Do not store hash secret in the DB

Author: devksingh4

src/api/functions/uin.ts

@@ -1,6 +1,6 @@
 import { DynamoDBClient, PutItemCommand } from "@aws-sdk/client-dynamodb";
 import { marshall } from "@aws-sdk/util-dynamodb";
-import { hash } from "argon2";
+import { argon2id, hash } from "argon2";
 import { genericConfig } from "common/config.js";
 import {
   BaseError,
@@ -93,7 +93,17 @@ export async function getUinHash({
   pepper,
   uin,
 }: HashUinInputs): Promise<string> {
-  return hash(uin, { salt: Buffer.from(pepper) });
+  // we set the defaults again because we do direct string comparisions
+  return hash(uin, {
+    secret: Buffer.from(pepper),
+    hashLength: 32,
+    timeCost: 3,
+    memoryCost: 65536,
+    parallelism: 4,
+    type: argon2id,
+    version: 19,
+    salt: Buffer.from("acmuiucuin"),
+  });
 }
 
 export async function getHashedUserUin({

tests/unit/functions/uin.test.ts

@@ -0,0 +1,36 @@
+import { describe, expect, test } from "vitest";
+import { getUinHash } from "../../../src/api/functions/uin.js";
+
+describe("UIN hashing test", async () => {
+  test("Hashes are the same as previously run", async () => {
+    const pepper = "2c8feda7-17af-4cd1-b783-0097f61a99f9"
+    const uin = "123456789";
+    const expectedHash = "$argon2id$v=19$m=65536,t=3,p=4$YWNtdWl1Y3Vpbg$nTyHsSnzvhe9+UIVEb/ol+k8dU1qTSEFoui6Hq8KbBY"
+    const hashed = await getUinHash({
+      pepper, uin
+    });
+    expect(hashed).toStrictEqual(expectedHash);
+  })
+  test("Hashes are the same from run to run", async () => {
+    const pepper = "c84b88f6-81cb-4748-b4a7-212431e10bbe"
+    const uin = "123456789";
+    const hashed1 = await getUinHash({
+      pepper, uin
+    });
+    const hashed2 = await getUinHash({
+      pepper, uin
+    });
+    expect(hashed1).toStrictEqual(hashed2);
+  })
+  test("Hashes are different from run to run", async () => {
+    const pepper = "c84b88f6-81cb-4748-b4a7-212431e10bbe"
+    const uin = "123456789";
+    const hashed1 = await getUinHash({
+      pepper, uin
+    });
+    const hashed2 = await getUinHash({
+      pepper, uin: "987654321"
+    });
+    expect(hashed1).not.toStrictEqual(hashed2);
+  })
+})