Leon SerfatyandClaude Fable 5
97e1d4c60b
Storage - Migrate document/media storage from local disk to DigitalOcean Spaces (S3); lib/storage.ts now streams via the S3 SDK; SPACES_* env vars required. - Add scripts/migrate-storage-to-spaces.ts (idempotent, one-time). Security hardening (all report findings) - DB pool fails closed in production when the CA cert is missing (no more silent unverified TLS); warns in dev. - trustProxy: 1 (was true) so X-Forwarded-For can't be spoofed to evade rate limits. - Login lockout keyed by (email, ip) so an attacker can't lock out a victim. - Superadmin auto-grant now requires a verified email. - CSRF tokens HMAC-signed; exact-path exemptions; logout no longer exempt. - Upload content-sniffing (magic bytes) rejects spoofed MIME types. - create-admin.ts reads creds from env/argv; seed-demo.ts guarded behind ALLOW_SEED. Production-blocker fixes - SPA deep-link/refresh no longer 500s (decorateReply fix); index.html served no-cache. - Invoice numbering is transaction-safe (per-firm advisory lock + max sequence), eliminating concurrent collisions and delete-reuse — no schema change. - Checkout guards against double-billing a firm already on a paid plan. - Fix render-loop in CreateInvoiceDrawer / ManualEntryDrawer (unstable effect deps). Honesty / trust - Remove fabricated testimonials, stats, strikethrough "was" prices, contact SLA, and the login-panel stats; replace with non-fabricated copy. - Fix cookie-policy consent-key mismatch. (Legal pages still need lawyer review.) Quality - Add Vitest unit tests (file-signature, password hashing) and GitHub Actions CI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
34 lines
1.3 KiB
TypeScript
34 lines
1.3 KiB
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import { hashPassword, verifyPassword } from '../src/auth/password.js';
|
|
|
|
describe('password hashing (argon2)', () => {
|
|
it('verifies a correct password against its hash', async () => {
|
|
const hash = await hashPassword('correct horse battery staple');
|
|
expect(await verifyPassword(hash, 'correct horse battery staple')).toBe(true);
|
|
});
|
|
|
|
it('rejects a wrong password', async () => {
|
|
const hash = await hashPassword('correct horse battery staple');
|
|
expect(await verifyPassword(hash, 'Tr0ub4dor&3')).toBe(false);
|
|
});
|
|
|
|
it('produces an argon2id hash, not plaintext', async () => {
|
|
const hash = await hashPassword('s3cret');
|
|
expect(hash).toMatch(/^\$argon2id\$/);
|
|
expect(hash).not.toContain('s3cret');
|
|
});
|
|
|
|
it('produces a different hash each time (random salt) but both verify', async () => {
|
|
const a = await hashPassword('same-password');
|
|
const b = await hashPassword('same-password');
|
|
expect(a).not.toBe(b);
|
|
expect(await verifyPassword(a, 'same-password')).toBe(true);
|
|
expect(await verifyPassword(b, 'same-password')).toBe(true);
|
|
});
|
|
|
|
it('is case-sensitive', async () => {
|
|
const hash = await hashPassword('CaseSensitive');
|
|
expect(await verifyPassword(hash, 'casesensitive')).toBe(false);
|
|
});
|
|
});
|