replace Math.random UUID generation w/ crypto.UUID

Author: NiloCK

packages/db/src/impl/common/BaseUserDB.ts

@@ -1094,23 +1094,50 @@ export function accomodateGuest(): {
     firstVisit: firstVisit,
   };
 
-  // pilfered from https://stackoverflow.com/a/8809472/1252649
+  // Use cryptographically secure UUID generation
   function generateUUID() {
     logger.log('[funnel] Inside generateUUID()');
+
+    // Use crypto.randomUUID() if available (Node 14.17+ / modern browsers)
+    if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {
+      const uuid = crypto.randomUUID();
+      logger.log('[funnel] Generated UUID using crypto.randomUUID():', uuid);
+      return uuid;
+    }
+
+    // Fallback for older environments: use crypto.getRandomValues()
+    if (typeof crypto !== 'undefined' && typeof crypto.getRandomValues === 'function') {
+      const bytes = new Uint8Array(16);
+      crypto.getRandomValues(bytes);
+
+      // Set version (4) and variant bits according to RFC 4122
+      bytes[6] = (bytes[6] & 0x0f) | 0x40; // Version 4
+      bytes[8] = (bytes[8] & 0x3f) | 0x80; // Variant 10
+
+      const uuid = [
+        Array.from(bytes.slice(0, 4)).map(b => b.toString(16).padStart(2, '0')).join(''),
+        Array.from(bytes.slice(4, 6)).map(b => b.toString(16).padStart(2, '0')).join(''),
+        Array.from(bytes.slice(6, 8)).map(b => b.toString(16).padStart(2, '0')).join(''),
+        Array.from(bytes.slice(8, 10)).map(b => b.toString(16).padStart(2, '0')).join(''),
+        Array.from(bytes.slice(10, 16)).map(b => b.toString(16).padStart(2, '0')).join(''),
+      ].join('-');
+
+      logger.log('[funnel] Generated UUID using crypto.getRandomValues():', uuid);
+      return uuid;
+    }
+
+    // Last resort fallback (should never happen in modern environments)
+    logger.warn('[funnel] crypto API not available, using timestamp-based UUID (NOT SECURE)');
     let d = new Date().getTime();
-    logger.log('[funnel] Date timestamp:', d);
     if (typeof performance !== 'undefined' && typeof performance.now === 'function') {
-      d += performance.now(); // use high-precision timer if available
-      logger.log('[funnel] After adding performance.now():', d);
+      d += performance.now();
     }
     const uuid = 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {
-      // tslint:disable-next-line:no-bitwise
       const r = (d + Math.random() * 16) % 16 | 0;
       d = Math.floor(d / 16);
-      // tslint:disable-next-line:no-bitwise
       return (c === 'x' ? r : (r & 0x3) | 0x8).toString(16);
     });
-    logger.log('[funnel] Generated UUID inside function:', uuid);
+    logger.log('[funnel] Generated UUID (fallback):', uuid);
     return uuid;
   }
 }