node-forge 1.3.1

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:npm/node-forge@1.3.1
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/node-forge@1.3.1

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:ed6867a00c0dd06027b0d16604a30b4769d28fab236653c2f7d0ac612742c6ea","contract":["forge.md.sha256.create creates a digest object that computes correct SHA-256 hex string for UTF-8 inputs","forge.md.md5.create creates a digest object that computes correct MD5 hex string","forge.hmac.create computes correct HMAC-SHA256 digest with specified key and message","forge.util.encode64 and forge.util.decode64 accurately round-trip ASCII and binary strings","forge.util.bytesToHex and forge.util.hexToBytes convert binary byte strings to hex and back","forge.cipher.createCipher and forge.cipher.createDecipher perform AES-CBC encryption and decryption with PKCS#7 padding","forge.pki.rsa.generateKeyPair generates valid RSA keypair and exports public/private keys in PEM format"],"goal":"verify pkg:npm/node-forge@1.3.1","kind":"HOW","packages":["pkg:npm/node-forge@1.3.1"],"schemaVersion":1},"contractCommand":["node","test/contract.js"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"npm","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/node-forge@1.3.1"],"schemaVersion":1,"subject":"pkg:npm/node-forge@1.3.1","verifierAdapter":"node-typescript@1"}

{
  "name": "sample-node-forge",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-node-forge",
      "version": "1.0.0",
      "license": "MIT-0",
      "dependencies": {
        "node-forge": "1.3.1"
      }
    },
    "node_modules/node-forge": {
      "version": "1.3.1",
      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.3.1.tgz",
      "integrity": "sha512-dPEtOeMvF9VMcYV/1Wb8CPoVAXtp6MKMlcbAt4ddqmGqUJ6fQZFXkNZNkNlfevtNkGtaSoXf/vNNNSvgrdXwtA==",
      "license": "(BSD-3-Clause OR GPL-2.0)",
      "engines": {
        "node": ">= 6.13.0"
      }
    }
  }
}

{
  "name": "sample-node-forge",
  "version": "1.0.0",
  "private": true,
  "description": "Clean-room verification sample for node-forge",
  "main": "src/index.js",
  "scripts": {
    "test": "node test/contract.js"
  },
  "dependencies": {
    "node-forge": "1.3.1"
  },
  "license": "MIT-0"
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:npm/node-forge@1.3.1",
  "kind": "HOW",
  "packages": [
    "pkg:npm/node-forge@1.3.1"
  ]
}

'use strict';

const forge = require('node-forge');

/**
 * Computes SHA-256 hash of a string.
 * @param {string} text
 * @returns {string} Hex encoded SHA-256 digest
 */
function computeSha256(text) {
  const md = forge.md.sha256.create();
  md.update(text, 'utf8');
  return md.digest().toHex();
}

/**
 * Computes HMAC-SHA256 of a message using a key.
 * @param {string} key
 * @param {string} message
 * @returns {string} Hex encoded HMAC digest
 */
function computeHmacSha256(key, message) {
  const hmac = forge.hmac.create();
  hmac.start('sha256', key);
  hmac.update(message);
  return hmac.digest().toHex();
}

/**
 * Base64 encodes a string.
 * @param {string} str
 * @returns {string}
 */
function base64Encode(str) {
  return forge.util.encode64(str);
}

/**
 * Base64 decodes a string.
 * @param {string} b64
 * @returns {string}
 */
function base64Decode(b64) {
  return forge.util.decode64(b64);
}

/**
 * Encrypts plaintext using AES-CBC.
 * @param {string} plaintext
 * @param {string} key 16 or 32 byte key string
 * @param {string} iv 16 byte IV string
 * @returns {string} Hex encoded ciphertext
 */
function encryptAesCbc(plaintext, key, iv) {
  const cipher = forge.cipher.createCipher('AES-CBC', key);
  cipher.start({ iv: iv });
  cipher.update(forge.util.createBuffer(plaintext, 'utf8'));
  cipher.finish();
  return cipher.output.toHex();
}

/**
 * Decrypts hex ciphertext using AES-CBC.
 * @param {string} cipherHex
 * @param {string} key 16 or 32 byte key string
 * @param {string} iv 16 byte IV string
 * @returns {string} Decrypted UTF-8 string
 */
function decryptAesCbc(cipherHex, key, iv) {
  const decipher = forge.cipher.createDecipher('AES-CBC', key);
  decipher.start({ iv: iv });
  decipher.update(forge.util.createBuffer(forge.util.hexToBytes(cipherHex)));
  const result = decipher.finish();
  if (!result) {
    throw new Error('Decryption failed');
  }
  return decipher.output.toString();
}

module.exports = {
  forge,
  computeSha256,
  computeHmacSha256,
  base64Encode,
  base64Decode,
  encryptAesCbc,
  decryptAesCbc
};

'use strict';

const assert = require('assert');
const forge = require('node-forge');
const {
  computeSha256,
  computeHmacSha256,
  base64Encode,
  base64Decode,
  encryptAesCbc,
  decryptAesCbc
} = require('../src/index.js');

// 1. forge.md.sha256.create creates a digest object that computes correct SHA-256 hex string for UTF-8 inputs
{
  const md = forge.md.sha256.create();
  md.update('hello world', 'utf8');
  const digestHex = md.digest().toHex();
  assert.strictEqual(digestHex, 'b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9');
  assert.strictEqual(computeSha256('hello world'), 'b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9');

  // Empty string
  const emptyMd = forge.md.sha256.create();
  emptyMd.update('', 'utf8');
  assert.strictEqual(emptyMd.digest().toHex(), 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855');
}

// 2. forge.md.md5.create creates a digest object that computes correct MD5 hex string
{
  const md = forge.md.md5.create();
  md.update('test string', 'utf8');
  assert.strictEqual(md.digest().toHex(), '6f8db599de986fab7a21625b7916589c');
}

// 3. forge.hmac.create computes correct HMAC-SHA256 digest with specified key and message
{
  const hmac = forge.hmac.create();
  hmac.start('sha256', 'sample-key');
  hmac.update('sample-message');
  const hmacHex = hmac.digest().toHex();
  assert.strictEqual(typeof hmacHex, 'string');
  assert.strictEqual(hmacHex.length, 64);
  assert.strictEqual(computeHmacSha256('sample-key', 'sample-message'), hmacHex);
}

// 4. forge.util.encode64 and forge.util.decode64 accurately round-trip ASCII and binary strings
{
  const original = 'Hello, CodeSampleX!';
  const encoded = base64Encode(original);
  assert.strictEqual(encoded, 'SGVsbG8sIENvZGVTYW1wbGVYIQ==');
  const decoded = base64Decode(encoded);
  assert.strictEqual(decoded, original);
}

// 5. forge.util.bytesToHex and forge.util.hexToBytes convert binary byte strings to hex and back
{
  const bytes = forge.util.hexToBytes('deadbeef');
  assert.strictEqual(bytes.length, 4);
  const hex = forge.util.bytesToHex(bytes);
  assert.strictEqual(hex, 'deadbeef');
}

// 6. forge.cipher.createCipher and forge.cipher.createDecipher perform AES-CBC encryption and decryption with PKCS#7 padding
{
  const key = forge.util.hexToBytes('00112233445566778899aabbccddeeff');
  const iv = forge.util.hexToBytes('0102030405060708090a0b0c0d0e0f10');
  const plaintext = 'Clean room test payload 12345';

  const cipherHex = encryptAesCbc(plaintext, key, iv);
  assert.strictEqual(typeof cipherHex, 'string');
  assert.ok(cipherHex.length > 0);

  const decrypted = decryptAesCbc(cipherHex, key, iv);
  assert.strictEqual(decrypted, plaintext);
}

// 7. forge.pki.rsa.generateKeyPair generates valid RSA keypair and exports public/private keys in PEM format
{
  const keypair = forge.pki.rsa.generateKeyPair({ bits: 1024, workers: -1 });
  assert.ok(keypair.publicKey);
  assert.ok(keypair.privateKey);

  const publicKeyPem = forge.pki.publicKeyToPem(keypair.publicKey);
  const privateKeyPem = forge.pki.privateKeyToPem(keypair.privateKey);

  assert.ok(publicKeyPem.startsWith('-----BEGIN PUBLIC KEY-----'));
  assert.strictEqual(typeof privateKeyPem, 'string');
  assert.ok(privateKeyPem.length > 0);

  const parsedPublicKey = forge.pki.publicKeyFromPem(publicKeyPem);
  assert.ok(parsedPublicKey.n);
  assert.ok(parsedPublicKey.e);
}

console.log('Contract tests passed successfully.');