@rpcbase/auth 0.55.0 → 0.57.0

package/dist/api/sign-in/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/api/sign-in/handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAmB,MAAM,cAAc,CAAA;AAInD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;yBA4DlC,KAAK,GAAG,CAAC,eAAe,CAAC;AAAzC,wBAEC"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/api/sign-in/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAmB,MAAM,cAAc,CAAA;AAInD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;yBAwDlC,KAAK,GAAG,CAAC,eAAe,CAAC;AAAzC,wBAEC"}

package/dist/api/sign-up/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/api/sign-up/handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAmB,MAAM,cAAc,CAAA;AAInD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;yBAgFlC,KAAK,GAAG,CAAC,eAAe,CAAC;AAAzC,wBAEC"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/api/sign-up/handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAmB,MAAM,cAAc,CAAA;AAInD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;yBA8ElC,KAAK,GAAG,CAAC,eAAe,CAAC;AAAzC,wBAEC"}

package/dist/{handler-Rf4brHOs.js → handler-ByODvDJo.js}

@@ -1,6 +1,5 @@
-import crypto from "crypto";
 import { loadModel } from "@rpcbase/db";
-import { hashPassword } from "@rpcbase/server";
+import { verifyPasswordFromStorage } from "@rpcbase/server";
 import { R as Route, r as requestSchema } from "./index-Bdcryyvv.js";
 const signIn = async (payload, ctx) => {
   const User = await loadModel("RBUser", ctx);
@@ -15,14 +14,12 @@ const signIn = async (payload, ctx) => {
     ctx.res.status(401);
     return { success: false, error: "invalid_credentials" };
   }
-  const [salt, hashedPassword] = String(user.password).split(":");
-  if (!salt || !hashedPassword) {
-    ctx.res.status(500);
-    return { success: false, error: "invalid_password_format" };
-  }
-  const derivedKey = await hashPassword(password, salt);
-  const passwordMatches = crypto.timingSafeEqual(Buffer.from(hashedPassword, "hex"), derivedKey);
+  const stored = String(user.password);
+  const passwordMatches = await verifyPasswordFromStorage(password, stored);
   if (!passwordMatches) {
+    if (!stored.startsWith("$scrypt$")) {
+      console.warn("auth::sign-in invalid stored password format", user._id.toString());
+    }
     ctx.res.status(401);
     return { success: false, error: "invalid_credentials" };
   }

package/dist/{handler-CLZl3E7O.js → handler-DgTUP3cD.js}

@@ -1,6 +1,6 @@
 import crypto from "crypto";
 import { loadModel } from "@rpcbase/db";
-import { hashPassword, sendEmail } from "@rpcbase/server";
+import { hashPasswordForStorage, sendEmail } from "@rpcbase/server";
 import { R as Route, r as requestSchema } from "./index-DwX0Y2YV.js";
 const signUp = async (payload, ctx) => {
   const User = await loadModel("RBUser", ctx);
@@ -17,9 +17,7 @@ const signUp = async (payload, ctx) => {
     ctx.res.status(409);
     return { success: false, error: "user_exists" };
   }
-  const salt = crypto.randomBytes(16).toString("hex");
-  const derivedKey = await hashPassword(password, salt);
-  const hashedPassword = `${salt}:${derivedKey.toString("hex")}`;
+  const hashedPassword = await hashPasswordForStorage(password);
   const tenantId = crypto.randomUUID();
   const emailVerificationCode = crypto.randomInt(0, 1e6).toString().padStart(6, "0");
   const emailVerificationExpiresAt = new Date(Date.now() + 10 * 60 * 1e3);

package/dist/routes.js

@@ -1,5 +1,5 @@
 const routes = Object.entries({
-  .../* @__PURE__ */ Object.assign({ "./api/me/handler.ts": () => import("./handler-C9aNvw-Q.js"), "./api/sign-in/handler.ts": () => import("./handler-Rf4brHOs.js"), "./api/sign-out/handler.ts": () => import("./handler-CNHucHrj.js"), "./api/sign-up/handler.ts": () => import("./handler-CLZl3E7O.js"), "./api/verify-otp/handler.ts": () => import("./handler-49961uAb.js") })
+  .../* @__PURE__ */ Object.assign({ "./api/me/handler.ts": () => import("./handler-C9aNvw-Q.js"), "./api/sign-in/handler.ts": () => import("./handler-ByODvDJo.js"), "./api/sign-out/handler.ts": () => import("./handler-CNHucHrj.js"), "./api/sign-up/handler.ts": () => import("./handler-DgTUP3cD.js"), "./api/verify-otp/handler.ts": () => import("./handler-49961uAb.js") })
 }).reduce((acc, [path, mod]) => {
   acc[path.replace("./api/", "@rpcbase/auth/api/")] = mod;
   return acc;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rpcbase/auth",
-  "version": "0.55.0",
+  "version": "0.57.0",
   "type": "module",
   "files": [
     "dist"