Secure Your Hono API: JWT Auth, Rate Limiting & RBAC

1{
2  "name": "hono-cloudflare-workers-starter",
3  "version": "2.0.0",
4  "type": "module",
5  "scripts": {
6    "dev": "wrangler dev",
7    "deploy": "wrangler deploy",
8    "db:create": "wrangler d1 create my-database",
9    "db:migrate:local": "npm run db:migrate:local:posts && npm run db:migrate:local:auth",
10    "db:migrate:local:posts": "wrangler d1 execute my-database --local --file=./migrations/0001_create_posts.sql",
11    "db:migrate:local:auth": "wrangler d1 execute my-database --local --file=./migrations/0002_create_auth_tables.sql",
12    "db:migrate:remote": "npm run db:migrate:remote:posts && npm run db:migrate:remote:auth",
13    "db:migrate:remote:posts": "wrangler d1 execute my-database --remote --file=./migrations/0001_create_posts.sql",
14    "db:migrate:remote:auth": "wrangler d1 execute my-database --remote --file=./migrations/0002_create_auth_tables.sql",
15    "secret:jwt": "wrangler secret put JWT_SECRET",
16    "test": "vitest run",
17    "test:watch": "vitest",
18    "typecheck": "tsc --noEmit",
19    "logs": "wrangler tail"
20  },
21  "dependencies": {
22    "@hono/zod-validator": "^0.4.2",
23    "hono": "^4.7.0",
24    "zod": "^3.24.1"
25  },
26  "devDependencies": {
27    "@cloudflare/vitest-pool-workers": "^0.8.0",
28    "@cloudflare/workers-types": "^4.20250109.0",
29    "typescript": "^5.7.3",
30    "vitest": "^3.0.2",
31    "wrangler": "^4.58.0"
32  }
33}

1{
2  "compilerOptions": {
3    "target": "ESNext",
4    "module": "ESNext",
5    "moduleResolution": "Bundler",
6    "strict": true,
7    "skipLibCheck": true,
8    "lib": ["ESNext"],
9    "types": [
10      "@cloudflare/workers-types",
11      "@cloudflare/vitest-pool-workers",
12      "vitest/globals"
13    ],
14    "jsx": "react-jsx",
15    "jsxImportSource": "hono/jsx",
16    "noEmit": true,
17    "isolatedModules": true,
18    "allowSyntheticDefaultImports": true,
19    "forceConsistentCasingInFileNames": true
20  },
21  "include": ["src/**/*", "tests/**/*"],
22  "exclude": ["node_modules"]
23}

1-- migrations/0002_create_auth_tables.sql
2
3-- Users table
4CREATE TABLE IF NOT EXISTS users (
5  id TEXT PRIMARY KEY,
6  email TEXT UNIQUE NOT NULL,
7  password_hash TEXT NOT NULL,
8  role TEXT NOT NULL DEFAULT 'user',
9  is_active INTEGER DEFAULT 1,
10  created_at TEXT DEFAULT CURRENT_TIMESTAMP,
11  updated_at TEXT DEFAULT CURRENT_TIMESTAMP
12);
13
14-- Refresh tokens for JWT rotation
15CREATE TABLE IF NOT EXISTS refresh_tokens (
16  id TEXT PRIMARY KEY,
17  user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
18  token_hash TEXT UNIQUE NOT NULL,
19  family_id TEXT NOT NULL,
20  expires_at TEXT NOT NULL,
21  created_at TEXT DEFAULT CURRENT_TIMESTAMP,
22  revoked_at TEXT DEFAULT NULL
23);
24
25-- API keys for server-to-server auth
26CREATE TABLE IF NOT EXISTS api_keys (
27  id TEXT PRIMARY KEY,
28  user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
29  key_prefix TEXT NOT NULL,
30  key_hash TEXT UNIQUE NOT NULL,
31  name TEXT NOT NULL,
32  scopes TEXT NOT NULL DEFAULT '[]',
33  rate_limit INTEGER DEFAULT 1000,
34  last_used_at TEXT DEFAULT NULL,
35  expires_at TEXT DEFAULT NULL,
36  created_at TEXT DEFAULT CURRENT_TIMESTAMP,
37  revoked_at TEXT DEFAULT NULL
38);
39
40-- Roles for RBAC
41CREATE TABLE IF NOT EXISTS roles (
42  id TEXT PRIMARY KEY,
43  name TEXT UNIQUE NOT NULL,
44  description TEXT,
45  created_at TEXT DEFAULT CURRENT_TIMESTAMP
46);
47
48-- Permissions for RBAC
49CREATE TABLE IF NOT EXISTS permissions (
50  id TEXT PRIMARY KEY,
51  name TEXT UNIQUE NOT NULL,
52  resource TEXT NOT NULL,
53  action TEXT NOT NULL,
54  created_at TEXT DEFAULT CURRENT_TIMESTAMP
55);
56
57-- Role-permission junction
58CREATE TABLE IF NOT EXISTS role_permissions (
59  role_id TEXT NOT NULL REFERENCES roles(id) ON DELETE CASCADE,
60  permission_id TEXT NOT NULL REFERENCES permissions(id) ON DELETE CASCADE,
61  PRIMARY KEY (role_id, permission_id)
62);
63
64-- Audit logs
65CREATE TABLE IF NOT EXISTS audit_logs (
66  id TEXT PRIMARY KEY,
67  user_id TEXT REFERENCES users(id) ON DELETE SET NULL,
68  action TEXT NOT NULL,
69  resource TEXT NOT NULL,
70  resource_id TEXT,
71  ip_address TEXT,
72  user_agent TEXT,
73  metadata TEXT DEFAULT '{}',
74  created_at TEXT DEFAULT CURRENT_TIMESTAMP
75);
76
77-- Create indexes
78CREATE INDEX IF NOT EXISTS idx_users_email ON users(email);
79CREATE INDEX IF NOT EXISTS idx_refresh_tokens_user ON refresh_tokens(user_id);
80CREATE INDEX IF NOT EXISTS idx_api_keys_prefix ON api_keys(key_prefix);
81CREATE INDEX IF NOT EXISTS idx_audit_logs_user ON audit_logs(user_id);
82CREATE INDEX IF NOT EXISTS idx_audit_logs_created ON audit_logs(created_at DESC);
83
84-- Seed default roles and permissions
85INSERT OR IGNORE INTO roles (id, name, description) VALUES
86  ('role_admin', 'admin', 'Full administrative access'),
87  ('role_editor', 'editor', 'Can create and edit content'),
88  ('role_viewer', 'viewer', 'Read-only access');
89
90INSERT OR IGNORE INTO permissions (id, name, resource, action) VALUES
91  ('perm_posts_create', 'posts:create', 'posts', 'create'),
92  ('perm_posts_read', 'posts:read', 'posts', 'read'),
93  ('perm_posts_update', 'posts:update', 'posts', 'update'),
94  ('perm_posts_delete', 'posts:delete', 'posts', 'delete');

1// src/types/bindings.ts
2export type Bindings = {
3  DB: D1Database;
4  JWT_SECRET: string;
5  RATE_LIMITER?: {
6    limit: (options: { key: string }) => Promise<{ success: boolean }>;
7  };
8  RATE_LIMIT_KV?: KVNamespace;
9};
10
11export type Variables = {
12  requestId: string;
13  userId?: string;
14  userEmail?: string;
15  userRole?: string;
16  apiKeyId?: string;
17  apiKeyScopes?: string[];
18};
19
20export type AppEnv = {
21  Bindings: Bindings;
22  Variables: Variables;
23};

1// src/middleware/jwt-auth.ts
2import { createMiddleware } from 'hono/factory';
3import { sign, verify } from 'hono/jwt';
4import { HTTPException } from 'hono/http-exception';
5import type { AppEnv } from '../types/bindings';
6
7export const JWT_CONFIG = {
8  accessTokenExpiry: 15 * 60, // 15 minutes
9  refreshTokenExpiry: 7 * 24 * 60 * 60, // 7 days
10  algorithm: 'HS256' as const,
11};
12
13export interface JWTPayload {
14  sub: string;
15  email: string;
16  role: string;
17  type: 'access' | 'refresh';
18  iat: number;
19  exp: number;
20  [key: string]: unknown;
21}
22
23export async function generateAccessToken(
24  user: { id: string; email: string; role: string },
25  secret: string
26): Promise<string> {
27  const now = Math.floor(Date.now() / 1000);
28  return sign({
29    sub: user.id,
30    email: user.email,
31    role: user.role,
32    type: 'access',
33    iat: now,
34    exp: now + JWT_CONFIG.accessTokenExpiry,
35  }, secret, JWT_CONFIG.algorithm);
36}
37
38export async function hashToken(token: string): Promise<string> {
39  const encoder = new TextEncoder();
40  const data = encoder.encode(token);
41  const hashBuffer = await crypto.subtle.digest('SHA-256', data);
42  const hashArray = Array.from(new Uint8Array(hashBuffer));
43  return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
44}
45
46export function jwtAuth() {
47  return createMiddleware<AppEnv>(async (c, next) => {
48    const authHeader = c.req.header('Authorization');
49
50    if (!authHeader?.startsWith('Bearer ')) {
51      throw new HTTPException(401, {
52        message: 'Missing or invalid Authorization header',
53      });
54    }
55
56    const token = authHeader.slice(7);
57    const secret = c.env.JWT_SECRET;
58
59    if (!secret) {
60      throw new HTTPException(500, { message: 'Server configuration error' });
61    }
62
63    try {
64      const payload = await verify(token, secret, JWT_CONFIG.algorithm) as unknown as JWTPayload;
65
66      if (payload.type !== 'access') {
67        throw new HTTPException(401, { message: 'Invalid token type' });
68      }
69
70      c.set('userId', payload.sub);
71      c.set('userEmail', payload.email);
72      c.set('userRole', payload.role);
73
74      await next();
75    } catch (error) {
76      if (error instanceof HTTPException) throw error;
77      throw new HTTPException(401, { message: 'Invalid or expired token' });
78    }
79  });
80}

1// src/middleware/api-key-auth.ts
2import { createMiddleware } from 'hono/factory';
3import { HTTPException } from 'hono/http-exception';
4import type { AppEnv } from '../types/bindings';
5
6export const API_KEY_PREFIX = {
7  secretLive: 'sk_live_',
8  secretTest: 'sk_test_',
9};
10
11export async function generateApiKey(
12  type: 'secret' = 'secret',
13  isLive: boolean = true
14): Promise<{ key: string; prefix: string }> {
15  const prefix = isLive ? API_KEY_PREFIX.secretLive : API_KEY_PREFIX.secretTest;
16  const randomBytes = new Uint8Array(32);
17  crypto.getRandomValues(randomBytes);
18  const randomPart = btoa(String.fromCharCode(...randomBytes))
19    .replace(/\+/g, '-')
20    .replace(/\//g, '_')
21    .replace(/=/g, '');
22  return { key: `${prefix}${randomPart}`, prefix };
23}
24
25export async function hashApiKey(key: string): Promise<string> {
26  const encoder = new TextEncoder();
27  const data = encoder.encode(key);
28  const hashBuffer = await crypto.subtle.digest('SHA-256', data);
29  const hashArray = Array.from(new Uint8Array(hashBuffer));
30  return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
31}
32
33export function apiKeyAuth(options?: { scopes?: string[] }) {
34  return createMiddleware<AppEnv>(async (c, next) => {
35    const apiKey = c.req.header('X-API-Key');
36
37    if (!apiKey) {
38      throw new HTTPException(401, { message: 'Missing X-API-Key header' });
39    }
40
41    const keyHash = await hashApiKey(apiKey);
42    const keyRecord = await c.env.DB.prepare(`
43      SELECT ak.*, u.id as user_id, u.email, u.role, u.is_active
44      FROM api_keys ak
45      JOIN users u ON ak.user_id = u.id
46      WHERE ak.key_hash = ?
47        AND ak.revoked_at IS NULL
48        AND (ak.expires_at IS NULL OR ak.expires_at > datetime('now'))
49    `).bind(keyHash).first();
50
51    if (!keyRecord) {
52      throw new HTTPException(401, { message: 'Invalid or expired API key' });
53    }
54
55    if (!keyRecord.is_active) {
56      throw new HTTPException(403, { message: 'User account is disabled' });
57    }
58
59    // Check scopes
60    if (options?.scopes?.length) {
61      const keyScopes: string[] = JSON.parse(keyRecord.scopes as string || '[]');
62      const hasAllScopes = options.scopes.every(s => keyScopes.includes(s));
63      if (!hasAllScopes) {
64        throw new HTTPException(403, { message: 'Insufficient API key permissions' });
65      }
66    }
67
68    // Update last used (non-blocking)
69    c.executionCtx.waitUntil(
70      c.env.DB.prepare("UPDATE api_keys SET last_used_at = datetime('now') WHERE id = ?")
71        .bind(keyRecord.id)
72        .run()
73    );
74
75    c.set('userId', keyRecord.user_id as string);
76    c.set('userEmail', keyRecord.email as string);
77    c.set('userRole', keyRecord.role as string);
78    c.set('apiKeyId', keyRecord.id as string);
79    c.set('apiKeyScopes', JSON.parse(keyRecord.scopes as string || '[]'));
80
81    await next();
82  });
83}

1// src/middleware/rate-limiter.ts
2import { createMiddleware } from 'hono/factory';
3import { HTTPException } from 'hono/http-exception';
4import type { AppEnv } from '../types/bindings';
5
6export const RATE_LIMIT_CONFIG = {
7  anonymous: { limit: 60, period: 60 },
8  authenticated: { limit: 1000, period: 60 },
9  auth: { limit: 5, period: 60 }, // Strict for login attempts
10};
11
12export function rateLimiter(options?: { limit?: number; period?: 10 | 60 }) {
13  return createMiddleware<AppEnv>(async (c, next) => {
14    const clientId = c.get('userId') || c.req.header('CF-Connecting-IP') || 'anonymous';
15    const isAuthenticated = !!c.get('userId');
16
17    const config = isAuthenticated
18      ? RATE_LIMIT_CONFIG.authenticated
19      : RATE_LIMIT_CONFIG.anonymous;
20
21    const limit = options?.limit ?? config.limit;
22    const rateLimiter = c.env.RATE_LIMITER;
23
24    if (!rateLimiter) {
25      // Rate limiting not configured - allow request
26      await next();
27      return;
28    }
29
30    try {
31      const key = `${clientId}:${c.req.path}`;
32      const { success } = await rateLimiter.limit({ key });
33
34      if (!success) {
35        throw new HTTPException(429, {
36          message: 'Too many requests. Please try again later.',
37        });
38      }
39
40      c.header('X-RateLimit-Limit', limit.toString());
41      await next();
42    } catch (error) {
43      if (error instanceof HTTPException) throw error;
44      await next();
45    }
46  });
47}
48
49export function strictRateLimiter() {
50  return rateLimiter({
51    limit: RATE_LIMIT_CONFIG.auth.limit,
52    period: RATE_LIMIT_CONFIG.auth.period as 10 | 60,
53  });
54}

1// src/middleware/rbac.ts
2import { createMiddleware } from 'hono/factory';
3import { HTTPException } from 'hono/http-exception';
4import type { AppEnv } from '../types/bindings';
5
6export const ROLE_HIERARCHY: Record<string, string[]> = {
7  admin: ['editor', 'viewer', 'user'],
8  editor: ['viewer', 'user'],
9  viewer: ['user'],
10  user: [],
11};
12
13export function roleHasPermission(userRole: string, requiredRole: string): boolean {
14  if (userRole === requiredRole) return true;
15  const inherited = ROLE_HIERARCHY[userRole] || [];
16  return inherited.includes(requiredRole);
17}
18
19export function requireRole(role: string | string[]) {
20  const roles = Array.isArray(role) ? role : [role];
21
22  return createMiddleware<AppEnv>(async (c, next) => {
23    const userRole = c.get('userRole');
24
25    if (!userRole) {
26      throw new HTTPException(401, { message: 'Authentication required' });
27    }
28
29    const hasRole = roles.some(r => roleHasPermission(userRole, r));
30
31    if (!hasRole) {
32      throw new HTTPException(403, {
33        message: `Access denied. Required role: ${roles.join(' or ')}`,
34      });
35    }
36
37    await next();
38  });
39}
40
41export function requirePermission(permission: string | string[]) {
42  const permissions = Array.isArray(permission) ? permission : [permission];
43
44  return createMiddleware<AppEnv>(async (c, next) => {
45    const userId = c.get('userId');
46    const userRole = c.get('userRole');
47
48    if (!userId || !userRole) {
49      throw new HTTPException(401, { message: 'Authentication required' });
50    }
51
52    // Check API key scopes first
53    const apiKeyScopes = c.get('apiKeyScopes');
54    if (apiKeyScopes?.every(p => permissions.includes(p))) {
55      await next();
56      return;
57    }
58
59    // Query user permissions from database
60    const { results } = await c.env.DB.prepare(`
61      SELECT DISTINCT p.name
62      FROM permissions p
63      JOIN role_permissions rp ON p.id = rp.permission_id
64      JOIN roles r ON rp.role_id = r.id
65      WHERE r.name = ?
66    `).bind(userRole).all();
67
68    const userPermissions = (results || []).map(r => r.name as string);
69    const hasPermission = permissions.every(p => userPermissions.includes(p));
70
71    if (!hasPermission) {
72      throw new HTTPException(403, {
73        message: `Access denied. Required permission: ${permissions.join(', ')}`,
74      });
75    }
76
77    await next();
78  });
79}
80
81export const adminOnly = () => requireRole('admin');
82export const editorOrAbove = () => requireRole(['admin', 'editor']);

1// src/middleware/audit-logger.ts
2import { createMiddleware } from 'hono/factory';
3import type { Context } from 'hono';
4import type { AppEnv } from '../types/bindings';
5
6const SENSITIVE_FIELDS = ['password', 'token', 'secret', 'authorization'];
7
8function redactSensitiveData(data: Record<string, unknown>): Record<string, unknown> {
9  const redacted: Record<string, unknown> = {};
10  for (const [key, value] of Object.entries(data)) {
11    if (SENSITIVE_FIELDS.some(f => key.toLowerCase().includes(f))) {
12      redacted[key] = '[REDACTED]';
13    } else if (typeof value === 'object' && value !== null) {
14      redacted[key] = redactSensitiveData(value as Record<string, unknown>);
15    } else {
16      redacted[key] = value;
17    }
18  }
19  return redacted;
20}
21
22export async function logAudit(
23  c: Context<AppEnv>,
24  entry: {
25    userId: string | null;
26    action: string;
27    resource: string;
28    resourceId?: string;
29    ipAddress?: string;
30    userAgent?: string;
31    metadata?: Record<string, unknown>;
32  }
33): Promise<void> {
34  const db = c.env.DB;
35  const id = crypto.randomUUID();
36  const safeMetadata = entry.metadata ? redactSensitiveData(entry.metadata) : {};
37
38  // Non-blocking write using waitUntil
39  c.executionCtx.waitUntil(
40    db.prepare(`
41      INSERT INTO audit_logs (id, user_id, action, resource, resource_id, ip_address, user_agent, metadata)
42      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
43    `).bind(
44      id,
45      entry.userId,
46      entry.action,
47      entry.resource,
48      entry.resourceId || null,
49      entry.ipAddress || null,
50      entry.userAgent || null,
51      JSON.stringify(safeMetadata)
52    ).run().catch(err => console.error('Audit log failed:', err))
53  );
54}
55
56export function auditLogger(options: { resource: string; action?: string }) {
57  const { resource, action } = options;
58
59  return createMiddleware<AppEnv>(async (c, next) => {
60    const startTime = Date.now();
61    await next();
62
63    const methodAction = action || {
64      GET: 'read',
65      POST: 'create',
66      PUT: 'update',
67      PATCH: 'update',
68      DELETE: 'delete',
69    }[c.req.method] || c.req.method.toLowerCase();
70
71    await logAudit(c, {
72      userId: c.get('userId') || null,
73      action: methodAction,
74      resource,
75      resourceId: c.req.param('id'),
76      ipAddress: c.req.header('CF-Connecting-IP'),
77      userAgent: c.req.header('User-Agent'),
78      metadata: {
79        method: c.req.method,
80        path: c.req.path,
81        status: c.res.status,
82        durationMs: Date.now() - startTime,
83      },
84    });
85  });
86}

1// src/middleware/error-handler.ts
2import type { Context } from "hono";
3import { HTTPException } from "hono/http-exception";
4
5export function errorHandler(err: Error, c: Context) {
6  console.error(`[Error] ${err.message}`, err.stack);
7
8  // Handle Hono HTTP exceptions
9  if (err instanceof HTTPException) {
10    return c.json({ error: err.message }, err.status);
11  }
12
13  // Handle Zod validation errors
14  if (err.name === "ZodError") {
15    return c.json({
16      error: "Validation failed",
17      details: (err as unknown as { issues: unknown[] }).issues,
18    }, 400);
19  }
20
21  // Handle D1 database errors
22  if (err.message?.includes("D1")) {
23    return c.json({ error: "Database error" }, 503);
24  }
25
26  // Generic error - don't leak details in production
27  return c.json({ error: "Internal server error" }, 500);
28}
29
30export function notFoundHandler(c: Context) {
31  return c.json({ error: "Not found", path: c.req.path }, 404);
32}

1// src/middleware/index.ts
2export { errorHandler, notFoundHandler } from "./error-handler";
3
4// Authentication
5export {
6  jwtAuth,
7  optionalJwtAuth,
8  generateAccessToken,
9  generateRefreshToken,
10  hashToken,
11  JWT_CONFIG,
12  type JWTPayload,
13} from "./jwt-auth";
14
15export {
16  apiKeyAuth,
17  combinedAuth,
18  generateApiKey,
19  hashApiKey,
20  extractKeyPrefix,
21  API_KEY_PREFIX,
22} from "./api-key-auth";
23
24// Rate Limiting
25export {
26  rateLimiter,
27  kvRateLimiter,
28  strictRateLimiter,
29  writeRateLimiter,
30  RATE_LIMIT_CONFIG,
31} from "./rate-limiter";
32
33// Authorization (RBAC)
34export {
35  requireRole,
36  requirePermission,
37  resourceOwner,
38  conditionalPermission,
39  adminOnly,
40  editorOrAbove,
41  roleHasPermission,
42  ROLE_HIERARCHY,
43} from "./rbac";
44
45// Audit Logging
46export {
47  auditLogger,
48  logAudit,
49  createAuditLogger,
50  queryAuditLogs,
51  getRequestMetadata,
52  AUDIT_ACTIONS,
53  type AuditLogEntry,
54} from "./audit-logger";

1// src/lib/password.ts
2const PBKDF2_ITERATIONS = 100000;
3const SALT_LENGTH = 16;
4const HASH_LENGTH = 256;
5
6export async function hashPassword(password: string): Promise<string> {
7  const encoder = new TextEncoder();
8  const salt = crypto.getRandomValues(new Uint8Array(SALT_LENGTH));
9
10  const keyMaterial = await crypto.subtle.importKey(
11    'raw',
12    encoder.encode(password),
13    'PBKDF2',
14    false,
15    ['deriveBits']
16  );
17
18  const hash = await crypto.subtle.deriveBits(
19    {
20      name: 'PBKDF2',
21      salt,
22      iterations: PBKDF2_ITERATIONS,
23      hash: 'SHA-256',
24    },
25    keyMaterial,
26    HASH_LENGTH
27  );
28
29  const combined = new Uint8Array(salt.length + new Uint8Array(hash).length);
30  combined.set(salt);
31  combined.set(new Uint8Array(hash), salt.length);
32
33  return btoa(String.fromCharCode(...combined));
34}
35
36export async function verifyPassword(
37  password: string,
38  storedHash: string
39): Promise<boolean> {
40  try {
41    const combined = Uint8Array.from(atob(storedHash), (c) => c.charCodeAt(0));
42    const salt = combined.slice(0, SALT_LENGTH);
43    const originalHash = combined.slice(SALT_LENGTH);
44
45    const encoder = new TextEncoder();
46    const keyMaterial = await crypto.subtle.importKey(
47      'raw',
48      encoder.encode(password),
49      'PBKDF2',
50      false,
51      ['deriveBits']
52    );
53
54    const hash = await crypto.subtle.deriveBits(
55      {
56        name: 'PBKDF2',
57        salt,
58        iterations: PBKDF2_ITERATIONS,
59        hash: 'SHA-256',
60      },
61      keyMaterial,
62      HASH_LENGTH
63    );
64
65    const newHash = new Uint8Array(hash);
66
67    // Constant-time comparison to prevent timing attacks
68    if (newHash.length !== originalHash.length) return false;
69
70    let result = 0;
71    for (let i = 0; i < newHash.length; i++) {
72      result |= newHash[i] ^ originalHash[i];
73    }
74
75    return result === 0;
76  } catch {
77    return false;
78  }
79}