@uln/auth 0.4.2 → 0.6.1

package/src/users.ts

@@ -1,4 +1,4 @@
-import { hashPassword, verifyPassword } from "./password.ts";
+import { hashPassword, MAX_PASSWORD_LENGTH, needsRehash, verifyPassword } from "./password.ts";
 import type { User, UserStore } from "./types.ts";
 
 const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
@@ -13,6 +13,8 @@ export async function createUser(
   input: { email: string; name: string; password?: string; isAdmin?: boolean },
 ): Promise<User> {
   if (!isValidEmail(input.email)) throw new Error("Invalid email address");
+  if (input.password !== undefined && input.password.length > MAX_PASSWORD_LENGTH)
+    throw new Error("Password is too long");
   const existing = await store.getUserByEmail(input.email);
   if (existing) throw new Error(`User with email ${input.email} already exists`);
 
@@ -35,12 +37,27 @@ export async function createUser(
   return user;
 }
 
+let dummyHash: Promise<string> | null = null;
+
+/**
+ * Check an email/password pair. When the user doesn't exist a dummy hash is still verified, so response timing
+ * doesn't reveal which emails have accounts. A correct password stored under older hashing parameters is re-hashed
+ * with the current ones.
+ */
 export async function verifyUserCredentials(store: UserStore, email: string, password: string): Promise<User | null> {
   const user = await store.getUserByEmail(email.toLowerCase());
-  if (!user) return null;
+  if (!user) {
+    dummyHash ??= hashPassword(crypto.randomUUID());
+    await verifyPassword(password, await dummyHash);
+    return null;
+  }
 
   const valid = await verifyPassword(password, user.passwordHash);
-  return valid ? user : null;
+  if (!valid) return null;
+  if (!needsRehash(user.passwordHash)) return user;
+  const upgraded: User = { ...user, passwordHash: await hashPassword(password), updatedAt: new Date().toISOString() };
+  await store.saveUser(upgraded);
+  return upgraded;
 }
 
 export async function updateName(store: UserStore, userId: string, name: string): Promise<void> {
@@ -56,6 +73,7 @@ export async function updateName(store: UserStore, userId: string, name: string)
 }
 
 export async function changePassword(store: UserStore, userId: string, newPassword: string): Promise<void> {
+  if (newPassword.length > MAX_PASSWORD_LENGTH) throw new Error("Password is too long");
   const user = await store.getUser(userId);
   if (!user) throw new Error(`User ${userId} not found`);
 

package/src/version.ts

@@ -0,0 +1,6 @@
+/**
+ * This library's version. Sent to the auth service on every login (`uln_v` on the return URL) so Admin → Sites can show
+ * which version each site runs and open upgrade PRs for the ones behind. `src/version.test.ts` keeps it equal to
+ * `package.json`.
+ */
+export const LIBRARY_VERSION = "0.6.1";