nmemmertandClaude Sonnet 5.5
8a796964b9
Publish Container / build (push) Successful in 17m3s
- Study passwords: salted scrypt; legacy SHA-256 hashes verified and upgraded on login - Admin sessions persisted (hashed tokens) so deploys no longer log the admin out - Upvotes: rate limit + one per client per question, approved questions only; rate limit on analytics play/event - npm audit: 46 -> 4 vulnerabilities (tiptap bumped to 3.31.4) - Untrack per-user data (study users/notes/progress/etc.) from git - Dockerfile HEALTHCHECK; node --test suite for password hashing - Fix email template cards remounting (lost input focus) on each keystroke - Lint: 34 errors -> 0 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
28 lines
1.1 KiB
JavaScript
28 lines
1.1 KiB
JavaScript
import { test } from 'node:test'
|
|
import assert from 'node:assert/strict'
|
|
import { createHash } from 'node:crypto'
|
|
import { hashStudyPassword, verifyStudyPassword, studyPasswordNeedsRehash } from '../server/study-helpers.js'
|
|
|
|
test('new hashes are salted scrypt and verify', () => {
|
|
const a = hashStudyPassword('correct horse')
|
|
const b = hashStudyPassword('correct horse')
|
|
assert.match(a, /^scrypt\$[0-9a-f]+\$[0-9a-f]+$/)
|
|
assert.notEqual(a, b)
|
|
assert.ok(verifyStudyPassword('correct horse', a))
|
|
assert.ok(!verifyStudyPassword('wrong', a))
|
|
assert.ok(!studyPasswordNeedsRehash(a))
|
|
})
|
|
|
|
test('legacy SHA-256 hashes still verify and are flagged for rehash', () => {
|
|
const legacy = createHash('sha256').update('study-user:hunter2hunter2').digest('hex')
|
|
assert.ok(verifyStudyPassword('hunter2hunter2', legacy))
|
|
assert.ok(!verifyStudyPassword('nope', legacy))
|
|
assert.ok(studyPasswordNeedsRehash(legacy))
|
|
})
|
|
|
|
test('malformed stored values never verify', () => {
|
|
for (const bad of ['', undefined, null, 'scrypt$', 'scrypt$zz$', 'abc']) {
|
|
assert.ok(!verifyStudyPassword('x', bad))
|
|
}
|
|
})
|