Added other dependencies for authentication, made minor adjustments to index.js, added templating for exams, will remove dependencie modules later, keep for now

9 files changed, 332 insertions, 0 deletions

diff --git a/node_modules/tsscmp/.npmignore b/node_modules/tsscmp/.npmignore
new file mode 100644
index 0000000..c2658d7
--- /dev/null
+++ b/node_modules/tsscmp/.npmignore
@@ -0,0 +1 @@
+node_modules/
diff --git a/node_modules/tsscmp/.travis.yml b/node_modules/tsscmp/.travis.yml
new file mode 100644
index 0000000..b85d89f
--- /dev/null
+++ b/node_modules/tsscmp/.travis.yml
@@ -0,0 +1,14 @@
+language: node_js
+node_js:
+  - "6"
+  - "5"
+  - "5.1"
+  - "4"
+  - "4.2"
+  - "4.1"
+  - "4.0"
+  - "0.12"
+  - "0.11"
+  - "0.10"
+  - "0.8"
+  - "0.6"
diff --git a/node_modules/tsscmp/LICENSE b/node_modules/tsscmp/LICENSE
new file mode 100644
index 0000000..c62e51b
--- /dev/null
+++ b/node_modules/tsscmp/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/node_modules/tsscmp/README.md b/node_modules/tsscmp/README.md
new file mode 100644
index 0000000..cba99d0
--- /dev/null
+++ b/node_modules/tsscmp/README.md
@@ -0,0 +1,48 @@
+# Timing safe string compare using double HMAC
+
+[![Node.js Version](https://img.shields.io/node/v/tsscmp.svg?style=flat-square)](https://nodejs.org/en/download)
+[![npm](https://img.shields.io/npm/v/tsscmp.svg?style=flat-square)](https://npmjs.org/package/tsscmp)
+[![NPM Downloads](https://img.shields.io/npm/dm/tsscmp.svg?style=flat-square)](https://npmjs.org/package/tsscmp)
+[![Build Status](https://img.shields.io/travis/suryagh/tsscmp/master.svg?style=flat-square)](https://travis-ci.org/suryagh/tsscmp)
+[![Build Status](https://img.shields.io/appveyor/ci/suryagh/tsscmp/master.svg?style=flat-square&label=windows)](https://ci.appveyor.com/project/suryagh/tsscmp)
+[![Dependency Status](http://img.shields.io/david/suryagh/tsscmp.svg?style=flat-square)](https://david-dm.org/suryagh/tsscmp)
+[![npm-license](http://img.shields.io/npm/l/tsscmp.svg?style=flat-square)](LICENSE)
+
+
+Prevents [timing attacks](http://codahale.com/a-lesson-in-timing-attacks/) using Brad Hill's
+[Double HMAC pattern](https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double-hmac-verification/)
+to perform secure string comparison. Double HMAC avoids the timing atacks by blinding the
+timing channel using random time per attempt comparison against iterative brute force attacks.
+
+
+## Install
+
+```
+npm install tsscmp
+```
+## Why
+To compare secret values like **authentication tokens**, **passwords** or
+**capability urls** so that timing information is not
+leaked to the attacker.
+
+## Example
+
+```js
+var timingSafeCompare = require('tsscmp');
+
+var sessionToken = '127e6fbfe24a750e72930c';
+var givenToken = '127e6fbfe24a750e72930c';
+
+if (timingSafeCompare(sessionToken, givenToken)) {
+  console.log('good token');
+} else {
+  console.log('bad token');
+}
+```
+##License: 
+[MIT](LICENSE)
+
+**Credits to:**  [@jsha](https://github.com/jsha) |
+[@bnoordhuis](https://github.com/bnoordhuis) |
+[@suryagh](https://github.com/suryagh) |
+ 
\ No newline at end of file
diff --git a/node_modules/tsscmp/appveyor.yml b/node_modules/tsscmp/appveyor.yml
new file mode 100644
index 0000000..29cd460
--- /dev/null
+++ b/node_modules/tsscmp/appveyor.yml
@@ -0,0 +1,29 @@
+# Test against this version of Node.js
+environment:
+  matrix:
+   # nodejs_version: "0.6" not supported  in Windows x86
+   - nodejs_version: "0.8"
+   - nodejs_version: "0.10"
+   - nodejs_version: "0.11"
+   - nodejs_version: "0.12"
+   - nodejs_version: "4.0"
+   - nodejs_version: "5.0"
+   - nodejs_version: "6.0"
+
+# Install scripts. (runs after repo cloning)
+install:
+  # Get the latest stable version of Node.js or io.js
+  - ps: Install-Product node $env:nodejs_version
+  # install modules
+  - npm install
+
+# Post-install test scripts.
+test_script:
+  # Output useful info for debugging.
+  - node --version
+  - npm --version
+  # run tests
+  - npm test
+
+# Don't actually build.
+build: off
diff --git a/node_modules/tsscmp/lib/index.js b/node_modules/tsscmp/lib/index.js
new file mode 100644
index 0000000..7c86142
--- /dev/null
+++ b/node_modules/tsscmp/lib/index.js
@@ -0,0 +1,33 @@
+'use strict';
+
+// Implements Brad Hill's Double HMAC pattern from
+// https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double-hmac-verification/.
+// The approach is similar to the node's native implementation of timing safe buffer comparison that will be available on v6+.
+// https://github.com/nodejs/node/issues/3043
+// https://github.com/nodejs/node/pull/3073
+
+var crypto = require('crypto');
+
+function bufferEqual(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  for (var i = 0; i < a.length; i++) {
+    if (a[i] !== b[i]) {
+      return false;
+    }
+  }
+  return true;
+}
+
+function timeSafeCompare(a, b) {
+  var sa = String(a);
+  var sb = String(b);
+  var key = crypto.pseudoRandomBytes(32);
+  var ah = crypto.createHmac('sha256', key).update(sa).digest();
+  var bh = crypto.createHmac('sha256', key).update(sb).digest();
+
+  return bufferEqual(ah, bh) && a === b;
+}
+
+module.exports = timeSafeCompare;
diff --git a/node_modules/tsscmp/package.json b/node_modules/tsscmp/package.json
new file mode 100644
index 0000000..f614168
--- /dev/null
+++ b/node_modules/tsscmp/package.json
@@ -0,0 +1,87 @@
+{
+  "_args": [
+    [
+      "tsscmp@1.0.5",
+      "/home/humair/School/csc309/a4/solutions_repo/node_modules/csrf"
+    ]
+  ],
+  "_from": "tsscmp@1.0.5",
+  "_id": "tsscmp@1.0.5",
+  "_inCache": true,
+  "_installable": true,
+  "_location": "/tsscmp",
+  "_nodeVersion": "5.6.0",
+  "_npmOperationalInternal": {
+    "host": "packages-16-east.internal.npmjs.com",
+    "tmp": "tmp/tsscmp-1.0.5.tgz_1464226502956_0.48576042777858675"
+  },
+  "_npmUser": {
+    "email": "surya.com@gmail.com",
+    "name": "suryagh"
+  },
+  "_npmVersion": "3.6.0",
+  "_phantomChildren": {},
+  "_requested": {
+    "name": "tsscmp",
+    "raw": "tsscmp@1.0.5",
+    "rawSpec": "1.0.5",
+    "scope": null,
+    "spec": "1.0.5",
+    "type": "version"
+  },
+  "_requiredBy": [
+    "/csrf"
+  ],
+  "_resolved": "https://registry.npmjs.org/tsscmp/-/tsscmp-1.0.5.tgz",
+  "_shasum": "7dc4a33af71581ab4337da91d85ca5427ebd9a97",
+  "_shrinkwrap": null,
+  "_spec": "tsscmp@1.0.5",
+  "_where": "/home/humair/School/csc309/a4/solutions_repo/node_modules/csrf",
+  "author": {
+    "name": "suryagh"
+  },
+  "bugs": {
+    "url": "https://github.com/suryagh/tsscmp/issues"
+  },
+  "dependencies": {},
+  "description": "Timing safe string compare using double HMAC",
+  "devDependencies": {},
+  "directories": {},
+  "dist": {
+    "shasum": "7dc4a33af71581ab4337da91d85ca5427ebd9a97",
+    "tarball": "https://registry.npmjs.org/tsscmp/-/tsscmp-1.0.5.tgz"
+  },
+  "engines": {
+    "node": ">=0.6.x"
+  },
+  "gitHead": "095fb02b3e6102cbd1d2bdc9613e3da54e782f59",
+  "homepage": "https://github.com/suryagh/tsscmp#readme",
+  "keywords": [
+    "double hmac string compare",
+    "hmac",
+    "safe string compare",
+    "timing safe string compare"
+  ],
+  "license": "MIT",
+  "main": "lib/index.js",
+  "maintainers": [
+    {
+      "name": "suryagh",
+      "email": "surya.com@gmail.com"
+    }
+  ],
+  "name": "tsscmp",
+  "optionalDependencies": {},
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org"
+  },
+  "readme": "ERROR: No README data found!",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/suryagh/tsscmp.git"
+  },
+  "scripts": {
+    "test": "node test/unit && node test/benchmark"
+  },
+  "version": "1.0.5"
+}
diff --git a/node_modules/tsscmp/test/benchmark/index.js b/node_modules/tsscmp/test/benchmark/index.js
new file mode 100644
index 0000000..fd93e42
--- /dev/null
+++ b/node_modules/tsscmp/test/benchmark/index.js
@@ -0,0 +1,30 @@
+'use strict';
+
+var timeSafeCompare = require('../../lib/index');
+
+function random(length) {
+
+    length = length || 32;
+    var result = "";
+    var possible = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()-+/*[]{}-=\|;\':\"<>?,./";
+
+    for( var i=0; i < length; i++ ){
+        result += possible.charAt(Math.floor(Math.random() * possible.length));
+    }
+    return result;
+}
+
+function run(count) {
+    count = count || 100*1000;
+    console.log('benchmark count: ' + count/1000 + 'k');
+    console.time('benchmark');
+    
+    while(count--){
+        timeSafeCompare(random(), random());
+    }
+    console.timeEnd('benchmark');
+}
+
+run(100000);
+
+module.exports = run;
diff --git a/node_modules/tsscmp/test/unit/index.js b/node_modules/tsscmp/test/unit/index.js
new file mode 100644
index 0000000..0335423
--- /dev/null
+++ b/node_modules/tsscmp/test/unit/index.js
@@ -0,0 +1,69 @@
+'use strict';
+
+var assert = require('assert');
+var timeSafeCompare = require('../../lib/index');
+
+process.on('error', function (e) {
+	console.log('caught: ' + e);
+});
+
+function testEqual(a, b) {
+	assert(timeSafeCompare(a, b));
+
+	// lets also do a parity check with the strict equal to operator
+	assert(a === b);
+}
+
+function testNotEqual(a, b) {
+	assert(!timeSafeCompare(a, b));
+
+	// lets also do a parity check with the strict not equal to operator
+	assert(a !== b);
+}
+
+// note: lets also make sure tsscmp can be inline replaced for any types -
+// just incase if anyone is interested
+
+// positive tests
+testEqual('127e6fbfe24a750e72930c220a8e138275656b8e5d8f48a98c3c92df2caba935',
+	'127e6fbfe24a750e72930c220a8e138275656b8e5d8f48a98c3c92df2caba935',
+	'test ');
+testEqual('a', 'a');
+testEqual('', '');
+testEqual(undefined, undefined);
+testEqual(true, true);
+testEqual(false, false);
+(function () {
+	var a = { a: 1 };
+	testEqual(a, a);
+})();
+(function () {
+	function f1() { return 1; };
+	testEqual(f1, f1);
+})();
+
+// negative tests
+testNotEqual('');
+testNotEqual('a', 'b');
+testNotEqual('a', 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');
+testNotEqual('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', 'a');
+testNotEqual('alpha', 'beta');
+testNotEqual(false, true);
+testNotEqual(false, undefined);
+testNotEqual(function () { }, function () { });
+testNotEqual({}, {});
+testNotEqual({ a: 1 }, { a: 1 });
+testNotEqual({ a: 1 }, { a: 2 });
+testNotEqual([1, 2], [1, 2]);
+testNotEqual([1, 2], [1, 2, 3]);
+(function () {
+	var a = { p: 1 };
+	var b = { p: 1 };
+	testNotEqual(a, b);
+})();
+(function () {
+	function f1() { return 1; };
+	function f2() { return 1; };
+	testNotEqual(f1, f2);
+})();
+console.log('Success: all tests complete.');