MichilisandClaude Opus 5
733d2459df
Replace the hand-rolled JWT auth with Better Auth 1.6.25 httpOnly cookie sessions, validated against the database on every request so revocation, bans and role changes take effect immediately. Backend: - betterAuth.ts wires the Drizzle adapter, magic links, Google sign-in and the admin plugin; auth-schema.ts maps Better Auth's models onto the existing `users` table so user IDs and their foreign keys survive intact. - routes/auth.ts is gone; Better Auth serves the standard endpoints and authExt.ts carries the flows it doesn't cover. - auth.ts shrinks to session resolution and helpers; sessions/revocation in dashboard.ts now read and delete `auth_sessions` rows directly. - Schema adds the Better Auth core + admin columns (email_verified, image, banned, ban_reason, ban_expires), with migrations and tests. - rateLimit.ts resolves client IPs spoof-resistantly: proxy headers are only honoured from loopback/RFC1918 peers plus TRUSTED_PROXIES. - passwordPolicy.ts centralises password validation. - Bump drizzle-orm, drizzle-kit and better-sqlite3 to versions compatible with Better Auth. Frontend: - auth-client.ts plus a reworked AuthContext and api/client.ts move to cookie-based sessions; no more bearer tokens in requests or middleware. photo-api: - Validate Better Auth session cookies against the shared auth_sessions table instead of verifying JWTs; JWT_SECRET is no longer needed for user auth, and PHOTO_VIEW_SECRET now signs gallery view tokens. BETTER_AUTH_SECRET and BETTER_AUTH_URL are required in production; the deprecated JWT_SECRET stays only as the photo-api view-token fallback. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
63 lines
2.3 KiB
TypeScript
63 lines
2.3 KiB
TypeScript
import * as argon2 from 'argon2';
|
|
import bcrypt from 'bcryptjs';
|
|
|
|
// Password hashing with Argon2 (spec requirement)
|
|
export async function hashPassword(password: string): Promise<string> {
|
|
return argon2.hash(password, {
|
|
type: argon2.argon2id,
|
|
memoryCost: 65536, // 64 MB
|
|
timeCost: 3,
|
|
parallelism: 4,
|
|
});
|
|
}
|
|
|
|
export async function verifyPassword(password: string, hash: string): Promise<boolean> {
|
|
// Support both bcrypt (legacy) and argon2 hashes for migration
|
|
if (hash.startsWith('$argon2')) {
|
|
return argon2.verify(hash, password);
|
|
}
|
|
// Legacy bcrypt support
|
|
return bcrypt.compare(password, hash);
|
|
}
|
|
|
|
// Small blocklist of common/weak passwords (and obvious app-specific ones).
|
|
// Compared case-insensitively after stripping non-alphanumerics so that e.g.
|
|
// "P@ssw0rd!" still matches "password".
|
|
const COMMON_PASSWORDS = new Set([
|
|
'password', 'passw0rd', '123456', '1234567', '12345678', '123456789', '1234567890',
|
|
'qwerty', 'qwertyuiop', 'letmein', 'welcome', 'admin', 'administrator', 'iloveyou',
|
|
'monkey', 'dragon', 'sunshine', 'princess', 'football', 'baseball', 'abc123',
|
|
'spanglish', 'changeme', 'secret', 'master', 'login', 'access',
|
|
]);
|
|
|
|
// Password policy: 10-128 chars, requires a mix of character types, and rejects
|
|
// common/weak passwords. Centralized so register/reset/change all share it.
|
|
export function validatePassword(password: string): { valid: boolean; error?: string } {
|
|
if (password.length < 10) {
|
|
return { valid: false, error: 'Password must be at least 10 characters long' };
|
|
}
|
|
if (password.length > 128) {
|
|
return { valid: false, error: 'Password must be at most 128 characters long' };
|
|
}
|
|
|
|
const hasLower = /[a-z]/.test(password);
|
|
const hasUpper = /[A-Z]/.test(password);
|
|
const hasDigit = /\d/.test(password);
|
|
const hasSymbol = /[^A-Za-z0-9]/.test(password);
|
|
|
|
// Require lowercase, uppercase, and at least one digit or symbol.
|
|
if (!hasLower || !hasUpper || !(hasDigit || hasSymbol)) {
|
|
return {
|
|
valid: false,
|
|
error: 'Password must include uppercase and lowercase letters and at least one number or symbol',
|
|
};
|
|
}
|
|
|
|
const normalized = password.toLowerCase().replace(/[^a-z0-9]/g, '');
|
|
if (COMMON_PASSWORDS.has(normalized)) {
|
|
return { valid: false, error: 'Password is too common. Please choose a less guessable password.' };
|
|
}
|
|
|
|
return { valid: true };
|
|
}
|