Security upgrades

node_modules/bcrypt/test/async.js

@@ -0,0 +1,181 @@
+var bcrypt = require('../bcrypt');
+
+module.exports = {
+    test_salt_length: function(assert) {
+        assert.expect(1);
+        bcrypt.genSalt(10, function(err, salt) {
+            assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
+            assert.done();
+        });
+    },
+    test_salt_only_cb: function(assert) {
+        assert.doesNotThrow(function() {bcrypt.genSalt(function(err, salt) {});}, "Should not throw an Error. Rounds and seed length are optional.");
+        assert.done();
+    },
+    test_salt_rounds_is_string_number: function(assert) {
+        bcrypt.genSalt('10', void 0, function (err, salt) {
+            assert.ok((err instanceof Error), "Should be an Error. genSalt requires round to be of type number.");
+            assert.done();
+        });
+    },
+    test_salt_rounds_is_string_non_number: function(assert) {
+        bcrypt.genSalt('z', function (err, salt) {
+            assert.ok((err instanceof Error), "Should throw an Error. genSalt requires rounds to of type number.");
+            assert.done();
+        });
+    },
+    test_salt_minor: function(assert) {
+        assert.expect(3);
+        bcrypt.genSalt(10, 'a', function(err, salt) {
+            assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
+            var split_salt = salt.split('$');
+            assert.strictEqual(split_salt[1], '2a');
+            assert.strictEqual(split_salt[2], '10');
+            assert.done();
+        });
+    },
+    test_salt_minor_b: function(assert) {
+        assert.expect(3);
+        bcrypt.genSalt(10, 'b', function(err, salt) {
+            assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
+            var split_salt = salt.split('$');
+            assert.strictEqual(split_salt[1], '2b');
+            assert.strictEqual(split_salt[2], '10');
+            assert.done();
+        });
+    },
+    test_hash: function(assert) {
+        assert.expect(1);
+        bcrypt.genSalt(10, function(err, salt) {
+            bcrypt.hash('password', salt, function(err, res) {
+                assert.ok(res, "Res should be defined.");
+                assert.done();
+            });
+        });
+    },
+    test_hash_rounds: function(assert) {
+        assert.expect(1);
+        bcrypt.hash('bacon', 8, function(err, hash) {
+          assert.strictEqual(bcrypt.getRounds(hash), 8, "Number of rounds should be that specified in the function call.");
+          assert.done();
+        });
+    },
+    test_hash_empty_strings: function(assert) {
+        assert.expect(2);
+        bcrypt.genSalt(10, function(err, salt) {
+            bcrypt.hash('', salt, function(err, res) {
+                assert.ok(res, "Res should be defined even with an empty pw.");
+                bcrypt.hash('', '', function(err, res) {
+                  if (err) {
+                    assert.ok(err);
+                  } else {
+                    assert.fail();
+                  }
+
+                  assert.done();
+                });
+            });
+        });
+    },
+    test_hash_no_params: function(assert) {
+        bcrypt.hash(function (err, hash) {
+            assert.ok(err, "Should be an error. No params.");
+            assert.done();
+        });
+    },
+    test_hash_one_param: function(assert) {
+        bcrypt.hash('password', function (err, hash) {
+            assert.ok(err, "Should be an Error. No salt.");
+            assert.done();
+        });
+    },
+    test_hash_salt_validity: function(assert) {
+        assert.expect(3);
+        bcrypt.hash('password', '$2a$10$somesaltyvaluertsetrse', function(err, enc) {
+            assert.strictEqual(err, undefined);
+            bcrypt.hash('password', 'some$value', function(err, enc) {
+                assert.notEqual(err, undefined);
+                assert.strictEqual(err.message, "Invalid salt. Salt must be in the form of: $Vers$log2(NumRounds)$saltvalue");
+                assert.done();
+            });
+        });
+    },
+    test_verify_salt: function(assert) {
+        assert.expect(2);
+        bcrypt.genSalt(10, function(err, salt) {
+            var split_salt = salt.split('$');
+            assert.strictEqual(split_salt[1], '2b');
+            assert.strictEqual(split_salt[2], '10');
+            assert.done();
+        });
+    },
+    test_verify_salt_min_rounds: function(assert) {
+        assert.expect(2);
+        bcrypt.genSalt(1, function(err, salt) {
+            var split_salt = salt.split('$');
+            assert.strictEqual(split_salt[1], '2b');
+            assert.strictEqual(split_salt[2], '04');
+            assert.done();
+        });
+    },
+    test_verify_salt_max_rounds: function(assert) {
+        assert.expect(2);
+        bcrypt.genSalt(100, function(err, salt) {
+            var split_salt = salt.split('$');
+            assert.strictEqual(split_salt[1], '2b');
+            assert.strictEqual(split_salt[2], '31');
+            assert.done();
+        });
+    },
+    test_hash_compare: function(assert) {
+        assert.expect(3);
+        bcrypt.genSalt(10, function(err, salt) {
+            assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
+            bcrypt.hash("test", salt, function(err, hash) {
+                bcrypt.compare("test", hash, function(err, res) {
+                    assert.strictEqual(res, true, "These hashes should be equal.");
+                    bcrypt.compare("blah", hash, function(err, res) {
+                        assert.strictEqual(res, false, "These hashes should not be equal.");
+                        assert.done();
+                    });
+                });
+            });
+        });
+    },
+    test_hash_compare_empty_strings: function(assert) {
+        assert.expect(2);
+        var hash = bcrypt.hashSync("test", bcrypt.genSaltSync(10));
+
+        bcrypt.compare("", hash, function(err, res) {
+          assert.strictEqual(res, false, "These hashes should not be equal.");
+          bcrypt.compare("", "", function(err, res) {
+            assert.strictEqual(res, false, "These hashes should not be equal.");
+            assert.done();
+          });
+        });
+    },
+    test_hash_compare_invalid_strings: function(assert) {
+      var fullString = 'envy1362987212538';
+      var hash = '$2a$10$XOPbrlUPQdwdJUpSrIF6X.LbE14qsMmKGhM1A8W9iqaG3vv1BD7WC';
+      var wut = ':';
+      bcrypt.compare(fullString, hash, function(err, res) {
+        assert.ok(res);
+        bcrypt.compare(fullString, wut, function(err, res) {
+          assert.ok(!res);
+          assert.done();
+        });
+      });
+    },
+    test_compare_no_params: function(assert) {
+        bcrypt.compare(function(err, hash) {
+            assert.ok(err, 'Should be an error. No params.');
+            assert.done();
+        });
+    },
+    test_hash_compare_one_param: function(assert) {
+        bcrypt.compare('password', function(err, hash) {
+            assert.ok(err, 'Should be an Error. No hash.');
+            assert.done();
+        });
+    }
+};

node_modules/bcrypt/test/implementation.js

@@ -0,0 +1,48 @@
+var bcrypt = require('../bcrypt');
+
+// some tests were adapted from https://github.com/riverrun/bcrypt_elixir/blob/master/test/base_test.exs
+// which are under the BSD LICENSE
+module.exports = {
+    openwall_bcrypt_tests: function(assert) {
+        assert.strictEqual(bcrypt.hashSync("U*U", "$2a$05$CCCCCCCCCCCCCCCCCCCCC."), "$2a$05$CCCCCCCCCCCCCCCCCCCCC.E5YPO9kmyuRGyh0XouQYb4YMJKvyOeW");
+        assert.strictEqual(bcrypt.hashSync("U*U*", "$2a$05$CCCCCCCCCCCCCCCCCCCCC."), "$2a$05$CCCCCCCCCCCCCCCCCCCCC.VGOzA784oUp/Z0DY336zx7pLYAy0lwK");
+        assert.strictEqual(bcrypt.hashSync("U*U*U", "$2a$05$XXXXXXXXXXXXXXXXXXXXXO"), "$2a$05$XXXXXXXXXXXXXXXXXXXXXOAcXxm9kjPGEMsLznoKqmqw7tc8WCx4a");
+        assert.strictEqual(bcrypt.hashSync("", "$2a$05$CCCCCCCCCCCCCCCCCCCCC."), "$2a$05$CCCCCCCCCCCCCCCCCCCCC.7uG0VCzI2bS7j6ymqJi9CdcdxiRTWNy");
+        assert.strictEqual(bcrypt.hashSync("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789", "$2a$05$abcdefghijklmnopqrstuu"), "$2a$05$abcdefghijklmnopqrstuu5s2v8.iXieOjg/.AySBTTZIIVFJeBui");
+        assert.done();
+    },
+    openbsd_bcrypt_tests: function(assert) {
+        assert.strictEqual(bcrypt.hashSync("000000000000000000000000000000000000000000000000000000000000000000000000", "$2a$05$CCCCCCCCCCCCCCCCCCCCC."), "$2a$05$CCCCCCCCCCCCCCCCCCCCC.6.O1dLNbjod2uo0DVcW.jHucKbPDdHS");
+        assert.strictEqual(bcrypt.hashSync("000000000000000000000000000000000000000000000000000000000000000000000000", "$2b$05$CCCCCCCCCCCCCCCCCCCCC."), "$2b$05$CCCCCCCCCCCCCCCCCCCCC.6.O1dLNbjod2uo0DVcW.jHucKbPDdHS");
+        assert.done();
+    },
+    test_long_passwords: function(assert) {
+        // bcrypt wrap-around bug in $2a$
+        assert.strictEqual(bcrypt.hashSync("012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234", "$2a$05$CCCCCCCCCCCCCCCCCCCCC."), "$2a$05$CCCCCCCCCCCCCCCCCCCCC.6.O1dLNbjod2uo0DVcW.jHucKbPDdHS");
+        assert.strictEqual(bcrypt.hashSync("01XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "$2a$05$CCCCCCCCCCCCCCCCCCCCC."), "$2a$05$CCCCCCCCCCCCCCCCCCCCC.6.O1dLNbjod2uo0DVcW.jHucKbPDdHS");
+
+        // tests for $2b$ which fixes wrap-around bugs
+        assert.strictEqual(bcrypt.hashSync("012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234", "$2b$05$CCCCCCCCCCCCCCCCCCCCC."), "$2b$05$CCCCCCCCCCCCCCCCCCCCC.XxrQqgBi/5Sxuq9soXzDtjIZ7w5pMfK");
+        assert.strictEqual(bcrypt.hashSync("0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345", "$2b$05$CCCCCCCCCCCCCCCCCCCCC."), "$2b$05$CCCCCCCCCCCCCCCCCCCCC.XxrQqgBi/5Sxuq9soXzDtjIZ7w5pMfK");
+        assert.done();
+    },
+    test_embedded_nulls: function(assert) {
+        assert.strictEqual(bcrypt.hashSync("Passw\0rd123", "$2b$05$CCCCCCCCCCCCCCCCCCCCC."), "$2b$05$CCCCCCCCCCCCCCCCCCCCC.VHy/kzL4sCcX3Ib3wN5rNGiRt.TpfxS");
+        assert.strictEqual(bcrypt.hashSync("Passw\0 you can literally write anything after the NUL character", "$2b$05$CCCCCCCCCCCCCCCCCCCCC."), "$2b$05$CCCCCCCCCCCCCCCCCCCCC.4vJLJQ6nZ/70INTjjSZWQ0iyUek92tu");
+        assert.done();
+    },
+    test_shorten_salt_to_128_bits: function(assert) {
+        assert.strictEqual(bcrypt.hashSync("test", "$2a$10$1234567899123456789012"), "$2a$10$123456789912345678901u.OtL1A1eGK5wmvBKUDYKvuVKI7h2XBu");
+        assert.strictEqual(bcrypt.hashSync("U*U*", "$2a$05$CCCCCCCCCCCCCCCCCCCCCh"), "$2a$05$CCCCCCCCCCCCCCCCCCCCCeUQ7VjYZ2hd4bLYZdhuPpZMUpEUJDw1S");
+        assert.strictEqual(bcrypt.hashSync("U*U*", "$2a$05$CCCCCCCCCCCCCCCCCCCCCM"), "$2a$05$CCCCCCCCCCCCCCCCCCCCC.VGOzA784oUp/Z0DY336zx7pLYAy0lwK");
+        assert.strictEqual(bcrypt.hashSync("U*U*", "$2a$05$CCCCCCCCCCCCCCCCCCCCCA"), "$2a$05$CCCCCCCCCCCCCCCCCCCCC.VGOzA784oUp/Z0DY336zx7pLYAy0lwK");
+        assert.done();
+    },
+    test_consistency: function(assert) {
+        assert.strictEqual(bcrypt.hashSync("ππππππππ", "$2a$10$.TtQJ4Jr6isd4Hp.mVfZeu"), "$2a$10$.TtQJ4Jr6isd4Hp.mVfZeuh6Gws4rOQ/vdBczhDx.19NFK0Y84Dle");
+        assert.strictEqual(bcrypt.hashSync("p@5sw0rd", "$2b$12$zQ4CooEXdGqcwi0PHsgc8e"), "$2b$12$zQ4CooEXdGqcwi0PHsgc8eAf0DLXE/XHoBE8kCSGQ97rXwuClaPam");
+        assert.strictEqual(bcrypt.hashSync("C'est bon, la vie!", "$2b$12$cbo7LZ.wxgW4yxAA5Vqlv."), "$2b$12$cbo7LZ.wxgW4yxAA5Vqlv.KR6QFPt4qCdc9RYJNXxa/rbUOp.1sw.");
+        assert.strictEqual(bcrypt.hashSync("ἓν οἶδα ὅτι οὐδὲν οἶδα", "$2b$12$LeHKWR2bmrazi/6P22Jpau"), "$2b$12$LeHKWR2bmrazi/6P22JpauX5my/eKwwKpWqL7L5iEByBnxNc76FRW");
+        assert.done();
+    }
+}

node_modules/bcrypt/test/promise.js

@@ -0,0 +1,252 @@
+var bcrypt = require('../bcrypt');
+var promises = require('../promises');
+
+var fail = function(assert, error) {
+    assert.ok(false, error);
+    assert.done();
+};
+
+// only run these tests if Promise is available
+if (typeof Promise !== 'undefined') {
+    module.exports = {
+        test_salt_returns_promise_on_no_args: function(assert) {
+            // make sure test passes with non-native implementations such as bluebird
+            // http://stackoverflow.com/questions/27746304/how-do-i-tell-if-an-object-is-a-promise
+            assert.strictEqual(typeof bcrypt.genSalt().then, 'function', "Should return a promise");
+            assert.done();
+        },
+        test_salt_returns_promise_on_null_callback: function(assert) {
+            assert.strictEqual(typeof bcrypt.genSalt(13, null, null).then,'function', "Should return a promise");
+            assert.done();
+        },
+        test_salt_length: function(assert) {
+            assert.expect(2);
+            bcrypt.genSalt(10).then(function(salt) {
+                assert.ok(salt,'salt must be defined');
+                assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
+                assert.done();
+            });
+        },
+        test_salt_rounds_is_string_number: function(assert) {
+            assert.expect(1);
+            bcrypt.genSalt('10').then(function() {
+                fail(assert, "should not be resolved");
+            }).catch(function(err) {
+                assert.ok((err instanceof Error), "Should be an Error. genSalt requires round to be of type number.");
+            }).then(function() {
+                assert.done();
+            });
+        },
+        test_salt_rounds_is_string_non_number: function(assert) {
+            assert.expect(1);
+            bcrypt.genSalt('b').then(function() {
+                fail(assert, "should not be resolved");
+            }).catch(function(err) {
+                assert.ok((err instanceof Error), "Should be an Error. genSalt requires round to be of type number.");
+            }).then(function() {
+                assert.done();
+            });
+        },
+        test_hash_returns_promise_on_null_callback: function(assert) {
+            assert.strictEqual(typeof bcrypt.hash('password', 10, null).then,'function', "Should return a promise");
+            assert.done();
+        },
+        test_hash: function(assert) {
+            assert.expect(1);
+            bcrypt.genSalt(10).then(function(salt) {
+                return bcrypt.hash('password', salt);
+            }).then(function(res) {
+                assert.ok(res, "Res should be defined.");
+                assert.done();
+            });
+        },
+        test_hash_rounds: function(assert) {
+            assert.expect(1);
+            bcrypt.hash('bacon', 8).then(function(hash) {
+                assert.strictEqual(bcrypt.getRounds(hash), 8, "Number of rounds should be that specified in the function call.");
+                assert.done();
+            });
+        },
+        test_hash_empty_strings: function(assert) {
+            assert.expect(2);
+            Promise.all([
+                bcrypt.genSalt(10).then(function(salt) {
+                    return bcrypt.hash('', salt);
+                }).then(function(res) {
+                    assert.ok(res, "Res should be defined even with an empty pw.");
+                }),
+                bcrypt.hash('', '').then(function() {
+                    fail(assert, "should not be resolved")
+                }).catch(function(err) {
+                    assert.ok(err);
+                }),
+            ]).then(function() {
+                assert.done();
+            });
+        },
+        test_hash_no_params: function(assert) {
+            assert.expect(1);
+            bcrypt.hash().then(function() {
+                fail(assert, "should not be resolved");
+            }).catch(function(err) {
+                assert.ok(err, "Should be an error. No params.");
+            }).then(function() {
+                assert.done();
+            });
+        },
+        test_hash_one_param: function(assert) {
+            assert.expect(1);
+            bcrypt.hash('password').then(function() {
+                fail(assert, "should not be resolved");
+            }).catch(function(err) {
+                assert.ok(err, "Should be an error. No salt.");
+            }).then(function() {
+                assert.done();
+            });
+        },
+        test_hash_salt_validity: function(assert) {
+            assert.expect(3);
+            Promise.all(
+                [
+                    bcrypt.hash('password', '$2a$10$somesaltyvaluertsetrse').then(function(enc) {
+                        assert.ok(enc, "should be resolved with a value");
+                    }),
+                    bcrypt.hash('password', 'some$value').then(function() {
+                        fail(assert, "should not resolve");
+                    }).catch(function(err) {
+                        assert.notEqual(err, undefined);
+                        assert.strictEqual(err.message, "Invalid salt. Salt must be in the form of: $Vers$log2(NumRounds)$saltvalue");
+                    })
+                ]).then(function() {
+                assert.done();
+            });
+        },
+        test_verify_salt: function(assert) {
+            assert.expect(2);
+            bcrypt.genSalt(10).then(function(salt) {
+                var split_salt = salt.split('$');
+                assert.strictEqual(split_salt[1], '2b');
+                assert.strictEqual(split_salt[2], '10');
+                assert.done();
+            });
+        },
+        test_verify_salt_min_rounds: function(assert) {
+            assert.expect(2);
+            bcrypt.genSalt(1).then(function(salt) {
+                var split_salt = salt.split('$');
+                assert.strictEqual(split_salt[1], '2b');
+                assert.strictEqual(split_salt[2], '04');
+                assert.done();
+            });
+        },
+        test_verify_salt_max_rounds: function(assert) {
+            assert.expect(2);
+            bcrypt.genSalt(100).then(function(salt) {
+                var split_salt = salt.split('$');
+                assert.strictEqual(split_salt[1], '2b');
+                assert.strictEqual(split_salt[2], '31');
+                assert.done();
+            });
+        },
+        test_hash_compare_returns_promise_on_null_callback: function(assert) {
+            assert.strictEqual(typeof bcrypt.compare('password', 'something', null).then, 'function', "Should return a promise");
+            assert.done();
+        },
+        test_hash_compare: function(assert) {
+            assert.expect(3);
+            bcrypt.genSalt(10).then(function(salt) {
+                assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
+                return bcrypt.hash("test", salt);
+            }).then(function(hash) {
+                return Promise.all(
+                    [
+                        bcrypt.compare("test", hash).then(function(res) {
+                            assert.strictEqual(res, true, "These hashes should be equal.");
+                        }),
+                        bcrypt.compare("blah", hash).then(function(res) {
+                            assert.strictEqual(res, false, "These hashes should not be equal.");
+                        })
+                    ]).then(function() {
+                    assert.done();
+                });
+            });
+        },
+        test_hash_compare_empty_strings: function(assert) {
+            assert.expect(2);
+            var hash = bcrypt.hashSync("test", bcrypt.genSaltSync(10));
+            bcrypt.compare("", hash).then(function(res) {
+                assert.strictEqual(res, false, "These hashes should not be equal.");
+                return bcrypt.compare("", "");
+            }).then(function(res) {
+                assert.strictEqual(res, false, "These hashes should not be equal.");
+                assert.done();
+            });
+        },
+        test_hash_compare_invalid_strings: function(assert) {
+            var fullString = 'envy1362987212538';
+            var hash = '$2a$10$XOPbrlUPQdwdJUpSrIF6X.LbE14qsMmKGhM1A8W9iqaG3vv1BD7WC';
+            var wut = ':';
+            Promise.all([
+                bcrypt.compare(fullString, hash).then(function(res) {
+                    assert.ok(res);
+                }),
+                bcrypt.compare(fullString, wut).then(function(res) {
+                    assert.ok(!res);
+                })
+            ]).then(function() {
+                assert.done();
+            });
+        },
+        test_hash_compare_no_params: function(assert) {
+            assert.expect(1);
+            bcrypt.compare().then(function() {
+                fail(assert, 'Should not resolve');
+            }).catch(function(err) {
+                assert.strictEqual(err.message, 'data and hash arguments required', 'Promise should be rejected when no parameters are supplied');
+            }).then(function() {
+                assert.done();
+            });
+        },
+        test_hash_compare_one_param: function(assert) {
+            assert.expect(1);
+            bcrypt.compare('password').then(function() {
+                fail(assert, 'Should not resolve');
+            }).catch(function(err) {
+                assert.strictEqual(err.message, 'data and hash arguments required', 'Promise should be rejected when no parameters are supplied');
+            }).then(function() {
+                assert.done();
+            });
+        },
+        test_change_promise_impl_reject: function(assert) {
+
+          promises.use({
+            reject: function() {
+              return 'mock';
+            }
+          });
+
+          assert.equal(promises.reject(), 'mock');
+
+          // need to reset the promise implementation because of require cache
+          promises.use(global.Promise);
+          assert.done();
+
+        },
+        test_change_promise_impl_promise: function(assert) {
+
+          promises.use({
+            reject: function(err) {
+              assert.equal(err.message, 'fn must be a function');
+              return 'mock';
+            }
+          });
+
+          assert.equal(promises.promise('', '', ''), 'mock');
+
+          // need to reset the promise implementation because of require cache
+          promises.use(global.Promise);
+          assert.done();
+
+        }
+    };
+}

node_modules/bcrypt/test/repetitions.js

@@ -0,0 +1,118 @@
+var bcrypt = require('../bcrypt');
+
+var EXPECTED = 2500; //number of times to iterate these tests...
+
+module.exports = {
+  test_salt_length: function(assert) {
+    assert.expect(EXPECTED);
+    var n = 0;
+    for (var i = 0; i < EXPECTED; i++) {
+      bcrypt.genSalt(10, function(err, salt) {
+        assert.equals(29, salt.length, "Salt ("+salt+") isn't the correct length. It is: " + salt.length);
+        n++;
+      });
+    }
+
+    function checkVal() {
+        if (n == EXPECTED) {
+          assert.done();
+        } else {
+          setTimeout(checkVal, 100);
+        }
+    }
+    setTimeout(checkVal, 100);
+  },
+  test_hash_length: function(assert) {
+    assert.expect(EXPECTED);
+    var SALT = '$2a$04$TnjywYklQbbZjdjBgBoA4e';
+    var n = 0;
+    for (var i = 0; i < EXPECTED; i++) {
+      bcrypt.hash('test', SALT, function(err, crypted) {
+        assert.equals(60, crypted.length, "Encrypted ("+crypted+") isn't the correct length. It is: " + crypted.length);
+        n++;
+      });
+    }
+
+    function checkVal() {
+      if (n == EXPECTED) {
+        assert.done();
+      } else {
+        setTimeout(checkVal, 100);
+      }
+    }
+    setTimeout(checkVal, 100);
+  },
+  test_compare: function(assert) {
+    assert.expect(EXPECTED);
+    var HASH = '$2a$04$TnjywYklQbbZjdjBgBoA4e9G7RJt9blgMgsCvUvus4Iv4TENB5nHy';
+    var n = 0;
+    for (var i = 0; i < EXPECTED; i++) {
+      bcrypt.compare('test', HASH, function(err, match) {
+        assert.equal(true, match, "No match.");
+        n++;
+      });
+    }
+
+    function checkVal() {
+      if (n == EXPECTED) {
+        assert.done();
+      } else {
+        setTimeout(checkVal, 100);
+      }
+    }
+    setTimeout(checkVal, 100);
+  },
+  test_hash_and_compare: function(assert) {
+    assert.expect((EXPECTED-1)*3);
+    var salt = bcrypt.genSaltSync(4),
+        idx = 0,
+        good_done = false,
+        bad_done = false;
+
+    function next() {
+      return test('secret' + Math.random());
+    }
+
+    function test(password) {
+      idx += 1;
+      return bcrypt.hash(password, salt, function(err, hash) {
+        if (err) throw err;
+        //console.log('\nbcrypt iter ' + idx);
+
+        assert.ok(hash);
+
+        bcrypt.compare(password, hash, function(err, res) {
+          //if (err) throw err;
+          assert.ok(res);
+          if (idx >= (EXPECTED-1)) {
+            good_done = true;
+          }
+        });
+
+        bcrypt.compare('bad' + password, hash, function(err, res) {
+          //if (err) throw err;
+          assert.ok(!res);
+          if (idx >= (EXPECTED-1)) {
+            bad_done = true;
+          }
+        });
+
+        if (idx < ((EXPECTED)-1)) {
+          next();
+        } else {
+          function checkDone() {
+            if (idx >= (EXPECTED-1) && good_done && bad_done) {
+              assert.done();
+            } else {
+              setTimeout(checkDone, 100);
+            }
+          }
+
+          setTimeout(checkDone, 100);
+        }
+      });
+    }
+
+    next();
+  }
+};

node_modules/bcrypt/test/sync.js

@@ -0,0 +1,137 @@
+var bcrypt = require('../bcrypt');
+
+module.exports = {
+    test_salt_length: function(assert) {
+        var salt = bcrypt.genSaltSync(10);
+        assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
+        var split_salt = salt.split('$');
+        assert.strictEqual(split_salt[1], '2b');
+        assert.strictEqual(split_salt[2], '10');
+        assert.done();
+    },
+    test_salt_no_params: function(assert) {
+        // same as test_verify_salt except using default rounds of 10
+        var salt = bcrypt.genSaltSync();
+        var split_salt = salt.split('$');
+        assert.strictEqual(split_salt[1], '2b');
+        assert.strictEqual(split_salt[2], '10');
+        assert.done();
+    },
+    test_salt_rounds_is_string_number: function(assert) {
+        assert.throws(function() {bcrypt.genSaltSync('10');}, "Should throw an Error. No params.");
+        assert.done();
+    },
+    test_salt_rounds_is_NaN: function(assert) {
+        assert.throws(function() {bcrypt.genSaltSync('b');}, "Should throw an Error. gen_salt requires rounds to be a number.");
+        assert.done();
+    },
+    test_salt_minor_a: function(assert) {
+        var salt = bcrypt.genSaltSync(10, 'a');
+        assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
+        var split_salt = salt.split('$');
+        assert.strictEqual(split_salt[1], '2a');
+        assert.strictEqual(split_salt[2], '10');
+        assert.done();
+    },
+    test_salt_minor_b: function(assert) {
+        var salt = bcrypt.genSaltSync(10, 'b');
+        assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
+        var split_salt = salt.split('$');
+        assert.strictEqual(split_salt[1], '2b');
+        assert.strictEqual(split_salt[2], '10');
+        assert.done();
+    },
+    test_hash: function(assert) {
+        assert.ok(bcrypt.hashSync('password', bcrypt.genSaltSync(10)), "Shouldn't throw an Error.");
+        assert.done();
+    },
+    test_hash_rounds: function(assert) {
+        var hash = bcrypt.hashSync('password', 8);
+        assert.strictEqual(bcrypt.getRounds(hash), 8, "Number of rounds should equal 8.");
+        assert.done();
+    },
+    test_hash_empty_string: function(assert) {
+        assert.ok(bcrypt.hashSync('', bcrypt.genSaltSync(10)), "Shouldn't throw an Error.");
+        assert.throws(function() {bcrypt.hashSync('password', '')}, "Should have thrown an Error related to the salt.");
+        assert.throws(function() {bcrypt.hashSync('', '')}, "Should have thrown an Error related to the salt.");
+        assert.done();
+    },
+    test_hash_pw_no_params: function(assert) {
+        assert.throws(function() {bcrypt.hashSync();}, "Should throw an Error. No Params.");
+        assert.done();
+    },
+    test_hash_pw_one_param: function(assert) {
+        assert.throws(function() {bcrypt.hashSync('password');}, "Should throw an Error. No salt.");
+        assert.done();
+    },
+    test_hash_pw_not_hash_str: function(assert) {
+        assert.throws(function() {bcrypt.hashSync('password', {});}, "Should throw an Error. hash should be a string or number.");
+        assert.done();
+    },
+    test_hash_salt_validity: function(assert) {
+        assert.expect(2);
+        assert.ok(bcrypt.hashSync('password', '$2a$10$somesaltyvaluertsetrse'));
+        assert.throws(function() {
+            bcrypt.hashSync('password', 'some$value');
+        });
+        assert.done();
+    },
+    test_verify_salt: function(assert) {
+        var salt = bcrypt.genSaltSync(10);
+        var split_salt = salt.split('$');
+        assert.strictEqual(split_salt[1], '2b');
+        assert.strictEqual(split_salt[2], '10');
+        assert.done();
+    },
+    test_verify_salt_min_rounds: function(assert) {
+        var salt = bcrypt.genSaltSync(1);
+        var split_salt = salt.split('$');
+        assert.strictEqual(split_salt[1], '2b');
+        assert.strictEqual(split_salt[2], '04');
+        assert.done();
+    },
+    test_verify_salt_max_rounds: function(assert) {
+        var salt = bcrypt.genSaltSync(100);
+        var split_salt = salt.split('$');
+        assert.strictEqual(split_salt[1], '2b');
+        assert.strictEqual(split_salt[2], '31');
+        assert.done();
+    },
+    test_hash_compare: function(assert) {
+        var salt = bcrypt.genSaltSync(10);
+        assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
+        var hash = bcrypt.hashSync("test", salt);
+        assert.ok(bcrypt.compareSync("test", hash), "These hashes should be equal.");
+        assert.ok(!(bcrypt.compareSync("blah", hash)), "These hashes should not be equal.");
+        assert.done();
+    },
+    test_hash_compare_empty_strings: function(assert) {
+        assert.ok(!(bcrypt.compareSync("", "password")), "These hashes should not be equal.");
+        assert.ok(!(bcrypt.compareSync("", "")), "These hashes should not be equal.");
+        assert.ok(!(bcrypt.compareSync("password", "")), "These hashes should not be equal.");
+        assert.done();
+    },
+    test_hash_compare_invalid_strings: function(assert) {
+      var fullString = 'envy1362987212538';
+      var hash = '$2a$10$XOPbrlUPQdwdJUpSrIF6X.LbE14qsMmKGhM1A8W9iqaG3vv1BD7WC';
+      var wut = ':';
+      bcrypt.compareSync(fullString, hash, function(err, res) {
+        assert.ok(res);
+      });
+      bcrypt.compareSync(fullString, wut, function(err, res) {
+        assert.ok(!res)
+      });
+      assert.done();
+    },
+    test_getRounds: function(assert) {
+        var hash = bcrypt.hashSync("test", bcrypt.genSaltSync(9));
+        assert.strictEqual(9, bcrypt.getRounds(hash), "getRounds can't extract rounds");
+        assert.done();
+    },
+    test_getRounds: function(assert) {
+        var hash = bcrypt.hashSync("test", bcrypt.genSaltSync(9));
+        assert.strictEqual(9, bcrypt.getRounds(hash), "getRounds can't extract rounds");
+        assert.throws(function() {bcrypt.getRounds(''); }, "Must pass a valid hash to getRounds");
+        assert.done();
+    }
+};