.nodeEnv === NodeEnv.test) {
-        const { SimpleJob, SimpleJobWithJobs } = await import('./tests/testJobs')
+        const { SimpleJob, SimpleJobWithJobs } = await import('./tests/testJobs.js')
         JobRegistry.instance.set(SimpleJob.type, SimpleJob)
         JobRegistry.instance.set(SimpleJobWithJobs.type, SimpleJobWithJobs)
       }

jest.config.js

@@ -1,4 +1,4 @@
-import { authenticator } from 'otplib'
+import { generateSecret as generateOtpSecret, generateURI, verifySync } from 'otplib'
 import * as crypto from 'node:crypto'
 import bcrypt from 'bcryptjs'
 
@@ -100,9 +100,13 @@ const generateSecret = async (options: {
 }): Promise<{ secret: string; otpAuthUrl: string }> => {
   const { userEmail, deviceName } = options
 
-  const secret = authenticator.generateSecret()
+  const secret = generateOtpSecret()
   const accountName = `${deviceName} - ${userEmail}`
-  const otpAuthUrl = authenticator.keyuri(accountName, ArenaServerConstants.appId, secret)
+  const otpAuthUrl = generateURI({
+    issuer: ArenaServerConstants.appId,
+    label: accountName,
+    secret,
+  })
 
   return { secret, otpAuthUrl }
 }
@@ -124,11 +128,13 @@ const generateBackupCodes = (): string[] => {
  */
 const verifyToken = (options: { secret: string; token: string }): boolean => {
   const { secret, token } = options
-
-  // Set window to allow for clock skew (2 time steps before and after)
-  authenticator.options = { window: 2 }
-
-  return authenticator.verify({ token, secret })
+  const result = verifySync({
+    secret,
+    token,
+    // Allow for clock skew: 2 TOTP windows on either side of current time.
+    epochTolerance: 60,
+  })
+  return result.valid
 }
 
 const to2FADeviceForClient = (device: User2FADevice): User2FADeviceForClient => {

jest.config.ts

@@ -1,4 +1,4 @@
-import { v4 as uuidv4 } from 'uuid'
+import * as crypto from 'node:crypto'
 
 import { BaseProtocol, DB } from '../../db'
 import { UserTempAuthTokenForClient, UserTempAuthTokenStored } from '../../model'
@@ -24,7 +24,7 @@ export const create = async (
   const now = new Date()
   const expiresAt = new Date(now.getTime() + expirationMinutes * 60 * 1000)
 
-  const token = uuidv4()
+  const token = crypto.randomUUID()
   const tokenHash = hashToken(token)
 
   const tempAuthToken: UserTempAuthTokenStored = {