Remove argon2id, use bcrypt-only password hashing

src/lib/auth/password.test.ts

@@ -1,12 +1,6 @@
-import { randomBytes } from "node:crypto";
-import { argon2id } from "hash-wasm";
 import { describe, expect, it, vi } from "vitest";
 
 const mockEnv = vi.hoisted(() => ({
-	PASSWORD_HASH: undefined as string | undefined,
-	ARGON2_PARALLELISM: 1,
-	ARGON2_ITERATIONS: 4,
-	ARGON2_MEMORY_SIZE: 65536,
 	BCRYPT_ROUNDS: 12,
 }));
 
@@ -29,9 +23,8 @@ describe("md5Hex", () => {
 	});
 });
 
-describe("hashPassword (default driver: bcrypt)", () => {
+describe("hashPassword", () => {
 	it("emits a bcrypt hash and round-trips", async () => {
-		mockEnv.PASSWORD_HASH = undefined;
 		const h = await hashPassword("s3cret!");
 		expect(h).toMatch(/^\$2y\$\d{2}\$/);
 		expect(await verifyPassword("s3cret!", h)).toBe(true);
@@ -39,35 +32,8 @@ describe("hashPassword (default driver: bcrypt)", () => {
 	});
 });
 
-describe("hashPassword (PASSWORD_HASH=argon2id)", () => {
-	it("hashes with the AtomCMS params and round-trips", async () => {
-		mockEnv.PASSWORD_HASH = "argon2id";
-		mockEnv.ARGON2_MEMORY_SIZE = 1024;
-		mockEnv.ARGON2_ITERATIONS = 1;
-		const h = await hashPassword("s3cret!");
-		expect(h).toMatch(/^\$argon2id\$v=19\$m=1024,t=1,p=1\$/);
-		expect(await verifyPassword("s3cret!", h)).toBe(true);
-		expect(await verifyPassword("wrong", h)).toBe(false);
-	});
-});
-
 describe("verifyPassword", () => {
-	it("verifies argon2id hashes", async () => {
-		const h = await argon2id({
-			password: "hunter2",
-			salt: randomBytes(16),
-			outputType: "encoded",
-			parallelism: 1,
-			iterations: 4,
-			memorySize: 1024,
-			hashLength: 32,
-		});
-		expect(await verifyPassword("hunter2", h)).toBe(true);
-		expect(await verifyPassword("nope", h)).toBe(false);
-	});
-
 	it("verifies legacy bcrypt hashes ($2y$)", async () => {
-		mockEnv.PASSWORD_HASH = undefined;
 		const h = await hashPassword("hunter2");
 		expect(h).toMatch(/^\$2y\$/);
 		expect(await verifyPassword("hunter2", h)).toBe(true);
@@ -85,7 +51,6 @@ describe("isMd5Of", () => {
 
 describe("checkLogin", () => {
 	it("upgrades a legacy md5 hash to bcrypt when conversion is enabled", async () => {
-		mockEnv.PASSWORD_HASH = undefined;
 		const stored = await md5Hex("oldpass");
 		const res = await checkLogin("oldpass", stored, { convertPasswords: true });
 		expect(res.valid).toBe(true);
@@ -105,10 +70,9 @@ describe("checkLogin", () => {
 	});
 
 	it("validates an existing modern hash with no upgrade", async () => {
-		mockEnv.PASSWORD_HASH = undefined;
 		const stored = await hashPassword("modern");
 		const res = await checkLogin("modern", stored, { convertPasswords: true });
 		expect(res.valid).toBe(true);
 		expect(res.upgradedHash).toBeUndefined();
 	});
-});
+});