possibility of having duplicate nonce

[xileftenurb]

correct me if I'm wrong, but I think it's possible to have duplicate nonce with the current algorithm.

If you get,
now = 431200011, repeat = 11, length = 8 -> nonce = "20001111"
now = 432000111 (800100 millisecond later ~ ), repeat = 1, length = 8 -> nonce = "20001111"

the greater the length, the less likely it happen, but it can.

[abrkn]

That's a disaster :-/ Can you produce a test vector so we can fix it?

[westy92]

For testing, you can use sinon to set the system time:

      let clock;
      try {
        clock = sinon.useFakeTimers(431200011);
        // generate nonce
      } finally {
        clock.restore();
      }

[fabiosantoscode]

Super simple repro:

const assert = require('assert')                                                                       
const nonce = require('nonce')()                                                                       
                                                                                                       
const seen = new Set()                                                                          
for (var x =0; x < 9999; x++) { const n = nonce(); assert(!seen.has(n), 'seen has ' + n); seen.add(n) } 

Run with node 12.

[fabiosantoscode]

It looks like this module was only made for async code because sync code can easily run into a duplicate nonce.

[xileftenurb]

@fabiosantoscode, that not the same thing,
It is possible to have a duplicate if you make 10000 nonce in a millisecond, but it is easy to prevent (by simply not doing so).

The error I presented is different. by doing nonce in a async way, because there is no distinction between the part of the nonce made from the date and the part made from the counter, it is possible to have duplicate nonce from two different date and counter.

[fabiosantoscode]

OK. Maybe I should've opened a separate issue. I still consider this to be a problem though. This module is supposed to generate a number that is ever-increasing and never repeats. The fact that there's a limit to how many you can generate per millisecond should at least be shown in the README, I'm sure you agree with that.

[abrkn]

Open to PRs. I'm not currently using this lib in production.

[fabiosantoscode]

Thanks @abrkn I've sent a PR.