luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(19): WR-03 make scrypt hashing async (threadpool) to avoid event-loop starvation DoS

Browse Source
This commit is contained in:
Lucas Berger
2026-06-17 20:30:28 -04:00
parent 322929aebe
commit 30ad25c026
8 changed files with 81 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/tests/routes/me.test.ts
+4 -4
View File
@@ -274,7 +274,7 @@ describe('POST /api/me/password — self-change password (AUTH-LOCAL-09)', () =>
const oldPassword = 'old-password-correct-123';
const newPassword = 'new-password-secure-456';
const storedHash = hashPassword(oldPassword);
const storedHash = await hashPassword(oldPassword);
let updatedHash: string | null = null;
// Mock sequence: resolveUserId (devBypass sets user), then:
@@ -326,15 +326,15 @@ describe('POST /api/me/password — self-change password (AUTH-LOCAL-09)', () =>
// The updatedHash must verify the new password
expect(updatedHash).not.toBeNull();
const { verifyPassword } = await import('../../src/auth/localCredentials.js');
expect(verifyPassword(updatedHash!, newPassword)).toBe(true);
expect(verifyPassword(updatedHash!, oldPassword)).toBe(false);
expect(await verifyPassword(updatedHash!, newPassword)).toBe(true);
expect(await verifyPassword(updatedHash!, oldPassword)).toBe(false);
});
it('Test 2: wrong currentPassword → 403 and update is NOT called', async () => {
const { db } = await import('../../src/db/client.js');
const realPassword = 'real-password-correct-789';
const storedHash = hashPassword(realPassword);
const storedHash = await hashPassword(realPassword);
let updateWasCalled = false;
let callCount = 0;