Harden bcrypt password hashing policy

[hoang12122]

What changed

• Centralized bcrypt hashing and verification policy.
• Added a bounded BCRYPT_COST configuration with a default of 12.
• Added transparent rehashing after successful login when an existing bcrypt hash uses a lower cost.
• Added a host benchmark command to select a suitable production work factor.
• Documented the production configuration in .env.example.

Why

Password hashing was already using bcrypt, but the work factor was hard-coded at 10 in multiple paths. This change makes the work factor centrally managed and supports gradual upgrades without forcing password resets.

Compatibility

Existing bcrypt hashes remain valid. They are upgraded only after a successful login and are never downgraded when their current cost is higher than the configured value.

Validation planned

• TypeScript typecheck
• Lint
• Password hashing benchmark on the deployment host
• Security and Acceptance Gate, Docker Acceptance Gate, HURC1 IRONCLAD CI/CD PIPELINE, and CodeQL Advanced after merge to main

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d7ac45e3-8404-4214-a7f7-f060359b71a6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/harden-password-hashing

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hoang12122]

CI follow-up:

The failing Changed-file design boundary gate was caused by src/lib/services/user-service.ts reaching 411 lines, not by twofa-service.ts. The branch has been refactored so user-service.ts is now below the 300-line boundary, while password management and role/password-reset administration were moved into focused modules:

• src/lib/services/user-password-service.ts
• src/lib/services/user-access-service.ts

user-service.ts re-exports the moved functions, preserving existing import paths. The GitHub Actions workflows have restarted on the new head commit.