coapjs / node-coap / 31588574437

88%

push

github

feat: Native OSCORE (RFC 8613) Integration (#397)

* feat: adding support for OSCORE

* fix: node-oscore from npm

* feat: track OSCORE decode proof on client responses

* fix: OSCORE security hardening — Echo encryption, token isolation, error handling

- Drop plaintext messages when OSCORE context exists (no fallback)
- Limit Echo auto-retry to 1 attempt to prevent infinite loops
- Carry over options and payload on Echo retry
- OSCORE-encrypt Echo 4.01 challenges (not plaintext)
- Store and verify Echo nonces with timingSafeEqual
- Namespace token-to-context bindings by senderId to prevent collisions
- Cap token bindings at 10k with LRU eviction
- Validate OSCORE option parsing (reject truncated fields)
- Standardize error messages to prevent information leakage
- Fix _sendError missing address parameter
- Use 'close' event for observe token cleanup

* fix(deps): bump oscore module

* chore: allow to use from fork

* chore: bump version

* fix: normalizing address

* refactor: replace onSsnChange with standard EventEmitter pattern

* feat: support per-instance CoAP parameters for Server and Agent

Each Server and Agent now snapshots its own frozen parameters at
construction time via the new `parameters` option, allowing multiple
instances with different timing/size configs without mutating the global.

* refactor: deduplicate timing derivation in parameters.ts

Extract applyOverrides() and deriveTimings() helpers so refreshTiming()
and createParameters() share a single implementation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: correctly parse Block1 option SZX for segmented transmission

Extract SZX via parseBlockOption instead of passing raw block1 byte,
and only re-segment when payload exceeds one block size.

* fix: address PR #397 review comments

- Make _parameters field private in Agent and RetrySend classes
- Remove unnecessary leading semicolons before type assertions
- Fix error message to omit colon when ... (continued)

641 of 763 branches covered (84.01%)

Branch coverage included in aggregate %.

716 of 899 new or added lines in 12 files covered. (79.64%)

3447 of 3895 relevant lines covered (88.5%)

6550.16 hits per line