@absolutejs/auth 0.60.0 → 0.61.0

package/dist/index.js

@@ -5333,6 +5333,8 @@ var evaluatePassword = async (password, policy = {}) => {
 var isPasswordCompromised = (password) => isPasswordBreached(password);
 
 // src/credentials/login.ts
+var dummyPasswordHashPromise;
+var dummyPasswordHash = () => dummyPasswordHashPromise ??= hashPassword("absolutejs-auth-timing-equalizer");
 var credentialsLogin = ({
   authSessionStore,
   checkBreachesOnLogin,
@@ -5374,7 +5376,13 @@ var credentialsLogin = ({
   const credential = await credentialStore.getCredentialByEmail(normalizedEmail);
   const user = await getUserByEmail(normalizedEmail);
   const verifyHash = passwordVerifier ?? verifyPassword;
-  const passwordValid = credential === undefined ? false : await verifyHash(password, credential.passwordHash);
+  let passwordValid;
+  if (credential === undefined) {
+    await verifyPassword(password, await dummyPasswordHash());
+    passwordValid = false;
+  } else {
+    passwordValid = await verifyHash(password, credential.passwordHash);
+  }
   if (!credential || !user || credential.status !== "active" || !passwordValid) {
     await lockoutGuard?.recordFailure(normalizedEmail);
     await onCredentialsLoginError?.({
@@ -37323,6 +37331,9 @@ var buildAuthApplications = async (configuration) => {
       await webhookDispatch?.(event);
     }
   }) : undefined;
+  if (auditEmit === undefined) {
+    console.warn("[@absolutejs/auth] No audit sink configured (pass `audit` or `webhooks`). " + "Privileged flows (impersonation, role/permission changes, sign-out) will " + "run WITHOUT an audit trail.");
+  }
   const lockoutGuard = lockout ? createLockoutGuard(lockout) : undefined;
   const resolvedAgentAuth = agentAuth === undefined ? undefined : {
     ...agentAuth,
@@ -38046,5 +38057,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=6BF9ABB7B635052264756E2164756E21
+//# debugId=60AF00D018199BB164756E2164756E21
 //# sourceMappingURL=index.js.map