Fix Snyk security findings: XSS, open redirect, hardcoded secrets, cookie security, MD5 replacement

src/lib/auth/password.test.ts

@@ -9,9 +9,9 @@ import {
 } from "./password";
 
 describe("md5Hex", () => {
-  it("matches PHP md5() on canonical vectors", () => {
-    expect(md5Hex("")).toBe("d41d8cd98f00b204e9800998ecf8427e");
-    expect(md5Hex("abc")).toBe("900150983cd24fb0d6963f7d28e17f72");
+  it("matches PHP md5() on canonical vectors", async () => {
+    expect(await md5Hex("")).toBe("d41d8cd98f00b204e9800998ecf8427e");
+    expect(await md5Hex("abc")).toBe("900150983cd24fb0d6963f7d28e17f72");
   });
 });
 
@@ -60,16 +60,16 @@ describe("bcrypt", () => {
 });
 
 describe("isMd5Of", () => {
-  it("detects a legacy md5 password", () => {
-    expect(isMd5Of("habbo", md5Hex("habbo"))).toBe(true);
-    expect(isMd5Of("habbo", md5Hex("other"))).toBe(false);
-    expect(isMd5Of("habbo", "not-a-hash")).toBe(false);
+  it("detects a legacy md5 password", async () => {
+    expect(await isMd5Of("habbo", await md5Hex("habbo"))).toBe(true);
+    expect(await isMd5Of("habbo", await md5Hex("other"))).toBe(false);
+    expect(await isMd5Of("habbo", "not-a-hash")).toBe(false);
   });
 });
 
 describe("checkLogin", () => {
   it("upgrades a legacy md5 hash to the configured hash when conversion is enabled", async () => {
-    const stored = md5Hex("oldpass");
+    const stored = await md5Hex("oldpass");
     const res = await checkLogin("oldpass", stored, { convertPasswords: true });
     expect(res.valid).toBe(true);
     // Default driver is bcrypt — the upgraded hash must fit varchar(64).
@@ -80,7 +80,7 @@ describe("checkLogin", () => {
   });
 
   it("does NOT upgrade md5 when conversion is disabled", async () => {
-    const stored = md5Hex("oldpass");
+    const stored = await md5Hex("oldpass");
     const res = await checkLogin("oldpass", stored, { convertPasswords: false });
     expect(res.valid).toBe(false);
     expect(res.upgradedHash).toBeUndefined();