refactor: extract shared login credential verification into auth/login-core

The username normalization, dummy-hash constant, password check and
email-verification gate were duplicated between precheckLogin and the
NextAuth credentials authorize handler. Move them into a single
login-core module so both paths share one source of truth and stay
consistent.

src/actions/auth-precheck.test.ts

@@ -1,19 +1,25 @@
 // @ts-nocheck
 import { beforeEach, describe, expect, it, vi } from "vitest";
-import { checkLogin } from "@/lib/auth/password";
 import { clientIp, rateLimit } from "@/lib/rate-limit";
 import { captchaConfig, verifyCaptcha } from "@/lib/services/captcha";
 import { siteSettings } from "@/lib/services/site-settings";
 import { precheckLogin } from "./auth-precheck";
 
-const { queryPreparedOne } = vi.hoisted(() => {
+const core = vi.hoisted(() => ({
-	const queryPreparedOne = vi.fn().mockResolvedValue(null);
+	getLoginUser: vi.fn(),
-	return { queryPreparedOne };
+	verifyLoginPassword: vi.fn(),
-});
+	isEmailUnverified: vi.fn(),
+	runDummyHashCheck: vi.fn(),
+	normalizeLoginInput: (username: unknown, password: unknown) => ({
+		username: String(username ?? "")
+			.normalize("NFC")
+			.trim(),
+		password: String(password ?? "").normalize("NFC"),
+	}),
+}));
 
 vi.mock("@/env", () => ({ env: { CONVERT_PASSWORDS: false } }));
-vi.mock("@/lib/auth/password", () => ({ checkLogin: vi.fn() }));
+vi.mock("@/lib/auth/login-core", () => core);
-vi.mock("@/lib/db", () => ({ queryPreparedOne }));
 vi.mock("@/lib/rate-limit", () => ({ clientIp: vi.fn(), rateLimit: vi.fn() }));
 vi.mock("@/lib/services/captcha", () => ({
 	captchaConfig: vi.fn(),
@@ -23,33 +29,35 @@ vi.mock("@/lib/services/site-settings", () => ({
 	siteSettings: { getBool: vi.fn() },
 }));
 
-beforeEach(() => {
+const user = (overrides = {}) => ({
-	vi.clearAllMocks();
-	vi.mocked(clientIp).mockResolvedValue("1.2.3.4");
-	vi.mocked(rateLimit).mockResolvedValue({ ok: true });
-	vi.mocked(checkLogin).mockResolvedValue({ valid: true } as never);
-	vi.mocked(captchaConfig).mockResolvedValue({ provider: "none" } as never);
-	queryPreparedOne.mockResolvedValue(null);
-});
-
-describe("precheckLogin", () => {
-	it("returns ok for valid login without 2FA", async () => {
-		queryPreparedOne.mockResolvedValue({
 	password: "hash",
 	twoFactorConfirmedAt: null,
 	mail: null,
 	mailVerified: "0",
-		});
+	...overrides,
+});
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	vi.mocked(clientIp).mockResolvedValue("1.2.3.4");
+	vi.mocked(rateLimit).mockResolvedValue({ ok: true });
+	vi.mocked(captchaConfig).mockResolvedValue({ provider: "none" } as never);
+	core.getLoginUser.mockResolvedValue(null);
+	core.verifyLoginPassword.mockResolvedValue({ valid: true });
+	core.isEmailUnverified.mockResolvedValue(false);
+	core.runDummyHashCheck.mockResolvedValue(undefined);
+});
+
+describe("precheckLogin", () => {
+	it("returns ok for valid login without 2FA", async () => {
+		core.getLoginUser.mockResolvedValue(user());
 		expect(await precheckLogin("user", "pass")).toBe("ok");
 	});
 
 	it("returns twofactor when 2FA is set up", async () => {
-		queryPreparedOne.mockResolvedValue({
+		core.getLoginUser.mockResolvedValue(
-			password: "hash",
+			user({ twoFactorConfirmedAt: new Date() }),
-			twoFactorConfirmedAt: new Date(),
+		);
-			mail: null,
-			mailVerified: "0",
-		});
 		expect(await precheckLogin("user", "pass")).toBe("twofactor");
 	});
 
@@ -62,30 +70,20 @@ describe("precheckLogin", () => {
 			provider: "hcaptcha",
 		} as never);
 		vi.mocked(verifyCaptcha).mockResolvedValue(false);
-		queryPreparedOne.mockResolvedValue({
+		core.getLoginUser.mockResolvedValue(user());
-			password: "hash",
-			twoFactorConfirmedAt: null,
-			mail: null,
-			mailVerified: "0",
-		});
 		expect(await precheckLogin("user", "pass", "bad-token")).toBe("captcha");
 	});
 
 	it("returns invalid when user not found (dummy hash check)", async () => {
-		queryPreparedOne.mockResolvedValue(null);
+		core.getLoginUser.mockResolvedValue(null);
 		const result = await precheckLogin("nonexistent", "pass");
 		expect(result).toBe("invalid");
-		expect(checkLogin).toHaveBeenCalled();
+		expect(core.runDummyHashCheck).toHaveBeenCalled();
 	});
 
 	it("returns unverified when email verification required", async () => {
-		queryPreparedOne.mockResolvedValue({
+		core.getLoginUser.mockResolvedValue(user({ mail: "[email protected]" }));
-			password: "hash",
+		core.isEmailUnverified.mockResolvedValue(true);
-			twoFactorConfirmedAt: null,
-			mail: "[email protected]",
-			mailVerified: "0",
-		});
-		vi.mocked(siteSettings.getBool).mockResolvedValue(true);
 		expect(await precheckLogin("user", "pass")).toBe("unverified");
 	});
 });

src/actions/auth-precheck.ts

@@ -1,11 +1,14 @@
 "use server";
 
-import { env } from "@/env";
+import {
-import { checkLogin } from "@/lib/auth/password";
+	getLoginUser,
-import { queryPreparedOne } from "@/lib/db";
+	isEmailUnverified,
+	normalizeLoginInput,
+	runDummyHashCheck,
+	verifyLoginPassword,
+} from "@/lib/auth/login-core";
 import { clientIp, rateLimit } from "@/lib/rate-limit";
 import { captchaConfig, verifyCaptcha } from "@/lib/services/captcha";
-import { siteSettings } from "@/lib/services/site-settings";
 
 export type PrecheckResult =
 	| "ok"
@@ -24,10 +27,7 @@ export async function precheckLogin(
 	password: string,
 	captchaToken?: string | null,
 ): Promise<PrecheckResult> {
-	const u = String(username ?? "")
+	const { username: u, password: p } = normalizeLoginInput(username, password);
-		.normalize("NFC")
-		.trim();
-	const p = String(password ?? "").normalize("NFC");
 	if (!u || !p) return "invalid";
 
 	const ip = await clientIp();
@@ -38,49 +38,17 @@ export async function precheckLogin(
 		if (!(await verifyCaptcha(captchaToken ?? null, ip))) return "captcha";
 	}
 
-	let user: {
+	const user = await getLoginUser(u);
-		password: string;
-		twoFactorConfirmedAt: Date | null;
-		mail: string | null;
-		mailVerified: string;
-	} | null;
-	try {
-		user = await queryPreparedOne<{
-			password: string;
-			twoFactorConfirmedAt: Date | null;
-			mail: string | null;
-			mailVerified: string;
-		}>(
-			`SELECT password, two_factor_confirmed_at AS twoFactorConfirmedAt,
-			        mail, mail_verified AS mailVerified
-			 FROM users WHERE username = ? LIMIT 1`,
-			[u],
-		);
-	} catch {
-		return "invalid";
-	}
 	if (!user) {
 		// Prevent timing-based enumeration: always run a dummy hash check.
-		await checkLogin(
+		await runDummyHashCheck(p);
-			p,
-			"$2y$12$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcd",
-			{
-				convertPasswords: false,
-			},
-		);
 		return "invalid";
 	}
 
-	const res = await checkLogin(p, user.password, {
+	const res = await verifyLoginPassword(user, p);
-		convertPasswords: env.CONVERT_PASSWORDS,
-	});
 	if (!res.valid) return "invalid";
 
-	if (
+	if (await isEmailUnverified(user)) {
-		(await siteSettings.getBool("require_email_verification", false)) &&
-		user.mail &&
-		user.mailVerified !== "1"
-	) {
 		return "unverified";
 	}
 

src/lib/auth.ts

@@ -1,85 +1,24 @@
-import { eq, sql } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import NextAuth from "next-auth";
 import Credentials from "next-auth/providers/credentials";
 import { env } from "@/env";
 import { getCachedJwtVersion } from "@/lib/auth/jwt-version-cache";
+import {
+	getLoginUser,
+	invalidateLoginCache,
+	isEmailUnverified,
+	normalizeLoginInput,
+	runDummyHashCheck,
+	verifyLoginPassword,
+} from "@/lib/auth/login-core";
+
+export { invalidateLoginCache };
+
 import { LaravelEncrypter } from "@/lib/auth/laravel-encrypter";
-import { checkLogin } from "@/lib/auth/password";
 import { verifyTotp } from "@/lib/auth/totp";
-import { cachedQuery, invalidateKey } from "@/lib/cached-db";
 import { db, User, WebsiteLoginLogs } from "@/lib/db";
 import { logger } from "@/lib/logger";
 import { clientIp, rateLimit } from "@/lib/rate-limit";
-import { siteSettings } from "@/lib/services/site-settings";
-
-interface LoginUser {
-	id: number;
-	username: string;
-	password: string | null;
-	rank: number;
-	mail: string | null;
-	mailVerified: string | null;
-	twoFactorConfirmedAt: string | null;
-	twoFactorSecret: string | null;
-}
-
-/**
- * Cached login user lookup — short TTL to survive brute-force attempts
- * while still reflecting recent password/account changes reasonably fast.
- */
-async function getLoginUser(username: string): Promise<LoginUser | null> {
-	return cachedQuery<LoginUser | null>(
-		`login:user:${username}`,
-		async () => {
-			const [result] = await db.execute<{
-				id: number;
-				username: string;
-				password: string | null;
-				rank: number;
-				mail: string | null;
-				mail_verified: string | null;
-				two_factor_confirmed_at: string | null;
-				two_factor_secret: string | null;
-			}>(sql`
-				SELECT id, username, password, rank, mail,
-				       mail_verified,
-				       two_factor_confirmed_at,
-				       two_factor_secret
-				FROM users
-				WHERE username = ${username}
-				LIMIT 1
-			`);
-			const rows = result as unknown as Array<{
-				id: number;
-				username: string;
-				password: string | null;
-				rank: number;
-				mail: string | null;
-				mail_verified: string | null;
-				two_factor_confirmed_at: string | null;
-				two_factor_secret: string | null;
-			}>;
-			return rows.length > 0
-				? {
-						id: rows[0].id,
-						username: rows[0].username,
-						password: rows[0].password,
-						rank: rows[0].rank,
-						mail: rows[0].mail,
-						mailVerified: rows[0].mail_verified,
-						twoFactorConfirmedAt: rows[0].two_factor_confirmed_at,
-						twoFactorSecret: rows[0].two_factor_secret,
-					}
-				: null;
-		},
-		15, // 15s TTL — brute-force protection without blocking legit changes
-	);
-}
-
-/** Call after password reset / rank change to invalidate the cached login row. */
-export async function invalidateLoginCache(username: string): Promise<void> {
-	await invalidateKey(`login:user:${username}`);
-}
 
 async function verify2faCode(userId: number, code: string): Promise<boolean> {
 	const [user] = await db
@@ -149,10 +88,10 @@ export const { handlers, signOut, auth } = NextAuth({
 				code: { label: "2FA code", type: "text" },
 			},
 			authorize: async (credentials) => {
-				const username = String(credentials?.username ?? "")
+				const { username, password } = normalizeLoginInput(
-					.normalize("NFC")
+					credentials?.username,
-					.trim();
+					credentials?.password,
-				const password = String(credentials?.password ?? "").normalize("NFC");
+				);
 				if (!username || !password) return null;
 
 				const ip = await clientIp();
@@ -163,28 +102,14 @@ export const { handlers, signOut, auth } = NextAuth({
 				const user = await getLoginUser(username);
 				if (!user) {
 					// Prevent timing-based enumeration: always run a dummy hash check.
-					await checkLogin(
+					await runDummyHashCheck(password);
-						password,
-						"$2y$12$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcd",
-						{
-							convertPasswords: false,
-						},
-					);
 					return null;
 				}
 
-				// Byte-compatible AtomCMS check (argon2id + legacy md5/bcrypt upgrade).
+				const res = await verifyLoginPassword(user, password);
-				if (!user.password) return null;
-				const res = await checkLogin(password, user.password, {
-					convertPasswords: env.CONVERT_PASSWORDS,
-				});
 				if (!res.valid) return null;
 
-				if (
+				if (await isEmailUnverified(user)) {
-					(await siteSettings.getBool("require_email_verification", false)) &&
-					user.mail &&
-					user.mailVerified !== "1"
-				) {
 					return null;
 				}
 

src/lib/auth/login-core.ts

@@ -0,0 +1,122 @@
+import { sql } from "drizzle-orm";
+import { env } from "@/env";
+import { checkLogin } from "@/lib/auth/password";
+import { cachedQuery, invalidateKey } from "@/lib/cached-db";
+import { db } from "@/lib/db";
+import { siteSettings } from "@/lib/services/site-settings";
+
+export interface LoginUser {
+	id: number;
+	username: string;
+	password: string | null;
+	rank: number;
+	mail: string | null;
+	mailVerified: string | null;
+	twoFactorConfirmedAt: string | null;
+	twoFactorSecret: string | null;
+}
+
+/**
+ * Fixed dummy bcrypt hash used to keep timing roughly constant when a username
+ * does not exist, so attackers can't enumerate accounts by response time.
+ */
+const DUMMY_BCRYPT_HASH =
+	"$2y$12$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcd";
+
+/**
+ * Normalize credentials exactly like the registration flow hashes them, so
+ * accounts with accented/non-ASCII usernames or passwords verify correctly.
+ */
+export function normalizeLoginInput(username: unknown, password: unknown) {
+	return {
+		username: String(username ?? "")
+			.normalize("NFC")
+			.trim(),
+		password: String(password ?? "").normalize("NFC"),
+	};
+}
+
+/**
+ * Cached login user lookup — short TTL to survive brute-force attempts
+ * while still reflecting recent password/account changes reasonably fast.
+ */
+export async function getLoginUser(
+	username: string,
+): Promise<LoginUser | null> {
+	return cachedQuery<LoginUser | null>(
+		`login:user:${username}`,
+		async () => {
+			const [result] = await db.execute<{
+				id: number;
+				username: string;
+				password: string | null;
+				rank: number;
+				mail: string | null;
+				mail_verified: string | null;
+				two_factor_confirmed_at: string | null;
+				two_factor_secret: string | null;
+			}>(sql`
+				SELECT id, username, password, rank, mail,
+				       mail_verified,
+				       two_factor_confirmed_at,
+				       two_factor_secret
+				FROM users
+				WHERE username = ${username}
+				LIMIT 1
+			`);
+			const rows = result as unknown as Array<{
+				id: number;
+				username: string;
+				password: string | null;
+				rank: number;
+				mail: string | null;
+				mail_verified: string | null;
+				two_factor_confirmed_at: string | null;
+				two_factor_secret: string | null;
+			}>;
+			return rows.length > 0
+				? {
+						id: rows[0].id,
+						username: rows[0].username,
+						password: rows[0].password,
+						rank: rows[0].rank,
+						mail: rows[0].mail,
+						mailVerified: rows[0].mail_verified,
+						twoFactorConfirmedAt: rows[0].two_factor_confirmed_at,
+						twoFactorSecret: rows[0].two_factor_secret,
+					}
+				: null;
+		},
+		15, // 15s TTL — brute-force protection without blocking legit changes
+	);
+}
+
+/** Call after password reset / rank change to invalidate the cached login row. */
+export async function invalidateLoginCache(username: string): Promise<void> {
+	await invalidateKey(`login:user:${username}`);
+}
+
+/** Runs a dummy hash check so missing-user responses stay timing-constant. */
+export async function runDummyHashCheck(password: string): Promise<void> {
+	await checkLogin(password, DUMMY_BCRYPT_HASH, { convertPasswords: false });
+}
+
+/** Verifies the password against the stored hash and reports a possible upgrade. */
+export async function verifyLoginPassword(
+	user: LoginUser,
+	password: string,
+): Promise<{ valid: boolean; upgradedHash?: string }> {
+	if (!user.password) return { valid: false };
+	return checkLogin(password, user.password, {
+		convertPasswords: env.CONVERT_PASSWORDS,
+	});
+}
+
+/** True when email verification is required but this account hasn't verified yet. */
+export async function isEmailUnverified(user: LoginUser): Promise<boolean> {
+	return (
+		(await siteSettings.getBool("require_email_verification", false)) &&
+		!!user.mail &&
+		user.mailVerified !== "1"
+	);
+}