feat(crypto): add RSA-PSS codemod for DEP0154

[nievasdev]

Summary

Add codemod to transform deprecated RSA-PSS crypto options:

• hash → hashAlgorithm
• mgf1Hash → mgf1HashAlgorithm

Changes

• Only transforms crypto.generateKeyPair() and crypto.generateKeyPairSync() calls with 'rsa-pss' key type
• Supports both direct calls (crypto.generateKeyPair) and destructured imports (generateKeyPair)
• Comprehensive test coverage for various usage patterns

Test plan

• Tests pass for basic transformations
• Tests pass for destructured imports
• Tests verify non-rsa-pss calls are ignored
• Lint and type checks pass

Resolves #144

[AugustinMauroy]

good starting ! But there are missing piece:

• if user do import * as foo from 'node:crypto'
• if use do const { generateKeyPair: foo } = require('node:crypto')
  Solution: have this pr merged #151 EDIT it's merged you should use this utility

Also for strictness on parameters analyst you should do something like that:

for (const call of callNode) {
	const optionsMatch = call.getMatch("OPTIONS");
	if (!optionsMatch) continue;

	// Find the object node that contains the URL options
	const objectNode = optionsMatch.find({
		rule: {
			kind: "object"
		}
	});

	if (!objectNode) continue;

	// Find all property pairs in the object
	const pairs = objectNode.findAll({
		rule: {
			kind: "pair"
		}
	});

	// find hash pair then replace it
	pairs.find(pair => {
		const keyNode = pair.find({
				rule: {
					kind: "property_identifier"
				}
			});
		if (!keyNode) return false;

		const key = keyNode.text();
		if (key === "hash") {
			const valueNode = pair.find({
				rule: {
					kind: "string_fragment"
				}
			}) || pair.find({
				rule: {
					kind: "string"
				}
			});

			if (!valueNode) return false;

			const value = valueNode.text().slice(1, -1); // Remove quotes
			const replacement = `hashAlgorithm: '${value}'`;
			edits.push(call.replace(replacement));
			return true;
		}
		return false;
	});
}

[nievasdev]

Hi @AugustinMauroy, I updated the branch, I would appreciate any feedback, thank you for your attention.

[AugustinMauroy]

Nit

[AugustinMauroy]

this case should be handled

const algo =  'sha256';

crypto.generateKeyPairSync('rsa-pss', {
  modulusLength: 2048,
  mgf1Hash: algo
});

[nievasdev]

@AugustinMauroy @brunocroh thanks for you feedback, I did the changes witch you ask for,
Sorry for the delay, I had to be away for a while.

[brunocroh]

Nice work, thanks! 🚀

[brunocroh]

LGTM 🚀🎉

[nievasdev]

@brunocroh @AugustinMauroy, how are you? Are there other things we should change? How should I continue with this work?

[brunocroh]

@brunocroh @AugustinMauroy, how are you? Are there other things we should change? How should I continue with this work?

We need one more member to review/approve before proceeding with the merge.
We are currently waiting for feedback from the team.

[nievasdev]

Good, could I take another issue while I wait, or is it better if I just wait?

[AugustinMauroy]

Good, could I take another issue while I wait, or is it better if I just wait?

yeah if you want you can open an second pr

[AugustinMauroy]

cc @JakobJingleheimer

[JakobJingleheimer]

LGTM 🙌

PS Sorry for the delay. This got lost in my inbox 😓