passport-telegram-web-app/src/utils.ts

A [Passport](https://www.passportjs.org/) strategy for [telegram web app (bots)](https://core.telegram.org/bots/webapps) authentication.

import { enc, HmacSHA256 } from "crypto-js";

import { DataInterface } from "./interfaces/data.interface";
import { HashVerifierCallbackFunction } from "./types/hash-verifier-callback.function";

export class Utils {
  public static defaultDataToCheckString(data: DataInterface): string {
    return `auth_date=${data.authDate}\nquery_id=${data.queryId}\nuser=${JSON.stringify(data.user)}`;
  }

  public static defaultHashVerifier(
    token: string,
    dataCheckString: string,
    hash: string,
    callback: HashVerifierCallbackFunction,
  ): void | Promise<void> {
    const secret = HmacSHA256(token, "WebAppData");
    const signature = HmacSHA256(dataCheckString, secret);
    const hex = signature.toString(enc.Hex);

    if (hex !== hash) {
      return callback(new Error("Not valid"));
    }

    return callback(null);
  }
}