Skip to content

Commit

Permalink
deps: switch from bcrypt to bcryptjs (#4640)
Browse files Browse the repository at this point in the history
* test: add test for BCryptHasher

* chore(deps): replace `bcrypt` with `bcryptjs`

* enhance: simplify BCryptHasher
  • Loading branch information
marcelgerber authored Mar 7, 2025
1 parent 3ad6c45 commit 38bd274
Show file tree
Hide file tree
Showing 4 changed files with 67 additions and 143 deletions.
46 changes: 46 additions & 0 deletions db/hashers.test.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
import { describe, expect, it } from "vitest"
import { BCryptHasher } from "./hashers.js"

describe(BCryptHasher, () => {
it("should encode a password", async () => {
const hasher = new BCryptHasher()
hasher.saltRounds = 4 // for faster tests
const password = "password"
const hash = await hasher.encode(password)
expect(hash).toContain("bcrypt")
})

it("should verify a hashed password", async () => {
const hasher = new BCryptHasher()
hasher.saltRounds = 4 // for faster tests
const password = "password"
const hash = await hasher.encode(password)
const result = await hasher.verify(password, hash)
expect(result).toBe(true)
})

it("should verify a pre-hashed password", async () => {
const hasher = new BCryptHasher()
const password = "password"
const hashedPasswords =
// hashes for "password"
[
"bcrypt$$2b$12$TF65ro5CW6A5Ai2qvVOSsO9h/rZbYMI19kX2CLV/7F5VeeHZkTJaC",
"bcrypt$$2b$04$JlvbPo81NHviVoeMv1DVTu0QmhB9K21jnaaYgMC.qShgQ0uyhfR.S",
]

for (const hashedPassword of hashedPasswords) {
const result = await hasher.verify(password, hashedPassword)
expect(result).toBe(true)
}
})

it("should not verify a wrong password", async () => {
const hasher = new BCryptHasher()
const password = "wrongPassword"
const hashedPassword =
"bcrypt$$2b$12$TF65ro5CW6A5Ai2qvVOSsO9h/rZbYMI19kX2CLV/7F5VeeHZkTJaC" // hash for "password"
const result = await hasher.verify(password, hashedPassword)
expect(result).toBe(false)
})
})
11 changes: 3 additions & 8 deletions db/hashers.ts
Original file line number Diff line number Diff line change
@@ -1,16 +1,11 @@
import bcrypt from "bcrypt"
import bcrypt from "bcryptjs"

export class BCryptHasher {
private algorithm = "bcrypt"
private iterations = 12

private async salt(): Promise<string> {
return bcrypt.genSalt(this.iterations)
}
saltRounds = 12 // only exposed for testing, where we use fewer rounds for faster tests

async encode(password: string): Promise<string> {
const salt = await this.salt()
const key = await bcrypt.hash(password, salt)
const key = await bcrypt.hash(password, this.saltRounds)
return `${this.algorithm}$${key}`
}

Expand Down
3 changes: 1 addition & 2 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@
"algoliasearch": "^4.23.2",
"antd": "^5.24.0",
"archieml": "^0.5.0",
"bcrypt": "^5.1.0",
"bcryptjs": "^3.0.2",
"bootstrap": "^4.6.1",
"cheerio": "1.0.0-rc.12",
"chunk-text": "^2.0.1",
Expand Down Expand Up @@ -181,7 +181,6 @@
"@testing-library/jest-dom": "^6.6.3",
"@testing-library/react": "^12.1.5",
"@tsconfig/node22": "^22.0.0",
"@types/bcrypt": "^5.0.0",
"@types/chunk-text": "^1.0.0",
"@types/codemirror": "^5.60.5",
"@types/colorbrewer": "^1.0.29",
Expand Down
150 changes: 17 additions & 133 deletions yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -2553,25 +2553,6 @@ __metadata:
languageName: node
linkType: hard

"@mapbox/node-pre-gyp@npm:^1.0.10":
version: 1.0.10
resolution: "@mapbox/node-pre-gyp@npm:1.0.10"
dependencies:
detect-libc: "npm:^2.0.0"
https-proxy-agent: "npm:^5.0.0"
make-dir: "npm:^3.1.0"
node-fetch: "npm:^2.6.7"
nopt: "npm:^5.0.0"
npmlog: "npm:^5.0.1"
rimraf: "npm:^3.0.2"
semver: "npm:^7.3.5"
tar: "npm:^6.1.11"
bin:
node-pre-gyp: bin/node-pre-gyp
checksum: 10/ebdde8d64be15755cec0deed373b99d518aff48ff48a7e001db8d52da76df05dd9b76ccf532bb8f9fdc575b2c2517117885cd8cb5bacc31853ef32b6cc492533
languageName: node
linkType: hard

"@napi-rs/wasm-runtime@npm:0.2.4":
version: 0.2.4
resolution: "@napi-rs/wasm-runtime@npm:0.2.4"
Expand Down Expand Up @@ -5171,15 +5152,6 @@ __metadata:
languageName: node
linkType: hard

"@types/bcrypt@npm:^5.0.0":
version: 5.0.0
resolution: "@types/bcrypt@npm:5.0.0"
dependencies:
"@types/node": "npm:*"
checksum: 10/257d71d410c7c8111893ec04f0eb3434d2c0432460da362ef4e09580afb5e336bd017340fa5f2a8723ade96d32064b5087d85da4d1bf1200f4d066824ea88cf0
languageName: node
linkType: hard

"@types/body-parser@npm:*":
version: 1.17.0
resolution: "@types/body-parser@npm:1.17.0"
Expand Down Expand Up @@ -6784,7 +6756,7 @@ __metadata:
languageName: node
linkType: hard

"aproba@npm:2.0.0, aproba@npm:^1.0.3 || ^2.0.0":
"aproba@npm:2.0.0":
version: 2.0.0
resolution: "aproba@npm:2.0.0"
checksum: 10/c2b9a631298e8d6f3797547e866db642f68493808f5b37cd61da778d5f6ada890d16f668285f7d60bd4fc3b03889bd590ffe62cf81b700e9bb353431238a0a7b
Expand All @@ -6805,16 +6777,6 @@ __metadata:
languageName: node
linkType: hard

"are-we-there-yet@npm:^2.0.0":
version: 2.0.0
resolution: "are-we-there-yet@npm:2.0.0"
dependencies:
delegates: "npm:^1.0.0"
readable-stream: "npm:^3.6.0"
checksum: 10/ea6f47d14fc33ae9cbea3e686eeca021d9d7b9db83a306010dd04ad5f2c8b7675291b127d3fcbfcbd8fec26e47b3324ad5b469a6cc3733a582f2fe4e12fc6756
languageName: node
linkType: hard

"argparse@npm:^1.0.7":
version: 1.0.10
resolution: "argparse@npm:1.0.10"
Expand Down Expand Up @@ -7172,13 +7134,12 @@ __metadata:
languageName: node
linkType: hard

"bcrypt@npm:^5.1.0":
version: 5.1.0
resolution: "bcrypt@npm:5.1.0"
dependencies:
"@mapbox/node-pre-gyp": "npm:^1.0.10"
node-addon-api: "npm:^5.0.0"
checksum: 10/6477ddb871e6ad01b88cb1b0fe9cb500484c820a05bd9900158ad724b430ac3f0bf3a6dc83eeccd7bf0b46f29648d0c08bf5e0869406f6636bcdf9ca646f33f7
"bcryptjs@npm:^3.0.2":
version: 3.0.2
resolution: "bcryptjs@npm:3.0.2"
bin:
bcrypt: bin/bcrypt
checksum: 10/02c37e7298aba74e13e0576d63617cc1c9005efc165e55c11b287dc17192bedce8cd6f6e78180203c2519a211d9eb77ff14b286f962e2f0b93c08d2ada02dc22
languageName: node
linkType: hard

Expand Down Expand Up @@ -7916,7 +7877,7 @@ __metadata:
languageName: node
linkType: hard

"color-support@npm:1.1.3, color-support@npm:^1.1.2":
"color-support@npm:1.1.3":
version: 1.1.3
resolution: "color-support@npm:1.1.3"
bin:
Expand Down Expand Up @@ -8102,7 +8063,7 @@ __metadata:
languageName: node
linkType: hard

"console-control-strings@npm:^1.0.0, console-control-strings@npm:^1.1.0":
"console-control-strings@npm:^1.1.0":
version: 1.1.0
resolution: "console-control-strings@npm:1.1.0"
checksum: 10/27b5fa302bc8e9ae9e98c03c66d76ca289ad0c61ce2fe20ab288d288bee875d217512d2edb2363fc83165e88f1c405180cf3f5413a46e51b4fe1a004840c6cdb
Expand Down Expand Up @@ -9057,13 +9018,6 @@ __metadata:
languageName: node
linkType: hard

"delegates@npm:^1.0.0":
version: 1.0.0
resolution: "delegates@npm:1.0.0"
checksum: 10/a51744d9b53c164ba9c0492471a1a2ffa0b6727451bdc89e31627fdf4adda9d51277cfcbfb20f0a6f08ccb3c436f341df3e92631a3440226d93a8971724771fd
languageName: node
linkType: hard

"denque@npm:^2.1.0":
version: 2.1.0
resolution: "denque@npm:2.1.0"
Expand Down Expand Up @@ -9099,7 +9053,7 @@ __metadata:
languageName: node
linkType: hard

"detect-libc@npm:^2.0.0, detect-libc@npm:^2.0.3":
"detect-libc@npm:^2.0.3":
version: 2.0.3
resolution: "detect-libc@npm:2.0.3"
checksum: 10/b4ea018d623e077bd395f168a9e81db77370dde36a5b01d067f2ad7989924a81d31cb547ff764acb2aa25d50bb7fdde0b0a93bec02212b0cb430621623246d39
Expand Down Expand Up @@ -10825,23 +10779,6 @@ __metadata:
languageName: node
linkType: hard

"gauge@npm:^3.0.0":
version: 3.0.2
resolution: "gauge@npm:3.0.2"
dependencies:
aproba: "npm:^1.0.3 || ^2.0.0"
color-support: "npm:^1.1.2"
console-control-strings: "npm:^1.0.0"
has-unicode: "npm:^2.0.1"
object-assign: "npm:^4.1.1"
signal-exit: "npm:^3.0.0"
string-width: "npm:^4.2.3"
strip-ansi: "npm:^6.0.1"
wide-align: "npm:^1.1.2"
checksum: 10/46df086451672a5fecd58f7ec86da74542c795f8e00153fbef2884286ce0e86653c3eb23be2d0abb0c4a82b9b2a9dec3b09b6a1cf31c28085fa0376599a26589
languageName: node
linkType: hard

"gaxios@npm:^5.0.0, gaxios@npm:^5.0.1":
version: 5.0.2
resolution: "gaxios@npm:5.0.2"
Expand Down Expand Up @@ -11129,7 +11066,7 @@ __metadata:
languageName: node
linkType: hard

"glob@npm:^7.0.0, glob@npm:^7.1.2, glob@npm:^7.1.3":
"glob@npm:^7.0.0, glob@npm:^7.1.2":
version: 7.2.3
resolution: "glob@npm:7.2.3"
dependencies:
Expand Down Expand Up @@ -11309,7 +11246,6 @@ __metadata:
"@testing-library/react": "npm:^12.1.5"
"@tippyjs/react": "npm:^4.2.6"
"@tsconfig/node22": "npm:^22.0.0"
"@types/bcrypt": "npm:^5.0.0"
"@types/chunk-text": "npm:^1.0.0"
"@types/codemirror": "npm:^5.60.5"
"@types/colorbrewer": "npm:^1.0.29"
Expand Down Expand Up @@ -11358,7 +11294,7 @@ __metadata:
algoliasearch: "npm:^4.23.2"
antd: "npm:^5.24.0"
archieml: "npm:^0.5.0"
bcrypt: "npm:^5.1.0"
bcryptjs: "npm:^3.0.2"
bootstrap: "npm:^4.6.1"
bundlewatch: "npm:^0.4.0"
cheerio: "npm:1.0.0-rc.12"
Expand Down Expand Up @@ -11599,7 +11535,7 @@ __metadata:
languageName: node
linkType: hard

"has-unicode@npm:2.0.1, has-unicode@npm:^2.0.1":
"has-unicode@npm:2.0.1":
version: 2.0.1
resolution: "has-unicode@npm:2.0.1"
checksum: 10/041b4293ad6bf391e21c5d85ed03f412506d6623786b801c4ab39e4e6ca54993f13201bceb544d92963f9e0024e6e7fbf0cb1d84c9d6b31cb9c79c8c990d13d8
Expand Down Expand Up @@ -13766,15 +13702,6 @@ __metadata:
languageName: node
linkType: hard

"make-dir@npm:^3.1.0":
version: 3.1.0
resolution: "make-dir@npm:3.1.0"
dependencies:
semver: "npm:^6.0.0"
checksum: 10/484200020ab5a1fdf12f393fe5f385fc8e4378824c940fba1729dcd198ae4ff24867bc7a5646331e50cead8abff5d9270c456314386e629acec6dff4b8016b78
languageName: node
linkType: hard

"make-fetch-happen@npm:^13.0.0, make-fetch-happen@npm:^13.0.1":
version: 13.0.1
resolution: "make-fetch-happen@npm:13.0.1"
Expand Down Expand Up @@ -14497,15 +14424,6 @@ __metadata:
languageName: node
linkType: hard

"node-addon-api@npm:^5.0.0":
version: 5.1.0
resolution: "node-addon-api@npm:5.1.0"
dependencies:
node-gyp: "npm:latest"
checksum: 10/595f59ffb4630564f587c502119cbd980d302e482781021f3b479f5fc7e41cf8f2f7280fdc2795f32d148e4f3259bd15043c52d4a3442796aa6f1ae97b959636
languageName: node
linkType: hard

"node-domexception@npm:1.0.0":
version: 1.0.0
resolution: "node-domexception@npm:1.0.0"
Expand Down Expand Up @@ -14662,17 +14580,6 @@ __metadata:
languageName: node
linkType: hard

"nopt@npm:^5.0.0":
version: 5.0.0
resolution: "nopt@npm:5.0.0"
dependencies:
abbrev: "npm:1"
bin:
nopt: bin/nopt.js
checksum: 10/00f9bb2d16449469ba8ffcf9b8f0eae6bae285ec74b135fec533e5883563d2400c0cd70902d0a7759e47ac031ccf206ace4e86556da08ed3f1c66dda206e9ccd
languageName: node
linkType: hard

"nopt@npm:^7.0.0, nopt@npm:^7.2.1":
version: 7.2.1
resolution: "nopt@npm:7.2.1"
Expand Down Expand Up @@ -14835,18 +14742,6 @@ __metadata:
languageName: node
linkType: hard

"npmlog@npm:^5.0.1":
version: 5.0.1
resolution: "npmlog@npm:5.0.1"
dependencies:
are-we-there-yet: "npm:^2.0.0"
console-control-strings: "npm:^1.1.0"
gauge: "npm:^3.0.0"
set-blocking: "npm:^2.0.0"
checksum: 10/f42c7b9584cdd26a13c41a21930b6f5912896b6419ab15be88cc5721fc792f1c3dd30eb602b26ae08575694628ba70afdcf3675d86e4f450fc544757e52726ec
languageName: node
linkType: hard

"nth-check@npm:^2.0.1":
version: 2.0.1
resolution: "nth-check@npm:2.0.1"
Expand Down Expand Up @@ -17238,7 +17133,7 @@ __metadata:
languageName: node
linkType: hard

"readable-stream@npm:^3.0.0, readable-stream@npm:^3.0.2, readable-stream@npm:^3.1.1, readable-stream@npm:^3.4.0, readable-stream@npm:^3.6.0":
"readable-stream@npm:^3.0.0, readable-stream@npm:^3.0.2, readable-stream@npm:^3.1.1, readable-stream@npm:^3.4.0":
version: 3.6.0
resolution: "readable-stream@npm:3.6.0"
dependencies:
Expand Down Expand Up @@ -17593,17 +17488,6 @@ __metadata:
languageName: node
linkType: hard

"rimraf@npm:^3.0.2":
version: 3.0.2
resolution: "rimraf@npm:3.0.2"
dependencies:
glob: "npm:^7.1.3"
bin:
rimraf: bin.js
checksum: 10/063ffaccaaaca2cfd0ef3beafb12d6a03dd7ff1260d752d62a6077b5dfff6ae81bea571f655bb6b589d366930ec1bdd285d40d560c0dae9b12f125e54eb743d5
languageName: node
linkType: hard

"rimraf@npm:^4.4.1":
version: 4.4.1
resolution: "rimraf@npm:4.4.1"
Expand Down Expand Up @@ -17929,7 +17813,7 @@ __metadata:
languageName: node
linkType: hard

"semver@npm:^6.0.0, semver@npm:^6.3.1":
"semver@npm:^6.3.1":
version: 6.3.1
resolution: "semver@npm:6.3.1"
bin:
Expand Down Expand Up @@ -18215,7 +18099,7 @@ __metadata:
languageName: node
linkType: hard

"signal-exit@npm:3.0.7, signal-exit@npm:^3.0.0, signal-exit@npm:^3.0.2, signal-exit@npm:^3.0.3":
"signal-exit@npm:3.0.7, signal-exit@npm:^3.0.2, signal-exit@npm:^3.0.3":
version: 3.0.7
resolution: "signal-exit@npm:3.0.7"
checksum: 10/a2f098f247adc367dffc27845853e9959b9e88b01cb301658cfe4194352d8d2bb32e18467c786a7fe15f1d44b233ea35633d076d5e737870b7139949d1ab6318
Expand Down Expand Up @@ -20463,7 +20347,7 @@ __metadata:
languageName: node
linkType: hard

"wide-align@npm:1.1.5, wide-align@npm:^1.1.2":
"wide-align@npm:1.1.5":
version: 1.1.5
resolution: "wide-align@npm:1.1.5"
dependencies:
Expand Down

0 comments on commit 38bd274

Please sign in to comment.