From 0cb8cfbcffdc7730c0135242aa03a294d5aecddd Mon Sep 17 00:00:00 2001
From: Andrey Sitnik <andrey@sitnik.ru>
Date: Sun, 4 Nov 2018 14:33:53 -0600
Subject: [PATCH 1/2] Speed up token generation

---
 index.js     | 7 ++++---
 package.json | 4 ++--
 test/test.js | 6 +++---
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/index.js b/index.js
index 78babe1..db163b2 100644
--- a/index.js
+++ b/index.js
@@ -13,9 +13,10 @@
  */
 
 var rndm = require('rndm')
-var uid = require('uid-safe')
 var compare = require('tsscmp')
 var crypto = require('crypto')
+var nanoid = require('nanoid')
+var nanoidAsync = require('nanoid/async')
 
 /**
  * Module variables.
@@ -92,7 +93,7 @@ Tokens.prototype.create = function create (secret) {
  */
 
 Tokens.prototype.secret = function secret (callback) {
-  return uid(this.secretLength, callback)
+  return nanoidAsync(Math.floor(this.secretLength * 8 / 5), callback)
 }
 
 /**
@@ -101,7 +102,7 @@ Tokens.prototype.secret = function secret (callback) {
  */
 
 Tokens.prototype.secretSync = function secretSync () {
-  return uid.sync(this.secretLength)
+  return nanoid(Math.floor(this.secretLength * 8 / 5))
 }
 
 /**
diff --git a/package.json b/package.json
index dff9b48..7b680b5 100644
--- a/package.json
+++ b/package.json
@@ -9,9 +9,9 @@
   "license": "MIT",
   "repository": "pillarjs/csrf",
   "dependencies": {
+    "nanoid": "2.0.0",
     "rndm": "1.2.0",
-    "tsscmp": "1.0.6",
-    "uid-safe": "2.1.5"
+    "tsscmp": "1.0.6"
   },
   "devDependencies": {
     "beautify-benchmark": "0.2.4",
diff --git a/test/test.js b/test/test.js
index a9161f4..c79b909 100644
--- a/test/test.js
+++ b/test/test.js
@@ -129,7 +129,7 @@ describe('Tokens', function () {
     it('should reject bad callback', function () {
       assert.throws(function () {
         this.tokens.secret(42)
-      }.bind(this), /argument callback/)
+      }.bind(this), /Callback is not a function/)
     })
 
     it('should create a secret', function (done) {
@@ -176,13 +176,13 @@ describe('Tokens', function () {
       it('should require callback', function () {
         assert.throws(function () {
           this.tokens.secret()
-        }.bind(this), /argument callback.*required/)
+        }.bind(this), /Function callback.*required/)
       })
 
       it('should reject bad callback', function () {
         assert.throws(function () {
           this.tokens.secret(42)
-        }.bind(this), /argument callback/)
+        }.bind(this), /Callback is not a function/)
       })
     })
   })

From 446490932e5b36fed0125aaf1da15b24a380ab49 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Sun, 4 Nov 2018 16:05:33 -0500
Subject: [PATCH 2/2] Fix error messages

---
 index.js     | 10 ++++++++++
 test/test.js |  6 +++---
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/index.js b/index.js
index db163b2..5dd271e 100644
--- a/index.js
+++ b/index.js
@@ -93,6 +93,16 @@ Tokens.prototype.create = function create (secret) {
  */
 
 Tokens.prototype.secret = function secret (callback) {
+  // validate callback is a function, if provided
+  if (callback !== undefined && typeof callback !== 'function') {
+    throw new TypeError('argument callback must be a function')
+  }
+
+  // require the callback without promises
+  if (!callback && !global.Promise) {
+    throw new TypeError('argument callback is required')
+  }
+
   return nanoidAsync(Math.floor(this.secretLength * 8 / 5), callback)
 }
 
diff --git a/test/test.js b/test/test.js
index c79b909..a9161f4 100644
--- a/test/test.js
+++ b/test/test.js
@@ -129,7 +129,7 @@ describe('Tokens', function () {
     it('should reject bad callback', function () {
       assert.throws(function () {
         this.tokens.secret(42)
-      }.bind(this), /Callback is not a function/)
+      }.bind(this), /argument callback/)
     })
 
     it('should create a secret', function (done) {
@@ -176,13 +176,13 @@ describe('Tokens', function () {
       it('should require callback', function () {
         assert.throws(function () {
           this.tokens.secret()
-        }.bind(this), /Function callback.*required/)
+        }.bind(this), /argument callback.*required/)
       })
 
       it('should reject bad callback', function () {
         assert.throws(function () {
           this.tokens.secret(42)
-        }.bind(this), /Callback is not a function/)
+        }.bind(this), /argument callback/)
       })
     })
   })