fix: resolve auth security issues - 2FA require TOTP on disable, rate limiting, timing-safe login, token expiry check

src/actions/auth-precheck.ts

@@ -2,6 +2,7 @@
 
 import { checkLogin } from "@/lib/auth/password";
 import { prisma } from "@/lib/prisma";
+import { clientIp, rateLimit } from "@/lib/rate-limit";
 import { env } from "@/env";
 
 export type PrecheckResult = "ok" | "invalid" | "twofactor";
@@ -18,6 +19,8 @@ export async function precheckLogin(
   const p = String(password ?? "");
   if (!u || !p) return "invalid";
 
+  if (!rateLimit(`precheck:${await clientIp()}`, 10, 5 * 60_000).ok) return "invalid";
+
   let user: { password: string; twoFactorConfirmedAt: Date | null } | null = null;
   try {
     user = await prisma.user.findUnique({
@@ -27,7 +30,15 @@ export async function precheckLogin(
   } catch {
     return "invalid";
   }
-  if (!user) return "invalid";
+  if (!user) {
+    // Prevent timing-based enumeration: always run a dummy hash check.
+    await checkLogin(
+      p,
+      "$2y$12$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcd",
+      { convertPasswords: false },
+    );
+    return "invalid";
+  }
 
   const res = await checkLogin(p, user.password, {
     convertPasswords: env.CONVERT_PASSWORDS,