feat(auth): switch password hashing to argon2id with legacy auto-upgrade

- hashPassword now emits argon2id (same params as the legacy AtomCMS
  Laravel setup: memory 64MB, iterations 4, parallelism 1)
- legacy md5 and bcrypt hashes are verified and auto-upgraded to
  argon2id on successful login (CONVERT_PASSWORDS=true)
- replace BCRYPT_ROUNDS env with ARGON2_MEMORY_KB / ARGON2_ITERATIONS /
  ARGON2_PARALLELISM
- update README and add tests for argon2id and bcrypt upgrade paths

.env.example

@@ -32,7 +32,9 @@ NEXT_PUBLIC_IMAGER_URL=http://localhost:3002/imaging
 AUTH_SECRET=your-super-secret-auth-key-change-this-min-32-chars
 APP_KEY=base64:your-app-key-here=
 CONVERT_PASSWORDS=true
-BCRYPT_ROUNDS=12
+ARGON2_MEMORY_KB=65536
+ARGON2_ITERATIONS=4
+ARGON2_PARALLELISM=1
 
 # --- PATHS ---
 BADGE_UPLOAD_DIR=./public/assets/images/badges

README.md

@@ -2,7 +2,7 @@
 
 A modern, high-performance content management system for Habbo hotel emulators, built on **Next.js 16** (App Router) with **Drizzle ORM** and **React 19**. Designed to integrate seamlessly with Polaris / Arcturus Morningstar MySQL/MariaDB databases.
 
-Features a premium animated homepage (typewriter hero, floating orbs, scroll counters), a full admin panel, NextAuth authentication (bcrypt with MD5-to-bcrypt upgrade), real-time RCON communication, Server-Sent Events for live radio data, smooth page transitions, and PM2 production deployment.
+Features a premium animated homepage (typewriter hero, floating orbs, scroll counters), a full admin panel, NextAuth authentication (argon2id hashing with legacy md5/bcrypt auto-upgrade), real-time RCON communication, Server-Sent Events for live radio data, smooth page transitions, and PM2 production deployment.
 
 ---
 

src/env.ts

@@ -50,13 +50,16 @@ const schema = z
 		// Laravel APP_KEY (base64:...) — needed to read existing 2FA secrets.
 		APP_KEY: z.string().optional(),
 
-		// Mirrors Laravel config('habbo.site.convert_passwords') — enables md5->bcrypt upgrade.
+		// Mirrors Laravel config('habbo.site.convert_passwords') — enables
+		// legacy md5/bcrypt hashes to be upgraded to argon2id on login.
 		CONVERT_PASSWORDS: z
 			.string()
 			.optional()
 			.transform((v) => v === "true" || v === "1"),
-		// Bcrypt cost factor (rounds).
-		BCRYPT_ROUNDS: z.coerce.number().int().positive().default(12),
+		// Argon2id parameters — defaults match the old AtomCMS (Laravel) setup.
+		ARGON2_MEMORY_KB: z.coerce.number().int().positive().default(65_536),
+		ARGON2_ITERATIONS: z.coerce.number().int().positive().default(4),
+		ARGON2_PARALLELISM: z.coerce.number().int().positive().default(1),
 		// Filesystem dir the badge uploader writes <code>.gif into (the emulator's
 		// badge image folder, e.g. .../assets/c_images/album1584). Upload is disabled
 		// when unset.

src/lib/auth.ts

@@ -176,7 +176,7 @@ export const { handlers, signOut, auth } = NextAuth({
 					return null;
 				}
 
-				// Byte-compatible AtomCMS check (bcrypt + md5->bcrypt upgrade).
+				// Byte-compatible AtomCMS check (argon2id + legacy md5/bcrypt upgrade).
 				if (!user.password) return null;
 				const res = await checkLogin(password, user.password, {
 					convertPasswords: env.CONVERT_PASSWORDS,

src/lib/auth/password.ts

@@ -1,16 +1,18 @@
 import { randomBytes } from "node:crypto";
-import { bcrypt, bcryptVerify, md5 } from "hash-wasm";
+import { argon2id, argon2Verify, bcryptVerify, md5 } from "hash-wasm";
 
 import { env } from "@/env";
 
 export async function hashPassword(password: string): Promise<string> {
-	const h = await bcrypt({
+	return await argon2id({
 		password,
 		salt: randomBytes(16),
-		costFactor: env.BCRYPT_ROUNDS,
+		parallelism: env.ARGON2_PARALLELISM,
+		iterations: env.ARGON2_ITERATIONS,
+		memorySize: env.ARGON2_MEMORY_KB,
+		hashLength: 32,
 		outputType: "encoded",
 	});
-	return h.replace(/^\$2[ab]\$/, "$2y$");
 }
 
 export async function md5Hex(input: string): Promise<string> {
@@ -27,18 +29,39 @@ export async function isMd5Of(
 	);
 }
 
+export async function isArgon2idOf(
+	password: string,
+	stored: string,
+): Promise<boolean> {
+	if (!/^\$argon2id\$/.test(stored)) return false;
+	try {
+		return await argon2Verify({ password, hash: stored });
+	} catch {
+		return false;
+	}
+}
+
+/** Legacy bcrypt support — only kept to verify & auto-upgrade old accounts. */
+export async function isBcryptOf(
+	password: string,
+	stored: string,
+): Promise<boolean> {
+	if (!/^\$2[aby]\$/.test(stored)) return false;
+	try {
+		return await bcryptVerify({ password, hash: stored });
+	} catch {
+		return false;
+	}
+}
+
 export async function verifyPassword(
 	password: string,
 	stored: string,
 ): Promise<boolean> {
-	if (/^\$2[aby]\$/.test(stored)) {
-		try {
-			return await bcryptVerify({ password, hash: stored });
-		} catch {
-			return false;
-		}
+	if (/^\$argon2id\$/.test(stored)) {
+		return isArgon2idOf(password, stored);
 	}
-	return false;
+	return isBcryptOf(password, stored);
 }
 
 export interface LoginCheck {
@@ -54,5 +77,11 @@ export async function checkLogin(
 	if (opts.convertPasswords && (await isMd5Of(password, stored))) {
 		return { valid: true, upgradedHash: await hashPassword(password) };
 	}
+	if (opts.convertPasswords && (await isArgon2idOf(password, stored))) {
+		return { valid: true };
+	}
+	if (opts.convertPasswords && (await isBcryptOf(password, stored))) {
+		return { valid: true, upgradedHash: await hashPassword(password) };
+	}
 	return { valid: await verifyPassword(password, stored) };
 }