@riocrypto/common-server 1.0.2871 → 1.0.2873

package/build/models/admin-auth.d.ts

@@ -47,6 +47,8 @@ interface AdminAuthDoc extends Document {
     authenticatorSecret?: string;
     apiKeys?: APIKey[];
     tokenVersion?: number;
+    signinAttempts?: number;
+    signinLockedUntil?: Date;
 }
 interface AdminAuthModel extends Model<AdminAuthDoc> {
     build(attrs: AdminAuthAttrs): HydratedDocument<AdminAuthDoc>;

package/build/models/admin-auth.js

@@ -76,6 +76,13 @@ const buildAdminAuth = (mongoose) => {
             type: Number,
             default: 0,
         },
+        signinAttempts: {
+            type: Number,
+            default: 0,
+        },
+        signinLockedUntil: {
+            type: Date,
+        },
         telegram: {
             type: Object,
         },
@@ -103,6 +110,11 @@ const buildAdminAuth = (mongoose) => {
                 delete ret.password;
                 delete ret.previousPasswords;
                 delete ret.authenticatorSecret;
+                // Signin route answers with the admin document, and the admin
+                // listing endpoints hand these records to other admins. Neither
+                // needs to publish how close an account is to being locked.
+                delete ret.signinAttempts;
+                delete ret.signinLockedUntil;
             },
         },
     });

package/build/services/password.js

@@ -13,19 +13,40 @@ exports.Password = void 0;
 const crypto_1 = require("crypto");
 const util_1 = require("util");
 const scryptAsync = (0, util_1.promisify)(crypto_1.scrypt);
+const KEY_LENGTH = 64;
+// 8 bytes was under the 16 the scrypt authors call for. The salt travels with
+// the hash, so widening it only affects credentials written from now on;
+// anything already stored keeps its own salt and still verifies.
+const SALT_BYTES = 16;
 class Password {
     static toHash(password) {
         return __awaiter(this, void 0, void 0, function* () {
-            const salt = (0, crypto_1.randomBytes)(8).toString("hex");
-            const buf = (yield scryptAsync(password, salt, 64));
+            const salt = (0, crypto_1.randomBytes)(SALT_BYTES).toString("hex");
+            const buf = (yield scryptAsync(password, salt, KEY_LENGTH));
             return `${buf.toString("hex")}.${salt}`;
         });
     }
+    // Everything the platform checks against a stored secret comes through
+    // here: account passwords, security answers, and every one-time code. The
+    // comparison is constant-time because `===` on the hex strings returns as
+    // soon as two characters differ, which times how much of the stored hash a
+    // guess reproduced. That is a slow leak rather than an open door -- an
+    // attacker cannot steer scrypt's output toward a prefix cheaply -- but the
+    // fix costs nothing and the alternative is arguing about how slow.
     static compare(storedPassword, suppliedPassword) {
         return __awaiter(this, void 0, void 0, function* () {
             const [hashedPassword, salt] = storedPassword.split(".");
-            const buf = (yield scryptAsync(suppliedPassword, salt, 64));
-            return buf.toString("hex") === hashedPassword;
+            if (!hashedPassword || !salt) {
+                return false;
+            }
+            const buf = (yield scryptAsync(suppliedPassword, salt, KEY_LENGTH));
+            const stored = Buffer.from(hashedPassword, "hex");
+            // timingSafeEqual throws rather than returning false on a length
+            // mismatch, which only happens if the stored value is malformed.
+            if (stored.length !== buf.length) {
+                return false;
+            }
+            return (0, crypto_1.timingSafeEqual)(stored, buf);
         });
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.2871",
+  "version": "1.0.2873",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",