5 files changed, 491 insertions, 0 deletions
diff --git a/node_modules/csrf/HISTORY.md b/node_modules/csrf/HISTORY.md
new file mode 100644
index 0000000..cbccedf
--- /dev/null
+++ b/node_modules/csrf/HISTORY.md
@@ -0,0 +1,86 @@
+3.0.3 / 2016-05-26
+==================
+
+  * deps: tsscmp@1.0.5
+
+3.0.2 / 2016-05-22
+==================
+
+  * Use `tsscmp` module for timing-safe token verification
+  * deps: base64-url@1.2.2
+  * deps: uid-safe@2.1.1
+    - deps: base64-url@1.2.2
+
+3.0.1 / 2016-01-28
+==================
+
+  * deps: rndm@1.2.0
+  * deps: uid-safe@2.1.0
+    - Use `random-bytes` for byte source
+
+3.0.0 / 2015-05-09
+==================
+
+  * Remove `tokenize` export
+  * Remove `tokenize` option
+  * Return a prototype-based object rather than functions
+    - This means the resulting functions need to be called as methods
+  * Throw when missing secret to `tokens.create()`
+  * deps: uid-safe@~2.0.0
+    - Use global `Promise` when returning a promise
+
+2.0.7 / 2015-05-03
+==================
+
+  * Fix compatibility with `crypto.DEFAULT_ENCODING` global changes
+
+2.0.6 / 2015-02-13
+==================
+
+  * deps: base64-url@1.2.1
+  * deps: uid-safe@~1.1.0
+    - Use `crypto.randomBytes`, if available
+    - deps: base64-url@1.2.1
+
+2.0.5 / 2015-01-31
+==================
+
+  * deps: base64-url@1.2.0
+  * deps: uid-safe@~1.0.3
+    - Fix error branch that would throw
+    - deps: base64-url@1.2.0
+
+2.0.4 / 2015-01-08
+==================
+
+  * deps: uid-safe@~1.0.2
+    - Remove dependency on `mz`
+
+2.0.3 / 2014-12-30
+==================
+
+  * Slight speed improvement for `verify`
+  * deps: base64-url@1.1.0
+  * deps: rndm@~1.1.0
+
+2.0.2 / 2014-11-09
+==================
+
+  * deps: scmp@1.0.0
+
+2.0.1 / 2014-08-22
+==================
+
+  * Rename module to `csrf`
+
+2.0.0 / 2014-06-18
+==================
+
+  * Use `uid-safe` module
+  * Use `base64-url` module
+  * Remove sync `.secret()` -- use `.secretSync()` instead
+
+1.0.4 / 2014-06-11
+==================
+
+  * Make sure CSRF tokens are URL safe
diff --git a/node_modules/csrf/LICENSE b/node_modules/csrf/LICENSE
new file mode 100644
index 0000000..6b774b4
--- /dev/null
+++ b/node_modules/csrf/LICENSE
@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>
+Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/node_modules/csrf/README.md b/node_modules/csrf/README.md
new file mode 100644
index 0000000..537a02a
--- /dev/null
+++ b/node_modules/csrf/README.md
@@ -0,0 +1,126 @@
+# CSRF
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Node.js Version][node-image]][node-url]
+[![Build Status][travis-image]][travis-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
+Logic behind CSRF token creation and verification.
+
+Read [Understanding-CSRF](https://github.com/pillarjs/understanding-csrf)
+for more information on CSRF. Use this module to create custom CSRF middleware.
+
+Looking for a CSRF framework for your favorite framework that uses this
+module?
+
+  * Express/connect: [csurf](https://www.npmjs.com/package/csurf) or
+    [alt-xsrf](https://www.npmjs.com/package/alt-xsrf)
+  * Koa: [koa-csrf](https://www.npmjs.com/package/koa-csrf) or
+    [koa-atomic-session](https://www.npmjs.com/package/koa-atomic-session)
+
+### Install
+
+```bash
+$ npm install csrf
+```
+
+## API
+
+```js
+var Tokens = require('csrf')
+```
+
+### new Tokens([options])
+
+Create a new token generation/verification instance. The `options` argument is
+optional and will just use all defaults if missing.
+
+#### Options
+
+Tokens accepts these properties in the options object.
+
+##### saltLength
+
+The length of the internal salt to use, in characters. Internally, the salt
+is a base 62 string. Defaults to `8` characters.
+
+##### secretLength
+
+The length of the secret to generate, in bytes. Note that the secret is
+passed around base-64 encoded and that this length refers to the underlying
+bytes, not the length of the base-64 string. Defaults to `18` bytes.
+
+#### tokens.create(secret)
+
+Create a new CSRF token attached to the given `secret`. The `secret` is a
+string, typically generated from the `tokens.secret()` or `tokens.secretSync()`
+methods. This token is what you should add into HTML `<form>` blocks and
+expect the user's browser to provide back.
+
+```js
+var secret = tokens.secretSync()
+var token = tokens.create(secret)
+```
+
+#### tokens.secret(callback)
+
+Asynchronously create a new `secret`, which is a string. The secret is to
+be kept on the server, typically stored in a server-side session for the
+user. The secret should be at least per user.
+
+```js
+tokens.secret(function (err, secret) {
+  if (err) throw err
+  // do something with the secret
+})
+```
+
+#### tokens.secret()
+
+Asynchronously create a new `secret` and return a `Promise`. Please see
+`tokens.secret(callback)` documentation for full details.
+
+**Note**: To use promises in Node.js _prior to 0.12_, promises must be
+"polyfilled" using `global.Promise = require('bluebird')`.
+
+```js
+tokens.secret().then(function (secret) {
+  // do something with the secret
+})
+```
+
+#### tokens.secretSync()
+
+A synchronous version of `tokens.secret(callback)`. Please see
+`tokens.secret(callback)` documentation for full details.
+
+```js
+var secret = tokens.secretSync()
+```
+
+#### tokens.verify(secret, token)
+
+Check whether a CSRF token is valid for the given `secret`, returning
+a Boolean.
+
+```js
+if (!tokens.verify(secret, token)) {
+  throw new Error('invalid token!')
+}
+```
+
+## License
+
+[MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/csrf.svg
+[npm-url]: https://npmjs.org/package/csrf
+[node-image]: https://img.shields.io/node/v/csrf.svg
+[node-url]: https://nodejs.org/en/download/
+[travis-image]: https://img.shields.io/travis/pillarjs/csrf/master.svg
+[travis-url]: https://travis-ci.org/pillarjs/csrf
+[coveralls-image]: https://img.shields.io/coveralls/pillarjs/csrf/master.svg
+[coveralls-url]: https://coveralls.io/r/pillarjs/csrf?branch=master
+[downloads-image]: https://img.shields.io/npm/dm/csrf.svg
+[downloads-url]: https://npmjs.org/package/csrf
diff --git a/node_modules/csrf/index.js b/node_modules/csrf/index.js
new file mode 100644
index 0000000..9b252cd
--- /dev/null
+++ b/node_modules/csrf/index.js
@@ -0,0 +1,139 @@
+/*!
+ * csrf
+ * Copyright(c) 2014 Jonathan Ong
+ * Copyright(c) 2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict'
+
+/**
+ * Module dependencies.
+ * @private
+ */
+
+var rndm = require('rndm')
+var uid = require('uid-safe')
+var compare = require('tsscmp')
+var crypto = require('crypto')
+var escape = require('base64-url').escape
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = Tokens
+
+/**
+ * Token generation/verification class.
+ *
+ * @param {object} [options]
+ * @param {number} [options.saltLength=8] The string length of the salt
+ * @param {number} [options.secretLength=18] The byte length of the secret key
+ * @public
+ */
+
+function Tokens (options) {
+  if (!(this instanceof Tokens)) {
+    return new Tokens(options)
+  }
+
+  var opts = options || {}
+
+  var saltLength = opts.saltLength !== undefined
+    ? opts.saltLength
+    : 8
+
+  if (typeof saltLength !== 'number' || !isFinite(saltLength) || saltLength < 1) {
+    throw new TypeError('option saltLength must be finite number > 1')
+  }
+
+  var secretLength = opts.secretLength !== undefined
+    ? opts.secretLength
+    : 18
+
+  if (typeof secretLength !== 'number' || !isFinite(secretLength) || secretLength < 1) {
+    throw new TypeError('option secretLength must be finite number > 1')
+  }
+
+  this.saltLength = saltLength
+  this.secretLength = secretLength
+}
+
+/**
+ * Create a new CSRF token.
+ *
+ * @param {string} secret The secret for the token.
+ * @public
+ */
+
+Tokens.prototype.create = function create (secret) {
+  if (!secret || typeof secret !== 'string') {
+    throw new TypeError('argument secret is required')
+  }
+
+  return this._tokenize(secret, rndm(this.saltLength))
+}
+
+/**
+ * Create a new secret key.
+ *
+ * @param {function} [callback]
+ * @public
+ */
+
+Tokens.prototype.secret = function secret (callback) {
+  return uid(this.secretLength, callback)
+}
+
+/**
+ * Create a new secret key synchronously.
+ * @public
+ */
+
+Tokens.prototype.secretSync = function secretSync () {
+  return uid.sync(this.secretLength)
+}
+
+/**
+ * Tokenize a secret and salt.
+ * @private
+ */
+
+Tokens.prototype._tokenize = function tokenize (secret, salt) {
+  var hash = crypto
+    .createHash('sha1')
+    .update(salt + '-' + secret, 'ascii')
+    .digest('base64')
+  return escape(salt + '-' + hash)
+}
+
+/**
+ * Verify if a given token is valid for a given secret.
+ *
+ * @param {string} secret
+ * @param {string} token
+ * @public
+ */
+
+Tokens.prototype.verify = function verify (secret, token) {
+  if (!secret || typeof secret !== 'string') {
+    return false
+  }
+
+  if (!token || typeof token !== 'string') {
+    return false
+  }
+
+  var index = token.indexOf('-')
+
+  if (index === -1) {
+    return false
+  }
+
+  var salt = token.substr(0, index)
+  var expected = this._tokenize(secret, salt)
+
+  return compare(token, expected)
+}
diff --git a/node_modules/csrf/package.json b/node_modules/csrf/package.json
new file mode 100644
index 0000000..cec4192
--- /dev/null
+++ b/node_modules/csrf/package.json
@@ -0,0 +1,118 @@
+{
+  "_args": [
+    [
+      "csrf@~3.0.3",
+      "/home/humair/School/csc309/a4/solutions_repo/node_modules/csurf"
+    ]
+  ],
+  "_from": "csrf@>=3.0.3 <3.1.0",
+  "_id": "csrf@3.0.3",
+  "_inCache": true,
+  "_installable": true,
+  "_location": "/csrf",
+  "_npmOperationalInternal": {
+    "host": "packages-12-west.internal.npmjs.com",
+    "tmp": "tmp/csrf-3.0.3.tgz_1464315403837_0.44625049154274166"
+  },
+  "_npmUser": {
+    "email": "doug@somethingdoug.com",
+    "name": "dougwilson"
+  },
+  "_npmVersion": "1.4.28",
+  "_phantomChildren": {},
+  "_requested": {
+    "name": "csrf",
+    "raw": "csrf@~3.0.3",
+    "rawSpec": "~3.0.3",
+    "scope": null,
+    "spec": ">=3.0.3 <3.1.0",
+    "type": "range"
+  },
+  "_requiredBy": [
+    "/csurf"
+  ],
+  "_resolved": "https://registry.npmjs.org/csrf/-/csrf-3.0.3.tgz",
+  "_shasum": "69d13220de95762808bb120f7533a994fc4293b5",
+  "_shrinkwrap": null,
+  "_spec": "csrf@~3.0.3",
+  "_where": "/home/humair/School/csc309/a4/solutions_repo/node_modules/csurf",
+  "author": {
+    "email": "me@jongleberry.com",
+    "name": "Jonathan Ong",
+    "url": "http://jongleberry.com"
+  },
+  "bugs": {
+    "url": "https://github.com/pillarjs/csrf/issues"
+  },
+  "contributors": [
+    {
+      "name": "Douglas Christopher Wilson",
+      "email": "doug@somethingdoug.com"
+    }
+  ],
+  "dependencies": {
+    "base64-url": "1.2.2",
+    "rndm": "1.2.0",
+    "tsscmp": "1.0.5",
+    "uid-safe": "2.1.1"
+  },
+  "description": "primary logic behind csrf tokens",
+  "devDependencies": {
+    "bluebird": "3.4.0",
+    "eslint": "2.10.2",
+    "eslint-config-standard": "5.3.1",
+    "eslint-plugin-promise": "1.3.0",
+    "eslint-plugin-standard": "1.3.2",
+    "istanbul": "0.4.3",
+    "mocha": "2.5.3"
+  },
+  "directories": {},
+  "dist": {
+    "shasum": "69d13220de95762808bb120f7533a994fc4293b5",
+    "tarball": "https://registry.npmjs.org/csrf/-/csrf-3.0.3.tgz"
+  },
+  "engines": {
+    "node": ">= 0.8"
+  },
+  "files": [
+    "HISTORY.md",
+    "LICENSE",
+    "README.md",
+    "index.js"
+  ],
+  "gitHead": "dbf7629bbff7ae14dfa7fab1b439e01b5ba3b629",
+  "homepage": "https://github.com/pillarjs/csrf",
+  "keywords": [
+    "csrf",
+    "tokens"
+  ],
+  "license": "MIT",
+  "maintainers": [
+    {
+      "name": "dougwilson",
+      "email": "doug@somethingdoug.com"
+    },
+    {
+      "name": "dwolla",
+      "email": "api@dwolla.com"
+    },
+    {
+      "name": "jongleberry",
+      "email": "jonathanrichardong@gmail.com"
+    }
+  ],
+  "name": "csrf",
+  "optionalDependencies": {},
+  "readme": "ERROR: No README data found!",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pillarjs/csrf.git"
+  },
+  "scripts": {
+    "lint": "eslint **/*.js",
+    "test": "mocha --trace-deprecation --reporter spec --bail --check-leaks test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --trace-deprecation --reporter dot --check-leaks test/",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --trace-deprecation --reporter spec --check-leaks test/"
+  },
+  "version": "3.0.3"
+}