Skip to content

Harden bcrypt password hashing policy - #32

Draft
hoang12122 wants to merge 10 commits into
mainfrom
agent/harden-password-hashing
Draft

Harden bcrypt password hashing policy#32
hoang12122 wants to merge 10 commits into
mainfrom
agent/harden-password-hashing

Conversation

@hoang12122

@hoang12122 hoang12122 commented Jul 13, 2026

Copy link
Copy Markdown
Owner

What changed

  • Centralized bcrypt hashing and verification policy.
  • Added a bounded BCRYPT_COST configuration with a default of 12.
  • Added transparent rehashing after successful login when an existing bcrypt hash uses a lower cost.
  • Added a host benchmark command to select a suitable production work factor.
  • Documented the production configuration in .env.example.

Why

Password hashing was already using bcrypt, but the work factor was hard-coded at 10 in multiple paths. This change makes the work factor centrally managed and supports gradual upgrades without forcing password resets.

Compatibility

Existing bcrypt hashes remain valid. They are upgraded only after a successful login and are never downgraded when their current cost is higher than the configured value.

Validation planned

  • TypeScript typecheck
  • Lint
  • Password hashing benchmark on the deployment host
  • Security and Acceptance Gate, Docker Acceptance Gate, HURC1 IRONCLAD CI/CD PIPELINE, and CodeQL Advanced after merge to main

@coderabbitai

coderabbitai Bot commented Jul 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d7ac45e3-8404-4214-a7f7-f060359b71a6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch agent/harden-password-hashing

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@hoang12122 ChatGPT Codex Connector

hoang12122 commented Jul 13, 2026

Copy link
Copy Markdown
Owner Author

CI follow-up:

The failing Changed-file design boundary gate was caused by src/lib/services/user-service.ts reaching 411 lines, not by twofa-service.ts. The branch has been refactored so user-service.ts is now below the 300-line boundary, while password management and role/password-reset administration were moved into focused modules:

  • src/lib/services/user-password-service.ts
  • src/lib/services/user-access-service.ts

user-service.ts re-exports the moved functions, preserving existing import paths. The GitHub Actions workflows have restarted on the new head commit.

This was referenced Jul 13, 2026
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hoang12122